Clinic Services Agreement

1. Parties & Acceptance

This Clinic Services Agreement (the "Agreement") is a binding contract between:

• 2855926 Ontario Inc., a corporation incorporated under the laws of the Province of Ontario, carrying on business as "CREALYZ" and operating the service as "DentRecall", of Brampton, Ontario, L6X 3L3, Canada ("DentRecall", "we", "us", "our"); and
• the dental clinic, practice, or organization that registers for or uses the Services ("Clinic", "you", "your").

By checking "I have read and agree to the Clinic Services Agreement" (or similar) during registration, or by accessing or using the Services, the individual accepting represents that they are authorized to bind the Clinic to this Agreement. If you do not agree, do not register for or use the Services.

2. Definitions

• "Services" — the DentRecall software-as-a-service platform for dental patient recall, reminders, two-way SMS, online booking, reviews, and related features made available at dentrecall.com and associated subdomains.
• "Patient Data" — personal information about the Clinic's patients that the Clinic uploads to, or that is generated within, the Services (e.g. name, phone number, email, appointment and treatment information).
• "Clinic Data" — all data the Clinic submits to or generates within the Services, including Patient Data.
• "Sub-Processor" — a third party engaged by DentRecall to process Clinic Data on its behalf, listed in Schedule A.
• "PIPEDA" — the Personal Information Protection and Electronic Documents Act (Canada) and any applicable substantially similar provincial privacy legislation.
• "CASL" — Canada's Anti-Spam Legislation (S.C. 2010, c. 23) and its regulations.
• "Plan" — the subscription tier and associated fees selected by the Clinic, as described in Schedule B.

3. The Services & License

3.1 License. Subject to this Agreement and payment of applicable fees, DentRecall grants the Clinic a non-exclusive, non-transferable, non-sublicensable, revocable right to access and use the Services during the Term for the Clinic's internal business purposes.

3.2 Account security. The Clinic is responsible for safeguarding its account credentials and for all activity occurring under its account. The Clinic must notify us promptly at [email protected] of any unauthorized access or use.

3.3 Acceptable use. The Clinic will not: (a) use the Services to send communications without the recipient's consent as required by law; (b) upload unlawful, infringing, harmful, or malicious content; (c) copy, modify, reverse engineer, decompile, resell, sublicense, or make the Services available to any third party other than its own patients; (d) exceed or attempt to circumvent Plan limits or technical restrictions; or (e) use the Services to violate any applicable law.

3.4 Changes to the Services. We may modify, enhance, or discontinue features from time to time. We will not materially degrade the core functionality of a paid Plan during a paid term without reasonable prior notice.

4. Subscription Term & Renewal

4.1 Paid subscription. The Services are offered on a paid subscription basis only. The Clinic's right to use the Services begins on activation of a paid Plan.

4.2 Billing cycle. Plans are billed monthly or annually in advance, as selected by the Clinic at sign-up.

4.3 Automatic renewal. Each subscription automatically renews for successive periods equal to the then-current billing cycle, unless the Clinic cancels before the end of the current period in accordance with Section 11. The Clinic authorizes recurring charges for each renewal until cancellation.

4.4 Cancellation. The Clinic may cancel at any time through its account or by written notice. Cancellation takes effect at the end of the then-current billing period, subject to the refund provisions in Section 5.7.

5. Fees & Payment

5.1 Fees. The Clinic will pay the fees for its selected Plan as set out in Schedule B or as presented at sign-up. Current published pricing: Starter — $279 CAD/month or $249 CAD/month billed annually; Pro — $379 CAD/month or $349 CAD/month billed annually; Enterprise — custom.

5.2 Payment processor. Recurring fees are charged in advance through our third-party payment processor, Stripe. The Clinic authorizes us and Stripe to charge its designated payment method for all fees and applicable taxes.

5.3 Usage / overage. SMS and email usage above Plan limits may incur overage charges at the rates disclosed in-product (currently $0.02 CAD per message) where the Clinic has enabled overage. Overage charges are billed in arrears.

5.4 Taxes. Fees are exclusive of applicable taxes, including GST/HST, which the Clinic is responsible for paying.

5.5 Late or failed payment. If a charge fails or fees become overdue, we may, after reasonable notice, suspend the Services until amounts are paid. Subscriptions overdue by more than fourteen (14) days may be terminated.

5.6 Price changes. We may change fees on no less than thirty (30) days' prior notice, effective at the start of the next renewal period. Continued use after the effective date constitutes acceptance of the changed fees.

5.7 Refunds.

(a) Monthly plans. Monthly subscriptions are non-refundable. The Clinic may cancel at any time; the subscription will not renew and the Clinic retains access until the end of the then-current monthly billing period (anchored to the Clinic's original sign-up date).

(b) Annual plans. Annual subscriptions are paid in full in advance on the contract start date (the date payment is made). (i) If the Clinic cancels within seven (7) days of the contract start date, the Clinic is charged for one (1) month at DentRecall's standard monthly rate for the applicable Plan, DentRecall refunds the remainder of the annual fee paid, and the Clinic retains access for that one-month period. (ii) If the Clinic cancels after the seven (7) day period, the annual fee is non-refundable; the subscription will not renew, and the Clinic retains access until the end of the paid twelve (12) month term.

(c) No refund is owed for overage charges already incurred or for termination by DentRecall for the Clinic's material breach. Refunds, where applicable, are issued to the original payment method.

6. Clinic Obligations — Consent & Compliance (CASL / PIPEDA)

6.1 Consent to process. The Clinic represents and warrants that it has obtained and maintains all consents, authorizations, and legal bases required under PIPEDA and other applicable privacy law to collect Patient Data and to disclose it to DentRecall for processing through the Services.

6.2 Consent to communicate (CASL). The Clinic is the sender of record for all messages sent through the Services. The Clinic represents and warrants that, for each recipient, it has obtained the express or implied consent required under CASL, and that each message complies with CASL's content and unsubscribe requirements. DentRecall provides STOP/opt-out handling as a feature but does not assume the Clinic's obligations as sender.

6.3 Accuracy & maintenance. The Clinic is responsible for the accuracy of Patient Data it uploads, for promptly updating it, and for promptly removing or suppressing any patient who withdraws consent.

6.4 Roles of the parties. As between the parties, the Clinic is the organization with primary responsibility for Patient Data under PIPEDA (the "controller"), and DentRecall acts as a service provider / processor that processes Patient Data solely on the Clinic's behalf and on its instructions as expressed through use of the Services.

6.5 Material breach. The Clinic acknowledges that a breach of this Section 6 is a material breach and triggers the indemnity in Section 14.1.

7. Data Protection & Privacy

7.1 Permitted use. We process Clinic Data only to provide, maintain, secure, and support the Services, as instructed by the Clinic through its use of the Services, and as permitted by this Agreement and applicable law. We do not sell Clinic Data and we do not use Patient Data for advertising.

7.2 Sub-Processors. The Clinic authorizes DentRecall to engage the Sub-Processors listed in Schedule A to process Clinic Data. We have entered into data protection terms (a DPA or equivalent) with each Sub-Processor requiring data protections consistent with this Agreement. We will give the Clinic notice of any new Sub-Processor by updating Schedule A and/or by in-product or email notice before the new Sub-Processor begins processing Clinic Data.

7.3 Cross-border processing. The Clinic acknowledges and agrees that, while Patient Data is stored in Canada, certain Clinic Data (including message content and content processed for AI features) may be processed outside Canada — including in the United States — by DentRecall's Sub-Processors, and may therefore be subject to the laws of, and lawful access by authorities in, those jurisdictions. The Clinic is responsible for disclosing this cross-border processing to its patients as required by PIPEDA. The processing locations are identified in Schedule A.

7.4 AI processing. Certain optional features use third-party AI services to generate message content. AI Sub-Processors operate on non-Chinese infrastructure (United States / EU). Only the Patient Data necessary to generate the relevant content is transmitted to those services, and it is not used to train third-party public models.

7.5 Security. We maintain commercially reasonable administrative, technical, and physical safeguards designed to protect Clinic Data against unauthorized access, use, or disclosure, including encryption in transit, access controls, and per-clinic tenant isolation. No system is fully secure, and we do not guarantee absolute security.

7.6 Breach notification. We will notify the Clinic without undue delay after confirming a security breach involving the Clinic's Patient Data, and will provide information reasonably necessary to help the Clinic meet its own breach-reporting and record-keeping obligations under PIPEDA.

7.7 Assistance with patient requests. We will provide reasonable assistance to enable the Clinic to respond to patient requests to access, correct, or delete personal information held within the Services.

7.8 Return / deletion on termination. Section 11 governs export and deletion of Clinic Data after termination.

8. Confidentiality

8.1 Each party may receive the other's confidential information. The receiving party will use it only to perform under this Agreement and will protect it using at least reasonable care.

8.2 These obligations do not apply to information that is or becomes public through no fault of the receiving party, is independently developed, or is rightfully obtained from a third party, and do not prevent disclosure required by law (with notice to the other party where lawful).

9. Intellectual Property

9.1 DentRecall IP. DentRecall owns and retains all right, title, and interest in the Services, underlying software, and documentation. No rights are granted except the limited license in Section 3.

9.2 Clinic Data. The Clinic owns and retains all right, title, and interest in Clinic Data. The Clinic grants DentRecall a worldwide, non-exclusive license to host, copy, process, transmit, and display Clinic Data solely as necessary to provide the Services.

9.3 Aggregated / de-identified data. We may generate and use aggregated and de-identified data — which does not identify the Clinic or any individual patient — to operate, analyze, and improve the Services.

9.4 Feedback. If the Clinic provides suggestions or feedback, we may use it without restriction or obligation.

10. Warranties; Disclaimer

10.1 Each party represents and warrants that it has the authority to enter into and perform this Agreement.

10.2 DISCLAIMER. EXCEPT AS EXPRESSLY STATED IN THIS AGREEMENT, THE SERVICES ARE PROVIDED "AS IS" AND "AS AVAILABLE" WITHOUT WARRANTIES OF ANY KIND, WHETHER EXPRESS, IMPLIED, STATUTORY, OR OTHERWISE, INCLUDING IMPLIED WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, AND NON-INFRINGEMENT. WE DO NOT WARRANT THAT THE SERVICES WILL BE UNINTERRUPTED OR ERROR-FREE, OR THAT MESSAGES WILL BE SUCCESSFULLY DELIVERED BY THIRD-PARTY TELECOMMUNICATIONS CARRIERS.

11. Term, Termination & Data Handling

11.1 Term. This Agreement begins on acceptance and continues for as long as the Clinic maintains an active subscription or uses the Services (the "Term").

11.2 Termination by the Clinic. The Clinic may cancel as described in Section 4.4. Refunds are governed by Section 5.7.

11.3 Termination for cause. Either party may terminate this Agreement immediately on written notice if the other party materially breaches it and fails to cure the breach within fifteen (15) days of written notice.

11.4 Effect of termination. On termination, the Clinic's right to access the Services ends and any outstanding, non-refundable fees become immediately due.

11.5 Data export & deletion. For thirty (30) days after termination, the Clinic may request an export of its Clinic Data in a commonly used format. After that period, we may delete Clinic Data from active systems, subject to residual Sub-Processor retention, backup cycles, and any retention required by law.

12. Suspension

We may suspend the Services, in whole or in part, immediately if: (a) the Clinic's use poses a security, legal, or reputational risk to DentRecall, its Sub-Processors, or others; (b) a Sub-Processor or telecommunications carrier requires it (for example, SMS carrier or A2P compliance); or (c) fees are overdue under Section 5.5. We will use reasonable efforts to notify the Clinic and to limit the suspension's scope and duration.

13. Limitation of Liability

13.1 Exclusion of indirect damages. TO THE MAXIMUM EXTENT PERMITTED BY LAW, NEITHER PARTY WILL BE LIABLE FOR ANY INDIRECT, INCIDENTAL, SPECIAL, CONSEQUENTIAL, OR PUNITIVE DAMAGES, OR FOR LOST PROFITS, REVENUE, GOODWILL, OR DATA, ARISING OUT OF OR RELATED TO THIS AGREEMENT, EVEN IF ADVISED OF THE POSSIBILITY.

13.2 Liability cap. EXCEPT FOR THE EXCLUDED CLAIMS IN SECTION 13.3, EACH PARTY'S TOTAL AGGREGATE LIABILITY ARISING OUT OF OR RELATED TO THIS AGREEMENT WILL NOT EXCEED THE TOTAL FEES PAID OR PAYABLE BY THE CLINIC TO DENTRECALL IN THE SIX (6) MONTHS IMMEDIATELY PRECEDING THE EVENT GIVING RISE TO THE CLAIM.

13.3 Exclusions from the cap. The exclusion in 13.1 and the cap in 13.2 do not apply to: (a) the Clinic's obligation to pay fees; (b) the Clinic's breach of Section 6 (Consent & Compliance); (c) either party's breach of confidentiality under Section 8; or (d) a party's indemnification obligations under Section 14.

14. Indemnification

14.1 By the Clinic. The Clinic will defend, indemnify, and hold harmless DentRecall from and against any third-party claims, damages, fines (including regulatory penalties under CASL or PIPEDA), liabilities, and reasonable costs arising out of: (a) the Clinic's breach of Section 6, including messages sent without the consent required by law; (b) Clinic Data; or (c) the Clinic's unlawful or unauthorized use of the Services.

14.2 By DentRecall. DentRecall will defend, indemnify, and hold harmless the Clinic from and against third-party claims that the Services, as provided by DentRecall and used in accordance with this Agreement, infringe that third party's intellectual property rights — excluding claims arising from Clinic Data, Clinic modifications, or use of the Services in violation of this Agreement.

14.3 Procedure. The indemnified party will promptly notify the indemnifying party of the claim, allow it to control the defense (with counsel of its choice), and provide reasonable cooperation. No settlement imposing liability or admission on the indemnified party may be made without its consent (not to be unreasonably withheld).

15. Changes to this Agreement

We may update this Agreement from time to time. For material changes, we will provide notice by email or in-product and update the version. Continued use of the Services after the stated effective date constitutes acceptance. Where required by law, we will request renewed acceptance.

16. Dispute Resolution & Governing Law

16.1 Good-faith resolution first. Before commencing any formal proceeding, the parties will attempt in good faith to resolve any dispute by negotiation, beginning within thirty (30) days of written notice of the dispute. This step does not apply to a party seeking urgent injunctive relief.

16.2 Governing law. This Agreement is governed by and construed under the laws of the Province of Ontario and the federal laws of Canada applicable therein, without regard to conflict-of-laws principles.

16.3 Jurisdiction. Subject to Section 16.1, the parties irrevocably submit to the exclusive jurisdiction of the courts of the Province of Ontario for any dispute arising out of or relating to this Agreement.

17. General

17.1 Assignment. The Clinic may not assign this Agreement without our prior written consent. We may assign it in connection with a merger, acquisition, reorganization, or sale of substantially all assets.

17.2 Force majeure. Neither party is liable for failure or delay caused by events beyond its reasonable control (including carrier failures, internet or hosting outages, or governmental action).

17.3 Notices. Notices to DentRecall must be sent to [email protected]. Notices to the Clinic may be sent to the email address on the Clinic's account. Notice is effective on confirmed delivery.

17.4 Entire agreement. This Agreement, including its Schedules, is the entire agreement between the parties and supersedes all prior or contemporaneous understandings on its subject matter.

17.5 Severability. If any provision is held unenforceable, it will be modified to the minimum extent necessary, and the remaining provisions remain in full force.

17.6 Waiver. A party's failure to enforce a provision is not a waiver of its right to do so later.

17.7 Independent contractors. The parties are independent contractors; nothing creates a partnership, agency, or joint venture.

17.8 Survival. Sections 5, 6, 7, 8, 9, 10, 11.4, 11.5, 13, 14, 16, and 17 survive termination.

Schedule A — Sub-Processors

DentRecall engages the following Sub-Processors to process Clinic Data. Each is bound by a DPA or equivalent data protection terms consistent with this Agreement.

Schedule B — Plans & Fees