Terms of Use and B2B SaaS Subscription Agreement

Parties and Definitions

This Agreement is concluded between the parties identified below.

• Provider ("OYOX", the "Company" or the "Data Controller"): OYOX LLC — a Domestic Limited Liability Company registered with the New Mexico Secretary of State on 23 February 2026 (Registration No. 0008084103); registered office at 1209 Mountain Road PL NE, STE N, Albuquerque, NM 87110, United States. BLUEHAMS is a brand and product name belonging exclusively to the Company.
• Customer ("Clinic"): A hearing aid sales and fitting center, acting for commercial or professional purposes, that subscribes to the Service by accepting this Agreement on the registration screen.

The Customer acknowledges and declares that it obtains the Service exclusively within the scope of its commercial or professional activity. The parties are merchants within the meaning of Turkish Commercial Code No. 6102 (the "TCC") and their relationship constitutes a commercial transaction; accordingly, Turkish Consumer Protection Law No. 6502, the Regulation on Distance Contracts and other provisions of consumer legislation do not apply to this Agreement. The Service is not offered to consumers.

Definitions

The defined terms below carry the meanings shown against them wherever they appear in quotation marks or capitalized throughout this Agreement and its annexes.

• Platform / Service: The cloud-based management software (Software as a Service — SaaS) for hearing aid centers, offered on a subscription basis via the bluehams.com domain and the associated Panel.
• Panel: The administration interface through which the Customer and Users access the Service.
• User: A natural person accessing the Platform on behalf of and with the authorization of the Customer (business owner and staff).
• Data Subject: A natural person whose Personal Data is processed, including the Customer's patients as well as Users, visitors and those submitting demo requests.
• Personal Data: Within the meaning of Article 3 of the Law, any information relating to an identified or identifiable natural person.
• Customer Data: All data and documents entered into or uploaded to the Platform by the Customer or its Users (including patient records, appointments, collection records and uploaded files).
• Data Processing Agreement ("DPA"): The Data Processing Agreement, an integral annex to this Agreement.
• Subscription Term: The monthly or annual billing period according to the selected plan.

Subject Matter and Nature of the Service

The subject of this Agreement is OYOX making the BLUEHAMS Platform available for the Customer's remote access and use during the subscription term. The Service is a pure subscription service (Software as a Service) that involves no transfer of source code, no license assignment and no transfer of reproduction rights, and it constitutes an innominate contract of continuous performance within the meaning of Turkish Code of Obligations No. 6098 (the "TCO"). No copy of the software is delivered to the Customer; no ownership, disposal or reproduction right over the software is granted. The Customer acquires only a non-exclusive, non-transferable right of access and use, limited to the subscription term.

As of the current release, the scope of the Service includes the following modules.

• Patient registration and follow-up
• Appointment management
• Stock and product management
• Technical service tracking
• Collections, installments and patient ledger module
• SMS reminder templates
• Staff and branch management with attendance tracking
• Performance reports
• Document generation and printing
• Announcements, audit log and trash bin
• Dark theme with Turkish/English interface

Module scope and functions may evolve by the nature of the Service and may be modified in accordance with the procedure set out in Section 13.

Account Opening, Accurate Information and Security

The Customer is obliged to provide accurate, current and complete information about its business and its authorized official during registration. After registration, accounts are activated upon administrator approval by OYOX; OYOX may refuse account opening where just cause exists or request additional verification.

• The Customer is responsible for the confidentiality of usernames and passwords and for all actions performed under its account.
• The Customer assigns User accounts only to its own staff, limits access rights to what job duties require, and revokes the access of departing staff without delay.
• If the Customer suspects that passwords or account credentials have been compromised, it shall notify OYOX without delay.
• The Platform offers two-factor authentication (2FA — TOTP) and recovery codes. As patient data includes special categories of Personal Data, the Customer is obliged to ensure that 2FA is enabled on all User accounts that access patient data. OYOX reserves the right to technically enforce the use of 2FA in line with the data security obligations under Article 12 of the Law and may bring such enforcement into effect in stages.
• Sessions are automatically terminated for security after 30 minutes of inactivity.

Fees, Taxes and Payment

Subscription fees are denominated in Turkish Lira, and current amounts are announced on bluehams.com and in the Panel. Announced prices do not include VAT.

• The agreed fee is a net amount. Any potential withholding tax obligations that may arise in Türkiye on the service fee belong to the Customer; if such withholding is required, the Customer shall gross up the payment so that OYOX receives the net amount in full. Upon request, OYOX provides its US certificate of tax residency.
• As OYOX LLC has no tax liability in Türkiye, no Turkish e-invoice (e-fatura/e-arşiv) is issued; commercial invoices are issued for payments. The tax consequences on the Customer's side should be assessed with the Customer's financial advisor.
• Payment is made by bank transfer/EFT; the Customer submits the payment receipt via the Panel. The Subscription Term commences or renews upon verification of payment.
• Advantages related to the annual payment option are published, as announced, on the website and in the Panel.
• In the event of default in payment, the advance (avans) interest rate applicable to commercial transactions under Turkish Law No. 3095 on Legal Interest and Default Interest shall apply.

Late Payment and Suspension

If the subscription fee is not paid when due, OYOX sends reminders to the Customer via the Panel and/or registered communication channels. If payment is not made within a reasonable period, the account is placed under a read-only restriction (viewing only); during this restriction, new data entry and module usage may be halted.

• During suspension, Customer Data is not deleted; the data continues to be preserved in accordance with the retention framework aligned with the Retention and Disposal Policy.
• Access is restored to its previous state upon payment of the overdue amount together with accrued advance interest.
• If non-payment continues, OYOX may terminate the Agreement under Section 10; even in that case, the data return provisions of Section 10 apply.

Service Level, Maintenance and Backups

OYOX exercises commercially reasonable efforts to keep the Service uninterrupted and error-free; however, given the nature of internet-based services, no guarantee of one hundred percent uptime is given.

• Planned maintenance is announced in advance via the Panel and/or the website to the extent possible, and is scheduled during low-traffic hours where feasible.
• Customer Data is backed up regularly in encrypted form (AES-256); in addition, an automatic backup is taken before every deployment (update). All backups — including pre-deployment automatic backups — are retained for 14 days.
• Data is hosted on servers located within the borders of the Republic of Türkiye (Istanbul); see the Privacy Policy and the Retention and Disposal Policy for details.
• Emergency security interventions may be carried out without prior announcement; in such cases the Customer is informed as soon as possible.

Use Restrictions and Prohibited Acts

The Customer and its Users shall use the Service only for lawful purposes and within the framework of this Agreement. The following acts are prohibited.

• Uploading unlawful content or data, content infringing third-party rights, or false data to the Platform
• Acts that damage or overload the operation of the Platform, servers or networks (including uploading malicious software, automated bulk querying and unauthorized security testing)
• Subjecting the software to reverse engineering, attempting to access the source code, copying it, creating derivative works, or renting/transferring the access right to third parties
• Sharing access credentials with unauthorized persons or attempting to access another account's data
• Systematically examining the Service for the purpose of developing a competing product

In case of violation of these prohibitions, OYOX may, depending on the severity of the violation, temporarily suspend the relevant User account or the Customer account, and may terminate the Agreement for just cause if the violation is not remedied. The rights of claim and action arising from the unfair competition provisions of the TCC and from other legislation on intellectual and industrial property rights are reserved. The Customer is responsible for the lawfulness of the content it and its Users enter into the Platform.

Intellectual Property

The software constituting the Platform, its source code, database structure, interface design, the BLUEHAMS trademark and all related intellectual and industrial property rights belong exclusively to OYOX LLC. This Agreement grants the Customer no intellectual property rights other than a right of access and use limited to the subscription term.

All rights in Customer Data belong to the Customer. OYOX processes Customer Data solely for providing the Service, ensuring security and fulfilling legal obligations, within the framework of the Data Processing Agreement, and claims no further rights whatsoever over Customer Data.

Suggestions and feedback submitted by the Customer regarding the Service are not considered Customer Data; OYOX may use such feedback in product development activities free of charge and without time limit.

Protection of Personal Data

The parties' roles and obligations under Personal Data Protection Law No. 6698 (the "Law") are governed by the Data Processing Agreement, which is an integral annex to this Agreement. With respect to patient data recorded on the Platform by the Customer, the Customer (Clinic) is the data controller and OYOX is the data processor. In its processing of its own customer and visitor data, OYOX acts as data controller, and the Privacy Notice and the Privacy Policy apply to those activities.

• Personal Data is hosted on servers located within the borders of the Republic of Türkiye. Where a transfer abroad becomes necessary, such transfer is carried out only with the appropriate safeguards provided for in Article 9 of the Law and secondary legislation.
• Processing that is mandatory for the conclusion and performance of this Agreement relies on Article 5/2-c of the Law (being directly related to the conclusion or performance of a contract) and other applicable lawful grounds.
• The provisions on joint responsibility for data security under Article 12/2 of the Law are reserved; nothing in this Agreement shall be interpreted as removing mandatory data protection obligations.
• The Customer itself fulfills its obligations toward its own patients as data controller (privacy notices within the framework of Article 5 of the Communiqué on the Principles and Procedures for Fulfilling the Obligation to Inform, explicit consent where required, and other controller duties); OYOX provides the reasonable support foreseen in the DPA.
• Data Subjects may exercise their rights in accordance with the procedure set out on the KVKK Application page.

Term, Termination and Return of Data

The Agreement enters into force upon acceptance on the registration screen and remains valid for the selected Subscription Term. The subscription renews at the end of each term upon payment; the Customer may decide not to renew for the following term at any time.

• Either party may terminate the Agreement for just cause if the other party fails to remedy a material breach within a reasonable period despite written notice.
• OYOX may terminate the Agreement in case of serious violation of the prohibitions in Section 7 or continued non-payment as set out in Section 5.

Return and Disposal of Data

• Upon termination of the Agreement for any reason, the Customer is granted read-only access for 30 days from the termination date. Upon the Customer's request, OYOX provides the Customer with a copy of the Customer Data within a reasonable period, in a commonly used and machine-readable electronic format.
• At the end of this period, Customer Data is permanently disposed of from the system in accordance with the Retention and Disposal Policy and the DPA; all copies in backups cease to exist upon expiry of the backup retention period (14 days).
• Records whose retention is required by legislation (for example invoicing and accounting records) are kept for the applicable statutory period.
• Since record retention obligations arising from healthcare legislation rest with the Customer, the Customer is strongly advised to export its data or request a copy before termination.

Limitation of Liability

OYOX's total liability arising from this Agreement is limited to the total subscription fees actually paid by the Customer during the 12 months preceding the event giving rise to liability.

• Subject to Article 115 of the TCO, this limitation does not apply in cases of intent or gross negligence, nor to liabilities arising from mandatory rules of law that cannot be limited (including joint responsibility for data security under Article 12/2 of the Law).
• OYOX shall not be liable for loss of profit, loss of reputation, loss of business or indirect damages, unless caused by its intent or gross negligence.
• OYOX is not liable for damages arising from the Customer's failure to fulfill its own legal obligations (keeping official registries and records, informing its patients, compliance with professional legislation).
• As both parties are merchants, they acknowledge, within the framework of the duty to act as a prudent businessperson under Article 18/2 of the TCC, that this limitation is part of the commercial balance of the Agreement.

Force Majeure

Events beyond the parties' control that render performance of the Agreement impossible or substantially more difficult (including natural disasters, epidemics, war, terrorism, general internet backbone or data center outages, widespread cyber attacks, prohibitions arising from legislative changes and decisions of public authorities) constitute force majeure.

• During force majeure, the parties' performance obligations are suspended to the extent affected; neither party is deemed in default during this period.
• The party affected by force majeure shall notify the other party without delay of the situation and its estimated duration, and shall use reasonable efforts to mitigate its impact.
• If force majeure continues uninterrupted for more than 60 days, either party may terminate the Agreement without compensation; in that case, prepaid fees corresponding to the unused period are refunded to the Customer and the data return provisions of Section 10 apply. The provisions of Article 136 of the TCO (impossibility of performance) are reserved.

Changes to the Agreement and the Service

OYOX may amend this Agreement, the prices and the scope of the Service in line with legislative requirements, security needs and product development.

• Changes are announced on bluehams.com and/or in the Panel; the current version and effective date are shown at the top of the document.
• Material changes to the Customer's detriment (price increases, substantial narrowing of scope, aggravation of the liability regime) are announced at least 30 days before they enter into force.
• A Customer that does not accept a material change has the right not to renew its subscription as of the end of the current term before the change enters into force; continued use of the Service after the notice period constitutes acceptance of the change.
• The 30-day period is not required for purely technical improvements and updates that are not to the Customer's detriment.

Governing Law and Competent Authorities

This Agreement and all disputes arising from or in connection with it are governed by Turkish law.

The invalidity of any provision of the Agreement does not affect the validity of the remaining provisions; the invalid provision is deemed replaced by a valid provision that comes closest to the parties' commercial intent.

Notices and Contact

Notices under this Agreement are made through the following channels.

• Notices from OYOX to the Customer are made via Panel announcements and/or the Customer's registered contact details; the Customer is obliged to keep its contact details up to date.
• For notices from the Customer to OYOX and for applications by Data Subjects resident in Türkiye, the primary channel is the above OYOX LLC (US) address by post: 1209 Mountain Road PL NE, STE N, Albuquerque, NM 87110, United States. As a secondary channel, the email address kvkk@bluehams.com may be used (this address will become active once the email infrastructure is completed); the contact form on bluehams.com may also be used.
• For applications concerning Personal Data, the procedure on the KVKK Application page applies.
• Notices producing legal consequences, such as termination and notices of material breach, should as a rule be made in writing through a provable channel.

Entry into Force

This Agreement enters into force at the moment the Customer accepts it electronically on the registration screen. Electronic acceptance is sufficient for the formation of the Agreement and for it to bind the parties; the parties accept the validity of this acceptance and agree that electronic transaction records (date, action and account records) shall constitute evidence in disputes within the meaning of the CCP. The person accepting on behalf of the Customer declares and warrants that they are authorized to bind the Customer.

The Data Processing Agreement, as an annex to this Agreement, enters into force together with it and as its integral part. In the event of a conflict between the body of the Agreement and its annexes regarding the protection of personal data, the provisions of the DPA prevail.

Version 1.1 — 17 August 2026.