COOKIE POLICY

Art. 1. (1) This Cookie Policy (the “Policy”) describes what cookies and similar technologies are used by the OneCare internet platform (the “Platform”), available at www.onecare.bg, owned by “DocNow Medical Services” EOOD, UIC 208622091, with registered office and management address: Sofia 1404, Triaditsa District, 109 Bulgaria Blvd., floor 2, office 2.5, email: [email protected], tel.: +359 889 999 955 (the “Company”), for what purposes they are used, what data they collect, and how you can manage your preferences.

(2) This Policy forms an integral part of the Privacy Policy of the Platform and applies together with the General Terms and Conditions for the use of the OneCare Platform, the Privacy Policy and the Marketing Policy.

(3) This Policy is available at www.onecare.bg. The cookie banner is displayed upon each visit to the Platform where there is no valid cookie on the visitor’s device storing the choice previously made by that visitor.

Art. 2. (1) Cookies are small text files stored on your device (computer, tablet, smartphone or other device) by the website you visit. Cookies allow the website to recognise your device on a subsequent visit, remember your preferences and improve your user experience.

(2) In addition to cookies, the Platform may also use other similar technologies, including tracking pixels, web beacons, browser local storage (local storage, session storage) and other means of storing information on the user’s device. Where this Policy refers to “cookies”, this also includes all similar technologies.

(3) According to their duration, cookies are divided into:

1. Session cookies - stored temporarily and automatically deleted when the browser is closed;

2. Persistent cookies - remain on your device for a specified period or until you delete them manually.

(4) According to their source, cookies are divided into:

1. First-party cookies - set by the Platform (www.onecare.bg);

2. Third-party cookies - set by a domain other than the Platform, including by providers of analytics, advertising or other services.

Art. 3. (1) The Platform uses the following categories of cookies:

1. Strictly necessary cookies;

2. Functional cookies;

3. Analytics cookies;

4. Marketing cookies.

Art. 4. (1) Strictly necessary cookies are required for the basic operation of the Platform and cannot be disabled through the cookie banner. They do not require your consent.

(2) These cookies ensure:

1. maintaining the user session and authentication when logging into an account;

2. protection against cross-site request forgery (CSRF protection);

3. remembering your cookie preferences (storing your choice from the banner);

4. basic routing, load balancing and security of the Platform;

5. maintaining a chat session and conversation identification in the embedded chat widget of the Platform.

Art. 5. (1) Functional cookies allow the Platform to remember the choices you have made and to provide enhanced, personalised functionality. These cookies require your consent.

(2) These cookies may be used for:

1. remembering language preferences;

2. remembering a selected locality or district;

3. remembering interface settings;

4. other user preferences that are not strictly necessary for the operation of the Platform.

Art. 6. (1) Analytics cookies allow the Company to collect information about how visitors use the Platform in order to improve its performance. These cookies require your consent.

(2) The Company uses the following analytics tools:

1. Google Analytics - collects data on visits, user behaviour, traffic sources, duration of visits and other statistical data;

2. Hotjar - collects data on user behaviour, including heatmaps, session recordings and surveys, in order to improve the user experience;

3. other analytics tools that the Company may introduce in the future, in which case this Policy will be updated.

Art. 7. (1) Marketing cookies are used to track visitors for the purpose of displaying relevant advertisements, measuring the effectiveness of advertising campaigns and creating personalised advertising audiences. These cookies require your consent.

(2) The Company uses the following marketing tools:

1. Meta Pixel (Facebook Pixel) - tracks users’ actions on the Platform for the purpose of measuring ad effectiveness, retargeting and creating personalised audiences;

2. other marketing tools (including, but not limited to, TikTok Pixel, LinkedIn Insight Tag, Pinterest Tag and others) that the Company may introduce in the future, in which case this Policy and the cookie banner will be updated.

Art. 8. (1) The Platform may embed third-party content, including but not limited to:

1. YouTube videos;

2. Google Maps maps;

3. social buttons and embedded content from Facebook, Instagram, TikTok, LinkedIn and other social networks;

4. a chat application (chat widget) providing real-time communication, which may be technically connected to an instant messaging application (e.g. WhatsApp, Viber, Telegram, Signal and others);

5. other third-party content that may be added in the future.

(2) When embedded third-party content is loaded, the relevant provider may set its own cookies on your device and collect data in accordance with its own terms and privacy policy. The Company has no control over these cookies.

(3) Embedded third-party content is loaded only after you have given consent to the relevant category of cookies through the cookie banner, except where this is technically impossible, in which case the Platform displays replacement text with an option for manual activation.

Art. 9. (1) When you visit the Platform and there is no valid cookie on your device storing the choice previously made by you, a cookie banner is displayed, through which you may:

1. accept all categories of cookies;

2. reject all non-essential cookies;

3. make an individual choice by category (functional, analytics, marketing).

(2) Until you make a choice, no non-essential cookies are set or activated. Strictly necessary cookies are activated regardless of your choice.

(3) Silence, inactivity, continued browsing or closing the banner without making a choice shall not be considered consent. If the banner is closed without a choice being made, non-essential cookies remain inactive and the banner is displayed again on the next visit.

(4) Consent is not a condition for access to the Platform or for the use of its basic functionalities. Refusal of non-essential cookies may limit certain additional functionalities but will not prevent registration, requesting services or making payments.

(5) Each time consent is given, changed or withdrawn through the cookie banner, the Platform records and stores evidence of the choice made.

Art. 10. (1) You may change or withdraw your cookie consent at any time through:

1. the cookie settings in the Platform, accessible via a link in the footer of each page of the Platform;

2. your browser settings, by deleting stored cookies or configuring the browser to block certain or all cookies.

(2) Withdrawal of consent shall not affect the lawfulness of processing carried out before the withdrawal.

(3) If you delete all cookies through your browser, the cookie storing your choice from the banner will also be deleted, as a result of which the banner will be displayed again on your next visit.

Art. 11. Information on managing cookies through browser settings can be found on the help pages of the relevant browser, including:

1. Google Chrome: https://support.google.com/chrome/answer/95647;

2. Mozilla Firefox: https://support.mozilla.org/kb/cookies-information-websites-store-on-your-computer;

3. Safari: https://support.apple.com/guide/safari/manage-cookies-sfri11471;

4. Microsoft Edge: https://support.microsoft.com/microsoft-edge/delete-cookies-in-microsoft-edge-63947406-40 ac-c3b8-57b9-2a946a29ae09.

Art. 12. (1) The processing of personal data through cookies is carried out on the following legal bases:

1. for strictly necessary cookies - Art. 4a, para. 4, item 2 of the Electronic Commerce Act (the “ECA”);

2. for functional, analytics and marketing cookies - Art. 4a, para. 1 of the ECA.

(2) All rights of data subjects provided for in Section X of the Privacy Policy apply to the data collected through cookies.

Art. 13. (1) The retention period of cookies depends on their category and purpose:

1. session cookies - deleted when the browser is closed;

2. persistent cookies - stored for the period specified in the settings of the relevant cookie, but not more than 2 years from the last visit, unless a shorter period is specified for a particular cookie.

(2) The evidence of consent under Art. 9, para. 5 shall be stored for a period of 5 years from the date of the last update of the consent, for GDPR accountability purposes.

Art. 14. (1) The data collected through analytics and marketing cookies may be disclosed to the relevant providers specified in Section III of this Policy, which process the data in accordance with their own privacy policies.

(2) Some of the providers of analytics and marketing services (Google, Meta and others) may process data outside the European Economic Area (the “EEA”). In such cases, the transfer is carried out subject to appropriate safeguards under Chapter V of the GDPR, including standard contractual clauses or an adequacy decision of the European Commission.

(3) For more information on transfers of data outside the EEA, see Section VII of the Privacy Policy.

Art. 15. (1) The Company has the right at any time to amend, supplement or replace this Policy, including in the event of changes to applicable law, the addition, replacement or removal of analytics, marketing or other tools, or changes to the functionalities of the Platform.

(2) The current version is published on the Platform, indicating the date of the latest update.

(3) In the event of material changes affecting the categories of cookies or the purposes of processing, the Company will display the cookie banner again in order to obtain updated consent.

Art. 16. (1) For matters not regulated in this Policy, the provisions of the Privacy Policy, the General Terms and Conditions and the applicable law shall apply.

(2) The invalidity of any individual provision of this Policy shall not result in the invalidity of the remaining provisions.

Art. 17. (1) This Policy has been adopted by the manager of the Company and enters into force as of 04.05.2026.

(2) For questions related to cookies, you may contact us by email at: [email protected].