MARKETING POLICY

Art. 1. (1) This Marketing Policy (the “Policy”) governs the rules, conditions and procedure for sending Marketing Communications and conducting marketing activities by DocNow Medical Services EOOD, UIC 208622091, with registered office and management address: Sofia 1404, Triaditsa district, 109 Bulgaria Blvd., floor 2, office 2.5, email: [email protected], tel.: +359 889 999 955 (hereinafter the “Company”), in connection with the OneCare platform (the “Platform”), accessible at www.onecare.bg and through the OneCare mobile application, regardless of its version and the operating system of the device.

(2) This Policy applies together with the General Terms and Conditions for Use of the OneCare Platform, the Privacy Policy and the Cookie Policy.

(3) This Policy applies to Marketing Communications sent to:

1. Users — natural persons registered on the Platform;

2. Service Providers — merchants, medical establishments, specialists, and their employees or collaborators whose profiles have been created on the Platform;

3. Visitors — persons who have provided contact details through the Platform without completing registration, where applicable.

(4) This Policy does not apply to communications that are not marketing in nature, including but not limited to:

1. confirmations of orders, order status, changes, cancellations, rescheduling;

2. notifications relating to payment, invoicing, refunds;

3. communications relating to security, account access, breaches;

4. notifications of changes to the General Terms and Conditions, the Privacy Policy, or other applicable policies;

5. communications necessary for the performance of a legal obligation or a contractual obligation.

(5) Communications by which the Company informs Users of scheduled technical maintenance, temporary unavailability, a change in the operation of an existing functionality, a change in the conditions for using an already requested service, or any other circumstance directly related to the technical functioning of the Platform or to the performance of an already existing legal relationship, are operational and contractual in nature and do not constitute Marketing Communications within the meaning of this Policy.

(6) In-Platform Messages with promotional content, including banners, pop-up windows, cards or Account messages displayed while a person uses the Platform, are not based on consent and are not Marketing Communications within the meaning of this Policy. The Company displays them on the basis of a legitimate interest in direct marketing in connection with the Platform and the services and offers available through it (Article 6, paragraph 1, point (f) GDPR), and they are subject to the right to object under Article 7 of this Policy and Article 21 GDPR. These messages are not based on health data or other Special Categories of Personal Data, subject to Article 10, paragraph 5 of the Privacy Policy.

Article 2. (1) For the purposes of this Policy:

1. “Marketing Communication” means any communication sent for the purpose of directly or indirectly offering, promoting, advertising or encouraging the use of services, products, functionalities, promotional mechanisms, campaigns, offers, content or other commercial activity related to the Platform, the Company or Service Providers offering services through the Platform. In-Platform Messages under Article 1, paragraph 6 are not Marketing Communications within the meaning of this Policy.

2. “Recipient” means the person to whom the Marketing Communication is addressed.

(2) All other definitions have the meaning assigned to them in the General Terms and Conditions, the Privacy Policy, and the applicable legislation.

Article 3. (1) The Company sends Marketing Communications only where a valid legal basis exists, as follows:

1. the explicit, freely given, specific, informed, and unambiguous consent of the Recipient within the meaning of Art. 6(1)(a) GDPR, Art. 6 of the Electronic Commerce Act, and Art. 261 of the Electronic Communications Act (the “ECA”);

2. the legitimate interest of the Company within the meaning of Art. 6(1)(f) GDPR, only in the cases and under the conditions provided for in Article 4 of this Policy.

(2) The Company does not send Marketing Communications based on special categories of personal data within the meaning of Art. 9 GDPR, including data concerning health. Marketing Communications are not personalized on the basis of information relating to medical services, health status, diagnoses, therapies, medical history, or other health information.

(3) Where the Recipient is a Provider, Marketing Communications are sent to the business contact details indicated by the Provider. Where Marketing Communications are addressed to a specific natural person (e.g., a representative, employee, or specialist of the Provider), the consent rules under paragraph (1), item 1 apply.

(4) Push Notifications with advertising content constitute Marketing Communications within the meaning of this Policy and are sent only on the basis of separate express consent under paragraph 1, item 1, and not on the basis of Article 4. The legal basis for In-Platform Messages is set out in Article 1, paragraph 6.

(5) The Company does not send Marketing Communications to persons under 18, does not direct marketing content to such persons and does not process data of Service Recipients who are children or minors for marketing purposes, including where a User has ordered the service for them under Article 9 of the General Terms and Conditions.

Art. 4. (1) The Company may send Marketing Communications without prior consent, on the basis of legitimate interest, only where all conditions under the Electronic Communications Act (ЗЕС) are cumulatively met:

1. the Company obtained the Recipient's electronic contact details in the context of the provision of a service or a sale through the Platform;

2. the Marketing Communication relates to services, products, or functionalities of the Company that are similar to those used by the Recipient;

3. the Recipient was given a clear and free opportunity to object to the use of their electronic contact details for marketing purposes at the time they were provided, as well as with each subsequent communication;

4. the Recipient has not objected to receiving Marketing Communications.

(2) In the absence of any of the conditions under paragraph (1), the Company sends Marketing Communications solely on the basis of explicit consent under Art. 3(1), item 1.

(3) The Company carries out a legitimate interest assessment (balancing of interests) before commencing marketing activity based on legitimate interest, taking into account the reasonable expectations of the Recipient, the nature of the communication, and the availability of an easy opt-out mechanism.

(4) The legitimate interest under paragraph 1 covers only the Company's own service of providing and maintaining the Platform and its similar functionalities. Marketing Communications relating to Service Providers' services offered through the Platform are sent only on the basis of express consent under Article 3, paragraph 1, item 1.

Art. 5. (1) Consent to receive Marketing Communications is a single general consent for the channels under Article 8, with the additional conditions under paragraph 5 applying to marketing Push Notifications. Consent is given through a separate, active and unambiguous action by the Recipient, distinct from accepting the General Terms and Conditions and acknowledging this Policy, including:

1. ticking an unchecked consent box (checkbox) when registering or ordering a service through the Platform; or

2. clicking a button confirming consent; or

3. another explicit and unambiguous action from which an intention to receive Marketing Communications can be established.

(2) The consent box may not be pre-filled (pre-checked). Silence, inaction, a pre-ticked box, or continued use of the Platform do not constitute valid consent.

(3) Consent to receive Marketing Communications is not a condition for registration on the Platform, for requesting a service, for making a payment, or for using any functionality of the Platform.

(4) The Company documents and retains evidence of the consent given, including the date, time, manner in which consent was given, channel, and scope of the consent, for the entire period of processing and for a period of 5 years following its withdrawal or termination.

(5) Sending Marketing Communications through Push Notifications requires, in addition to consent under paragraph 1, a separate express permission (opt-in) for marketing Push Notifications given through the Platform, as well as notification permission at device level. This permission is distinct from permission for service and transactional notifications, is not a condition for registration, access to or use of the Platform or any of its functionalities, and may be withdrawn at any time through a setting in the Platform and through the device's notification settings, in accordance with Article 6.

(6) Consent under paragraph 1 also covers receiving partner offers under Article 15, which the Company sends in its own name.

Article 6. (1) The Recipient has the right to withdraw their consent to receive Marketing Communications at any time, without stating a reason and without owing any compensation, penalty, or other costs.

(2) Withdrawal may be effected by:

1. clicking an unsubscribe link contained in every marketing communication sent by e-mail;

2. sending a “STOP” reply or another designated command for Marketing Communications sent via SMS, Viber, WhatsApp, Telegram, Signal, or another instant messaging application;

3. changing the communication settings in the user profile, where such functionality is available on the Platform;

4. sending a request to the e-mail address: [email protected];

5. another method provided in the Platform or in the particular marketing communication;

6. disabling marketing Push Notifications through the Platform settings or the device's notification settings.

(3) The withdrawal of consent takes effect within a reasonable period from its receipt, but no later than 5 business days, unless technical reasons require a longer period, of which the Recipient is notified.

(4) The withdrawal of consent does not affect the lawfulness of processing carried out prior to the withdrawal.

(5) The withdrawal of consent to Marketing Communications does not affect or terminate:

1. the Recipient's user profile on the Platform;

2. services already requested, confirmed, or in the process of being performed;

3. the Company's right to send communications that are not marketing communications within the meaning of Article 1, paragraph 4 of this Policy;

4. displaying In-Platform Messages under Article 1, paragraph 6, which are subject to the right to object under Article 7.

(6) The Recipient may withdraw consent entirely, for all channels under Article 8, or only for an individual channel while retaining consent for the others. Withdrawal for an individual channel does not affect consent for the other channels.

Article 7. (1) The Recipient has the right to object at any time to the processing of their personal data for direct marketing purposes, including profiling to the extent that it is related to direct marketing, pursuant to Art. 21(2) and (3) GDPR.

(2) Upon receipt of an objection under paragraph (1), the Company ceases processing the Recipient's personal data for marketing purposes without undue delay.

(3) The right to object under paragraph 1 also covers In-Platform Messages under Article 1, paragraph 6 and may be exercised through the mechanisms under Article 6, paragraph 2. Upon receiving an objection, the Company stops displaying In-Platform Messages with promotional content and sending Marketing Communications, without affecting the service and contractual communications under Article 1, paragraph 4.

Art. 8. (1) The Company may send Marketing Communications through the following channels, including, but not limited to::

1. e-mail;

2. short text message (SMS);

3. instant messaging applications (Viber, WhatsApp, Telegram, Signal, and others);

4. Push Notifications, subject to Article 5, paragraph 5;

5. telephone call;

6. social networks and digital platforms (Facebook, Instagram, TikTok, YouTube, LinkedIn, and others), including through retargeting and personalized advertising audiences;

7. other channels that the Company may introduce in the future, of which the Recipient will be duly informed. In-Platform Messages under Article 1, paragraph 6 are not a marketing channel under this paragraph and are governed on the basis of legitimate interest.

(2) When giving consent, the Recipient may, where the Platform provides such an option, select their preferred channels for receiving Marketing Communications.

(3) For channels requiring separate technical permission or separate consent (e.g. Push Notifications), Marketing Communications are sent only after these have been provided, subject to Article 5, paragraph 5.

(4) When social networks and digital platforms are used for marketing purposes (retargeting, personalized audiences), the processing of data is carried out under the terms of the Cookie Policy and the Privacy Policy. Data provided to the relevant platform for this purpose are processed in accordance with that platform's own terms and policies.

(5) Device advertising identifiers and tracking for advertising purposes are managed through consent. On iOS devices, the Company does not track across applications and websites for advertising purposes without App Tracking Transparency (ATT) permission, and on other platforms without the corresponding consent.

(6) The Company does not build or use custom advertising audiences, retargeting or other targeting based on health data or other Special Categories of Personal Data, or on data that alone or in combination allow conclusions to be drawn about a particular person's health, including screen names, event names and parameters, and identifiers of ordered services. This prohibition is unconditional and cannot be overridden by consent.

(7) Changing a particular service provider within an already described channel, or adding a new instant messaging application within the channel under paragraph 1, item 3, does not constitute an amendment to this Policy.

Article 9. (1) The Marketing Communications sent by the Company may include the following types of content:

1. newsletters with news, updates, new services, and functionalities of the Platform;

2. promotional offers, discounts, vouchers, promotional codes, and special conditions for using services through the Platform;

3. notifications of new categories of services, new Service Providers, or expansion of the scope of the Platform;

4. seasonal and themed campaigns;

5. promotional content relating to particular Service Providers of non-medical services (e.g. cleaning companies, gardeners, childcare specialists), including content prepared at the request and expense of the relevant Service Provider, with the Company sending the communication in its own name;

6. invitations to participate in a referral/partner program, where available;

7. invitations to participate in surveys, polls, and feedback;

8. educational and informational content related to the services offered through the Platform;

9. partner offers from third parties where the Company has assessed that they may be of interest to the Recipient

10. other types of marketing content compatible with the purpose of the Platform.

(2) Marketing Communications relating to specific Service Providers do not include content from or for medical establishments, medical specialists, or veterinary practices in their capacity as providers of health or veterinary services.

(3) The Company does not send Marketing Communications that:

1. contain or are based on data concerning the health of the Recipient or of a third party;

2. personalize content on the basis of past medical or veterinary requests;

3. are misleading, deceptive, contain false information, or are in breach of the applicable legislation;

4. violate the rules on advertising health services, medicinal products, medical devices or veterinary medicinal products laid down in applicable legislation;

5. offer, promise or provide a discount, voucher, promotional code, participation in a game, incentive or other benefit in exchange for rating, reviewing or commenting on the Mobile Application in an application store, or for rating or reviewing a Service Provider or service in the Platform.

(4) Where a marketing communication contains promotional content prepared at the request and expense of a specific Provider, the following rules apply:

1. the sender of the communication is the Company, not the Provider;

2. the promotional content is clearly marked as “promotional”, “sponsored”, or in another appropriate manner allowing the Recipient to distinguish promotional from editorial content;

3. the communication is sent only to persons who have given valid consent to receive marketing communications in accordance with this Policy;

4. the Company does not provide the Service Provider with the Recipients' personal data in connection with the sending of the communication;

5. the Service Provider is responsible for the accuracy, lawfulness, and non-infringing nature of the promotional content it has provided to the Company for inclusion in the communication.

Article 10. (1) The Company may personalize Marketing Communications on the basis of the following categories of data, where the corresponding legal basis exists:

1. history of requests for non-medical services;

2. preferences, choices, and settings indicated by the Recipient in their profile;

3. location (locality, district), to the extent relevant to the availability of services;

4. type of services used and frequency of requests;

5. age group, to the extent relevant to the type of services offered;

6. activity and behavior on the Platform, collected through cookies and similar technologies under the terms of the Cookie Policy.

(2) The personalization under paragraph (1) is not carried out on the basis of:

1. data concerning health or another special category of personal data;

2. history of requests for medical or veterinary services;

3. the content of medical or veterinary documentation uploaded through the Platform.

(3) The Recipient has the right at any time to object to profiling for marketing purposes under Article 21 GDPR, through the mechanisms under Article 6, paragraph 2 of this Policy and in accordance with Section X of the Privacy Policy.

(4) Upon an objection under paragraph (3), the Company ceases profiling and personalization in respect of the relevant Recipient and switches to sending only general, non-personalized Marketing Communications, provided the Recipient has not withdrawn their marketing consent entirely.

Article 11. (1) The Company may carry out segmentation of Recipients for marketing purposes on the basis of aggregated and non-individualized criteria, including locality, type of non-medical services used, frequency of requests, and other similar parameters.

(2) The segmentation under paragraph (1) is carried out in compliance with the principle of data minimization and the principle of purpose limitation, pursuant to Art. 5 GDPR.

Article 12. (1) Every marketing communication sent by the Company contains, as a minimum:

1. clear identification of the Company as the sender of the communication, including, but not limited to, identification as “OneCare”;

2. an easy, free, and accessible mechanism for opting out of receiving future Marketing Communications (an unsubscribe link, an opt-out command, or another appropriate means);

3. contact details of the Company (e-mail: [email protected]).

(2) Marketing Communications sent via SMS or instant messaging applications contain instructions on the manner in which the Recipient may opt out of future communications.

(3) Marketing Communications are not sent from a hidden, disguised, false, or misleading sender address or number.

(4) The subject or title of the Marketing Communication must not mislead as to the content of the communication.

(5) In-Platform Messages under Article 1, paragraph 6:

1. are clearly, briefly and unambiguously identified as advertising or promotional, in a way that enables the Recipient to distinguish them from the Platform's other content;

2. state on whose behalf they are presented and, where the content was prepared at the request and expense of a Service Provider or partner, also state that fact;

3. can be closed or dismissed by the Recipient with a single action, without loss of entered data, interruption of an Order Request or any adverse consequence for the Recipient;

4. are not displayed during the steps for ordering a service, making payment or submitting a complaint or notice, and do not obscure interface elements necessary to complete these actions;

5. do not use an interface, structure or presentation that misleads the Recipient or distorts their ability to make a free and informed choice.

(6) Marketing Push Notifications do not contain health data, other Special Categories of Personal Data, the name of an ordered medical or veterinary service, or other confidential information, in compliance with the Privacy Policy rules on notification content.

Article 13. (1) The Company may send Marketing Communications to Service Providers whose profiles have been created on the Platform, for the purpose of informing them of new functionalities, new categories of services, promotional programs, training, partnership initiatives, and other opportunities related to the Platform.

(2) Marketing Communications to Service Providers are sent to the contact details indicated by the Service Provider upon creation of the profile or in its contractual relationship with the Company.

(3) The Service Provider has the right to opt out of receiving Marketing Communications at any time in accordance with Article 6 of this Policy.

(4) Opting out of Marketing Communications does not affect the sending of operational, administrative, or contractual communications necessary for the functioning of the legal relationship between the Company and the Provider.

Article 14. (1) The Company may organize a referral/partner program (“Invite a Friend” or similar), through which Users and/or Service Providers may invite third parties to register on the Platform or to use its services, under conditions and a procedure determined by the Company.

(2) Under a referral program, the invited person receives an invitation from another User or Provider, and not directly from the Company. The Company does not send Marketing Communications to the invited person until that person independently takes action to register or to give consent.

(3) The person who sends the invitation is responsible for ensuring that the invited person has not expressed objection to receiving invitations from them and that the invitation does not breach the applicable legislation.

(4) The specific terms of the referral program, including any incentives, discounts, vouchers, or other benefits, are governed by separate special terms published on the Platform.

(5) The Company does not store contact details of invited persons, unless and until they register on the Platform themselves and/or give consent to the processing of their data.

(6) The Company does not request or obtain access to the contact list, telephone directory or correspondence on the device of the person sending the invitation. If such a functionality is introduced, access takes place only after separate permission through the operating system; the data are used solely to send the particular invitation selected by the person, are not uploaded or stored by the Company and are not used for any other purpose.

Art. 15. (1) The Company may include offers, promotions or information from third parties (partners) in its marketing communications where it has assessed that they may be of interest to the Recipient. Partners are third parties offering consumer goods and services in areas related to everyday personal and professional life and use of the Platform, including the home and household, home services, gardening and repairs, family and care for children and older people, education and training, leisure, shopping, tourism and telecommunications services, and other consumer goods and services. Partners do not include persons whose offers would require processing special categories of personal data or relate to politics.

(2) Partner offers are sent by the Company, and not directly by the third party. The Company does not provide partners with the Recipients' personal data for the partners' own marketing purposes, unless the Recipient has given separate explicit consent to this. The same rule applies where the content has been prepared at the request of a Service Provider in accordance with Art. 9(4).

(3) Partner offers do not include offers relating to medical services, health products, medicinal products, medical devices, or veterinary medicinal products, unless the applicable legislation expressly permits such advertising and all applicable requirements have been met.

(4) Partner offers are clearly marked as such in the relevant marketing communication.

Article 16. (1) The personal data processed for marketing purposes include:

1. names;

2. e-mail;

3. telephone number;

4. address (locality, district), where relevant;

5. consent status data (given/withdrawn, date, channel);

6. data on the history of requests for non-medical services, preferences, activity, where applicable;

7. technical data collected through cookies and similar technologies, under the terms of the Cookie Policy.

(2) The Company does not process for marketing purposes:

1. data concerning health;

2. EGN (Unified Civil Number), LNCh (Personal Number of a Foreigner), or other identification numbers;

3. payment and banking data;

4. data on the history of medical or veterinary requests;

5. another special category of personal data.

(3) Data for marketing purposes are retained until the withdrawal of consent or the exercise of the right to object. Evidence of the consent given/withdrawn is retained for a period of 5 years following withdrawal.

(4) Upon deletion of a user profile, the Company ceases sending Marketing Communications to the relevant Recipient, unless the Recipient has given separate consent to the continuation of marketing communications outside the context of the profile.

Article 17. (1) For the purposes of marketing activities, the Company may share data with the following categories of personal data processors:

1. e-mail delivery service providers (e.g., SendGrid and others);

2. SMS and instant messaging service providers, including but not limited to Viber Media S.à r.l. (Rakuten Group), WhatsApp Ireland Limited (Meta Platforms Group), Telegram Messenger Inc., and Signal Messenger LLC;

3. marketing agencies, designers, content specialists, and other persons assisting the Company in carrying out marketing activities;

4. other technical providers necessary for the functioning of the marketing channels;

5. legal advisors — lawyers, attorneys-at-law, and law firms assisting the Company in ensuring the compliance of marketing activities with the applicable legislation, in reviewing marketing content, in handling complaints or objections related to marketing communications, or in defending legal claims.

(2) The Company does not provide the Recipients' personal data to partners or third parties for their own marketing purposes without the separate explicit consent of the Recipient.

(3) With respect to data processed through the analytics and advertising platforms under Article 8, paragraph 1 and through those platforms' software components embedded in the Mobile Application, including Firebase components, the respective platforms act as independent or joint controllers under their own terms and policies. The Company shares data with them only subject to Article 8, paragraphs 5 and 6 and the Cookie Policy, and does not activate functionalities linking data collected through the Mobile Application to advertising profiles on those platforms unless the Recipient has given the corresponding permission or consent.

Article 18. (1) In the event of a conflict between this Policy and a mandatory provision of the applicable legislation, the mandatory provision prevails.

(2) Matters not governed by this Policy are subject to the provisions of the Privacy Policy, the General Terms and Conditions for the use of the OneCare Platform, and the applicable legislation.

(3) This Policy is drawn up in Bulgarian. The Bulgarian version is the original and the only legally binding version. Any version in another language, including one prepared through automated translation, is for information only and for the convenience of the person concerned. In the event of any discrepancy, conflict or doubt as to meaning, the Bulgarian version applies, and a version in another language does not create rights and obligations different from those provided for in the Bulgarian version.

Article 19. (1) The Company has the right to amend, supplement, or replace this Policy at any time, including where there is a change in the applicable legislation, in the marketing channels, in the types of content, in the providers, or in the functionalities of the Platform.

(2) The current version of the Policy is published on the Platform at www.onecare.bg, with an indication of the date of the last update.

(3) In the event of material changes affecting the rights of Recipients, the Company notifies the Recipients by e-mail, an in-profile message, a notification on the Platform, or another appropriate means.

Art. 20. (1) This Policy has been adopted by the Company's manager and enters into force as of 16.09.2026. It repeals and replaces all previous versions of the Marketing Policy.

(2) The invalidity of an individual provision of this Policy does not result in the invalidity of the remaining provisions.