Publishing and Service Agreement “Carnet” — General Terms and Conditions

Courtesy translation — the French text is the only binding version. This document is an English translation of the French “Contrat d'édition et de service « Carnet » — Conditions générales”, version 2026-10-10 (in force since 10 October 2026; it replaces version 2026-10-09), provided for information only. The Client accepts the French text, and only the French text binds the parties; in the event of any discrepancy or difference of interpretation, the French text prevails. For a Client outside Switzerland, the conditions of the managed service outside Switzerland and the zone annex derogate from this agreement clause by clause and prevail over it (I.4); price, VAT, scope and several clauses below do not apply as written — read them in French alongside. Swiss statutes are cited by their official French abbreviations (CO, CPC, LPD, LAMal…), and federal acts by their number in the Classified Compilation of Federal Legislation (SR, in French RS); English renderings of their titles are non-official, English not being an official language of the Swiss Confederation. The numbering of sections and clauses is identical to that of the French text. Translator's notes appear in square brackets. Button labels are translated, with the French label in brackets: the French text is the one accepted. The conditions of the managed service outside Switzerland and the WORLD zone annex have their own courtesy translations, which are not binding either.

Parties

• The Publisher: David Lambrecht, publisher of the “Carnet” software, Sierre (Valais), Switzerland.
• The Client: the self-employed healthcare professional who uses the software, acting in the course of their professional activity (not a consumer within the meaning of Art. 32 CPC).

Version: 2026-10-10, in force since 10 October 2026 (replaces version 2026-10-09; a unique identifier shared with the application: the version accepted by the Client and the timestamp of their acceptance are recorded by the application and sent as a receipt to the server, see section 14).

Before accepting — the specially highlighted clauses. This agreement is accepted by a single action, timestamped and linked to its version (section 14). The clauses below bind you more than the others: each one bears, in the text, the words “specially highlighted clause”, and its essence is written there in bold. Here they are, in plain terms:

- Limited liability of the Publisher: for slight negligence, at most the higher of the fees of the last twelve months and CHF 10,000, per event and in total for a contract year, excluding indirect damage; wilful misconduct, gross negligence and mandatory provisions remain reserved (7.4, 7.5); - Claims of patients and third parties: you hold the Publisher harmless from those arising from your use, your data or your care decisions (7.7); - No recovery without your secrets: if you lose all your means of access (password, recovery key, Recovery Sheet, and the recovery contact if you have activated one), your data are lost forever; the Publisher cannot reopen them (7.9, 10.5, 10.6); - Place of jurisdiction in Sierre (Valais): a dispute is heard by the courts of Sierre, subject to mandatory places of jurisdiction (13.2); - Amendments to the agreement: minor amendments are deemed accepted if you do not terminate within thirty days (12.1); a substantial amendment awaits your “I accept (J'accepte)” or your “I refuse (Je refuse)” — if you have not answered thirty days after it was presented to you, synchronisation waits for your answer, the application continuing to work on your device (12.2); - Recovery door and custodians: what the Publisher keeps, and on what conditions it returns it (10.8, 9.11); - No insurance of the Publisher: at the date of this version, the Publisher has taken out no civil liability insurance and promises none; it answers for its commitments with its assets, within the limits of section 7, and its statutory liability (LRFP) remains in full (3.5, 7.11); - Patients cared for in France: you declare that you do not care for any with this account — neither with the managed service nor with any function that places data on the server (locum cover, recovery, safety net, transfer between devices); if this declaration is false, the Publisher may terminate the agreement, and you alone answer for the legal consequences in France (4.1ter); - Cantonal scope (2.5), early access — beta phase (3.8), VAT (5.5), requests from authorities (9.14), assignment of the agreement (12.4); - at subscription only: the paid subscription begins only with your confirmation, at the end of the thirty-day free trial — without confirmation, the managed service stops and local use continues (5.1bis) —, the part paid in advance kept by the Publisher if it terminates for a fault on your part — in all other cases, it is refunded to you pro rata (5.2) —, exclusive remedies in the event of unavailability (3.2), withdrawal of a function for security or compliance (12.3), version not installed (7.12), discontinuation of the service with 90 days' notice (11.3) — and the terms of the subscription itself (5.6).

This box summarises; the text of the clauses prevails.

1. Background and intention of the parties

1.1 The Publisher develops and publishes “Carnet”, a zero-knowledge progressive web application (PWA) for keeping the care record, planning the round and invoicing, intended for self-employed healthcare professionals practising in Switzerland (French-speaking Switzerland first) — see clause 2.5 (cantonal scope).

1.2 The software is published under the free licence GNU Affero General Public License version 3 (AGPLv3). The source code is publicly accessible and auditable at https://carnet.health/source/ (archive of every deployed version, tags included), for the whole period during which the service is operated. The Publisher does not sell a licence to use the code — free by nature — but services (hosting of blind synchronisation, support, custodian service, managed backups).

1.3 “Carnet” rests on a zero-knowledge architecture: the entire record is encrypted end to end on the Client's device, by means of keys derived from their password and their recovery key alone. The Publisher has no access to the data in plaintext and holds no key enabling it, alone or jointly with the server, to decrypt the Client's data — neither an administration password nor a back door. It holds only the private custody key of the recovery mechanism (section 10.5), which unseals only one share of that mechanism, inoperative without the 8 words of the Recovery Sheet — or, if the Client has expressly activated a recovery contact, without the code given to that contact — secrets which the Publisher never knows and which never pass through the server. This property is verifiable in the public source code (AGPLv3). The Client's sovereignty over their data is an essential and intended property of the product, not a defect.

1.4 The parties agree that this architecture entails consequences which the Client declares they have understood and accepted, in particular: the safekeeping of the password and of the recovery key, the making of backups and the statutory retention of the record are exclusively the Client's responsibility (sections 4 and 10).

2. Subject matter of the agreement

2.1 This agreement governs the provision of the “Carnet” software and the supply of the associated services, as well as the allocation of rights and responsibilities between the parties. It is an innominate contract of duration concerning continuous IT services (hosting, synchronisation, backups, support); the rules on sale (Art. 197 et seq. CO) do not apply to the supply of the free software.

2.2 Services (invoiced, with the exception of let. d): (a) hosting in Switzerland of the blind synchronisation service between the Client's devices; (b) retention of encrypted backups; (c) support; (d) provision of the sending connector for the MediData network (clause 9.7bis), a free (open-source) program installed on the Client's premises, which is used without a subscription (clause 5.1ter let. a); the Publisher routes no invoice and neither holds nor hands over any access certificate for the network, the Client obtaining their own from MediData under their own connection; (e) where applicable, custodian service for the recovery key.

2.3 Intended purpose of the software. The Publisher assigns to the software the following purpose, strictly and exclusively: (i) keeping and retaining the care record under the control of the professional; (ii) organising rounds, schedules and administrative reminders; (iii) preparing and transmitting invoices and administrative documents (in particular OPAS/MediData); (iv) making available to the professional documentary reference information which reproduces published and cited sources (sheets of usual reference points per substance, official scales and instructions of assessment instruments), without automatic application to the data of a specific patient; the software's checks are limited to the formal quality of entries and documents (writing of doses according to ISMP rules, missing units, typing plausibility). The software is intended neither to establish a diagnosis, nor to prescribe, nor to monitor physiological parameters, nor to determine or recommend a treatment for a specific patient, nor to replace clinical judgement.

2.4 Position with regard to medical device law. The software is intended for keeping the care record, organising rounds and invoicing. It is not placed on the market as a medical device: it performs no function of diagnosis, prevention, monitoring, prediction or treatment for a specific patient; its checks are limited to the formal quality of entries and documents, and the reference information it displays reproduces published, cited sources, without automatic application to a patient's data. In view of this purpose, of the actual functionality of the software and of the qualification decision tree of guidance MDCG 2019-11 Rev.1, the Publisher considers that the software pursues none of the medical purposes listed in Art. 3 of the Medical Devices Ordinance (ODim, SR 812.213) or in Art. 2(1) of Regulation (EU) 2017/745 (MDR), and that it therefore does not constitute a medical device subject to conformity assessment. The parties acknowledge that the qualification as a medical device is objective: it is a matter for the assessment of Swissmedic and, where applicable, of the courts, and not for the agreement of the parties. This agreement documents the framing adopted by the Publisher; it does not qualify the software in a manner binding on the authorities. The Publisher reserves the right provided for in section 12 to adapt, restrict or withdraw a function in the event of regulatory developments or a contrary opinion of a competent authority.

2.5 Cantonal scope (specially highlighted clause). The software is designed for practice in French-speaking Switzerland: Valais, Vaud, Geneva, Fribourg, Neuchâtel, Jura and the Canton of Bern (Bernese Jura). The cantonal texts displayed — supervisory authority, continuity-of-care contacts, emergency lines, retention period of the record and replacement rule — follow the canton of the practice, deduced from its postcode or confirmed by the Client; they cite the cantonal law read by the Publisher, and a fact it has not been able to verify is not displayed. The directory of localities covers the whole of Switzerland. The statement of residual financing of care is prepared on the Client's device and follows the canton of residence of the insured person on the day of care (Art. 25a para. 5 LAMal), according to the address recorded in the record; an item of care whose address does not designate a single canton is attributed to none until the address is clarified. For an insured person resident in the canton of the practice, the statement is prepared for Valais (official Valais template, home-care and social centres), Geneva (official template), Fribourg (official form of the Social Welfare Service, for care provided from 01.10.2026 to 31.03.2027; for care provided from 01.04.2027, that service requires the statement of a nurse authorised in Fribourg to be drawn up by a billing body it recognises, which the Publisher is not and which the software does not replace), Bern (totals to be entered in the cantonal portal and supporting sheet), Jura and Neuchâtel (official templates). For an insured person resident in a canton other than that of the practice, the software prepares the document that this canton requires where the Publisher knows its procedure (Geneva: detailed statement; Fribourg and Neuchâtel: their template); failing that, it calculates no amount, and the Client declares this care according to the rules of the canton or municipality of residence. The Client files each statement themselves and checks its content, tariffs applied included, before filing it. For Vaud, they declare the residual financing according to the rules of the canton, outside the software, until its coverage is announced in writing. In the other cantons, the cantonal texts are neutral, and the Publisher does not warrant the fitness of the software for practice in a canton whose coverage has not been announced in writing. The rest of the software — care record, rounds, OPAS prescriptions, invoicing to compulsory health insurance and MediData transmission — rests on federal law and national agreements, and is not affected. It is for the Client to check the requirements of their own canton; the Publisher assists them on request without being answerable for it. This clause limits the fitness promised; it does not restrict any mandatory right of the Client.

2.6 The Client acknowledges that they can run “Carnet” without subscribing to the managed service, the code being free; the fee remunerates the service exclusively, not the software.

3. Obligations of the Publisher (obligation of means)

3.1 Nature of the service. The Publisher undertakes to supply and maintain the software and the services with the diligence required of a provider in its sector (obligation of means, not of result). It warrants neither a specific clinical, administrative or financial result, nor uninterrupted operation free of any error, such a total absence of defects being technically impossible for any software.

3.2 The Publisher makes available corrective and security updates and endeavours to maintain the availability of the synchronisation service. No quantified service level (SLA) is guaranteed; however: an unavailability of the synchronisation service attributable to the Publisher (force majeure under clause 7.8 being reserved) exceeding ten (10) consecutive days entitles the Client to a pro rata credit on the next instalment; beyond thirty (30) days, the Client may terminate with a pro rata refund. (Specially highlighted clause, 14.2 let. i:) These remedies are exclusive of any other claim on the same ground, Art. 100 and 101 CO remaining reserved. The Client is reminded that the application works locally for keeping the record, scheduling, printing and preparing invoices; synchronisation between devices, by contrast, depends on the service. The transmission of invoices to the MediData network does not depend on it: it leaves from the connector installed on the Client's premises, under their own certificate (9.7bis).

3.3 The Publisher ensures data security appropriate to the risk (section 9): end-to-end encryption (without holding any key), encryption of transport (TLS), partitioning and restriction of administrative access, encrypted off-site backups, hosting in Switzerland. The access logs of the service are disabled (clause 9.3).

3.4 The Publisher keeps the source code of the official version publicly accessible — at https://carnet.health/source/, archive of every deployed version — for the whole period of commercial operation of the service.

3.5 Publisher's civil liability insurance — none is promised (specially highlighted clause, 14.2 let. f bis).

(a) At the date of this version, the Publisher has taken out no civil liability insurance covering its activity as publisher of the software and provider of the managed service. It does not promise to take one out, neither by a date, nor upon a condition of volume or turnover, nor for a determined extent or sum; no fee is subject to the existence of such insurance. No statutory provision requires the Publisher to have this insurance for the activity that this agreement describes.

(b) What this means for the Client. The Publisher is a natural person operating as a sole proprietorship: it answers for its commitments, within the limits of section 7, with all of its assets, and not up to an insured sum. The Client therefore knows, before accepting, that a claim for damages against the Publisher is guaranteed by no insurer. This information neither extends nor restricts the Publisher's liability: the cap in clause 7.4 applies whether or not the Publisher is insured, and it remains without effect, like clause 7.11, for wilful misconduct, gross negligence and the liability that mandatory law places on the Publisher.

(c) The Client keeps the choice. If the Client considers that the absence of insurance does not suit them, they may refuse this version (clause 12.2) or terminate (clause 11.1) with a refund of the fraction paid in advance pro rata (clause 5.2), and they keep local use of their software and the export of their data (clause 8.4). They are invited to make sure that their own professional civil liability insurance covers the use of IT tools for keeping the care record.

(d) If the Publisher takes out insurance later, it may inform the Client of this and publish the extent of cover on the pricing page; this information is not an amendment of the agreement within the meaning of section 12, it creates no obligation to maintain the insurance and neither limits nor extends the Publisher's liability beyond what is provided for by section 7 and mandatory law.

(e) Earlier versions. What was free of charge under an earlier version of the agreement, in particular because the Publisher had undertaken to collect no fee before being insured, is never invoiced afterwards. A Client who has not accepted this version remains governed by the version they accepted, including that undertaking (clause 12.2, “No answer”).

3.6 Support. The Publisher provides support by e-mail (), with an indicative response time of 48 working hours; security anomalies (6.3) are handled as a priority. Support is included in the fee (5.1). It is given in the Client's language, among those that the application offers: French, English, German, Italian or Spanish; failing that, in French. The language of support does not change the language that is binding (the French text of the agreement).

3.7 MediData connection. The direct connection to the MediData network has been in place since 6 August 2026, through the connector installed on the Client's computer. For a Client for whom it is not yet activated, the software produces the invoicing files in the official format (validated XML), which the Client uploads themselves to the portal of their choice; the Publisher states this fairly before subscription.

3.8 Early access — beta phase of the managed service (specially highlighted clause). The managed service is open in early access, which is a beta phase in the technical sense: the software changes quickly, several times a week, and interruptions, regressions and defects are possible. The Publisher announces this before any subscription, on the subscription screen and on the website, rather than letting the Client discover it afterwards.

This phase reduces none of the Publisher's obligations: backups (3.3, 9.5), recovery service (10.8), remedies in the event of unavailability (3.2), export of data (11.4) and durability of the format remain owed in full, and the Publisher's liability is in no way lightened by reason of early access.

Exit without loss. During this phase as afterwards, the Client may terminate at any time, with immediate effect, without charge or justification; the part paid in advance and not used is refunded to them pro rata for the remaining days (clauses 5.2 and 11.1). The Publisher announces the end of early access in the application and on the website, at least thirty (30) days in advance; this end changes neither the price nor the exit conditions.

4. Obligations of the Client — duty to verify

4.1 The Client is an authorised healthcare professional, solely responsible for their acts, their clinical decisions and their compliance with the rules of the art, with the Federal Act on Healthcare Professions (LPSan, SR 811.21 — Art. 11 et seq. and 16), with the LPTh and with their professional and ethical obligations (ICN Code of Ethics for Nurses).

4.1bis Warranty of authorisation. The Client warrants that they hold the cantonal authorisation to practise required (Art. 11 et seq. LPSan) and, for the use of invoicing to the compulsory health insurance and of the MediData connection, a valid RCC/ZSR number. They inform the Publisher without delay of any withdrawal or suspension of these authorisations. The Publisher assumes no duty to verify these elements. The MediData connection being the Client's own, established under their own certificate (9.7bis let. d), the Publisher has no means of suspending it.

4.1ter Patients cared for in France — Client's declaration (specially highlighted clause). French law reserves the hosting of health data on behalf of a professional to a certified host, which stores them in the European Union or the European Economic Area (Art. L.1111-8 of the French Public Health Code); the managed service, hosted in Switzerland (9.7), does not meet these conditions. Consequently, the Client uses, for patients whom they care for in France, neither the managed service nor any function that places data on the Publisher's server — locum cover (9.12), recovery door (10.5, 10.8), safety net of the locum cover mode (9.7 ④), relay for transfer between devices (9.7 ①) —, and makes the following declaration:

Client's declaration: “I do not care for patients in France with this account.” (Je ne soigne pas de patients en France avec ce compte.)

This declaration forms part of this agreement: the Client makes it by accepting the agreement, by the same action, timestamped and linked to the accepted version — at subscription to the managed service (5.6 let. c bis) and at each new acceptance of a version of the agreement (12.2) for as long as they use the managed service or one of these functions. It requires no separate action. Local use of the application, without any of these functions, is not covered.

Inaccurate declaration. If the declaration is or becomes inaccurate, the Publisher may terminate the agreement on that ground, which constitutes good cause within the meaning of clause 11.2. The Client alone answers for the legal consequences in France of the use they have made of the managed service or of these functions for patients whom they care for there, towards those patients, the authorities and any third party; clause 7.7 applies to claims against the Publisher arising therefrom. Termination deprives the Client neither of their data, which remain on their device, nor of their export (8.4), nor of local use of the software (8.7).

4.2 Duty to verify (basis of Art. 44 CO). Before using, sharing, printing or transmitting them to a third party (patient, insurer, authority, MediData network), the Client verifies the accuracy, completeness and plausibility of any data, dose, calculation, reference point or document produced or displayed by the software. The software's reference points in no case dispense from this verification, from the use of professional judgement and from official sources (medicinal product information, Compendium, applicable federal ordinances).

4.3 Breach of this duty to verify constitutes contributory fault of the Client which, within the meaning of Art. 44 para. 1 CO, reduces or excludes the Publisher's liability to the extent that it contributed to the occurrence or aggravation of the damage.

4.4 Safekeeping of secrets and backups (obligations of the Client). The Client keeps their password and their recovery key securely, separately and durably; they make and regularly check their encrypted backups (.carnet) and, where applicable, use the custodian mechanism (section 10).

4.5 Updates. The Client installs without delay the updates flagged as corrective or security updates and uses the latest available version of the software.

4.6 Compliant use. The Client uses the software in accordance with the intended purpose (section 2.3) and with applicable law. They base their care decisions on their own judgement and not on the software's reference points alone.

4.7 Paper outputs and exported files. Any document printed or exported outside the application (medication plan, OPAS form, transmission record, legal forms, PDF/ODT/DOCX files, invoicing files) leaves with names and in plaintext and leaves the encrypted perimeter. Its safekeeping, transport, filing and destruction are the sole responsibility of the Client, under professional secrecy (Art. 321 CP) and data security (Art. 8 LPD). Deletion carried out in Carnet does not extend to these copies. When a document is marked as sent in Carnet, an encrypted copy of the specimen is kept in the patient's file, inside the encrypted perimeter; it does not replace the safekeeping of the specimen that has left.

5. Costs and fees

5.1 Price. The managed service — presented on the website and in the application under the name “managed practice” — is invoiced as a monthly or annual flat fee, at the Client's choice at subscription: CHF 69 per month, or CHF 690 per year (i.e. ten monthly instalments), per seat (clause 5.1ter let. d), all inclusive: multi-device synchronisation, managed encrypted backups, locum cover (clause 9.12), support, custodian service and updates. The fee remunerates the service, not a licence to use the code (open-source). No launch rate and no increase is agreed in advance: the Publisher may adjust this price only in accordance with the procedure in section 12. Outside Switzerland, in each country where sales are open and only from their opening (the price page states which countries are open), the price is the one that this page publishes for the Client's country, excluding tax, in the currency of that country (per month, or per year for ten monthly instalments), and the managed service is sold by a reseller: the one named, at the time of the sale, in the conditions of the managed service outside Switzerland and on the payment page (9.6). It collects the price, adds the tax of the country to it and issues the receipt for it. The Publisher supplies the service. As long as sales are not open in their country, the Client does not subscribe there and owes nothing.

5.1bis Thirty-day trial, then subscription upon confirmation (specially highlighted clause, 14.2 let. g). Subscription to the managed service opens a free trial of thirty (30) days, locum cover included, which runs from the day of the Client's account's first synchronisation, i.e. the first upload of encrypted data accepted by the server; as long as the Client has not synchronised, the trial has not begun. The Publisher records these dates without seeing anything of the data and communicates them to the Client on request. No fee is owed for the trial.

(a) The subscription begins only if the Client confirms it, by any written or electronic means, choosing the monthly or annual plan (clause 5.1). No fee is owed or invoiced without this confirmation. The first paid period begins on the day after the end of the trial, or on the day of confirmation if it occurs later; the subscription then runs for successive periods, payable in advance, until one of the parties puts an end to it (section 11).

(b) In the absence of confirmation, the managed service pauses of its own accord at the end of the trial, in so far as it concerns synchronisation between devices, managed backups and the opening of new locum cover accesses (clause 9.12). A locum cover access already opened is not withdrawn, and local use of the software continues, free of charge and without time limit (clause 5.1ter let. a). The Client's encrypted blocks are kept for at least ninety (90) days; no deletion takes place without thirty (30) days' written notice. The Client may confirm the subscription at any time during this period: the managed service resumes upon their confirmation.

(c) The trial is open only once per Client; the subscription confirmation (clause 5.6 let. d) gives its end date, or the rule that fixes it if the Client has not yet synchronised. A Client who already had access to the managed service before 9 October 2026, without benefiting from the free-of-charge arrangement under clause 5.1ter let. e, has a thirty-day trial from the day on which they first accept the version of 9 October 2026 or a later version; no fee is owed by them before their confirmation. The end of the trial, agreed in advance, does not constitute an amendment within the meaning of section 12.

5.1ter Chargeable event, seat, practice tier.

(a) What is free. Strictly local running of the software — keeping the record, scheduling, printing, preparing invoices, exporting the invoicing file which the Client uploads themselves and sending invoices to the MediData network through the connector installed on their computer, under their own certificate (clause 9.7bis) — is free of charge and without time limit: it requires no subscription, the code being free (clause 2.6). No function is restricted in it, no data is withheld. Complete export of the Client's data (clause 8.4bis) remains open to them at any time and free of charge, whether or not they have subscribed, during the trial, the subscription or a suspension (clause 5.4) as well as after the end of the agreement.

(b) What is invoiced. The fee is owed for the managed service, from the confirmation of the subscription following the trial (clause 5.1bis), and for that service alone: synchronisation between devices, managed backups, locum cover (clause 9.12), support, custodian service. In practice, the Client needs to subscribe only when they want these services — that is, when they link a second device, entrust a locum cover mandate or deposit a recovery door. Sending invoices to the MediData network is not part of it (let. a). None of these services is a precondition for local use, which remains whole and free of charge (let. a). The fee is a fixed flat fee, never a percentage of the Client's turnover, and the Publisher neither measures nor checks the Client's volume of activity, which it is in any case unable to observe (zero-knowledge architecture). Once the subscription is confirmed, the fee runs according to the agreed periodicity, irrespective of the number of invoices actually transmitted.

(c) Seat. A seat is the use of the managed service by one specific natural person, a healthcare professional, under their own synchronisation account. The account is personal and not shared.

The access opened to a locum nurse under a locum cover mandate (clause 9.12) is personal — their link, their token and their signing key belong to them alone, and the Client may withdraw it separately from that of the others — whereas the mandate's record is common to the locum nurses whom the Client has called to it. On their device, a single password opens all the accesses they hold there, including those entrusted by other carers; it belongs to them exclusively, and the withdrawal of an access by the Client remains fully effective whatever the state of that device.

Up to five (5) simultaneous accesses opened by the Client, across all locum covers, do not constitute additional seats and are not invoiced. Beyond that, each additional simultaneous access is a seat within the meaning of this clause and of clause 5.1. The flat fee is assessed over all the mandates opened by the Client, and not mandate by mandate: a Client who runs three locum covers at once has five free accesses in total, not fifteen. A withdrawn access frees its place: only simultaneity counts, never the number of persons who have succeeded one another. The application informs the Client that they are crossing this threshold before they open the access; it never refuses it.

Scope clarified on 20.09.2026. The previous wording counted the five accesses per mandate; as nothing limits the number of mandates of the same Client, the flat fee multiplied without limit. The correction takes place before any collection based on this clause and withdraws no right exercised: no Client has opened more than five simultaneous accesses to date.

(d) A single price, per seat. The fee in clause 5.1 applies to each seat, whatever the number of seats and whatever their affiliation, save for a special written agreement. There is no group flat fee: the practice tier of two to four seats (CHF 109/month), which appeared here, was abolished on 06.09.2026 and was never invoiced to anyone.

(e) Free use promised in writing. A Client to whom the Publisher promised in writing, before 9 October 2026, that the managed service would be free of charge retains that, on the conditions and for the duration of that promise: this agreement neither withdraws nor reduces it, and the fee in clause 5.1 is not owed by them. Their account is never suspended for non-payment (clause 5.4). This agreement grants no other free-of-charge arrangement and no price guaranteed for life.

5.2 Payment and pro rata refund. Fees are payable in advance according to the agreed periodicity. Where the agreement or the managed service ends before the expiry of the paid period, the fraction paid in advance and not used is refunded to the Client pro rata for the remaining days, without recalculation or charges, in particular in the event of: (a) termination by the Client, at any time (clause 11.1); (b) termination by the Publisher with notice (clause 11.1); (c) good cause attributable to the Publisher (clause 11.2), refusal of an amendment (clauses 12.1 and 12.2), discontinuation of the managed service (clause 11.3) or assignment of the agreement (clause 12.4). (Specially highlighted clause, 14.2 let. h:) Sole exception: in the event of termination for good cause attributable to the Client (clause 11.2), the fraction paid in advance remains with the Publisher, mandatory provisions remaining reserved. In Switzerland, the Publisher makes the refund itself, by bank transfer to the account that the Client indicates. Where sales are open outside Switzerland, the refund is executed by the reseller (9.6), to the means of payment used where possible, corresponding tax included: the Publisher decides it and has it executed; the refund debt remains the Publisher's own towards the Client.

5.3 The Publisher may adjust its rates in accordance with the amendment procedure in section 12.

5.4 Late payment and suspension. In the event of an unpaid fee, the Publisher sends a reminder with a payment period of twenty (20) days; if it expires without payment, it may suspend, after notice, the managed service only in so far as it concerns synchronisation between devices, managed backups and locum cover (clause 9.12); a locum cover access already opened is not withdrawn by the suspension. The suspension never concerns: the Client's local access to their data and to the software, the .carnet export, the recovery mechanism, sending invoices to the MediData network — which leaves from the connector installed on the Client's premises, under the Client's own certificate, which the Publisher does not hold (clause 9.7bis) —, nor the rights conferred by the AGPLv3. The Client's encrypted blocks are kept for at least ninety (90) days after the suspension; no deletion takes place without thirty (30) days' written notice. Where sales are open outside Switzerland, the Publisher sends the Client no request for payment: the reseller (9.6) retries the payment and reminds the Client; its reminders take the place of the reminder, and suspension does not occur before twenty-eight (28) days after the end of the paid period. Where the Client has confirmed the subscription there (clause 5.1bis let. a) without ever paying its first period, the reseller has nothing to remind: the Publisher sends the Client the payment link by an e-mail that sets a due date, at the earliest twenty (20) days after that sending and after the start of that first period, and states the consequence; failing payment by that due date, the managed service is suspended by itself, without further notice, and a payment received afterwards lifts the suspension. Without that e-mail, no suspension occurs on this ground. The guarantees of this clause remain in full.

5.5 Value added tax (specially highlighted clause). The prices stated in this agreement are exclusive of value added tax. To date, the Publisher is not liable for VAT: its taxable turnover remains below the statutory registration threshold, no VAT is invoiced and no input tax is deducted; the Publisher's invoices therefore bear no VAT number. If the Publisher becomes liable for VAT, VAT at the statutory rate is added automatically to the agreed prices from the date of liability, subject to thirty (30) days' notice; this addition does not constitute a substantial amendment within the meaning of section 12 and gives rise to no right of extraordinary termination, the Publisher merely passing on a tax which it is legally required to collect. The Client, who carries on a care activity excluded from the scope of the tax, is made aware that this VAT will be for them a definitive cost (no input tax deduction).

5.6 Subscription — preconditions for any fee (specially highlighted clause). This agreement is accepted a first time at the creation of the vault, which is free of charge and purely local. No fee is owed on that ground alone. The Publisher collects no fee before the Client has, on a separate subscription screen:

• (a) taken note of the applicable price (per seat), the periodicity, the term, the termination arrangements and the fate of sums paid in advance (clause 5.2);
• (b) been informed of the thirty-day trial, of the fact that the subscription begins only upon their confirmation (clause 5.1bis), of the amount of the fee that will then be owed and of what happens without confirmation;
• (c) expressly accepted this agreement, by an action separate from the first acceptance (14.1 let. b), the screen presenting to them, highlighted, the onerous clauses of an economic nature listed in clause 14.2, letters (g) to (l);
• (c bis) declared, by that same acceptance, that they care for no patient in France with this account, the declaration in clause 4.1ter being reproduced, highlighted, on the subscription screen;
• (d) received a confirmation by e-mail setting out these elements, the end date of the trial (or, if they have not yet synchronised, the rule that fixes it) and the version of the agreement accepted.

For as long as this mechanism is not in operation, use of the managed service is free of charge and no invoice is sent to the Client.

6. Collaboration and support

6.1 The Publisher provides support electronically to a reasonable extent, in order to help the Client to use the service. Support never constitutes clinical advice and never replaces the Client's professional judgement.

6.2 The Client cooperates in good faith, reports any malfunction without delay and provides the information necessary to process their requests. No patient-identifying data may be transmitted to the Publisher in connection with support; where necessary, the Client anonymises their requests.

6.3 Information security anomalies. The Publisher maintains a dedicated reporting channel () for any information security anomaly affecting the software or the service. It handles these reports as a priority and, with the diligence of an obligation of means, publishes a fix or neutralises the function concerned (clause 12.3) and informs Clients where the anomaly concerns them (clause 12.1). This clause creates no guaranteed correction period.

7. Liability

Specially highlighted section (onerous clauses). Clauses 7.4 (limitation and cap), 7.5 (indirect damage), 7.7 (indemnity with regard to third parties) and 7.9 (zero-knowledge irreversibility) limit or allocate liability to the detriment of the Client. They are highlighted in the text, recalled in the box at the head of the agreement and presented on the acceptance screen before the action that accepts it (section 14); the Client declares that they have taken note of them.

7.1 Fault required. The Publisher's contractual liability presupposes a lack of diligence (Art. 97 para. 1 CO). The Client remains solely responsible for their professional decisions, for the care they provide, for the accuracy of the data they enter and of the documents they draw up, print or transmit by means of the software.

7.2 Reference information — non-binding documentation. The reference information provided by the software (documentary sheets of usual reference points per substance, administrative flagging of a duplicate entry, cited scales of assessment instruments, limits agreed in the care plan ENTERED by the Client) constitutes generic documentation or settings of the Client, indicative and non-binding, intended for a professional who retains full control of their judgement. None of this information is blocking; none constitutes medical advice, a diagnosis, a prescription or an automated decision having legal effect (Art. 21 LPD). A missing sheet (the list of substances covered is short and closed), a flag not triggered, incomplete or erroneous cannot, in itself, constitute a defect: the level of safety legitimately expected of these functions is assessed in the light of their purely documentary nature.

7.3 Display or printing errors. Errors, inaccuracies, omissions or layout defects in the information displayed, calculated or printed by the software fall under the regime of clause 7.4 (wilful misconduct, gross negligence and Art. 100 para. 2 CO reserved). The Client's duty to verify remains reserved (section 4.2): breach of it constitutes contributory fault (Art. 44 para. 1 CO).

7.4 Limitation and cap (slight negligence) — specially highlighted clause (14.2 let. a). Subject to mandatory provisions — in particular Art. 100 para. 1 CO (wilful misconduct and gross negligence), Art. 100 para. 2 CO (discretion of the court where liability arises from the exercise of an activity requiring official authorisation or where the creditor is in the debtor's employment) and the LRFP (SR 221.112.944), Art. 8 of which prohibits excluding or limiting product liability in advance — the Publisher's liability arising from slight negligence is limited, for each damaging event, to the higher of the two following amounts: (a) the amount of the fees actually paid by the Client during the twelve months preceding the event causing the damage; or (b) a fixed floor of CHF 10,000. The purpose of this floor is to rule out any objection of disguised exclusion. Several damages arising from the same cause or from connected facts form a single event, attached to the contract year in which the first damaging fact occurs. Annual cap. In addition, for all the events of one and the same contract year, the Publisher's liability is limited to the same amount, calculated on the day of the first damaging fact of the year: the total compensation owed for that year cannot exceed it, and the two caps are not added together. The contract year is each period of twelve months that begins on the Client's acceptance of the contract, then on each of its anniversaries. These caps apply only to slight negligence: they limit neither wilful misconduct, nor gross negligence (Art. 100 para. 1 CO), nor the liability that the LRFP (Art. 8) or any other mandatory provision places on the Publisher, and damage of that kind is not counted against them.

7.5 Indirect damage — specially highlighted clause (14.2 let. a). To the same extent and subject to the same reservations, the Publisher is not liable for indirect or consequential damage, in particular loss of profit, loss of clientele, business interruption loss, damage resulting from a delay, refusal or error in invoicing, or loss or corruption of data not attributable to the Publisher.

7.6 Auxiliaries and subcontractors (Art. 101 paras. 2 and 3 CO). The Publisher's liability for its auxiliaries and subcontractors (in particular the hosting provider, the blind synchronisation provider and the custodian) is, in accordance with Art. 101 para. 2 CO, limited to the same extent as its own liability and excluded for their slight negligence. The parties acknowledge that, in accordance with Art. 101 para. 3 CO, the court retains the power to assess the validity of this exclusion where liability arises from the exercise of an activity requiring official authorisation. Wilful misconduct and gross negligence remain reserved.

7.7 Third-party claims (patients) — limited indemnity (Art. 41 CO) — specially highlighted clause (14.2 let. b). Third parties, in particular patients, are not parties to this agreement. The Client indemnifies the Publisher and holds it harmless from any claim brought by a third party (patient, relative, insurer, authority, employer) in connection with the Client's use of the software, their care decisions, the data they enter or the documents they draw up, transmit or keep, including reasonable defence costs. This indemnity in no case applies — even in the event of slight negligence by the Publisher — to the liability that the LRFP or another mandatory provision places on the Publisher (in particular death and personal injury), nor to wilful misconduct or gross negligence of the Publisher, nor to a defect inherent in the software. The indemnity is confined to claims arising from the act, use, data or decisions of the Client.

7.8 Force majeure and impediment without fault (Art. 97, 103, 119 CO). The Publisher is not liable for non-performance or delay resulting from an event which it could not reasonably foresee or overcome (network or power outage, failure of a hosting provider or third-party service, cyberattack, decision of an authority, epidemic, disaster). For the duration of such an impediment without fault, the Publisher is not in default (Art. 103 para. 2 CO) and the obligations affected are suspended.

7.9 Zero-knowledge nature — data loss without fault — specially highlighted clause (14.2 let. c). The Client acknowledges and accepts that the Publisher can neither read nor restore the data, nor reset a password. The simultaneous loss of the password and of the recovery key entails the final and irreversible loss of the data. The Publisher is not liable for this loss where it results from the Client's negligent safekeeping (loss, forgetting or disclosure of their password or recovery key), gross negligence and wilful misconduct of the Publisher in the design of the recovery key or custodian mechanism remaining reserved. The parties agree that inaccessibility for the Publisher is an intended property of the product, not a defect within the meaning of Art. 4 LRFP or of the contractual warranty.

7.10 Warranty for defects. The agreement being an innominate contract of duration concerning continuous IT services (section 2.1), liability is governed by Art. 97, 100 and 101 CO. The software is supplied “as is”; the Publisher does not warrant that it is free of all errors or suited to a particular use not agreed, other than the correction undertakings provided for in this agreement. In any event, Art. 100 (paras. 1 and 2) and 101 CO, the LRFP and — to the extent that the rules on sale were nonetheless held to apply — Art. 199 CO (nullity of the exclusion in the event of fraudulent concealment of a defect) are reserved.

7.11 Product liability — reservation and transparency (specially highlighted clause, 14.2 let. f bis). The Client is informed that the Publisher's liability for damage resulting from death or personal injury caused by a defect in the product is governed by the LRFP (SR 221.112.944), from which no derogation by agreement is possible (Art. 8 LRFP). No provision of this agreement may exclude or limit that liability, nor liability for wilful misconduct or gross negligence (Art. 100 para. 1 CO). The LRFP covers only death, personal injury and damage to property for private use (deductible of CHF 900, Art. 6 LRFP); the Client's own financial loss remains governed by sections 7.4 and 7.5. The Publisher not being insured at the date of this version (clause 3.5), this damage is borne by its assets; insured or not, it remains borne by the Publisher to the full extent provided for by the LRFP, without limitation to the cap in clause 7.4.

7.12 Updates and development risk (Art. 5 LRFP) — specially highlighted clause (14.2 let. k). The Publisher is not liable for damage resulting from the use of an obsolete version, from a defect already corrected by an update made available and not installed, or from a modification of the software or of its execution environment not authorised by the Publisher, within the limits permitted by mandatory law.

7.13 Saving clause (reduction to the lawful extent). If a clause of this agreement, in particular a limitation or exclusion of liability or warranty, were held to be void, invalid or unenforceable, it would not be struck out but reduced by the court to the maximum extent permitted by mandatory law, without the validity of the other clauses being affected. Any limitation provided for in this agreement applies to the fullest extent permitted by law.

8. Intellectual property and AGPLv3 licence

8.1 Ownership (Art. 2 para. 3 and 10 LDA). The “Carnet” software (source and object code, interfaces, documentation, original graphic elements) is a protected work. The Publisher remains the sole holder of the copyright, subject to the rights of third-party contributors; contributions from third parties are governed by the contribution policy published with the repository (CONTRIBUTING.md: DCO, submission under AGPL-3.0-or-later). This agreement entails no assignment of these rights; neither signature, nor payment of fees, nor use gives rise to any intellectual property right of the Client in the software.

8.2 Free licence. “Carnet” is published under the AGPLv3. The Client enjoys freely and free of charge the rights conferred by that licence (running, studying, modifying, redistributing the code, on the terms of the AGPLv3, in particular its section 13). This agreement does not restrict, suspend or make conditional those rights; in the event of conflict, the AGPLv3 prevails as regards use of the code (in accordance with the prohibition of “further restrictions” in AGPLv3 §10).

8.3 No back door. The Publisher warrants that “Carnet” is designed according to a zero-knowledge architecture: the Publisher has no global administrator access, master password, back door or technical means enabling it, alone or jointly with the server, to read, decrypt or transmit to a third party the Client's data (the custody key of the recovery mechanism, inoperative on its own, is described in sections 1.3 and 10.5). The synchronisation server hosts only unintelligible encrypted blocks. The free nature of the code enables the Client, or any third party of their choice, to verify this absence of a back door.

8.4 Control and reversibility of the Client's data. The data entered, generated or imported by the Client, including the encrypted journal and patients' identifying data, remain under the exclusive control of the Client, controller within the meaning of the LPD (SR 235.1). The parties deliberately use the term control and not ownership: Swiss law does not recognise a right of ownership in data, and the data subjects retain in any event their own rights (right of access, Art. 25 LPD; obligation to account for the mandate, Art. 400 para. 1 CO). The Publisher acquires no right to use, analyse, exploit or assign these data.

8.4bis Two distinct tools — not to be confused. The software offers two exports, which have neither the same recipient nor the same use:

(a) The “.carnet” backup — for the Client alone. At any time and free of charge, the Client exports the whole of their vault to a .carnet file. This file is encrypted under their own master key: it can be restored only to their own account, by means of their password, their recovery key or their Recovery Sheet, and the Publisher's software is currently the only one able to read it back (its format is described in the public source code, which enables anyone to write a reader for it, but such a reader has yet to be written). It contains the records of all the Client's patients. It therefore constitutes their complete backup and, with regard to the Publisher, their complete restitution — the Publisher having nothing else to return that it can read. This file is neither intended for nor capable of being handed to a patient: handing it to them would be both useless (they cannot open it) and a breach of professional secrecy with regard to all the other patients.

(b) The “Complete patient record — right of access (Art. 25 LPD)” — for the patient. The software produces, per patient and for the sections selected, a readable document — PDF, ODT or DOCX — entitled “Dossier complet du patient — droit d'accès (art. 25 LPD)” (Complete patient record — right of access), comprising the entire history and, optionally, the wound photographs. It is this export that the Client hands to a person exercising their rights.

8.4ter Patients' right of access — allocation of roles. The Client remains bound by the right of access of their patients: a controller who uses a processor remains obliged to provide the information requested (Art. 25 para. 4 LPD). The Publisher's technical impossibility therefore creates no gap — the obligation has never left the Client, who is the only one able to decrypt. The parties recall that no one may waive the right of access in advance (Art. 25 para. 5 LPD), that the information is in principle free of charge and provided within thirty (30) days (Art. 25 paras. 6 and 7 LPD), and that health data may, with the consent of the data subject, be communicated to them through a healthcare professional whom they designate (Art. 25 para. 3 LPD) — a useful option in the face of a delicate request. The right to delivery or transmission of the data (Art. 28 LPD) is likewise exercised against the Client, the only one in a position to act on it.

8.5 Distinctive signs and integrity of the official version. The logo and the other original graphic elements of the Publisher are works protected by copyright; they are not covered by the AGPLv3 (reservations in section 7, let. d and e, of that licence, relating to the use of names for publicity purposes and to trademarks) and remain the property of the Publisher. The name “Carnet” is used by the Publisher as a distinctive sign of its product; to date, no trademark is registered and the Publisher claims no trademark right. The Client may use these signs to designate the software as supplied. Anyone who modifies and redistributes the code must indicate their modifications and may not present a modified version as the official version or use the distinctive signs in a manner likely to cause confusion. The Publisher is not answerable for the operation, security or compliance of a version modified or distributed by a third party.

8.6 Allocation of the regulatory burden in the event of modification. In accordance with the freedoms of the AGPLv3, the Client may modify the code. Whoever modifies the software and gives it a medical purpose within the meaning of Art. 3 ODim / Art. 2(30) MDR becomes the manufacturer themselves and alone bears all the regulatory obligations. This clause does not prohibit modification (a right guaranteed by the AGPLv3); it allocates the regulatory responsibility arising from it.

8.7 Continuity through the source code. By reason of publication under the AGPLv3, the Client retains, irrespective of the survival of the Publisher or the continuation of the managed service, the right to run, have hosted and have maintained “Carnet” themselves or by any third party, from the published source code. Termination of the agreement, whatever its cause, does not extinguish this right.

8.8 “As is” warranty and mandatory reservation. The software being supplied under a free licence, it is made available “as is”, without warranty of quality or fitness for a particular use, within the limits permitted by applicable law (AGPLv3, sections 15 to 17). Expressly reserved are Art. 100 paras. 1 and 2 CO, Art. 101 CO, the LRFP (Art. 8, mandatory) and the Client's right to the information necessary for interoperability (Art. 21 LDA). For the rest, liability relating to the software is governed by section 7.

9. Data protection (integrated DPA — LPD SR 235.1, OPDo SR 235.11)

9.1 Roles. The Client is the sole controller (Art. 5 let. j LPD) of the data of their patients: they determine its purposes and means, are responsible for its lawfulness (Art. 6 and 8 LPD) and remain bound by professional secrecy (Art. 321 CP).

9.2 Processing of encrypted blocks. For the synchronisation and backup retention service alone, the Publisher acts as processor (Art. 5 let. k and 9 LPD), exclusively on end-to-end encrypted blocks which it cannot decrypt. By design, it has no access to health data in plaintext or to patients' identities. This qualification as processor is adopted as a precaution and extends only to those operations on encrypted data.

9.3 Independent controller for technical metadata. For the metadata and data that are its own — synchronisation timestamps and volumes, pairing data and the Client's invoicing data — the Publisher acts as independent controller, on the legal basis of performance of the contract and security of the system (Art. 31 LPD). This processing is not subject to the regime of the Client's sole instructions; the Client is informed of it by this agreement. These data include no patient data. The servers' access logs are disabled: the IP address is processed only in random-access memory, for the sole purpose of rate limiting, and is not recorded. The sole exception is the account recovery service: each of its steps — set-up, change of the verification number, addition or revocation of a recovery contact, deactivation of the service, request, veto, delivery — is recorded with a secret-key fingerprint of the address (since 23.09.2026; previously the address itself) and the date, in a log that nothing can modify or erase, as protection against a fraudulent request. The data processed during the recovery release procedure (clause 9.11) fall under the same regime: verification telephone number, identity verification elements presented on the day of the request and the log of the procedure — the Publisher's own processing, necessary for the protection of the Client themselves.

9.4 Instructions and confidentiality. On the encrypted blocks, the Publisher processes only on the documented instructions of the Client and for the purposes of the service alone (Art. 9 para. 1 LPD). The Publisher, its officers and its auxiliaries are bound by confidentiality, including as regards metadata; this obligation survives the agreement. The Publisher refrains from any attempt to decrypt, correlate or re-identify the data retained, and from any use for its own purposes.

9.5 Security (Art. 8 LPD, Art. 1 to 4 OPDo). The Publisher ensures security appropriate to the risk: end-to-end encryption (without holding any key), TLS, partitioning and restriction of administrative access, encrypted off-site backups, hosting as described in clause 9.7. It keeps these measures in line with the state of the art. The Client acknowledges that the robustness of the protection depends decisively on the confidentiality of their password and their recovery key, which they alone hold.

9.6 Sub-processing (Art. 9 para. 3 LPD). The Client gives general authorisation for the use of sub-processors (hosting, infrastructure), on condition that each is subject to equivalent obligations. The Publisher informs the Client, on a durable medium, of any addition or replacement before it is implemented, so as to enable the Client to object on good grounds; in the event of a well-founded objection that is not resolved, the Client may terminate the service concerned. The Publisher is answerable for the proper performance of the sub-processor's obligations as for its own.

Payment provider. Where sales are open outside Switzerland, the price of the managed service is sold and collected by a reseller (“merchant of record”), named at the time of the sale in the conditions of the managed service outside Switzerland and on the payment page (at the date of this version, the reseller is Paddle.com Market Limited, London, in the countries outside Switzerland that the pricing page states as open): it sells in its own name, collects the tax of the Client's country, renews, reminds and refunds. For the payment data that the Client gives it directly, this provider acts as an independent controller, under its own terms; it is not a sub-processor of patient data and receives neither encrypted block nor patient data. The Publisher communicates to it only the opaque identifier of the Client's synchronisation account, in order to link a payment to that account, and the refunds that it decides. The information and objection regime of the first paragraph applies to this provider as to a sub-processor: the Publisher informs the Client, on a durable medium, of any replacement of the payment provider or any addition of a second provider, before it is implemented; the Client may object on good grounds and, failing a solution, terminate the managed service, the fraction paid in advance and not used being refunded to them pro rata (5.2). In Switzerland, the Publisher sells itself, without a payment provider.

9.7 Location. The encrypted blocks entrusted to the Publisher are hosted on infrastructure located in Switzerland. No patient data — encrypted or in plaintext — is disclosed abroad, apart from any encrypted backups replicated to a State with adequate protection (Art. 16 para. 1 LPD) or subject to a safeguard under Art. 16 para. 2 LPD, the Client being informed in advance. Patients' identities are never readable by the Publisher or by the server, and are never subject to continuous synchronisation. They travel only through four sealed channels, all end-to-end encrypted and opaque to the Publisher as to the server: ① the one-off device-to-device transfer that the Client triggers, sealed to the recipient device alone, with human verification; ② the recovery door — offered when synchronisation is activated, the application asking the question without activating anything without an express choice, refusable and revocable at any time, this choice being kept — which deposits on the server a DOUBLE-SEALED envelope (encrypted under the Client's master key and then sealed to the recovery key), decryptable exclusively on the Client's device by recombining their 8 recovery words with the share held by the Publisher, released only after a waiting period; the server holds only inert blocks; ③ replacement (“locum cover mode”, clause 9.12), which seals to the devices of the designated locum nurse the identities and records of the patients whom the Client has themselves selected; ④ the safety net of the locum cover mode, which deposits on the server only the identities of the patients entrusted, encrypted under a key derived from the locum nurse's passkey — which the server cannot reconstruct —, limited to the end of the mandate and destroyed by the withdrawal of their access as by closure. It exists so that a locum nurse who loses their device in the middle of a locum cover can recover the records entrusted without the Client having to start everything again.

One flow escapes these channels and is neither sealed nor opaque: the invoice to the insurer, which leaves IN PLAINTEXT. Art. 42 LAMal requires the service provider to give the insurer a detailed invoice; that invoice necessarily contains the surname, first name, date of birth, sex, AVS number and address of the insured person, the services invoiced, the identity and address of the prescribing physician, and a medical indication in free text (up to 350 characters). This transmission is imposed by law and addressed to the insurer, itself bound by secrecy. The Client triggers it THEMSELVES from their own device, to the MediData network; the content of the medical indication field is a matter for their sole judgement and their duty of proportionality.

9.7bis The sending connector — architectural commitment (essential clause).

(a) Rule. A patient's invoice never passes through any infrastructure of the Publisher. The parties agree that this rule is an essential characteristic of the product, and not a technical arrangement: it is what ensures that the Publisher is never placed in the presence of the content of an invoice bearing a name. The Publisher undertakes to maintain it; it could depart from it only with the express and prior consent of the Client, obtained according to the procedure for substantial amendments (clause 12.2), silence never constituting acceptance.

(b) How it works. Direct sending to the MediData network takes place by means of a connector, a small free (open-source) program supplied by the Publisher and installed on the Client's computer. On the Client's instruction, the software hands it the invoice through an interface specific to that computer; the connector transmits it directly to the network and reports the insurer's response back to the software. The Client may also expressly designate a local folder from which the connector sends the invoices placed in it; no folder is monitored in the absence of such a designation. Manual export of the official file, which the Client uploads themselves to the portal of their choice, remains available at all times: if the connector or the network stops, invoicing is never blocked.

(c) What the Publisher learns. Nothing. The connector communicates with no server of the Publisher: the Publisher learns neither that it has started, nor that an invoice has left, nor any invoice, any patient, any amount, any IP address.

(d) The network access certificate. MediData authenticates the connector by means of the client certificate belonging to the Client, which the Client obtains themselves from MediData under their own connection, under their connection identifier. This certificate and its private key remain on the Client's computer; they are neither transmitted to the Publisher nor kept by it, and the Publisher holds no certificate that would enable it to send an invoice in the name of the Client or to read the responses intended for them. It follows that: (i) the Client is authenticated by a secret of their own; (ii) the Publisher can neither suspend nor interrupt direct sending, which the suspension under clause 5.4 does not affect; (iii) renewal of the certificate on its expiry is the Client's responsibility, with MediData, the connector indicating its expiry date to them.

9.8 Data security breach (Art. 24 LPD). The Publisher notifies the Client without delay and at the latest within forty-eight (48) hours of becoming aware of it, of any breach affecting the data entrusted; the notification is sent to the e-mail address provided by the Client and, failing that, by display in the application; the Publisher can be reached on this subject at . The notification states at least the nature of the breach, the categories and approximate number of the data concerned, the likely consequences and the measures taken or proposed, as well as a point of contact; it is supplemented progressively if not everything is known from the outset — an incomplete fact does not justify waiting. The Publisher's obligation towards the Client derives from Art. 24 para. 3 LPD. Two protections in favour of the Client are recalled: a notification based on Art. 24 LPD may be used in criminal proceedings against the person notifying only with their consent (Art. 24 para. 6 LPD) — which matters to the Client, bound by professional secrecy (Art. 321 CP); and the Client may restrict, defer or dispense with informing the data subjects where a duty of secrecy so requires (Art. 24 para. 5 LPD). End-to-end encryption of the blocks constitutes a relevant factor in assessing the risk to the data subjects — that assessment remaining case by case and ultimately incumbent on the Client (controller), to whom the Publisher lends reasonable assistance. The Publisher documents each breach and the measures taken and keeps that documentation for at least two (2) years (Art. 15 OPDo).

9.9 Data subjects' rights, record of processing activities. Patients' requests (Art. 25 et seq. LPD) are handled by the Client, the only one able to decrypt and identify the data; the Publisher, having no access to the content, is not bound to handle them and forwards to the Client without delay any request received. The Publisher provides the Client, on request, with the information necessary for their record of processing activities (Art. 12 LPD). The Client, processing health data (Art. 5 let. c no. 2 LPD), is made aware that it is incumbent on them to keep their own record, the exemption in Art. 24 OPDo possibly not being available to them.

9.10 Deletion at the end of the agreement. The Publisher deletes or anonymises the encrypted blocks it was keeping within a reasonable period after the end of the agreement, subject to the technical periods strictly necessary (logs, rotating backups) and to its own legal obligations. The deletion concerning data already unintelligible to the Publisher, it does not affect the Client's ability to dispose of their data via their export. On request, the Publisher certifies the deletion in writing.

9.11 Recovery and custodian service (specially highlighted clause, 14.2 let. f). Where the recovery door is active (offered when synchronisation is activated, without a pre-ticked option, refusable and revocable — section 10.5), the Publisher keeps on behalf of the Client: the sealed cryptographic share of the mechanism, the double-sealed envelope (identities included) and the verification telephone number; the server holds only unintelligible blocks, which no element held by the Publisher enables it, alone or jointly with the server, to decrypt. The release procedure comprises, as a matter of principle: a waiting period of seventy-two (72) hours by default, on an irreducible floor of twenty-four (24) hours hard-coded in the server — no setting can lower it, only extend it —, notification of the Client's active devices with right of veto, an identity verification before any release (video call to the sole number recorded at set-up, identity document presented, or meeting in person), and the keeping of an unalterable (append-only) log of each step. The log of the procedure is kept for ten (10) years; in the event of revocation (opt-out), the elements kept are destroyed and the Publisher certifies this in writing on request. This service is described from the point of view of the data in the privacy policy (section 2).

9.12 Replacement (“locum cover mode”) — disclosure of data covered by professional secrecy. The term “locum cover” here means professional replacement; it is unrelated to the indemnity with regard to third parties in clause 7.7 (both are called “relève” in the French text).

(a) What the software does. When the Client entrusts all or part of their round to a locum nurse, the software transmits to that locum nurse, in sealed form to their devices, the records of only those patients whom the Client has designated, identities included, for as long as the access which the Client has opened to them remains open — an access which the Client may extend, limit or revoke at any time, and which lapses on closure of the locum cover, on withdrawal of that access alone, on its revocation or, of its own accord, 90 days after the scheduled end of the mandate (a safeguard against oversight; a mandate without an end date has none).

The Client may call several locum nurses to the same mandate. The synchronisation account is then dedicated to the mandate; each receives a personal access — their own link, token and signing key — which the Client may withdraw separately without cutting off that of the others. The mandate's record is common: each reads and adds to what the others write, and each entry bears the name and signature of its author. Only the Client calls a locum nurse to a mandate; a locum nurse cannot call anyone to it. The locum nurse keeps the record of these patients there as the Client keeps it, each of their entries bearing their name and signature; the declaration of care to the insurer (OPAS 7) remains with the Client, who answers for the mandate: the locum nurse consults it and may print it, without being able to modify it. The Publisher creates for this purpose a synchronisation account dedicated to the locum nurse and hosts the corresponding encrypted blocks.

(b) Encryption does not release from secrecy. This transmission is a disclosure of data covered by professional secrecy (Art. 321 CP). Encryption protects the data during their transport and storage; it in no way releases the Client from their secrecy with regard to the locum nurse, nor from their duty to assess, patient by patient, what it is necessary and proportionate to transmit. The Client remains the controller (clause 9.1) for the records thus entrusted.

(c) Steps incumbent on the Client. The Client obtains the consent of their patients to the sharing of their record with the carers who attend to them — the basis of the disclosure (Art. 321 no. 2 CP; Art. 36 para. 2 LS/VS) —, records it and informs their patients of the use of a locum nurse. The application flags any objection by a patient to them and records it in the patient's record; it withdraws no record on the Client's behalf: the decision whether or not to entrust a record despite an objection — and its justification, in particular in an emergency — is a matter for the sole judgement and sole responsibility of the Client. The Client ensures that the locum nurse is authorised to practise.

(d) The Publisher verifies nothing and cannot do so. The Publisher has no means of verifying these steps and does not carry out any such verification: it knows neither the identity of the patients concerned, nor the content transmitted (encrypted blocks), nor whether information has been given or an objection received. Its service is limited to the mechanism described under (a).

(e) Undertaking of the locum nurse, in the application. Before any display of names, the locum nurse must accept versioned “Terms of use of the locum cover mode”, in a manner that is blocking at first access; acceptance is timestamped and recorded. Where these terms change during the mandate, re-acceptance is requested from them at their next entry into the application, without interrupting care in progress: nothing closes and nothing disappears in the meantime — the record continues to reach them, as the safety of care requires, and their entries continue to reach the Client; a banner asks them to accept the new version. These terms cover: the basis of access — the consent of patients to the sharing of their record, obtained and recorded by the Client —, professional secrecy (Art. 321 CP), access limited to the care of the patients entrusted for as long as the access granted is open, the personal nature of the ACCESS — link, token and signing key — and the COMMON nature of the mandate's record, which all the locum nurses called by the Client read and add to, the prohibition on disclosing these records to third parties — the other locum nurses of the same mandate not being third parties within the meaning of this clause —, what they keep after withdrawal of their access: the summary of their own acts, and that alone, the lapse of access on closure, on withdrawal of that access alone or on its revocation, and the deletion of the compartment, responsibility for their own documentation, the personal and non-shared nature of the access, reporting without delay of any loss, theft or unauthorised access, the prohibition on disclosing these records to third parties and on copying them outside Carnet, and the reminder that informing patients is the Client's responsibility. There is no paper document: the undertaking is given in the application. These terms bind the locum nurse with regard to the Client; they create no obligation of the Publisher as to the conduct of the locum nurse.

9.13 Professional secrecy and lawfulness of processing by a processor (Art. 9 para. 1 let. b LPD; Art. 321 CP). The law permits processing to be entrusted to a processor only if no legal or contractual obligation of secrecy prohibits it. The parties agree on the following construction:

(a) Principally — there is no disclosure. The Client remains bound by and in control of the secret. What they entrust to the Publisher is end-to-end encrypted: the Publisher receives unintelligible blocks, without identity or content, which no element in its possession enables it to open (sections 1.3 and 8.3). Entrusting content which the recipient cannot read is not disclosing it to them; secrecy is therefore not called into question, and the condition in Art. 9 para. 1 let. b LPD is met.

(b) Alternatively and without admission — the status of auxiliary. In case an authority or a court were nonetheless to hold that a disclosure exists, the parties agree that the Publisher acts as the Client's auxiliary within the meaning of Art. 321 no. 1 CP: it is bound by the same secrecy, for the same duration, including after the end of the agreement (clause 9.4), and extends it to its own auxiliaries. This stipulation is made in the alternative and entails no admission that the architecture described under (a) would be insufficient.

(c) What, by contrast, leaves in plaintext — the invoice to the insurer (clause 9.7) — never passes through any infrastructure of the Publisher (clause 9.7bis): the Publisher is therefore at no time its custodian.

9.14 Requests from authorities (specially highlighted clause). The Publisher may receive a requisition, a production order or a seizure order (in particular Art. 265 CPP).

(a) What it can hand over: unintelligible encrypted blocks, the technical metadata described in clause 9.3, and — if the recovery door is active — the custody share, which is mathematically insufficient on its own (clause 10.8). It can hand over neither the content of a record, nor the identity of a patient, nor a connection history, which does not exist (clause 9.3).

(b) What it will do: unless legally prohibited from doing so, the Publisher informs the Client without delay of any request concerning them, before any handover if time permits, so that they can assert their rights — in particular their professional secrecy; it limits itself to what is strictly required by the decision, requires a written order, and invokes the protected nature of the data where the law permits.

(c) What it will not do: the Publisher has no back door and undertakes not to create one, nor to weaken the encryption, nor to modify the software to capture a secret of the Client — whether spontaneously or at the request of a third party. Any change that would render this undertaking inaccurate would constitute a substantial amendment (clause 12.2), subject to the express consent of the Client. The free nature of the code makes it possible to verify this undertaking in each published version.

10. Zero-knowledge, statutory retention, backups and recovery key

10.1 Technical and legal impossibility of retaining on behalf of the Client. The Publisher having no access to the data in plaintext, it is unable to ensure the retention, archiving or restitution of the content of the records: these obligations are exclusively the Client's.

10.2 Statutory retention obligation. The Client, a self-employed healthcare professional, remains solely bound by the obligation to keep the record of each patient for the period required by applicable law — that is, save for a longer provision, twenty (20) years from the last entry (safe assumption: Art. 128a and 60 para. 1bis CO — limitation period for personal injury; professional duties under Art. 16 LPSan; EPR ordinance; Valais requiring at least 20 years, Art. 32 para. 2 LS-VS). They likewise keep, for at least ten (10) years, invoicing and accounting documents (Art. 958f CO, Olico). Compliance with these periods is the Client's own concern: it is incumbent on them to export their records regularly (clause 10.3) and to keep these exports for the whole statutory period, including after the end of this agreement. The Publisher does not ensure this retention and is technically unable to do so, having no access to the data in plaintext: “Carnet” is not a statutory archiving service and the Publisher cannot be held liable on that basis.

10.3 Backups (obligation of the Client). The Client makes, under their sole responsibility and at an appropriate frequency (at least monthly and after any significant entry), complete backups by means of the encrypted “.carnet” export, and keeps at least one copy of them off the work device. They periodically check that their backups are readable and restorable.

10.4 Synchronisation ≠ backup ≠ archiving. The sole purpose of blind synchronisation is the replication between the Client's devices of data already encrypted; it constitutes neither a security backup nor statutory archiving, and does not dispense from the obligations in clause 10.3.

10.5 Irreversibility (specially highlighted clause, 14.2 let. c). Recovery of access is possible only through the recovery key, through the Recovery Sheet (8 words, recombined on the Client's device with the custody share held by the Publisher — section 1.3) or, if the Client has activated it, through the recovery contact. The Client understands and expressly accepts that the simultaneous loss of the password, the recovery key AND the Recovery Sheet entails the final and irreversible loss of access to all the data — no reset procedure exists and the Publisher alone can recover nothing. The Client therefore keeps these elements securely, separately and durably.

10.6 Corresponding exclusion (specially highlighted clause, 14.2 let. c). The Publisher is not liable for loss of access or of data resulting from the loss, forgetting or disclosure by the Client of their password or recovery key, this impossibility of recovery being the inherent and intended counterpart of zero-knowledge protection, brought to the Client's attention before the conclusion of the agreement. Wilful misconduct and gross negligence of the Publisher remain reserved, in particular in the design of the recovery key or custodian mechanism.

10.7 Information received. The Client declares that they were clearly informed, before the conclusion of the agreement, that the durable safekeeping of the record, of the secrets and of the backups is their sole responsibility, and that “Carnet” is a record-keeping tool and not a statutory archiving service operated on their behalf by the Publisher.

10.8 Recovery door and custodians (specially highlighted clause). The agreement uses the term “custodian” in two distinct senses, which this clause delimits: (a) the trusted custodian whom the Client may freely designate (clause 10.5) is a third party chosen by the Client; the Publisher receives nothing and does not intervene in that relationship; (b) the recovery door rests on two shares: the “8 words” share (Recovery Sheet), held by the Client alone, and a cryptographic share held by the Publisher, kept sealed outside the server and mathematically insufficient on its own; recombination takes place exclusively on a device of the Client; (c) the share held by the Publisher is handed over only re-sealed to a device of the Client, at the end of the verified procedure in clause 9.11 — never in plaintext, and never to heirs or third parties outside the procedure. The parties expressly specify that a death certificate, a certificate of inheritance or the status of beneficiary confers no right to the handover of the custody share: the Client's professional secrecy is not transmitted by succession, and opening the vault would deliver the records of all their patients. The fate of the records in the event of the Client's death is a matter for the rules of the profession and the competent cantonal authority, not for this agreement; (d) in the event of seizure or requisition (Art. 265 CPP), the elements that can be seized from the Publisher do not, on their own, permit decryption of the Client's data — a technical property verifiable in the public source code.

11. Term, termination and discontinuation of the managed service

11.1 Term and termination. The agreement is concluded for an indefinite term. The Client may put an end to the managed service, or to the agreement, at any time, by any written or electronic means, without charge or justification, with immediate effect or on the date they indicate; the fraction paid in advance and not used is refunded to them pro rata (clause 5.2). The Publisher may terminate as at the end of a current subscription period, subject to thirty (30) days' notice, by any written or electronic means.

11.2 Good cause. Each party may terminate with immediate effect for good cause, in particular in the event of a serious breach of an essential obligation not remedied within a reasonable period after formal notice.

11.3 Discontinuation of the managed service by the Publisher (specially highlighted clause, 14.2 let. l). The Publisher may discontinue all or part of the managed service subject to ninety (90) days' notice. Thanks to the local and open-source nature of the software (8.7) and to export (8.4), the Client remains able to access their data and to keep them. Discontinuation affects neither the Client's control over their data (8.4) nor their retention obligation, and gives rise to no compensation other than, where applicable, the refund of the fraction of the subscription paid in advance and not used, Art. 100 paras. 1 and 2 and 101 CO remaining reserved.

11.4 Continuing duty. Termination does not end the statutory retention obligation (10.2): it is incumbent on the Client, before any termination or cessation of use, to carry out a complete export of their records and to ensure their retention for the remaining statutory periods. The Publisher keeps after the end of the agreement no usable data and assumes no subsequent obligation of restitution.

11.5 Continuity in the event of the Publisher's death or incapacity. (a) By derogation from Art. 405 para. 1 CO, the death or lasting incapacity of the Publisher does not automatically end the agreement; the agreement continues under the discontinuation regime of clause 11.3, the ninety (90) days' notice running from notification to Clients. (b) The Publisher designates a contractual technical agent (sealed instructions kept with the physical copy of the custody key), backed by directives to the executor of the will; this agent is responsible for notifying Clients within thirty (30) days, maintaining read-only synchronisation and export for the duration of the notice period (hosting provisioned), and then handing over or destroying the custody elements with a formal record — never transmission into the estate outside the procedure. (c) The operating secrets (hosting access, administration token, custody envelope) are placed in escrow for this purpose; they permit no reading of the Clients' data (zero-knowledge architecture). (d) The MediData connection, a third-party contract, is not guaranteed beyond notification. This clause is stipulated in favour of the Client; in any event, the rights under clauses 8.4 (export) and 8.7 (continuity through the code) subsist.

12. Amendments to the agreement and to the service

12.1 Minor amendments (specially highlighted clause, 14.2 let. e). The Publisher may adapt these terms for minor reasons (clarifications, technical developments not affecting the balance of the agreement). Any minor amendment is communicated at least thirty (30) days before it comes into force, by display in the application or electronically; in the absence of termination before that date, it is deemed accepted. A Client who refuses a minor amendment may, by derogation from clause 11.1, terminate in writing before it comes into force, with effect on that date and with a pro rata refund of the fraction paid in advance. Amendments do not apply retroactively to services already performed.

12.2 Substantial amendments — express acceptance. Any substantial amendment — in particular of the price, the liability regime, data protection or the place of jurisdiction — requires the express acceptance of the Client. The Publisher presents it to them in the application, and by e-mail to a Client who has subscribed to the managed service, in a single communication which comprises:

• (a) the statement that the terms have changed, with the identifier of the new version;
• (b) a summary of what changes, clause by clause;
• (c) access to the full text of the new version, in which the specially highlighted clauses remain highlighted (14.2), and which the Client can save or print (PDF) before answering;
• (d) the choice between accepting and refusing, and what refusal entails (below).

The Client accepts by a single action (“I accept (J'accepte)”), timestamped and linked to the version; there is no box to tick. Silence does not constitute acceptance of a substantial amendment. A substantial amendment that the summary (let. b) failed to mention cannot be relied on against the Client.

No answer (specially highlighted clause, 14.2 let. e). For as long as the Client has neither accepted nor refused, the previous terms continue to apply. For thirty (30) days from the communication, the Publisher reminds them of the amendment, in the application and, if they have subscribed to the managed service, by e-mail, without interrupting anything. On expiry of this period, synchronisation of their account waits for their answer; it resumes as soon as they accept. The answer given on one of their devices applies to their account, and therefore to all their devices. This waiting applies only to a Client who has already accepted a version of the agreement that provides for it: for the amendment that introduces it, the reminder continues without interrupting anything until they answer. This waiting is neither a suspension within the meaning of clause 5.4 nor a termination: use of the application on their device continues, and it never concerns the Client's local access to their data, the .carnet export, the recovery mechanism or the rights conferred by the AGPLv3; the encrypted blocks already entrusted remain kept. The days of waiting of a Client who has subscribed are not invoiced: they are credited to them pro rata on the following period, or refunded if the agreement ends (5.2).

Right to refuse. The Client may refuse the amendment, by a single action (“I refuse (Je refuse)”), timestamped and linked to the version. The application transmits the refusal to the Publisher, which keeps a timestamped receipt of it (version refused, date of refusal, effective date chosen) and shows it to the Client.

• (a) A Client who has subscribed to the managed service and refuses the amendment terminates the managed service, without charge or compensation. Termination takes effect, at their choice, immediately or at the end of the current subscription period — failing a paid period in progress, at the end of the calendar month following the refusal, and at the earliest at the end of the thirtieth day following the refusal —, but never before the Publisher has received the refusal — through the application's receipt or by a written request to ; until then, the previous terms continue to apply and synchronisation continues. The fraction paid in advance and not used is refunded to them pro rata (5.2 let. c). On the effective date, they are in the situation of let. (b).
• (b) A Client who has not subscribed to the managed service retains local use of the software on their device, on the previous terms, without synchronisation. Their data remain on their device and their export (8.4) remains open to them. They may accept the new version later, from the application; synchronisation then becomes accessible to them again, on the terms of the new version.

Refusal deprives the Client neither of their data nor of their export; it is for them to keep their records for the statutory periods (10.2, 11.4).

The end of the trial (clause 5.1bis), agreed in advance, is not an amendment within the meaning of this section.

12.3 Development of the software and regulatory reservation (specially highlighted clause, 14.2 let. j). The Publisher may develop the functionalities, add to them or withdraw them, for reasons of security, compliance or improvement, provided that the essential functions agreed remain substantially ensured. If a competent authority, a legislative development or a new version of the MDCG guidance were to qualify all or part of a function as a medical device, the Publisher may modify, restrict or withdraw it in order to preserve compliance, without this constituting non-performance. The free nature (AGPLv3) guarantees the Client the lasting availability of earlier versions. Mandatory provisions (in particular the LRFP) remain reserved.

12.4 Assignment of the agreement and change of control (specially highlighted clause). The Publisher holds a recovery key share and, when the door is active, an envelope containing the double-sealed identities of the Client's patients: the identity of whoever holds these elements is decisive for the Client. Consequently:

(a) the Publisher may not assign this agreement, its business, or the managed service, nor transfer control of it to a third party, without informing the Client in writing at least sixty (60) days in advance, stating the identity, registered office and jurisdiction of the acquirer;

(b) the Client may then terminate without charge with effect on the date of the transfer, the fraction of the fee paid in advance being refunded to them pro rata;

(c) the Client may in any event, and without terminating, require the certified destruction of the custody elements concerning them (cryptographic share, double-sealed envelope, verification number) rather than their transfer to the acquirer; the Publisher does so before the transfer and certifies it in writing. The recovery door is then deactivated, the consequence of which the Client bears (clause 10.5);

(d) the acquirer is bound to take over all the obligations of this agreement, including the architectural commitment in clause 9.7bis and the absence of a back door (clause 9.14 let. c).

The death or incapacity of the Publisher falls under clause 11.5, not under this clause.

13. Governing law and place of jurisdiction

13.1 Governing law. This agreement is governed exclusively by Swiss law, to the exclusion of the conflict-of-laws rules and of the United Nations Convention on Contracts for the International Sale of Goods (CISG).

13.2 Place of jurisdiction (specially highlighted clause, 14.2 let. d). The Client, acting in the course of their professional activity, is a non-consumer (Art. 35 CPC does not apply). The parties agree that the exclusive place of jurisdiction is at the Publisher's seat, in Sierre (Canton of Valais), for either party, subject to mandatory places of jurisdiction. In concrete terms: a dispute arising from this agreement is brought before the courts of Sierre, and not before those of the Client's domicile, whichever party brings the action. This clause, onerous for the Client, is highlighted in the text, recalled in the box at the head of the agreement and presented on the acceptance screen (14.2). Its acceptance, timestamped and linked to a version whose full text is kept (14.4), constitutes the “means enabling it to be evidenced by text” of Art. 17 para. 2 CPC.

14. Conclusion, acceptance and special attention to onerous clauses

14.1 Formation of the agreement — two distinct moments. (a) At the creation of the vault, free of charge and purely local, the Client accepts these terms by a single action in the application — pressing the button “Create the account (Créer le compte)”, immediately preceded by the sentence “By tapping “Create the account (Créer le compte)”, you declare: “I accept the contract, including the specially highlighted clauses (J'accepte le contrat, y compris les clauses spécialement signalées)”” (14.2 point 4) —, after the full text and its specially highlighted clauses have been presented to them (14.2); the version accepted and the timestamp of acceptance are recorded as evidence. This acceptance gives rise to no obligation to pay: it governs use, not the subscription. (b) At subscription to the managed service, the Client additionally accepts, on a separate screen and by a new single action, timestamped and linked to the version, the economic elements of the agreement, its onerous clauses of an economic nature and the declaration in clause 4.1ter (clause 5.6). The clauses of an economic nature — price, trial and confirmation of the subscription, fate of sums paid in advance, term and termination — can be relied on only from this second acceptance. The same applies to the jurisdiction clause (13.2): a person who has never subscribed is subject to the ordinary statutory places of jurisdiction. The clauses relating to liability and zero-knowledge irreversibility, by contrast, apply from the first acceptance, free use being itself supplied “as is” (clause 8.8).

14.2 Special attention to onerous clauses (unusualness rule). The parties acknowledge that the Client is not versed in the law of licences or of software liability. The onerous clauses below are therefore not buried in a global acceptance: the Publisher draws the Client's attention specially to each of them, and does so by four cumulative means:

• (1) in the text, each bears the words “specially highlighted clause” and its essence is written in bold;
• (2) a box placed at the head of the agreement lists them and states their scope in plain language;
• (3) the acceptance screen presents this same box, and gives access to the full text, before the acceptance button, so that it is not possible to accept without having had it before one's eyes; it also makes it possible, before that button, to save or print the agreement (PDF);
• (4) the acceptance button, or the sentence immediately preceding it, names them: “I accept the contract, including the specially highlighted clauses (J'accepte le contrat, y compris les clauses spécialement signalées)”.

The Client accepts the agreement, highlighted clauses included, by this single action, timestamped and linked to the version; there is no box to tick. The same applies to each new acceptance of an amended version (12.2). The case law of the Swiss Federal Supreme Court holds attention to have been sufficiently drawn where the clause is drafted clearly, unequivocally and highlighted by typographical means such as bold type (TF 4A_372/2022 of 11.07.2023, consid. 3.3; see also ATF 138 III 411 consid. 3.1 and 3.5; ATF 135 III 1 consid. 2.1).

First group — at the creation of the vault, in the application:

• (a) limitation of liability and cap (7.4) and exclusion of indirect damage (7.5);
• (b) indemnity with regard to third parties / hold harmless (7.7);
• (c) zero-knowledge irreversibility and data loss (7.9, 10.5, 10.6);
• (d) place of jurisdiction at the Publisher's seat (13.2);
• (e) amendment by silence for minor amendments (12.1), and waiting of synchronisation in the absence of an answer to a substantial amendment within thirty days (12.2);
• (f) recovery door and custodians (10.8, 9.11);
• (f bis) absence of insurance of the Publisher: no civil liability insurance has been taken out or is promised; the Publisher answers with its assets, within the limits of section 7; its statutory liability (LRFP) remains in full (3.5, 7.11);
• (m) cantonal scope: the suitability of the software is not guaranteed outside the cantons and procedures that the clause names (2.5);
• (n) early access — beta phase: interruptions, regressions and defects possible; exit at any time with pro rata refund, during this phase as afterwards (3.8);
• (o) patients cared for in France: the Client's declaration and its consequences — termination by the Publisher, and liability of the Client alone for the legal consequences in France (4.1ter);
• (p) requests from authorities: what the Publisher can hand over, what it will do and what it will not do (9.14);
• (q) assignment of the agreement and change of control (12.4).

Letters (m) to (q) were added by the version of 8 October 2026, after the existing letters, so that the agreement's references to 14.2 let. a to l (3.2, 3.5, 5.1bis, 5.2, 9.11, 10.5, 11.3, 12.1, 12.3, 13.2) remain accurate. These five clauses already bore the words “specially highlighted clause” and appeared in the box at the head; they were missing from this list, on which their enforceability rests.

Second group — at subscription to the managed service (clause 5.6), on the subscription screen:

• (g) stop of the managed service at the end of the thirty-day trial, in the absence of confirmation (5.1bis): synchronisation, managed backups and the opening of new locum covers stop, the encrypted blocks are kept for at least ninety days (5.1bis);
• (h) part paid in advance retained by the Publisher in the event of termination for good cause attributable to the Client — the sole exception to the pro rata refund (5.2);
• (i) exclusive nature of the remedies in the event of unavailability: pro rata credit beyond 10 days, termination beyond 30 days, to the exclusion of any other claim on the same ground (3.2);
• (j) right to withdraw or restrict a function for reasons of security or compliance, without this constituting non-performance (12.3);
• (k) forfeiture in the event of a version not installed: the Publisher is not liable for damage resulting from the use of an obsolete version or from a defect already corrected by an update not installed (7.12);
• (l) discontinuation of the managed service subject to 90 days' notice (11.3), and automatic addition of VAT if the Publisher becomes liable for VAT (5.5).

A clause in this list which has not been presented to the Client in the manner described above before their acceptance cannot be relied on against them, the rest of the agreement remaining in force.

14.3 Scope of the arrangement. The Client acknowledges that this agreement is only one tier of an arrangement of protection also comprising the in-app framing “aid, not a medical device, not decision-making” and the obtaining, where applicable, of a written qualification opinion from Swissmedic.

14.4 Signatures / electronic acceptance.

For the Publisher: ____________________ Date: __________

The Client declares that they have read, understood and accepted this agreement, including the onerous clauses specially highlighted in clause 14.2 and, if they use the managed service, the declaration in clause 4.1ter. The agreement not being subject to any statutory form (Art. 11 CO), electronic acceptance suffices to conclude it; the Publisher keeps the full text of each version accepted, and attaches it to the subscription confirmation (5.6 let. d):

Surname / first name: ____________________ Date and timestamp: __________ Version accepted: __________