Mobcly Terms of Service

Effective date: 10 October 2026. Version 1.0.

These terms are an agreement between the clinic or business that signs up (“you”, “the Customer”) and Mobcly OÜ, registry code 14065339, Mardi 6-209, 10113 Tallinn, Estonia (“Mobcly”, “we”). By ticking “I accept” at sign-up, the person signing up confirms that they may bind the Customer and that the Customer accepts these terms.

1. Words used in these terms

Service: the Mobcly software described in §2, with its websites, apps and booking pages.
Customer Data: everything you or your Users put into the Service: patient records, examinations, prescriptions, images, appointments, clinic details and settings.
Patient Data: the part of Customer Data about patients and people who book online. It includes health data.
Owner: the person who signed up, or the person the owner role was later moved to (§3). The Owner manages the plan, the data and deletion.
Users: the Owner and the staff who sign in under the Customer’s account.
Documentation: the help texts and descriptions of the Service that we publish.
Data Protection Laws: the laws on personal data that apply to the Customer Data. This includes the EU General Data Protection Regulation (GDPR) and the UK GDPR where they apply, and the laws of the countries where the Customer works, for example the Philippine Data Privacy Act of 2012.

2. The service

Mobcly is software for eye-care clinics and opticians. It covers patient records, examinations, prescriptions, exam images, appointments, online booking pages and related tools. It is available as a web app and as apps for Android and Windows. Which parts you can use depends on your package (§5).

3. Who may use Mobcly

Mobcly is for businesses and professionals, not consumers. The person signing up must be at least 18.
The account belongs to the Customer. The Owner manages it. Other Users sign in with their own logins under the Owner’s account.
Keep passwords private, and make sure only authorised people use your logins and devices. You are responsible for what happens under your account. Tell us at [email protected] if you suspect misuse.
Changing the Owner. If the clinic is sold, or the Owner leaves or can no longer act, we move the owner role to another person once the Customer shows us, to our reasonable satisfaction, that they may act for it.
You may not use the Service in a country, or for a person, under trade sanctions of the EU, the UN or another authority that binds us.

4. Your responsibilities as a clinic

Your patients’ data is yours. You decide what you record, and you are responsible for having a lawful basis for it under the Data Protection Laws: informing patients, and any consent they must give, including for minors. We process it for you under Annex A.
Local health-record rules are your duty. Health-care law may require you to keep medical records for a number of years, to use a registered or approved electronic medical record system, to report to a health authority, or to keep health data in your own country. Check what applies to you before you use Mobcly. We store data in the European Union (Finland) and do not promise that the Service meets any country’s rules on medical records. Mobcly is not an archive service: export your records before you delete your account or stop paying (§10).
Mobcly does not give medical advice. It helps you record and organise information. It is not a medical device and makes no diagnoses. Clinical decisions remain yours and your professionals’ responsibility. Check what you enter and what you print. Do not rely on Mobcly for emergency or time-critical care.
Devices. The apps keep an encrypted copy of your data on your devices for offline work. Protect the devices with a screen lock and the operating system’s disk encryption, and keep them up to date. Our responsibility for security covers our servers, not your devices (§11).
Offline license: you alone keep the data. With an offline license, Patient Data is stored only on your own devices and never on our servers. You alone are responsible for it: the security of the devices, who can use them, backups, and loss or theft. Use the backup function in Settings and keep the backups safe. We are not your processor for that data, and if it is lost or accessed by someone who should not see it, you handle any notice to patients or authorities yourself.
Online booking and patient messages. If you publish a booking page, you are responsible for its content and for the bookings you receive. Booking receipts and appointment reminders are sent by us on your behalf and in your clinic’s name. You are responsible for being allowed to contact those people, and for telling them how you use their data.
HIPAA. Mobcly does not currently sign Business Associate Agreements. If you are subject to the US HIPAA rules, do not store protected health information in Mobcly unless we have signed such an agreement with you.

5. Packages, trial and payment

Free trial. A new account can start one free trial (currently 7 days). One trial per business and email address.
Packages. Packages, their contents and prices are shown on our website at the time of purchase.
Price changes. The price you pay when your subscription starts stays the same for at least 12 months. After that we may change it: we email the Owner at least 60 days before the new price applies, and you may switch renewal off before then.
Paying. Plans are bought on our website (eyecare.mobcly.com), not inside the apps. Payments are processed by Stripe. Prices are shown with any taxes that apply.
Renewal. A subscription with automatic renewal is charged at the start of each period until you switch renewal off on the Billing page. Without automatic renewal, it simply ends at the end of the period. We remind you by email before a renewal or an end.
Offline license. A one-time purchase that lets you use the version you bought, without time limit, on a limited number of devices (currently 2), without a subscription and without syncing to our servers. We provide updates for as long as we publish the apps. The apps check the license with our server from time to time, so a device must go online now and then.
No refunds for time already paid, including when you delete your account before the period ends, except where these terms (§7, §10, Annex A §6) or the law require a refund.
Late or failed payment. If a payment fails and is not fixed, your access ends at the end of the paid period. Your data is kept, and you can sign in to pay. See §10 for how long.

6. Acceptable use

Do not:

break the law with Mobcly, or store content you have no right to store;
try to access other customers’ data, test our security without our written permission, or overload the Service;
copy, resell or reverse engineer the Service, except where the law allows it;
use the booking pages or emails to send spam.

We may suspend access that puts the Service, other customers or patients at risk. Where we can, we tell you first.

7. Availability and changes

We work to keep Mobcly available and to fix problems quickly, but we do not promise uninterrupted service. Maintenance may cause short breaks. The apps keep working offline from their device copy.
We may improve and change the Service. If we remove a major feature you pay for, we tell you in advance, and you may cancel and receive a refund of unused prepaid time for the affected part.
Events beyond our control. Neither side is liable for a delay or failure caused by events beyond its reasonable control, for example a major outage at a hosting or network provider, a natural disaster, war or an act of a public authority. Our duties to protect Customer Data continue during such an event.

8. Your data and ours

You own your data: Customer Data stays yours. You give us only the rights needed to host, process, back up and show it to you in order to provide the Service. Annex A sets out how we process the personal data in it.
Getting your data out. Owners can download each patient’s full record, or all records at once (JSON), and print records at any time. When you leave, you can also ask for a copy in CSV files (§10).
Service statistics. We may use statistics about how the Service is used, which cannot identify patients or your clinic and never include Patient Data, to run, secure and improve it.
We own Mobcly: the software, design and trademarks. You get a non-exclusive, non-transferable right to use it during your subscription or license.
Feedback. If you send us ideas, we may use them without owing you anything.
Our Privacy Policy explains how we handle account, billing and usage data, for which we are the controller.

9. Confidentiality and security

We keep Customer Data confidential. Only staff who need it to run the Service and give support may access it, and only as far as needed. The security measures are described in the Privacy Policy and Annex A.

10. Ending the agreement

You may end it at any time by deleting your account in Settings, or on https://eyecare.mobcly.com/delete-account. The account closes at once and its data is deleted for good after 30 days, during which you can restore it by signing in. Paid time is not refunded (§5).
We may end it at once if you seriously breach these terms (for example misuse under §6) and do not fix it after we ask.
We may also end it without any breach on your part, for example if we stop offering the Service. Then we tell the Owner at least 30 days in advance, refund the unused part of any prepaid subscription, and send the Owner the copy of the data described below without being asked.
When access ends because a plan ended (not deleted), your data is kept for 12 months. We email you before we delete it, so you can pay or export.
A copy of your data when you leave. If you end or do not renew a web subscription, the Owner can ask us at [email protected] for a full copy of the Customer Data, as long as we still hold it (see the point above). We send it within 30 days in common formats that other software can read: CSV files (spreadsheet tables) for patients, examinations, prescriptions and appointments, and the images as ordinary image files. The first copy is free; we may charge a reasonable fee for further copies. We send it securely and only to the Owner, after checking it is them. This does not apply to an offline license, whose data we never hold.
After deletion, we keep only what the law requires (invoices) and our security logs, as described in the Privacy Policy. Backups are overwritten within 30 days.

11. Liability

What we promise. We provide the Service with the care that can reasonably be expected of a professional software provider. To the extent the law allows, we give no other promises: for example, that it suits a particular purpose or never has errors.
Losses neither side pays for. Neither side is liable for indirect or consequential losses, such as lost profits, lost business or lost goodwill. Neither side is liable for lost data that the Customer could have prevented by using the export and backup functions.
Data on your devices. We are not liable for any loss, damage, unauthorised access or breach of data on the Customer’s devices, or of backups the Customer makes, whatever the cause: for example a lost or stolen device, malware, a weak screen lock, shared logins or unsafe backup storage. This covers the device copy of every account, and all data of an offline license, which exists only on the Customer’s devices.
Our maximum. Our total liability under these terms in any 12 months is limited to the fees you paid us in the 12 months before the event, and at least EUR 500.
What these limits never cover: liability that cannot be limited by law, including for intent or gross negligence; the Customer’s duty to pay the fees; and the indemnities in §12.

12. Claims by others (indemnities)

You cover us against claims by others (for example patients or authorities), and the reasonable costs of defending them, that arise from Customer Data, from your lack of a lawful basis or consent, from the content of your booking pages, or from your breach of §4 or §6.
We cover you against claims that the Service, used as these terms allow, infringes someone else’s intellectual property rights, and the reasonable costs of defending them. We may instead change the Service so it no longer infringes, or end the agreement and refund unused prepaid fees.
The side asking to be covered tells the other promptly, lets it lead the defence, and helps as far as reasonable.

13. Changes to these terms

We may update these terms. We tell Owners about significant changes by email or in the app at least 30 days before they take effect. If you do not agree, you may delete your account before then; continuing to use Mobcly after that date means you accept the new terms.

14. Law and disputes

These terms are governed by the law of Estonia.
We will first try to solve any problem together: write to [email protected].
Customers in the EU or EEA: disputes go to the Harju County Court (Harju Maakohus), unless mandatory law says otherwise.
Customers outside the EU and EEA: disputes are finally settled by arbitration at the Arbitration Court of the Estonian Chamber of Commerce and Industry, under its rules, by one arbitrator, in English. Hearings may be held online. An award can be enforced in the many countries that have signed the New York Convention.
Either side may still ask a court for urgent measures, for example to stop misuse of data.

15. Other

Whole agreement. These terms, with Annex A and the Privacy Policy they refer to, are the whole agreement about the Service. If they conflict, Annex A wins on personal data, then these terms, then the Documentation.
Language. These terms are written in English. If we give you a translation, the English version applies where the law allows.
If a part of these terms is invalid, the rest stays in force.
We may transfer this agreement to a company that takes over the Service; you may transfer it only with our consent.
Notices to you go to the Owner’s email address; notices to us go to [email protected].

Annex A: Data processing terms (patient records)

These terms apply where Mobcly processes personal data on the Customer’s behalf, under GDPR Article 28 and the matching rules of the other Data Protection Laws. The Customer is the controller; Mobcly is the processor. They do not apply to data of an offline license, which stays only on the Customer’s devices and which Mobcly never receives.

Subject matter and duration. Hosting, storing, syncing, backing up, displaying, exporting and deleting the Customer Data in the Service, for as long as the agreement lasts and until deletion under §10.
Data and people.
- Categories: identity and contact details, health data (eye examinations, prescriptions, exam images, notes) and appointments.
- Concerning: the Customer’s patients and people who book online; also the Customer’s staff, who are Users.
Instructions.
- Mobcly processes the data only on the Customer’s documented instructions: to provide the Service as described in these terms and the Documentation, or as the Customer otherwise instructs in writing. That includes transfers to other countries.
- If a law requires Mobcly to do otherwise, Mobcly tells the Customer first, unless that law forbids it.
- Mobcly tells the Customer if it believes an instruction breaks the law.
- Mobcly does not use the data for its own purposes, does not sell it, and does not use it to train artificial intelligence.
Confidentiality. Everyone at Mobcly who can access the data is bound to confidentiality.
Security.
- Encryption: in transit (HTTPS), and at rest for images, backups and the apps’ local database.
- Access control: per-account separation of data, and roles (owner-only access log, erase and export).
- Logins: passwords hashed, and accounts locked after repeated wrong passwords.
- Access log of reads and changes, and encrypted backups.
Subprocessors.
- The Customer authorises the subprocessors listed at https://mobcly.com/subprocessors (also in the Privacy Policy, §6).
- Mobcly tells the Customer at least 30 days before adding or replacing one. The Customer may object; if the objection cannot be resolved, the Customer may end the agreement and receive a refund of unused prepaid time.
- Mobcly binds each subprocessor to equivalent data protection obligations.
Transfers.
- Data is stored in the EU. Any transfer outside the EU or EEA uses the safeguards the law requires (an adequacy decision or the EU Standard Contractual Clauses).
- For a Customer outside the EEA, the processor-to-controller Standard Contractual Clauses (Module 4) apply to the data Mobcly sends or shows to it, where the GDPR requires them.
Assistance. Mobcly helps the Customer answer requests from patients exercising their rights, mainly through the Service’s own functions (view, correct, export, erase). It also helps with data protection impact assessments and with consulting authorities, as far as reasonable.
Breaches.
- Mobcly informs the Customer without undue delay, and in any case within 48 hours of becoming aware of a personal data breach affecting the Customer Data.
- The notice says, as far as known at the time: what happened; which kinds of data and about how many people are affected; the likely consequences; what Mobcly has done and recommends; and whom to contact.
- Mobcly adds information as it learns more, so the Customer can meet its own duties to notify authorities and patients.
End of processing.
- Before deletion: the Customer can export all records at any time before deleting the account.
- Return of data: when a subscription ends, Mobcly returns a full copy of the Customer Data on request, in CSV files plus the images, as described in §10 of the terms.
- On deletion: Mobcly deletes the data 30 days after the Owner’s deletion request (or at once on written request). It then disappears from backups within a further 30 days.
- Kept: only what the law requires Mobcly to keep.
Audits. Mobcly makes available the information needed to show compliance with these terms. It allows audits by the Customer or an auditor it appoints, at reasonable intervals, on 30 days’ notice, at the Customer’s cost and subject to confidentiality.