Acceptance and Binding Effect

By registering for, accessing, or using the Smile Genius Dental platform (the "Platform" or "Services"), you ("Customer", "you", "your") acknowledge that you have read these Terms & Conditions and agree to be bound by them. No separate signature or formal contract is required. These Terms & Conditions constitute the complete and binding agreement between Smile Genius Dental Limited ("Company", "we", "us", "our") and you regarding your use of the Platform.

If you do not agree to these Terms, you may not access or use the Platform.

1. SaaS Services and Support

1.1 Services Provision

Subject to these Terms, Company will use commercially reasonable efforts to provide you the Services in accordance with the Service Level Terms (Exhibit A) and Support Terms (Exhibit B). The specific features and services included depend on your selected subscription plan.

1.2 Registration and Account Security

During registration, you will create an account with an administrative username and password. You are responsible for:

• Maintaining the confidentiality of your account credentials
• Ensuring all information provided is accurate and current
• All activity under your account, whether authorized or not
• Immediately notifying Company of any unauthorized access or use

Company reserves the right to refuse registration of, or cancel, credentials it deems inappropriate or in violation of these Terms.

1.3 Equipment and Connectivity

You are solely responsible for obtaining and maintaining any equipment and ancillary services needed to connect to, access, or use the Services (modems, hardware, servers, software, operating systems, networking, etc.), for maintaining the security of your Equipment, account, passwords, and files, and for all uses of your account.

2. Restrictions and Responsibilities

2.1 Prohibited Conduct

You will not, directly or indirectly:

• Reverse engineer, decompile, disassemble, or otherwise attempt to discover the source code, object code, or underlying structure, ideas, know-how, or algorithms relevant to the Services or any Software
• Modify, translate, or create derivative works based on the Services or Software (except as expressly permitted)
• Use the Services for timesharing, service bureau, or resale purposes, or for the benefit of a third party
• Remove any proprietary notices or labels
• Export or re-export the Services or Software in violation of laws or regulations of the Republic of Ireland

2.2 Compliance and Indemnity

You represent, covenant, and warrant that you will use the Services only in compliance with Company's standard published policies and all applicable laws and regulations (including data protection laws). You agree to indemnify and hold harmless Company against damages, losses, liabilities, settlements, and expenses (including costs and attorneys' fees) arising from any claim relating to your violation of the foregoing or your use of the Services. Company may monitor use of the Services and may prohibit any use it reasonably believes violates the foregoing.

2.3 Data Responsibility

You will obtain all necessary agreements and consents from your provider clinics/clients and their patients. Smile Genius Limited acts solely as a Data Processor on your behalf in respect of Personal Data you submit; you (or your clinics) remain the Data Controller.

3. Confidentiality and Proprietary Rights

3.1 Confidential Information

Each party (the "Receiving Party") understands that the other party (the "Disclosing Party") has disclosed or may disclose Proprietary Information. Proprietary Information of Company includes non-public information regarding features, functionality, and performance of the Services. Proprietary Information of Customer includes Customer Data. The Receiving Party agrees to take reasonable precautions to protect such Proprietary Information and not to use or disclose it except in performance of the Services. These obligations do not apply to information that: (a) after five (5) years following disclosure; (b) is or becomes generally available to the public; (c) was in the Receiving Party's possession prior to receipt; (d) was rightfully disclosed by a third party without restriction; (e) was independently developed; or (f) is required to be disclosed by law (with prompt notice where lawful).

3.2 Data Ownership and Intellectual Property

You own all right, title, and interest in Customer Data and any data derived from it that is provided to you as part of the Services. Company owns and retains all rights in the Services and Software, all improvements and modifications, any technology developed in connection with implementation or support, and all related intellectual property. Privacy Policy: https://www.smilegeniusdental.com/privacy-policy

3.3 Data Analysis and Usage

Company may collect and analyze data relating to the provision, use, and performance of the Services, and may (during and after the Term) use such data to improve and enhance the Services and disclose such data solely in aggregated or de-identified form in connection with its business. De-identified data will not identify you, your clinics, or any patient.

4. Payment of Fees

4.1 Subscription Fees and Billing

You will pay Company the fees applicable to your selected subscription plan (the "Fees"), billed monthly or annually. Fees are exclusive of applicable taxes unless stated otherwise. Managed Services (where opted in) are included in your subscription at no additional cost.

4.2 Price Changes

Company may change the Fees or introduce new charges at the end of the then-current term, upon thirty (30) days' prior notice (which may be sent by email). Changes do not apply to your current billing period.

4.3 Payment Methods and Invoicing

Payment is processed via Stripe or another authorized payment provider; you authorize automatic charging each billing period. Where Company invoices, full payment is due within thirty (30) days of the invoice date. Unpaid amounts are subject to a finance charge of 1.5% per month (or the maximum permitted by law, whichever is lower) plus collection expenses, and may result in suspension or termination of Services.

4.4 Billing Disputes

If you believe Company has billed you incorrectly, contact Company no later than sixty (60) days after the invoice date to receive an adjustment or credit. Direct inquiries to support@smilegeniusdental.com.

5. Data Privacy and Processing (GDPR / UK GDPR)

5.1 Roles and Legal Framework

For Personal Data processed via the Platform, you (or your clinics) are the Data Controller and Company is the Data Processor. Company processes Personal Data in accordance with the EU General Data Protection Regulation (EU) 2016/679 ("GDPR"), the UK GDPR and Data Protection Act 2018, and Irish data protection legislation, and with the Privacy Policy at https://www.smilegeniusdental.com/privacy-policy. This Section 5 constitutes the data processing terms required by Article 28(3) GDPR.

5.2 Processor Obligations (Article 28)

Company will:

• Process Personal Data only on your documented instructions (including these Terms and your configuration of the Platform), unless required otherwise by law, in which case Company will inform you unless prohibited
• Ensure persons authorized to process Personal Data are bound by confidentiality obligations
• Implement appropriate technical and organisational measures under Article 32 GDPR (encryption in transit and at rest, access controls, audit logging, environment segregation)
• Assist you, insofar as possible, in responding to Data Subject requests (Articles 12–23) and in your obligations under Articles 32–36 (security, breach notification, DPIAs)
• At your choice, delete or return all Personal Data at the end of the provision of Services (per Section 12.4), unless law requires retention
• Make available information necessary to demonstrate compliance and allow for audits per Section 5.6

5.3 Managed Services — Data Processing

Where you opt in to Managed Services for scanner automation, Company will monitor scanner notification emails forwarded by you, create cases within your portal on your behalf, and perform AI-assisted parsing of submitted information.

5.3.1 Scope of Data Processing

Categories of data: scanner notification content (emails and attachments), case files and metadata, and patient-identifiable information including patient name, date of birth, scan files, prescribing dentist details, screening data, and clinical notes. Data subjects: patients and clinic staff named on orders.

Managed Services is limited to: receiving forwarded scanner notification emails; extracting case metadata via AI-assisted parsing; and creating the case record in your portal. Managed Services does not include clinical review or validation of case data, verification of data completeness or accuracy, or completion of fields the AI cannot extract. You remain responsible for reviewing extracted data and correcting errors before the case enters production.

5.3.2 Sub-processors

Company engages the following sub-processors:

Anthropic's DPA: https://www.anthropic.com/legal/data-processing-addendum

Company will notify you of any intended addition or replacement of sub-processors processing Personal Data (email suffices), giving you the opportunity to object on reasonable data protection grounds within fourteen (14) days. Company remains fully liable for the performance of its sub-processors' obligations.

5.3.3 International Transfers

Where Personal Data is transferred outside the UK/EEA (including to Anthropic in the United States), Company ensures a lawful transfer mechanism under GDPR Chapter V is in place, including Standard Contractual Clauses and, where applicable, the UK International Data Transfer Addendum, together with supplementary measures as appropriate.

5.3.4 Data Retention

Personal Data processed as part of Managed Services (forwarded emails, extracted case information, parsing logs) is retained only as long as necessary to provide the Managed Services and comply with legal requirements. Upon case creation, case data resides in your portal, where retention is governed by Section 5.1 and your subscription terms.

5.3.5 Data Subject Rights

Data subjects retain all rights under GDPR/UK GDPR: access, rectification, erasure, restriction, portability, objection, and rights relating to automated decision-making. Requests should be submitted to support@smilegeniusdental.com with subject line "GDPR Data Subject Request — [Request Type]". Company will acknowledge within five (5) business days and respond within thirty (30) calendar days (extendable to sixty (60) days for complex requests, with notice). Where Company receives a request directly as processor, it will forward it to you without undue delay and assist as required.

5.3.6 Data Protection Contact

support@smilegeniusdental.com — Data Protection Contact: Arun Kumar, CTO, Smile Genius Dental Limited. You may lodge complaints with the Irish Data Protection Commission (www.dataprotection.ie) or the UK Information Commissioner's Office (www.ico.org.uk).

5.3.7 Credential Sharing and Lab Obligations

To enable Managed Services, you agree to provide Company with login credentials or API access to your scanner platform(s), ensure credentials remain accurate and current, and notify Company immediately of credential changes or security concerns. Company stores scanner credentials in encrypted, access-controlled storage with audit logging, restricted to authorised operations personnel. You may revoke Company's access at any time by written request to support@smilegeniusdental.com; credentials will be rotated and securely deleted within eight (8) business hours (i.e., by end of the next business day at the latest).

5.3.8 Personal Data Breach and Incident Response

Company will notify you without undue delay, and in any event within 48 hours, after becoming aware of a Personal Data Breach affecting your Personal Data, providing (as available): the nature of the breach, categories and approximate numbers of data subjects and records affected, likely consequences, and measures taken or proposed. For compromise of scanner credentials specifically, Company will additionally notify you within 24 hours, immediately revoke and rotate affected credentials, and cooperate with any investigation or regulatory notification. Nothing in this section delays or replaces your own obligations as Controller to notify supervisory authorities within 72 hours under Article 33 GDPR; Company will provide reasonable assistance.

5.4 Security Measures (Article 32)

Company implements and maintains appropriate technical and organisational measures, including: encryption of Personal Data in transit (TLS) and at rest; role-based access controls and least-privilege access; unique user authentication; audit logging of access to Personal Data and credentials; secure credential vaulting; regular backups; environment segregation; personnel confidentiality undertakings and data protection training; and vendor due diligence for sub-processors.

5.5 HIPAA-Aligned Safeguards (US Customers)

HIPAA (the US Health Insurance Portability and Accountability Act) applies only where Company processes Protected Health Information ("PHI") on behalf of a US Covered Entity or Business Associate. Company's security controls are designed to align with the HIPAA Security Rule standards for administrative, physical, and technical safeguards. If you are a US Covered Entity or Business Associate and intend to submit PHI to the Platform, you must notify Company in advance and execute a Business Associate Agreement ("BAA") with Company before submitting any PHI. A BAA is available on request from support@smilegeniusdental.com. Absent an executed BAA, you must not submit PHI to the Platform, and Company disclaims any obligation under HIPAA with respect to such data.

5.6 Audit and Compliance

Upon reasonable written notice (at least 30 days) and no more than once per calendar year, you may audit Company's security and data handling practices relevant to your data, during business hours, limited in scope, and subject to confidentiality. Company may provide a SOC 2 Type II report or equivalent third-party attestation in lieu of an on-site audit. Audit rights under this section satisfy Article 28(3)(h) GDPR.

6. Integrations and Third Parties

6.1 Third-Party Integrations

The Platform may integrate with third-party systems (e.g., 3Shape, Medit, iTero scanners; laboratory systems; payment providers). Company is not responsible for the availability or performance of third-party services, data accuracy from external integrations, or interruptions caused by third-party services.

6.2 Managed Services — Third-Party Platform Activity

Where Managed Services are enabled, you remain responsible for monitoring the source scanner platform (e.g., iTero) directly for any clinician-submitted comments, amendments, or status changes made after case creation. Company does not automatically retrieve or sync post-creation updates, and case status updates within Smile Genius are not synchronised back to the source platform. Managed Services is a one-way intake service at this time.

7. Platform Availability and Service Levels

7.1 Availability

The Platform is provided on an "as available" basis. Services may be temporarily unavailable for scheduled maintenance or unscheduled emergency maintenance (by Company or third-party providers), or due to causes beyond Company's reasonable control. Company will use reasonable efforts to give advance written notice of scheduled maintenance.

7.2 Managed Services — Service Commitments

Where Managed Services are enabled:

• During business hours (9:00am–5:00pm UK time, Monday–Friday, excluding UK bank holidays): Company will use reasonable efforts to create each eligible case in your portal within 90 minutes of Company's receipt of the corresponding scanner notification.
• Outside business hours (including weekends and UK bank holidays): Company will use reasonable efforts to create eligible cases by 9:00am UK time on the next business day.

These timeframes are best-efforts service targets, not guaranteed outcomes, and do not give rise to any penalty, credit, or remedy if missed. The measurement period begins only when the scanner notification is received by Company. These targets are subject to factors beyond Company's reasonable control, including:

• Scanner platform (e.g., iTero) outages, degraded availability, or performance issues
• Scanner platform internal processing delays — including where the platform's own processing or regional support teams delay file availability (delays of 2–4 hours or more before files become available to Company are common and are excluded from measurement)
• Email delivery delays or failures
• File size, incompleteness, corruption, or network transmission time
• Company resource constraints

8. Warranties and Disclaimers

Company shall use reasonable efforts consistent with prevailing industry standards to maintain the Services in a manner which minimizes errors and interruptions and shall perform any implementation services in a professional and workmanlike manner.

HOWEVER, COMPANY DOES NOT WARRANT THAT THE SERVICES WILL BE UNINTERRUPTED OR ERROR-FREE, NOR DOES IT MAKE ANY WARRANTY AS TO THE RESULTS THAT MAY BE OBTAINED FROM USE OF THE SERVICES. EXCEPT AS EXPRESSLY SET FORTH IN THIS SECTION, THE SERVICES ARE PROVIDED "AS IS" AND COMPANY DISCLAIMS ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, IMPLIED WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, NON-INFRINGEMENT, TITLE, AND QUIET ENJOYMENT.

9. Intellectual Property Indemnity

9.1 Indemnification by Company

Company shall hold you harmless from liability to third parties resulting from infringement by the Services of any patent, copyright, or misappropriation of any trade secret under the laws of the Republic of Ireland or the European Union, provided Company is promptly notified of all threats, claims, and proceedings, given reasonable assistance, and given the opportunity to assume sole control over defense and settlement. Company will not be responsible for any settlement it does not approve in writing.

9.2 Exceptions

The foregoing obligations do not apply to portions or components of the Services: (i) not supplied by Company; (ii) made in accordance with your specifications; (iii) modified after delivery; (iv) combined with other products, processes, or materials where the alleged infringement relates to such combination; (v) where you continue allegedly infringing activity after notification; or (vi) where your use is not strictly in accordance with these Terms.

9.3 Remedies

If the Services are held or believed by Company to be infringing, Company may, at its option and expense: (a) replace or modify the Services to be non-infringing with substantially similar features; or (b) terminate these Terms and refund any prepaid, unused fees.

10. Limitation of Liability

NOTWITHSTANDING ANYTHING TO THE CONTRARY, EXCEPT FOR BODILY INJURY OR DEATH OF A PERSON, COMPANY AND ITS SUPPLIERS, OFFICERS, AFFILIATES, REPRESENTATIVES, CONTRACTORS, AND EMPLOYEES SHALL NOT BE RESPONSIBLE OR LIABLE WITH RESPECT TO ANY SUBJECT MATTER OF THESE TERMS UNDER ANY CONTRACT, NEGLIGENCE, STRICT LIABILITY, OR OTHER THEORY: (A) FOR ERROR OR INTERRUPTION OF USE OR FOR LOSS OR INACCURACY OR CORRUPTION OF DATA OR COST OF PROCUREMENT OF SUBSTITUTE GOODS, SERVICES, OR TECHNOLOGY OR LOSS OF BUSINESS; (B) FOR ANY INDIRECT, EXEMPLARY, INCIDENTAL, SPECIAL, OR CONSEQUENTIAL DAMAGES; (C) FOR ANY MATTER BEYOND COMPANY'S REASONABLE CONTROL; OR (D) FOR ANY AMOUNTS THAT, TOGETHER WITH AMOUNTS ASSOCIATED WITH ALL OTHER CLAIMS, EXCEED THE FEES PAID BY YOU TO COMPANY FOR THE SERVICES IN THE 12 MONTHS PRIOR TO THE ACT THAT GAVE RISE TO THE LIABILITY, IN EACH CASE, WHETHER OR NOT COMPANY HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES.

Nothing in these Terms limits or excludes liability that cannot be limited or excluded under applicable law, including liability arising under data protection law to the extent it cannot lawfully be limited. Managed Services targets under Section 7.2 are expressly excluded from any penalty, credit, or remedy regime.

11. Force Majeure

Neither party shall be liable for failure to perform obligations (other than payment obligations) caused by circumstances beyond its reasonable control, including acts of God, war, terrorism, civil unrest, pandemics or epidemics, government actions or sanctions, power or telecommunications failures, cyber attacks, or failures of third-party service providers. The affected party must notify the other within five (5) business days and use reasonable efforts to resume performance. If non-performance continues for more than ninety (90) days, either party may terminate without penalty.

12. Term and Termination

12.1 Term and Renewal

These Terms apply for the Initial Service Term of your subscription plan and renew automatically for successive periods of the same duration unless either party gives notice of non-renewal at least thirty (30) days before the end of the then-current term.

12.2 Termination for Cause

Either party may terminate upon thirty (30) days' written notice (or without notice in the case of non-payment) if the other party materially breaches these Terms and fails to cure within ten (10) days of written notice.

12.3 Termination for Convenience

Either party may terminate for any reason on thirty (30) days' written notice, provided all accrued payment obligations are met.

12.4 Effect of Termination

Upon termination or expiry: you will pay in full for Services up to and including the last day of service; Company will make Customer Data available for electronic retrieval for thirty (30) days; Personal Data will be deleted from production systems within ninety (90) days (except where retention is required by law), with backup copies retained for a further ninety (90) days for disaster recovery before deletion; you are responsible for costs of data migration; and you may disable Managed Services at any time via Settings without affecting Platform access.

12.5 Survival

The following survive termination: Sections 3 (Confidentiality; Proprietary Rights), 5 (Data Privacy, to the extent processing continues), 8 (Warranties and Disclaimers), 9 (IP Indemnity), 10 (Limitation of Liability), 12.4–12.5, 14 (Miscellaneous), and accrued rights to payment.

13. Acceptable Use

You agree not to: use the Platform for unlawful or fraudulent purposes; attempt to copy, reverse engineer, or misuse the Platform; interfere with system performance or security; upload harmful, malicious, or defamatory content; transmit viruses or malware; harass or abuse other users; collect or track personal information of others without consent; or use the Platform for competitive intelligence or benchmarking.

14. Miscellaneous

14.1 Entire Agreement

These Terms, together with your subscription plan selection and the Privacy Policy, constitute the complete and exclusive statement of the mutual understanding of the parties and supersede all previous written and oral agreements and communications relating to their subject matter. No purchase order or similar document shall have any force or effect.

14.2 Governing Law and Jurisdiction

These Terms are governed by the laws of the Republic of Ireland without regard to conflict of laws provisions. Subject to Section 14.11, disputes are subject to the exclusive jurisdiction of the courts of the Republic of Ireland.

14.3 Notices

All notices must be in writing and are deemed given: when personally delivered; when receipt is electronically confirmed if by email; the day after dispatch by recognized overnight courier; or upon receipt if by certified or registered mail. Notices to Company: support@smilegeniusdental.com. Notices to you: the email or mailing address registered to your account.

14.4 Amendments and Waivers

Company may update these Terms from time to time; material changes will be notified at least thirty (30) days in advance by email or in-Platform notice, and continued use after the effective date constitutes acceptance. No waiver is effective unless in writing; failure to enforce a right is not a waiver.

14.5 Assignment

You may not assign, transfer, or sublicense these Terms without Company's prior written consent; any attempt is void. Company may assign without consent, including to a successor in connection with a merger, acquisition, or sale of assets, with notice to you.

14.6 Severability

If any provision is found unenforceable or invalid, it will be limited or eliminated to the minimum extent necessary so that these Terms otherwise remain in full force and effect.

14.7 No Agency

No agency, partnership, joint venture, or employment is created by these Terms, and you have no authority to bind Company.

14.8 Attorneys' Fees

In any action or proceeding to enforce rights under these Terms, the prevailing party is entitled to recover reasonable costs and attorneys' fees.

14.9 Counterparts and Electronic Acceptance

Acceptance of these Terms electronically (including by registration, click-through, or continued use) has the same legal effect as a handwritten signature.

14.10 Export Compliance

Each party shall comply with applicable export laws and regulations.

14.11 Dispute Escalation

(a) Good-Faith Negotiation. Before initiating formal legal proceedings, the parties will attempt to resolve any dispute through good-faith negotiation between senior representatives (your business owner or equivalent; Company's CEO or nominated officer) for at least thirty (30) days from written notice of the dispute.

(b) Mediation. If negotiation does not resolve the dispute, either party may refer it to non-binding mediation before a mutually agreed neutral mediator in Dublin, Ireland. The parties will share the mediator's fees equally and bear their own costs. Mediation will take place within thirty (30) days of referral.

(c) Litigation. If the dispute remains unresolved thirty (30) days after mediation is initiated (or if the parties fail to agree a mediator within fourteen (14) days), either party may pursue litigation in the courts of the Republic of Ireland.

(d) Exceptions. Either party may seek immediate injunctive or interim relief in court to prevent irreparable harm, protect confidential information or intellectual property, or address non-payment, without first pursuing negotiation or mediation.

15. Representations and Warranties of Customer

You represent and warrant that: you have authority to accept these Terms on behalf of your organisation; you own or control the Customer Data provided; the Customer Data does not infringe third-party rights; your use of the Platform complies with all applicable laws; and you have obtained all necessary consents from patients and clinic partners.

16. Definitions

"Business Hours" — 9:00am to 5:00pm UK time, Monday to Friday, excluding UK bank holidays.

"Customer Data" — non-public data provided by or on behalf of Customer to Company to enable provision of the Services, including Personal Data.

"Data Controller" / "Data Processor" / "Personal Data" / "Personal Data Breach" / "Data Subject" / "processing" — have the meanings given in the GDPR/UK GDPR.

"GDPR" — Regulation (EU) 2016/679; "UK GDPR" — the GDPR as incorporated into UK law by the Data Protection Act 2018 and the European Union (Withdrawal) Act 2018.

"HIPAA" — the US Health Insurance Portability and Accountability Act of 1996 and its implementing regulations; "PHI" — Protected Health Information as defined under HIPAA; "BAA" — Business Associate Agreement.

"Managed Services" — the scanner-intake automation service described in Section 5.3, whereby Company monitors forwarded scanner notifications and creates cases in Customer's portal on Customer's behalf.

"Platform" / "Services" — the Smile Genius Dental software-as-a-service platform, including all features made available under Customer's subscription plan.

"Proprietary Information" — business, technical, or financial information disclosed by one party to the other, as described in Section 3.1.

"Software" — software, documentation, and data related to the Services.

"Sub-processor" — a third party engaged by Company to process Personal Data on Customer's behalf.

"Term" / "Initial Service Term" — as described in Section 12.1.

Exhibit A — Service Level Terms

Availability: The Services shall be available 99.5%, measured monthly, excluding UK bank holidays, weekends, and scheduled maintenance (with advance notice). Any downtime resulting from outages of third-party connections or utilities, or other causes beyond Company's reasonable control, is excluded from calculation. If Customer requests maintenance during measured hours, affected periods are excluded.

Recovery: Company will use commercially reasonable efforts to restore the Services within 48 hours of downtime being reported by Customer.

Managed Services targets: See Section 7.2 (best-efforts; excluded from any penalty or credit regime).

Exhibit B — Support Terms

Channels: Email (support@smilegeniusdental.com) and Help Centre (https://help.smilegeniusdental.com).

Hours: Weekdays 9:00am–5:00pm UK time, excluding weekends and UK bank holidays.

Response targets:

• Critical issues (Platform unavailable or material data-loss risk): response within four (4) business hours
• Standard issues: response within one (1) business day

Critical issues may be escalated to Company's engineering team; Customer will be notified of escalation status within 24 hours.

Questions? Contact support@smilegeniusdental.com — Data Protection Contact: Arun Kumar, CTO

© 2026 Smile Genius Dental Limited. All rights reserved.