CARDILINK GMBH

1

CARDILINK GMBH

Platform Terms of Service

Terms for individual authorized users of the CardiLink Platform

Effective date: 9th February 2026

CardiLink GmbH

Bahnhofstraße 2

90402 Nürnberg

Germany

support@cardi-link.com

These Platform Terms of Service (“Terms of Service”) govern an individual user’s access to and use of the CardiLink

web platform, including the login page, web dashboard and related authenticated services (the “Platform”).

The Platform is provided by CardiLink GmbH (“CardiLink”) primarily to business, governmental, institutional and

professional customers and their authorized users. These Terms of Service govern individual use of the Platform; they

do not replace the commercial agreement between CardiLink and the organization through which your account is

provided.

1. Relationship with the Customer Agreement

1.1 Your right to access the Platform derives from an agreement, Order, licence or other commercial relationship

between CardiLink and the organization through which your account has been provided (“Customer Organization”).

1.2 These Terms of Service govern your individual access to and use of the Platform. The applicable agreement

between CardiLink and the Customer Organization, including any General Terms and Conditions, Master Services

Agreement, Order, schedule, addendum or Data Processing Agreement (“Customer Agreement”), governs the

commercial relationship.

1.3 If these Terms of Service conflict with the Customer Agreement, the Customer Agreement prevails to the extent of

the conflict.

1.4 By accessing or using the Platform, you confirm that you are authorized by the Customer Organization to do so

and agree to comply with these Terms of Service.

2. Authorized Users and Accounts

2.1 Platform access is limited to authorized users. You may use the Platform only for the legitimate business,

governmental, institutional or professional purposes for which your account was issued.

2.2 You must provide accurate account information, keep your credentials confidential and take reasonable steps to

prevent unauthorized use of your account.

2.3 You must not share personal credentials with another person. System, integration or shared technical accounts

may be used only where expressly permitted by CardiLink or the Customer Organization.

2.4 You must promptly notify your Customer Organization or CardiLink at support@cardi-link.com if you know or

reasonably suspect that your account or credentials have been compromised.

2.5 The Customer Organization controls user roles and permissions within the scope of its contracted rights. Your

access may be modified or removed by the Customer Organization or CardiLink where appropriate.

3. Permitted Use

3.1 Subject to the Customer Agreement, you may use the Platform to manage AED-related operational information,

connected and non-connected AEDs, lifecycle information, locations, inspections, maintenance, consumables, service

records, warranty information, notifications, reports, registry information and other functions made available to your

account.

CARDILINK GMBH

2

3.2 Available functionality depends on the Customer Organization’s package, device compatibility, integrations,

permissions, configuration, country availability and other technical or contractual factors.

3.3 You are responsible for using the Platform in accordance with applicable law, your organization’s policies, the

Customer Agreement and these Terms of Service.

4. Prohibited Use

You must not:

•

access or attempt to access accounts, organizations, data or functions for which you are not authorized;

•

share, disclose or misuse login credentials;

•

circumvent authentication, authorization, security, rate limits or technical restrictions;

•

reverse engineer, decompile, disassemble or attempt to derive source code except where mandatory law

expressly permits it;

•

introduce malware, malicious code or content intended to interfere with the Platform;

•

use automated scraping, extraction or similar tools except through an API or interface expressly authorized by

CardiLink;

•

use the Platform to develop or benchmark a competing product in breach of the Customer Agreement;

•

upload or process information unlawfully or without the necessary rights, permissions or legal basis;

•

misrepresent AED status, inspection results, location information or other operational data; or

•

use the Platform in a manner that could damage, overload, disrupt or compromise CardiLink systems or other

users.

5. AED Information and User Responsibility

5.1 The Platform is designed for AED infrastructure management, connectivity, administrative monitoring and

operational support.

5.2 Information displayed in the Platform may originate from connected devices, authorized field users, customer

records, file imports, manufacturers or third-party systems. Data depth, update frequency and accuracy may therefore

vary.

5.3 Where information is described as validated, this may mean that it has been captured or confirmed through an

authorized workflow or supported by connected-device data. It does not mean that CardiLink has independently

verified every AED record, location, status or data point unless a specific validation service is expressly agreed.

5.4 Users remain responsible for entering and maintaining accurate information within the scope of their assigned

responsibilities and for following their organization’s AED inspection, maintenance, service and emergency

procedures.

6. No Emergency Dispatch or Clinical Function

6.1 The Platform is not emergency dispatch software, clinical decision-support software or a substitute for legally or

operationally required AED inspection, maintenance, training or emergency procedures.

6.2 The Platform does not diagnose, treat, prevent or cure a medical condition and does not determine the clinical

suitability of an AED.

6.3 CardiLink does not guarantee that an AED is physically present, accessible, functional or ready for use at any

particular time, and does not guarantee that a notification, device status or other information will be transmitted,

received, read or acted upon within a particular time.

6.4 The Platform must not be relied upon as the sole means of emergency communication or as a guarantee of

emergency-response outcomes.

7. Connectivity and Device Status

7.1 CORE, PRO and INSIDE may use cellular connectivity provided through third-party mobile network operators and

connectivity providers. Cellular coverage, roaming, network availability, network changes, outages, local restrictions

and other telecommunications conditions are outside CardiLink’s control.

CARDILINK GMBH

3

7.2 CardiLink does not guarantee uninterrupted cellular connectivity or continuous transmission of device data.

Platform status information represents the latest information available to the Platform and may be delayed, incomplete

or unavailable.

7.3 Loss or degradation of a third-party cellular network does not by itself mean that the underlying AED is defective,

and the Platform should not be used as a substitute for required physical inspections or maintenance.

8. Notifications

Notifications, alerts, reminders and status indicators are provided to support operational awareness. Their availability

may depend on device connectivity, data quality, user configuration, third-party services and technical conditions.

Users and Customer Organizations remain responsible for appropriate operational follow-up.

9. Data and Privacy

9.1 You may access or enter information only where you and the Customer Organization are authorized to do so.

9.2 Personal data must be handled in accordance with applicable data-protection law, the Customer Organization’s

instructions and policies, the Customer Agreement and the CardiLink Platform Privacy Policy.

9.3 The Customer Organization generally controls the business data it places in the Platform. CardiLink may process

that data on the Customer Organization’s behalf under the applicable Data Processing Agreement.

9.4 You must not intentionally upload protected health information, special-category personal data or other highly

sensitive personal data unless the applicable Customer Agreement expressly permits such processing and the

Platform has been configured for it.

10. Intellectual Property

10.1 CardiLink and its licensors retain all rights, title and interest in the Platform, software, documentation, interfaces,

designs, trademarks, APIs and related intellectual property.

10.2 No ownership rights are transferred to you. Your right to use the Platform is limited to the authorized access

provided through the Customer Organization and ends when that authorization or the applicable Customer Agreement

ends.

10.3 You may not use CardiLink names, logos or trademarks except as authorized by CardiLink or the Customer

Agreement.

11. Platform Availability, Maintenance and Changes

11.1 CardiLink may perform scheduled or emergency maintenance and may update the Platform for security, legal,

technical, performance or operational reasons.

11.2 Platform availability may be affected by maintenance, internet or telecommunications failures, cloud

infrastructure, third-party systems, force majeure, security events or circumstances outside CardiLink’s reasonable

control.

11.3 Any contractual service level or availability commitment applies only if and to the extent stated in the Customer

Agreement. These Terms of Service do not create a separate service-level commitment to an individual user.

12. Suspension and Termination of User Access

12.1 CardiLink or the Customer Organization may suspend or terminate your access where your authorization ends,

the Customer Agreement expires or is suspended, security requires immediate action, misuse is suspected,

applicable law requires it, or you materially breach these Terms of Service.

12.2 Where reasonably practicable, access will be limited only to the extent necessary to address the relevant issue.

12.3 Termination of your individual account does not itself terminate or modify the Customer Agreement.

13. Disclaimers and Liability

13.1 The contractual warranties, disclaimers and limitations of liability applicable to the Platform are those agreed

between CardiLink and the Customer Organization. These Terms of Service do not expand CardiLink’s warranties or

liability beyond the Customer Agreement or mandatory law.

CARDILINK GMBH

4

13.2 Nothing in these Terms of Service excludes or limits liability that cannot legally be excluded or limited.

13.3 If you use the Platform in the course of your work for the Customer Organization, claims concerning the

commercial provision of the Platform should ordinarily be handled under the Customer Agreement.

14. Privacy and Necessary Cookies

The Platform login and authenticated service use technically necessary authentication/session cookies or equivalent

storage required to provide secure login and maintain the requested session. CardiLink does not use the login page

for advertising or cross-site tracking. Further information is provided in the CardiLink Platform Privacy Policy.

15. Changes to these Terms of Service

CardiLink may update these Terms of Service to reflect changes in law, security requirements, Platform functionality

or operational practices. The current version will be made available through the Platform. Material changes will be

communicated where required by law or the Customer Agreement.

Changes to these Terms of Service do not override specifically negotiated rights of the Customer Organization under

the Customer Agreement.

16. Governing Framework

These Terms of Service are intended to operate within the Customer Agreement. Unless mandatory law requires

otherwise, questions concerning governing law, jurisdiction and contractual remedies are determined by the Customer

Agreement rather than creating a separate legal framework for each individual user.

17. Contact

Questions about Platform access or these Terms of Service may be sent to:

CardiLink GmbH

Bahnhofstraße 2

90402 Nürnberg

Germany

Email: support@cardi-link.com