Clear Aligner Products Terms and Conditions

1. INTRODUCTION. These Terms and Conditions (“Terms and Conditions” or “Agreement”) shall apply to any order, purchase, and/or use by any dental or medical professional, clinician, doctor or dentist (“Customer”) of any products and services, including the Clear Aligner and Retainer products and services and the product packages described in Exhibit A attached hereto (collectively, “Products”) which are offered, sold or provided to any Customer hereunder by any of Henry Schein, Inc. or any of its subsidiaries, affiliates, sub-distributors or subcontractors, which are specified as the Product provider in the order form or contract to which these Terms and Conditions are attached or relate (each individually an “HSI Entity” and collectively, as the context requires, “HSI”). The parties hereby acknowledge and agree that, except as otherwise expressly provided in this Agreement, each individual HSI Entity is acting severally under this Agreement and, as such, any and all obligations and liabilities with respect to each such individual HSI Entity shall be several, not joint with the other HSI Entities, and relate only to such individual HSI Entity and the specific products or services being provided or performed by such individual HSI Entity.

1. TERM. The term of this Agreement for each Product shall begin on the date a Customer Order is submitted in accordance with this Agreement and end on the latest expiration date of any applicable warranties on the Products contained in this Agreement. This Agreement may be terminated earlier by a party for a breach of this Agreement by the other party which breach isn’t cured within 30 days of the non-breaching party’s notice of such breach to the breaching party.

1. CUSTOMER ORDERS. Orders are placed by Customer (“Customer Orders”) using the Smilers Portal (“Smiler Portal”) (or by any other means designated by HSI from time to time) which can be accessed at https://smilers.biotech-dental.com/en/login. Customer Orders may be rejected by HSI in its sole discretion and may be accepted by HSI by any means, including by HSI sending the Customer a confirmation or by shipment of the Products to Customer. Customer Orders are considered placed when and as follows: (a) if Treatment Setup (as defined in Exhibit A) is used, on the date the final Treatment Setup is approved by Customer, or (b) if no Treatment Setup is required, on the date of the submission of the order by Customer with all required patient records. Except as otherwise provided in this Agreement, once Customer has placed a Customer Order that is accepted by HSI, Customer cannot cancel or terminate the Customer Order unless HSI fails to provide the Products or Customer within a reasonable time frame.

1. HSI SYSTEMS SECURITY. Use by Customer of any applicable HSI software, website, platform or system, including the Smiler Portal (collectively, “HSI Systems”), shall be subject to Customer’s registration for such use as directed by HSI, and Customer’s agreement with these Terms and Conditions and any end user license agreement and/or other policies, procedures, terms and conditions, including with respect to privacy of any data or information, communicated to Customer by HSI or included or contained in any HSI Systems (collectively, Privacy Policies”). Customer is responsible for maintaining the confidentiality of all login information for HSI Systems, including their Smiler Portal login information, and is fully responsible for all activities that occur under that password or user name. Customer agrees to (a) immediately notify HSI of any unauthorized use of any password, login information or user name used by Customer to access any HSI Systems or any other breach of the security and/or any Privacy Policies of any HSI Systems, and (b) to ensure that Customer exit from their HSI Systems accounts at the end of each session.
2. Data Privacy Laws; USE OF PROTECTED INFORMATION.
   1. Customer will, as applicable, obtain from all of its patients for whom the Products are designed, ordered or used, all requisite written consents and agreements (including as required in order to treat the patient and design, order and utilize the Products, communicate treatment plans and other patient clinical information (or for any other purposes under this Agreement)) as required by applicable laws and regulations including the following:

1. For Customers located in the European Union, written consents and agreements to Customer’s and HSI’s use of “Personal Data” (as defined in the European Union General Data Protection Regulation (“GDPR”));
2. For Customers located in the United States, written consents and agreements to Customer’s and HSI’s use of Protected Health Information (“PHI”) (as defined in Health Insurance Portability and Accountability Act (“HIPAA”);
3. For Customers located in Canada, written consents and agreements to Customer’s and HSI’s use of any clinical or patient information or other protected health information or any other information (“Canadian Protected Information”) the use or disclosure of which is restricted under any applicable laws and regulations (including any applicable Canadian provincial or federal privacy legislation); and
4. For  Customers located outside of Canada, the EU and the United States, written consents and agreements to Customer’s and HSI’s use of any clinical patient information or other protected health information or any other information (“Other Protected Information”) the use of which is restricted under any applicable laws and regulations in the jurisdiction in which Customer is located (including any applicable privacy or secrecy laws and regulations), including, without limitation, the laws and regulations, if any, set forth in Exhibit E attached hereto.

1. 1. Customer acknowledges and understands the confidential nature, as applicable to the Customer depending on its location, of PHI in the United States, Personal Data in the European Union, Canadian Protected Information in Canada and any Other Protected Information in any other jurisdiction in which Customer is located (collectively, “Protected Information”) and agrees that (i) Customer will only communicate such Protected Information to HSI as required for HSI to provide the Products under this Agreement and (ii) Customer is solely responsible for maintaining any and all necessary measures to assure such confidentiality in accordance with all applicable laws and regulations. HSI (including each HSI Entity) shall not be liable for any claims arising from any disclosures or breaches of the security of any Protected Information or of any other information maintained by Customer, and Customer shall promptly notify HSI if it becomes aware of any such claim, disclosure or breach.
   2. Use of any information provided to HSI by Customer hereunder or in the course of Customer’s use of any of the HSI Systems, including any Protected Information, shall be subject to HSI’s applicable Privacy Policies (as defined below). Customer must use the security features (including any key, PIN or password) in order to keep Protected Information secure and shall keep such security features confidential without lending, sharing, transferring or otherwise misusing them. Customer acknowledges that HSI may change its security features from time to time.
   3. Customer acknowledges and agrees that HSI may transfer Protected Information for processing to one or more of its affiliates or third party sub-processors located anywhere in the world in the course of designing, manufacturing and providing the Products.
   4. Customer agrees that HSI may use Protected Information for promotional, educational and/or research purposes, publication in professional journals or use in professional collateral materials, provided that such Protected Information has first been anonymized in a way that neither Customer nor any patient is identifiable.
   5. To the extent HSI must access Protected Information for purposes of this Agreement in Canada, the EU, the United States, or any other country or territory, as applicable, including with respect to the Treatment Setups:

1. For Customers located in the United States: PHI subject to HIPAA, HSI shall be deemed a business associate to the Customer (as defined by HIPAA) and both HSI and Customer shall be subject to the terms and conditions of the HIPAA Business Associate Agreement attached hereto as Exhibit C.
2. For Customers located in the EU, the UK or Switzerland: For Personal Data subject to the GDPR, the UK GDPR or the Swiss Data Protection Act, the HSI Entity which is the Product provider shall be a “processor” (as defined by the GDPR), each other HSI Entity involved in the applicable transaction are “sub-processors”, and the Customer shall be the “controller” (as defined by the applicable data protection law), and both the Customer (as controller) and the Product provider (as processor) shall be subject to the terms and conditions of the GDPR Controller-Processor Agreement attached hereto as Exhibit D.
3. For Customers located in Canada: For Canadian Protected Information subject to Canadian Privacy Legislation, the Customer shall be the “custodian” (or similar language as may be defined in Canadian Privacy Legislation) of the Canadian Protected Information, and both HSI and Customer shall be subject to the terms and conditions of any of the applicable provincial or territorial Information Management Agreements, as amended from time to time. The provincial or territorial Information Management Agreements, as applicable, are incorporated by reference herein.
4. For Customers located outside of Canada, the EU and the United States: For use of any Other Protected Information, HSI and Customer shall be subject to any applicable laws and regulations in the jurisdiction in which Customer is located (including any applicable privacy or secrecy legislation), including, without limitation, as set forth in Exhibit E attached hereto.

1. CUSTOMER REPRESENTATIONS AND OBLIGATIONS. As a condition of HSI’s sale of the Products to Customer, Customer agrees as follows:

1. 1. Customer is licensed or registered to practice medicine, dentistry and/or orthodontics, as applicable, without restriction in the jurisdiction to which the Products are to be shipped and where Customer will install the Products and otherwise provide treatment to such patient;
   2. Customer, (i) will not use the Products, and will promptly inform HSI, if any of their licenses or registrations to practice expires, is not valid, is revoked, suspended or otherwise jeopardized or restricted at any time during treatment of patients, and (ii) will allow HSI to take such actions as HSI considers appropriate in light of such circumstances;
   3. Customer (i) has the necessary expertise, experience and training to properly perform procedures associated or in conjunction with treatment using the Products, and (ii) will use the Products only in accordance with generally accepted dental standards as well as any HSI clinical protocols designated by HSI.
   4. The Products will not be used (i) by any other person other than the Customer who placed the order, (ii) on or for the benefit of any patient other than Customer’s patient for whom the Products were ordered and designed; or (iii) outside of the country where Customer and the applicable patient are located and to which such Products are shipped by HSI or its designee.
   5. Customer shall provide HSI with Customer’s accurate and complete ownership information as requested by HSI if required to fulfill any of HSI’s legal or regulatory obligations, including with respect to transparency reporting obligations, if any, in the applicable jurisdiction where Customer is located.
   6. Customer (i) shall be fully responsible, and directly and solely liable for the treatment of each patient, including the exercise of clinical judgment in the decision to use the Products and the design and implementation of each patient’s treatment plan, and for achieving the desired outcome for the Patient, (ii) will, upon request, provide feedback regarding the status of any patient’s treatment, experience and outcome with the Products; and (iii) promptly notify HSI of any event (with all available details) relating to the Products of which Customer or HSI is required to notify  any governmental or regulatory authority.

1. CANCELLATIONS.
   1. HSI may begin to manufacture the ordered Products upon Customer’s approval of the Treatment Setup and associated price quotation (the “Customer Order Approval”) for the Products. Customer may not cancel any Aligner Products order after the Customer Order Approval. If any Treatment Setup has been posted to the Smiler Portal for more than sixty (60) days without Customer response or feedback, such Customer Order may be cancelled by HSI without notice to the applicable Customer.
   2. Cancellation Fees: Customer Orders cancelled by Customer before Treatment Setup will not incur cancellation fees.  For orders that are cancelled after Treatment Setup, or if the Customer does not accept a Treatment Setup after sixty (60) days, the Customer will be charged a cancellation fee.  In addition, HSI reserves the right to assess a cancellation fee per cancelled Customer Order and/or deactivation of a Customer’s HSI Systems account status if (i) permitted under applicable laws in the jurisdiction in which Customer is located, or (ii) a Customer has an unreasonably high, in HSI’s sole discretion, number of Customer Order cancellations. Full payment of all fees for a Customer Order for Products (including replacement Products orders) will be payable by Customer within 30 days of cancellation.

1. PRICES AND PAYMENT.
   1. The price that applies to any Customer Order will be the price shown on the price quotation provided at the time Customer places the Customer Order in accordance with these Terms and Conditions. The prices for Products and Services are subject to change by HSI at any time without notice to Customer. Price changes will not affect orders which have already been received Customer Order Approval.
   2. Prices are in either U.S. dollars or, if designated by HSI consistent with applicable laws, the local currency of the country where the Customer is located and are exclusive of any applicable taxes (including sales tax, VAT, GST, and consumption tax) and shipping and insurance charges which shall be billed to Customer separately. Additional shipping charges may apply to Customer Orders for Clear Aligners and retainers, including replacement Products.
   3. Customer will pay all HSI invoices as directed in the invoice in full and in cleared funds. Invoices are due for initial Aligner Products within 60 days of invoice and all other products and fees are due within 30 days of the date of invoice unless otherwise mutually agreed in writing by the parties or as otherwise stated in the invoice. Any invoice or other outstanding balance not paid by the invoice due date may be subject to the lesser of (i) 1.5% per month or (ii) the maximum monthly interest allowable by law.

1. CLINICAL RISKS.
   1. Customer is wholly responsible for the use of the Products and the review and approval of the Treatment Setup, as well as the diagnosis and treatment of each patient.
   2. Customer is responsible for carefully reviewing a proposed Treatment Setup prior to approval and for determining the suitability of the treatment for the applicable patient.
   3. Customer acknowledges and understands that HSI is not providing and does not provide medical, dental or health care services or advice.
   4. The Customer is responsible for ensuring that (i) they are aware of the content of the Products’ Instructions for Use (the “Product Instructions”), including the contraindications and risk factors, (ii)  the Products are prescribed only to patients who do not have contraindications and to whom the risks of treatment with the Products have been properly and fully explained, and (iii) patients are provided with the Product Instructions applicable to patient’s use of the Products and ensuring that they understand them.

1. COMPLIANCE WITH LAWS. Customer agrees that, in carrying out its duties and responsibilities under this Agreement, it will neither undertake nor cause or permit to be undertaken, any activity which is illegal under any applicable laws, decrees, rules, regulations, codes, orders or other requirements, including, without limitation and as applicable in the jurisdiction in which Customer is located, any anti-bribery and anti-kickback laws, any transparency laws (as hereinafter defined) and any data privacy laws (including with respect to any Protected Information), all as amended from time to time, including, without limitation, as set forth in Exhibit E attached hereto.

1. DISCOUNTS AND REBATES. Customer shall be obligated to report and provide information concerning any discounts, rebates or other price reductions provided under this Agreement. Customer must claim the benefit of these discounts in the fiscal year in which the discounts are earned, or the following year. By signing this Agreement, Customer acknowledges its legal obligations to fully and accurately report the discounts, rebates and/or other price reductions received under this program. Customer should retain this Agreement and any other documentation of discounts, rebates or other price reductions and make such information available to any applicable governmental authorities and programs and other applicable payers upon request.

1. SUNSHINE ACT. For Customers located in the United States only, the parties acknowledge that the Physician Payments Transparency Requirements enacted as section 6002 of the Patient Protection and Affordable Act of 2010 (codified at 42 U.S.C. §1320a-7h) and the regulations of the Centers for Medicare and Medicaid Services (CMS) promulgated thereunder (collectively, the “Sunshine Act”) require pharmaceutical, medical device, group purchasing organizations and other companies to annually report certain information about compensation, expenses and other payments or transfers of value provided directly or indirectly to U.S. physicians and teaching hospitals to CMS, which will in turn publicly post the information.  If Customer is located in the United States, Customer agrees:  (a) not to contest any such reporting made by HSI in its reasonable judgment; (b) to provide HSI with any information requested to ensure its timely, accurate and complete reporting; and (c) to comply with its annual reporting obligations under the Sunshine Act, to the extent required, including filing appropriate ownership reports.

1. CONFIDENTIALITY OF INFORMATION.  Customer will not use (except to undertake the activities contemplated by this Agreement), publish or otherwise disclose any confidential or proprietary information (including the terms of this Agreement) (“Confidential Information”) related to HSI or the Products that is disclosed by HSI or otherwise acquired by Customer in connection with the performance of this Agreement unless required by applicable law. This provision shall survive any expiration or termination of this Agreement.

1. PRODUCT WARRANTY. 
   1. HSI offers the Product warranty to its Customers as shown on Exhibit B attached hereto.  HSI offers no other warranty with respect to the Products or any portion thereof.
   2. DISCLAIMER OF ALL OTHER WARRANTIES.  EXCEPT AS PROVIDED IN EXHIBIT B HERETO, TO THE EXTENT PERMITTED BY LAW, HSI (INCLUDING EACH HSI ENTITY) PROVIDES NO WARRANTIES OF ANY KIND, EXPRESS OR IMPLIED, REGARDING THE PRODUCTS OR SERVICES OR ANY PORTION THEREOF, INCLUDING WITHOUT LIMITATION ANY WARRANTY OF MERCHANTABILITY, FITNESS FOR PARTICULAR PURPOSE OR NON-INFRINGEMENT.
   3. This Section 14 shall survive any expiration or termination of this Agreement.

1. OTHER MATTERS.
   1. LIMITATION OF LIABILITY.  TO THE EXTENT PERMITTED BY LAW, NEITHER PARTY SHALL BE LIABLE TO THE OTHER (OR, IN THE CASE OF HSI AND EACH HSI ENTITY, TO CUSTOMER’S PATIENTS) FOR INDIRECT, INCIDENTAL, PUNITIVE, SPECIAL OR CONSEQUENTIAL DAMAGES INCLUDING, BUT NOT LIMITED TO, LOST PROFITS AND LOSS OF GOODWILL, ARISING FROM OR RELATING TO ANY BREACH OF THIS AGREEMENT (OR ANY DUTY OF COMMON LAW, AND WHETHER OR NOT OCCASIONED BY THE NEGLIGENCE OF A PARTY OR ITS AFFILIATES), REGARDLESS OF ANY NOTICE OF THE POSSIBILITY OF SUCH DAMAGES; PROVIDED THAT NOTHING IN THIS SECTION IS INTENDED TO, OR DOES, LIMIT THE CONFIDENTIALITY RIGHTS OR OBLIGATIONS OF EITHER PARTY SET FORTH HEREIN. IN NO EVENT WILL HSI’S (INCLUDING ALL OF THE HSI ENTITIES) AGGREGATE LIABILITY UNDER THIS AGREEMENT EXCEED THE AMOUNT OF FEES PAID BY CUSTOMER TO HSI UNDER THIS AGREEMENT IN THE PRECEDING 12 MONTHS. This Section shall survive any expiration or termination of this Agreement.
   2. Indemnity.  Customer agrees to indemnify, keep indemnified, defend and hold harmless HSI, including each HSI Entity against and from any and all claims, causes of actions, damages, debts, liabilities, losses, obligations, payments, costs and expenses (including reasonable legal expenses), arising from or relating to: (i) Customer’s breach of any term of this Agreement or of any  agreement between Customer and their patient; (ii) any actions or omissions of Customer and including  any act or failure to act in respect of a patient; (iii) Customer’s provision of incorrect or incomplete information, records, documents or impressions to HSI or any failure to timely provide HSI with any such  information, records, documents or impressions; and (iv) any dealings with any applicable regulators, licensing or professional bodies in relation to Customer. This Section shall survive any expiration or termination of this Agreement.
   3. Intellectual Property Rights, Confidentiality and Trademarks.
      1. All rights in intellectual property (including all patents, trademarks, trade names, service marks, logos, registered designs, utility models, design right, database rights, copyright (including copyright in software and computer algorithms), trade secrets and other confidential information, know-how, and all other intellectual and industrial property and rights of a similar or corresponding nature in any part of the world) in or relating to the Products, any materials or information, HSI Systems (including the Smiler Portal), documents or items that HSI prepares or produces for Customer or any patent or makes available to Customer or any patient (collectively, “HSI Intellectual Property”), as between HSI and Customer, will belong to HSI absolutely and exclusively and Customer shall obtain no rights or licenses with respect to and shall not utilize any HSI Intellectual Property except as otherwise expressly provided in this Agreement. Customer agrees to promptly inform HSI if Customer becomes aware of any infringement of any of the HSI Intellectual Property by any person or entity. This Section shall survive any expiration or termination of this Agreement
      2. HSI grants to Customer the limited right to the use of the trademarks on the Products provided by HSI in connection with the use and sale of the Products as authorized under this Agreement during the term of this Agreement. Any changes to the marketing materials or other documentation related to the Products, including, without limitation, materials that include HSI Trademarks, must be approved in writing in advance by HSI.
   4. Insurance. Customer shall maintain during the Term of this Agreement (and if any policy is on a claims-made and reported form, for three years thereafter) a third party liability insurance with such coverage as customary for dentists in the country where the Customer has its seat.  HSI shall be given at least 30 days’ notice of cancellation or expiration of such insurance.
   5. Audits.  Customer agrees to cooperate with any audit performed by HSI (or it’s duly appointed agents or representatives) undertaken to verify Customer’s compliance with this Agreement or required in order to comply with applicable laws.
   6. Notices.  Except as otherwise provided, all notices given under this Agreement shall be in writing and shall be deemed to have been duly given upon receipt if delivered by hand or electronic transmission with receipt confirmed, three days after mailing by certified or registered mail, and one day after sending by overnight courier, to the parties’ respective address indicated on the signature page of this Agreement or such other address as a Party specifies in writing to the other Party. Any notice to HSI shall include a copy to: Henry Schein, Inc., 135 Duryea Road, Melville, New York 11747; Attn: General Counsel; Fax: 631-843-5660.
   7. Force Majeure. HSI will not be liable or responsible for any failure to perform, or delay in performance of, any of our obligations under these Terms and Conditions that is caused by events outside our reasonable control (“Force Majeure Event”). Any failure by Customer to pay any sums due to HSI shall not be excused by reason of any Force Majeure Event. HSI’s obligations under these Terms and Conditions are suspended for the period that the Force Majeure Event continues, and HSI will extend the time to perform these obligations for the duration of that period but will make reasonable efforts to perform.
   8. Governing Law.  This Agreement shall be governed by:

1. With respect to Customers located outside of the European Union, the laws of the State of New York, without reference to conflict of laws principles, and the parties irrevocably submit to the jurisdiction of the federal courts sitting in the Eastern and Southern Districts of New York for the purposes of any suit, action or proceeding arising under this Agreement; and
2. With respect to Customers located in the European Union, the laws of the country where the Customer has its seat and the parties irrevocable submit to the jurisdiction of the courts having jurisdiction over the place where the Customer has its seat.

The parties hereby irrevocably waive the defense of an inconvenient forum to the maintenance of any such suit, action or proceeding.

1. 1. Remedies.  Since the disclosing Party may not be adequately compensated by money damages in the event of the receiving Party’s breach of any of the confidentiality provisions of this Agreement, the disclosing Party shall be entitled, in addition to any other right or available remedy, to seek an injunction or other equitable relief restraining such breach or any threatened breach.
   2. Amendments.  This Agreement may not be amended, nor any obligation waived, except by a writing signed by both parties.
   3. No Waiver.  No failure or delay by any Party in exercising any right, power or privilege hereunder shall operate as a waiver thereof, nor shall any single or partial exercise thereof preclude any other or further exercise thereof or the exercise of any other right, power or privilege hereunder.
   4. Severability.  If any term of this Agreement is held by a court of competent jurisdiction to be invalid or unenforceable, then this Agreement, including all of the remaining unaffected terms, shall remain in full force and effect as if such invalid or unenforceable term had never been included.
   5. No Publicity.  Neither Party shall originate any publicity, press releases or other public announcement relating to any relationship between the parties, this Agreement or the performance hereof without the other Party’s prior written consent; provided, however, that either Party may, without such consent, make any press release or other public announcement as required by law.
   6. Section Headings.  The headings contained in this Agreement are for convenience of reference only and are not intended to have any substantive significance in interpreting this Agreement.
   7. Entire Agreement.  This Agreement, including these Terms and Conditions and exhibits attached hereto, each of which is incorporated herein by reference in its entirety, constitutes the entire agreement between Customer and HSI.  All prior or contemporaneous agreements, proposals, understandings and communications between or involving Customer and HSI, whether oral or written, are superseded by this Agreement.  The terms contained in this Agreement shall supersede any conflicting terms contained in any document used or submitted by either Party in connection with the purchase of Products covered by this Agreement.

Exhibit A

Product and Product Package Descriptions and Definitions

SMILERS AND SMILERS EXPERT PACKAGE DESCRIPTIONS

Unlimited – Treatment package for moderate-to-severe cases with 21 or more steps. Includes unlimited aligners and refinements.  Comes with unlimited aligners/steps and Refinements (if needed) and one set of Retainers.

Agile – This treatment option is for mild-to-moderate cases for single arch with 11 to 20 steps or dual arches with 21 to 40 individual aligners. Includes up to (2) two Refinements (if needed).  An additional cost per aligner applies if the treatment exceeds the number of aligners allotted in the package.  No retainers are included.

Mini – This treatment option is for very mild cases for single arch with 10 or less steps or dual arches with 20 or less individual aligners. Includes up to one (1) Refinement (if needed). An additional cost per aligner applies if the treatment exceeds the number of aligners allotted in the package.  No retainers are included.

Aesthetics – This treatment option is for single arch or dual arches premolar to premolar correction.  These cases come with unlimited aligners/steps within one (1) year of the start of the treatment. No retainers are included.

DEFINITIONS

Assurance Plan is period of guaranteed refinements calculated by the aligner case invoice date. For Unlimited and Agile cases, the Assurance Plan period is three (3) years.  For Mini and Aesthetics cases, the Assurance Plan period is one (1) year.

Elastic Button Technique (EBT) is a technique for using buttons and rubber bands as auxiliaries to aligners in order to achieve extrusion. The Clinician will be notified if EBT is recommended on the Treatment Setup, but those recommendations are not required to be accepted by the Clinician and it is up to the Clinician to promptly inform HSI of any necessary changes. If the Clinician approves the Treatment Setup with EBT, directions on the location and timing for EBT will be provided once the aligners have been manufactured. The Clinician must follow directions provided by creating cutouts on aligners in-office and adhering separately purchased buttons to the surface of the teeth near the gingiva. The Clinician has complete choice of what buttons and elastics to use.  After aligners have been modified and buttons adhered, the Clinician must instruct patients on proper elastics wear.   

Interproximal Reduction (IPR) is a procedure where the proximal surfaces of the teeth are reduced. This reshaping creates spaces between the teeth to allow them to move more easily during treatment.  The Clinician will be notified if IPR is recommended on the Treatment Setup, but those recommendations are not required to be accepted by the Clinician and it is up to the Clinician to promptly inform HSI of any necessary changes. The Clinician will need to notify HSI of any preferences on when to perform IPR when submitting the case or requesting modifications of the treatment plan. If the Clinician approves the Treatment Setup with IPR, directions on the location and timing for IPR will be provided once the aligners have been manufactured. The Clinician has complete choice of what instruments and methods to use for completion of planned IPR. HSI recommends always getting signed consent from the patient before performing IPR.

Refinement – An option if further tooth movement is needed in order to meet the original approved Treatment Setup. Refinements are not an opportunity to modify the original Treatment Setup. HSI will provide the recommended number of aligners to achieve your approved Treatment Setup once appropriate records have been provided. Refinements may only be requested after half the number of steps provided have been used and before the Treatment Expiration Date.

Retainers – One set of upper and lower, made of slightly thicker material for longevity. May be ordered as replacement retainers, based on the original submitted intraoral scan and approved Treatment Setup.

Replacement Aligners – To replace lost or damaged aligner trays, Replacement Aligners are made from the original submitted intraoral scan and approved Treatment Setup. Dual arch Replacement Aligners constitute two replacement trays.  Note – there is an additional cost per aligner tray for Replacement Aligners for all packages.

Instruction on Replacement Aligners: Direct patients to keep their most recently used aligners and temporarily use the previous set while replacements are being made. Replacement Aligners for more than one step are available for purchase and will generally ship within 7 to 10 business days after placing the order.  If one set of aligners has been lost, please instruct the patient to skip that step and increase the length of time the next step is worn until the teeth are fully seated. 

Revision – An option if the treatment plan needs to be changed by the doctor to achieve new treatment goals. A new Treatment Setup will be provided for approval.

Treatment Expiration Date is calculated by the aligner delivery date plus 2 weeks per step, plus 120 days from completion of the final step.

Treatment Setup is a virtual three-dimensional representation of the patient’s expected tooth movement which is used for communicating the orthodontic treatment plan. Treatment Setups include the virtual model and the option for Interproximal Reduction (IPR), Attachments, Cutouts, Elastic Slits, and Elastic Button Technique (EBT) if needed. Prior to approving the final Treatment Setup, the Clinician is requested to thoroughly review the Treatment Setup and request changes or modifications in the Smiler Portal. If the Clinician does not approve the Treatment Setup, he/she may cancel the case with no cancellation fees. The Clinician’s approval of the customized Treatment Setup is considered a prescription to HSI and HSI’s final authorization to manufacture the Henry Schein’s Aligners (when medically feasible for extraction cases, HSI recommends Treatment Setup approval prior to performing extractions). Results depicted in Treatment Setup are simulated; actual clinical results may vary and are not guaranteed.

New Treatment Setup – When new scans or impressions are required for Retainers or a new Treatment Setup is requested after one has already been approved by the customer.

Exhibit B

Product Warranty

This Warranty covers aligner Products (“Aligner Products”) and retainer Products (“Retainer Products”) (collectively, “Products”) sold to Customer hereunder. The warranty is exclusively for the benefit of eligible treating Customers (individually, a “Clinician”) and is not for the benefit of any other person or entity, including, but not limited to, any patients, practices, laboratories and/or other intermediate suppliers.

1. The “Warranty Period” is as follows and will apply to (i)  Aligner Product packages until the “Treatment Expiration Date” (which is calculated by taking the date the applicable Aligner Product is delivered to Customer and adding two (2) weeks per step (per approved Treatment Setup), plus 90 days; and (ii) Retainer Products sold separately for up to six (6) months from the Treatment Expiration Date; provided that HSI only warrants the fit of the Retainer Products for up to 60 days from the date of shipment to Customer. (iii) Individual Aligner Products sold separately HSI only warrants the fit for up to 15 days from the date of shipment to Customer.

1. Scope of Warranty. Subject to the eligibility and other requirements set forth in this Warranty, if the Product fails due to a defect during the Warranty Period, HSI will replace the defective Product using the original approved Treatment Setup and originally provided patient records.

1. Eligibility. To be eligible for the Warranty, Clinician must provide notice to HSI prior to the expiration of the applicable Warranty period and no later than 30 days after the defect in the Product was discovered, with such notice including documentation demonstrating the facts and circumstances surrounding the failure of the Product.

1. Returns. Customer is responsible for Products returned to HSI, provided that in case the returned Product proves to be covered under this Warranty, reasonable and documented transportation costs for the return of such Product shall be borne by HSI. All returns should be completed via a reputable national courier which provides insurance for the full replacement value of the shipped Product. Returned Products must include a Return Material Authorization (RMA) number marked clearly on the outside of the package. The package must be addressed to the Returns Department. Please contact aligners@archive.henryscheinortho.com for support. Customer shall be responsible for all transport costs and risks relating to any return of a Product where the Products or the reason for the return is not covered by the Warranty.

5. Exclusions. This Warranty shall not apply in the event of:

1. Any trauma, accident, or other damage to the Product by the patient or a third-party;
2. Any placement of the Product in a patient with accepted contra-indicated conditions that might interfere with successful integration;
3. Any normal wear and tear of the Products;
4. Any misuse or modification of the Product;
5. Any use of the Product in combination with any third party products, materials or services not expressly authorized in writing by HSI;
6. Any negligent treatment by the Clinician or treatment by any Clinician not properly licensed;
7. Any other damage, failure or defect not caused by HSI

1. NOTWITHSTANDING ANYTHING TO THE CONTRARY CONTAINED IN THIS WARRANTY OR ANY AGREEMENT BETWEEN HSI AND CUSTOMER, HSI’S AND EACH HSI APPLICBALE ENTITY’S SOLE AND EXCLUSIVE LIABILITY AND OBLIGATION UNDER THIS WARRANTY IS FOR REPLACEMENT OF THE APPLICABLE PRODUCTS COVERED BY THIS WARRANTY. NO WARRANTY IS MADE REGARDING THE OUTCOME OF ANY TREATMENT USING THE PRODUCTS OR ANY COMBINATION OF THE PRODUCTS WITH ANY THIRD PARTY PRODUCTS, WHETHER OR NOT IN CONJUNCTION WITH ANY HSI SERVICES. IN NO EVENT WILL HSI’S (INCLUDING ALL OF THE HSI ENTITIES’) AGGREGATE LIABILITY UNDER THIS AGREEMENT EXCEED THE AMOUNT OF FEES PAID BY CUSTOMER TO HSI UNDER THIS AGREEMENT IN THE PRECEDING 12 MONTHS. This Section shall survive any expiration or termination of any agreement between Clinician and HSI.

1. No representative, employee or agent of HSI is authorized to give any other warranties on behalf of HSI or modify the limitations set forth in this Products Warranty or the Terms and Conditions to which this Product Warranty is attached or relates.

Exhibit C (For U.S. Customers Only)

HIPAA Business Associates Agreement

(PRIVACY AND SECURITY OF HEALTH INFORMATION)

This BUSINESS ASSOCIATE AGREEMENT (“Agreement”) is entered into between Henry Schein, Inc. and/or its affiliated companies (including, for clarity and to the extent applicable, Ortho Organizers, Inc.), as applicable (each a “Business Associate”, as applicable) and the Customer (as defined in the T&Cs) (“Provider”) together with the Clear Aligner Products Terms and Conditions (“T&Cs”). The parties hereby acknowledge and agree that each Business Associate is acting severally under this Agreement and as such, any and all obligations and liabilities with respect to each Business Associate shall be several, not joint, and relate only to the Business Associate and specific products or services being provided or performed by such individual Business Associate. Both parties agree as follows:

1. DEFINITIONS

Capitalized terms used, but not otherwise defined, in this Agreement shall have the same meaning as those terms in the Standards for Privacy of Individually Identifiable Health Information, at 45 Code of Federal Regulations (“CFR”) part 160 and part 164 subpart E (the “Privacy Rule”), the Security Standards issued at 45 CFR part 160 and part 164 subpart C (the “Security Rule”), and the breach notification rules at 45 CFR Part 164, subpart D (“Breach Rules”)  as they may be amended from time to time.

The following capitalized terms shall have the following meaning when used in this Agreement:

1. 1. “Breach” shall have the same meaning as the term “Breach” in 45 CFR 164.402.
   2. “Designated Record Set” shall mean a group of records maintained for Provider that are the medical and/or billing records that refer to an individual Patient.
   3. “Electronic PHI” shall mean the PHI that is transmitted or maintained by Business Associate on behalf of Provider in electronic media, including, but not limited to, hard drives, disks, on the internet, or on an intranet.
   4. “HITECH Act” shall mean the “Health Information Technology for Economic and Clinical Health Act” set forth within P.L. 111-5, and all relevant regulations promulgated thereunder, as amended from time to time.
   5. “Patient” shall mean the individual whose PHI is contained in a specific medical or billing record that Business Associate maintains on behalf of Provider, or that person’s duly appointed guardian or qualified personal representative.
   6. “PHI” shall have the same meaning as the term “protected health information” in 45 CFR 160.103, limited to the information created or received by Business Associate from or on the behalf of Provider.
   7. “Secretary” shall mean the Secretary of the U.S. Department of Health and Human Services or his designee.
   8. “Unsecured PHI” shall have the same meaning as the term “Unsecured Protected Health Information” as defined in 45 CFR 164.402.

1. OBLIGATIONS AND ACTIVITIES OF BUSINESS ASSOCIATE
   1. Business Associate agrees to comply with those provisions of the Security Rule that are set forth at 45 C.F.R. §§ 164.308, 164.310, 164.312, and 164.316, as amended from time to time, with respect the security of PHI, in the same manner that such regulations apply to the Provider.
   2. Business Associate agrees to comply with the Privacy Rule at 45 C.F.R. § 164.504(e), as amended from time to time, with respect to its use and disclosure of PHI, in the same manner that such regulation applies to Provider. The additional requirements of the HITECH Act that relate to privacy and that are made applicable with respect to covered entities shall also be applicable to Business Associate and shall be and by this reference hereby are incorporated into the Business Associate Agreement.
   3. Business Associate agrees to not use or further disclose PHI other than as specifically permitted or required by this Agreement or as required by law.
   4. Business Associate agrees to use appropriate safeguards and comply, where applicable, with Subpart C of 45 CFR Part 164 with respect to Electronic PHI, to prevent use or disclosure of PHI other than as provided for by this Agreement.
   5. Business Associate agrees to mitigate, to the extent practicable, any harmful effect that is known to Business Associate of a use or disclosure of PHI by Business Associate in violation of the requirements of the Agreement.
   6. Business Associate agrees to report to Provider if it becomes aware of any use or disclosure of PHI not provided for by this Agreement, including any Breach of Unsecured PHI as required by 45 CFR 164.410, and any Security Incident of which it becomes aware.  Notwithstanding anything herein to the contrary, the parties acknowledge and agree that this Agreement shall constitute notice to Provider that Business Associate may periodically experience broadcast attacks on its firewall, port scans, unsuccessful log-on attempts, denials of service and similar unsuccessful security incidents, and Business Associate need not further report such incidents to Provider so long as such incidents do not result in unauthorized access, use or disclosure of PHI.
   7. Business Associate agrees to ensure that any Subcontractors that create, receive, maintain, or transmit PHI on behalf of Business Associate on behalf of Provider agree to the same restrictions and conditions that apply to Business Associate with respect to such information, including, without limitation, implementation of appropriate safeguards to protect the security of Electronic PHI.
   8. Upon the written request of Provider, Business Associate agrees to provide access to Provider to PHI that Business Associate maintains in a Designated Record Set (if in fact its arrangements with Provider require Business Associate to maintain Designated Record Sets on behalf of Provider), in order for Provider to meet the Patient access and copying requirements under 45 CFR 164.524.   If Business Associate maintains an electronic health record which contains the PHI, Business Associate shall provide such information produced in accordance with this section 2(h) in electronic format to enable Provider to fulfill its obligations under applicable regulations.
   9. Upon the written request of Provider, Business Associate agrees to make any amendment(s) to PHI that Business Associate maintains in a Designated Record Set (if in fact its arrangements with Provider require Business Associates to maintain Designated Record Sets on behalf of Provider), that the Provider directs or agrees to pursuant to 45 CFR 164.526.
   10. Business Associate agrees to make its internal practices, books and records relating to the use and disclosure of PHI available at the request of the Provider to the Secretary, for purposes of determining Provider’s compliance with the Privacy Rule, subject to attorney-client or other applicable legal privileges.
   11. Business Associate agrees to document such disclosures of PHI and information related to such disclosures as would be required for Provider to respond to a request by Patient for an accounting of disclosures of PHI in accordance with 45 CFR 164.528, as may be amended from time to time.
   12. Upon written request of Provider, Business Associate agrees to provide Provider with information collected in accordance with Section II.k of this Agreement to permit Provider to respond to a request by Patient for an accounting of disclosures of PHI in accordance with 45 CFR 164.528.
   13. Business Associate agrees that to the extent it is to carry out Provider’s obligation under the Privacy Rule that it will comply with the requirements of the Privacy Rule that apply to Provider in the performance of such obligation.
   14. Business Associate agrees to notify Provider without unreasonable delay, but in no event more than 60 days after Business Associate becomes aware of an unauthorized use or disclosure by or on behalf of Business Associate which constitutes a Breach of Unsecured PHI unless it receives a request to delay such notification from a law enforcement official pursuant to 45 CFR 164.412. Such notification shall include a list of impacted Patients, and describe the Breach in such reasonable detail to enable Provider to fulfill its obligations under applicable regulations.
   15. Upon written request of Provider, Business Associate will comply with a Patient request for restriction of certain disclosures to health plans in accordance with 45 CFR 164.522 and the HITECH Act, if the disclosure is to a health care plan for the purposes of carrying out payment or health care operations and the PHI pertains solely to a health care item or service for which Patient has paid for out of pocket in full. Except to the extent that Provider must agree to a Patient request for restriction under the HITECH Act, Business Associate shall not be required to comply with a Patient’s request to restrict the use or disclosure of PHI.

1. PERMITTED USES AND DISCLOSURES BY BUSINESS ASSOCIATE
   1. Business Associate may use or disclose PHI to perform functions, activities or services for, or on behalf of, Provider, in accordance with the contractual or other arrangements between Provider and Business Associate.
   2. Except as otherwise specifically permitted by Section IV of this Agreement, Business Associate shall limit its use and disclosure of PHI to only the minimum necessary PHI required by Business Associate to furnish services on behalf of Provider.

1. SPECIFIC USE AND DISCLOSURE PROVISIONS
   1. Business Associate may use PHI for the proper management and administration of the Business Associate or to carry out the legal responsibilities of the Business Associate.
   2. Business Associate may disclose PHI for the proper management and administration of the Business Associate, provided that disclosures are required by law, or Business Associate obtains reasonable assurances from the person to whom PHI is disclosed that it will remain confidential and be used or further disclosed only as required by law or for the purpose for which it was disclosed to the person, and the person notifies the Business Associate of any instances of which it is aware in which the confidentiality of PHI has been breached.
   3. Business Associate may use PHI to provide data aggregation services as permitted by 45 CFR 164.504(e)(2)(i)(B) (i.e. the combining PHI received from Provider with PHI received by Business Associate in its capacity as the business associate of another practice for the purpose of conducting data analyses that relate to health care operations of various practices).
   4. Business Associate may use PHI to create de-identified health information to the extent permitted by the Privacy Rule. There will be no restrictions on Business Associate’s use or disclosure of the de-identified health information once it is so de-identified.

1. OBLIGATIONS OF PROVIDER
   1. Provider represents and warrants to Business Associate that its Notice of Privacy Practices permits Provider to disclose PHI to Business Associate, and that the Notice of Privacy Practices used by Provider incorporates the terms and statements required by the Privacy Rule. Provider agrees that Provider shall not modify such notice or its privacy procedures in any manner that may affect Business Associate’s authority to use or disclose PHI pursuant to this Agreement without the consent of Business Associate, except as may be required by applicable law.
   2. If applicable, Provider shall notify Business Associate of any changes in, or revocation of, permission by a Patient to use or disclose PHI, to the extent that such changes may affect the permitted uses or disclosures of such PHI by Business Associate.
   3. Provider shall not request that Business Associate use or disclose PHI in any manner that would not be permissible under the Privacy Rule, Security Rule or other applicable law or its Notice of Privacy Practices if done by Provider except the uses specifically permitted under Section IV above, where Business Associate may use or disclose PHI for data aggregation or management and administrative activities of Business Associate.
   4. Provider represents and warrants to Business Associate that Provider shall comply with all requirements of the Privacy Rule, Security Rule, and any similar federal or state requirements relating to privacy concerns.

1. MUTUAL OBLIGATIONS

The parties agree that they will neither directly nor indirectly receive remuneration in exchange for any PHI of a Patient, unless a valid authorization, pursuant to 45 CFR 164.508, is executed by that Patient. Notwithstanding the foregoing, the parties agree that they may receive remuneration in exchange for PHI of a patient in accordance with 42 USC § 17935(d)(2) and 45 CFR 164.502(a)(5)(ii)(B)(2).

1. TERM AND TERMINATION
   1. The Term of this Agreement shall be effective as of the date set forth above, and shall remain effective so long as a relationship between the Provider and the Business Associate shall persist.  This Agreement shall terminate when all of the PHI provided by Provider to Business Associate or created or received by Business Associate on behalf of Provider is destroyed or returned to Provider or, if it is infeasible to return or destroy PHI, protections are extended to such information in accordance with the termination provisions in Section I.a.i(ii) below.
   2. Upon Provider’s knowledge of a material breach of this Agreement by Business Associate, Provider shall provide written notice to Business Associate identifying the breach, and permit the Business Associate 30 days to cure the breach; if Business Associate does not cure the breach or end the violation within the time specified, or if cure is not possible, Provider may immediately terminate this Agreement, and/or report the event to the Secretary.   
   3. Upon Business Associate’s knowledge of a material breach of this Agreement by the Provider, the Business Associate shall provide written notice to the Provider identifying the breach, and may permit the Provider the opportunity to cure the breach within 30 days; if Provider does not cure the breach or end the violation within the time specified, or if cure is not possible, Business Associate may immediately terminate this Agreement, and/or report the event to the Secretary.
   4. Effect of Termination.

1. 1. 1. 1. Except as provided in Section I.a.i(ii) below, upon termination of this Agreement, for any reason, Business Associate shall return or destroy all PHI received from Provider, or created or received by Business Associate on behalf of Provider.  This provision shall apply to PHI that is in the possession of subcontractors or agents of Business Associate.  Business Associate shall retain no copies of the PHI.
         2. In the event the Business Associate determines that the returning of or destroying of the PHI is infeasible, Business Associate shall provide to Provider notification of the conditions that make return or destruction infeasible, and thereafter, Business Associate shall extend the protections of this Agreement to such PHI and limit further uses and disclosures of such PHI to those purposes that make the return or destruction infeasible, for so long as Business Associate maintains such PHI.

1. VIII.NOTICE

Any and all notices, requests, or reports, required or permitted to be given under any provision of this Agreement shall be in writing and shall be deemed given upon the mailing thereof by first class certified mail, return receipt requested, postage prepaid, or by overnight mail. If such notice is to the Business Associate, then it shall be sent to the attention of the HIPAA Compliance Officer at: Henry Schein, Inc., 135 Duryea Road, Melville, New York 11747, with a copy to the General Counsel; fax: 631-843-5660.  If such notice is to the Provider, then it shall be sent to the address that the Business Associate then has on file for the Provider.

1. MISCELLANEOUS
   1. This Agreement is between Provider and Business Associate and shall not be construed, interpreted, or deemed to confer any rights whatsoever to any third party, including Patients.
   2. The parties agree that any ambiguity in this Agreement shall be resolved in favor of a meaning that complies and is consistent with Health Insurance Portability and Accountability Act, the Transaction Standards, Security Standards, the Privacy Rules, and the HITECH Act.
   3. This Agreement shall be governed by and construed in accordance with the laws of the state of Delaware, without regard to the conflicts of law principles of such state.
   4. Provider and Business Associate agree to negotiate in good faith if, in either party’s reasonable judgment, modification of this Agreement becomes necessary due to legislative or regulatory amendments to the Privacy Rule, the Security Rule, or the HITECH Act.
   5. In the event that it is impossible to comply with both this Agreement and any underlying services agreements between the parties, the provisions of this Agreement shall control with respect to those provisions of each agreement that expressly conflict.
   6. This agreement replaces and supersedes any previous agreement with respect to the subject matter hereof.

EXHIBIT D (For EU Customers only)

GDPR CONTROLLER-PROCESSOR AGREEMENT

This GDPR Controller-Processor Agreement (“CPA”) is incorporated into and adds the following data privacy clauses to the Terms and Conditions to which this CPA is attached or relates (“T&Cs”), between the Customer (as defined in the T&Cs) (“Controller”) and the HSI Entity (as defined in the T&Cs) which is providing the Products (as defined in the T&Cs) (“Processor”)  to the Customer; each a “Party” and both jointly the “Parties”.

1. Scope and roles
   1. 1.1.This CPA is applicable to the processing of personal data which falls under European Union Regulation (EU) 2016/679 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (“GDPR”) and that is subject to the Controller´s use of the Processor´s services under the T&Cs. Unless specified otherwise, capitalized terms in this CPA shall have the same meaning as in the GDPR.
   2. 1.2.In particular, the Personal Data that is subject to this CPA is: data necessary for manufacture and sale of Aligner Products and services to Customer’s patients.
   3. 1.3.The Personal Data is processed by Processor on behalf of Controller for the purpose(s) of:  manufacture and sale of Aligner Products to Customer’s patients.  This Personal Data shall be processed by Processor on behalf of Controller for the term of the T&Cs.
   4. 1.4.The Parties agree that Controller is responsible for compliance as a “controller” with respect to the services and Processor is responsible for compliance as a “processor” with all applicable data privacy laws (including without limitation the GDPR) and with the obligations established under this CPA.
   5. 1.5.Processor shall process Personal on behalf of Controller, as necessary to perform its obligations under the agreements between the Parties and strictly in accordance with documented instructions from Controller, including with regard to transfers of Personal Data to countries besides the intended recipient country and will not process such Personal Data in any other way or for any other purpose, except where otherwise required or permitted by any applicable European Union (“EU”) (or any EU member state) law.  Controller is aware that provision of the Products to Controller requires the transfer of Personal Data to sub-processors in third countries (as specified in section 6 below) and instructs Processor to carry out or permit such transfers accordingly.
   6. 1.6. Controller´s instructions to Processor are to provide the services such as enshrined in the applicable service descriptions and the T&Cs. If Controller issues additional instructions, Controller will reimburse the Processor for any resulting costs on a time and material basis. Processor will inform Controller about such additional costs before commencing work, and will only commence work if Controller has approved the additional costs.

1. Transfers of Personal Data outside the EU or European Economic Area (“EEA”). 
   1. 2.1.The following provisions shall apply to transfers of Personal Data to countries outside of the EU or EEA, except where the EU Commission has decided that the third country, a territory or one or more specified sectors within that third country ensures an adequate level of protection (Article 45 GDPR).
   2. 2.2.If the Processor is located outside of the countries or areas mentioned in section 2.1, the transfer of Personal Data shall be subject to Standard Contract Clauses for Controller-to-Processor transfers as determined in EU Commission Implementing Decision (EU) 2021/914 (“C2P SCCs“), which are attached to this Exhibit D.

1. Security of processing
   1. 3.1.Processor represents that Processor and each Sub-Processor and Sub-Sub-Processor has implemented and maintains appropriate technical and organizational measures to ensure a level of security appropriate to the risks for the rights and freedoms of persons, taking into account the nature, context, purposes and scope of processing, the costs of implementation and the information available to Processor.  In particular, Processor will protect the Personal Data from: (i) accidental or unlawful destruction; and (ii) loss, alteration, unauthorised disclosure of or access to the Personal Data.

Such measures shall include, as appropriate:

1. the pseudonymisation and encryption of Personal Data;
2. the ability to ensure the ongoing confidentiality, integrity, availability and resilience of processing systems and services;
3. the ability to restore the availability and access to Personal Data in a timely manner in the event of a physical or technical incident;
4. a process for regularly testing, assessing and evaluating the effectiveness of technical and organisational measures for ensuring the security of the processing;
5. keeping the Data separate from the data and information of its other customers; as well as
6. any other such security measures as notified in writing from time to time by the Controller.

1. 1. 6.2.Processor shall inform Controller without undue delay, and where feasible within 72 hours after having become aware, of any data breach concerning Personal Data (as defined by the GDPR) processed by Processor on behalf of Controller.
   2. 6.3.Processor undertakes a duty of confidentiality and professional secrecy and represents that Processor authorizes individuals to process the Personal Data on Processor’s behalf on a strict “need-to”-basis and that these authorized individuals have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality.

1. Accountability
   1. 4.1.Where necessary, Processor shall promptly inform Controller if the processing of Personal Data by Processor is likely to result in a high risk to the data protection rights and freedoms of data subjects.  Processor shall assist Controller with conducting Data Protection Impact Assessments (as defined by the GDPR) for the Processing of Personal Data by Processor on behalf of Controller.
   2. 4.2.Processor shall make available to Controller all information necessary to demonstrate compliance with the Regulation and shall allow for and contribute to audits conducted or mandated by Controller.

1. Rights of the individuals and cooperation.  Processor shall assist Controller by implementing appropriate technical and organizational measures, for the fulfilment of Controller’s obligations to respond to, as applicable, requests for transparency, access, rectification, correction, erasure, restriction, objection, and portability of Personal Data required by the Regulation and any other correspondence, enquiry or complaint received from a data subject, regulator or other third party in connection with the processing of Personal Data.  In the event that any such request, correspondence, enquiry or complaint is made directly to Processor, Processor shall promptly inform Controller providing full details of the same.

When receiving a right of erasure request, Processor will restrict processing of Personal Data within five (5) days relating to such request and communicate the same obligation to any Sub-Processor engaged with processing on behalf of Processor hereunder.

1. Sub-Processors
   1. 6.1.Controller authorizes Processor to use the following Sub-Processors for the processing of Personal Data to perform the following services pursuant to the T&Cs on behalf of Controller:
      1. Biotech Dental Smilers S.A.S., 305 allee de Craponme, 13300, Salon-de-Provence, France (a Henry Schein, Inc. affiliate) to manufacture the Aligner Products.
      2. Ortho Organizers, Inc., 1822 Aston Ave Carlsbad, CA, 92008-7306 USA, (a Henry Schein, Inc. subsidiary) to review the product and case;
      3. Henry Schein One, LLC, 1220 S 630 E Ste 100 American Fork, UT, 84003-3917 USA (a Henry Schein, Inc. affiliate), for provision and maintenance of the DDX software used to enable the manufacture the Aligner Products; and
      4. Software Nemotec, S.L., Avenida Juan Caramuel, 1 – Parque Cientifico Tecnologico – 28919 Leganes, Madrid, Spain, for the provision and maintenance of software use to enable the treatment planning and manufacture of the Aligner Products.

Processor represents that the same data privacy obligations as set out in this CPA have been imposed on each of its sub-processors (“Sub-Processors”) by contract, in particular with regard to providing sufficient guarantees to implement appropriate technical and organizational measures and that Processor shall remain fully liable for any data breach caused by an act, error or omission of its Sub-Processors.

1. 1. 6.2.Processor shall inform Controller of the identity and services provided by any Sub-Processors having access to Controller’s data falling under EU data protection laws before entering in a new subcontracting relationship, giving Controller the opportunity to object to such changes. This communication will be done either through an update of the information available to the Controller in the customer portal for the service, or in writing (e.g. email notification with acknowledge of receipt or other mechanism that ensures reception), and Controller should have ten (10) days to approve or reject the Sub-Processor. If the Controller remains silent, this is regarded as acceptance of the new Sub-Processor. If Controller does not approve the Sub-Processor, Processor is entitled to terminate the T&Cs (including this CPA) with immediate effect through written notice to Controller in its sole discretion.
   2. 6.3.If a Sub-Processor is engaged by Processor to perform services pursuant to the T&Cs, Processor represents that the same data privacy obligations as set out in this CPA shall be imposed on the Sub-Processor by contract, in particular with regard to providing sufficient guarantees to implement appropriate technical and organizational measures.

1. End of Services.  After the end of the provision of services in accordance with the T&Cs, Processor shall securely delete or return all Personal Data to Controller, at the choice of Controller, and securely delete all copies thereof unless the EU or an EU member state law requires ongoing storage of Personal Data. Notwithstanding the foregoing, Processor may temporarily keep a copy of certain Personal Data when necessary to comply with a legal obligation, as long as such Personal Data is properly isolated from other data and securely stored with restricted access to the extent required by applicable law. Once such obligation has expired, Processor will securely delete all Personal Data.

STANDARD CONTRACTUAL CLAUSES (MODULE 2 – CONTROLLER TO PROCESSOR)

SECTION I

Clause 1

Purpose and scope

Clause 2

Effect and invariability of the Clauses

Clause 3

Third-party beneficiaries

Clause 4

Interpretation

Clause 5

Hierarchy

In the event of a contradiction between these Clauses and the provisions of related agreements between the Parties, existing at the time these Clauses are agreed or entered into thereafter, these Clauses shall prevail.

Clause 6

Description of the transfer(s)

The details of the transfer(s), and in particular the categories of personal data that are transferred and the purpose(s) for which they are transferred, are specified in Annex I.B.

Clause 7

Docking clause

(a) An entity that is not a Party to these Clauses may, with the agreement of the Parties, accede to these Clauses at any time, either as a data exporter or as a data importer, by completing the Appendix and signing Annex I.A.

(b) Once it has completed the Appendix and signed Annex I.A, the acceding entity shall become a Party to these Clauses and have the rights and obligations of a data exporter or data importer in accordance with its designation in Annex I.A.

(c) The acceding entity shall have no rights or obligations arising under these Clauses from the period prior to becoming a Party.

SECTION II – OBLIGATIONS OF THE PARTIES

Clause 8

Data protection safeguards

The data exporter warrants that it has used reasonable efforts to determine that the data importer is able, through the implementation of appropriate technical and organisational measures, to satisfy its obligations under these Clauses.

1. Instructions

1. Purpose limitation

The data importer shall process the personal data only for the specific purpose(s) of the transfer, as set out in Annex I.B, unless on further instructions from the data exporter.

1. Transparency

On request, the data exporter shall make a copy of these Clauses, including the Appendix as completed by the Parties, available to the data subject free of charge. To the extent necessary to protect business secrets or other confidential information, including the measures described in Annex II and personal data, the data exporter may redact part of the text of the Appendix to these Clauses prior to sharing a copy, but shall provide a meaningful summary where the data subject would otherwise not be able to understand the content or exercise his/her rights. On request, the Parties shall provide the data subject with the reasons for the redactions, to the extent possible without revealing the redacted information. This Clause is without prejudice to the obligations of the data exporter under Articles 13 and 14 of Regulation (EU) 2016/679.

1. Accuracy

If the data importer becomes aware that the personal data it has received is inaccurate, or has become outdated, it shall inform the data exporter without undue delay. In this case, the data importer shall cooperate with the data exporter to erase or rectify the data.

1. Duration of processing and erasure or return of data

Processing by the data importer shall only take place for the duration specified in Annex I.B. After the end of the provision of the processing services, the data importer shall, at the choice of the data exporter, delete all personal data processed on behalf of the data exporter and certify to the data exporter that it has done so, or return to the data exporter all personal data processed on its behalf and delete existing copies. Until the data is deleted or returned, the data importer shall continue to ensure compliance with these Clauses. In case of local laws applicable to the data importer that prohibit return or deletion of the personal data, the data importer warrants that it will continue to ensure compliance with these Clauses and will only process it to the extent and for as long as required under that local law. This is without prejudice to Clause 14, in particular the requirement for the data importer under Clause 14(e) to notify the data exporter throughout the duration of the contract if it has reason to believe that it is or has become subject to laws or practices not in line with the requirements under Clause 14(a).

1. Security of processing

1. Sensitive data

Where the transfer involves personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, genetic data, or biometric data for the purpose of uniquely identifying a natural person, data concerning health or a person’s sex life or sexual orientation, or data relating to criminal convictions and offences (hereinafter ‘sensitive data’), the data importer shall apply the specific restrictions and/or additional safeguards described in Annex I.B.

1. Onward transfers

The data importer shall only disclose the personal data to a third party on documented instructions from the data exporter. In addition, the data may only be disclosed to a third party located outside the European Union (in the same country as the data importer or in another third country, hereinafter ‘onward transfer’) if the third party is or agrees to be bound by these Clauses or if:

Any onward transfer is subject to compliance by the data importer with all the other safeguards under these Clauses, in particular purpose limitation.

1. Documentation and compliance

Clause 9

Use of sub-processors

Clause 10

Data subject rights

Clause 11

Redress

Clause 12

Liability

Clause 13

Supervision

SECTION III – LOCAL LAWS AND OBLIGATIONS IN CASE OF ACCESS BY PUBLIC AUTHORITIES

Clause 14

Local laws and practices affecting compliance with the Clauses

Clause 15

Obligations of the data importer in case of access by public authorities

1. Notification

1. Review of legality and data minimisation

SECTION IV – FINAL PROVISIONS

Clause 16

Non-compliance with the Clauses and termination

Clause 17

Governing law

These Clauses shall be governed by the law of one of the EU Member States, provided such law allows for third-party beneficiary rights. The Parties agree that this shall be the law of Germany.

Clause 18

Choice of forum and jurisdiction

APPENDIX

ANNEX I

A.   LIST OF PARTIES

Data exporter(s): [Identity and contact details of the data exporter(s) and, where applicable, of its/their data protection officer and/or representative in the European Union]

Name: Controller (in case of a third-country transfer)

Address: [As specified in the purchase order]

Contact person’s name, position and contact details: [As specified in the purchase order]

Data Protection officer’s (if any) name, position, and contact details: N/A

EU representative’s (if any) name, position, and contact details: N/A

Activities relevant to the data transferred under these Clauses: Activities that are necessary for manufacture and sale of Aligner Products to Customer’s patients, as further specified in the Terms & Conditions

Signatures and dates:

[As per the purchase order]

B.   DESCRIPTION OF TRANSFER

Categories of data subjects whose personal data is transferred

Patients of Controller

Categories of personal data transferred

Data necessary for manufacture and sale of Aligner Products and services to Customer’s patients

Sensitive data transferred (if applicable) and applied restrictions or safeguards that fully take into consideration the nature of the data and the risks involved, such as for instance strict purpose limitation, access restrictions (including access only for staff having followed specialised training), keeping a record of access to the data, restrictions for onward transfers or additional security measures.

Health data. For applicable restrictions, see section 3 of the CPA.

The frequency of the transfer (e.g. whether the data is transferred on a one-off or continuous basis).

Continuous

Nature of the processing

C2P Relationship for the purpose of manufacturing Aligner Products

Purpose(s) of the data transfer and further processing

Manufacturing of Aligner Products

The period for which the personal data will be retained, or, if that is not possible, the criteria used to determine that period

As long as required for the purpose of manufacturing Aligner Products and/or as required by law.

For transfers to (sub-) processors, also specify subject matter, nature and duration of the processing

As specified in section 6 of the CPA.

C.   COMPETENT SUPERVISORY AUTHORITY

Name: Controller (in case of a third-country transfer)

Data exporter is established in an EEA country.

The competent supervisory authority is the data protection authority competent for the territory in which the main establishment of Controller is located.

ANNEX II

TECHNICAL AND ORGANISATIONAL MEASURES INCLUDING TECHNICAL AND ORGANISATIONAL MEASURES TO ENSURE THE SECURITY OF THE DATA

As specified in section 3 of the CPA

ANNEX III

LIST OF SUB-PROCESSORS

The controller has authorised the use of the following sub-processors:

As specified in section 6 of the CPA.

ANNEX IV

Amendments for UK and Switzerland

International Data Transfer Addendum to the EU Commission Standard Contractual Clauses

for transfers from the UK to Third Countries

VERSION B1.0, in force 21 March 2022

Part 1: Tables

Table 1: Parties

Table 2: Selected SCCs, Modules and Selected Clauses

Table 3: Appendix Information

“Appendix Information” means the information which must be provided for the selected modules as set out in the Appendix of the Approved EU SCCs (other than the Parties), and which for this Addendum is set out in:

Table 4: Ending this Addendum when the Approved Addendum Changes

Part 2: Mandatory Clauses

Entering into this Addendum

1. Each Party agrees to be bound by the terms and conditions set out in this Addendum, in exchange for the other Party also agreeing to be bound by this Addendum.
2. Although Annex 1A and Clause 7 of the Approved EU SCCs require signature by the Parties, for the purpose of making Restricted Transfers, the Parties may enter into this Addendum in any way that makes them legally binding on the Parties and allows data subjects to enforce their rights as set out in this Addendum. Entering into this Addendum will have the same effect as signing the Approved EU SCCs and any part of the Approved EU SCCs.

Interpretation of this Addendum

1. Where this Addendum uses terms that are defined in the Approved EU SCCs those terms shall have the same meaning as in the Approved EU SCCs. In addition, the following terms have the following meanings:

1. This Addendum must always be interpreted in a manner that is consistent with UK Data Protection Laws and so that it fulfils the Parties’ obligation to provide the Appropriate Safeguards.
2. If the provisions included in the Addendum EU SCCs amend the Approved SCCs in any way which is not permitted under the Approved EU SCCs or the Approved Addendum, such amendment(s) will not be incorporated in this Addendum and the equivalent provision of the Approved EU SCCs will take their place.
3. If there is any inconsistency or conflict between UK Data Protection Laws and this Addendum, UK Data Protection Laws applies.
4. If the meaning of this Addendum is unclear or there is more than one meaning, the meaning which most closely aligns with UK Data Protection Laws applies.
5. Any references to legislation (or specific provisions of legislation) means that legislation (or specific provision) as it may change over time. This includes where that legislation (or specific provision) has been consolidated, re-enacted and/or replaced after this Addendum has been entered into.

Hierarchy

1. Although Clause 5 of the Approved EU SCCs sets out that the Approved EU SCCs prevail over all related agreements between the parties, the parties agree that, for Restricted Transfers, the hierarchy in Section 10 will prevail.
2. Where there is any inconsistency or conflict between the Approved Addendum and the Addendum EU SCCs (as applicable), the Approved Addendum overrides the Addendum EU SCCs, except where (and in so far as) the inconsistent or conflicting terms of the Addendum EU SCCs provides greater protection for data subjects, in which case those terms will override the Approved Addendum.
3. Where this Addendum incorporates Addendum EU SCCs which have been entered into to protect transfers subject to the General Data Protection Regulation (EU) 2016/679 then the Parties acknowledge that nothing in this Addendum impacts those Addendum EU SCCs.

Incorporation of and changes to the EU SCCs

1. This Addendum incorporates the Addendum EU SCCs which are amended to the extent necessary so that:

1. together they operate for data transfers made by the data exporter to the data importer, to the extent that UK Data Protection Laws apply to the data exporter’s processing when making that data transfer, and they provide Appropriate Safeguards for those data transfers;
2. Sections 9 to 11 override Clause 5 (Hierarchy) of the Addendum EU SCCs; and
3. this Addendum (including the Addendum EU SCCs incorporated into it) is (1) governed by the laws of England and Wales and (2) any dispute arising from it is resolved by the courts of England and Wales, in each case unless the laws and/or courts of Scotland or Northern Ireland have been expressly selected by the Parties.

1. Unless the Parties have agreed alternative amendments which meet the requirements of Section 12, the provisions of Section 15 will apply.
2. No amendments to the Approved EU SCCs other than to meet the requirements of Section 12 may be made.
3. The following amendments to the Addendum EU SCCs (for the purpose of Section 12) are made:

1. References to the “Clauses” means this Addendum, incorporating the Addendum EU SCCs;

1. In Clause 2, delete the words:

“and, with respect to data transfers from controllers to processors and/or processors to processors, standard contractual clauses pursuant to Article 28(7) of Regulation (EU) 2016/679”;

1. Clause 6 (Description of the transfer(s)) is replaced with:

“The details of the transfers(s) and in particular the categories of personal data that are transferred and the purpose(s) for which they are transferred) are those specified in Annex I.B where UK Data Protection Laws apply to the data exporter’s processing when making that transfer.”;

1. Clause 8.7(i) of Module 1 is replaced with:

“it is to a country benefitting from adequacy regulations pursuant to Section 17A of the UK GDPR that covers the onward transfer”;

1. Clause 8.8(i) of Modules 2 and 3 is replaced with:

“the onward transfer is to a country benefitting from adequacy regulations pursuant to Section 17A of the UK GDPR that covers the onward transfer;”

1. References to “Regulation (EU) 2016/679”, “Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (General Data Protection Regulation)” and “that Regulation” are all replaced by “UK Data Protection Laws”. References to specific Article(s) of “Regulation (EU) 2016/679” are replaced with the equivalent Article or Section of UK Data Protection Laws;
2. References to Regulation (EU) 2018/1725 are removed;
3. References to the “European Union”, “Union”, “EU”, “EU Member State”, “Member State” and “EU or Member State” are all replaced with the “UK”;
4. The reference to “Clause 12(c)(i)” at Clause 10(b)(i) of Module one, is replaced with “Clause 11(c)(i)”;
5. Clause 13(a) and Part C of Annex I are not used;
6. The “competent supervisory authority” and “supervisory authority” are both replaced with the “Information Commissioner”;
7. In Clause 16(e), subsection (i) is replaced with:

“the Secretary of State makes regulations pursuant to Section 17A of the Data Protection Act 2018 that cover the transfer of personal data to which these clauses apply;”;

1. Clause 17 is replaced with:

“These Clauses are governed by the laws of England and Wales.”;

1. Clause 18 is replaced with:

“Any dispute arising from these Clauses shall be resolved by the courts of England and Wales. A data subject may also bring legal proceedings against the data exporter and/or data importer before the courts of any country in the UK. The Parties agree to submit themselves to the jurisdiction of such courts.”; and

1. The footnotes to the Approved EU SCCs do not form part of the Addendum, except for footnotes 8, 9, 10 and 11.

Amendments to this Addendum

1. The Parties may agree to change Clauses 17 and/or 18 of the Addendum EU SCCs to refer to the laws and/or courts of Scotland or Northern Ireland.

1. If the Parties wish to change the format of the information included in Part 1: Tables of the Approved Addendum, they may do so by agreeing to the change in writing, provided that the change does not reduce the Appropriate Safeguards.

1. From time to time, the ICO may issue a revised Approved Addendum which:

1. makes reasonable and proportionate changes to the Approved Addendum, including correcting errors in the Approved Addendum; and/or
2. reflects changes to UK Data Protection Laws;

The revised Approved Addendum will specify the start date from which the changes to the Approved Addendum are effective and whether the Parties need to review this Addendum including the Appendix Information. This Addendum is automatically amended as set out in the revised Approved Addendum from the start date specified.

1. If the ICO issues a revised Approved Addendum under Section 18, if any Party selected in Table 4 “Ending the Addendum when the Approved Addendum changes”, will as a direct result of the changes in the Approved Addendum have a substantial, disproportionate and demonstrable increase in:

1. its direct costs of performing its obligations under the Addendum; and/or
2. its risk under the Addendum,

and in either case it has first taken reasonable steps to reduce those costs or risks so that it is not substantial and disproportionate, then that Party may end this Addendum at the end of a reasonable notice period, by providing written notice for that period to the other Party before the start date of the revised Approved Addendum.

1. The Parties do not need the consent of any third party to make changes to this Addendum, but any changes must be made in accordance with its terms.

International Data Transfers Addendum for Data Transfers from Switzerland to Countries without Adequacy Status

For data that originates in Switzerland, or for which the Controller is a company located in Switzerland, the following additional rules shall apply:

1. Sensitive data shall also include data that otherwise concerns the intimate sphere of the data subjects and data on social security measures.
2. In relation to Personal Data exported by the Exporter, references to a “member state” or to the “EU” in the SCCs shall be deemed to include Switzerland.
3. Where the SCC designate a supervisory authority of an EU Member State as competent authority, the Swiss supervisory authority EDÖB shall also be competent.
4. Where an international transfer of Personal Data is subject to any law that protects legal entities as data subjects, the Parties agree that the SCC will apply to data relating to legal entities as well.

Exhibit E

COUNTRY/TERRITORY SPECIFIC CLAUSES AND LAWS

THE FOLLOWING COUNTRY/TERRITORY SPECIFIC LAWS AND CLAUSES ONLY APPLY TO CUSTOMERS LOCATED IN THE APPLICABLE COUNTRY/TERRITORY DESIGNATED BELOW:

A. ITALY:

For Italy, Sections 16 and 17 of the Terms and Conditions shall read as follows:

1. PRODUCT WARRANTY. 

1. 1. HSI offers the Product warranty to its Customers as shown on Exhibit B attached hereto.  HSI offers no other warranty with respect to the Products or any portion thereof.
   2. DISCLAIMER OF ALL OTHER WARRANTIES.  EXCEPT AS PROVIDED IN EXHIBIT B HERETO, TO THE EXTENT PERMITTED BY LAW, HSI (INCLUDING EACH HSI ENTITY) PROVIDES NO WARRANTIES OF ANY KIND, EXPRESS OR IMPLIED, REGARDING THE PRODUCTS OR SERVICES OR ANY PORTION THEREOF, INCLUDING WITHOUT LIMITATION ANY WARRANTY OF MERCHANTABILITY, FITNESS FOR PARTICULAR PURPOSE OR NON-INFRINGEMENT.
   3. This Section shall survive any expiration or termination of this Agreement.

1. OTHER MATTERS.

1. 1. LIMITATION OF LIABILITY.  TO THE EXTENT PERMITTED BY LAW, NEITHER PARTY SHALL BE LIABLE TO THE OTHER (OR, IN THE CASE OF HSI AND EACH HSI ENTITY, TO CUSTOMER’S PATIENTS) FOR INDIRECT, INCIDENTAL, PUNITIVE, SPECIAL OR CONSEQUENTIAL DAMAGES INCLUDING, BUT NOT LIMITED TO, LOST PROFITS AND LOSS OF GOODWILL, ARISING FROM OR RELATING TO ANY BREACH OF THIS AGREEMENT, AND WHETHER OR NOT OCCASIONED BY THE NEGLIGENCE OF A PARTY OR ITS AFFILIATES), REGARDLESS OF ANY NOTICE OF THE POSSIBILITY OF SUCH DAMAGES; PROVIDED THAT NOTHING IN THIS SECTION IS INTENDED TO, OR DOES, LIMIT THE CONFIDENTIALITY RIGHTS OR OBLIGATIONS OF EITHER PARTY SET FORTH HEREIN. IN NO EVENT WILL HSI’S (INCLUDING ALL OF THE HSI ENTITIES) AGGREGATE LIABILITY UNDER THIS AGREEMENT EXCEED THE AMOUNT OF FEES PAID BY CUSTOMER TO HSI UNDER THIS AGREEMENT IN THE PRECEDING 12 MONTHS.
   2. Indemnity.  Customer agrees to indemnify, keep indemnified, defend and hold harmless HSI, including each HSI Entity against and from any and all claims, causes of actions, damages, debts, liabilities, losses, obligations, payments, costs and expenses (including reasonable legal expenses), arising from or relating to: (i) Customer’s breach of any term of this Agreement or of any  agreement between Customer and their patient; (ii) any actions or omissions of Customer and including  any act or failure to act in respect of a patient; (iii) Customer’s provision of incorrect or incomplete information, records, documents or impressions to HSI or any failure to timely provide HSI with any such  information, records, documents or impressions; and (iv) any dealings with any applicable regulators, licensing or professional bodies in relation to Customer. This Section shall survive any expiration or termination of this Agreement.
   3. Waiver. The Customer expressly waives to the right of recourse against HSI, pursuant to art. 131 Consumer Code (D. Lgs. n. 206/2005), with respect to sale to a consumer (i.e. to a natural person who buys for purposes not related to his business or profession or who makes the purchase without indicating a VAT number in the order form) of defective Products (whether due to production defects or otherwise) or which otherwise do not comply with this Agreement or in any other case, whether or not attributable directly to HSI.
   4. Survival. This Section shall survive any expiration or termination of this Agreement.

Agreed for the purposes of Art 1341 Italian Civil Code …………………………………..

Signature Customer or other means of acceptance designated by HSI