MARKETING POLICY

Article 1. (1) This Marketing Policy (the “Policy”) governs the rules, conditions, and procedure for sending Marketing Communications and for carrying out marketing activities by “DocNow Medical Services” EOOD, UIC 208622091, with its registered seat and registered office at: Sofia 1404, Triaditsa District, 109 Bulgaria Blvd., floor 2, office 2.5, e-mail: [email protected], tel.: +359 889 999 955 (hereinafter referred to as the “Company”), in connection with the OneCare online platform (the “Platform”), accessible at www.onecare.bg.

(2) This Policy forms an integral part of the Platform's Privacy Policy and applies together with the General Terms and Conditions for the use of the OneCare Platform, the Privacy Policy, and the Cookie Policy.

(3) This Policy applies to Marketing Communications sent to:

1. Users — natural persons registered on the Platform;

2. Service Providers — merchants, medical establishments, specialists, and their employees or collaborators whose profiles have been created on the Platform;

3. Visitors — persons who have provided contact details through the Platform without completing registration, where applicable.

(4) This Policy does not apply to communications that are not marketing in nature, including but not limited to:

1. confirmations of orders, order status, changes, cancellations, rescheduling;

2. notifications relating to payment, invoicing, refunds;

3. communications relating to security, account access, breaches;

4. notifications of changes to the General Terms and Conditions, the Privacy Policy, or other applicable policies;

5. communications necessary for the performance of a legal obligation or a contractual obligation.

(5) Communications by which the Company informs Users of scheduled technical maintenance, temporary unavailability, a change in the operation of an existing functionality, a change in the conditions for using an already requested service, or any other circumstance directly related to the technical functioning of the Platform or to the performance of an already existing legal relationship, are operational and contractual in nature and do not constitute Marketing Communications within the meaning of this Policy.

Article 2. (1) For the purposes of this Policy:

1. “Marketing Communication” means any communication sent for the purpose of directly or indirectly offering, promoting, advertising, or encouraging the use of services, products, functionalities, promotional mechanisms, campaigns, offers, content, or other commercial activity related to the Platform, to the Company, or to Service Providers of services through the Platform.

2. “Recipient” means the person to whom the Marketing Communication is addressed.

(2) All other definitions have the meaning assigned to them in the General Terms and Conditions, the Privacy Policy, and the applicable legislation.

Article 3. (1) The Company sends Marketing Communications only where a valid legal basis exists, as follows:

1. the explicit, freely given, specific, informed, and unambiguous consent of the Recipient within the meaning of Art. 6(1)(a) GDPR, Art. 6 of the Electronic Commerce Act, and Art. 261 of the Electronic Communications Act (the “ECA”);

2. the legitimate interest of the Company within the meaning of Art. 6(1)(f) GDPR, only in the cases and under the conditions provided for in Article 4 of this Policy.

(2) The Company does not send Marketing Communications based on special categories of personal data within the meaning of Art. 9 GDPR, including data concerning health. Marketing Communications are not personalized on the basis of information relating to medical services, health status, diagnoses, therapies, medical history, or other health information.

(3) Where the Recipient is a Provider, Marketing Communications are sent to the business contact details indicated by the Provider. Where Marketing Communications are addressed to a specific natural person (e.g., a representative, employee, or specialist of the Provider), the consent rules under paragraph (1), item 1 apply.

Article 4. (1) The Company may send Marketing Communications without prior consent, on the basis of legitimate interest, only where all of the conditions under Art. 261(2) of the ECA are cumulatively met:

1. the Company obtained the Recipient's electronic contact details in the context of the provision of a service or a sale through the Platform;

2. the Marketing Communication relates to services, products, or functionalities of the Company that are similar to those used by the Recipient;

3. the Recipient was given a clear and free opportunity to object to the use of their electronic contact details for marketing purposes at the time they were provided, as well as with each subsequent communication;

4. the Recipient has not objected to receiving Marketing Communications.

(2) In the absence of any of the conditions under paragraph (1), the Company sends Marketing Communications solely on the basis of explicit consent under Art. 3(1), item 1.

(3) The Company carries out a legitimate interest assessment (balancing of interests) before commencing marketing activity based on legitimate interest, taking into account the reasonable expectations of the Recipient, the nature of the communication, and the availability of an easy opt-out mechanism.

Article 5. (1) Consent to receive Marketing Communications is given through an active, unambiguous action by the Recipient, including:

1. ticking an unfilled consent box (checkbox) upon registration or when requesting a service through the Platform;

2. clicking a button confirming consent;

3. another explicit and unambiguous action from which an intention to receive Marketing Communications can be established.

(2) The consent box may not be pre-filled (pre-checked). Silence, inaction, a pre-ticked box, or continued use of the Platform do not constitute valid consent.

(3) Consent to receive Marketing Communications is not a condition for registration on the Platform, for requesting a service, for making a payment, or for using any functionality of the Platform.

(4) The Company documents and retains evidence of the consent given, including the date, time, manner in which consent was given, channel, and scope of the consent, for the entire period of processing and for a period of 5 years following its withdrawal or termination.

Article 6. (1) The Recipient has the right to withdraw their consent to receive Marketing Communications at any time, without stating a reason and without owing any compensation, penalty, or other costs.

(2) Withdrawal may be effected by:

1. clicking an unsubscribe link contained in every marketing communication sent by e-mail;

2. sending a “STOP” reply or another designated command for Marketing Communications sent via SMS, Viber, WhatsApp, Telegram, Signal, or another instant messaging application;

3. changing the communication settings in the user profile, where such functionality is available on the Platform;

4. sending a request to the e-mail address: [email protected];

5. another manner provided for on the Platform or in the specific marketing communication.

(3) The withdrawal of consent takes effect within a reasonable period from its receipt, but no later than 5 business days, unless technical reasons require a longer period, of which the Recipient is notified.

(4) The withdrawal of consent does not affect the lawfulness of processing carried out prior to the withdrawal.

(5) The withdrawal of consent to Marketing Communications does not affect or terminate:

1. the Recipient's user profile on the Platform;

2. services already requested, confirmed, or in the process of being performed;

3. the Company's right to send communications that are not marketing within the meaning of Article 1(4) of this Policy.

Article 7. (1) The Recipient has the right to object at any time to the processing of their personal data for direct marketing purposes, including profiling to the extent that it is related to direct marketing, pursuant to Art. 21(2) and (3) GDPR.

(2) Upon receipt of an objection under paragraph (1), the Company ceases processing the Recipient's personal data for marketing purposes without undue delay.

Article 8. (1) The Company may send Marketing Communications through the following channels:

1. e-mail;

2. short text message (SMS);

3. instant messaging applications (Viber, WhatsApp, Telegram, Signal, and others);

4. notifications within the Platform (in-profile notifications);

5. browser notifications (push notifications), subject to explicit authorization;

6. telephone call;

7. social networks and digital platforms (Facebook, Instagram, TikTok, YouTube, LinkedIn, and others), including through retargeting and personalized advertising audiences;

8. other channels that the Company may introduce in the future, of which the Recipient will be duly informed.

(2) When giving consent, the Recipient may, where the Platform provides such an option, select their preferred channels for receiving Marketing Communications.

(3) For channels that require separate technical authorization (e.g., browser notifications), Marketing Communications are sent only after such authorization has been explicitly granted.

(4) When social networks and digital platforms are used for marketing purposes (retargeting, personalized audiences), the processing of data is carried out under the terms of the Cookie Policy and the Privacy Policy. Data provided to the relevant platform for this purpose are processed in accordance with that platform's own terms and policies.

Article 9. (1) The Marketing Communications sent by the Company may include the following types of content:

1. newsletters with news, updates, new services, and functionalities of the Platform;

2. promotional offers, discounts, vouchers, promotional codes, and special conditions for using services through the Platform;

3. notifications of new categories of services, new Service Providers, or expansion of the scope of the Platform;

4. seasonal and themed campaigns;

5. promotional content related to specific Service Providers of non-medical services (e.g., cleaning companies, gardeners, childcare specialists), including content prepared at the request and expense of the relevant Provider, whereby the Company sends the communication in its own name and/or in the name and at the expense of the Provider;

6. invitations to participate in a referral/partner program, where available;

7. invitations to participate in surveys, polls, and feedback;

8. educational and informational content related to the services offered through the Platform;

9. partner offers from third parties, where the Company has determined that they may be of interest to the Recipient;

10. other types of marketing content compatible with the purpose of the Platform.

(2) Marketing Communications relating to specific Service Providers do not include content from or for medical establishments, medical specialists, or veterinary practices in their capacity as providers of health or veterinary services.

(3) The Company does not send Marketing Communications that:

1. contain or are based on data concerning the health of the Recipient or of a third party;

2. personalize content on the basis of past medical or veterinary requests;

3. are misleading, deceptive, contain false information, or are in breach of the applicable legislation;

4. breach the rules on the advertising of health services, medicinal products, medical devices, or veterinary medicinal products established in the applicable legislation.

(4) Where a marketing communication contains promotional content prepared at the request and expense of a specific Provider, the following rules apply:

1. the sender of the communication is the Company, not the Provider;

2. the promotional content is clearly marked as “promotional”, “sponsored”, or in another appropriate manner allowing the Recipient to distinguish promotional from editorial content;

3. the communication is sent only to persons who have given valid consent to receive marketing communications in accordance with this Policy;

4. the Company does not provide the Service Provider with the Recipients' personal data in connection with the sending of the communication;

5. the Service Provider is responsible for the accuracy, lawfulness, and non-infringing nature of the promotional content it has provided to the Company for inclusion in the communication.

Article 10. (1) The Company may personalize Marketing Communications on the basis of the following categories of data, where the corresponding legal basis exists:

1. history of requests for non-medical services;

2. preferences, choices, and settings indicated by the Recipient in their profile;

3. location (locality, district), to the extent relevant to the availability of services;

4. type of services used and frequency of requests;

5. age group, to the extent relevant to the type of services offered;

6. activity and behavior on the Platform, collected through cookies and similar technologies under the terms of the Cookie Policy.

(2) The personalization under paragraph (1) is not carried out on the basis of:

1. data concerning health or another special category of personal data;

2. history of requests for medical or veterinary services;

3. the content of medical or veterinary documentation uploaded through the Platform.

(3) The Recipient has the right to object at any time to profiling for marketing purposes pursuant to Art. 21 GDPR, in accordance with Article 7 of this Policy and Section X of the Privacy Policy.

(4) Upon an objection under paragraph (3), the Company ceases profiling and personalization in respect of the relevant Recipient and switches to sending only general, non-personalized Marketing Communications, provided the Recipient has not withdrawn their marketing consent entirely.

Article 11. (1) The Company may carry out segmentation of Recipients for marketing purposes on the basis of aggregated and non-individualized criteria, including locality, type of non-medical services used, frequency of requests, and other similar parameters.

(2) The segmentation under paragraph (1) is carried out in compliance with the principle of data minimization and the principle of purpose limitation, pursuant to Art. 5 GDPR.

Article 12. (1) Every marketing communication sent by the Company contains, as a minimum:

1. clear identification of the Company as the sender of the communication, including but not limited to its identification as “OneCare”;

2. an easy, free, and accessible mechanism for opting out of receiving future Marketing Communications (an unsubscribe link, an opt-out command, or another appropriate means);

3. contact details of the Company (e-mail: [email protected]).

(2) Marketing Communications sent via SMS or instant messaging applications contain instructions on the manner in which the Recipient may opt out of future communications.

(3) Marketing Communications are not sent from a hidden, disguised, false, or misleading sender address or number.

(4) The subject or title of the Marketing Communication must not mislead as to the content of the communication.

Article 13. (1) The Company may send Marketing Communications to Service Providers whose profiles have been created on the Platform, for the purpose of informing them of new functionalities, new categories of services, promotional programs, training, partnership initiatives, and other opportunities related to the Platform.

(2) Marketing Communications to Service Providers are sent to the contact details indicated by the Service Provider upon creation of the profile or in its contractual relationship with the Company.

(3) The Service Provider has the right to opt out of receiving Marketing Communications at any time in accordance with Article 6 of this Policy.

(4) Opting out of Marketing Communications does not affect the sending of operational, administrative, or contractual communications necessary for the functioning of the legal relationship between the Company and the Provider.

Article 14. (1) The Company may organize a referral/partner program (“Invite a Friend” or similar), through which Users and/or Service Providers may invite third parties to register on the Platform or to use its services, under conditions and a procedure determined by the Company.

(2) Under a referral program, the invited person receives an invitation from another User or Provider, and not directly from the Company. The Company does not send Marketing Communications to the invited person until that person independently takes action to register or to give consent.

(3) The person who sends the invitation is responsible for ensuring that the invited person has not expressed objection to receiving invitations from them and that the invitation does not breach the applicable legislation.

(4) The specific terms of the referral program, including any incentives, discounts, vouchers, or other benefits, are governed by separate special terms published on the Platform.

(5) The Company does not store contact details of invited persons, unless and until they register on the Platform themselves and/or give consent to the processing of their data.

Article 15. (1) The Company may include in its marketing communications offers, promotions, or information from third parties (partners), where the Company has determined that they may be of interest to the Recipient.

(2) Partner offers are sent by the Company, and not directly by the third party. The Company does not provide partners with the Recipients' personal data for the partners' own marketing purposes, unless the Recipient has given separate explicit consent to this. The same rule applies where the content has been prepared at the request of a Service Provider in accordance with Art. 9(4).

(3) Partner offers do not include offers relating to medical services, health products, medicinal products, medical devices, or veterinary medicinal products, unless the applicable legislation expressly permits such advertising and all applicable requirements have been met.

(4) Partner offers are clearly marked as such in the relevant marketing communication.

Article 16. (1) The personal data processed for marketing purposes include:

1. names;

2. e-mail;

3. telephone number;

4. address (locality, district), where relevant;

5. consent status data (given/withdrawn, date, channel);

6. data on the history of requests for non-medical services, preferences, activity, where applicable;

7. technical data collected through cookies and similar technologies, under the terms of the Cookie Policy.

(2) The Company does not process for marketing purposes:

1. data concerning health;

2. EGN (Unified Civil Number), LNCh (Personal Number of a Foreigner), or other identification numbers;

3. payment and banking data;

4. data on the history of medical or veterinary requests;

5. another special category of personal data.

(3) Data for marketing purposes are retained until the withdrawal of consent or the exercise of the right to object. Evidence of the consent given/withdrawn is retained for a period of 5 years following withdrawal.

(4) Upon deletion of a user profile, the Company ceases sending Marketing Communications to the relevant Recipient, unless the Recipient has given separate consent to the continuation of marketing communications outside the context of the profile.

Article 17. (1) For the purposes of marketing activities, the Company may share data with the following categories of personal data processors:

1. e-mail delivery service providers (e.g., SendGrid and others);

2. SMS and instant messaging service providers, including but not limited to Viber Media S.à r.l. (Rakuten Group), WhatsApp Ireland Limited (Meta Platforms Group), Telegram Messenger Inc., and Signal Messenger LLC;

3. marketing agencies, designers, content specialists, and other persons assisting the Company in carrying out marketing activities;

4. analytics and advertising platforms (e.g., Google Analytics, Meta/Facebook) for the purposes of retargeting, performance measurement, and analytics;

5. other technical providers necessary for the functioning of the marketing channels;

6. legal advisors — lawyers, attorneys-at-law, and law firms assisting the Company in ensuring the compliance of marketing activities with the applicable legislation, in reviewing marketing content, in handling complaints or objections related to marketing communications, or in defending legal claims.

(2) The Company does not provide the Recipients' personal data to partners or third parties for their own marketing purposes without the separate explicit consent of the Recipient.

Article 18. (1) In the event of a conflict between this Policy and a mandatory provision of the applicable legislation, the mandatory provision prevails.

(2) Matters not governed by this Policy are subject to the provisions of the Privacy Policy, the General Terms and Conditions for the use of the OneCare Platform, and the applicable legislation.

Article 19. (1) The Company has the right to amend, supplement, or replace this Policy at any time, including where there is a change in the applicable legislation, in the marketing channels, in the types of content, in the providers, or in the functionalities of the Platform.

(2) The current version of the Policy is published on the Platform at www.onecare.bg, with an indication of the date of the last update.

(3) In the event of material changes affecting the rights of Recipients, the Company notifies the Recipients by e-mail, an in-profile message, a notification on the Platform, or another appropriate means.

Article 20. (1) This Policy was adopted by the Manager of the Company and enters into force as of 04.05.2026.

(2) The invalidity of an individual provision of this Policy does not result in the invalidity of the remaining provisions.