Your direct bridge to operational excellence
General Terms and Conditions (GTC)
QBRG-901735770-1022
Revision: 0.40
Q-Bridge Consulting GmbH (hereinafter referred to as “Q-Bridge” or “Contractor”)
Effective from: 2026-05-21
Table of Contents
PART A: General Provisions (Scope, Liability, Payments)
PART B: Special terms and conditions for cloud platforms and assembly
PART C: Special terms and conditions for cloud platforms and assembly
PART D: Data processing agreement (DPA) pursuant to art. 28 GDPR
PART E: Technical and organizational measures (TOMS)
Part A
General Provisions
§1. Scope and Definitions
1.1.
Scope of Application: These General Terms and Conditions (hereinafter “GTC”) shall apply to all contracts, services, and offers provided by Q-Bridge Consulting GmbH (hereinafter “Q-Bridge” or “Contractor”) to its clients (hereinafter “Client”).
1.2.
Exclusive B2B Application: The services of Q-Bridge are intended exclusively for business owners (Unternehmer) as defined in Section 14 of the German Civil Code (BGB), legal entities under public law, or special funds under public law.
1.3.
Framework Agreement for Future Contracts: These Terms and Conditions, as amended from time to time, shall also serve as a Framework Agreement for all future contracts with the same Client regard-ing the provision of consulting services, IT services, and software solutions, without Q-Bridge being re-quired to refer to them again in each individual case.
1.4.
Exclusion of Conflicting Terms: Any terms and conditions of the Client that differ from, conflict with, or supplement these GTC shall only become part of the contract if Q-Bridge has expressly agreed to their validity in writing.
1.5.
Order of Precedence (Relationship of Documents): These GTC supplement the Framework Agreement concluded between the parties as well as the respective Individual Orders. In the event of any contradictions or inconsistencies between the contractual documents, the following order of precedence shall apply: (1) the respective individual order, (2) the framework agreement, (3) these General Terms and Conditions (GTC). Individual agreements concluded between the parties shall always take precedence over these General Terms and Conditions.
§2. Formation of Contract and Tender Documents
2.1.
Non-Binding Nature of Offers: Offers provided by Q-Bridge are subject to change and are non-binding, unless they are expressly designated as binding. A contract shall only be concluded upon writ-ten confirmation of the Individual Order (including confirmation via email) or upon the actual com-mencement of performance of the services by Q-Bridge.
2.2.
Proprietary and Intellectual Property Rights: Q-Bridge reserves and retains all title, ownership, copyrights, and other intellectual property or proprietary rights in and to all offers, cost estimates, con-cepts, documents, drawings, calculations, and models made available to the Client. The Client shall not make these documents or information accessible to third parties without the express prior written consent of Q-Bridge, nor shall the Client use, reproduce, exploit, or imitate them, or permit any third party to do so.
§3. Scope of Services, Amendments and Subcontractors
3.1.
Scope of Services and Partial Performance: The specific scope of the services to be performed by Q-Bridge shall be definitively established in the respective Individual Order. Q-Bridge shall be entitled to provide partial services and invoice them separately, provided that such partial performance is reasonable for the Client and does not impair the primary purpose of the contract.
3.2.
Change Order Procedure: Any subsequent amendments, modifications, or expansions of the agreed scope of services must be made in writing or text form (e.g., via email) to be effective. If the Client requests a change, Q-Bridge will examine whether and under what conditions the requested change can be implemented. Q-Bridge shall notify the Client of any impact the desired change may have on the schedule, deadlines, and remuneration, and shall submit a corresponding supplementary offer (Nachtragsangebot) or change order proposal to the Client. Until such supplementary offer or change order is accepted by the Client in writing, the originally agreed scope of services shall remain in effect.
3.3.
Engagement of Subcontractors: Q-Bridge is entitled to engage qualified subcontractors, independent contractors, or third-party service providers to perform its contractual obligations and deliver the services. Applicable data protection and privacy requirements shall remain unaffected.
§4. Performance Deadlines, and Force Majeure
4.1.
Binding Nature of Deadlines: Deadlines and dates for performance shall only be binding upon Q-Bridge if they have been expressly agreed upon in writing as binding or as a "firm deadline" (Fixtermin) in the respective Individual Order.
4.2.
Force Majeure and Excused Performance: Q-Bridge shall not be liable for any impossibility of performance or for delays in performance to the extent that such failures are caused by Force Majeure (Höhere Gewalt) or other unforeseeable events occurring after the conclusion of the contract for which Q-Bridge is not responsible. Such events shall include, but are not limited to, operational disruptions of any kind, difficulties in procuring materials or energy, transport delays, strikes, lawful lockouts, shortages of labor, energy, or raw materials, pandemics, epidemics, third-party cyberattacks, governmental actions, or failure, incorrectness, or untimeliness of delivery by suppliers.
4.3.
Right of Rescission for Long-Term Obstacles: Insofar as events within the meaning of Section 4.2 render the performance of services substantially more difficult or impossible for Q-Bridge, and such obstacle is not merely of temporary duration, Q-Bridge shall be entitled to rescind (zurücktreten) the contract. In the event of obstacles of a temporary duration, the deadlines for performance or delivery shall be extended, or the dates for performance postponed, by the period of the obstruction plus a reasonable ramp-up period.
§5. Remuneration, Payment Terms, and Default
5.1.
Time-and-Materials Remuneration: Remuneration for services shall be based on actual time spent in accordance with the rates agreed upon in the respective Individual Order, plus statutory value-added tax (VAT) as applicable. Time shall be tracked and recorded in minutes, with the smallest billable unit being 0.1 hours (6 minutes) per service rendered or incremental time unit started.
5.2.
Due Date and Payment Term: Invoices issued by Q-Bridge shall be due and payable within ten (10) days of receipt of the invoice date without any deduction or set-off.
5.3.
Payment Default and Suspension of Services: In the event of a payment default (Zahlungsverzug) by the Client, Q-Bridge shall be entitled to demand default interest at a rate of 9 percentage points above the applicable base interest rate (Basiszinssatz) of the European Central Bank. Q-Bridge expressly reserves the right to claim proven higher or additional damages caused by such delay. Furthermore, in the event of default, Q-Bridge shall be entitled, upon prior written notice, to suspend the performance of any further services until all outstanding claims have been paid in full.
5.4.
Travel Expenses and Disbursals: Travel expenses, per diems, and other out-of-pocket business expenses shall be invoiced separately in accordance with the specific provisions set forth in the Framework Agreement or the respective Individual Order.
§6. Client’s Cooperation and Default in Acceptance
6.1.
Timely and Free-of-Charge Cooperation: As a material contractual obligation, the Client shall ensure that all necessary acts of cooperation are performed in a timely manner, completely, and free of charge for Q-Bridge (including, but not limited to, the provision of accurate data, test environments, access to IT systems and premises, as well as the designation of qualified contact persons).
6.2.
Legal Consequences of Non-Cooperation and Default of Acceptance: If the Client defaults on accepting the performance of services (Annahmeverzug) or culpably breaches any other cooperation obligations, Q-Bridge shall be entitled to claim compensation for any resulting damages, including any and all additional expenses incurred (such as costs for idled personnel resources held in readiness or project delay costs). In such an event, the risk of accidental loss or accidental deterioration (Gefahr des zufälligen Untergangs oder einer zufälligen Verschlechterung) of the performance or deliverable shall pass to the Client at the exact moment the Client enters into default of acceptance. Any further statutory rights of Q-Bridge (including, without limitation, the right to terminate or to set a deadline pursuant to Section 642 of the German Civil Code (BGB)) are expressly reserved.
§7. Limitation of Liability
7.1.
Unlimited Liability: Q-Bridge shall be liable without limitation for damages caused by intent (Vorsatz), gross negligence (grobe Fahrlässigkeit), for culpable injury to life, body, or health, under the German Product Liability Act (Produkthaftungsgesetz), or to the extent Q-Bridge has expressly granted a specific warranty (Garantie).
7.2.
Ordinary Negligence and Core Duties: In cases of ordinary negligence (leichte Fahrlässigkeit) involving the breach of an essential contractual obligation (a core duty the fulfillment of which is indispensable for the proper execution of the contract and on the observance of which the Client regularly relies; a Kardinalpflicht), Q-Bridge’s liability shall be limited to the damages that were foreseeable and typical for this type of contract at the time of its conclusion.
7.3.
Liability Cap: To the maximum extent permitted by applicable law, Q-Bridge’s total aggregate liability for all claims arising out of or in connection with ordinary negligence shall be strictly limited to EUR 1,000,000 per individual claim and shall not exceed a total maximum cap of EUR 2,000,000 for all claims occurring within any single calendar year.
7.4.
Exclusion of Other Damages (Consequential Damages): In all cases other than those specified in Sections 7.1 and 7.2, Q-Bridge’s liability for ordinary negligence shall be expressly excluded. To the maximum extent permitted by law, this exclusion applies in particular to indirect damages, consequential damages, lost profits, loss of revenue, or business interruption.
§8. Non-solicitation
8.1.
Prohibition of Solicitation and Employment: The Client undertakes and agrees that, during the term of the cooperation and for a period of twelve (12) months after its termination, it shall not, directly or indirectly, solicit, recruit, hire, or engage in any other manner (e.g., as an independent contractor) any employee of Q-Bridge without the prior written consent of Q-Bridge).
8.2.
Liquidated Damages for Breach: For each individual case of a culpable breach of the obligation under Section 8.1, the Client undertakes to pay a reasonable contractual penalty to Q-Bridge, the amount of which shall be determined by Q-Bridge at its reasonable discretion and, in the event of a dispute, shall be reviewed for reasonableness by the competent court. The contractual penalty shall be limited to a maximum amount of 25% of the last gross annual salary of the person concerned.
§9. Confidentiality, Data Protection, and Data Security
9.1.
Confidential Information: The contracting parties agree to keep confidential, for an indefinite period — that is, even after the termination of the contractual relationship — all information that comes to their knowledge during the performance of this contract and that is designated as confidential or is otherwise recognizable as a trade or business secret. This applies in particular to all information regarding business processes, technical concepts, data models, pricing structures, as well as all documents and drafts provided to the Client by Q-Bridge.
9.2.
Exceptions to Confidentiality: The obligation of confidentiality does not apply to information that
(a)
were already known to the receiving contracting party prior to the notification,
(b)
become known lawfully through no fault of the receiving party,
(c)
must be disclosed due to legal obligations or by order of a court or government agency. In such cases, the other party must be notified in advance.
9.3.
Disclosure to Third Parties: Neither Party may disclose Confidential Information to any third party without the prior express written consent of the other Party, except where such disclosure is required for the proper performance of the contractual services or mandated by applicable law. Q-Bridge may disclose Confidential Information to employees, contractors, subcontractors, affiliates, or professional advisors on a strict need-to-know basis, provided that such recipients are subject to written confidentiality obligations at least equivalent to those contained in this Agreement. Where the disclosed information includes personal data, Q-Bridge shall ensure that any such disclosure is made in compliance with Regulation (EU) 2016/679 (GDPR), including, where applicable, the requirements governing processors, sub-processors, documented instructions, and appropriate technical and organizational measures under Articles 28 and 32 GDPR.
9.4.
Data Protection (GDPR): Q-Bridge strictly complies with data protection regulations (in particular the General Data Protection Regulation (GDPR) and the Federal Data Protection Act (BDSG)). Personal data is processed only for the purposes specified in the contract. To the extent that Q-Bridge gains access to personal data within the client’s IT infrastructure in the course of consulting or software customization, the following applies:
(a)
The client remains the “controller” within the meaning of Article 4(7) of the GDPR.
(b)
To this end, the parties shall enter into the Data Processing Agreement (DPA) attached in PART D.
(c)
The client is responsible for ensuring the legality of the data transfer and is required to anonymize patient data to the greatest extent possible before Q-Bridge accesses it, provided that this does not significantly impede the provision of services.
9.5.
Data Storage Media and Obligation to Return: Upon termination of the contract or at the request of either party, all confidential documents, data storage media, and copies received from the other party must either be returned or verifiably destroyed (in accordance with data protection regulations), unless required by law to be retained.
9.6.
Data Security and Communication: The contracting parties acknowledge that communication via unencrypted email poses risks to confidentiality. If agreed upon in the individual order or requested by the client, Q-Bridge will use encryption methods (e.g., S/MIME, PGP, or password-protected file transfer). Liability for unauthorized access by third parties during transmission over public networks is excluded—unless caused by gross negligence.
§10. Final Provision
10.1.
Amendments and Waivers: Any amendments, supplements, or modifications to these Terms and Conditions or the underlying contract must be made in writing to be effective. This written form requirement may only be waived by an express written agreement. Written form includes electronic communication (e.g., email), unless a qualified electronic signature or a handwritten signature is explicitly required by mutual agreement in a specific instance. No waiver of any provision shall constitute a continuing waiver or a waiver of any other provision.
10.2.
Governing Language: This Agreement is originally drafted in the German language. In the event of any discrepancies, inconsistencies, or conflicts between the German version of this Agreement and any translation, the German version shall exclusively govern and prevail.
10.3.
Governing Law: This Agreement, and all claims or causes of action arising out of or relating to this Agreement, shall be governed exclusively by, and construed in accordance with, the laws of the Federal Republic of Germany, without giving effect to any choice of law principles that would cause the application of the laws of any other jurisdiction. The United Nations Convention on Contracts for the International Sale of Goods (CISG) is expressly excluded.
10.4.
Dispute Resolution and Venue: If the Client is a merchant (Kaufmann), a legal entity under public law, or a special fund under public law, the exclusive venue for any legal action or proceeding arising out of or relating to this Agreement shall be the competent courts at the registered office of Q-Bridge Consulting GmbH. Notwithstanding the foregoing, Q-Bridge reserves the right to initiate legal proceedings against the Client before any court of competent jurisdiction where the Client is located or has its principal place of business.
10.5.
Severability: Should any provision of these General Terms and Conditions be or become invalid, illegal, or unenforceable, the validity of the remaining provisions shall remain unaffected thereby. In place of the invalid or incomplete provision, the statutory provisions shall apply.
§11. Amendments to these General Terms and Conditions
11.1.
Right to Amend GTC: Q-Bridge reserves the right to amend these General Terms and Conditions with a reasonable advance notice period of at least six (6) weeks, provided that such amendments are reasonable for the Client and do not fundamentally disrupt the contractual equilibrium to the detriment of the Client.
11.2.
Notice of Amendment and Deemed Consent: Notifications regarding any amendments to these GTC shall be sent to the Client via email or in text form. The amendments shall be deemed approved by the Client and shall become effective unless the Client objects to the amendments in writing or in text form within six (6) weeks following receipt of the notice.
11.3.
Notice of Consequences of Failure to Object: Q-Bridge shall be entitled to amend these General Terms and Conditions with a notice period of six weeks in advance, provided that such amendments are required to adapt to modified statutory or regulatory requirements (e.g., MDR, ISO 13485) or due to fundamental technical adjustments and provided further that the contractual equivalence ratio (Äquivalenzverhältnis) is not shifted to the detriment of the Customer. The intended amendments shall be notified to the Customer in text form (e.g., via email) at least six weeks prior to their proposed effective date. The Customer’s consent shall be deemed granted if the Customer does not object to the amendments in text form before the proposed effective date. Q-Bridge shall specifically point out this deemed consent effect and the right to object in the notification of the amendments.
Part B
Special terms and conditions for cloud platforms and assembly
§1. Scope and Type of Services
1.1.
Subject Matter of Services: Q-Bridge provides consulting and support services in the fields of process consulting, quality management (in particular with respect to MDR and ISO 13485), as well as the design and implementation of digital solutions.
1.2.
Classification as Service Contract (No Guarantee of Success): Unless a work-performance contract (Werkvertrag) with a specifically defined, measurable result or deliverable has been expressly agreed upon in writing in the respective Individual Order, all services shall be performed exclusively as professional services (Dienstleistungen) within the meaning of Sections 611 et seq. of the German Civil Code (BGB). Q-Bridge undertakes to perform its consulting services in a professional manner in accordance with the current state of the art and science. However, Q-Bridge does not guarantee, warrant, or owe any specific economic success, increase in revenue, and expressly does not guarantee the successful issuance, grant, or maintenance of any regulatory certifications, approvals, or permissions by authorities or notified bodies.
1.3.
Flexibility in Staffing: Q-Bridge shall be entitled, in its sole discretion, to assign and replace qualified employees, independent contractors, or subcontractors for the performance of the services. The Client shall have no right or claim to the performance of services by a specific individual (e.g., a named consultant) unless such requirement has been expressly agreed upon in writing in the respective Individual Order and such individual remains available to perform the work.
§2. Obligations to Cooperate in the Area of IT and Process Consulting
2.1.
Obligation to Provide Information Proactively: The Client acknowledges and agrees that the successful execution of IT and process projects requires close and continuous cooperation between the parties. The Client undertakes to proactively, timely, and completely provide Q-Bridge with all information, documents, and records necessary for the performance of the services (including, but not limited to, current process descriptions, organizational charts, and IT architecture plans).
2.2.
Provision of System Access and Contacts: As a material contractual obligation, the Client shall ensure that Q-Bridge is granted secure access to all relevant IT systems (either via remote access or on-site) to the extent necessary during the project term, and that Q-Bridge is provided with direct access to the Client's professionally competent and authorized personnel.
2.3.
Consequences of Client-Induced Delays: Any delays in the project schedule resulting from the Client’s failure to perform, or to timely or completely perform, its cooperation obligations under this Agreement or any Individual Order shall be borne exclusively by the Client. In such events, all agreed deadlines, milestones, and timeframes shall automatically be extended by the duration of the Client-induced delay plus a reasonable ramp-up period required for the reorganization of the project team.
§3. Acceptance Procedure for Work Performance Contracts
3.1.
Obligation to Accept: Insofar as a work-performance contract (Werkvertrag) has been expressly agreed upon in the respective Individual Order, the Client shall be obligated to accept the deliverables or services as soon as Q-Bridge notifies the Client of their completion or readiness for acceptance.
3.2.
Form of Acceptance: Acceptance shall be effected by a written declaration of acceptance from the Client (including via email) or by the execution of a mutual acceptance protocol signed by both parties.
3.3.
No Rejection for Immaterial Defects: The Client shall not be entitled to withhold or refuse acceptance due to immaterial or minor defects. Any such immaterial defects shall be recorded in the acceptance protocol or a punch list as remaining items to be remedied by Q-Bridge within a reasonable period.
3.4.
Deemed Acceptance: The services or deliverables shall be deemed fully and legally accepted upon the occurrence of the earlier of the following events:
(a)
The Client fails to reject the acceptance in writing or in text form within fourteen (14) days following Q-Bridge’s notice of completion and request for acceptance, provided that such rejection must specify at least one material, reproducible defect; or
(b)
The Client uses the deliverable or service (e.g., the drafted concept, documentation, or configured software module) in live production or otherwise exploits it operationally for its business purposes.
§4. Intellectual Property Rights and Proprietary Materials
4.1.
Grant of License (Deliverables): Q-Bridge hereby grants to the Client a non-exclusive, perpetual, worldwide, irrevocable, and non-transferable license to use the final deliverables specifically created for the Client within the scope of the Individual Order (e.g., reports, analyses, customized documentation). This license is granted strictly and exclusively for the Client’s own internal business operations.
4.2.
Reservation of Rights Pending Full Payment: The transfer and grant of the license set forth in Section 4.1 is subject to the condition precedent (aufschiebende Bedingung) of full, unconditional, and timely payment of the remuneration agreed upon in the respective Individual Order. Any use of the deliverables prior to full payment is strictly prohibited unless expressly authorized by Q-Bridge in writing.
4.3.
Protection of Background IP and Proprietary Methods: Notwithstanding the license granted in Section 4.1, all methods, tools, software components, best-practice data models, algorithms, checklists, and templates brought into the project, utilized, or independently developed by Q-Bridge (collectively, "Background IP") shall remain the sole and exclusive property of Q-Bridge. The Client is granted a license to use such Background IP only to the extent strictly necessary for the contractual use of the deliverables themselves. The Client shall not isolate, disclose, distribute, reproduce, or modify the Background IP to or for third parties, nor use it outside the scope of the contractually agreed purpose.
§5. Changes in services and regulatory responsibility
5.1.
Change Request Procedure: Should the Client wish to modify the contractually agreed scope of services, the Client must notify Q-Bridge in writing. Q-Bridge shall review the requested changes and inform the Client whether the change is technically feasible and what impact it will have on the compensation and the schedule.
5.2.
Continuation of Work: Pending the execution of a written amendment, the work shall be continued under the original individual order, unless the Client instructs a suspension in writing.
5.3.
Client’s Technical Responsibility: The client bears sole responsibility for the technical, content-related, and regulatory accuracy of the data, documents, and processes it provides (particularly with regard to compliance with the MDR, IVDR, or ISO 13485).
5.4.
Indemnification in the Event of Regulatory Rejection: Q-Bridge reviews the concepts or configurations developed as part of the consulting services for technical functionality and compliance with the requirements of the specific contract. Liability for the final acceptance, approval, or certification of these processes by Notified Bodies or authorities is excluded to the extent that Q-Bridge has merely implemented the client’s technical specifications in a technical or conceptual manner. Q-Bridge is obligated to provide professional services in accordance with the state of the art but does not guarantee the successful completion of an audit or certification.
Part C
Special terms and conditions for cloud platforms and assembly
§1. Scope of Application and Scope of Services
1.1.
Supplemental Scope of Application: The provisions of this section shall apply in addition to the terms set forth in Part A and Part B for all contracts concerning the provision of third-party software platforms (Software-as-a-Service, hereinafter “SaaS”) as well as the client-specific configuration, customization, and modeling (tailoring) of such platforms by Q-Bridge.
1.2.
Provision of Cloud-Based Services: Q-Bridge shall provide the Client with access to cloudbased software solutions. The software itself will not be installed on the Client's local IT systems, but will be hosted and operated on an IT infrastructure provided either by the respective third-party vendor or by Q-Bridge, and shall be made accessible to the Client via the internet.
1.3.
Configuration for Quality Management Processes: The scope of services also encompasses the customization and configuration of the software platform to align with the Client’s specific quality management processes. This includes, without limitation, the setup and modeling of modules for corrective and preventive actions (CAPA), complaint management, audit management, or document control in compliance with regulatory standards (e.g., MDR, ISO 13485).
§2. Third-Party Vendor Software and Limitation of Responsibility
2.1.
Incorporation of Third-Party Terms (EULA): To the extent Q-Bridge brokers, resells, or sublicenses software licenses or SaaS access from third-party vendors, the respective End User License Agreements (EULA), Terms of Service, and Service Level Agreements (SLA) of the respective software manufacturer shall apply additionally. The Client expressly undertakes to comply with these third-party conditions and shall indemnify and hold Q-Bridge harmless from any and all claims arising out of a breach of such manufacturer terms by the Client.
2.2.
Exclusion of Liability for Third-Party Infrastructure: To the extent that Q-Bridge mediates or sub-licenses software products from third-party vendors, Q-Bridge shall not be liable for their technical availability or freedom from defects, unless Q-Bridge is at fault due to its own intentional or grossly negligent conduct. To the extent that Q-Bridge holds claims against the respective manufacturer regarding technical defects, Q-Bridge shall, upon the Customer's request, assign such claims to the Customer for direct enforcement. If Q-Bridge provides its own software solutions or proprietary tools, the liability provisions separately agreed upon in the individual orders shall apply to such products; in the absence of such specific agreements, the general liability provisions set forth in Section 7 of Part A of these GTC shall apply.
§3. Process Modeling, Intellectual Property Protection, and Configuration Licenses
3.1.
Modeling Based on Client Specifications: The modeling and configuration of business and quality processes within the software platform shall be executed in accordance with the specific instructions and guidelines provided by the Client. The Client shall bear sole responsibility for the substantive accuracy of such specifications.
3.2.
Intellectual Property Protection of Configuration Logic: The Client acknowledges and agrees that all configuration logics, best-practice data models, workflow structures, scripts, and validation templates introduced, utilized, or developed by Q-Bridge within the scope of the project constitute the proprietary intellectual property and trade secrets of Q-Bridge, or that Q-Bridge holds the exclusive rights therein.
3.3.
Grant of Limited License: Q-Bridge hereby grants to the Client a non-exclusive, non-transferable, non-sublicensable, and limited license to use the specific configuration results, data models, and workflows for its own internal business operations, strictly for the duration of the respective Individual Order (SaaS subscription term).
3.4.
Right of Reuse and Residual Rights: Q-Bridge expressly reserves the right to reuse and exploit the structures, models, workflows, and logics developed during the tailoring and system customization process in a completely anonymized form (without any reference to protected operational data, trade secrets, or the identity of the Client) for its consulting services, product development, and software configurations performed for other clients.
3.5.
Prohibition of Reverse Engineering and Copying: The Client is strictly prohibited from engaging in any form of reverse engineering, decompilation, disassembly, or copying of the data models and configuration structures created by Q-Bridge for use in third-party systems or for the purpose of imitation.
3.6.
Reservation of Rights Conditional on Full Payment: The grant of the license to the customized data models, configurations, and workflows is subject to the condition precedent (aufschiebende Bedingung) of full and unconditional payment of the remuneration agreed upon for the respective configuration services.
3.7.
Consequences of Payment Default (Suspension and Revocation of License): If the Client defaults on the payment of due and outstanding fees for configuration services, the license granted to the Client for the affected configurations and modules shall automatically terminate upon prior written notice and the expiration of a reasonable grace period. In such event, Q-Bridge shall be entitled to technically disable or suspend access to the respective modules and configurations until all outstanding balances have been paid in full.
§4. Term, Termination, Suspension, and Data Return Upon Termination
4.1.
Contract Term and Ordinary Termination: The term for the provision of the software (SaaS) shall be determined by the respective Individual Order. Unless otherwise agreed therein, the contract and the software access shall automatically renew for additional periods equal to the initial term (but not exceeding one year per renewal), unless terminated in accordance with the applicable notice period. If no specific notice period is defined in the Individual Order, the notice period shall be one (1) month prior to the end of the current term. Any notice of termination must be submitted in writing or in text form (delivery via email shall be sufficient) to be effective.
4.2.
Temporary Right of Suspension for Material Default: Q-Bridge shall be entitled to temporarily suspend the Client’s access to the software if the Client defaults on the payment of due license, subscription, or configuration fees for more than thirty (30) days, or if the Client materially or repeatedly breaches essential terms of use of this contract despite having received a prior warning in text form. Q-Bridge’s claim to the agreed remuneration shall remain unaffected and continue in full force and effect during any period of justified suspension.
4.3.
Data Return and IP Protection Upon Termination: Upon termination of the contract, Q-Bridge shall be obligated to provide the Client with its raw data (user data) stored in the system in a standard, machine-readable format (e.g., .csv or .xlsx) via download or data carrier, at Q-Bridge's sole discretion. The Client shall have no right or claim to the return, copy, disclosure, or migration of the configuration logic, workflows, scripts, or proprietary data models developed by Q-Bridge. Following the successful delivery of the raw data and upon expiration of any statutory retention periods, Q-Bridge shall be entitled and obligated to irrevocably delete the Client’s data from its active systems.
§5. Warranty and Regulatory Disclaimer
5.1.
Warranty of Conformity to Requirements: Q-Bridge warrants that the customer-specific configuration and modeling of the software platform shall comply with the requirements and specifications expressly documented in the respective individual order and approved by both parties.
5.2.
Regulatory Responsibility: The Client bears sole responsibility for the content and regulatory compliance of the processes modeled within the software (e.g., MDR/ISO 13485). In the case of third-party software, Q-Bridge only warrants the professional technical implementation of the Client’s requirements. Q-Bridge provides no warranty or guarantee that the modeled processes will be certified or approved by governmental authorities or Notified Bodies. This does not apply if Q-Bridge offers its own software solutions for which Q-Bridge has expressly guaranteed specific regulatory compliance (e.g., in accordance with MDR) as a characteristic of the product.
§6. Client System Requirements and IT Environment Disclaimers
6.1.
Responsibility for System Environment: The Client shall be solely and exclusively responsible for providing, configuring, and continuously maintaining the system environment required to access and use the cloud software (including, without limitation, appropriately dimensioned hardware, a stable internet connection with sufficient bandwidth, and the use of current, compatible, and supported web browser versions).
6.2.
Exclusion of Defect Liability for Client-Side Infrastructure Failures: Any malfunctions, service disruptions, downtime, or performance degradation of the software platform resulting from an inadequate, non-compliant, or faulty IT infrastructure of the Client, improper operation by the Client's personnel, or incompatibilities with the Client's local IT environment (such as local firewalls, proxy servers, network configurations, or security software) shall not constitute a defect (Mangel) in the performance of Q-Bridge and shall not give rise to any warranty or defect claims by the Client.
Part D
Data processing agreement (DPA) pursuant to art. 28 GDPR
§1. Scope, Duration, and Purpose of Data Processing
1.1.
Subject Matter of Processing: Q-Bridge performs consulting, system configuration, and software customization services for the Client, during the execution of which access to or processing of personal data (personenbezogene Daten) cannot be ruled out. The parties shall execute a separate Data Processing Addendum (DPA) pursuant to Article 28 of the General Data Protection Regulation (GDPR) to govern such processing.
1.2.
Duration of Processing: The duration of the data processing shall correspond to the term of the respective underlying Individual Order, plus any subsequent contractual or statutory data retention, record-keeping, or deletion periods.
1.3.
Purpose and Nature of Processing: The purpose of the processing is the provision, client- and regulatory-specific configuration, maintenance, and support of the quality management software, as well as the analysis and structuring of process data to optimize compliance with regulatory standards (in particular MDR and ISO 13485).
§2. Type of data and group of data subjects
2.1.
Data Categories: Master data (name, position), contact information, qualification data (training certificates), audit data, and quality-related process data (e.g., CAPA reports, complaint data).
2.2.
Patient Data: If the Client grants Q-Bridge access to systems containing patient data (e.g., in the context of complaint management), the Client is required to anonymize such data in advance. If this is not technically feasible, this Data Processing Agreement also applies to these specific categories of personal data (Art. 9 GDPR).
2.3.
Affected individuals: The client’s employees, suppliers, auditors, and potential patients/users of medical devices.
§3. Obligations of Q-Bridge (Contractor)
3.1.
Documented Instructions: Q-Bridge shall process personal data exclusively on documented instructions from the Client – including with regard to transfers of personal data to a third country or an international organization –, unless Q-Bridge is required to do so by European Union or Member State law to which Q-Bridge is subject; in such a case, Q-Bridge shall inform the Client of that legal requirement before processing, unless that law prohibits such information on important grounds of public interest.
3.2.
Confidentiality Commitment of Personnel: Q-Bridge shall ensure that persons authorized to process the personal data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality.
3.3.
Technical and Organizational Measures (Security): Q-Bridge shall implement all technical and organizational measures required pursuant to Article 32 of the GDPR to ensure a level of security appropriate to the risk (the specifically agreed measures are set forth in PART E of these Terms and Conditions).
3.4.
Assistance to the Client (Data Subject Rights and Compliance): Q-Bridge shall assist the Client, insofar as this is possible, by appropriate technical and organizational measures, for the fulfillment of the Client's obligation to respond to requests for exercising the data subject's rights laid down in Chapter III of the GDPR. Taking into account the nature of processing and the information available to Q-Bridge, Q-Bridge shall further assist the Client in ensuring compliance with the obligations pursuant to Articles 32 to 36 of the GDPR (ensuring data security, notification of personal data breaches to supervisory authorities, communication of data breaches to data subjects, data protection impact assessments, and prior consultations).
§4. Subcontracting Relationships (Sub-Processors)
4.1.
General Authorization for Sub-Processors: The Client hereby grants Q-Bridge a general authorization to engage further sub-processors (e.g., cloud hosting providers such as Microsoft Azure/AWS or specialized IT subcontractors).
4.2.
Purpose-Bound Engagement and Pre-Approval of Core Sub-Processors: The engagement of sub-processors shall be strictly purpose-bound and determined on a case-by-case basis, depending on the scope of services agreed upon in the respective main contract or Individual Order. The engagement of the core sub-processor specified below shall be deemed pre-approved by the Client exclusively in the event that the subject matter of the specific Individual Order includes the provision, licensing, or use of the ALM platform „Orcanos”:
| Subcontractor | Company headquarters | Content / Purpose of Processing | Location of the data center / data storage |
| Orcanos Ltd. | 4 Ariel Sharon (Floor 10) Givatyim, 5320054 Israel |
(Available only when booking the Orcanos platform): Provision of software architecture, technical support (second/third-level), infrastructure hosting | Frankfurt am Main, Germany (Certified cloud data center) |
4.3.
Contractual Safeguards Pursuant to Article 28 GDPR: Q-Bridge shall ensure that contractual agreements have been entered into with all engaged sub-processors which fully satisfy the requirements set forth in Article 28 Paragraphs 3 and 4 of the GDPR.
4.4.
International Data Transfers and Physical Data Sovereignty: In the event that the Orcanos ALM platform is utilized and the aforementioned sub-processor is engaged, notice is hereby given that an effective adequacy decision by the EU Commission pursuant to Article 45 of the GDPR exists for its country of incorporation (Israel), which guarantees a level of data protection equivalent to that of the European Union. The physical storage location of the data shall remain contractually guaranteed within the Federal Republic of Germany (Frankfurt am Main region) under all circumstances.
4.5.
Notification Obligation and Client's Right to Object: Q-Bridge shall notify the Client in text form of any intended changes regarding the addition or replacement of sub-processors at least 14 days in advance. The Client shall have the right to object to such changes within this period based on reasonable, demonstrable data protection grounds. If no objection is raised, the change shall be deemed approved.
4.6.
Equivalence of Data Protection Obligations: The sub-processor shall be contractually bound by the same data protection obligations as those established in this contract between Q-Bridge and the Client. Where the sub-processor fails to fulfill its data protection obligations, Q-Bridge shall remain fully liable to the Client for the performance of that sub-processor's obligations.
§5. Audit Rights and Demonstrating Compliance
5.1.
Right to Conduct Audits and Inspections: The Client shall be entitled to verify compliance with statutory data protection regulations and the contractual agreements by Q-Bridge to a necessary and reasonable extent, either itself or through qualified third parties bound by professional confidentiality. Such audits and on-site inspections must be notified to Q-Bridge in writing with a reasonable advance notice period of at least fourteen (14) days, and must take place during regular business hours without disrupting Q-Bridge’s operational workflows. The Client shall bear all costs incurred by it in connection with conducting such audits; any third-party auditor engaged by the Client must not be a competitor of Q-Bridge.
5.2.
Assistance and Documentation of Compliance: Q-Bridge shall make available to the Client all information necessary to demonstrate compliance with the obligations laid down in Article 28 of the GDPR and allow for and contribute to audits, including inspections, conducted by the Client or another auditor mandated by the Client. Q-Bridge may fulfill its obligation to demonstrate compliance by providing current certificates, third-party attestations (e.g., ISO 27001), or recent audit reports issued by independent bodies.
§6. End of Processing (Return and Deletion of Data)
6.1.
Option for Deletion or Return: Upon completion of the provisions of services relating to processing, Q-Bridge shall, at the choice of the Client, delete all personal data or return it to the Client and delete existing copies, unless European Union or Member State law requires the continued storage of such personal data.
6.2.
Documentation and Confirmation of Deletion: The proper deletion or destruction of the data shall be documented by Q-Bridge. Upon the Client's written request, Q-Bridge shall provide the Client with a corresponding written confirmation or a deletion protocol demonstrating compliance with the data erasure requirements.
Part E
Technical and organizational measures (TOMS)
In accordance with Article 32 of the GDPR, Q-Bridge takes the following measures to ensure a level of security appropriate to the risk:
§1. Confidentiality (Art. 32(1)(b) of the GDPR)
1.1.
Access control: Preventing unauthorized access to data processing systems used to process or utilize personal data:
•
Securing business premises with locking systems.
•
Monitoring visitor traffic (visitor lists).
•
Alarmanlage und/oder Sicherheitsdienst, sofern erforderlich.
1.2.
Access control: Preventing unauthorized individuals from using data processing systems:
•
Use of modern authentication methods (password complexity, multi-factor authentication – MFA).
•
Use of firewalls and VPN technologies for remote access.
•
Automatic screen lock when inactive.
1.3.
Access control: Ensuring that authorized users of a data processing system can access only the data covered by their access permissions:
•
Role-based access control (need-to-know principle).
•
Logging of data access.
•
Encryption of storage devices (e.g., BitLocker).
1.4.
Separation of processing: Ensuring that data collected for different purposes can be processed separately:
•
Logical client separation in the cloud systems used.
•
Separation of development, test, and production systems.
Integrity (Art. 32(1)(b) of the GDPR)
2.1.
Transmission control: Ensuring that personal data cannot be read, copied, altered, or deleted without authorization during electronic transmission or while in transit:
•
Use of encrypted transmission channels (TLS/SSL, HTTPS).
•
Provision of email encryption (S/MIME or PGP) for communication regarding sensitive quality data.
•
Logging of data transmission.
2.2.
Input control: Ensuring that it is possible to verify retrospectively whether personal data has been entered, modified, or deleted from data processing systems, and by whom:
•
Logging of user input using unique user identifiers.
§3. Availability and capacity (Art. 32(1)(b) and (c) of the GDPR)
3.1.
Data integrity: Ensuring that personal data is protected against accidental destruction or loss:
•
Regular backups of configuration data.
•
Use of certified cloud data centers (e.g., ISO 27001) with high-availability architecture.
•
Uninterruptible Power Supply (UPS) in the infrastructure in use.
3.2.
Rapid recovery:: Implementation of disaster recovery plans to quickly restore the availability of and access to personal data in the event of a physical or technical incident.
§4. Procedure for regular review and evaluation (Art. 32(1)(d) of the GDPR)
4.1.
Data Protection Management:
•
Regular training for employees on data confidentiality and IT security.
•
Compliance with data protection regulations is monitored by Q-Bridge’s designated data protection officer.
•
Incident Response Process for Reporting Security Incidents.
4.2.
Order Tracking:
•
Careful selection of subcontractors (SaaS providers).
•
Regular review of partners' security certifications (e.g., SOC 2 reports from platform operators).