DentalReady B2B SaaS Agreement

This DentalReady B2B SaaS Agreement is between Dental Ready Technologies Pty Ltd (ACN 697 960 704) (DentalReady, we, us or our) and the business or other organisation identified as the customer in an Order Form or DentalReady account record (Customer or you). It starts when the Customer accepts it electronically, signs an Order Form that incorporates it, or first uses the Services after being given a reasonable opportunity to review it.

The agreement consists of the applicable Order Form, these terms and Schedule 1 (Data Protection Schedule). If they conflict, Schedule 1 prevails for privacy and data-protection matters, an Order Form prevails for the commercial or service detail it expressly changes, and these terms prevail for everything else.

The person accepting for the Customer represents that they are authorised to bind the Customer. DentalReady may keep an electronic record of the document version, acceptance action and wording, date and time, account and practice identifiers, and relevant technical evidence such as IP address and user agent.

Applicable Law:

all laws and binding regulatory requirements that apply to a party or the Services, including privacy, health-records, employment, tax and consumer laws where relevant.

Authorised User:

an individual whom the Customer permits to use the Services under its account.

Beta Period:

a no-fee evaluation period expressly offered by DentalReady before a paid subscription.

Customer Data:

information, files, records and other content submitted to, stored in or generated from the Services for the Customer, excluding DentalReady technology and properly de-identified aggregate information.

Documentation:

DentalReady user guides, in-product instructions and support material made available for the Services.

Fees:

the fees stated in an Order Form, excluding GST unless expressly stated otherwise.

Order Form:

a quote, order, subscription schedule or other written or electronic ordering record accepted by both parties that identifies the Services, term and any Fees.

Services:

the DentalReady hosted platform, supported applications and related services described in an Order Form, including any agreed beta service.

Subscription Term:

the period stated in an Order Form or, for a Beta Period, the period described in clause 4.

During the Subscription Term and subject to this agreement, DentalReady grants the Customer a limited, non-exclusive, non-transferable right for its Authorised Users to access and use the Services for the Customer's internal dental-practice operations. The Customer may not sublicense or resell the Services unless an Order Form expressly allows it.

DentalReady will provide the Services with due care and skill, make the Documentation and standard support channels available, and use reasonable efforts to keep the Services operational. No particular uptime, response time or service level applies unless it is stated in an Order Form.

DentalReady may improve or change the Services. We will give reasonable advance notice where practicable if a change materially reduces a core paid function during a current Subscription Term. If we cannot provide a reasonably equivalent alternative, the Customer may terminate the affected Service and receive a pro-rata refund of prepaid Fees for the unused period.

A Beta Period costs $0. Unless a beta invitation or Order Form states a different period, it runs for three months from activation of the Customer's workspace. DentalReady will use reasonable efforts to contact the Customer before it ends to discuss whether the Customer wants a paid subscription.

A Beta Period never converts automatically into a paid subscription. DentalReady will not charge the Customer unless the parties later accept an Order Form that clearly identifies the Fees and payment arrangements. If no later Order Form is accepted, beta access may end or become read-only at the end of the Beta Period.

Beta and preview functions may be incomplete or change more frequently than paid generally available functions. The Customer should not put real patient information, health information or other confidential practice data into a shared demonstration workspace. DentalReady's confidentiality, privacy, security and data-return obligations still apply to Customer Data submitted to a dedicated beta workspace.

The Customer is responsible for its Authorised Users, account administration, role and permission settings, and keeping credentials and access links confidential. The Customer must promptly remove access that is no longer required and notify DentalReady of suspected unauthorised access.

The Customer must have all rights, notices, authorities and consents needed for Customer Data and its use of the Services, including for employee monitoring, attendance photos, recordings, patient and health information, integrations and communications. The Customer determines the lawful purposes for which its users process Customer Data.

The Customer remains responsible for professional, clinical, employment, payroll, accounting, tax and regulatory decisions; for checking data and outputs before relying on them; and for maintaining any source records or independent copies that Applicable Law or prudent practice requires. The Services support practice operations but do not replace a practice management system of record, professional judgement or emergency services.

The Customer must not, and must not permit an Authorised User to:

• use the Services unlawfully, fraudulently, outside the Documentation or in a way that infringes another person's rights;
• gain or attempt to gain unauthorised access to an account, tenant, system or data;
• upload malware, disrupt the Services, bypass security or rate limits, or conduct security testing without DentalReady's prior written approval;
• copy, reverse engineer or derive source code from the Services except to the limited extent Applicable Law does not allow that restriction;
• scrape, resell, sublicense or use the Services or outputs to build or train a competing product;
• use the Services as the sole basis for diagnosis, treatment, clinical urgency, workplace safety or another decision where human professional review is reasonably required; or
• submit patient or other sensitive information to a shared demonstration account or any field that DentalReady identifies as unsuitable for that information.

As between the parties, the Customer owns Customer Data. The Customer grants DentalReady and its approved subprocessors a non-exclusive right to host, copy, transmit, transform and otherwise process Customer Data only as needed to provide, secure, support and improve the Services, comply with lawful instructions and Applicable Law, and exercise rights under this agreement.

DentalReady may create and use aggregate information only after applying measures reasonably designed to prevent it from identifying the Customer, an Authorised User or a patient. DentalReady may use that de-identified information for service analytics, security, capacity planning, benchmarking and product improvement, but will not try to re-identify it or sell personal or health information.

DentalReady does not obtain ownership of Customer Data. The Customer is responsible for its accuracy, quality and legality and for resolving disputes about access to records controlled by the Customer.

Each party must comply with the privacy and data-protection laws that apply to it. DentalReady will process Customer Data in accordance with Schedule 1 and its published Privacy Policy. If the Customer gives DentalReady a reasonable written instruction about Customer Data, DentalReady will follow it unless it conflicts with this agreement, the operation or security of the Services, or Applicable Law.

DentalReady will maintain reasonable technical and organisational safeguards appropriate to the nature of Customer Data and the risks of processing. No online service can guarantee absolute security. Each party must notify the other promptly of a security issue within its control that is reasonably likely to materially affect the Services or Customer Data and cooperate on an appropriate response.

The Services may interoperate with third-party services selected or authorised by the Customer. The Customer authorises the exchange of the data needed for that integration. Separate third-party terms may apply, and DentalReady is not responsible for a third party's service, outage or change outside DentalReady's reasonable control. DentalReady remains responsible for subprocessors it appoints to process Customer Data as described in Schedule 1.

AI-assisted features may produce classifications, summaries, suggestions or drafts that are incomplete or inaccurate. They are decision-support tools, not autonomous clinical, employment, legal, financial or accounting advice. The Customer must ensure that an appropriately qualified person reviews relevant inputs and outputs before use, communication or action.

A Beta Period is $0. Paid service starts only under a later Order Form accepted by both parties. The Customer must pay the Fees in the Order Form. If an Order Form does not state a payment period, invoices are due 14 days after the invoice date. Fees are non-refundable except as this agreement, an Order Form or Applicable Law expressly provides.

Fees exclude GST unless an Order Form says otherwise. If GST is payable on a taxable supply, the recipient must pay the GST amount when it pays the consideration, subject to receiving a valid tax invoice.

The Customer must raise a genuine invoice dispute promptly and pay the undisputed amount on time. The parties will work in good faith to resolve the disputed amount. DentalReady may charge reasonable recovery costs and suspend for overdue undisputed Fees only in accordance with clause 16.

DentalReady may change Fees only as permitted by an Order Form or by giving at least 30 days' notice before a renewal term. The Customer may decline the renewal. A fee notice or the end of a Beta Period does not itself authorise a charge.

DentalReady and its licensors own the Services, Documentation, software, designs, templates, methods and other technology, including improvements to them. Except for the limited access right in clause 3, no intellectual-property right is transferred to the Customer.

If the Customer voluntarily gives feedback, DentalReady may use it without restriction or payment, provided DentalReady does not identify the Customer publicly without permission. Customer-specific materials supplied by the Customer remain Customer Data.

Each party must protect the other party's non-public business, technical, security and commercial information using at least reasonable care, use it only for this agreement, and disclose it only to personnel, advisers and subcontractors who need it and are bound by confidentiality duties. Customer Data is the Customer's confidential information.

These duties do not apply to information that the receiving party can show was already lawfully known without restriction, becomes public without breach, is independently developed, or is lawfully received from a third party. A party may disclose information when legally required if it gives notice where lawful and reasonably assists the other party to seek protection. These duties continue for five years after termination, and for trade secrets and personal or health information for as long as the information remains protected by law or its nature.

Each party warrants that it has authority to enter this agreement. DentalReady warrants that paid Services will materially conform to the Documentation when used as permitted and will be supplied with due care and skill. If DentalReady breaches that warranty, it will use reasonable efforts to correct or re-perform the affected Service; if it cannot do so within a reasonable time, the Customer may terminate the affected Service and receive a pro-rata refund of prepaid Fees for the unused period.

The warranty does not cover an issue caused by Customer Data, misuse, an unauthorised change, unsupported equipment or software, or a third-party service outside DentalReady's reasonable control. Subject to non-excludable rights, DentalReady does not warrant that every function will be uninterrupted or error-free, that all data or AI-assisted outputs will be accurate, or that the Services are suitable for a purpose not stated in an Order Form.

Nothing in this agreement excludes, restricts or modifies a consumer guarantee, right or remedy under the Australian Consumer Law or another law that cannot lawfully be excluded, restricted or modified. Where lawful, DentalReady's liability for a failure to comply with a non-excludable guarantee relating to services is limited, at DentalReady's option, to supplying the services again or paying the cost of having them supplied again.

DentalReady will defend the Customer against a third-party claim that the Customer's authorised use of a paid Service infringes that third party's Australian intellectual-property rights, and will pay damages finally awarded or a settlement DentalReady approves. DentalReady may modify or replace the affected Service or, if that is not reasonably practicable, terminate it and refund prepaid Fees for the unused period. This does not apply to Customer Data, Customer instructions, combinations not supplied by DentalReady, unauthorised use or continued use after DentalReady provides a non-infringing alternative.

The Customer will defend DentalReady against a third-party claim arising from Customer Data infringing that party's rights, or from the Customer's unlawful or unauthorised use of the Services, and will pay damages finally awarded or a settlement the Customer approves, but only to the extent the claim was caused by the Customer or its Authorised Users.

An indemnity applies only if the indemnified party promptly notifies the other party, gives it reasonable control of the defence and settlement, and provides reasonable cooperation at the indemnifying party's cost. A settlement must not admit fault by or impose a non-monetary obligation on the indemnified party without its consent, which must not be unreasonably withheld.

To the extent permitted by law, neither party is liable to the other for indirect or consequential loss, or for loss of anticipated profit, revenue, goodwill or opportunity, arising from this agreement, even if advised that it was possible. This exclusion does not prevent recovery for direct costs reasonably incurred to restore Customer Data or respond to a breach for which a party is liable.

Subject to the next paragraph, each party's aggregate liability arising out of or in connection with this agreement, whether in contract, tort (including negligence), statute or otherwise, must not exceed the total Fees paid or payable by the Customer under the applicable Order Forms during the 12 months immediately before the event giving rise to the claim.

The exclusions and cap in this clause do not apply to the Customer's obligation to pay Fees, fraud or wilful misconduct, death or personal injury caused by negligence, breach of clause 12 or Schedule 1, a party's indemnity for a third-party intellectual-property claim, or liability that cannot lawfully be excluded or limited. Each party must take reasonable steps to mitigate its loss.

DentalReady may suspend affected access to the extent reasonably necessary to respond to a security risk, unlawful use, material breach of clause 6, an emergency affecting the Services, or overdue undisputed Fees. Except in an urgent security or legal situation, DentalReady will first give notice and a reasonable opportunity to remedy the issue, including at least 10 business days for overdue undisputed Fees. DentalReady will limit the suspension where reasonably practicable and restore access promptly after the issue is resolved.

This agreement continues for the Subscription Term. Renewal occurs only as stated in an Order Form. A Beta Period ends under clause 4 and does not automatically renew as paid service.

Either party may terminate an affected Order Form if the other materially breaches this agreement and does not remedy the breach within 30 days after written notice, or immediately if the breach cannot reasonably be remedied. Either party may terminate if the other becomes insolvent, enters external administration or ceases business, subject to Applicable Law.

DentalReady may discontinue a paid Service for convenience only by giving at least 60 days' notice and refunding prepaid Fees for the period after termination. The Customer may choose not to renew and may terminate for convenience only if an Order Form allows it. Termination does not affect accrued rights or Fees properly due for service already provided.

The Customer may use available export functions during the Subscription Term. After expiry or termination, DentalReady will keep the Customer's workspace available for export for 30 days in a form and access mode DentalReady reasonably determines, unless law or an urgent security issue requires earlier restriction. Reasonable professional-service Fees may apply to a custom export not included in the Services, but DentalReady will disclose them first.

After that export period, DentalReady may delete Customer Data from active systems within 90 days. Residual encrypted backups may remain until overwritten in the ordinary backup cycle, and DentalReady may retain information required by law, to resolve a dispute, or to establish or defend legal rights. Retained information remains protected by this agreement and will not be used for another purpose.

The Customer is responsible for exporting records it must retain, including patient and employment records. At the Customer's reasonable request, DentalReady will confirm completion of deletion, subject to the exceptions above.

DentalReady may publish a new version for a future Order Form or renewal. A new version does not materially reduce the Customer's rights during a current paid Subscription Term unless the Customer agrees. DentalReady may make a change during a term when reasonably required by law, regulation or an urgent security need, and will give as much notice as practicable. The version accepted for an Order Form remains available at its versioned public URL.

A party claiming a dispute must give written notice describing it. Senior representatives must meet or confer in good faith within 10 business days. If the dispute is not resolved within a further 10 business days, either party may refer it to confidential mediation in Sydney, New South Wales, administered by the Resolution Institute under its current mediation rules.

Nothing prevents urgent interlocutory relief, debt recovery for an undisputed amount, or use of a statutory complaint or consumer remedy. This agreement is governed by the laws of New South Wales, Australia. The parties submit to the courts of New South Wales and courts entitled to hear appeals from them.

Neither party is liable for delay caused by an event beyond its reasonable control, except for payment obligations, if it promptly notifies the other and uses reasonable efforts to minimise the effect. If the event continues for more than 60 days and materially prevents the Services, either party may terminate the affected Order Form and DentalReady will refund prepaid Fees for the unused period.

Neither party may assign this agreement without the other's consent, not to be unreasonably withheld, except to an affiliate or in connection with a bona fide merger, reorganisation or sale of substantially all relevant assets, provided the assignee can perform the obligations. DentalReady may use subcontractors but remains responsible for its obligations under this agreement.

The parties are independent contractors. This agreement does not create employment, partnership, agency or exclusivity. If a provision is invalid, it is severed or read down only to the minimum extent necessary. A waiver must be in writing and is not a continuing waiver. Clauses intended by their nature to survive termination do so, including clauses 7, 8, 11 to 15, 18, 20 and Schedule 1.

This agreement is the entire agreement about its subject and supersedes prior proposals and discussions, but does not exclude liability for fraud. It may be accepted and signed electronically and in counterparts.

Formal notices must be sent by email to the address stated in the Order Form or the account's current administrator contact. Notices to DentalReady may be sent to hello@dentalready.com.au. A notice is received when the sender receives no automated delivery failure, but a notice sent after 5:00 pm at the recipient's location is treated as received on the next business day. Ordinary support requests and in-product messages are not formal notices unless they clearly say they are.

This Schedule applies when DentalReady processes personal information or health information in Customer Data to provide the Services. It survives for as long as DentalReady holds that information.

The Customer determines why its Customer Data is collected and used and instructs DentalReady to process it to provide, secure and support the Services, comply with documented lawful requests, and meet legal obligations. Each party remains responsible for its own obligations as an APP entity, health service provider, employer or other regulated entity where those concepts apply.

DentalReady will not sell personal or health information, use it for third-party advertising, or use identifiable Customer Data to train a general-purpose AI model unless the Customer gives specific written authorisation. DentalReady will tell the Customer if a requested instruction would, in DentalReady's reasonable view, breach Applicable Law and may pause that instruction while the parties resolve it.

Subject matter and duration:

operation and support of the Services for the Subscription Term and the return, retention and deletion periods in clause 18.

Nature and purpose:

hosting, organising, retrieving, displaying, transmitting, analysing, backing up, securing, supporting and deleting Customer Data as needed for the Customer's selected workflows.

People:

Customer personnel, candidates, contractors, advisers, patients, patient contacts, suppliers and other people whose information an Authorised User lawfully submits.

Information:

identity and contact details, account and access data, practice operations, employment, attendance, communications, files, financial and supplier records, patient and health information, recordings, images, integration data, support records, agreement evidence, and product and email activity telemetry.

Sensitive information:

health information and any other sensitive information the Customer chooses and is authorised to process through a supported workflow.

The Customer must collect and use personal and health information lawfully, give required privacy notices, obtain required consents or other authority, respond to individuals, and configure access appropriately. It must not instruct DentalReady to process information in a way that breaches Applicable Law. The Customer must tell DentalReady if a supported workflow needs a specific retention, access, location or security requirement not already stated in this agreement.

DentalReady will maintain a security program proportionate to the nature of the Services and Customer Data. Measures will include, as appropriate:

• encryption in transit and encryption at rest for supported production storage;
• role-based access, tenant-isolation controls and least-privilege administrative access;
• authentication controls, logging and monitoring appropriate to relevant systems;
• secure development, dependency and vulnerability management practices;
• backup, recovery and incident-response processes;
• confidentiality obligations and privacy or security training for personnel with access; and
• risk-based due diligence and contractual data-protection obligations for subprocessors.

DentalReady may update specific measures as technology and risks change, provided the overall protection is not materially reduced during a current Subscription Term.

The Customer generally authorises DentalReady to use subprocessors needed to provide the Services. DentalReady will identify material provider categories and likely overseas locations in its Privacy Policy or another current notice, impose appropriate confidentiality and data-protection terms, and remain responsible for their performance of DentalReady's obligations under this Schedule.

DentalReady will give reasonable advance notice of a material new subprocessor where practicable. The Customer may object on reasonable data-protection grounds within 10 business days. The parties will try in good faith to resolve the concern. If they cannot and DentalReady cannot provide the affected Service without that subprocessor, the Customer may terminate the affected Service and receive a pro-rata refund of prepaid Fees for the unused period.

Before disclosing personal information to an overseas recipient, DentalReady will take the steps reasonably required by Australian Privacy Principle 8 and other Applicable Law. The Customer authorises overseas processing described in the current Privacy Policy, subject to those safeguards.

DentalReady will notify the Customer without undue delay after becoming aware of unauthorised access to, disclosure of or loss of Customer Data that is reasonably likely to require investigation or notification under Applicable Law. As information becomes available, DentalReady will describe the nature of the incident, affected information, likely consequences, containment and remediation, and a contact for follow-up.

DentalReady will take reasonable steps to contain, investigate and remediate the incident and reasonably assist the Customer with its assessment and notices. Unless Applicable Law requires DentalReady to notify directly, the Customer controls communications about its Customer Data. A notice is not an admission of fault or liability.

Taking account of the nature of processing, DentalReady will provide reasonable assistance for the Customer to respond to a request to access, correct, export or delete Customer Data and to a privacy regulator. If DentalReady receives a request that relates primarily to Customer-controlled data, it may refer the requester to the Customer unless law prevents it. DentalReady remains responsible for requests about information it controls for its own purposes.

To the extent the Health Records and Information Privacy Act 2002 (NSW) applies, each party must comply with the Health Privacy Principles applicable to its handling of health information. DentalReady will handle health information only for supported, authorised purposes and will reasonably assist the Customer with access, correction, security, retention and complaint obligations. The Customer remains responsible for clinical records, patient notices, professional obligations and legally required retention as the health service provider and record owner.

DentalReady will return and delete Customer Data as described in clause 18. On reasonable request no more than once in a 12-month period, DentalReady will provide available information reasonably needed to demonstrate compliance with this Schedule, subject to confidentiality, security and third-party restrictions.

If that information does not reasonably address a substantiated material concern, the Customer may request an independent audit of the relevant controls on reasonable notice during business hours. The audit must minimise disruption, protect other customers' information and use an auditor bound by confidentiality. The Customer pays the audit cost unless it identifies a material breach by DentalReady, in which case DentalReady will pay reasonable audit costs and promptly remediate the breach.