Verkoop: 929-416-3396
AAN DE SLAG BEKIJK DE PRIJZEN
AAN DE SLAG PRIJZEN BEKIJKEN LATEN WE AAN DE SLAG GAAN
Verkoop: 929-416-3396
© 2026 Dandy

Practice Agreement Additional Terms & Conditions

US | Canada | UK | Spain | France | Italy | Germany | Ireland | Netherlands | Belgium (French) | Belgium (Dutch) | Sweden

US TERMS AND CONDITIONS

Effective: September 21, 2026

These Terms and Conditions (the “Terms”) are incorporated by reference into the Order Form between Dandy and Customer (collectively, the Order Form, the Terms, the BAA, and the IT Policy, if applicable, the “Practice Agreement”). Capitalized terms used but not defined here have the meanings given in the Order Form.

  1. Dandy Offerings and Equipment. Dandy’s proprietary software platform, including Chairside, Dandy Practice Portal, digital services and support, hardware and software, and all Dandy Products are collectively referred to as “Dandy Offerings.” If applicable, Dandy provides Customer with the Equipment specified in the Order Form on a loaned basis to enable Customer to use Dandy Offerings, subject to Customer’s compliance with the terms of this Agreement. For sales tax calculation purposes only, $100 of the Monthly Spend Commitment is attributable to Equipment. This allocation does not impact the Monthly Spend Commitment. Title to the Equipment remains with Dandy at all times, and Customer will not: (a) modify, alter, disassemble, or attempt to repair the Equipment (except routine cleaning); (b) remove the Equipment from Customer’s practice location without Dandy’s prior written consent; (c) remove, alter, or obscure any Dandy labels, serial numbers, or proprietary notices; or (d) grant any lien, security interest, or encumbrance on the Equipment. Customer bears all risk of loss, theft, damage, or destruction of Equipment while in Customer’s possession. Dandy will provide reasonable technical support and software maintenance for the Equipment during the Term. Customer is responsible for maintaining adequate insurance covering the Equipment.
  2. Dandy Product Warranty. Dandy warrants that Dandy Products will be free from defects in materials, manufacturing, and workmanship as follows: (a) Fixed Products (crowns, bridges, implant crowns, implant bridges, inlays, onlays, veneers, and zirconia and titanium implant abutments) have a lifetime warranty against breakage during ordinary use due to manufacturing defects; (b) Removable Products (partial and full dentures, night guards, splints, sleep apnea devices, clear aligners, retainers, and bleaching trays) have a six (6) month warranty against wear and tear, and a ten (10) year warranty against breakage during ordinary use due to manufacturing defects. Under this warranty, Dandy will, at its sole discretion, repair or replace the defective product or refund the original purchase price. This warranty is void if: (i) the patient fails to maintain regular dental checkups; (ii) the product is modified after delivery; (iii) damage results from accident, misuse, or failure to follow Dandy’s instructions; or (iv) Customer fails to comply with the terms of the Practice Agreement. THIS WARRANTY IS EXCLUSIVE AND IN LIEU OF ALL OTHER WARRANTIES, EXPRESS OR IMPLIED, INCLUDING ANY WARRANTY OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE.
  3. Overdue Invoices; Remedies. If any amount owed by Customer is more than thirty (30) days past due, Dandy may: (a) suspend Customer’s access to Dandy Offerings until all outstanding amounts are paid in full; (b) charge interest on overdue amounts at the rate of 1.5% per month (or the maximum rate permitted by law, if less); and (c) recover all costs of collection, including reasonable attorneys’ fees. Dandy’s exercise of any remedy does not waive any other remedy available at law or under the Practice Agreement.
  4. Termination. Either party may terminate the Practice Agreement at any time by providing ten (10) days’ advance written notice to the other party. If the Practice Agreement is terminated, Customer is obligated to promptly return all Equipment. Dandy will provide shipping labels and a box to return the Equipment. If Customer fails to initiate the return of the Equipment by scheduling a UPS pickup date within thirty (30) days of receiving a return label, Dandy may invoice Customer for the full replacement cost of the Equipment at its then-current price (price list available upon request), which amount will be due immediately. If the Practice Agreement is terminated, Customer remains liable for all fees for orders placed prior to termination and for the Monthly Spend Commitment for the month in which termination occurs.
  5. Training. Dandy will provide training at no additional cost to Customer and its personnel who use Dandy Offerings. Customer is solely responsible for ensuring that its personnel are properly trained and comply with the Practice Agreement. 
  6. Medical Disclaimer. Dandy Offerings do not constitute medical, dental, or healthcare advice, diagnosis, or treatment. Customer is solely responsible for: (a) all clinical decisions, patient treatment, and patient outcomes; (b) obtaining informed consent from patients, including disclosing all relevant risks and alternatives; (c) ensuring that only licensed dental professionals authorized under applicable state law perform intraoral scans and related procedures; and (d) complying with all applicable federal, state, and local laws, regulations, and professional standards governing dental practice. Customer will not make any representations, warranties, or guarantees about Dandy Offerings to patients on behalf of Dandy. Customer acknowledges that Dandy is a dental laboratory and technology provider, not a healthcare provider.
  7. Entire Agreement. The Order Form, these Terms and Conditions, the Business Associate Agreement, and the IT Policies (if applicable), constitute the entire agreement between the parties. Anything communicated by other means is not binding. This Practice Agreement supersedes all prior agreements between the parties.
  8. Regulatory Compliance. Each party will comply with all applicable federal, state, and local laws and regulations, including without limitation: (a) applicable laws governing the collection, use, disclosure and protection of personal information, including personal health information; (b) state dental practice legislation, professional standards, and licensing requirements; and (c) the Federal Trade Commission Act and state consumer protection laws. Customer acknowledges that it is solely responsible for compliance with laws governing the practice of dentistry and patient care. Nothing in this Practice Agreement is intended as, or shall be construed as, an inducement or incentive to prescribe, recommend, order, purchase, or use any product, service, or treatment, and Customer is solely responsible for exercising independent clinical judgment and ensuring the clinical appropriateness of any product, service, or treatment for its patients.
  9. Indemnity. Customer will indemnify, defend, and hold harmless Dandy from all claims, causes of action, damages, debts, liabilities, losses, obligations, payments, costs, and expenses (including reasonable legal expenses) arising from or relating to: (a) Customer’s breach of the Practice Agreement; (b) Customer’s acts or omissions regarding patient care, treatment, or professional services; (c) any claim by a patient or third party relating to Customer’s dental services; (d) Customer’s provision of inaccurate, incomplete, or misleading information, scans, or data to Dandy; (e) Customer’s violation of any applicable law, regulation, or professional standard, including failure to obtain proper patient consents; or (f) any regulatory or disciplinary proceedings relating to Customer’s practice.
  10. Sales Tax. Dandy will charge applicable sales tax based on Customer’s geographic location. The sales tax amount will be shown on the monthly invoice and collected as described herein. If Customer is tax-exempt, Customer must provide a valid exemption certificate acceptable to each taxing jurisdiction where exempt status is claimed.
  11. Confidentiality. Each party will hold in confidence all non-public information received from the other party under the Practice Agreement (“Confidential Information”), use it only for purposes of the Practice Agreement, and not disclose it to third parties except to employees or contractors with a need to know who are bound by confidentiality obligations. These obligations do not apply to information that is or becomes publicly available through no fault of the receiving party, was already known to the receiving party, or is required to be disclosed by law. 
  12. Intellectual Property. Dandy retains all right, title, and interest in and to the Equipment, software, platform, technology, Dandy Offerings, and all related intellectual property. No rights are granted to Customer except the limited right to use the Dandy Offerings during the Term in accordance with the Practice Agreement. Customer retains all right, title, and interest in and to the data, information, and content Customer provides to Dandy, including patient information and scan data, subject to the licenses granted herein. If Customer provides feedback or suggestions regarding Dandy Offerings, Dandy may use such feedback without restriction or obligation to Customer. Dandy may also use Customer data, solely on an aggregated and anonymized basis, to operate, improve, and develop Dandy Offerings and related products and services.
  13. Third-Party Service Providers. Customer acknowledges and agrees that Dandy may engage third-party service providers to perform certain functions in connection with Dandy Offerings. Dandy will maintain appropriate agreements with such third-party service providers to protect Customer data. By using Dandy Offerings, Customer consents to the disclosure of Customer data to such third-party service providers as necessary to provide services to Customer.
  14. Integrated Services. Dandy may, directly or through its affiliates, provide additional products, services, or features that integrate with or supplement Dandy Offerings. Such additional products, services, or features may be governed by separate or supplemental terms, which will be made available to Customer prior to use. Customer acknowledges and agrees that Dandy and its affiliates may share Customer data among themselves as necessary to provide integrated services and to improve the overall Customer experience.
  15. Assignment; Change of Control. Customer may not transfer or assign the Practice Agreement without Dandy’s prior written consent. Any purported assignment without consent is null and void. Customer will notify Dandy in writing at least thirty (30) days before (or, if not possible, promptly upon) any ownership change, including any sale, merger, or change of control, regardless of whether the legal entity changes. Any new owner must execute a written assumption agreement covering all outstanding obligations, including unpaid balances. Upon any ownership change, Dandy may withhold consent, require a new agreement, require full payment, or terminate the Practice Agreement. The original party remains liable until Dandy confirms the transfer in writing.
  16. Bankruptcy Notice. Customer must notify Dandy in writing within five (5) business days of any bankruptcy filing, insolvency proceeding, or assignment for the benefit of creditors. Failure to provide timely notice constitutes a material breach of the Practice Agreement.
  17. Insurance. Each party will maintain, at its own expense, commercially reasonable levels of insurance sufficient to cover its obligations and liabilities under the Practice Agreement with a reputable insurance carrier(s). 
  18. Limit of Liability. Except for fraud, gross negligence, willful misconduct, Customer’s indemnification and payment obligations, and Customer’s liability for equipment, each party’s total liability under the Practice Agreement will not exceed the fees paid by Customer in the twelve (12) months preceding the claim. Neither party will be liable for any indirect, incidental, special, consequential, or punitive damages.
  19. Governing Law; Arbitration. The Practice Agreement is governed by the laws of the State of New York without regard to conflicts of law principles. Any dispute, claim, or controversy arising out of or relating to the Practice Agreement or the breach, termination, enforcement, interpretation, or validity thereof, including the determination of the scope or applicability of the Practice Agreement to arbitrate, will be determined by binding arbitration in the State of New York before one (1) arbitrator.  The arbitration will be administered by JAMS (www.jamsadr.com) pursuant to its Comprehensive Arbitration Rules and Procedures, and in accordance with the Expedited Procedures set forth in those Rules.  Judgment on the award may be entered in any court having jurisdiction.
  20. Force Majeure. Neither party will be liable for any delay or failure to perform its obligations (other than payment obligations) due to causes beyond its reasonable control, including acts of God, natural disasters, war, terrorism, riots, embargoes, labor disputes, government actions, supply chain disruptions, pandemics, epidemics, or failures of third-party telecommunications or power. The affected party must provide prompt notice and use reasonable efforts to mitigate the impact.
  21. Publicity. Customer grants Dandy a limited, revocable, non-exclusive license to use and display Customer’s name and logo on Dandy’s website and in marketing materials. Customer may revoke this license at any time by providing written notice to Dandy.
  22. Notices. All notices under the Practice Agreement must be in writing and are effective upon: (a) personal delivery; (b) the second business day after mailing by certified mail, return receipt requested; or (c) the first business day after sending by nationally recognized overnight courier or email (with confirmation of receipt). Notices to Dandy must be sent to: Zima International, Inc. d/b/a Dandy, Attn: Legal Department, 22 Cortlandt St, 30th Floor, New York, NY 10006 Email: [email protected]. Notices to Customer must be sent to the address or email provided in the Order Form. Either party may change its notice address by providing notice in accordance with this Section. 
  23. Relationship of Parties. The parties are independent contractors. Nothing in the Practice Agreement creates a partnership, joint venture, agency, franchise, or employment relationship between the parties. Neither party has authority to bind the other or incur obligations on the other’s behalf.
  24. No Third-Party Beneficiaries. This Practice Agreement is for the sole benefit of the parties and their permitted successors and assigns. Nothing in the Practice Agreement confers any rights or remedies on any third party, including any patient or end user.
  25. General Provisions. No failure or delay by either party in exercising any right, power, or remedy under the Practice Agreement will operate as a waiver; no waiver is effective unless in writing. If any provision is held invalid or unenforceable, the remaining provisions will continue in full force and effect.
  26. Modifications. Dandy may modify these Terms from time to time by posting updated Terms on Dandy’s website. Customer is responsible for reviewing the Terms periodically, and continued use of Dandy Offerings after any modification constitutes acceptance.

Business Associate Agreement

This HIPAA BUSINESS ASSOCIATE AGREEMENT (“Addendum”), is effective as of the date the Practice Agreement is entered into (“Effective Date”), between the dental practice identified in the Practice Agreement (“Covered Entity”) and Dandy (“BA”).  This Addendum, which supersedes any previous business associate agreement between the parties, amends, supplements, and is made a part of the Practice Agreement, by and between Covered Entity and BA, as the same may be amended from time to time (the “Agreement”).

RECITALS

WHEREAS, Covered Entity is a “covered entity” as that term is defined at 45 C.F.R. § 160.103;

WHEREAS, BA may, on behalf of Covered Entity, create, receive, maintain, or transmit certain Protected Health Information (as defined below) in order to provide services to Covered Entity pursuant to the Agreement;

WHEREAS, Covered Entity is subject to the Administrative Simplification requirements of the Health Insurance Portability and Accountability Act of 1996 and regulations promulgated thereunder, including the Standards for Privacy of Individually Identifiable Health Information and the Security Standards for the Protection of Electronic Protected Health Information at 45 C.F.R. Parts 160 and 164 (collectively “Privacy and Security Regulations”);

WHEREAS, the Privacy and Security Regulations require Covered Entity to enter into a contract with BA in order to mandate certain protections for the privacy and security of Protected Health Information, and those Regulations prohibit the disclosure of Protected Health Information from Covered Entity to BA if such a contract is not in place;

WHEREAS, this Addendum shall be applicable only in the event that BA meets, with respect to Covered Entity, the definition of “business associate” set forth in 45 C.F.R. § 160.103.

In consideration of the foregoing, and for other good and valuable consideration, the receipt and adequacy of which is hereby acknowledged, the parties agree as follows:

1. Definitions

  1. “Breach” shall have the meaning given to the term “breach” at 45 C.F.R. § 164.402, as applied to the Unsecured PHI created, received, maintained, or transmitted by BA from or on behalf of Covered Entity.
  2. “Electronic Protected Health Information” or “ePHI” means shall have the meaning given to the term “electronic protected health information” at 45 C.F.R. § 160.103, as applied to the information created, received, maintained, or transmitted by BA from or on behalf of Covered Entity.
  3. “Protected Health Information” or “PHI” shall have the meaning given to the term “protected health information” at 45 C.F.R. § 160.103, as applied to the information created, received, maintained, or transmitted by BA from or on behalf of Covered Entity.
  4. “Reportable Event” means any (1) use or disclosure of PHI not provided for by this Addendum; (2) Security Incident; (3) Breach of Unsecured PHI; or (4) any data incident involving PHI for which data breach notification is required under applicable foreign, federal, or state law.
  5. “Services” mean the services provided by BA to Covered Entity as set forth in the Agreement.
  6. “Security Incident” shall have the meaning given to the term “security incident” at 45 C.F.R. § 164.304, as applied to the ePHI created, received, maintained, or transmitted by BA from or on behalf of Covered Entity.

Terms used, but not otherwise defined, in this Addendum shall have the same meaning as those terms in the Privacy and Security Regulations including, but not limited to, 45 C.F.R. Sections 160.103 and 164.501. Any inconsistency in the definition of a term shall be resolved in favor of a meaning that permits compliance with HIPAA.

2. Permitted Uses and Disclosures of PHI

Except as otherwise limited in this Addendum or the Agreement, BA may do any or all of the following:

  1. Use of Disclosure under the Agreement. Use or disclose PHI to perform functions, activities, or services for, or on behalf of Covered Entity, to the extent permitted in the Agreement, provided that such use or disclosure would not violate the Privacy Rule or any applicable state law if done by Covered Entity.  Notwithstanding the above, BA may use and disclose PHI for the purposes identified in paragraphs (2), (3), and (5) of this Section 2, even if Covered Entity could not do so under the Privacy Rule.
  2. Use for Administration or Legal Responsibilities. Use PHI, but only to the minimum extent necessary, for the proper management and administration of BA, for debt collection practices of BA, or to carry out the legal responsibilities of BA.
  3. Disclosure for Administration or Legal Responsibilities. Disclose PHI, but only to the minimum extent necessary, for the proper management and administration of BA or to carry out the legal responsibilities of BA, provided that:
    1. The disclosures are Required by Law; or
    2. BA obtains reasonable assurances from the third party to whom the PHI is disclosed that such information shall remain confidential and shall be used or further disclosed only as Required By Law or for the purpose for which it was disclosed to the person (which purpose must be consistent with the limitations imposed upon BA pursuant to this Addendum), and such person agrees to promptly notify BA of any instance of which it is aware in which the confidentiality of the information has been breached.
  4. Use for Reporting of Violations. Use PHI to report violations of law to appropriate federal, state, and local authorities, consistent with 45 C.F.R. § 164.502(j).
  5. Use for Data Aggregation Services. Use PHI to provide Data Aggregation services relating to the health care operations of Covered Entity, as permitted by 45 C.F.R. §164.504(e)(2)(i)(B).
  6. De-Identified Information. Use PHI to create de-identified information in accordance with 45 C.F.R. §§ 164.502(d) and 164.514(a)-(c).

3.  Obligations of Business Associate

  1. Limited by Agreement and Law.  BA may not use or disclose PHI other than as permitted or required by this Addendum and the Agreement or as Required by Law.
  2. Compliance with HIPAA. To the extent that BA is responsible for carrying out an obligation of Covered Entity under HIPAA pursuant to this Addendum or the Agreement, BA shall comply with the requirements of HIPAA that apply to Covered Entity in the performance of such obligation.
  3. Appropriate Safeguards for PHI. BA shall implement and maintain appropriate safeguards to prevent the Use or Disclosure of PHI in any manner other than as permitted by the Agreement and this Addendum. 

4. Reportable Events

  1. Use of Subcontractors. If BA discloses PHI to a subcontractor or allows a subcontractor to create, receive, maintain, or transmit PHI on its behalf, BA shall require the subcontractor to execute a written agreement obligating the subcontractor to comply with all the terms of this Addendum. If BA becomes aware of a pattern of activity or practice of a subcontractor that would constitute a material breach or violation of the written agreement between BA and subcontractor, BA shall take reasonable steps to cure such breach or end the violation, as applicable, or terminate such written agreement with such subcontractor.
  2. Availability of Internal Practices, Books and Records to Government Agencies. BA agrees to make its internal practices, books and records relating to the Use and Disclosure of PHI that is received from, or created or received by BA on behalf of, Covered Entity available to the Secretary of the United States Department of Health and Human Services for purposes of determining Covered Entity’s compliance with the HIPAA. No attorney-client, accountant-client, or other legal privilege shall be deemed to have been waived by BA by virtue of BA’s compliance with this provision.
  3. Access to and Amendment of PHI. To the extent that BA maintains PHI in a Designated Record Set, BA shall: (a) make the PHI specified by Partner available to the individual(s) identified by Covered Entity as being entitled to access such PHI, and (b) make amendment(s) to such PHI in a Designated Record Set that as directed or agreed to by Covered Entity. BA shall provide such access and incorporate such amendments within the time and in the manner specified by Covered Entity that meets the requirements of 45 C.F.R. § 164.524, § 164.526, and applicable state law.
  4. Accounting of Disclosures. Upon Covered Entity’s request, BA shall provide to Covered Entity an accounting of the disclosures of an Individual’s PHI in a time and manner that meets the requirements of 45 C.F.R. § 164.528 and, as of the applicable effective date, Section 13405(c) of HITECH and any regulations promulgated thereunder.
  5. Minimum Necessary.  BA agrees that it shall comply with HIPAA’s minimum necessary requirements.
  6. Communication with Other Business Associates.  In connection with the performance of its services, activities, and/or functions to or on behalf of Covered Entity, BA may disclose information, including PHI, to other business associates of Covered Entity.  Likewise, BA may use and disclose information, including PHI, received from other business associates of Covered Entity, as if this information was received from, or originated with, Covered Entity.  The parties agree that it is the responsibility of Covered Entity to secure and maintain business associate agreements with its other business associates.
  7. BA shall report to Covered Entity any Reportable Event of which it becomes aware. All such reports shall be made without unreasonable delay and in no case later than fifteen (15) business days after BA’s discovery of a Reportable Event.
  8. BA shall cooperate with Covered Entity in investigating a Reportable Event and assist Covered Entity in determining whether a Reportable Event constitutes a Breach of Unsecured PHI.
  9. BA shall mitigate, to the extent practicable, any harmful effect that is known to BA of a Reportable Event.
  10. The parties acknowledge and agree that this section constitutes notice by BA to Covered Entity of the ongoing existence and occurrence of attempted but unsuccessful Security Incidents that do not result in unauthorized access to, or use, loss, modification, destruction, or disclosure of, PHI, such as pings and other broadcast attacks on BA’s firewall, port scans, unsuccessful log-on attempts, unsuccessful denial of service attacks, or any combination thereof.

5.  Obligations of Covered Entity

  1. Notice of Privacy Practices.  Covered Entity shall notify BA in writing of any limitations in its notice of privacy practices, to the extent that such limitations may affect BA’s use or disclosure of PHI.
  2. Notification of Revocations.  Covered Entity shall notify BA in writing of any changes in, or revocation of, authorization by an Individual to use or disclose PHI, to the extent that such changes or revocation may affect BA’s use or disclosure of PHI.
  3. Notification of Restrictions.  Covered Entity shall notify BA in writing of any restriction to the use or disclosure of PHI that Covered Entity has agreed to or is required to abide by in accordance with 45 C.F.R. § 164.522, to the extent that such restriction may affect BA’s use or disclosure of PHI.
  4. Permissible Requests.  Covered Entity shall not request that BA use or disclose PHI in any manner that would not be permissible under HIPAA or other applicable federal or state law if done by Covered Entity.

6.  Term and Termination

  1. Term. The term of this Addendum shall be the same as the term of the Agreement, but shall terminate as of the earliest occurrence of any of the following:
    1. The Agreement expires or is terminated with or without cause; 
    2. This Addendum is terminated for cause as described in Section 5.2 below; 
    3. The parties mutually agree to terminate this Addendum; or
    4. This Addendum is terminated under applicable federal, state, or local law. 
  2. Termination for Cause.
    1. Upon Covered Entity’s determination of a breach of any material term of this Addendum by BA, Covered Entity shall provide BA written notice of that breach in sufficient detail to enable BA to understand the specific nature of that breach and afford BA an opportunity to cure the breach; provided, however, that if BA fails to cure the breach within thirty (30) days of receipt of such notice, Covered Entity may terminate this Addendum and the Agreement. 
    2. Upon BA’s determination of a breach of a material term of this Addendum by Covered Entity, BA shall provide Covered Entity written notice of that breach in sufficient detail to enable Covered Entity to understand the specific nature of that breach and afford Covered Entity an opportunity to cure the breach; provided, however, that if Covered Entity fails to cure the breach within thirty (30) days of receipt of such notice, BA may terminate this Addendum and the Agreement.
  3. Effect of Termination
    1. Subject to Section 5.3(b) below, upon termination of this Addendum for any reason, BA shall return or destroy all PHI that BA still maintains in any form.  BA shall retain no copies of such PHI. 
    2. If return or destruction of any or all PHI is not feasible, BA shall:
      1. Retain only that PHI for which return or destruction is not feasible;
      2. Return to Covered Entity or destroy the remaining PHI that BA still maintains in any form;
      3. Extend the protections of this Addendum to any retained PHI, continue to use appropriate safeguards, and comply with the Security Rule with respect to ePHI, in order to prevent use or disclosure of the retained PHI other than as provided for in this Addendum for as long as BA retains the PHI;
      4. Not use or disclose the PHI retained by BA other than for the purposes for which such PHI was retained and subject to the same conditions set forth in this Addendum that applied prior to termination; and
      5. Return to Covered Entity or destroy the PHI retained by BA if and when it becomes feasible to do so.
    3. These provisions shall apply to PHI that is in the possession of subcontractors or agents of BA.
    4. This Section 5.3 shall survive termination of this Addendum. 

7.  Miscellaneous

  1. Regulatory References.  A reference in this Addendum to a section in HIPAA means the section as in effect or as amended at the time this Addendum is executed or amended.
  2. Amendment; No Waiver.  Upon the effective date of any federal statute amending or expanding HIPAA, any guidance or temporary, interim final or final regulations promulgated under HIPAA, or under any federal statute amending or expanding HIPAA (collectively, the “HIPAA Regulations”) that are applicable to this Addendum or any amendments to the HIPAA Regulations, this Addendum shall be automatically amended, such that the obligations imposed on Covered Entity and BA shall remain in compliance with such requirements, unless the parties agree otherwise by mutual consent.  The parties shall take all necessary action to expressly reflect such automatic amendments to this Addendum from time to time.  Except as provided otherwise in this paragraph (B), no waiver, change, modification, or amendment of any provision of this Addendum shall be made unless it is in writing and is signed by the parties hereto.  The failure of either party at any time to insist upon strict performance of any condition, promise, agreement, or understanding set forth herein shall not be construed as a waiver or relinquishment of the right to insist upon strict performance of the same condition, promise, agreement, or understanding at a future time.
  3. Interpretation.  Any ambiguity in this Addendum shall be resolved in favor of a meaning that permits compliance with HIPAA. The titles and headings set forth at the beginning of each section hereof are inserted for convenience of reference only and shall in no way be construed as a part of this Addendum or as a limitation on the scope of the particular provision to which it refers.  In the event of an inconsistency between the provisions of this Addendum and the mandatory terms of HIPAA, as may be expressly amended from time-to-time by the Secretary, or as a result of interpretations by the Secretary, a court, or another regulatory agency with authority over the parties, the interpretation of the Secretary, such court, or regulatory agency shall prevail.
  4. Relationship to Agreement Provisions. In the event that a provision of this Addendum is contrary to a provision of the Agreement, the provision of this Addendum shall control. Otherwise, this Addendum shall be construed under, and in accordance with, the terms of the Agreement.
  5. Relationship of Parties.  The parties to this Addendum are independent contractors.  None of the provisions of this Addendum are intended to create, nor shall they be interpreted or construed to create, any relationship between Covered Entity and BA other than that of independent contractors.  Except as otherwise expressly set forth herein, neither party, nor any of its representatives, shall be deemed to be the agent, employee, or representative of the other party.
  6. No Third Party Beneficiaries.  This Addendum is between the parties hereto.  Nothing express or implied in this Addendum is intended to confer, nor shall anything herein confer, any rights, remedies, obligations, or liabilities whatsoever upon any person other than Covered Entity and BA and any respective successors and assigns.
  7. Invalid or Unenforceable Provision.  The provisions of this Addendum shall be severable.  The invalidity or unenforceability of any particular provision or portion of such provision of this Addendum be construed, in all respects, as if such invalid or unenforceable provision or portion of such provision had been omitted, and shall not affect the validity and enforceability of the other provisions hereof or portions of that provision.
  8. Assignment.  The parties’ rights and obligations with respect to assignment of this Addendum shall be subject to the assignment provision set forth in the Agreement. In the event that the Agreement does not contain an assignment provision, neither party may assign its rights, or delegate its duties or obligations, under this Addendum without the prior written consent of the other party, which consent shall not be unreasonably withheld.  This Addendum shall be binding upon, and shall inure to the benefit of, the parties hereto and their respective successors.
  9. Applicable Law.  This Addendum shall be construed, administered, and governed by the governing law set forth in the Agreement, except to the extent preempted by applicable federal law.  In the event that the Agreement does not identify the governing law, this Addendum shall be construed, administered, and governed under the laws of the State of New York, except to the extent preempted by applicable federal law.
  10. Notices.  All notices hereunder shall be in writing, and either delivered by hand, or sent by mail, or delivered in such other manner as the parties may agree upon, to the following:

To Covered Entity: Practice’s Email Address Identified in the Practice Agreement

To BA: Dandy

Attention: Legal Department

11 Park Place, Suite 502

New York, NY 10007

[email protected]

Each party reserves the right to change address for receiving notice during the term of this Addendum upon written notice to the other parties.

  1. Counterparts.  This Addendum may be executed in separate counterparts, none of which need contain the signatures of both parties, and each of which, when so executed, shall be deemed to be an original, and such counterparts shall together constitute and be one and the same instrument.

IT Policy for Practice-Provided Equipment

This policy applies only to practices that use their own laptop and scanner as part of their relationship with Dandy.

Standard Systems Policy:

To ensure the quality and consistency of case submission to Dandy Labs, you agree to comply with the following requirements regarding your IT infrastructure:

  1. You agree to use the 3Shape TRIOS 3, TRIOS 4, or TRIOS 5 intraoral scanner only.
  2. You agree to provide a consistent Wi-Fi connection of at least 15 Mbps upload and 15 Mbps download in all locations where case submission occurs.
  3. You agree to use a computer with the 3Shape intraoral scanner that meets the following system requirements:
  4. PC Minimum:

PC Recommended:

  1. You agree to upgrade the Trios software to a minimum version of 1.7.19.1.
  2. You agree to save and submit all case files to the local storage of the computer.
  3. You agree to grant EasyAccess to Splashtop to Dandy’s customer service team with a mutually agreed-upon shared password that will exist for the duration of the relationship.
  4. You agree to install the DandyUploader to a local user’s profile and you will use this local profile in connection with your use of the TRIOS software.
  5. You agree to grant permission to the following file path if you are using antivirus software:
  1. Should your practice have a network firewall, either physical or web-based, please allow all traffic on the following domains:

CANADA TERMS AND CONDITIONS

Effective: October 1, 2026

These Terms and Conditions (the “Terms”) are incorporated by reference into the Order Form between Dandy and Customer (collectively, the Order Form, the Terms, the Data Privacy Agreement, and the IT Policy, if applicable, the “Practice Agreement”). Capitalized terms used but not defined here have the meanings given in the Order Form.

  1. Dandy Offerings and Equipment. Dandy’s proprietary software platform, including Chairside, Dandy Practice Portal, digital services and support, hardware and software, and all Dandy Products are collectively referred to as “Dandy Offerings.” If applicable, Dandy provides Customer with the Equipment specified in the Order Form on a loaned basis to enable Customer to use Dandy Offerings, subject to Customer’s compliance with the terms of this Agreement. For sales tax calculation purposes only, CAD$100 of the Monthly Spend Commitment is attributable to Equipment. This allocation does not impact the Monthly Spend Commitment. Title to the Equipment remains with Dandy at all times, and Customer will not: (a) modify, alter, disassemble, or attempt to repair the Equipment (except routine cleaning); (b) remove the Equipment from Customer’s practice location without Dandy’s prior written consent; (c) remove, alter, or obscure any Dandy labels, serial numbers, or proprietary notices; or (d) grant any lien, security interest, or encumbrance on the Equipment. Customer bears all risk of loss, theft, damage, or destruction of Equipment while in Customer’s possession. Dandy will provide reasonable technical support and software maintenance for the Equipment during the Term. Customer is responsible for maintaining adequate insurance covering the Equipment. 
  2. Dandy Product Warranty. Dandy warrants that Dandy Products will be free from defects in materials, manufacturing, and workmanship as follows: (a) Fixed Products (crowns, bridges, implant crowns, implant bridges, inlays, onlays, veneers, and zirconia and titanium implant abutments) have a lifetime warranty against breakage during ordinary use due to manufacturing defects; (b) Removable Products (partial and full dentures, night guards, splints, sleep apnea devices, clear aligners, retainers, and bleaching trays) have a six (6) month warranty against wear and tear, and a ten (10) year warranty against breakage during ordinary use due to manufacturing defects. Under this warranty, Dandy will, at its sole discretion, repair or replace the defective product or refund the original purchase price. This warranty is void if: (i) the patient fails to maintain regular dental checkups; (ii) the product is modified after delivery; (iii) damage results from accident, misuse, or failure to follow Dandy’s instructions; or (iv) Customer fails to comply with the terms of the Practice Agreement. THIS WARRANTY IS EXCLUSIVE AND IN LIEU OF ALL OTHER WARRANTIES, EXPRESS OR IMPLIED, INCLUDING ANY WARRANTY OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE.
  3. Overdue Invoices; Remedies. If any amount owed by Customer is more than thirty (30) days past due, Dandy may: (a) suspend Customer’s access to Dandy Offerings until all outstanding amounts are paid in full; (b) charge interest on overdue amounts at the rate of 1.5% per month (or the maximum rate permitted by law, if less); and (c) recover all costs of collection, including reasonable attorneys’ fees. Dandy’s exercise of any remedy does not waive any other remedy available at law or under the Practice Agreement.
  4. Termination. Either party may terminate the Practice Agreement at any time by providing ten (10) days’ advance written notice to the other party. If the Practice Agreement is terminated, Customer is obligated to promptly return all Equipment. Dandy will provide shipping labels and a box to return the Equipment. If Customer fails to initiate the return of the Equipment by scheduling a UPS pickup date within thirty (30) days of receiving a return label, Dandy may invoice Customer for the full replacement cost of the Equipment at its then-current price (price list available upon request), which amount will be due immediately. If the Practice Agreement is terminated, Customer remains liable for all fees for orders placed prior to termination and for the Monthly Spend Commitment for the month in which termination occurs.
  5. Training. Dandy will provide training at no additional cost to Customer and its personnel who use Dandy Offerings. Customer is solely responsible for ensuring that its personnel are properly trained and comply with the Practice Agreement. 
  6. Medical Disclaimer. Dandy Offerings do not constitute medical, dental, or healthcare advice, diagnosis, or treatment. Customer is solely responsible for: (a) all clinical decisions, patient treatment, and patient outcomes; (b) obtaining informed consent from patients, including disclosing all relevant risks and alternatives; (c) ensuring that only licensed dental professionals authorized under applicable provincial law perform intraoral scans and related procedures; and (d) complying with all applicable federal, provincial, and local laws, regulations, and professional standards governing the practice of dentistry. Customer will not make any representations, warranties, or guarantees about Dandy Offerings to patients on behalf of Dandy. Customer acknowledges that Dandy is a dental laboratory and technology provider, not a healthcare provider.
  7. Entire Agreement. The Order Form, these Terms and Conditions, the Data Privacy Agreement, and the IT Policies (if applicable), constitute the entire agreement between the parties. Anything communicated by other means is not binding. This Practice Agreement supersedes all prior agreements between the parties.
  8. Regulatory Compliance. Each party will comply with all applicable federal, provincial, and local laws and regulations, including without limitation: (a) applicable laws governing the collection, use, disclosure and protection of personal information, including personal health information; (b) provincial dental practice legislation, professional standards and licensing requirements; and (c) the Competition Act and provincial consumer protection laws. Customer acknowledges that it is solely responsible for compliance with laws relating to the practice of dentistry and patient care. Nothing in this Practice Agreement is intended as, or shall be construed as, an inducement or incentive to prescribe, recommend, order, purchase, or use any product, service, or treatment, and Customer is solely responsible for exercising independent clinical judgment and ensuring the clinical appropriateness of any product, service, or treatment for its patients.
  9. Indemnity. Customer will indemnify, defend, and hold harmless Dandy from all claims, causes of action, damages, debts, liabilities, losses, obligations, payments, costs, and expenses (including reasonable legal expenses) arising from or relating to: (a) Customer’s breach of the Practice Agreement; (b) Customer’s acts or omissions regarding patient care, treatment, or professional services; (c) any claim by a patient or third party relating to Customer’s dental services; (d) Customer’s provision of inaccurate, incomplete, or misleading information, scans, or data to Dandy; (e) Customer’s violation of any applicable law, regulation, or professional standard, including failure to obtain proper patient consents; or (f) any regulatory or disciplinary proceedings relating to Customer’s practice.
  10. Sales Tax. Dandy will charge applicable sales taxes based on Customer’s geographic location. The sales tax amount will be shown on the monthly invoice and collected as described herein. If Customer is tax-exempt, Customer must provide a valid exemption certificate acceptable to each taxing jurisdiction where exempt status is claimed.
  11. Confidentiality. Each party will hold in confidence all non-public information received from the other party under the Practice Agreement (“Confidential Information”), use it only for purposes of the Practice Agreement, and not disclose it to third parties except to employees or contractors with a need to know who are bound by confidentiality obligations. These obligations do not apply to information that is or becomes publicly available through no fault of the receiving party, was already known to the receiving party, or is required to be disclosed by law. 
  12. Intellectual Property. Dandy retains all right, title, and interest in and to the Equipment, software, platform, technology, Dandy Offerings, and all related intellectual property. No rights are granted to Customer except the limited right to use the Dandy Offerings during the Term in accordance with the Practice Agreement. Customer retains all right, title, and interest in and to the data, information, and content Customer provides to Dandy, including patient information and scan data, subject to the licenses granted herein. If Customer provides feedback or suggestions regarding Dandy Offerings, Dandy may use such feedback without restriction or obligation to Customer. Dandy may also use Customer data, solely on an aggregated and anonymized basis, to operate, improve, and develop Dandy Offerings and related products and services.
  13. Third-Party Service Providers. Customer acknowledges and agrees that Dandy may engage third-party service providers to perform certain functions in connection with Dandy Offerings. Dandy will maintain appropriate agreements with such third-party service providers to protect Customer data. By using Dandy Offerings, Customer consents to the disclosure of Customer data to such third-party service providers as necessary to provide services to Customer.
  14. Integrated Services. Dandy may, directly or through its affiliates, provide additional products, services, or features that integrate with or supplement Dandy Offerings. Such additional products, services, or features may be governed by separate or supplemental terms, which will be made available to Customer prior to use. Customer acknowledges and agrees that Dandy and its affiliates may share Customer data among themselves as necessary to provide integrated services and to improve the overall Customer experience.
  15. Assignment; Change of Control. Customer may not transfer or assign the Practice Agreement without Dandy’s prior written consent. Any purported assignment without consent is null and void. Customer will notify Dandy in writing at least thirty (30) days before (or, if not possible, promptly upon) any ownership change, including any sale, merger, or change of control, regardless of whether the legal entity changes. Any new owner must execute a written assumption agreement covering all outstanding obligations, including unpaid balances. Upon any ownership change, Dandy may withhold consent, require a new agreement, require full payment, or terminate the Practice Agreement. The original party remains liable until Dandy confirms the transfer in writing.
  16. Bankruptcy Notice. Customer must notify Dandy in writing within five (5) business days of any bankruptcy filing, insolvency proceeding, or assignment for the benefit of creditors. Failure to provide timely notice constitutes a material breach of the Practice Agreement.
  17. Insurance. Each party will maintain, at its own expense, commercially reasonable levels of insurance sufficient to cover its obligations and liabilities under the Practice Agreement with a reputable insurance carrier(s). 
  18. Limit of Liability. Except for fraud, gross negligence, willful misconduct, Customer’s indemnification and payment obligations, and Customer’s liability for equipment, each party’s total liability under the Practice Agreement will not exceed the fees paid by Customer in the twelve (12) months preceding the claim. Neither party will be liable for any indirect, incidental, special, consequential, or punitive damages.
  19. Governing Law; Arbitration. The Practice Agreement is governed by the laws of the Province of Ontario without regard to conflicts of law principles. Any dispute, claim, or controversy arising out of or relating to the Practice Agreement or the breach, termination, enforcement, interpretation, or validity thereof, including the determination of the scope or applicability of the Practice Agreement to arbitrate, will be determined by binding arbitration in the City of Toronto before one (1) arbitrator.  The arbitration will be administered with the Canadian Arbitration Association under Ontario law.  Judgment on the award may be entered in any court having jurisdiction.
  20. Force Majeure. Neither party will be liable for any delay or failure to perform its obligations (other than payment obligations) due to causes beyond its reasonable control, including acts of God, natural disasters, war, terrorism, riots, embargoes, labor disputes, government actions, supply chain disruptions, pandemics, epidemics, or failures of third-party telecommunications or power. The affected party must provide prompt notice and use reasonable efforts to mitigate the impact.
  21. Notices. All notices under the Practice Agreement must be in writing and are effective upon: (a) personal delivery; (b) the second business day after mailing by certified mail, return receipt requested; or (c) the first business day after sending by nationally recognized overnight courier or email (with confirmation of receipt). Notices to Dandy must be sent to: Dandy Canada, Attn: Legal Department, 250 University Avenue, Suite #200, Toronto, ON M5H 3E5, with a copy to [email protected]. Notices to Customer must be sent to the address or email provided in the Order Form. Either party may change its notice address by providing notice in accordance with this Section. 
  22. Relationship of Parties. The parties are independent contractors. Nothing in the Practice Agreement creates a partnership, joint venture, agency, franchise, or employment relationship between the parties. Neither party has authority to bind the other or incur obligations on the other’s behalf.
  23. No Third-Party Beneficiaries. This Practice Agreement is for the sole benefit of the parties and their permitted successors and assigns. Nothing in the Practice Agreement confers any rights or remedies on any third party, including any patient or end user.
  24. General Provisions. No failure or delay by either party in exercising any right, power, or remedy under the Practice Agreement will operate as a waiver; no waiver is effective unless in writing. If any provision is held invalid or unenforceable, the remaining provisions will continue in full force and effect.
  25. Modifications. Dandy may modify these Terms from time to time by posting updated Terms on Dandy’s website. Customer is responsible for reviewing the Terms periodically, and continued use of Dandy Offerings after any modification constitutes acceptance.

Data Privacy Agreement

This Data Privacy Agreement (“DPA”) is incorporated into the Practice Agreement between Dandy and Customer (the “Practice Agreement”). This DPA ensures that Dandy’s processing of Personal Information and Personal Health Information complies with Applicable Laws. Capitalized terms used but not defined herein shall have the definitions set forth in the Practice Agreement.

1. Definitions

“Applicable Laws” means all laws, regulations, and regulatory guidance applicable to the collection, use, disclosure, retention, safeguarding, transfer, disposal, or other processing of Personal Information and Personal Health Information under this DPA, including, as applicable, the Personal Information Protection and Electronic Documents Act (PIPEDA), the Ontario Personal Health Information Protection Act, 2004 (PHIPA), and any other applicable federal or provincial privacy laws.

“Privacy Incident” means any unauthorized access, acquisition, use, disclosure, copying, modification, disposal, destruction, loss, theft, compromise of, or interference with Personal Information or Personal Health Information that is in the custody or control of Dandy  or its subcontractors, including any incident that constitutes a reportable breach under Applicable Laws, whether or not the incident poses a real risk of significant harm to any individual.

“Personal Health Information” or “PHI” means identifying information about an individual in oral or recorded form that relates to: (a) the physical or mental health of the individual; (b) the provision of health care to the individual; (c) payments or eligibility for health care; or (d) the individual’s health card number, and includes dental records and treatment information; or as otherwise defined by PHIPA (or as that term or a similar term is otherwise defined in applicable health privacy law).

“Personal Information” means any information about an identifiable individual, as defined under Applicable Law, other than Personal Health Information.

2. Scope and Purpose

Dandy agrees to process Personal Information and Personal Health Information only on behalf of, for the benefit of, and under the documented instructions of the Customer, except where required by Applicable Laws. Customer is the custodian, trustee, health information custodian, organization, controller, or equivalent accountable entity under Applicable Law, and Dandy acts only as Customer’s agent, affiliate, information manager, service provider, processor or equivalent service provider role with respect to any Personal Information and Personal Health Information processed under this DPA.

Dandy shall not collect, use, disclose, retain, sell, rent, commercialize, de-identify, anonymize, aggregate, re-identify, combine, or otherwise process Personal Information or Personal Health Information for any purpose other than to perform the Services described in the Practice Agreement, comply with Customer’s documented instructions, or comply with Applicable Laws. Dandy shall not use Personal Information or Personal Health Information for secondary purposes except to the extent expressly authorized in writing by the Customer or permitted by Applicable Laws.

3. Obligations of Dandy

Dandy shall comply with all Applicable Laws concerning the processing of Personal Information and Personal Health Information. . Dandy shall treat all such information as confidential and only disclose it to its employees or subcontractors who: (a) are subject to binding confidentiality and privacy obligations at least as protective as those in this DPA; (b) have a need to access such information to perform the Services; and (c) have received appropriate privacy, security, and health information training required by Applicable Laws.

If subcontractors are engaged to process Personal Information or Personal Health Information, Dandy shall: (a) enter into written agreements with such subcontractors containing data protection obligations no less protective than those in this DPA; (b) ensure the subcontractor processes information only to perform the Services and only in accordance with the Customer’s instructions; and (c) remain liable to Customer for any breach of this DPA caused by an act, error, or omission of the subcontractor to the same extent Dandy would be liable for its own acts, errors, or omissions.

Dandy stores and hosts Personal Information and Personal Health Information in Canada.  As part of normal operations, such information may be accessed or transferred outside of Canada on a routine basis. On request, Dandy shall provide Customer with information reasonably necessary to assess any such transfer, including processing locations, applicable subcontractors, categories of information affected, safeguards, contractual protections, and the potential for access by foreign courts, governments, law enforcement, or regulatory authorities. Dandy shall implement safeguards that provide a comparable level of protection to that required by Applicable Laws and shall support any notices, consents, risk assessments, privacy impact assessments, or contractual disclosures required by Customer.

Dandy will provide Customer with reasonable assistance to respond to requests by individuals to access, correct, amend, or delete their Personal Information or Personal Health Information. Dandy shall promptly direct any such requests received directly from individuals to Customer, as the health information custodian, and shall not take action with respect to any such request without instructions from Customer, except to the extent required by Applicable Laws.

Dandy will provide the Customer with reasonable notice of any intended disclosure of the Personal Information or Personal Health Information that is required by law, unless the provision of such notice would violate Applicable Laws. Should a law enforcement agency send a request to Dandy or its subcontractors regarding Personal Information or Personal Health Information, Dandy will: (a) immediately notify Customer, unless prohibited by law; (b) attempt to redirect the law enforcement agency’s request to the Customer as the health information custodian; (c) assert any available exemptions, privileges, or objections that Customer could raise if processing the request directly; (d) provide only the minimum information legally required to be disclosed; and (e) cooperate with Customer to challenge or narrow the scope of any compelled disclosure to the extent permitted by law.. 

Dandy will notify the Customer of any notice, inquiry, investigation or the receipt of a complaint from any individual or regulatory authority which relates directly or indirectly to the processing of Personal Information or Personal Health Information, and reasonably cooperate with the Customer where required by the Customer to meet its obligations under Applicable Laws.

4. Security

Dandy has implemented and will maintain appropriate administrative, technical, and physical safeguards to protect Personal Information and Personal Health Information against unauthorized access, collection, use, disclosure, copying, modification, disposal, loss, or theft. These safeguards shall be commensurate with the sensitivity of the information and shall meet or exceed any requirements prescribed by Applicable Laws and include measures relating to: (a) physical security of facilities; (b) access controls and authentication; (c) encryption of data in transit and at rest; (d) audit logging; (e) regular testing and assessment of security measures, (f) secure disposal and destruction procedures for records containing Personal Information or Personal Health Information; and (g) business continuity and disaster recovery capabilities to ensure availability and integrity of information.

5. Privacy Incidents

If Dandy becomes aware of a Privacy Incident, Dandy shall: (a) notify Customer without unreasonable delay and, in any event, within twenty-four (24) hours after discovery; (b) immediately take reasonable steps to investigate, contain, mitigate and remediate the Privacy Incident; (c) promptly provide Customer with all information reasonably necessary to determine whether the Privacy Incident is reportable under Applicable Laws, including the nature and scope of the incident, the information and individuals affected, the cause, safeguards in place, mitigation steps, remediation measures; (d) preserve evidence and maintain records of the Privacy Incident as required by Applicable Laws; (e) cooperate with Customer in any notification to individuals, regulators, professional colleges, insurers, Information and Privacy Commissioners, or other required recipients and provide reasonable assistance to Customer in meeting the timing requirements for breach reporting under Applicable Laws; (f) not notify any individual, regulator, or third party without Customer’s prior written approval unless required by Applicable Laws; and (g) implement corrective measures to prevent recurrence and report on effectiveness within a timeframe agreed with Customer..

6. Compliance

Upon request by the Customer, Dandy will make available to Customer information demonstrating and verifying that Dandy uses the Personal Information and Personal Health Information in a manner consistent with its obligations under this DPA and Applicable Laws. Upon request by Customer, Dandy shall reasonably cooperate with Customer in privacy impact assessments, threat risk assessments, security reviews, regulatory inquiries, patient or individual requests, complaints to Information and Privacy Commissioners, and audits relating to the Services, subject to reasonable confidentiality, security, and operational restrictions.

7. Customer Responsibilities

Customer acknowledges that, as the health information custodian or equivalent accountable entity under Applicable Laws, Customer is responsible for obtaining and documenting all necessary consents from individuals for the collection, use, and disclosure of their Personal Information and Personal Health Information as required by Applicable Laws, including consent to transfer outside of Customer’s jurisdiction if required by Applicable Laws. Customer is also responsible for providing individuals with notice of the purposes for the collection, use, and disclosure of their Personal Information and Personal Health Information, including notice that a service provider or agent may process such information on Customer’s behalf.  Customer shall ensure that the Personal Information and Personal Health Information provided to Dandy is accurate, complete, and up-to-date to the extent necessary for the purposes for which it is processed.

Customer is responsible for responding to access, correction, and other requests from individuals in accordance with Applicable Laws, and providing Dandy with timely instructions regarding the handling of any such requests received by Dandy.  Customer shall comply with all breach notification and reporting obligations under Applicable Laws.

8. General

This DPA shall remain in force until the earlier of: (a) the termination or expiry of the Practice Agreement; or (b) Dandy ceasing to process Personal Information and Personal Health Information. Upon termination or expiry, Dandy shall, at Customer’s election, either return all Personal Information and Personal Health Information to Customer or securely destroy such information and certify in writing that destruction has been completed, except to the extent Applicable Laws require retention. Any retained information shall remain subject to this DPA and shall be isolated, protected, and processed only as required by Applicable Laws.

If any part of this DPA is found by any court or administrative body of competent jurisdiction to be invalid, unenforceable, or illegal, the other terms shall remain in force. Any invalid, unenforceable, or illegal term will be interpreted to give effect to the parties’ commercial intention. If that is not possible, it will be severed but the rest shall remain in full force.

In the event of conflict between this DPA and the terms of the Practice Agreement, this DPA shall prevail to the extent the conflict concerns the processing of Personal Information or Personal Health Information.

Dandy’s total aggregate liability for any claims arising under or in connection with this DPA is subject to and limited by the limitations on liability contained in the Practice Agreement.

This DPA shall be interpreted as broadly as necessary to implement and comply with Applicable Laws. Any ambiguity shall be resolved in favor of compliance with Applicable Laws.

This DPA shall be governed by the laws of the Province of Ontario and the federal laws of Canada applicable therein, without regard to conflicts of law principles.

IT Policy for Practice-Provided Equipment

This policy applies only to practices that use their own laptop and scanner as part of their relationship with Dandy.

Standard Systems Policy:

To ensure the quality and consistency of case submission to Dandy Labs, you agree to comply with the following requirements regarding your IT infrastructure:

1. You agree to use the 3Shape TRIOS 3, TRIOS 4, or TRIOS 5 intraoral scanner only.

2. You agree to provide a consistent Wi-Fi connection of at least 15 Mbps upload and 15 Mbps download in all locations where case submission occurs.

3. You agree to use a computer with the 3Shape intraoral scanner that meets the following system requirements:

4. PC Minimum:

PC Recommended:

1. You agree to upgrade the Trios software to a minimum version of 1.7.19.1.

2. You agree to save and submit all case files to the local storage of the computer.

3. You agree to grant EasyAccess to Splashtop to Dandy’s customer service team with a mutually agreed-upon shared password that will exist for the duration of the relationship.

4. You agree to install the DandyUploader to a local user’s profile and you will use this local profile in connection with your use of the TRIOS software.

5. You agree to grant permission to the following file path if you are using antivirus software:

6. Should your practice have a network firewall, either physical or web-based, please allow all traffic on the following domains:

United Kingdom Terms of Service, including Data Privacy Agreement

These Terms & Conditions (“Terms”) to the Practice Agreement (“Agreement”) are entered into by and between Zima Labs GB Ltd. d/b/a Dandy (“Dandy” or “we”) and you and your dental practice or office (“You”) and are effective as of the date the Practice Agreement is entered into (“Effective Date”). If you accept these Terms on behalf of an entity, partnership, corporation, or organization, “you” includes you, that entity, and all entity users and you hereby represent that you have the authority to bind all such users. Dandy and you will each be referred to as a “Party” and together, the “Parties.”  For good and valuable consideration as set forth in the Agreement, the Parties agree to the following:

1. Amendment. These Terms and the Agreement cannot be changed unless both Parties agree in writing. Dandy will notify You of any material changes. Changes become effective thirty (30) days after notification unless You terminate in writing. In such cases, Dandy will honor existing terms for 60 days or until the Hardware is returned.

2. Entire Agreement. The Practice Agreement, these Terms, the Data Privacy Agreement (Schedule A), and the IT Policy constitute the entire agreement. This Agreement supersedes all prior conflicting agreements.

3. Non-assignability. You may not transfer or assign this Agreement to a third party without Dandy’s prior written consent.

4. Legal Compliance. Both Parties agree to comply with all applicable health and data laws in the United Kingdom, including the UK GDPR, the Data Protection Act 2018,relevant NHS/GDC regulatory standards, and the Care Quality Commission (CQC).

5. Indemnity. You will indemnify, defend, and hold harmless Dandy from all claims or losses arising from: (a) Your breach of this Agreement or the DPA; (b) negligence or willful acts regarding patient care; (c) provision of incorrect clinical data; and (d) dealings with UK regulators (e.g., CQC, GDC, or the ICO).

6. Governing Law & Dispute Resolution. This Agreement is governed by the laws of England and Wales. Any disputes shall be resolved through arbitration under the Rules of the London Court of International Arbitration (LCIA). The seat of arbitration shall be London.

7. VAT & Tax. Dandy will charge Value Added Tax (VAT) at the prevailing rate, where applicable. If You are exempt, You must provide a valid VAT exemption certificate or evidence satisfactory to HMRC.

8. Data Privacy.  Because Dandy processes Special Category Data (Personal Health Data) on Your behalf, the Data Privacy Agreement (DPA) at Schedule A is a mandatory and integral part of this Agreement.

Data Protection Roles. The Parties acknowledge that:

Data Protection Contact. Any privacy-related notices or requests under this Agreement should be directed to Dandy’s Data Protection Officer (DPO) Tony Riesen at [email protected].

Schedule A: Data Privacy Agreement

This DPA is incorporated into the Agreement where Dandy acts as a Processor on behalf of the Practice (Controller). The nature, purpose, and duration of the processing are set out in Appendix 1 (Data Processing Details).

1. Definitions

2. Subject Matter & Instructions

Dandy shall process Personal Data only on the documented instructions of the Controller (the Practice), including with regard to transfers of personal data to a third country, unless required to do so by UK law. If Dandy believes any instruction infringes Applicable Laws, it shall immediately inform the Controller.

The Controller shall ensure it has a lawful basis for all sharing of Personal Data and a lawful ground for processing all Special Category Data.

3. Obligations of Dandy (The Processor)

4. International Transfers

Dandy shall not transfer Personal Data outside the UK or the EEA unless it ensures that the transfer is subject to “appropriate safeguards” (such as the UK International Data Transfer Agreement (IDTA) or an adequacy decision of the UK government).

5. Breach Notification

Dandy shall notify the Controller without undue delay (and in any event within 48 hours) after becoming aware of a Personal Data Breach affecting Personal Data, providing sufficient information to allow the Controller to meet any reporting obligations to the relevant data protection authority.

6. Deletion or Return

At the choice of the Controller, Dandy shall delete or return all Personal Data to the Controller after the end of the provision of services, and delete existing copies unless UK law requires storage.

APPENDIX 1: DATA PROCESSING DETAILS

EU Spaans

Estos términos y condiciones adicionales (“Términos”) al Acuerdo de Colaboración, incluida la Política de Privacidad de la UE y el Acuerdo de Privacidad (conjuntamente, el “Acuerdo”) se celebran entre Dandy Labs Europe SAS (“Dandy” o “Nosotros”) y usted y su consulta o clínica dental (“Usted” o la “Consulta”), y entran en vigor en la fecha en que se celebre el Acuerdo (“Fecha de Entrada en Vigor”). Si Usted acepta el Acuerdo en nombre de una entidad, sociedad, corporación u organización, “Usted” le incluye a Usted, a dicha entidad y a todos los usuarios de la entidad, y Usted declara que tiene autoridad para vincular a todos dichos usuarios. Dandy y Usted serán denominados individualmente como “Parte” y conjuntamente como las “Partes”. Los términos definidos en el presente documento o en cualquier otra parte del Acuerdo tendrán el significado que se les atribuya en todo el Acuerdo. Por la contraprestación válida y suficiente establecida en el Acuerdo de Consulta, las Partes acuerdan lo siguiente:

1. Facturación y pagos: Todos los importes pagaderos en virtud del presente Acuerdo se expresan en euros y solo podrán abonarse mediante transferencia en euros (corriendo a su cargo las comisiones de cambio de divisa y las comisiones bancarias, en su caso) y son exclusivos del Impuesto sobre el Valor Añadido (IVA) aplicable, que, cuando proceda, se cargará adicionalmente a los importes facturados y será abonado por Usted, previa recepción de una factura válida conforme a la legislación aplicable). Aceptamos pagos mediante Adeudo Directo SEPA, transferencia bancaria, tarjeta de débito o tarjeta de crédito, y Usted está obligado a mantener un método de pago válido registrado en todo momento. El cumplimiento del plazo de pago es esencial. Sin perjuicio de lo anterior, las Partes acuerdan que todas las facturas se abonarán en un plazo máximo de treinta (30) días desde la fecha de recepción de la factura o, si fuera posterior, desde la fecha de recepción de los bienes o servicios. Los descuentos y promociones no podrán utilizarse para pagar costes de procesamiento, envío, cancelación u otros cargos. Dandy tiene derecho a cobrar (y Usted se compromete a pagar) el importe máximo de intereses permitido por la legislación aplicable, o el 1,5 % mensual si la legislación aplicable no especifica ninguno. Los intereses se devengarán diariamente desde la fecha de vencimiento hasta el pago efectivo, ya sea antes o después de una resolución judicial. Dandy no acepta cheques en papel, tarjetas de crédito prepago, pagos entre particulares ni criptomonedas como métodos de pago válidos. En caso de que Usted tenga saldos impagados durante 60 días o más, o el importe adeudado a Dandy sea de 10.000 euros o superior, Dandy se reserva el derecho de suspender su cuenta hasta que se abonen todos los saldos pendientes. En caso de impago continuado, Dandy podrá cancelar o suspender cualquiera o todos los acuerdos con Usted, lo que no extinguirá la deuda ni el devengo de intereses. Se espera que Usted gestione las expectativas de sus pacientes en relación con los plazos de suministro de los Productos Dandy pedidos para ellos.

Salvo lo dispuesto a continuación, cada Parte será la única responsable de sus propias obligaciones fiscales derivadas del presente Acuerdo. Todos los pagos que Usted realice en virtud del presente Acuerdo se efectuarán sin deducción ni retención de impuestos, salvo que así lo exija la Legislación Aplicable. En la medida en que cualquier pago en virtud del presente Acuerdo genere para Usted la obligación de deducir, retener o ingresar cualquier importe a cualquier autoridad gubernamental conforme a la legislación aplicable, los importes adeudados y pagaderos en virtud del presente Acuerdo se incrementarán de modo que Nosotros recibamos un importe igual al que habríamos recibido de no haberse efectuado dicha deducción o retención. A efectos de declaración, Usted se compromete a entregar a Dandy la prueba de que dichos impuestos fueron abonados a una autoridad gubernamental, incluido el original o una copia compulsada del recibo emitido por dicha autoridad que acredite el pago.

Usted reconoce además que Dandy ha comunicado la posibilidad de que se apliquen comisiones de procesamiento y ha ofrecido la oportunidad de formular cualquier pregunta sobre dichas comisiones antes de celebrar el presente Acuerdo. Usted se compromete a indemnizar y mantener indemne a Dandy frente a cualesquiera reclamaciones, daños o pérdidas derivados de los recargos impuestos por proveedores de servicios de terceros. Dandy se reserva el derecho de modificar los precios de los Productos Dandy (definidos a continuación) en cualquier momento, previa notificación con 45 días de antelación. Usted acepta que no tendrá derecho de compensación, reconvención, deducción ni retención frente a los importes adeudados por Dandy a Usted. Usted acepta que Dandy podrá, en cualquier momento y sin perjuicio de cualesquiera otros derechos o recursos de los que disponga, compensar cualquier importe adeudado por Usted con cualquier importe pagadero por Dandy a Usted. Dandy no acepta pagos de pacientes, incluidos los pagos a nombre del paciente remitidos por Usted.

2. Equipamiento. El riesgo de pérdida, robo, daño o destrucción del Equipamiento se transmitirá a Usted en el momento de la Entrega. El Equipamiento permanecerá bajo su exclusivo riesgo durante la vigencia del presente Acuerdo y durante cualquier período adicional en el que el Equipamiento esté en su posesión, custodia o control (el “Período de Riesgo”) hasta que el Equipamiento sea devuelto a Dandy. Usted deberá notificar inmediatamente por escrito a Dandy cualquier pérdida, accidente o daño del Equipamiento que se produzca en relación con su posesión o uso del mismo.

3. Requisitos informáticos. Usted se compromete a proporcionar y mantener una conexión a internet de alta velocidad para su uso en relación con el Equipamiento, y se compromete a cumplir las políticas informáticas incluidas en los términos y condiciones en línea.

4. Indemnización: Usted se compromete a indemnizar, mantener indemne, defender y eximir de responsabilidad a Dandy frente a cualesquiera reclamaciones, causas de acción, daños, deudas, responsabilidades, pérdidas, obligaciones, pagos, costes y gastos (incluidos gastos jurídicos) que se deriven de o estén relacionados con: (a) el incumplimiento por parte de Usted de cualquier término de cualquier acuerdo con Dandy; (b) el incumplimiento por parte de Usted de cualquier término de cualquier acuerdo entre Usted y su paciente o cualesquiera actos u omisiones respecto de un paciente (incluidas las actuaciones de cualquier organismo profesional que le regule a Usted o de cualquier regulador o entidad otorgante de licencias nacional); y (c) la aportación por parte de Usted de información, documentos, escaneados o impresiones incorrectos o incompletos, o la falta de suministro oportuno a Dandy de cualquier información que le solicitemos.

5. Cambio de control de la Consulta: Si su Consulta dental experimenta un cambio de control desde el punto de vista de la titularidad, Usted se compromete a informar a Dandy mediante notificación escrita con un mínimo de cinco días hábiles de antelación a la fecha en que dicho cambio de control sea efectivo. A los efectos de esta cláusula, una situación de “Cambio de Control” incluirá cualquier operación o serie de operaciones que resulten en un cambio en la titularidad directa o indirecta de más del cincuenta por ciento (50 %) de los derechos de voto o del capital social de su Consulta dental, o cualquier fusión, consolidación o venta de la totalidad o sustancialmente la totalidad de sus activos.

6. Aviso legal médico: Su Consulta es la única responsable del tratamiento de los pacientes que utilicen cualquier Producto Dandy, así como de facilitar a sus pacientes toda la información pertinente sobre los Productos Dandy y cualquier riesgo asociado antes y después del tratamiento. Los Productos Dandy se ofrecen únicamente como complemento a su Consulta dental y no constituyen asesoramiento médico, odontológico ni sanitario de otra índole, ni diagnóstico o tratamiento para sus pacientes. Usted se compromete a no realizar declaraciones ni ofrecer garantías respecto de los Productos Dandy a sus pacientes. Usted declara ante Dandy que su Consulta cumplirá con toda la legislación aplicable, normativa, directrices y códigos de conducta profesionales relativos a los profesionales autorizados para ejercer la odontología y realizar escáneres intraorales a los pacientes de la Consulta. Salvo que se disponga expresamente lo contrario en el presente documento, los productos Dandy que se le proporcionan en virtud del mismo se facilitan “TAL CUAL” y se suministran conforme a su prescripción para el paciente individual.

Las Partes reconocen que el presente Acuerdo no crea ninguna relación contractual directa entre Dandy y sus pacientes. Cualesquiera reclamaciones, demandas o acciones interpuestas por un paciente o un organismo regulador derivadas de sus decisiones clínicas, gestión del tratamiento, errores de prescripción o suministro de datos defectuosos (tales como escáneres o impresiones defectuosas) estarán sujetas a sus obligaciones plenas de indemnización conforme a lo establecido en la sección 4.     

Usted se compromete a cumplir con sus obligaciones en virtud del Reglamento (UE) 2017/745           relativo a los productos sanitarios en la medida en que sea aplicable. Usted se compromete a gestionar todas las comunicaciones y demás actividades relacionadas con cualquier retirada del mercado u otra actividad regulatoria de conformidad con todas nuestras instrucciones razonables y a no contactar ni comunicarse de otro modo con una autoridad competente sin consultar previamente con nosotros. Esta obligación, así como las disposiciones de indemnización relacionadas de la sección 5 de los Términos y Condiciones en Línea, sobrevivirán a la terminación del presente Acuerdo de Consulta durante el período en que los productos sanitarios suministrados por nosotros permanezcan en uso.

7. Modificación. Los presentes Términos y el Acuerdo podrán modificarse por acuerdo escrito mutuo de las Partes. Los presentes Términos y el Acuerdo podrán ser modificados de otro modo por Dandy, que le notificará cualquier cambio sustancial. Dichos cambios sustanciales entrarán en vigor 30 días después de la notificación, salvo que Usted resuelva el Acuerdo mediante notificación escrita dentro de dicho plazo. En tales casos, Dandy respetará los Términos vigentes durante 60 días o hasta la devolución del Equipamiento.

8. Acuerdo íntegro. El Acuerdo de Colaboración, los presentes Términos, la Política de Privacidad de la UE, el Acuerdo de Privacidad (Anexo A) y la Política Informática constituyen el “Acuerdo”. El presente Acuerdo sustituye a todos los acuerdos anteriores que resulten contradictorios.

9. Intransferibilidad. Usted no podrá transferir ni ceder el Acuerdo a un tercero sin el consentimiento previo por escrito de Dandy.

10. Cumplimiento legal. Ambas Partes se comprometen a cumplir con toda la legislación sanitaria y de protección de datos aplicable en la jurisdicción en la que Usted y Dandy estén establecidos, las normas regulatorias pertinentes emitidas por las autoridades europeas y nacionales, y las directrices emitidas por los organismos reguladores profesionales.

11. Indemnización. Usted indemnizará, defenderá y mantendrá indemne a Dandy frente a todas las reclamaciones o pérdidas derivadas de: (a) su incumplimiento del Acuerdo; (b) negligencia o actos dolosos en relación con la atención al paciente; (c) aportación de datos clínicos incorrectos; y (d) relaciones con reguladores de la UE o nacionales.

12. Legislación aplicable y jurisdicción. 

  1. Legislación aplicable. Usted acepta que el Acuerdo se regirá e interpretará de conformidad con la legislación de la jurisdicción en la que esté establecida la Consulta. 
  2. Jurisdicción. Cualesquiera controversias que surjan de o en relación con el Acuerdo se someterán a la jurisdicción exclusiva de los tribunales de la jurisdicción aplicable en la que esté establecida la Consulta, según se indica en la tabla siguiente.
PaísJurisdicción
FranciaTribunaal voor Economische Activiteiten van Parijs
IrelandCourts of Dublin 
ItaliaTribunal de Milán
The NetherlandsThe competent court in Amsterdam, the Netherlands
EspañaJuzgados y Tribunales de Madrid

13. IVA e Impuestos. Dandy cargará el Impuesto sobre el Valor Añadido (“IVA”) al tipo aplicable, además de cualquier precio, cargo o importe adeudado en virtud del Acuerdo, y dicho IVA será pagadero por Usted, cuando proceda. Si Usted está exento, deberá aportar un certificado válido de exención de IVA o prueba satisfactoria para la administración tributaria correspondiente, cuando esté disponible, o justificar la base de la exención de IVA.

14. Privacidad de Datos. Dado que Dandy trata datos personales, incluidos datos de salud (“Datos Personales”) en su nombre.

Funciones en materia de Protección de Datos. Las Partes reconocen que:

Contacto de Protección de Datos. Cualquier notificación o solicitud relacionada con la privacidad en virtud del presente Acuerdo deberá dirigirse a Dandy a [email protected]

Anexo A: Acuerdo de Privacidad de Datos (“APD”)

El presente APD se incorpora al Acuerdo cuando Dandy actúa como encargado del tratamiento en nombre de la Consulta como responsable del tratamiento. La naturaleza, finalidad y duración del tratamiento se establecen en el Apéndice 1 (“Detalles del Tratamiento de Datos”).

1. Definiciones

●      “Legislación Aplicable” significa toda la legislación aplicable que rige el tratamiento y la seguridad de los Datos Personales, así como la privacidad de las comunicaciones electrónicas, incluidos, sin carácter limitativo, (i) el Reglamento (UE) 2016/679 de 27 de abril de 2016 (el RGPD), (ii) la Directiva 2002/58/CE de 12 de julio de 2002 (la Directiva sobre la Privacidad y las Comunicaciones Electrónicas), (iii) la legislación nacional de transposición y complementaria de la legislación de la UE mencionada en esta definición, y (iv) las disposiciones pertinentes de las leyes sanitarias nacionales, cada una de (i) a (iv) según sean modificadas y/o complementadas en cada momento.

●      “Violación de Datos Personales” significa cualquier violación de la seguridad que ocasione la destrucción, pérdida, alteración, divulgación no autorizada o acceso accidental o ilícito a Datos Personales, o cualquier otro evento que afecte a la integridad, disponibilidad o confidencialidad de los Datos Personales.

●      “Categorías Especiales de Datos” significa las categorías de Datos Personales contempladas en el Artículo 9 del RGPD (incluidos, entre otros, los Datos Personales relativos a la salud, datos biométricos o datos utilizados con el fin de identificar de manera unívoca a una persona física y datos genéticos).

●      “Datos Personales” significa los datos personales (según la definición del RGPD) tratados por Dandy en nombre de la Consulta.

●      “Interesado” tiene el significado atribuido en el RGPD.

●      “Autoridad de Control” significa una autoridad de supervisión de protección de datos que tenga jurisdicción sobre el Tratamiento de Datos Personales por parte de la Consulta.

●      “CCT” significa las cláusulas contractuales tipo para la transferencia de datos personales a terceros países establecidas en la Decisión de la Comisión 2021/914 de 4 de junio de 2021, según sean modificadas, actualizadas o sustituidas en cada momento.

●      “Tercer País” significa cualquier país o territorio fuera del ámbito de aplicación de la legislación de protección de datos del Espacio Económico Europeo, excluidos los países o territorios aprobados por la Comisión Europea como garantes de un nivel adecuado de protección de los datos personales en cada momento.

●      “Marco de Privacidad de Datos” significa, según corresponda, el Marco de Privacidad de Datos UE-EE. UU. administrado por el Departamento de Comercio de EE. UU. y aprobado por la Comisión Europea como garante de un nivel adecuado de protección de los datos personales a los efectos del Artículo 45 del RGPD, según esté vigente, sea modificado, consolidado, refundido o sustituido en cada momento.

2. Objeto e Instrucciones

Dandy tratará los Datos Personales únicamente siguiendo las instrucciones documentadas de la Consulta, incluso en lo que respecta a las transferencias de Datos Personales a un Tercer País, salvo que así lo exija la Legislación Aplicable a la que esté sujeto Dandy; en tal caso, Dandy informará a la Consulta de dicho requisito legal antes del Tratamiento, salvo que dicha legislación prohíba dicha información por razones importantes de interés público. Si Dandy considera que alguna instrucción infringe la Legislación Aplicable, informará inmediatamente a la Consulta y tendrá derecho a suspender la ejecución de la instrucción pertinente hasta que la Consulta la confirme, modifique o retire. Cualquier instrucción verbal deberá ser confirmada por la Consulta por escrito sin demora indebida.

La consulta deberá asegurarse de disponer de una base jurídica válida conforme al Artículo 6 del RGPD para el tratamiento de Datos Personales, así como de una excepción conforme al Artículo 9 del RGPD para el tratamiento de Categorías Especiales de Datos, en el contexto contemplado en el presente APD.

3. Obligaciones de Dandy (el “Encargado del Tratamiento”)

●      Confidencialidad: Dandy se asegurará de que su personal autorizado para tratar los Datos Personales se haya comprometido a guardar confidencialidad o esté sujeto a una obligación legal de confidencialidad adecuada.

●      Derechos de los Interesados: Dandy asistirá a la Consulta mediante medidas técnicas y organizativas apropiadas para el cumplimiento de la obligación de la Consulta de atender las solicitudes de ejercicio de los derechos de los Interesados, incluidos los derechos de rectificación, supresión, limitación del tratamiento, acceso, portabilidad de datos, oposición y el derecho a no ser objeto de decisiones automatizadas. Dandy responderá a cualquier solicitud de este tipo de la Consulta sin demora indebida.

●      Asistencia: Cada Parte prestará a la otra la asistencia razonable necesaria para cumplir con sus respectivas obligaciones en virtud de la Legislación Aplicable, incluidas las relativas a la seguridad del tratamiento, la notificación de una Violación de Datos Personales a la autoridad de protección de datos competente y/o a los Interesados, la elaboración de evaluaciones de impacto en la protección de datos, la Consulta previa con la autoridad de protección de datos competente y cualquier evaluación, Consulta, notificación o investigación por parte de una Autoridad de Control. Sin perjuicio de lo anterior, la Consulta cooperará con Dandy de buena fe en relación con cualquier Consulta, auditoría o investigación regulatoria relacionada con el tratamiento de Datos Personales por parte de Dandy en virtud del presente APD.

●      Seguridad: Dandy implementará medidas técnicas y organizativas apropiadas para garantizar un nivel de seguridad adecuado al riesgo, teniendo en cuenta el estado de la técnica, los costes de implementación y la naturaleza, el alcance, el contexto y la finalidad del Tratamiento, según se detalla en el Apéndice 2. Dandy podrá actualizar o modificar las medidas de seguridad establecidas en el Apéndice 2 en cada momento, siempre que dichas actualizaciones o modificaciones no reduzcan sustancialmente el nivel general de protección otorgado a los Datos Personales.

●      Auditoría e Inspección: Dandy, previa solicitud escrita de la Consulta, facilitará periódicamente a la Consulta la información razonablemente necesaria para demostrar el cumplimiento de las obligaciones establecidas en el presente Acuerdo. Dandy contribuirá a las auditorías, incluidas las inspecciones de las instalaciones, sistemas, equipos e infraestructuras de tratamiento de datos de Dandy, realizadas por la Consulta o por un auditor independiente en posesión de las cualificaciones profesionales requeridas y sujeto a un deber de confidencialidad, designado por la Consulta (“Auditorías Presenciales”). Las Auditorías Presenciales se realizarán previa notificación escrita a Dandy con 60 días de antelación (o con un plazo menor cuando así lo exija una Autoridad de Control o tras una Violación de Datos Personales u otro asunto de urgencia), no más de una vez por año natural (salvo que lo exija una Autoridad de Control o tras una Violación de Datos Personales u otro asunto de urgencia). Las Partes harán esfuerzos razonables para garantizar que las Auditorías Presenciales se realicen durante el horario comercial habitual de Dandy y no afecten de manera desproporcionada a las operaciones de Dandy. La Consulta correrá con los costes de las Auditorías Presenciales, salvo cuando una auditoría revele un incumplimiento material por parte de Dandy de sus obligaciones en virtud del presente APD.

4. Subencargados del Tratamiento

4.1 La Consulta otorga por la presente a Dandy una autorización general por escrito para contratar a los subencargados del tratamiento enumerados en el centro de confianza de Dandy, disponible en https://trust.meetdandy.com/subprocessors, y sujeto a la presente cláusula 4.

4.2 Si Dandy designa un nuevo subencargado del tratamiento o tiene la intención de realizar cambios relativos a la adición o sustitución de los subencargados del tratamiento, lo notificará a la Consulta con 20 días hábiles de antelación por escrito, durante los cuales la Consulta podrá oponerse a la designación o sustitución por motivos razonables y documentados relacionados con la confidencialidad o seguridad de los Datos Personales o con el cumplimiento de la Legislación Aplicable por parte del subencargado. Si la Consulta no se opone, Dandy podrá proceder con la designación o sustitución. Si la consulta se opone y Dandy no puede atender razonablemente la objeción, la Consulta podrá resolver el presente APD y el Acuerdo mediante notificación escrita. Dandy se asegurará de tener un acuerdo por escrito con todos los subencargados del tratamiento que imponga a estos obligaciones no menos rigurosas que las obligaciones de Dandy en virtud del presente APD.

5. Obligaciones de la Consulta

5.1 La Consulta declara y garantiza que: (i) la legislación que le es aplicable no impide a Dandy cumplir las instrucciones recibidas de la Consulta ni desempeñar las obligaciones de Dandy en virtud del presente APD; y (ii) ha cumplido y continúa cumpliendo con la Legislación Aplicable, en particular que ha obtenido los consentimientos necesarios o ha realizado las notificaciones pertinentes, y que cuenta con una base legítima para comunicar los datos a Dandy y permitir el Tratamiento de los Datos Personales por parte de Dandy conforme a lo establecido en el presente APD.

5.2 La Consulta acepta que indemnizará y mantendrá indemne a Dandy, a su requerimiento, frente a todas las reclamaciones, responsabilidades, costes, gastos, pérdidas o daños (incluidos daños consecuenciales, lucro cesante y daño reputacional, así como todos los intereses, sanciones, costes jurídicos y otros gastos profesionales) en los que incurra Dandy como consecuencia directa o indirecta de un incumplimiento de la presente cláusula 5.

6. Cambios en la Legislación Aplicable

Las Partes acuerdan negociar de buena fe las modificaciones del presente APD cuando sean necesarias para que Dandy pueda seguir tratando los Datos Personales conforme a lo contemplado en el presente APD en cumplimiento de la Legislación Aplicable, incluyendo (i) para cumplir con el RGPD o cualquier legislación nacional de transposición, y cualquier directriz sobre la interpretación de sus respectivas disposiciones; (ii) si las CCT u otros mecanismos o decisiones de adecuación son invalidados o modificados; o (iii) si los cambios en el estatus de membresía de un país en la Unión Europea o en el Espacio Económico Europeo requieren dicha modificación.

7. Transferencias Internacionales

Dandy no transferirá Datos Personales fuera del Espacio Económico Europeo salvo que garantice que la transferencia esté sujeta a garantías adecuadas de conformidad con el Artículo 46 del RGPD. Dichas garantías adecuadas podrán incluir: (a) una decisión de adecuación de la Comisión Europea conforme al Artículo 45 del RGPD; (b) CCT adoptadas por la Comisión Europea conforme al Artículo 46(2)(c) del RGPD; (c) certificación en virtud del Marco de Privacidad de Datos UE-EE. UU.; o (d) cualquier otro mecanismo de transferencia válido conforme a la Legislación Aplicable.

8. Notificación de Violación de Datos Personales

Dandy notificará a la Consulta sin demora indebida (y en todo caso en un plazo de 72 horas) después de tener conocimiento de una Violación de Datos Personales, proporcionando información suficiente para permitir a la Consulta cumplir con sus obligaciones de notificación a la autoridad de protección de datos competente. Se facilitará información adicional sobre la Violación de Datos Personales de forma progresiva a medida que se disponga de más detalles.

9. Supresión o Devolución 

A elección de la Consulta, Dandy suprimirá o devolverá todos los Datos Personales a la Consulta tras la finalización de la prestación de los servicios y suprimirá las copias existentes, salvo que la Legislación Aplicable exija su conservación continuada.

APÉNDICE 1: DETALLES DEL TRATAMIENTO DE DATOS

●      Objeto y finalidad: La prestación de los servicios a Usted en virtud del Acuerdo de Consulta.

●      Naturaleza: Recepción, almacenamiento seguro y transmisión de escáneres dentales y registros clínicos enviados por el Responsable a través de la plataforma Dandy; alojamiento en la nube de datos de pacientes y expedientes; modelado 3D, diseño digital y fabricación de prótesis dentales; gestión de casos y enrutamiento de flujos de trabajo; transmisión posterior de datos de casos a los subencargados autorizados de Dandy para fines de diseño y fabricación; devolución de resultados digitales de casos (p. ej., archivos de diseño y planes de tratamiento) al Responsable; atención al cliente y comunicación de casos; y procesamiento de envíos y logística para la entrega de restauraciones dentales acabadas al Responsable.

●      Duración: La vigencia del Acuerdo de Consulta más el período hasta la supresión de todos los datos.

●      Categorías de interesados: Pacientes y usuarios finales autorizados de la Consulta.

●   Tipos de Datos Personales: Nombres, direcciones de correo electrónico, direcciones postales, números de colegiación profesional y datos de salud de los pacientes (incluidos, entre otros, datos de citas, registros clínicos y escáneres dentales).

●      Datos sensibles y garantías aplicadas: Datos de salud de los pacientes (categoría especial de datos conforme al Artículo 9 del RGPD). Las garantías aplicadas incluyen: limitación estricta de la finalidad a la prestación de servicios de laboratorio dental; restricciones de acceso únicamente al personal autorizado; cifrado de datos en tránsito y en reposo; registro de los accesos a datos de pacientes; y restricciones a las transferencias ulteriores salvo las permitidas en virtud del presente APD.

●      Frecuencia de la transferencia: Continua, dado que los escáneres dentales y los registros clínicos se transmiten de forma continuada como parte de los servicios.

●   Tratamiento por subencargados: Los subencargados del tratamiento podrán tratar Datos Personales con fines de alojamiento en la nube, almacenamiento de datos y servicios de infraestructura informática. El objeto, la naturaleza y la duración del tratamiento por los subencargados serán coherentes con el tratamiento descrito anteriormente y no excederán la vigencia del Acuerdo de Consulta. La lista de subencargados autorizados está disponible en el Centro de Confianza de Dandy en https://trust.meetdandy.com/subprocessors.

APÉNDICE 2: MEDIDAS DE SEGURIDAD

●  Gobernanza y personal. Responsabilidad definida en materia de seguridad de la información en toda la plantilla, dispositivos e infraestructura; políticas documentadas que cubren el uso aceptable, el control de acceso, la respuesta ante incidentes, la continuidad del negocio y la gestión de riesgos, revisadas periódicamente; y evaluaciones de riesgos periódicas, repetidas ante cambios materiales en los Servicios. El personal es verificado cuando lo permite la legislación aplicable, está sujeto a obligaciones escritas de confidencialidad, se le concede y revoca el acceso a través de procesos establecidos de incorporación y desvinculación con revocación inmediata tras la finalización o el cambio de funciones, y recibe formación en seguridad y protección de datos en el momento de su contratación y de forma periódica posterior.

●  Control de acceso. Acceso a los Datos Personales basado en roles, con privilegios mínimos y necesidad de conocer, con autenticación multifactor y credenciales individualmente atribuibles requeridas para los sistemas de producción, cuentas de producción compartidas prohibidas, credenciales de sistemas y servicios gestionadas mediante mecanismos controlados, derechos de acceso revisados periódicamente y acceso a los Datos Personales registrado y verificable.

●  Cifrado y protección de datos. Datos Personales cifrados en tránsito mediante TLS 1.2 o superior y en reposo mediante AES-256 o algoritmos equivalentes estándar de la industria, con claves gestionadas mediante procesos controlados que proporcionan acceso restringido y rotación periódica. Los datos de los clientes están separados lógicamente en entornos multiinquilino, limitados a lo que requieren los Servicios, y seudonimizados cuando es compatible; los datos de producción no se utilizan en entornos de desarrollo ni de pruebas.

●  Infraestructura, dispositivos y seguridad del desarrollo. Protección perimetral, segmentación de red, protección contra denegación de servicio y autenticación multifactor para el acceso administrativo; monitorización y alertas en la infraestructura de producción, con registros de auditoría conservados y protegidos contra acceso, modificación y eliminación no autorizados; y líneas base de configuración gestionadas con gestión de cambios que requiere revisión y aprobación documentada antes del despliegue en producción. Los dispositivos están gestionados de forma centralizada y sujetos a controles de protección contra malware, cifrado y aplicación de parches. Un ciclo de vida de desarrollo seguro documentado prevé la revisión de código, pruebas de seguridad automatizadas del código de aplicación y dependencias de terceros, separación de entornos y despliegue controlado, con el respaldo de pruebas periódicas de penetración independientes cuyos hallazgos se rastrean hasta su corrección.

●  Resiliencia y respuesta ante incidentes. Infraestructura de alojamiento redundante, copias de seguridad periódicas de los Datos Personales con pruebas periódicas de los procedimientos de restauración, y un plan de continuidad del negocio y recuperación ante desastres revisado y probado periódicamente. Un proceso documentado de respuesta ante incidentes prevé la identificación, escalado y corrección de incidentes de seguridad, y la notificación al Responsable sin demora indebida tras tener conocimiento el Encargado de una Violación de Datos Personales, con cooperación razonable y la información de que disponga el Encargado.

●  Alojamiento, terceros y cooperación. Los Datos Personales se alojan en instalaciones de terceros que implementan controles físicos y ambientales, incluido el acceso monitorizado y controlado. Las instalaciones gestionadas por el Encargado en las que se accede a los Datos Personales están sujetas a controles de seguridad física y ambiental adecuados a la naturaleza del emplazamiento. Los subencargados del tratamiento se someten a un proceso de diligencia debida en materia de seguridad y protección de datos antes de su contratación y a reevaluaciones periódicas, y los componentes de terceros y de código abierto utilizados en los Servicios se inventarían y monitorizan en busca de vulnerabilidades conocidas. Los Datos Personales se conservan únicamente durante el tiempo necesario para los fines para los que se tratan y para cumplir obligaciones legales, contables o de presentación de informes, tras lo cual se suprimen o devuelven de conformidad con el Acuerdo. Teniendo en cuenta la naturaleza del tratamiento, el Encargado presta asistencia razonable al Responsable, en la medida de lo posible, para cumplir las obligaciones del Responsable de atender las solicitudes de los interesados y garantizar el cumplimiento de sus obligaciones en virtud de los Artículos 32 a 36 del RGPD.

Conditions Générales + ADP

Les présentes conditions générales (« Conditions Générales ») de l’Accord de Collaboration sont conclues entre Dandy Labs Europe SAS (anciennement Dandy Labs France SAS) (« Dandy » ou « Nous ») et vous, ainsi que votre cabinet ou clinique dentaire (« Vous » ou le « Cabinet »), et prennent effet à la date de la conclusion de l’Accord de Collaboration (la « Date d’Entrée en Vigueur »). Si Vous acceptez les présentes Conditions Générales pour le compte d’une entité, d’une société de personnes, d’une société ou d’une organisation, « Vous » désigne Vous, ladite entité et l’ensemble des utilisateurs de l’entité, et Vous déclarez disposer du pouvoir de lier l’ensemble de ces utilisateurs. Dandy et Vous seront chacun désignés comme une « Partie » et, ensemble, les « Parties ». En contrepartie des stipulations de l’Accord de Collaboration, les Parties conviennent de ce qui suit :

1. Amendement. Les présentes Conditions Générales et l’Accord de Collaboration peuvent être modifiés d’un commun accord écrit entre les Parties. Elles peuvent également être modifiées par Dandy, qui Vous informera de toute modification substantielle. Ces modifications substantielles prendront effet trente (30) jours après leur notification, sauf si Vous résiliez le contrat par notification écrite dans ce délai. Dans ce cas, Dandy continuera d’appliquer les Conditions Générales en vigueur pendant soixante (60) jours ou jusqu’à ce que l’Équipement soit restitué.

2. Intégralité du Contrat. L’Accord de Collaboration, les présentes Conditions Générales, la Politique de Confidentialité, l’Accord de Protection des Données (« APD ») (Annexe B) et les Politiques Informatiques constituent l’intégralité du contrat (le « Contrat »). Le présent Contrat remplace et annule tout accord antérieur incompatible.

3. Incessibilité. Vous ne pouvez pas transférer ni céder l’Accord de Collaboration à un tiers sans l’accord écrit préalable de Dandy.

4. Conformité légale. Les Parties conviennent de se conformer à l’ensemble des lois applicables en matière de santé et de données dans la juridiction où Vous et Dandy êtes tous deux établis, aux normes réglementaires pertinentes édictées par les autorités européennes et nationales, ainsi qu’aux orientations publiées par les organismes de réglementation professionnelle.

5. Indemnisation. Vous vous engagez à indemniser, défendre et dégager Dandy de toute responsabilité au titre de toute réclamation ou perte résultant : (a) de votre violation du Contrat ; (b) de toute négligence ou de tout acte intentionnel relatif aux soins prodigués aux patients ; (c) de la fourniture de données cliniques inexactes ; et (d) de vos relations avec des autorités de régulation de l’Union européenne ou nationales.

6. Droit applicable et Compétence juridictionnelle. 

  1. Droit applicable. Vous acceptez que les présentes Conditions Générales soient régies par et interprétées conformément aux lois de la juridiction dans laquelle Vous êtes établi(e).
  1. Compétence juridictionnelle. Tout litige découlant des présentes Conditions Générales ou en lien avec celles‑ci sera soumis à la compétence exclusive des tribunaux de la juridiction applicable dans laquelle Vous êtes établi(e), comme indiqué dans le tableau ci‑dessous.
LandenBevoegde rechterlijke instantie
FrankrijkTribunaal voor Economische Activiteiten van Parijs
SpanjeRechtbanken en gerechtshoven van Madrid

7. TVA & fiscalité. Dandy facturera la taxe sur la valeur ajoutée (« TVA ») au taux applicable, en sus de tout prix, frais, charge ou montant dû au titre du Contrat, et ladite TVA sera, le cas échéant, payable par Vous. Si Vous bénéficiez d’une exonération, Vous devrez fournir un certificat d’exonération de TVA valable ou tout justificatif jugé satisfaisant par l’administration fiscale compétente, lorsqu’un tel document est disponible, ou justifier le fondement de toute exonération de TVA.

8. Protection des données. Dans la mesure où Dandy traite, pour votre compte, des données à caractère personnel (« Données à Caractère Personnel »), y compris des données de santé, le contrat de sous-traitance en matière de protection des données figurant en Annexe B constitue une section obligatoire et fait partie intégrante du présent Contrat.

Rôles en matière de protection des données. Les Parties reconnaissent que :

Contact pour la protection des données. Toute notification ou demande relative à la protection des données au titre du présent Contrat doit être adressée au Délégué à la Protection des Données de Dandy (« DPD »), Tony Riesen, à l’adresse [email protected].

Annexe B : Contrat de sous-traitance en matière de protection des données 

Le présent contrat de sous-traitance en matière de protection des données (« DPA ») est incorporé au Contrat lorsque Dandy agit en qualité de sous-traitant pour le compte du Cabinet, agissant en qualité de responsable du traitement. La nature, la finalité et la durée du traitement sont précisées à l’Annexe B(1) (« Détails du Traitement de Données »).

1. Définitions

2. Objet & Instructions

Dandy ne traite les Données à Caractère Personnel que sur instructions documentées du Cabinet, y compris en ce qui concerne les transferts de Données à Caractère Personnel vers un pays tiers, et ce à moins que les Lois Applicables ne l’obligent à d’autres traitements. Si Dandy estime qu’une instruction du Cabinet enfreint les Lois Applicables, elle en informe immédiatement le Cabinet.

Le Cabinet veille à disposer d’une base légale au titre de l’article 6 du RGPD pour le traitement de toutes Données à Caractère Personnel, ainsi que d’une dérogation au titre de l’article 9 du RGPD pour le traitement de Données à Caractère Personnel Sensibles, dans le cadre de tout traitement envisagé par le présent DPA.

3. Obligations de Dandy (le « Sous-Traitant »)

4. Transferts Internationaux

Dandy ne transférera pas de Données à Caractère Personnel en dehors de l’Espace Economique Européen (« EEE ») à moins qu’elle ne s’assure que le transfert est soumis à des « garanties appropriées » (telles qu’une décision d’adéquation de la Commission Européenne).

5. Notification d’une Violation de Données à Caractère Personnel

Dandy notifiera le Cabinet sans retard injustifié (et en tout état de cause dans un délai de quarante-huit (48) heures) après avoir eu connaissance d’une Violation de Données à Caractère Personnel affectant des Données à Caractère Personnel, en fournissant des informations suffisantes pour permettre au Cabinet de satisfaire à toute obligation de notification auprès de l’autorité de protection des données compétente.

6. Suppression ou restitution

Au choix du Cabinet, Dandy supprimera ou restituera au Cabinet l’ensemble des Données à Caractère Personnel à l’issue de la fourniture des services, et supprimera les copies existantes, sauf si les Lois Applicables exigent une conservation continue.

Annexe B(1): DÉTAILS DU TRAITEMENT DES DONNÉES

Annexe B(2): MESURES DE SÉCURITÉ 

Politique informatique relative à l’équipement fourni aux cabinets et dentistes

Cette politique s’applique uniquement aux cabinets et aux dentistes qui utilisent leur propre ordinateur portable et leur propre scanner dans le cadre de leur relation avec Dandy.

Politique relative aux systèmes standards :

Afin de garantir la qualité et la cohérence des dossiers soumis à Dandy Labs, vous vous engagez à respecter les exigences suivantes concernant votre infrastructure informatique :

  1. Vous acceptez d’utiliser uniquement le scanner intra-oral 3Shape TRIOS 3, TRIOS 4 ou TRIOS 5.
  2. Vous acceptez de fournir une connexion Wi-Fi stable d’au moins 15 Mbps en débit montant et 15 Mbps en débit descendant dans tous les lieux où des dossiers sont soumis.
  3. Vous acceptez d’utiliser, avec le scanner intra-oral 3Shape, un ordinateur qui répond aux exigences système suivantes :
  4. PC (configuration minimale) :
    • Processeur : i7-10850H
    • Mémoire : 16 Go DDR4
    • Disque dur : 256 Go
    • Carte graphique : Quadro T1000 (4 Go)
    • Système d’exploitation : Windows 11 Pro

PC Recommandé:

  1. Vous acceptez de mettre à jour le logiciel TRIOS vers une version minimale 1.7.19.1.
  2. Vous acceptez d’enregistrer et de transmettre tous les dossiers vers le stockage local de l’ordinateur.
  3. Vous acceptez d’accorder à l’équipe du service client de Dandy un accès EasyAccess à Splashtop, grâce à un mot de passe partagé convenu d’un commun accord, qui restera valable pendant toute la durée de la relation.
  4. Vous acceptez d’installer DandyUploader dans le profil d’un utilisateur local et d’utiliser ce profil local dans le cadre de votre utilisation du logiciel TRIOS.
  5. Si vous utilisez un logiciel antivirus, vous acceptez d’autoriser l’accès au chemin d’accès suivant :
  1. Si votre cabinet dispose d’un pare-feu réseau, qu’il soit physique ou en ligne, veuillez autoriser tout le trafic vers les domaines suivants :

Termini e Condizioni all’Accordo di Collaborazione

I presenti termini e condizioni (“Termini”) all’Accordo di Collaborazione sono stipulati tra Dandy Labs Europe SAS (già Dandy Labs France SAS) (“Dandy” o “Noi”), e Lei e il Suo studio o ambulatorio odontoiatrico (“Lei” o “Studio”), dall’altro, e hanno efficacia a decorrere dalla data di efficacia dell’Accordo di Collaborazione (“Data di Efficacia”). Qualora Lei accetti i presenti Termini per conto di un ente, società di persone, società di capitali o altra organizzazione, il termine “Lei” comprende Lei, tale ente e tutti gli utenti che fanno riferimento all’ente, e Lei dichiara di avere l’autorità per vincolare tali utenti. Dandy e Lei saranno di seguito indicati singolarmente come “Parte” e congiuntamente come “Parti”. In considerazione del corrispettivo previsto nell’Accordo di Collaborazione, le Parti convengono quanto segue:

1. Fatturazione e Pagamenti: Tutti gli importi dovuti ai sensi del presente Contratto sono espressi in Euro (€) e potranno essere corrisposti esclusivamente mediante trasferimento in Euro (con eventuali commissioni di cambio e commissioni bancarie, ove applicabili, a Suo carico) e al netto dell’Imposta sul Valore Aggiunto (IVA) applicabile, che sarà, ove prevista, addebitata in aggiunta agli importi fatturati e corrisposta da Lei, previa ricezione di fattura valida ai sensi delle Leggi Applicabili. Accettiamo pagamenti tramite addebito diretto SEPA, bonifico bancario, carta di debito o carta di credito, e Lei è tenuto a mantenere un metodo di pagamento valido sempre disponibile. Il rispetto dei termini di pagamento è essenziale. Fermo restando quanto precede, le Parti convengono che tutte le fatture saranno pagate entro un termine massimo di trenta (30) giorni dalla data di ricevimento della fattura o, se successiva, dalla data di ricevimento dei beni o servizi. Sconti e promozioni non possono essere utilizzati per il pagamento di spese di elaborazione, spedizione, cancellazione o altri oneri. Dandy ha il diritto di addebitare (e Lei accetta di corrispondere) l’importo massimo di interessi consentito dalle Leggi Applicabili, ovvero l’1,5% mensile qualora le Leggi Applicabili non prevedano alcuna disposizione in merito. Gli interessi matureranno giornalmente dalla data di scadenza fino all’effettivo pagamento, sia prima che dopo l’eventuale pronuncia giudiziale. Dandy non accetta assegni cartacei, carte di credito prepagate, pagamenti peer-to-peer o criptovalute come metodi di pagamento validi. Qualora Lei abbia saldi insoluti per sessanta (60) giorni o più, ovvero l’importo dovuto a Dandy sia pari o superiore a 10.000 € (EUR), Dandy si riserva il diritto di sospendere il Suo account fino al saldo di tutti gli importi insoluti. In caso di persistente inadempimento, Dandy potrà risolvere o sospendere uno o tutti i contratti con Lei, senza che ciò comporti l’estinzione del debito o la cessazione della maturazione degli interessi. Lei è tenuto a gestire le aspettative dei Suoi pazienti in merito ai tempi di consegna dei Prodotti Dandy ordinati per loro conto.

Salvo quanto diversamente previsto di seguito, ciascuna Parte sarà esclusivamente responsabile dei propri obblighi fiscali derivanti dal presente Contratto. Tutti i pagamenti da Lei effettuati ai sensi del presente Contratto saranno corrisposti senza deduzione o ritenuta per imposte, salvo quanto richiesto dalle Leggi Applicabili. Nella misura in cui qualsiasi pagamento ai sensi del presente Contratto dia luogo a un obbligo a Suo carico di dedurre, trattenere o versare qualsiasi importo a qualsiasi autorità governativa ai sensi delle Leggi Applicabili, gli importi dovuti e pagabili ai sensi del presente Contratto saranno aumentati in modo che Noi riceviamo un importo pari a quello che avremmo ricevuto qualora tale deduzione o ritenuta non fosse stata effettuata. Ai fini della rendicontazione, Lei accetta di consegnare a Dandy la prova che tali imposte sono state versate a un’autorità governativa, incluso l’originale o una copia autenticata di una ricevuta rilasciata da tale autorità attestante il pagamento.

Lei riconosce altresì che Dandy ha comunicato la possibilità di commissioni di elaborazione e ha offerto l’opportunità di porre eventuali domande relative a tali commissioni prima della stipula del presente Contratto. Lei accetta di manlevare e tenere indenne Dandy da qualsiasi pretesa, danno o perdita derivante da eventuali sovraprezzi imposti da fornitori di servizi terzi. Dandy si riserva il diritto di modificare i prezzi dei Prodotti Dandy (come definiti di seguito) in qualsiasi momento, con un preavviso di quarantacinque (45) giorni. Lei accetta di non avere alcun diritto di compensazione, domanda riconvenzionale, deduzione o ritenuta a fronte di importi dovuti da Dandy a Lei. Lei accetta che Dandy possa in qualsiasi momento, e senza limitare altri diritti o rimedi di cui possa disporre, compensare qualsiasi importo da Lei dovuto con qualsiasi importo pagabile da Dandy a Lei. Dandy non accetta pagamenti da parte dei pazienti, inclusi i pagamenti a nome del paziente da Lei inoltrati.

2. Attrezzatura. Il rischio di perdita, furto, danno o distruzione dell’Attrezzatura passerà a Lei al momento della Consegna. L’Attrezzatura rimarrà a Suo esclusivo rischio per tutta la durata del presente Contratto e per qualsiasi ulteriore periodo durante il quale l’Attrezzatura sia in Suo possesso, custodia o controllo (il “Periodo di Rischio”) fino alla riconsegna dell’Attrezzatura a Dandy. Lei dovrà dare immediata comunicazione scritta a Dandy in caso di perdita, incidente o danno all’Attrezzatura derivante da o connesso al Suo possesso o utilizzo dell’Attrezzatura.

3. Requisiti IT. Lei accetta di fornire e mantenere una connessione internet ad alta velocità da utilizzare in connessione con l’Attrezzatura, e Lei accetta di rispettare le Policy IT incluse nei termini e condizioni online.

4. Manleva: Lei manleverà, terrà indenne, difenderà e terrà indenne Dandy da e contro qualsiasi pretesa, causa d’azione, danno, debito, responsabilità, perdita, obbligo, pagamento, costo e spesa (incluse le spese legali), derivanti da o relativi a: (a) una Sua violazione di qualsiasi termine di qualsiasi contratto con Dandy; (b) una Sua violazione di qualsiasi termine di qualsiasi contratto tra Lei e il Suo paziente o qualsiasi atto o omissione nei confronti di un paziente (incluse azioni da parte di qualsiasi organismo professionale che La regola o di qualsiasi autorità regolatoria o organismo di abilitazione nazionale) ivi inclusi, senza limitazione alcuna, gli atti di negligenza o dolosi relativi all’assistenza al paziente ovvero alla fornitura di dati clinici inesatti; e (c) fornitura da parte Sua di informazioni, documenti, scansioni o impronte inesatti o incompleti o mancata tempestiva fornitura a Dandy di qualsiasi informazione da Noi richiesta.

5. Cambio di Controllo dello Studio: Qualora il Suo studio odontoiatrico subisca un Cambio di Controllo dal punto di vista proprietario, Lei accetta di informare Dandy mediante comunicazione scritta entro cinque (5) giorni lavorativi prima della data in cui tale Cambio di Controllo diventi efficace. Ai fini della presente clausola, una situazione di “Cambio di Controllo” includerà qualsiasi operazione o serie di operazioni che comporti un cambiamento nella titolarità diretta o indiretta di oltre il cinquanta percento (50%) dei diritti di voto o del capitale sociale del Suo studio odontoiatrico, ovvero qualsiasi fusione, consolidamento o vendita di sostanzialmente tutti i suoi asset.

6. Esclusione di Responsabilità Medica: Il Suo studio è l’unico responsabile del trattamento dei pazienti mediante l’utilizzo di qualsiasi Offerta Dandy, e della fornitura ai Suoi pazienti di tutte le informazioni pertinenti relative alle Offerte Dandy e a qualsiasi rischio correlato, prima e dopo il trattamento. Le Offerte Dandy sono offerte esclusivamente come supplemento al Suo studio odontoiatrico e non costituiscono consulenza medica, odontoiatrica o di altro tipo sanitario, diagnosi o trattamento per i Suoi pazienti. Lei accetta di non rilasciare alcuna dichiarazione o garanzia ai Suoi pazienti in merito alle Offerte Dandy. Lei dichiara a Dandy che il Suo studio rispetterà tutte le Leggi Applicabili, i regolamenti, le linee guida e i codici deontologici professionali relativi ai professionisti autorizzati a esercitare l’odontoiatria e a effettuare scansioni intraorali sui pazienti dello studio. Salvo quanto diversamente ed espressamente previsto nel presente documento, le Offerte Dandy a Lei fornite ai sensi del presente Contratto sono fornite “COSÌ COME SONO” e sono fornite ai sensi della Sua prescrizione per il singolo paziente.

Le Parti riconoscono che il presente Contratto non crea alcun rapporto contrattuale diretto tra Dandy e i Suoi pazienti. Qualsiasi pretesa, richiesta o azione promossa da un paziente o da un’autorità regolatoria derivante dalle Sue decisioni cliniche, dalla gestione del trattamento, da errori di prescrizione o dalla fornitura di dati errati (quali scansioni o impronte difettose) sarà soggetta ai Suoi pieni obblighi di manleva di cui alla sezione 4.

Lei accetta di adempiere ai Suoi obblighi ai sensi del Regolamento (UE) 2017/745 sui dispositivi medici, nella misura applicabile. Lei accetta di gestire tutte le comunicazioni e le altre attività relative a qualsiasi richiamo o altra attività regolatoria in conformità a tutte le Nostre ragionevoli istruzioni e di non contattare o comunicare in altro modo con un’autorità competente prima di averci consultato. Il presente obbligo, nonché le relative disposizioni di manleva di cui alla sezione 5 dei Termini e Condizioni Online, sopravvivranno alla risoluzione del presente Accordo di Collaborazione per il periodo in cui i dispositivi medici da Noi forniti rimarranno in uso.

7. Modifica. I presenti Termini e l’Accordo di Collaborazione potranno essere modificati mediante accordo scritto tra le Parti. I presenti Termini e l’Accordo di Collaborazione potranno altresì essere modificati da Dandy, che Le comunicherà eventuali modifiche sostanziali. Tali modifiche sostanziali acquisteranno efficacia decorsi trenta (30) giorni dalla notifica, salvo che Lei receda dal Contratto mediante comunicazione scritta entro tale termine. In caso di recesso da parte Sua ai sensi della presente clausola, Dandy rispetterà i Termini vigenti per sessanta (60) giorni o fino alla restituzione dell’Attrezzatura.

8. Intero accordo. L’Accordo di Collaborazione, i presenti Termini, l’Informativa sulla Privacy UE, l’Accordo sul Trattamento dei Dati (“DPA”) (Allegato A) e la Policy IT costituiscono l’intero accordo tra le Parti (il “Contratto”). Il presente Contratto sostituisce e supera ogni precedente e confliggente accordo o intesa tra le Parti.

9. Divieto di cessione. Lei non potrà trasferire né cedere l’Accordo di Collaborazione a terzi senza il previo consenso scritto di Dandy.

10. Conformità alla normativa. Le Parti si impegnano a rispettare tutte le leggi applicabili in materia sanitaria e di protezione dei dati applicabili nel Paese dove Lei e Dandy avete sede, gli standard normativi emanati dalle autorità europee e nazionali, nonché le linee guida emanate dagli organismi professionali di regolamentazione.

11. Manleva. Lei manleverà, difenderà e terrà indenne Dandy da qualsiasi pretesa o perdita derivante da fatti, omissioni o violazioni imputabili allo Studio, inclusi: (a) una Sua violazione del Contratto; (b) negligenza o atti dolosi relativi all’assistenza ai pazienti; (c) fornitura di dati clinici inesatti; e (d) rapporti con le autorità regolatorie dell’UE o nazionali.

12. Legge applicabile e foro competente.

  1. Legge applicabile. I presenti Termini sono disciplinati e interpretati in conformità alle leggi della giurisdizione in cui ha sede lo Studio.
  2. Foro competente. Qualsiasi controversia derivante dai presenti Termini o connessa agli stessi sarà devoluta alla giurisdizione dei tribunali del Paese in cui ha sede lo Studio e, nell’ambito di tale giurisdizione, alla competenza esclusiva del foro indicato, per tale Paese, nella tabella seguente.
PaeseGiurisdizione
FranciaTribunaal voor Economische Activiteiten van Parijs
Irlanda Tribunali competenti di Dublino 
ItaliaTribunale di Milano
Paesi Bassi Il tribunale competente di Amsterdam, Paesi Bassi
SpagnaCorti e tribunal di Madrid 

13. IVA e imposte. Dandy addebiterà l’Imposta sul Valore Aggiunto (“IVA”) all’aliquota applicabile, in aggiunta a qualunque prezzo, onere o importo dovuto ai sensi del Contratto; tale IVA sarà a Suo carico, ove applicabile. Qualora Lei sia esente, dovrà fornire un certificato di esenzione IVA valido o idonea documentazione per la competente amministrazione fiscale, ove disponibile, oppure giustificare la base dell’esenzione IVA.

14. Protezione dei dati personali. La presente clausola disciplina il trattamento da parte di Dandy di dati personali, inclusi dati sanitari (“Dati Personali”), per Suo conto. 

Ruoli in Materia di Protezione dei Dati. Le Parti riconoscono che

Contatto per la Protezione dei Dati. Eventuali comunicazioni o richieste relative  al presente Contratto devono essere indirizzate a Dandyall’indirizzo [email protected].

Allegato A: Accordo sul Trattamento dei Dati (o DPA)

Il presente DPA forma parte del Contratto, ai sensi del quale Dandy opera in qualità di responsabile del trattamento per conto dello Studio, che opera in qualità di titolare del trattamento. La natura, la finalità e la durata del trattamento sono stabilite nell’Appendice 1 (“Dettagli del Trattamento dei Dati”).

1. Definizioni

2. Oggetto e Istruzioni

Dandy tratterà i Dati Personali esclusivamente sulla base delle istruzioni documentate dello Studio, anche per quanto riguarda i trasferimenti di Dati Personali verso un paese terzo, salvo che ciò sia richiesto dalle Leggi Applicabili, alle quali Dandy è soggetto; in tal caso, Dandy informerà lo Studio di tale obbligo di legge prima del Trattamento, salvo che la legge vieti tale informazione per rilevanti motivi di interesse pubblico. Qualora Dandy ritenga che un’istruzione violi le Leggi Applicabili, ne informerà immediatamente lo Studio e avrà il diritto di sospendere l’esecuzione dell’istruzione pertinente fino a quando lo Studio non la confermi, la modifichi o la revochi. Eventuali istruzioni orali dovranno essere confermate dallo Studio per iscritto senza indebito ritardo.

Lo Studio dovrà assicurarsi di disporre di una base giuridica ai sensi dell’Articolo 6 del GDPR per il trattamento dei Dati Personali, nonché di una deroga ai sensi dell’Articolo 9 del GDPR per il trattamento delle Categorie Particolari di Dati, nel contesto previsto dal presente

3. Obblighi di Dandy (il “Responsabile del Trattamento”)      

Sicurezza: Dandy adotterà misure tecniche e organizzative appropriate per garantire un livello di sicurezza adeguato al rischio, tenendo conto dello stato dell’arte, dei costi di attuazione e della natura, dell’ambito, del contesto e delle finalità del Trattamento, come ulteriormente dettagliato nell’Appendice 2. Dandy potrà di volta in volta aggiornare o modificare le misure di sicurezza di cui all’Appendice 2, a condizione che tali aggiornamenti o modifiche non riducano sostanzialmente il livello complessivo di protezione garantito ai Dati Personali.

4. Sub-responsabili

4.1 Con la presente, lo Studio autorizza Dandy in via generale e per iscritto a nominare i sub-responsabili elencati nel Trust Center di Dandy, disponibile all’indirizzo https://trust.meetdandy.com/subprocessors, e in conformità al presente articolo 4.

4.2 Qualora Dandy nomini un nuovo sub-responsabile o intenda apportare modifiche relative all’aggiunta o alla sostituzione di sub-responsabili, ne darà comunicazione scritta allo Studio con un preavviso di venti (20) giorni lavorativi, durante i quali lo Studio potrà opporsi alla nomina o alla sostituzione per motivi ragionevoli e documentati relativi alla riservatezza o alla sicurezza dei Dati Personali o alla conformità del sub-responsabile alle Leggi Applicabili. Qualora lo Studio non si opponga, Dandy potrà procedere con la nomina o la sostituzione. Qualora lo Studio si opponga e Dandy non possa ragionevolmente accogliere l’opposizione, lo Studio potrà risolvere il presente DPA e il Contratto mediante comunicazione scritta. Dandy garantirà di avere in essere un contratto scritto con tutti i sub-responsabili che imponga al sub-responsabile obblighi non meno onerosi di quelli imposti a Dandy ai sensi del presente DPA.

5. Obblighi dello Studio

5.1 Lo Studio garantisce che: (i) la normativa ad esso applicabile non impedisce a Dandy di adempiere alle istruzioni ricevute dallo Studio e di eseguire gli obblighi di Dandy ai sensi del presente DPA; e (ii) ha rispettato e continua a rispettare le Leggi Applicabili, in particolare che ha ottenuto tutti i consensi necessari o ha fornito tutte le comunicazioni necessarie, e dispone comunque di una base legittima per comunicare i dati a Dandy e consentire il Trattamento dei Dati Personali da parte di Dandy come previsto nel presente DPA.

5.2 Lo Studio accetta di manlevare e tenere indenne Dandy, su richiesta, da e contro qualsiasi pretesa, responsabilità, costo, spesa, perdita o danno (incluse perdite consequenziali, perdita di profitto e perdita di reputazione e tutti gli interessi, le penali e i costi e le spese legali e professionali) sostenuti da Dandy derivanti direttamente o indirettamente da una violazione del presente articolo 5.

6. Modifiche alle Leggi Applicabili

Le Parti si impegnano a negoziare in buona fede modifiche al presente DPA qualora siano necessarie affinché Dandy possa continuare a trattare i Dati Personali come previsto dal presente DPA in conformità alle Leggi Applicabili, incluso (i) per conformarsi al GDPR o a qualsiasi normativa nazionale di attuazione dello stesso, e a qualsiasi orientamento sull’interpretazione delle rispettive disposizioni; (ii) qualora le SCC o qualsiasi altro meccanismo o decisione di adeguatezza siano invalidati o modificati; o (iii) qualora modifiche allo status di appartenenza di un paese all’Unione Europea o allo Spazio Economico Europeo richiedano tale modifica.

7. Trasferimenti Internazionali

Dandy non trasferirà Dati Personali al di fuori dello Spazio Economico Europeo a meno che non garantisca che il trasferimento sia soggetto a garanzie adeguate ai sensi dell’Articolo 46 del GDPR. Tali garanzie adeguate possono includere: (a) una decisione di adeguatezza della Commissione Europea ai sensi dell’Articolo 45 del GDPR; (b) SCC adottate dalla Commissione Europea ai sensi dell’Articolo 46(2)(c) del GDPR; (c) certificazione ai sensi del Data Privacy Framework UE-USA; o (d) qualsiasi altro meccanismo di trasferimento valido ai sensi delle Leggi Applicabili.

8. Notifica di Violazione dei Dati Personali

Dandy notificherà lo Studio senza ingiustificato ritardo (e in ogni caso entro 72 ore) nel caso in cui venga a conoscenza di una Violazione dei Dati Personali che interessa i Dati Personali, fornendo informazioni sufficienti per consentire allo Studio di adempiere a eventuali obblighi di segnalazione all’autorità di controllo competente. Ulteriori informazioni sulla Violazione dei Dati Personali saranno fornite gradualmente man mano che ulteriori dettagli saranno disponibili.

9. Cancellazione o Restituzione

A scelta dello Studio, Dandy cancellerà o restituirà tutti i Dati Personali allo Studio al termine della fornitura dei servizi, e cancellerà le copie esistenti salvo che le Leggi Applicabili ne richiedano la conservazione continuata. 

APPENDICE 1: DETTAGLI DEL TRATTAMENTO DEI DATI

APPENDICE 2: MISURE DI SICUREZZA

EU Duits

Diese Allgemeinen Geschäftsbedingungen („AGB“) zum Praxisvertrag werden zwischen Dandy Labs Europe SAS (vormals Dandy Labs France SAS) („Dandy“ oder „wir“) und Ihnen sowie Ihrer Zahnarztpraxis oder -klinik („Sie“ oder „Praxis“) geschlossen und treten mit Abschluss des Praxisvertrags in Kraft („Inkrafttreten“). Wenn Sie diese AGB im Namen eines Unternehmens, einer Personengesellschaft, einer Kapitalgesellschaft oder einer sonstigen Organisation abschließen, umfasst „Sie“ sowohl Sie persönlich als auch dieses Unternehmen und alle Nutzer des Unternehmens. Sie versichern , dass Sie zur vertraglichen Verpflichtung all dieser Nutzer befugt sind. Dandy und Sie werden jeweils als „Partei“ und gemeinsam als die „Parteien“ bezeichnet. Im Hinblick auf die im festgelegten gegenseitigen Leistungen vereinbaren die Parteien Folgendes:

1. Änderung. Diese AGB und der Praxisvertrag können durch beiderseitige schriftliche Vereinbarung der Parteien geändert werden. Diese AGB und der Praxisvertrag können anderweitig von Dandy geändert werden, und Dandy wird Sie über wesentliche Änderungen informieren. Solche wesentlichen Änderungen treten dreißig (30) Tage nach der Benachrichtigung in Kraft, es sei denn, Sie kündigen den Vertrag innerhalb dieses Zeitraums durch schriftliche Mitteilung. In diesem Fall wird Dandy die bestehenden AGB für sechzig (60) Tage oder bis zur Rückgabe der Ausrüstung einhalten.

2. Vollständiger Vertrag. Der Praxisvertrag, diese AGB, unsere EU-Datenschutzerklärung, der Auftragsverarbeitungsvertrag („AVV“) (Anlage A) und die IT-Richtlinie bilden den „Vertrag“. Dieser Vertrag ersetzt alle früheren entgegenstehenden Vereinbarungen und Absprachen.

3. Abtretungsverbot. Sie dürfen den Praxisvertrag nicht ohne vorherige schriftliche Zustimmung von Dandy an Dritte übertragen oder abtreten.

4. Einhaltung gesetzlicher Vorschriften. Beide Parteien verpflichten sich, alle anwendbaren Gesundheits- und Datenschutzgesetze der Rechtsordnung einzuhalten, in der sowohl Sie als auch Dandy ansässig sind, sowie die einschlägigen regulatorischen Standards, die von europäischen und nationalen Behörden erlassen wurden, und die Leitlinien, die von berufsständischen Aufsichtsbehörden herausgegeben wurden.

5. Freistellung. Sie stellen Dandy von sämtlichen Ansprüchen und Schäden frei, verteidigen Dandy gegen solche Ansprüche und halten Dandy insoweit schadlos, die sich aus Folgendem ergeben: (a) Ihrem Verstoß gegen den Vertrag; (b) Fahrlässigkeit oder vorsätzlichen Handlungen im Zusammenhang mit der Patientenversorgung; (c) der Bereitstellung unrichtiger klinischer Daten; und (d) dem Umgang mit Aufsichtsbehörden auf Unionsebene oder nationaler Ebene.

6. Anwendbares Recht und Gerichtsstand. 

  1. Anwendbares Recht. Sie erklären sich damit einverstanden, dass diese Bedingungen dem Recht der Rechtsordnung unterliegen, in der die Praxis niedergelassen ist, und nach diesem ausgelegt werden.
  2. Gerichtsstand. Für sämtliche Streitigkeiten, die sich aus oder im Zusammenhang mit diesen Bedingungen ergeben, sind ausschließlich die Gerichte der jeweils maßgeblichen Rechtsordnung zuständig, in der die Praxis niedergelassen ist, wie in der nachstehenden Tabelle aufgeführt.
LandZuständigkeit
FrankrijkTribunaal voor Economische Activiteiten van Parijs
SpanienGerichte und Tribunale von Madrid

7. Steuern. Dandy wird die Umsatzsteuer („USt“) zum jeweils geltenden Satz zusätzlich zu jedem Preis, jeder Gebühr oder jedem nach dem Vertrag geschuldeten Betrag berechnen. Diese Umsatzsteuer ist, soweit anwendbar, von Ihnen zu zahlen. Sind Sie von der Steuer befreit, müssen Sie eine gültige Umsatzsteuerbefreiungsbescheinigung oder einen für die zuständige Finanzbehörde zufriedenstellenden Nachweis vorlegen, sofern verfügbar, oder die Grundlage für die Umsatzsteuerbefreiung darlegen.

8. Datenschutz. Dandy verarbeitet personenbezogene Daten, einschließlich Gesundheitsdaten („Personenbezogene Daten”), in Ihrem Auftrag gemäß diesem Vertrag.

Datenschutzrechtliche Rollenverteilung. Die Parteien erkennen an, dass

Datenschutzbeauftragter. Alle datenschutzbezogenen Mitteilungen oder Anfragen im Rahmen dieses Vertrags sind an den Datenschutzbeauftragten von Dandy („DSB“), Tony Riesen, unter [email protected] zu richten.

Anlage A: Auftragsverarbeitungsvertrag (oder AVV)

Dieser AVV wird in den Vertrag einbezogen, wenn Dandy als Auftragsverarbeiter im Auftrag der Praxis als Verantwortlicher handelt. Gegenstand, Zweck und Dauer der Verarbeitung sind in Anhang 1 („Einzelheiten der Datenverarbeitung”) festgelegt.

1. Begriffsbestimmungen

2. Gegenstand und Weisungen

Dandy verarbeitet Personenbezogene Daten nur auf dokumentierte Weisung der Praxis, auch in Bezug auf die Übermittlung Personenbezogener Daten in ein Drittland, es sei denn, Dandy ist nach dem für Dandy geltenden anwendbaren Recht zur Verarbeitung verpflichtet. Ist Dandy der Ansicht, dass eine Weisung gegen das anwendbare Recht verstößt, unterrichtet es die Praxis unverzüglich.

Die Praxis stellt sicher, dass sie über eine Rechtsgrundlage gemäß Artikel 6 der DSGVO für die Verarbeitung Personenbezogener Daten sowie über eine Ausnahme gemäß Artikel 9 der DSGVO für die Verarbeitung besonderer Kategorien Personenbezogener Daten im Rahmen dieses AVV verfügt.

3. Pflichten von Dandy (dem „Auftragsverarbeiter”)

4. Internationale Datenübermittlungen

Dandy darf Personenbezogene Daten nicht außerhalb des EWR übermitteln, es sei denn, Dandy stellt sicher, dass die Übermittlung „geeigneten Garantien” unterliegt (z. B. einem Angemessenheitsbeschluss der Europäischen Kommission).

5. Meldung von Verletzungen des Schutzes Personenbezogener Daten

Dandy benachrichtigt die Praxis unverzüglich (und in jedem Fall innerhalb von 48 Stunden) nach Kenntniserlangung von einer Verletzung des Schutzes Personenbezogener Daten und stellt ausreichende Informationen zur Verfügung, damit die Praxis etwaigen Meldepflichten gegenüber der zuständigen Datenschutzbehörde nachkommen kann.

6. Löschung oder Rückgabe

Nach Aufforderung durch die Praxis löscht Dandy alle Personenbezogenen Daten oder gibt sie an die Praxis zurück, nachdem die Erbringung der Dienstleistungen beendet ist, und löscht vorhandene Kopien, es sei denn, nach dem anwendbaren Recht ist eine Aufbewahrung erforderlich.

ANHANG 1: EINZELHEITEN DER DATENVERARBEITUNG

ANHANG 2: TECHNISCHE UND ORGANISATORISCHE MAßNAHMEN

EU Ireland

These additional terms & conditions (“Terms”) to the Practice Agreement including the EU Privacy Policy, and the Data Privacy Agreement form part of the Agreement (together the “Agreement”) are entered into by and between Dandy Labs Europe SAS (“Dandy” or “We”), and you and your dental practice or office (“You” or “Practice”), and are effective as of the date the Practice Agreement is entered into (“Effective Date”). If You accept the Agreement  on behalf of an entity, partnership, corporation, or organization, “You” includes You, that entity, and all entity users and You hereby represent that You have the authority to bind all such users. Dandy and You will each be referred to as a “Party” and together, the “Parties”. Terms defined herein or elsewhere in the Agreement shall have the defined term apply across the Agreement. For good and valuable consideration as set forth in the Practice Agreement, the Parties agree to the following:

1. Billing & Payments: All amounts payable pursuant to this Agreement are in Euros (€) and may be made by transfer of Euros only (with any foreign exchange fees and bank fees, if applicable, borne by You) and exclusive of applicable Value Added Tax (VAT that shall, where applicable, be charged in addition to the invoiced amounts and paid by You, upon receipt of a valid invoice as required by Applicable Law).  We accept payment by SEPA Direct Debit, bank transfer, debit card or credit card, and You are required to keep a valid payment method on file at all times. Time of payment is of the essence. Without prejudice to the foregoing, the Parties agree that all invoices shall be paid within a maximum period of thirty (30) days from the date of receipt of the invoice or, if later, from the date of receipt of goods or services. Discounts and promotions cannot be used to pay for processing, shipping, cancellation, or other fees. Dandy has the right to charge (and You agree to pay) the maximum interest amount allowed by Applicable Law, or 1.5% per month if none is specified by Applicable Law. Interest shall accrue daily from the due date until actual payment, whether before or after judgment. Dandy does not accept paper checks, prepaid credit cards, peer-to-peer payments, or cryptocurrency as valid payment methods. In the event You have any unpaid balances for sixty (60) days or more, or the amount owed to Dandy is 10,000 € (EUR) or more, Dandy reserves the right to pause your account until all unpaid balances are remitted. In the event of continuing non-payment, Dandy may cancel or suspend any or all agreements with You, which shall not extinguish the debt or any accrual of interest. You are expected to manage your patients’ expectations of the timing of the supply of the Dandy Products ordered for them accordingly. 

Except as provided below, each Party shall be solely responsible for its own tax obligations arising in connection with this Agreement. All payments by You under this Agreement shall be made without deduction or withholding for any taxes, except as required by Applicable Law. To the extent any payment under this Agreement gives rise to any obligation on You to deduct, withhold, or remit any amount to any governmental authority under Applicable Law, the amounts due and payable under this Agreement shall be increased so that We receive an amount equal to the amount we would have received had no such deduction or withholding been made. For reporting purposes, You agree to deliver to Dandy evidence that such taxes were paid to a governmental authority, including the original or a certified copy of a receipt issued by that authority evidencing the payment.

You further acknowledge that Dandy has disclosed the possibility of processing fees and has provided the opportunity to ask any questions regarding such fees prior to entering this Agreement. You agree to indemnify and hold Dandy harmless from any claims, damages, or losses arising from any such surcharges imposed by third-party service providers. Dandy reserves the right to change pricing for Dandy Products (defined below) at any time upon forty-five (45) days’ notice. You agree that You shall have no right of set-off, counterclaim deduction or withholding against amounts owed by Dandy to You. You agree that Dandy may at any time and without limiting any other rights or remedies it may have, set-off any amount owing by You against any amount payable by Dandy to You. Dandy does not accept payments from patients, including payments in the patient’s name forwarded by You.

2. Equipment. The risk of loss, theft, damage or destruction of the Equipment shall pass to You on Delivery. The Equipment shall remain at your sole risk during the term of this Agreement and any further term during which the Equipment is in your possession, custody or control (the “Risk Period“) until the Equipment is redelivered to Dandy. You shall give immediate written notice to Dandy in the event of any loss, accident or damage to the Equipment arising out of or in connection with your possession or use of the Equipment.

3. IT Requirements. You agree to provide and maintain a high-speed internet connection for use in connection with the Equipment, and You agree to follow the IT Policies included in the online terms and conditions.

4. Indemnity: You shall indemnify, keep indemnified, defend and hold harmless Dandy against and from any and all claims, causes of actions, damages, debts, liabilities, losses, obligations, payments, costs and expenses (including legal expenses), arising from or relating to: (a) breach by You of any term of any agreement with Dandy; (b) breach by You of any term of any agreement between You and your patient or any acts or failures in respect of a patient (including actions by any professional body regulating You or any national regulator(s) or licensing body), including without limitation, negligence or willful acts regarding patient care or the provision of any incorrect clinical data; and (c) provision by You of incorrect or incomplete information, documents, scans or impressions or failure to timely provide Dandy with any information we request from You.

5. Practice Change of Control: If your dental practice undergoes a Change of Control from an ownership perspective, You agree to inform Dandy with written notice within five (5) business days before the day such Change of Control becomes effective. For the purposes of this clause, a “Change of Control” situation shall include any transaction or series of transactions resulting in a change in the direct or indirect ownership of more than fifty percent (50%) of the voting rights or share capital of your dental practice, or any merger, consolidation, or sale of substantially all of its assets.

6. Medical Disclaimer: Your practice is solely responsible for the treatment of patients using any Dandy Offerings, and for providing your patients with all relevant information about the Dandy Offerings and any related risk prior to and after treatment. The Dandy Offerings are offered solely as a supplement to your dental practice and do not constitute medical, dental or other healthcare advice, diagnosis or treatment to or for your patients. You agree not to make any representations or warranties regarding the Dandy Offerings to your patients. You represent to Dandy that your practice will comply with all Applicable Law, regulations, guidance and professional codes of conduct regarding professionals who are authorized to practice dentistry and to conduct intraoral scans on practice patients. Except as otherwise expressly provided herein, the Dandy Offerings provided to you hereunder are provided “AS IS” and are provided pursuant to your prescription for the individual patient. 

The Parties acknowledge that this Agreement creates no direct contractual relationship between Dandy and Your patients. Any claims, demands, or actions brought by a patient or regulatory body arising out of your clinical decisions, treatment management, prescription errors, or the provision of faulty data (such as defective scans or impressions) shall be subject to your full indemnification obligations as set out in section 4.

You agree to comply with your obligations under Regulation (EU) 2017/745 on medical devices to the extent applicable. You agree to handle all communications and other activities in relation to any recall or other regulatory activity in accordance with all our reasonable instructions and to not reach out or otherwise communicate with a competent authority prior to consultation with us. This obligation as well as related indemnification arrangements of the Online Terms and Conditions shall survive termination of this Practice Agreement for the period medical devices supplied by us remain in use.

7. Amendment. These Terms and the Agreement may be changed by mutual written agreement of the Parties. These Terms and the Agreement may otherwise be amended by Dandy and Dandy will notify You of any material changes. Such material changes shall become effective thirty (30) days after notification unless You terminate by written notice within that period. In such cases, Dandy will honor existing Terms for sixty (60) days or until the Equipment is returned.

8. Entire Agreement. The Practice Agreement, these Terms, the EU Privacy Policy, the Data Privacy Agreement (“DPA”) (Schedule A), and the IT Policy constitute the “Agreement”. This Agreement supersedes all prior conflicting agreements.

9. Non-assignability. You may not transfer or assign the Agreement to a third party without Dandy’s prior written consent.

10. Legal Compliance. Both Parties agree to comply with all applicable health and data laws in the jurisdiction where You and Dandy are both established, relevant regulatory standards issued by European and national authorities, and guidance issued by professional regulatory bodies.

11. Governing Law & Jurisdiction. 

  1. Governing Law. You agree that the Agreement shall be governed by and construed in accordance with the laws of the jurisdiction where the Practice is established. 
  2. Jurisdiction. Any disputes arising out of or in connection with the Agreement shall be submitted to the exclusive jurisdiction of the courts of the applicable jurisdiction where the Practice is established, as set forth in the table below.
CountryJurisdiction
FrankrijkTribunaal voor Economische Activiteiten van Parijs
IrelandCourts of Dublin 
ItalyTribunal of Milan
The NetherlandsThe competent court in Amsterdam, the Netherlands
SpainCourts and Tribunals of Madrid

12. VAT & Tax. Dandy will charge Value Added Tax (“VAT”) at the applicable rate in addition to any price, charge or amount due under the Agreement and such VAT shall be payable by You, where applicable. If You are exempt, You must provide a valid VAT exemption certificate or evidence satisfactory to the relevant tax administration, when available or justify the basis for the VAT exemption.

13. Data Privacy. Because Dandy processes personal data, including health data (“Personal Data”) on your behalf.

Data Protection Roles. The Parties acknowledge that:

Data Protection Contact. Any privacy-related notices or requests under this Agreement should be directed to Dandy at [email protected]

Schedule A: Data Privacy Agreement (“DPA”)

This DPA is incorporated into the Agreement where Dandy acts as a processor on behalf of the Practice as controller. The nature, purpose, and duration of the processing are set out in Appendix 1 (“Data Processing Details”).

1. Definitions

●      “Applicable Laws” means all applicable laws that govern the processing and security of Personal Data as well as the privacy of electronic communications, including, without limitation, (i) Regulation (EU) 2016/679 of 27 April 2016 (the GDPR), (ii) Directive 2002/58/EC of 12 July 2002 (the ePrivacy Directive), (iii) domestic laws implementing and supplementing the EU laws referred to in this definition, and (iv) the relevant provisions of national health laws, each of (i) to (iv) as amended and/or supplemented from time to time.

●      “Personal Data Breach” means any breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Personal Data, or any other event affecting the integrity, availability or confidentiality of Personal Data.

●      “Special Category Data” means the categories of Personal Data referred to in Article 9 of the GDPR (including but not limited to Personal Data concerning health, biometric data, or data used for the purpose of uniquely identifying a natural person and genetic data).

●      “Personal Data” means personal data (as defined by the GDPR) processed by Dandy on behalf of the Practice.

●      “Data Subject” has the meaning given in the GDPR.

●      “Regulator” means a data protection supervisory authority which has jurisdiction over the Practice’s Processing of Personal Data.

●      “SCCs” means the standard contractual clauses for the transfer of personal data to third countries set out in Commission Decision 2021/914 of 4 June 2021, as amended, updated or replaced from time to time.

●      “Third Country” means any country or territory outside of the scope of the data protection laws of the European Economic Area, excluding countries or territories approved as providing adequate protection for personal data by the European Commission from time to time.

●      “Data Privacy Framework” means, as relevant, the EU-US Data Privacy Framework as administered by the US Department of Commerce and approved by the European Commission as ensuring an adequate level of protection for personal data for the purposes of Article 45 GDPR, as in force, amended, consolidated, re-enacted or replaced from time to time.

2. Subject Matter & Instructions

Dandy shall process Personal Data only on the documented instructions of the Practice, including with regard to transfers of Personal Data to a Third Country, unless required to do so by Applicable Laws, to which Dandy is subject; in such a case, Dandy shall inform the Practice of that legal requirement before Processing, unless that law prohibits such information on important grounds of public interest. If Dandy believes any instruction infringes Applicable Laws, it shall immediately inform the Practice and shall be entitled to suspend the execution of the relevant instruction until the Practice confirms, amends or withdraws it. Any oral instructions shall be confirmed by the Practice in writing without undue delay.

The Practice shall ensure it has a lawful basis under Article 6 of the GDPR for processing Personal Data, as well as an exemption under Article 9 of the GDPR for processing Special Category Data, in the context contemplated in this DPA.

3. Obligations of Dandy (the “Processor”)

●      Confidentiality: Dandy shall ensure that its personnel authorized to process the Personal Data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality.

●      Data Subject Rights: Dandy shall assist the Practice by appropriate technical and organizational measures for the fulfillment of the Practice’s obligation to respond to requests for exercising Data Subject rights, including rights to rectification, erasure, restriction of processing, access, data portability, objection, and the right not to be subject to automated decision making. Dandy shall respond to any such request from the Practice without undue delay.

●      Assistance: Each Party shall provide reasonable assistance to the other as necessary to comply with its respective obligations under Applicable Laws, including in relation to the security of processing, notification of a Personal Data Breach to the relevant data protection authority and/or Data Subjects, preparation of data protection impact assessments, prior consultation with the relevant data protection authority, and any assessment, enquiry, notice or investigation by a Regulator. Without limiting the foregoing, the Practice shall cooperate with Dandy in good faith in connection with any regulatory enquiry, audit or investigation that relates to Dandy’s processing of Personal Data under this DPA.

●      Security: Dandy shall implement appropriate technical and organizational measures to ensure a level of security appropriate to the risk, taking into account the state of the art, the costs of implementation and the nature, scope, context and purpose of the Processing, as further detailed in Appendix 2. Dandy may update or modify the security measures set out in Appendix 2 from time to time, provided that such updates or modifications do not materially diminish the overall level of protection afforded to Personal Data.

●      Audit & Inspection: Dandy shall upon written request from the Practice from time to time provide the Practice with such information as is reasonably necessary to demonstrate compliance with the obligations laid down in this Agreement. Dandy shall contribute to audits, including inspections of Dandy’s premises, systems, equipment, and data processing facilities, conducted by the Practice or an independent auditor in possession of the required professional qualifications and bound by a duty of confidentiality, appointed by the Practice (“On-Site Audits”). Any On-Site Audits shall be conducted upon a 60 day prior written notice to Dandy (or shorter notice where required by a Regulator or following a Personal Data Breach or another matter of urgency), not more than once every calendar year (unless required by a Regulator or following a Personal Data Breach or another matter of urgency). The Parties shall use reasonable endeavors to ensure any On-Site Audits are conducted during Dandy’s normal business hours and do not unreasonably affect Dandy’s operations. The Practice shall bear the costs of any On-Site Audits, except where an audit reveals a material breach by Dandy of its obligations under this DPA.

4. Sub-Processing

4.1 The Practice hereby grants Dandy general written authorisation to engage the sub-processors listed within Dandy’s Trust Center, which can be found at https://trust.meetdandy.com/subprocessors, and subject to this clause 4.

4.2 If Dandy appoints a new sub-processor or intends to make any changes concerning the addition or replacement of the sub-processors, it shall provide the Practice with twenty (20) business days’ prior written notice, during which the Practice can object against the appointment or replacement on reasonable and documented grounds related to the confidentiality or security of Personal Data or the sub-processor’s compliance with Applicable Laws. If the Practice does not object, Dandy may proceed with the appointment or replacement. If the Practice objects and Dandy cannot reasonably accommodate the objection, the Practice may terminate this DPA and the Agreement upon written notice. Dandy shall ensure that it has a written agreement in place with all sub-processors which imposes obligations on the sub-processor which are no less onerous on the relevant sub-processor than the obligations on Dandy under this DPA.

5. Practice’s Obligations

5.1 The Practice warrants that: (i) the legislation applicable to it does not prevent Dandy from fulfilling the instructions received from the Practice and performing Dandy’s obligations under this DPA; and (ii) it has complied and continues to comply with the Applicable Laws, in particular that it has obtained any necessary consents or given any necessary notices, and otherwise has a legitimate ground to disclose the data to Dandy and enable the Processing of the Personal Data by Dandy as set out in this DPA.

5.2 The Practice agrees that it will indemnify and hold harmless Dandy on demand from and against all claims, liabilities, costs, expenses, loss or damage (including consequential losses, loss of profit and loss of reputation and all interest, penalties and legal and other professional costs and expenses) incurred by Dandy arising directly or indirectly from a breach of this clause 5.

6. Changes in Applicable Laws

The Parties agree to negotiate in good faith modifications to this DPA if changes are required for Dandy to continue to process the Personal Data as contemplated by this DPA in compliance with the Applicable Laws, including (i) to comply with the GDPR or any national legislation implementing it, and any guidance on the interpretation of any of their respective provisions; (ii) if the SCCs or any other mechanisms or findings of adequacy are invalidated or amended; or (iii) if changes to the membership status of a country in the European Union or the European Economic Area require such modification.

7. International Transfers

Dandy shall not transfer Personal Data outside the European Economic Area unless it ensures that the transfer is subject to appropriate safeguards in accordance with Article 46 GDPR. Such appropriate safeguards may include: (a) an adequacy decision of the European Commission pursuant to Article 45 GDPR; (b) SCCs adopted by the European Commission pursuant to Article 46(2)(c) GDPR; (c) certification under the EU-US Data Privacy Framework; or (d) any other valid transfer mechanism under Applicable Laws.

8. Personal Data Breach Notification

Dandy shall notify the Practice without undue delay (and in any event within 72 hours) after becoming aware of a Personal Data Breach, providing sufficient information to allow the Practice to meet any reporting obligations to the relevant data protection authority. Further information about the Personal Data Breach shall be provided in phases as more details become available.

9. Deletion or Return 

At the choice of the Practice, Dandy shall delete or return all Personal Data to the Practice after the end of the provision of services and delete existing copies unless Applicable Laws require continued storage.

APPENDIX 1: DATA PROCESSING DETAILS

●      Subject Matter and Purpose: The provision of the services to You under the Practice Agreement. 

●      Nature: Receipt, secure storage, and transmission of dental scans and clinical records submitted by the Controller via the Dandy platform; cloud hosting of patient data and case files; 3D modelling, digital design, and fabrication of dental prosthetics; case management and workflow routing; onward transmission of case data to Dandy’s authorized sub-processors for design and manufacturing purposes; return of digital case outputs (e.g., design files and treatment plans) to the Controller; customer support and case communication; and shipping and logistics processing for delivery of finished dental restorations to the Controller.

●      Duration: The term of the Practice Agreement plus the period until all data is deleted.

●      Categories of Data Subjects: Patients and authorized end users of the Practice.

●   Types of Personal Data: Names, email addresses, addresses, professional registration numbers, and patients’ health data (including but not limited to appointment data, clinical records, and dental scans).

●      Sensitive Data and Applied Safeguards: Patients’ health data (special category data under Article 9 GDPR). Applied safeguards include: strict purpose limitation to the provision of dental laboratory services; access restrictions to authorized personnel only; encryption of data in transit and at rest; keeping records of access to patient data; and restrictions on onward transfers except as permitted under this DPA.

●      Frequency of Transfer: Continuous, as dental scans and clinical records are transmitted on an ongoing basis as part of the services.

●   Sub-processor Processing: Sub-processors may process Personal Data for the purposes of cloud hosting, data storage, and IT infrastructure services. The subject matter, nature, and duration of sub-processor processing shall be consistent with the processing described above and shall not exceed the term of the Practice Agreement. A list of authorized sub-processors is available via Dandy’s Trust Center at https://trust.meetdandy.com/subprocessors.

APPENDIX 2: SECURITY MEASURES

●  Governance and personnel. Defined accountability for information security across the workforce, endpoints, and infrastructure; documented policies covering acceptable use, access control, incident response, business continuity, and risk management, reviewed periodically; and periodic risk assessments, repeated upon material change to the Services. Personnel are screened where permitted by applicable law, bound by written confidentiality obligations, granted and revoked access through established onboarding and offboarding processes with prompt revocation on termination or role change, and trained on security and data protection at hire and periodically thereafter.

●  Access control. Role-based, least-privilege, need-to-know access to Personal Data, with multi-factor authentication and individually attributable credentials required for production systems, shared production accounts prohibited, system and service credentials managed through controlled mechanisms, access rights reviewed periodically, and access to Personal Data logged and reviewable.

●  Encryption and data protection. Personal Data encrypted in transit using TLS 1.2 or higher and at rest using AES-256 or equivalent industry-standard algorithms, with keys managed under controlled processes providing restricted access and periodic rotation. Customer data is logically separated in multi-tenant environments, limited to what the Services require, and pseudonymized where compatible; production data is not used in development or test environments.

●  Infrastructure, endpoint, and development security. Boundary protection, network segmentation, denial-of-service protection, and multi-factor authentication for administrative access; monitoring and alerting across production infrastructure, with audit logs retained and protected against unauthorized access, modification, and deletion; and managed configuration baselines with change management requiring review and documented approval before production deployment. Endpoints are centrally managed and subject to malware protection, encryption, and patching controls. A documented secure development lifecycle provides for code review, automated security testing of application code and third-party dependencies, environment separation, and controlled deployment, supported by periodic independent penetration testing with findings tracked to remediation.

●  Resilience and incident response. Redundant hosting infrastructure, regular backups of Personal Data with periodic testing of restoration procedures, and a business continuity and disaster recovery plan reviewed and tested periodically. A documented incident response process provides for the identification, escalation, and remediation of security incidents, and for notification to the Controller without undue delay upon the Processor becoming aware of a Personal Data Breach, with reasonable cooperation and such information as is available to the Processor.

●  Hosting, third parties, and cooperation. Personal Data is hosted in third-party facilities that implement physical and environmental controls, including monitored and controlled access. Processor-managed premises at which Personal Data is accessed are subject to physical and environmental security controls appropriate to the nature of the site. Sub-processors undergo security and data protection due diligence before engagement and periodic reassessment, and third-party and open-source components used in the Services are inventoried and monitored for known vulnerabilities. Personal Data is retained only as long as necessary for the purposes for which it is processed and to meet legal, accounting, or reporting obligations, after which it is deleted or returned in accordance with the Agreement. Taking into account the nature of the processing, the Processor provides reasonable assistance to the Controller, insofar as possible, in fulfilling the Controller’s obligations to respond to data subject requests and to ensure compliance with its obligations under Articles 32 to 36 of the GDPR.

EU Netherlands

These additional terms & conditions (“Terms”) to the Practice Agreement including the EU Privacy Policy, and the Data Privacy Agreement form part of the Agreement (together the “Agreement”) are entered into by and between Dandy Labs Europe SAS (“Dandy” or “We”), and you and your dental practice or office (“You” or “Practice”), and are effective as of the date the Practice Agreement is entered into (“Effective Date”). If You accept the Agreement  on behalf of an entity, partnership, corporation, or organization, “You” includes You, that entity, and all entity users and You hereby represent that You have the authority to bind all such users. Dandy and You will each be referred to as a “Party” and together, the “Parties”. Terms defined herein or elsewhere in the Agreement shall have the defined term apply across the Agreement. For good and valuable consideration as set forth in the Practice Agreement, the Parties agree to the following:

1. Billing & Payments: All amounts payable pursuant to this Agreement are in Euros (€) and may be made by transfer of Euros only (with any foreign exchange fees and bank fees, if applicable, borne by You) and exclusive of applicable Value Added Tax (VAT that shall, where applicable, be charged in addition to the invoiced amounts and paid by You, upon receipt of a valid invoice as required by Applicable Law).  We accept payment by SEPA Direct Debit, bank transfer, debit card or credit card, and You are required to keep a valid payment method on file at all times. Time of payment is of the essence. Without prejudice to the foregoing, the Parties agree that all invoices shall be paid within a maximum period of thirty (30) days from the date of receipt of the invoice or, if later, from the date of receipt of goods or services. Discounts and promotions cannot be used to pay for processing, shipping, cancellation, or other fees. Dandy has the right to charge (and You agree to pay) the maximum interest amount allowed by Applicable Law, or 1.5% per month if none is specified by Applicable Law. Interest shall accrue daily from the due date until actual payment, whether before or after judgment. Dandy does not accept paper checks, prepaid credit cards, peer-to-peer payments, or cryptocurrency as valid payment methods. In the event You have any unpaid balances for sixty (60) days or more, or the amount owed to Dandy is 10,000 € (EUR) or more, Dandy reserves the right to pause your account until all unpaid balances are remitted. In the event of continuing non-payment, Dandy may cancel or suspend any or all agreements with You, which shall not extinguish the debt or any accrual of interest. You are expected to manage your patients’ expectations of the timing of the supply of the Dandy Products ordered for them accordingly. 

Except as provided below, each Party shall be solely responsible for its own tax obligations arising in connection with this Agreement. All payments by You under this Agreement shall be made without deduction or withholding for any taxes, except as required by Applicable Law. To the extent any payment under this Agreement gives rise to any obligation on You to deduct, withhold, or remit any amount to any governmental authority under Applicable Law, the amounts due and payable under this Agreement shall be increased so that We receive an amount equal to the amount we would have received had no such deduction or withholding been made. For reporting purposes, You agree to deliver to Dandy evidence that such taxes were paid to a governmental authority, including the original or a certified copy of a receipt issued by that authority evidencing the payment.

You further acknowledge that Dandy has disclosed the possibility of processing fees and has provided the opportunity to ask any questions regarding such fees prior to entering this Agreement. You agree to indemnify and hold Dandy harmless from any claims, damages, or losses arising from any such surcharges imposed by third-party service providers. Dandy reserves the right to change pricing for Dandy Products (defined below) at any time upon forty-five (45) days’ notice. You agree that You shall have no right of set-off, counterclaim deduction or withholding against amounts owed by Dandy to You. You agree that Dandy may at any time and without limiting any other rights or remedies it may have, set-off any amount owing by You against any amount payable by Dandy to You. Dandy does not accept payments from patients, including payments in the patient’s name forwarded by You.

2. Equipment. The risk of loss, theft, damage or destruction of the Equipment shall pass to You on Delivery. The Equipment shall remain at your sole risk during the term of this Agreement and any further term during which the Equipment is in your possession, custody or control (the “Risk Period“) until the Equipment is redelivered to Dandy. You shall give immediate written notice to Dandy in the event of any loss, accident or damage to the Equipment arising out of or in connection with your possession or use of the Equipment.

3. IT Requirements. You agree to provide and maintain a high-speed internet connection for use in connection with the Equipment, and You agree to follow the IT Policies included in the online terms and conditions.

4. Indemnity: You shall indemnify, keep indemnified, defend and hold harmless Dandy against and from any and all claims, causes of actions, damages, debts, liabilities, losses, obligations, payments, costs and expenses (including legal expenses), arising from or relating to: (a) breach by You of any term of any agreement with Dandy; (b) breach by You of any term of any agreement between You and your patient or any acts or failures in respect of a patient (including actions by any professional body regulating You or any national regulator(s) or licensing body), including without limitation, negligence or willful acts regarding patient care or the provision of any incorrect clinical data; and (c) provision by You of incorrect or incomplete information, documents, scans or impressions or failure to timely provide Dandy with any information we request from You.

5. Practice Change of Control: If your dental practice undergoes a Change of Control from an ownership perspective, You agree to inform Dandy with written notice within five (5) business days before the day such Change of Control becomes effective. For the purposes of this clause, a “Change of Control” situation shall include any transaction or series of transactions resulting in a change in the direct or indirect ownership of more than fifty percent (50%) of the voting rights or share capital of your dental practice, or any merger, consolidation, or sale of substantially all of its assets.

6. Medical Disclaimer: Your practice is solely responsible for the treatment of patients using any Dandy Offerings, and for providing your patients with all relevant information about the Dandy Offerings and any related risk prior to and after treatment. The Dandy Offerings are offered solely as a supplement to your dental practice and do not constitute medical, dental or other healthcare advice, diagnosis or treatment to or for your patients. You agree not to make any representations or warranties regarding the Dandy Offerings to your patients. You represent to Dandy that your practice will comply with all Applicable Law, regulations, guidance and professional codes of conduct regarding professionals who are authorized to practice dentistry and to conduct intraoral scans on practice patients. Except as otherwise expressly provided herein, the Dandy Offerings provided to you hereunder are provided “AS IS” and are provided pursuant to your prescription for the individual patient. 

The Parties acknowledge that this Agreement creates no direct contractual relationship between Dandy and Your patients. Any claims, demands, or actions brought by a patient or regulatory body arising out of your clinical decisions, treatment management, prescription errors, or the provision of faulty data (such as defective scans or impressions) shall be subject to your full indemnification obligations as set out in section 4.

You agree to comply with your obligations under Regulation (EU) 2017/745 on medical devices to the extent applicable. You agree to handle all communications and other activities in relation to any recall or other regulatory activity in accordance with all our reasonable instructions and to not reach out or otherwise communicate with a competent authority prior to consultation with us. This obligation as well as related indemnification arrangements of the Online Terms and Conditions shall survive termination of this Practice Agreement for the period medical devices supplied by us remain in use.

7. Amendment. These Terms and the Agreement may be changed by mutual written agreement of the Parties. These Terms and the Agreement may otherwise be amended by Dandy and Dandy will notify You of any material changes. Such material changes shall become effective thirty (30) days after notification unless You terminate by written notice within that period. In such cases, Dandy will honor existing Terms for sixty (60) days or until the Equipment is returned.

8. Entire Agreement. The Practice Agreement, these Terms, the EU Privacy Policy, the Data Privacy Agreement (“DPA”) (Schedule A), and the IT Policy constitute the “Agreement”. This Agreement supersedes all prior conflicting agreements.

9. Non-assignability. You may not transfer or assign the Agreement to a third party without Dandy’s prior written consent.

10. Legal Compliance. Both Parties agree to comply with all applicable health and data laws in the jurisdiction where You and Dandy are both established, relevant regulatory standards issued by European and national authorities, and guidance issued by professional regulatory bodies.

11. Governing Law & Jurisdiction. 

  1. Governing Law. You agree that the Agreement shall be governed by and construed in accordance with the laws of the jurisdiction where the Practice is established. 
  2. Jurisdiction. Any disputes arising out of or in connection with the Agreement shall be submitted to the exclusive jurisdiction of the courts of the applicable jurisdiction where the Practice is established, as set forth in the table below.
CountryJurisdiction
FrankrijkTribunaal voor Economische Activiteiten van Parijs
IrelandCourts of Dublin 
ItalyTribunal of Milan
The NetherlandsThe competent court in Amsterdam, the Netherlands
SpainCourts and Tribunals of Madrid

12. VAT & Tax. Dandy will charge Value Added Tax (“VAT”) at the applicable rate in addition to any price, charge or amount due under the Agreement and such VAT shall be payable by You, where applicable. If You are exempt, You must provide a valid VAT exemption certificate or evidence satisfactory to the relevant tax administration, when available or justify the basis for the VAT exemption.

13. Data Privacy. Because Dandy processes personal data, including health data (“Personal Data”) on your behalf.

Data Protection Roles. The Parties acknowledge that:

Data Protection Contact. Any privacy-related notices or requests under this Agreement should be directed to Dandy at [email protected]

Schedule A: Data Privacy Agreement (“DPA”)

This DPA is incorporated into the Agreement where Dandy acts as a processor on behalf of the Practice as controller. The nature, purpose, and duration of the processing are set out in Appendix 1 (“Data Processing Details”).

1. Definitions

●      “Applicable Laws” means all applicable laws that govern the processing and security of Personal Data as well as the privacy of electronic communications, including, without limitation, (i) Regulation (EU) 2016/679 of 27 April 2016 (the GDPR), (ii) Directive 2002/58/EC of 12 July 2002 (the ePrivacy Directive), (iii) domestic laws implementing and supplementing the EU laws referred to in this definition, and (iv) the relevant provisions of national health laws, each of (i) to (iv) as amended and/or supplemented from time to time.

●      “Personal Data Breach” means any breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Personal Data, or any other event affecting the integrity, availability or confidentiality of Personal Data.

●      “Special Category Data” means the categories of Personal Data referred to in Article 9 of the GDPR (including but not limited to Personal Data concerning health, biometric data, or data used for the purpose of uniquely identifying a natural person and genetic data).

●      “Personal Data” means personal data (as defined by the GDPR) processed by Dandy on behalf of the Practice.

●      “Data Subject” has the meaning given in the GDPR.

●      “Regulator” means a data protection supervisory authority which has jurisdiction over the Practice’s Processing of Personal Data.

●      “SCCs” means the standard contractual clauses for the transfer of personal data to third countries set out in Commission Decision 2021/914 of 4 June 2021, as amended, updated or replaced from time to time.

●      “Third Country” means any country or territory outside of the scope of the data protection laws of the European Economic Area, excluding countries or territories approved as providing adequate protection for personal data by the European Commission from time to time.

●      “Data Privacy Framework” means, as relevant, the EU-US Data Privacy Framework as administered by the US Department of Commerce and approved by the European Commission as ensuring an adequate level of protection for personal data for the purposes of Article 45 GDPR, as in force, amended, consolidated, re-enacted or replaced from time to time.

2. Subject Matter & Instructions

Dandy shall process Personal Data only on the documented instructions of the Practice, including with regard to transfers of Personal Data to a Third Country, unless required to do so by Applicable Laws, to which Dandy is subject; in such a case, Dandy shall inform the Practice of that legal requirement before Processing, unless that law prohibits such information on important grounds of public interest. If Dandy believes any instruction infringes Applicable Laws, it shall immediately inform the Practice and shall be entitled to suspend the execution of the relevant instruction until the Practice confirms, amends or withdraws it. Any oral instructions shall be confirmed by the Practice in writing without undue delay.

The Practice shall ensure it has a lawful basis under Article 6 of the GDPR for processing Personal Data, as well as an exemption under Article 9 of the GDPR for processing Special Category Data, in the context contemplated in this DPA.

3. Obligations of Dandy (the “Processor”)

●      Confidentiality: Dandy shall ensure that its personnel authorized to process the Personal Data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality.

●      Data Subject Rights: Dandy shall assist the Practice by appropriate technical and organizational measures for the fulfillment of the Practice’s obligation to respond to requests for exercising Data Subject rights, including rights to rectification, erasure, restriction of processing, access, data portability, objection, and the right not to be subject to automated decision making. Dandy shall respond to any such request from the Practice without undue delay.

●      Assistance: Each Party shall provide reasonable assistance to the other as necessary to comply with its respective obligations under Applicable Laws, including in relation to the security of processing, notification of a Personal Data Breach to the relevant data protection authority and/or Data Subjects, preparation of data protection impact assessments, prior consultation with the relevant data protection authority, and any assessment, enquiry, notice or investigation by a Regulator. Without limiting the foregoing, the Practice shall cooperate with Dandy in good faith in connection with any regulatory enquiry, audit or investigation that relates to Dandy’s processing of Personal Data under this DPA.

●      Security: Dandy shall implement appropriate technical and organizational measures to ensure a level of security appropriate to the risk, taking into account the state of the art, the costs of implementation and the nature, scope, context and purpose of the Processing, as further detailed in Appendix 2. Dandy may update or modify the security measures set out in Appendix 2 from time to time, provided that such updates or modifications do not materially diminish the overall level of protection afforded to Personal Data.

●      Audit & Inspection: Dandy shall upon written request from the Practice from time to time provide the Practice with such information as is reasonably necessary to demonstrate compliance with the obligations laid down in this Agreement. Dandy shall contribute to audits, including inspections of Dandy’s premises, systems, equipment, and data processing facilities, conducted by the Practice or an independent auditor in possession of the required professional qualifications and bound by a duty of confidentiality, appointed by the Practice (“On-Site Audits”). Any On-Site Audits shall be conducted upon a 60 day prior written notice to Dandy (or shorter notice where required by a Regulator or following a Personal Data Breach or another matter of urgency), not more than once every calendar year (unless required by a Regulator or following a Personal Data Breach or another matter of urgency). The Parties shall use reasonable endeavors to ensure any On-Site Audits are conducted during Dandy’s normal business hours and do not unreasonably affect Dandy’s operations. The Practice shall bear the costs of any On-Site Audits, except where an audit reveals a material breach by Dandy of its obligations under this DPA.

4. Sub-Processing

4.1 The Practice hereby grants Dandy general written authorisation to engage the sub-processors listed within Dandy’s Trust Center, which can be found at https://trust.meetdandy.com/subprocessors, and subject to this clause 4.

4.2 If Dandy appoints a new sub-processor or intends to make any changes concerning the addition or replacement of the sub-processors, it shall provide the Practice with twenty (20) business days’ prior written notice, during which the Practice can object against the appointment or replacement on reasonable and documented grounds related to the confidentiality or security of Personal Data or the sub-processor’s compliance with Applicable Laws. If the Practice does not object, Dandy may proceed with the appointment or replacement. If the Practice objects and Dandy cannot reasonably accommodate the objection, the Practice may terminate this DPA and the Agreement upon written notice. Dandy shall ensure that it has a written agreement in place with all sub-processors which imposes obligations on the sub-processor which are no less onerous on the relevant sub-processor than the obligations on Dandy under this DPA.

5. Practice’s Obligations

5.1 The Practice warrants that: (i) the legislation applicable to it does not prevent Dandy from fulfilling the instructions received from the Practice and performing Dandy’s obligations under this DPA; and (ii) it has complied and continues to comply with the Applicable Laws, in particular that it has obtained any necessary consents or given any necessary notices, and otherwise has a legitimate ground to disclose the data to Dandy and enable the Processing of the Personal Data by Dandy as set out in this DPA.

5.2 The Practice agrees that it will indemnify and hold harmless Dandy on demand from and against all claims, liabilities, costs, expenses, loss or damage (including consequential losses, loss of profit and loss of reputation and all interest, penalties and legal and other professional costs and expenses) incurred by Dandy arising directly or indirectly from a breach of this clause 5.

6. Changes in Applicable Laws

The Parties agree to negotiate in good faith modifications to this DPA if changes are required for Dandy to continue to process the Personal Data as contemplated by this DPA in compliance with the Applicable Laws, including (i) to comply with the GDPR or any national legislation implementing it, and any guidance on the interpretation of any of their respective provisions; (ii) if the SCCs or any other mechanisms or findings of adequacy are invalidated or amended; or (iii) if changes to the membership status of a country in the European Union or the European Economic Area require such modification.

7. International Transfers

Dandy shall not transfer Personal Data outside the European Economic Area unless it ensures that the transfer is subject to appropriate safeguards in accordance with Article 46 GDPR. Such appropriate safeguards may include: (a) an adequacy decision of the European Commission pursuant to Article 45 GDPR; (b) SCCs adopted by the European Commission pursuant to Article 46(2)(c) GDPR; (c) certification under the EU-US Data Privacy Framework; or (d) any other valid transfer mechanism under Applicable Laws.

8. Personal Data Breach Notification

Dandy shall notify the Practice without undue delay (and in any event within 72 hours) after becoming aware of a Personal Data Breach, providing sufficient information to allow the Practice to meet any reporting obligations to the relevant data protection authority. Further information about the Personal Data Breach shall be provided in phases as more details become available.

9. Deletion or Return 

At the choice of the Practice, Dandy shall delete or return all Personal Data to the Practice after the end of the provision of services and delete existing copies unless Applicable Laws require continued storage.

APPENDIX 1: DATA PROCESSING DETAILS

●      Subject Matter and Purpose: The provision of the services to You under the Practice Agreement. 

●      Nature: Receipt, secure storage, and transmission of dental scans and clinical records submitted by the Controller via the Dandy platform; cloud hosting of patient data and case files; 3D modelling, digital design, and fabrication of dental prosthetics; case management and workflow routing; onward transmission of case data to Dandy’s authorized sub-processors for design and manufacturing purposes; return of digital case outputs (e.g., design files and treatment plans) to the Controller; customer support and case communication; and shipping and logistics processing for delivery of finished dental restorations to the Controller.

●      Duration: The term of the Practice Agreement plus the period until all data is deleted.

●      Categories of Data Subjects: Patients and authorized end users of the Practice.

●   Types of Personal Data: Names, email addresses, addresses, professional registration numbers, and patients’ health data (including but not limited to appointment data, clinical records, and dental scans).

●      Sensitive Data and Applied Safeguards: Patients’ health data (special category data under Article 9 GDPR). Applied safeguards include: strict purpose limitation to the provision of dental laboratory services; access restrictions to authorized personnel only; encryption of data in transit and at rest; keeping records of access to patient data; and restrictions on onward transfers except as permitted under this DPA.

●      Frequency of Transfer: Continuous, as dental scans and clinical records are transmitted on an ongoing basis as part of the services.

●   Sub-processor Processing: Sub-processors may process Personal Data for the purposes of cloud hosting, data storage, and IT infrastructure services. The subject matter, nature, and duration of sub-processor processing shall be consistent with the processing described above and shall not exceed the term of the Practice Agreement. A list of authorized sub-processors is available via Dandy’s Trust Center at https://trust.meetdandy.com/subprocessors.

APPENDIX 2: SECURITY MEASURES

●  Governance and personnel. Defined accountability for information security across the workforce, endpoints, and infrastructure; documented policies covering acceptable use, access control, incident response, business continuity, and risk management, reviewed periodically; and periodic risk assessments, repeated upon material change to the Services. Personnel are screened where permitted by applicable law, bound by written confidentiality obligations, granted and revoked access through established onboarding and offboarding processes with prompt revocation on termination or role change, and trained on security and data protection at hire and periodically thereafter.

●  Access control. Role-based, least-privilege, need-to-know access to Personal Data, with multi-factor authentication and individually attributable credentials required for production systems, shared production accounts prohibited, system and service credentials managed through controlled mechanisms, access rights reviewed periodically, and access to Personal Data logged and reviewable.

●  Encryption and data protection. Personal Data encrypted in transit using TLS 1.2 or higher and at rest using AES-256 or equivalent industry-standard algorithms, with keys managed under controlled processes providing restricted access and periodic rotation. Customer data is logically separated in multi-tenant environments, limited to what the Services require, and pseudonymized where compatible; production data is not used in development or test environments.

●  Infrastructure, endpoint, and development security. Boundary protection, network segmentation, denial-of-service protection, and multi-factor authentication for administrative access; monitoring and alerting across production infrastructure, with audit logs retained and protected against unauthorized access, modification, and deletion; and managed configuration baselines with change management requiring review and documented approval before production deployment. Endpoints are centrally managed and subject to malware protection, encryption, and patching controls. A documented secure development lifecycle provides for code review, automated security testing of application code and third-party dependencies, environment separation, and controlled deployment, supported by periodic independent penetration testing with findings tracked to remediation.

●  Resilience and incident response. Redundant hosting infrastructure, regular backups of Personal Data with periodic testing of restoration procedures, and a business continuity and disaster recovery plan reviewed and tested periodically. A documented incident response process provides for the identification, escalation, and remediation of security incidents, and for notification to the Controller without undue delay upon the Processor becoming aware of a Personal Data Breach, with reasonable cooperation and such information as is available to the Processor.

●  Hosting, third parties, and cooperation. Personal Data is hosted in third-party facilities that implement physical and environmental controls, including monitored and controlled access. Processor-managed premises at which Personal Data is accessed are subject to physical and environmental security controls appropriate to the nature of the site. Sub-processors undergo security and data protection due diligence before engagement and periodic reassessment, and third-party and open-source components used in the Services are inventoried and monitored for known vulnerabilities. Personal Data is retained only as long as necessary for the purposes for which it is processed and to meet legal, accounting, or reporting obligations, after which it is deleted or returned in accordance with the Agreement. Taking into account the nature of the processing, the Processor provides reasonable assistance to the Controller, insofar as possible, in fulfilling the Controller’s obligations to respond to data subject requests and to ensure compliance with its obligations under Articles 32 to 36 of the GDPR.

Belgium (French)

Les présentes conditions générales additionnelles (« Conditions Générales ») de l’Accord de Collaboration, y compris l’Accord relatif à la protection des données (Data Privacy Agreement), font partie intégrante du Contrat (ensemble, le « Contrat ») sont conclues entre Dandy Labs Europe SAS (« Dandy » ou « Nous ») et vous, ainsi que votre cabinet ou clinique dentaire (« Vous » ou le « Cabinet »), et prennent effet à la date de la conclusion de l’Accord de Collaboration (la « Date d’Entrée en Vigueur »). Si Vous acceptez le présente Contrat pour le compte d’une entité, d’une société de personnes, d’une société ou d’une organisation, « Vous » désigne Vous, ladite entité et l’ensemble des utilisateurs de l’entité, et Vous déclarez disposer du pouvoir de lier l’ensemble de ces utilisateurs. Dandy et Vous seront chacun désignés comme une « Partie » et, ensemble, les « Parties ». Les termes définis dans les présentes ou ailleurs dans le Contrat ont la même définition dans l’ensemble du Contrat. En contrepartie des stipulations de l’Accord de Collaboration, les Parties conviennent de ce qui suit :

1. Facturation et paiements. Tous les montants dus en vertu du présent Contrat sont libellés en euros (€) et ne peuvent être réglés que par virement en euros (les frais de change et les frais bancaires, le cas échéant, étant à votre charge), hors taxe sur la valeur ajoutée (TVA) applicable (celle-ci devant, le cas échéant, être facturée en sus des montants facturés et payée par Vous, dès réception d’une facture valide conformément à la Loi Applicable). Nous acceptons les paiements par prélèvement SEPA, virement bancaire, carte de débit ou carte de crédit, et Vous êtes tenu de maintenir à tout moment un moyen de paiement valide dans votre dossier. Le respect des délais de paiement est essentiel. Sans préjudice de ce qui précède, les Parties conviennent que toutes les factures doivent être réglées dans un délai maximal de trente (30) jours à compter de la date de réception de la facture ou, si elle est postérieure, à compter de la date de réception des biens ou des services. Les remises et promotions ne peuvent pas être utilisées pour payer des frais de traitement, d’expédition, d’annulation ou d’autres frais. Dandy se réserve le droit de facturer (et Vous acceptez de payer) le montant maximal des intérêts autorisé par la Loi Applicable, ou 1,5 % par mois si aucun taux n’est spécifié par la Loi Applicable. Les intérêts courront quotidiennement à compter de la date d’échéance jusqu’au paiement effectif, que ce soit avant ou après jugement. Dandy n’accepte pas les chèques papier, les cartes de crédit prépayées, les paiements de pair à pair ou les cryptomonnaies comme moyens de paiement valides. Dans le cas où Vous auriez des soldes impayés depuis soixante (60) jours ou plus, ou si le montant dû à Dandy est de 10 000 € (EUR) ou plus, Dandy se réserve le droit de suspendre votre compte Dandy jusqu’à ce que tous les soldes impayés soient réglés. En cas de non-paiement persistant, Dandy pourra résoudre ou suspendre tout ou partie des contrats conclus avec Vous, ce qui n’éteindra pas la dette ni les intérêts courus. Il Vous appartient de gérer les attentes de vos patients quant aux délais de livraison des Produits Dandy commandés pour eux.

Sauf disposition contraire ci-dessous, chaque Partie est seule responsable de ses propres obligations fiscales découlant du présent Contrat. Tous les paiements que Vous effectuez au titre du présent Contrat sont réalisés sans aucune déduction ni retenue au titre d’impôts ou de taxes, sauf si la Loi Applicable l’exige. Dans la mesure où un paiement au titre du présent Contrat Vous oblige, en vertu de le la Loi Applicable, à déduire, retenir ou reverser un montant quelconque à une autorité publique, les montants dus au titre du présent Contrat seront majorés de sorte que Nous percevions un montant égal à celui que Nous aurions perçu en l’absence de cette déduction ou retenue. À des fins déclaratives, Vous vous engagez à remettre à Dandy la preuve du paiement de ces impôts ou taxes à l’autorité publique, notamment l’original ou une copie certifiée conforme d’un reçu délivré par cette autorité attestant du paiement.

Vous reconnaissez en outre que Dandy a divulgué la possibilité de frais de traitement et a offert la possibilité de poser toute question relative à ces frais avant la conclusion du présent Contrat. Vous acceptez d’indemniser Dandy et de le tenir indemne de toute réclamation, dommage ou perte résultant de surcharges imposées par des prestataires de services tiers. Dandy se réserve le droit de modifier les tarifs des Produits Dandy (définis ci-dessous) à tout moment moyennant un préavis de quarante-cinq (45) jours. Vous acceptez que Vous n’aurez aucun droit de compensation, de demande reconventionnelle, de déduction ou de retenue à l’encontre des montants dus par Dandy à Vous. Vous acceptez que Dandy puisse à tout moment, et sans limiter les autres droits ou recours dont elle pourrait disposer, compenser tout montant dû par Vous avec tout montant payable par Dandy à Vous. Dandy n’accepte pas les paiements provenant de patients, y compris les paiements au nom du patient transmis par Vous.

2. Equipment. Les risques de perte, de vol, de dommage ou de destruction de l’Équipement Vous sont transférés à la Livraison. L’Équipement demeure sous Votre seule responsabilité pendant la durée du présent Contrat et pendant toute période ultérieure au cours de laquelle l’Équipement est en Votre possession, sous Votre garde ou sous Votre contrôle (la « Période de Risque »), jusqu’à sa restitution à Dandy. Vous devez informer immédiatement Dandy par écrit de toute perte, de tout accident ou de tout dommage subi par l’Équipement du fait ou à l’occasion de sa possession ou de son utilisation par Vous. Dandy fournira des étiquettes d’expédition et un carton pour le retour de l’Équipement.

Vous vous engagez à ne pas modifier, endommager ou détruire l’Équipement de quelque manière que ce soit, ni en retirer une quelconque partie de votre Cabinet. Dandy Vous fournira l’assistance, le service technique et la maintenance logicielle de l’Équipement. Vous vous engagez à assurer l’entretien quotidien approprié de l’Équipement, notamment son nettoyage et son rangement en toute sécurité. Vous êtes responsable de l’Équipement tant qu’il est en Votre possession et Vous supportez le risque de sa perte, le cas échéant. En cas de dommage partiel de l’Équipement dû à une erreur d’utilisation, notamment une installation incorrecte, un mauvais usage ou un usage abusif de l’Équipement, Dandy peut, à sa seule discrétion, Vous facturer des frais de pièces de rechange pouvant aller jusqu’à 3 000 € (EUR).

3. Garantie de Dandy. Nous garantissons la qualité des Produits Dandy. Les piliers implantaires en titane bénéficient d’une garantie à vie contre la rupture du produit dans le cadre d’une utilisation normale due à un défaut de matériaux, de fabrication ou de façonnage. Tous les produits fixes (à savoir, les couronnes, bridges, couronnes sur implant, bridges sur implant, inlays, onlays, facettes et piliers implantaires en zircone, chacun dans la mesure où ils sont disponibles sur Votre marché) bénéficient d’une garantie à vie contre la rupture du produit dans le cadre d’une utilisation normale due à un défaut de matériaux, de fabrication ou de façonnage. Dans la mesure où ils sont disponibles sur Votre marché, toutes les prothèses partielles et complètes, les gouttières de nuit, les attelles, les dispositifs contre l’apnée du sommeil, les aligneurs transparents, les appareils de contention et les gouttières de blanchiment bénéficient d’une garantie contre l’usure normale pendant les six (6) premiers mois à compter de la date de livraison, et d’une garantie de dix (10) ans contre la rupture du produit dans le cadre d’une utilisation normale due à un défaut de matériaux, de fabrication ou de façonnage. Au titre de la garantie Dandy, et comme seul recours, Dandy réparera ou remplacera le produit ou remboursera le prix d’achat initial, à la seule discrétion de Dandy. La garantie sera annulée si la restauration n’est pas régulièrement entretenue et contrôlée par un professionnel dentaire qualifié. 

Les produits tiers inclus dans l’équipement bénéficieront des garanties du fabricant qui pourraient Vous être transmises par Dandy, mais ne bénéficieront pas autrement de la garantie de Dandy prévue ci-dessus. 

Dans la limite maximale autorisée par la Loi Applicable, les garanties énoncées dans le présent article 3 sont les seules garanties applicables aux produits fournis par Dandy, et toutes les autres garanties expresses et implicites sont exclues, y compris les garanties implicites de qualité marchande, d’adéquation ou d’aptitude à un usage particulier, et de non-contrefaçon.

4. Exigences informatiques. Vous acceptez de fournir et de maintenir une connexion internet haut débit pour une utilisation en lien avec l’équipement, et Vous acceptez de respecter les Politiques Informatiques incluses dans les Conditions Générales accessibles en ligne.

5. Formation. Vous, ainsi que toute personne au sein de votre Cabinet qui utilisera la plateforme logicielle fournie par Dandy, tel qu’elle pourra être mise à jour pour inclure le logiciel Chairside, le Portail Dandy, tout service numérique ou support, tout matériel et/ou logiciel, ou les Produits Dandy fixes et amovibles (ensemble, les « Offres Dandy »), devrez participer à une formation à distance Dandy avant d’utiliser ou de discuter des Offres Dandy avec les patients.

6. Indemnisation. Vous vous engagez à indemniser, à tenir indemne, à défendre et à garantir Dandy contre et de toutes réclamations, action en justice, dommages, dettes, responsabilités, pertes, obligations, paiements, coûts et dépenses (y compris les frais juridiques) découlant de ou liés à : (a) toute violation par Vous d’une stipulation de tout contrat conclu avec Dandy ; (b) toute violation par Vous d’une stipulation de tout contrat conclu entre Vous et Votre patient, ou tout acte ou toute défaillance à l’égard d’un patient (y compris les actions de tout organisme professionnel Vous réglementant, de toute autorité nationale de régulation ou de tout organisme d’agrément), notamment toute négligence ou tout acte intentionnel concernant les soins aux patients ou la fourniture de données cliniques incorrectes ; et (c) la fourniture par Vous d’informations, de documents, de scans ou d’empreintes incorrects ou incomplets, ou le défaut de fournir en temps utile à Dandy toute information que Nous Vous demandons.

7. Changement de contrôle du cabinet dentaire. Si votre Cabinet fait l’objet d’un Changement de Contrôle du point de vue de l’actionnariat, Vous acceptez d’en informer Dandy par notification écrite dans un délai de cinq (5) jours ouvrés avant la date à laquelle ce Changement de Contrôle prend effet. Aux fins du présent article, un « Changement de Contrôle » désigne toute opération ou série d’opérations entraînant un changement dans la propriété directe ou indirecte de plus de cinquante pour cent (50 %) des droits de vote ou du capital social de votre Cabinet, ou toute fusion, consolidation ou vente de la quasi-totalité de ses actifs.

8. Avertissement médical : Votre Cabinet est seul responsable du traitement des patients utilisant toute Offre Dandy, et de la fourniture à vos patients de toutes les informations pertinentes relatives aux Offres Dandy et à tout risque associé, avant et après le traitement. Les Offres Dandy sont proposées uniquement en complément de votre Cabinet et ne constituent pas un conseil médical, dentaire ou de santé, un diagnostic ou un traitement à l’attention de vos patients. Vous acceptez de ne faire aucune déclaration ni garantie concernant les Offres Dandy à vos patients. Vous garantissez à Dandy que votre Cabinet se conformera à l’ensemble de la Loi Applicable, des réglementations, directives et codes de déontologie professionnelle concernant les professionnels autorisés à exercer la dentisterie et à réaliser des scans intra-oraux sur les patients du Cabinet. Sauf disposition expressément contraire dans les présentes, les Offres Dandy qui Vous sont fournies au titre des présentes sont fournies « EN L’ÉTAT » et sont fournies conformément à votre prescription pour le patient individuel.

Les Parties reconnaissent que le présent Contrat ne crée aucune relation contractuelle directe entre Dandy et Vos patients. Toute réclamation, demande ou action introduite par un patient ou une autorité réglementaire et résultant de vos décisions cliniques, de la prise en charge du traitement, d’erreurs de prescription ou de la fourniture de données erronées ou défectueuses (telles que des scans ou empreintes défectueux) sera soumise à vos obligations d’indemnisation intégrale telles que prévues à l’Article 6.

Vous acceptez de respecter les obligations qui Vous incombent au titre du règlement (UE) 2017/745 relatif aux dispositifs médicaux, dans la mesure où elles Vous sont applicables. Vous acceptez de prendre en charge l’ensemble des communications et autres mesures liées à tout rappel de produit ou à toute autre mesure réglementaire conformément à l’ensemble de nos instructions raisonnables, et de ne pas contacter ni communiquer de quelque autre manière que ce soit avec une autorité compétente sans Nous avoir préalablement consultés. Cette obligation, ainsi que les obligations d’indemnisation correspondantes prévues par ces Conditions Générales, survivront à la résiliation du Contrat de Collaboration aussi longtemps que les dispositifs médicaux que nous avons fournis resteront en utilisation.

9. Amendement. Les présentes Conditions Générales et le présente Contrat peuvent être modifiés d’un commun accord écrit entre les Parties. Elles peuvent également être modifiées par Dandy, qui Vous informera de toute modification substantielle. Ces modifications substantielles prendront effet trente (30) jours après leur notification, sauf si Vous résiliez le contrat par notification écrite dans ce délai. Dans ce cas, Dandy continuera d’appliquer les Conditions Générales en vigueur pendant soixante (60) jours ou jusqu’à ce que l’Équipement soit restitué.

10. Intégralité du Contrat. L’Accord de Collaboration, les présentes Conditions Générales, l’Accord de Protection des Données (« DPA ») (Annexe A) et les Politiques Informatiques constituent l’intégralité du contrat (le « Contrat »). Le présent Contrat remplace et annule tout accord antérieur incompatible.

11. Incessibilité. Vous ne pouvez pas transférer ni céder le présent Contrat à un tiers sans l’accord écrit préalable de Dandy.

12. Conformité légale. Les Parties conviennent de se conformer à l’ensemble des lois applicables en matière de santé et de données dans la juridiction où Vous et Dandy êtes tous deux établis, aux normes réglementaires pertinentes édictées par les autorités européennes et nationales, ainsi qu’aux orientations publiées par les organismes de réglementation professionnelle.

13. Loi Applicable et Compétence juridictionnelle.

  1. Loi Applicable. Vous acceptez que le présent Contrat soit régi par et interprété conformément aux lois de la juridiction dans laquelle Vous êtes établi(e) (« Loi Applicable »).
  1. Compétence juridictionnelle. Tout litige découlant du présent Contrat ou en lien avec celui-ci sera soumis à la compétence exclusive des tribunaux de la juridiction applicable dans laquelle Vous êtes établi(e), comme indiqué dans le tableau ci‑dessous.
LandenBevoegde rechterlijke instantie
DuitslandRechtbanken van Frankfurt am Main
BelgiëRechtbanken van Brussel
SpanjeRechtbanken en gerechtshoven van Madrid
FrankrijkTribunaal voor Economische Activiteiten van Parijs
IerlandRechtbanken van Dublin
ItaliëRechtbank van Milaan
NederlandDe bevoegde rechtbank van Amsterdam (Nederland)
ZwedenRechtbanken van Stockholm

14. TVA & fiscalité. Dandy facturera la taxe sur la valeur ajoutée (« TVA ») au taux applicable, en sus de tout prix, frais, charge ou montant dû au titre du Contrat, et ladite TVA sera, le cas échéant, payable par Vous. Si Vous bénéficiez d’une exonération, Vous devrez fournir un certificat d’exonération de TVA valable ou tout justificatif jugé satisfaisant par l’administration fiscale compétente, lorsqu’un tel document est disponible, ou justifier le fondement de toute exonération de TVA.

15. Protection des données. Dans la mesure où Dandy traite, pour votre compte, des données à caractère personnel, y compris des données de santé (« Données à Caractère Personnel ») :

Rôles en matière de protection des données. Les Parties reconnaissent que :

Contact pour la protection des données. Toute notification ou demande relative à la protection des données au titre du présent Contrat doit être adressée à Dandy à l’adresse [email protected].

Annexe A : Accord relatif à la protection des données (« DPA »)

Le présent DPA est intégré au Contrat lorsque Dandy agit en qualité de « Sous-traitant » pour le compte du Cabinet, en qualité de « Responsable du traitement ». La nature, les finalités et la durée du traitement sont définies à l’Annexe 1 (« Détails du traitement des données »).

1. Définitions

2. Objet et instructions

Dandy ne traite les Données à caractère personnel que sur instructions documentées du Cabinet, y compris en ce qui concerne les transferts de Données à caractère personnel vers un Pays tiers, sauf si elle y est tenue en vertu des lois applicables auxquelles Dandy est soumise ; dans ce cas, Dandy informe le Cabinet de cette obligation légale avant le traitement, à moins que la loi concernée n’interdise une telle information pour des motifs importants d’intérêt public. Si Dandy estime qu’une instruction constitue une violation des Lois applicables, elle en informe immédiatement le Cabinet et est autorisée à suspendre l’exécution de l’instruction concernée jusqu’à ce que le Cabinet la confirme, la modifie ou la retire. Toute instruction orale est confirmée par écrit par le Cabinet sans retard indu.

Le Cabinet veille à disposer d’une base légale au titre de l’article 6 du RGPD pour le traitement des Données à caractère personnel, ainsi que d’une condition de licéité au titre de l’article 9 du RGPD pour le traitement des Données de catégorie particulière, dans le cadre envisagé par le présent DPA.

3. Obligations de Dandy (le « Sous-traitant »)

4. Sous-traitance ultérieure

4.1 Le Cabinet autorise par les présentes Dandy, par une autorisation générale écrite, à faire appel aux sous-traitants ultérieurs figurant dans le Trust Center de Dandy, accessible à l’adresse https://trust.meetdandy.com/subprocessors, sous réserve des dispositions de la présente clause 4.

4.2 Si Dandy désigne un nouveau sous-traitant ultérieur ou envisage toute modification concernant l’ajout ou le remplacement de sous-traitants ultérieurs, elle en informe le Cabinet par écrit au moins vingt (20) jours ouvrés à l’avance. Pendant ce délai, le Cabinet peut s’opposer à la désignation ou au remplacement pour des motifs raisonnables et documentés liés à la confidentialité ou à la sécurité des Données à caractère personnel, ou au respect des Lois applicables par le sous-traitant ultérieur. Si le Cabinet ne formule pas d’objection, Dandy peut procéder à la désignation ou au remplacement. Si le Cabinet formule une objection et que Dandy ne peut raisonnablement en tenir compte, le Cabinet peut résilier le présent DPA et le Contrat par notification écrite. Dandy veille à conclure avec chacun des sous-traitants ultérieurs un accord écrit imposant à celui-ci des obligations au moins aussi contraignantes que celles qui incombent à Dandy au titre du présent DPA.

5. Obligations du Cabinet

5.1 Le Cabinet garantit que : (i) la législation qui lui est applicable n’empêche pas Dandy de donner suite aux instructions reçues du Cabinet et d’exécuter ses obligations au titre du présent DPA ; et (ii) il s’est conformé et continue de se conformer aux Lois applicables, notamment qu’il a obtenu tous les consentements nécessaires ou fourni toutes les informations nécessaires, et qu’il dispose par ailleurs d’un fondement juridique légitime pour communiquer les données à Dandy et permettre à Dandy de traiter les Données à caractère personnel comme prévu dans le présent DPA.

5.2 Le Cabinet convient d’indemniser et de garantir Dandy, à première demande, contre l’ensemble des réclamations, responsabilités, coûts, dépenses, pertes ou dommages, y compris les préjudices consécutifs, le manque à gagner, l’atteinte à la réputation, ainsi que tous intérêts, pénalités et frais et honoraires d’avocats et autres professionnels, engagés ou subis par Dandy et résultant directement ou indirectement d’un manquement à la présente clause 5.

6. Modifications des Lois applicables

Les Parties conviennent de négocier de bonne foi les modifications du présent DPA qui seraient nécessaires pour permettre à Dandy de continuer à traiter les Données à caractère personnel comme prévu dans le présent DPA, conformément aux Lois applicables, notamment : (i) pour se conformer au RGPD ou à toute législation nationale le mettant en œuvre, ainsi qu’à toute recommandation relative à l’interprétation de leurs dispositions respectives ; (ii) si les Clauses contractuelles types ou tout autre mécanisme de transfert ou décision d’adéquation sont invalidés ou modifiés ; ou (iii) si une modification du statut d’un pays au regard de son appartenance à l’Union européenne ou à l’Espace économique européen rend une telle modification nécessaire.

7. Transferts internationaux

Dandy ne transfère pas de Données à caractère personnel en dehors de l’Espace économique européen, sauf si elle veille à ce que le transfert soit soumis à des garanties appropriées conformément à l’article 46 du RGPD. Ces garanties appropriées peuvent notamment comprendre : (a) une décision d’adéquation de la Commission européenne en application de l’article 45 du RGPD ; (b) les Clauses contractuelles types adoptées par la Commission européenne en application de l’article 46, paragraphe 2, point c), du RGPD ; (c) une certification au titre du EU-U.S. Data Privacy Framework ; ou (d) tout autre mécanisme de transfert valide au titre des Lois applicables.

8. Notification d’une Violation de données à caractère personnel

Dandy notifie au Cabinet sans retard indu, et en tout état de cause dans un délai de 72 heures, toute Violation de données à caractère personnel après en avoir pris connaissance, en fournissant des informations suffisantes pour permettre au Cabinet de respecter ses éventuelles obligations de notification auprès de l’Autorité de contrôle compétente. Les informations complémentaires relatives à la Violation de données à caractère personnel sont fournies par étapes, à mesure que de nouveaux éléments sont disponibles.

9. Suppression ou restitution

Au choix du Cabinet, Dandy supprime ou restitue au Cabinet l’ensemble des Données à caractère personnel à l’issue de la prestation de services et supprime les copies existantes, sauf si les lois applicables imposent de conserver ces données.

ANNEXE 1 : DÉTAILS DU TRAITEMENT DES DONNÉES

●      Objet et finalité : La fourniture des services au titre du Contrat conclu avec le Cabinet.

●      Nature : Réception, stockage sécurisé et transmission des scans dentaires et des dossiers cliniques transmis par le Responsable du traitement via la plateforme Dandy ; hébergement dans le cloud des données relatives aux patients et des dossiers ; modélisation 3D, conception numérique et fabrication de prothèses dentaires ; gestion des dossiers et acheminement des flux de travail ; transmission ultérieure des données des dossiers aux sous-traitants ultérieurs autorisés de Dandy aux fins de conception et de fabrication ; restitution au Responsable du traitement des résultats numériques du dossier, tels que les fichiers de conception et les plans de traitement ; assistance à la clientèle et communications relatives aux dossiers ; et traitement des opérations d’expédition et de logistique pour la livraison des restaurations dentaires terminées au Responsable du traitement.

●      Durée : La durée du Contrat conclu avec le Cabinet, augmentée de la période nécessaire à la suppression de l’ensemble des données.

●      Catégories de Personnes concernées : Patients et utilisateurs finaux autorisés du Cabinet.

●      Types de Données à caractère personnel : Noms, adresses électroniques, adresses, numéros d’inscription professionnelle et données de santé des patients, y compris, sans s’y limiter, les données de rendez-vous, les dossiers cliniques et les scans dentaires.

●      Données de catégorie particulière et mesures de protection appliquées : Données de santé des patients (Données de catégorie particulière au titre de l’article 9 du RGPD). Les mesures de protection mises en œuvre comprennent : limitation stricte de la finalité à la fourniture de services de laboratoire dentaire ; restriction de l’accès au seul personnel autorisé ; chiffrement des données en transit et au repos ; conservation de journaux des accès aux données des patients ; et restriction des transferts ultérieurs, sauf dans les cas autorisés par le présent DPA.

●      Fréquence des transferts : Continue, les scans dentaires et les dossiers cliniques étant transmis de manière régulière dans le cadre des services.

●      Traitement par les sous-traitants ultérieurs : Les sous-traitants ultérieurs peuvent traiter les Données à caractère personnel aux fins de l’hébergement dans le cloud, du stockage des données et des services d’infrastructure informatique. L’objet, la nature et la durée du traitement par les sous-traitants ultérieurs sont cohérents avec le traitement décrit ci-dessus et ne dépassent pas la durée du Contrat conclu avec le Cabinet. La liste des sous-traitants ultérieurs autorisés est disponible via le Trust Center de Dandy à l’adressehttps://trust.meetdandy.com/subprocessors.

ANNEXE 2 : MESURES DE SÉCURITÉ

●     Gouvernance et personnel. Répartition clairement définie des responsabilités en matière de sécurité de l’information pour l’ensemble du personnel, des terminaux et de l’infrastructure ; politiques documentées couvrant l’utilisation acceptable, le contrôle des accès, la réponse aux incidents, la continuité des activités et la gestion des risques, réexaminées périodiquement ; et évaluations périodiques des risques, répétées en cas de modification substantielle des Services. Le personnel fait l’objet de vérifications dans la mesure permise par la législation applicable, est soumis à des obligations de confidentialité écrites, bénéficie d’un accès accordé et retiré dans le cadre de procédures établies d’intégration et de départ, avec retrait rapide des accès en cas de cessation des fonctions ou de changement de rôle, et reçoit une formation en matière de sécurité et de protection des données lors de son embauche, puis périodiquement.

●     Contrôle des accès. Accès aux Données à caractère personnel fondé sur les rôles, selon les principes du moindre privilège et du besoin d’en connaître, avec authentification multifacteur et identifiants individuels permettant d’attribuer les accès à chaque utilisateur pour les systèmes de production, interdiction des comptes de production partagés, gestion des identifiants des systèmes et services au moyen de mécanismes contrôlés, réexamen périodique des droits d’accès, et journalisation et possibilité de contrôle des accès aux Données à caractère personnel.

●     Chiffrement et protection des données. Les Données à caractère personnel sont chiffrées en transit au moyen du protocole TLS 1.2 ou d’une version ultérieure et au repos au moyen de l’algorithme AES-256 ou d’algorithmes équivalents conformes aux normes du secteur, les clés étant gérées selon des procédures contrôlées prévoyant un accès restreint et une rotation périodique. Les données des clients sont séparées logiquement dans les environnements mutualisés, limitées à ce qui est nécessaire aux Services et pseudonymisées lorsque cela est compatible avec les Services ; les données de production ne sont pas utilisées dans les environnements de développement ou de test.

●     Sécurité de l’infrastructure, des terminaux et du développement. Protection du périmètre, segmentation du réseau, protection contre les attaques par déni de service et authentification multifacteur pour l’accès administrateur ; surveillance et alertes sur l’ensemble de l’infrastructure de production, les journaux d’audit étant conservés et protégés contre tout accès, toute modification ou toute suppression non autorisés ; et configurations de référence gérées, avec une gestion des changements exigeant un examen et une approbation documentée avant tout déploiement en production. Les terminaux sont gérés de manière centralisée et soumis à des mesures de protection contre les logiciels malveillants, de chiffrement et d’installation de correctifs. Un cycle de développement sécurisé documenté prévoit une revue du code, des tests automatisés de sécurité du code applicatif et des dépendances de tiers, une séparation des environnements et un déploiement contrôlé, avec des tests d’intrusion indépendants périodiques dont les résultats font l’objet d’un suivi jusqu’à leur correction.

●     Résilience et réponse aux incidents. Infrastructure d’hébergement redondante, sauvegardes régulières des Données à caractère personnel avec tests périodiques des procédures de restauration, et plan de continuité des activités et de reprise après sinistre réexaminé et testé périodiquement. Un processus documenté de réponse aux incidents prévoit l’identification, l’escalade et la correction des incidents de sécurité, ainsi que la notification au Responsable du traitement sans retard indu dès que le Sous-traitant a connaissance d’une Violation de données à caractère personnel, avec une coopération raisonnable et la communication des informations dont dispose le Sous-traitant.

●     Hébergement, tiers et coopération. Les Données à caractère personnel sont hébergées dans des installations de tiers qui mettent en œuvre des mesures de sécurité physiques et environnementales, y compris un accès surveillé et contrôlé. Les locaux gérés par le Sous-traitant dans lesquels les Données à caractère personnel sont accessibles sont soumis à des mesures de sécurité physiques et environnementales adaptées à la nature du site. Les sous-traitants ultérieurs font l’objet de vérifications préalables en matière de sécurité et de protection des données avant leur engagement, puis d’une réévaluation périodique, et les composants de tiers et à code source ouvert utilisés dans les Services sont répertoriés et surveillés afin de détecter les vulnérabilités connues. Les Données à caractère personnel sont conservées uniquement pendant la durée nécessaire aux finalités pour lesquelles elles sont traitées et au respect des obligations légales, comptables ou déclaratives, après quoi elles sont supprimées ou restituées conformément au Contrat. Compte tenu de la nature du traitement, le Sous-traitant fournit au Responsable du traitement une assistance raisonnable, dans la mesure du possible, afin de l’aider à s’acquitter de ses obligations de donner suite aux demandes des Personnes concernées et de respecter ses obligations au titre des articles 32 à 36 du RGPD.

Belgium (Dutch)

Deze aanvullende algemene voorwaarden (“Voorwaarden”) bij de Samenwerkingsovereenkomst, met inbegrip van de Verwerkersovereenkomst, maken deel uit van de Overeenkomst (samen de “Overeenkomst”) en worden aangegaan tussen Dandy Labs Europe SAS (“Dandy” of “Wij”) en u en uw tandartspraktijk of -kantoor (“U” of “Praktijk”), en treden in werking op de datum waarop de Samenwerkingsovereenkomst wordt aangegaan (“Ingangsdatum”). Indien u de Overeenkomst namens een entiteit, vennootschap, rechtspersoon of organisatie aanvaardt, omvat “u“ zowel uzelf, die entiteit als alle gebruikers van die entiteit, en verklaart u hierbij dat u bevoegd bent om al deze gebruikers te binden. Dandy en u worden elk aangeduid als een “Partij” en gezamenlijk als de “Partijen”. Termen die hierin of elders in de Overeenkomst worden gedefinieerd, hebben de gedefinieerde betekenis die in de gehele Overeenkomst van toepassing is. Gelet op de geldige en waardevolle tegenprestatie zoals vastgelegd in de Samenwerkingsovereenkomst, komen de Partijen het volgende overeen:

1. Facturering & Betalingen: Alle krachtens deze Overeenkomst verschuldigde bedragen luiden in euro’s (€) en mogen uitsluitend worden voldaan via een overschrijving in euro’s (waarbij eventuele wisselkoerskosten en bankkosten, indien van toepassing, voor Uw rekening komen) en zijn exclusief de toepasselijke belasting over de toegevoegde waarde (btw, die, indien van toepassing, bovenop de gefactureerde bedragen in rekening wordt gebracht en door U dient te worden voldaan na ontvangst van een geldige factuur, zoals vereist op grond van het Toepasselijk Recht). Wij accepteren betalingen via SEPA-incasso, bankoverschrijving, debetkaart of creditcard, en U bent verplicht te allen tijde een geldige betaalmethode geregistreerd te houden. De betalingstermijn is van essentieel belang. Onverminderd het voorgaande komen de Partijen overeen dat alle facturen binnen een termijn van maximaal dertig (30) dagen vanaf de datum van ontvangst van de factuur of, indien later, vanaf de datum van ontvangst van de goederen of diensten, moeten worden voldaan. Kortingen en promoties kunnen niet worden gebruikt ter betaling van verwerkings-, verzend-, annulerings- of andere kosten. Dandy heeft het recht om het maximale rentebedrag in rekening te brengen dat is toegestaan op grond van het Toepasselijk Recht, of 1,5% per maand indien dit niet door het Toepasselijk Recht is gespecificeerd, en U stemt ermee in om dit betalen. Over de verschuldigde bedragen wordt dagelijks rente berekend vanaf de vervaldatum tot aan de daadwerkelijke betaling, ongeacht of deze plaatsvindt vóór of na een rechterlijke uitspraak. Dandy accepteert geen papieren cheques, prepaid-creditcards, peer-to-peer-betalingen of cryptovaluta als geldige betaalmethoden. Indien U gedurende zestig (60) dagen of langer openstaande bedragen heeft, of indien het aan Dandy verschuldigde bedrag 10.000 € (EUR) of meer bedraagt, behoudt Dandy zich het recht voor om Uw account op te schorten totdat alle openstaande bedragen zijn voldaan. In geval van aanhoudende wanbetaling kan Dandy alle overeenkomsten met U ontbinden of opschorten, hetgeen geen einde maakt aan de schuld of de opgebouwde rente. Van U wordt verwacht dat U de verwachtingen van Uw patiënten ten aanzien van het tijdstip van levering van de voor hen bestelde Dandy Producten dienovereenkomstig beheert. 

Behoudens het hieronder bepaalde, is elke Partij uitsluitend verantwoordelijk voor haar eigen belastingverplichtingen die voortvloeien uit deze Overeenkomst. Alle betalingen door U uit hoofde van deze Overeenkomst dienen te worden verricht zonder aftrek of inhouding van enige belasting, tenzij dit krachtens het Toepasselijk Recht is vereist. Voor zover een betaling uit hoofde van deze Overeenkomst aanleiding geeft tot een verplichting voor U om krachtens het Toepasselijk Recht een bedrag af te trekken, in te houden of af te dragen aan een overheidsinstantie, worden de uit hoofde van deze Overeenkomst verschuldigde en betaalbare bedragen verhoogd, zodat Wij een bedrag ontvangen dat gelijk is aan het bedrag dat Wij zouden hebben ontvangen indien een dergelijke aftrek of inhouding niet had plaatsgevonden. Voor rapportagedoeleinden stemt U ermee in om aan Dandy bewijs te verstrekken dat dergelijke belastingen aan een overheidsinstantie zijn betaald, met inbegrip van het origineel of een gewaarmerkte kopie van een door die instantie afgegeven ontvangstbewijs waaruit de betaling blijkt.

U erkent voorts dat Dandy U op de hoogte heeft gesteld van de mogelijkheid van verwerkingskosten en U de gelegenheid heeft geboden om vragen over dergelijke kosten te stellen alvorens deze Overeenkomst aan te gaan. U stemt ermee in Dandy te vrijwaren en schadeloos te stellen voor alle vorderingen, schade of verliezen die voortvloeien uit dergelijke toeslagen die door externe dienstverleners worden opgelegd. Dandy behoudt zich het recht voor om de prijzen voor Dandy Producten (hieronder gedefinieerd) te allen tijde te wijzigen, mits dit vijfenveertig (45) dagen van tevoren wordt aangekondigd. U stemt ermee in dat U geen recht hebt op verrekening, aftrek van tegenvorderingen of inhouding op bedragen die Dandy aan U is verschuldigd. U stemt ermee in dat Dandy te allen tijde, zonder afbreuk te doen aan andere rechten of rechtsmiddelen waarover zij beschikt, enig bedrag dat U aan Dandy verschuldigd bent, mag verrekenen met enig bedrag dat Dandy aan U verschuldigd is. Dandy accepteert geen betalingen van patiënten, met inbegrip van betalingen op naam van de patiënt die door U is doorgestuurd.

2. Apparatuur. Het risico van verlies, diefstal, beschadiging of vernietiging van de Apparatuur gaat bij levering op U over. De Apparatuur blijft gedurende de looptijd van deze Overeenkomst en elke verdere periode waarin de Apparatuur in Uw bezit, bewaring of beheer is (de “Risicoperiode”) uitsluitend voor Uw risico, totdat de Apparatuur aan Dandy is geretourneerd. U dient Dandy onmiddellijk schriftelijk op de hoogte te stellen in geval van verlies, een ongeval of schade aan de Apparatuur die voortvloeit uit of verband houdt met Uw bezit of gebruik van de apparatuur. Dandy zal verzendlabels en een doos verstrekken om de Apparatuur te retourneren. 

U mag de Apparatuur op geen enkele wijze aanpassen, beschadigen of vernietigen, noch mag U de Apparatuur van Uw praktijklocatie verwijderen. Dandy zal U ondersteuning, technische service en softwareonderhoud voor de Apparatuur bieden. U stemt ermee in verantwoordelijk te zijn voor het dagelijks op de juiste wijze onderhouden van de Apparatuur, met inbegrip van het reinigen en veilig opbergen ervan. U bent verantwoordelijk voor de Apparatuur zolang deze in Uw bezit is, en U aanvaardt het risico van verlies mocht dit zich voordoen. Indien er sprake is van gedeeltelijke schade aan de Apparatuur als gevolg van een gebruikersfout, met inbegrip van, maar niet beperkt tot, onjuiste installatie, verkeerd gebruik of misbruik van de Apparatuur, kan Dandy U naar eigen inzicht een vergoeding voor vervangende onderdelen in rekening brengen van maximaal XX € (EUR).

3. Garantie van Dandy: Wij staan achter de kwaliteit van de Dandy Producten. Voor titanium implantaat abutments bieden Wij een levenslange garantie tegen breuk tijdens normaal gebruik als gevolg van een defect in materiaal, fabricage of vakmanschap. Ook voor alle vaste producten (te weten kronen, bruggen, implantaatkronen, implantaatbruggen, inlays, onlays, veneers en zirconia implantaat abutments, voor zover beschikbaar in Uw markt) bieden Wij een levenslange garantie tegen breuk tijdens normaal gebruik als gevolg van een materiaal-, fabricage- of verwerkingsfout. Voor zover beschikbaar in Uw markt bieden wij voor alle partiële en volledige gebitsprothesen, nachtbeschermers, spalken, hulpmiddelen tegen slaapapneu, clear aligners, retainers en bleekbitjes een garantie tegen slijtage gedurende de eerste zes (6) maanden vanaf de leveringsdatum, en een garantie van tien (10) jaar tegen breuk tijdens normaal gebruik als gevolg van een materiaal-, fabricage- of verwerkingsfout. Op grond van de garantie van Dandy zal Dandy, als enige verhaalsmogelijkheid, naar eigen oordeel het product repareren, vervangen of de oorspronkelijk betaalde prijs terugbetalen. De garantie vervalt indien de restauratie niet regelmatig wordt onderhouden en gecontroleerd door een gekwalificeerde tandheelkundige professional.          

Producten van derden die in de Apparatuur zijn opgenomen, profiteren van fabrieksgaranties die door Dandy aan U kunnen worden overgedragen, maar vallen voor het overige niet onder de hierboven beschreven garantie van Dandy. 


Voor zover maximaal toegestaan onder het Toepasselijk Recht, vormen de garanties in deze sectie 3 de enige garanties voor door Dandy geleverde producten, en worden alle overige uitdrukkelijke en impliciete garanties uitgesloten, met inbegrip van impliciete garanties van verkoopbaarheid, geschiktheid voor een bepaald doel en het niet inbreukmakend karakter.

4. IT-vereisten. U stemt ermee in om een snelle internetverbinding te verzorgen en in stand te houden voor gebruik in verband met de Apparatuur, en U stemt ermee in om het IT-beleid na te leven dat is opgenomen in de online algemene voorwaarden.

5. Training: U, en iedereen in Uw Praktijk die gebruik zal maken van de door Dandy geleverde software, welke kan worden bijgewerkt met Chairside, de Dandy Practice Portal, digitale diensten of ondersteuning, hardware en/of software, of vaste en verwijderbare Dandy Producten (samen het “Dandy Aanbod”), dient vóór gebruik van of communicatie over het Dandy Aanbod met patiënten een virtuele training van Dandy te volgen.

6. Vrijwaring: U zult Dandy vrijwaren, gevrijwaard houden, verdedigen en schadeloos stellen voor en tegen alle aanspraken, vorderingen, schade, schulden, aansprakelijkheden, verliezen, verplichtingen, betalingen, kosten en uitgaven (met inbegrip van juridische kosten) die voortvloeien uit of verband houden met: (a) schending door U van enige bepaling van enige overeenkomst met Dandy; (b) schending door U van enige bepaling van enige overeenkomst tussen U en Uw patiënt of enig handelen of nalaten met betrekking tot een patiënt (waaronder begrepen maatregelen van een beroepsorganisatie die toezicht houdt op U of nationale toezichthouder(s) of vergunningverlenende instantie), met inbegrip van, maar niet beperkt tot, nalatigheid of opzettelijk handelen met betrekking tot de zorg voor patiënten, dan wel het verstrekken van onjuiste klinische gegevens; en (c) het verstrekken door U van onjuiste of onvolledige informatie, documenten, scans of afdrukken, dan wel het niet tijdig verstrekken aan Dandy van informatie waar Wij U om hebben verzocht.

7. Wijziging van Zeggenschap over de Praktijk: Indien Uw Praktijk een wijziging van zeggenschap ondergaat, stemt U ermee in Dandy hiervan schriftelijk in kennis te stellen binnen vijf (5) werkdagen vóór de dag waarop deze wijziging van zeggenschap van kracht wordt. In het kader van deze clausule omvat een situatie van “Wijziging van zeggenschap” elke transactie of reeks transacties die leidt tot een wijziging in de directe of indirecte eigendom van meer dan vijftig procent (50%) van de stemrechten of het aandelenkapitaal van Uw Praktijk, of elke fusie, consolidatie of verkoop van nagenoeg alle activa daarvan.

8. Medische Disclaimer: Uw Praktijk is als enige verantwoordelijk voor de behandeling van patiënten waarbij gebruik wordt gemaakt van het Dandy Aanbod, alsmede voor het verstrekken aan Uw patiënten van alle relevante informatie over het Dandy Aanbod en daarmee verbonden risico’s vóór en na de behandeling. Het Dandy Aanbod wordt uitsluitend aangeboden als aanvulling op Uw Praktijk en vormt geen medisch, tandheelkundig of ander gezondheidsadvies, diagnose of behandeling aan of voor Uw patiënten. U stemt ermee in geen verklaringen of garanties met betrekking tot het Dandy Aanbod aan Uw patiënten te geven. U verklaart jegens Dandy dat Uw Praktijk zal voldoen aan al het Toepasselijk Recht, regelgeving, richtlijnen en beroepsgedragscodes met betrekking tot beroepsbeoefenaars die bevoegd zijn om tandheelkunde uit te oefenen en intraorale scans uit te voeren bij patiënten van de Praktijk. Tenzij hierin uitdrukkelijk anders is bepaald, wordt het Dandy Aanbod dat hieronder aan U wordt aangeboden, geleverd “in de staat waarin zij zich bevindt” (as is) en wordt het Dandy Aanbod verstrekt op basis van Uw voorschrift voor de individuele patiënt. 

De Partijen erkennen dat deze Overeenkomst geen directe contractuele relatie tot stand brengt tussen Dandy en Uw patiënten. Alle aanspraken, eisen of rechtsvorderingen die door een patiënt of een regelgevende instantie worden ingesteld en die voortvloeien uit Uw klinische beslissingen, behandelingsbeheer, voorschrijffouten of het verstrekken van gebrekkige gegevens (zoals defecte scans of afdrukken), vallen onder Uw volledige vrijwaringsverplichtingen zoals uiteengezet in sectie 6.

U stemt ermee in om, voor zover van toepassing, te voldoen aan Uw verplichtingen uit hoofde van Verordening (EU) 2017/745 betreffende medische hulpmiddelen. U stemt ermee in alle communicatie en andere activiteiten met betrekking tot een terugroepactie of andere regelgevende maatregelen uit te voeren in overeenstemming met al onze redelijke instructies en geen contact op te nemen of anderszins te communiceren met een bevoegde autoriteit voordat U met ons heeft overlegd. Deze verplichting, evenals de daarmee verband houdende vrijwaringsbepalingen van deze Voorwaarden, blijven ook na beëindiging van de Samenwerkingsovereenkomst van kracht zolang de door ons geleverde medische hulpmiddelen in gebruik blijven.

9. Wijziging. Deze Voorwaarden en de Overeenkomst kunnen worden gewijzigd door middel van een wederzijdse schriftelijke overeenkomst tussen de Partijen. Daarnaast kunnen deze Voorwaarden en de Overeenkomst door Dandy worden gewijzigd en Dandy zal u op de hoogte stellen van eventuele wezenlijke wijzigingen. Dergelijke wezenlijke wijzigingen treden dertig (30) dagen na kennisgeving in werking, tenzij u de Overeenkomst binnen die termijn schriftelijk opzegt. In dergelijke gevallen zal Dandy de bestaande Voorwaarden nog zestig (60) dagen naleven, of totdat de Apparatuur is geretourneerd.

10. Volledige Overeenkomst. De Samenwerkingsovereenkomst, deze Voorwaarden, de Verwerkersovereenkomst (Bijlage A) en het IT-beleid vormen samen de “Overeenkomst”. Deze Overeenkomst vervangt alle eerdere, daarmee strijdige overeenkomsten.

11. Niet-Overdraagbaarheid. U mag de Overeenkomst niet overdragen of toewijzen aan een derde partij zonder voorafgaande schriftelijke toestemming van Dandy.

12. Naleving van Wetgeving. Beide Partijen komen overeen zich te houden aan alle toepasselijke wetgeving omtrent gezondheid en persoonsgegevens in het rechtsgebied waar U en Dandy beide zijn gevestigd, aan relevante regelgevingsnormen die zijn uitgegeven door Europese en nationale autoriteiten, en aan richtlijnen die zijn uitgegeven door beroepsregulerende instanties.

13. Toepasselijk Recht en Bevoegde Rechtbank.

  1. Toepasselijk Recht. U stemt ermee in dat de Overeenkomst wordt beheerst door en wordt uitgelegd overeenkomstig het recht van het rechtsgebied waar de Praktijk is gevestigd (“Toepasselijk Recht”). 
  2. Bevoegde rechtbank. Alle geschillen die voortvloeien uit of verband houden met de Overeenkomst worden onderworpen aan de exclusieve bevoegdheid van de rechtbank in het toepasselijke rechtsgebied waar de Praktijk is gevestigd, zoals uiteengezet in de onderstaande tabel.
LandJurisdictie
BelgiëRechtbanken van Brussel
FrankrijkTribunaal voor Economische Activiteiten van Parijs
IerlandRechtbanken van Dublin 
ItaliëRechtbank van Milaan
NederlandDe bevoegde rechtbank te Amsterdam, Nederland
SpanjeRechtbanken en tribunalen van Madrid
DuitslandRechtbanken van Frankfurt am Main
ZwedenRechtbanken van [O] 

14. Btw & Belastingen. Dandy brengt de toepasselijke belasting over de toegevoegde waarde (“btw”) tegen het geldende tarief in rekening boven op elke prijs, vergoeding of verschuldigd bedrag uit hoofde van de Overeenkomst, en deze btw dient door U te worden voldaan, indien van toepassing. Indien U bent vrijgesteld, dient U een geldig btw-vrijstellingscertificaat of bewijsstukken te verstrekken die voor de betreffende belastingdienst toereikend zijn, indien beschikbaar, of de grondslag voor de btw-vrijstelling te motiveren.

15. Gegevensbescherming. Aangezien Dandy namens U persoonsgegevens verwerkt, waaronder gezondheidsgegevens (“Persoonsgegevens”), is het volgende van toepassing:

Rollen op het Gebied van Gegevensbescherming. De Partijen erkennen dat:

●      Dandy Labs Europe SAS optreedt als verwerkingsverantwoordelijke voor de Persoonsgegevens die op grond van deze Voorwaarden worden verwerkt en die betrekking hebben op het personeel en de zakelijke contacten van de Praktijk, zoals nader uiteengezet in haar EU-privacybeleid https://www.meetdandy.com/privacy-policy/.

●      Dandy Labs Europe SAS treedt op als verwerker bij het leveren van haar platform- en digitale laboratoriumdiensten aan U, zoals uiteengezet in Bijlage A, met inbegrip van de verwerking van alle Persoonsgegevens van patiënten.

Contactpersoon voor Gegevensbescherming. Alle privacy gerelateerde mededelingen of verzoeken in het kader van deze Overeenkomst dienen te worden gericht aan Dandy via [email protected]

Bijlage A: Verwerkersovereenkomst 

Deze Verwerkersovereenkomst maakt deel uit van de Overeenkomst voor zover Dandy optreedt als verwerker namens de Praktijk als verwerkingsverantwoordelijke. De aard, het doel en de duur van de verwerking zijn uiteengezet in Bijlage 1 (“Gegevens over de Verwerking”).

1. Definities

●      “Toepasselijke Wetgeving” betekent alle toepasselijke wetgeving die de verwerking en beveiliging van Persoonsgegevens alsmede de vertrouwelijkheid van elektronische communicatie regelt, waaronder, maar niet beperkt tot, (i) Verordening (EU) 2016/679 van 27 april 2016 (de AVG), (ii) Richtlijn 2002/58/EG van 12 juli 2002 (de ePrivacyrichtlijn), (iii) nationale wetgeving ter uitvoering van en aanvulling op de in deze definitie bedoelde EU-wetgeving, en (iv) de relevante bepalingen van de nationale gezondheidswetgeving, elk van (i) tot en met (iv) zoals van tijd tot tijd gewijzigd en/of aangevuld.

●      “Inbreuk in verband met Persoonsgegevens” betekent een inbreuk op de beveiliging die per ongeluk of op onrechtmatige wijze leidt tot de vernietiging, het verlies, de wijziging of de ongeoorloofde verstrekking van of de ongeoorloofde toegang tot Persoonsgegevens, dan wel enige andere gebeurtenis die de integriteit, beschikbaarheid of vertrouwelijkheid van Persoonsgegevens aantast.

●      “Bijzondere Categorieën van Gegevens” betekent de categorieën van Persoonsgegevens bedoeld in artikel 9 van de AVG (met inbegrip van, maar niet beperkt tot, Persoonsgegevens over gezondheid, biometrische gegevens met het oog op de unieke identificatie van een persoon, en genetische gegevens).

●      “Persoonsgegevens” betekent persoonsgegevens (zoals gedefinieerd in de AVG) die door Dandy namens de Praktijk worden verwerkt.

●      “Betrokkene” heeft de betekenis die daaraan wordt gegeven in de AVG.

●      “Toezichthoudende Autoriteit” betekent een toezichthoudende autoriteit voor gegevensbescherming die bevoegd is ten aanzien van de verwerking van Persoonsgegevens door de Praktijk.

●      “SCC’s” betekent de standaardcontractbepalingen voor de doorgifte van persoonsgegevens aan derde landen, zoals vastgesteld bij Uitvoeringsbesluit (EU) 2021/914 van de Commissie van 4 juni 2021, zoals van tijd tot tijd gewijzigd, bijgewerkt of vervangen.

●      “Derde Land” betekent elk land of gebied buiten de werkingssfeer van de gegevensbeschermingswetgeving van de Europese Economische Ruimte, met uitzondering van landen of gebieden ten aanzien waarvan de Europese Commissie van tijd tot tijd heeft erkend dat zij een passend beschermingsniveau voor persoonsgegevens bieden.

●      “Data Privacy Framework” betekent, naargelang relevant, het EU-VS Data Privacy Framework, zoals beheerd door de US Department of Commerce en door de Europese Commissie erkend als een passend beschermingsniveau voor persoonsgegevens biedend voor de toepassing van artikel 45 AVG, zoals van tijd tot tijd van kracht, gewijzigd, geconsolideerd, opnieuw vastgesteld of vervangen.

2. Onderwerp van deze Verwerkersovereenkomst en Instructies

Dandy verwerkt Persoonsgegevens uitsluitend op basis van de gedocumenteerde instructies van de Praktijk, met inbegrip van instructies met betrekking tot de doorgifte van Persoonsgegevens aan een Derde Land, tenzij Dandy daartoe verplicht is op grond van Toepasselijke Wetgeving waaraan Dandy is onderworpen; in dat geval stelt Dandy de Praktijk voorafgaand aan de Verwerking in kennis van dat wettelijke vereiste, tenzij die wetgeving een dergelijke kennisgeving verbiedt om gewichtige redenen van algemeen belang. Indien Dandy van mening is dat een instructie in strijd is met toepasselijke wetgeving, stelt zij de Praktijk daarvan onmiddellijk in kennis en is zij gerechtigd de uitvoering van de betreffende instructie op te schorten totdat de Praktijk deze bevestigt, wijzigt of intrekt. Mondelinge instructies worden door de Praktijk onverwijld schriftelijk bevestigd.

De Praktijk zorgt ervoor dat zij beschikt over een rechtmatige grondslag op grond van artikel 6 van de AVG voor de verwerking van Persoonsgegevens, alsmede over een uitzondering op grond van artikel 9 van de AVG voor de verwerking van Bijzondere Categorieën van Gegevens, in de in deze Verwerkersovereenkomst bedoelde context.

3. Verplichtingen van Dandy (de “Verwerker”)

●      Vertrouwelijkheid: Dandy zorgt ervoor dat haar personeel dat gemachtigd is om de Persoonsgegevens te verwerken, zich heeft verbonden tot geheimhouding of onderworpen is aan een passende wettelijke geheimhoudingsplicht.

●      Rechten van Betrokkenen: Dandy verleent de Praktijk, rekening houdend met de aard van de verwerking zoals nader uiteengezet in Bijlage 1, bijstand door middel van passende technische en organisatorische maatregelen, voor zover mogelijk, voor de nakoming van de verplichting van de Praktijk om verzoeken tot uitoefening van de rechten van de Betrokkene te beantwoorden, met inbegrip van de rechten op rectificatie, gegevenswissing, beperking van de verwerking, inzage, overdraagbaarheid van gegevens, bezwaar, en het recht om niet te worden onderworpen aan geautomatiseerde besluitvorming. Dandy reageert onverwijld op een dergelijk verzoek van de Praktijk.

●      Bijstand: Elke Partij verleent de andere Partij, rekening houdend met de aard van de verwerking en de haar ter beschikking staande informatie, redelijke bijstand voor zover nodig om te voldoen aan haar respectieve verplichtingen uit hoofde van Toepasselijke Wetgeving, waaronder met betrekking tot de beveiliging van de verwerking, de melding van een Inbreuk in verband met Persoonsgegevens aan de bevoegde toezichthoudende autoriteit voor gegevensbescherming en/of aan Betrokkenen, het opstellen van gegevensbeschermingseffectbeoordelingen, voorafgaande raadpleging van de bevoegde toezichthoudende autoriteit voor gegevensbescherming, en elke beoordeling, elk verzoek, elke kennisgeving en elk onderzoek door een Toezichthoudende Autoriteit. Onverminderd het voorgaande werkt de Praktijk te goeder trouw met Dandy samen in verband met elk regelgevend verzoek, elke audit en elk onderzoek dat verband houdt met de Verwerking van Persoonsgegevens door Dandy op grond van deze Verwerkersovereenkomst.

●      Beveiliging: Dandy treft passende technische en organisatorische maatregelen om een op het risico afgestemd beveiligingsniveau te waarborgen, rekening houdend met de stand van de techniek, de uitvoeringskosten, alsook met de aard, de omvang, de context en de doeleinden van de Verwerking en de qua waarschijnlijkheid en ernst uiteenlopende risico’s voor de rechten en vrijheden van personen zoals nader uiteengezet in Bijlage 2. Dandy mag de in Bijlage 2 beschreven beveiligingsmaatregelen van tijd tot tijd bijwerken of wijzigen, mits dergelijke updates of wijzigingen het algehele beschermingsniveau van de Persoonsgegevens niet wezenlijk verminderen.

●      Audit en Inspectie: Dandy verstrekt de Praktijk op haar schriftelijk verzoek van tijd tot tijd de informatie die redelijkerwijs noodzakelijk is om aan te tonen dat zij voldoet aan de in deze Overeenkomst neergelegde verplichtingen. Dandy werkt mee aan audits, met inbegrip van inspecties van de bedrijfsruimten, systemen, apparatuur en gegevensverwerkingsfaciliteiten van Dandy, uitgevoerd door de Praktijk of door een onafhankelijke, door de Praktijk aangestelde auditor die over de vereiste beroepskwalificaties beschikt en aan een geheimhoudingsplicht is gebonden (“Audits ter Plaatse”). Audits ter Plaatse worden uitgevoerd met inachtneming van voorafgaande schriftelijke kennisgeving van 60 dagen aan Dandy (of een kortere termijn indien vereist door een Toezichthoudende Autoriteit of naar aanleiding van een Inbreuk in verband met Persoonsgegevens of een andere urgente aangelegenheid), niet vaker dan eenmaal per kalenderjaar (tenzij vereist door een Toezichthoudende Autoriteit of naar aanleiding van een Inbreuk in verband met Persoonsgegevens of een andere urgente aangelegenheid). Partijen spannen zich redelijkerwijs in om ervoor te zorgen dat Audits ter Plaatse plaatsvinden tijdens de gebruikelijke kantooruren van Dandy en de activiteiten van Dandy niet onredelijk verstoren. De Praktijk draagt de kosten van Audits ter Plaatse, behalve indien uit een audit een materiële schending door Dandy van haar verplichtingen uit hoofde van deze Verwerkersovereenkomst blijkt.

4. Subverwerking

4.1 De Praktijk verleent Dandy hierbij algemene schriftelijke toestemming om de subverwerkers in te schakelen die zijn vermeld in het Trust Center van Dandy, te raadplegen via https://trust.meetdandy.com/subprocessors, en zulks met inachtneming van dit artikel 4.

4.2 Indien Dandy een nieuwe subverwerker aanstelt of voornemens is wijzigingen aan te brengen met betrekking tot de toevoeging of vervanging van subverwerkers, stelt zij de Praktijk daarvan twintig (20) werkdagen voorafgaand schriftelijk in kennis. Gedurende die termijn kan de Praktijk bezwaar maken tegen de aanstelling of vervanging op redelijke en gedocumenteerde gronden die verband houden met de vertrouwelijkheid of beveiliging van Persoonsgegevens of met de naleving van Toepasselijke Wetgeving door de subverwerker. Indien de Praktijk geen bezwaar maakt, kan Dandy overgaan tot de aanstelling of vervanging. Indien de Praktijk bezwaar maakt en Dandy dat bezwaar redelijkerwijs niet kan accommoderen, kan de Praktijk deze Verwerkersovereenkomst en de Overeenkomst schriftelijk opzeggen. Dandy zorgt ervoor dat zij met alle subverwerkers een schriftelijke overeenkomst heeft gesloten die de subverwerker verplichtingen oplegt die niet minder zwaar zijn dan de verplichtingen die op grond van deze Verwerkersovereenkomst op Dandy rusten.

5. Verplichtingen van de Praktijk

5.1 De Praktijk garandeert dat: (i) de op haar toepasselijke wetgeving Dandy niet belet de van de Praktijk ontvangen instructies op te volgen en haar verplichtingen uit hoofde van deze Verwerkersovereenkomst na te komen; en (ii) zij de Toepasselijke Wetgeving heeft nageleefd en blijft naleven, in het bijzonder dat zij de noodzakelijke toestemmingen heeft verkregen of de noodzakelijke kennisgevingen heeft gedaan, en overigens over een rechtmatige grondslag beschikt om de gegevens aan Dandy te verstrekken en de Verwerking van de Persoonsgegevens door Dandy mogelijk te maken zoals uiteengezet in deze Verwerkersovereenkomst.

5.2 De Praktijk stemt ermee in Dandy op eerste verzoek te vrijwaren en schadeloos te stellen voor alle vorderingen, aansprakelijkheden, kosten, uitgaven, verliezen of schade (met inbegrip van gevolgschade, winstderving en reputatieschade, alsmede alle rente, boetes en juridische en overige professionele kosten en uitgaven) die Dandy direct of indirect lijdt als gevolg van een schending van dit artikel 5.

6. Wijzigingen in Toepasselijke Wetgeving

Partijen komen overeen te goeder trouw te onderhandelen over wijzigingen van deze Verwerkersovereenkomst indien wijzigingen vereist zijn om Dandy in staat te stellen de Persoonsgegevens te blijven verwerken zoals beoogd in deze Verwerkersovereenkomst, in overeenstemming met de Toepasselijke Wetgeving, met inbegrip van (i) om te voldoen aan de AVG of enige nationale uitvoeringswetgeving daarvan, alsmede aan richtsnoeren inzake de uitlegging van de respectieve bepalingen daarvan; (ii) indien de SCC’s of enig ander mechanisme of adequaatheidsbesluit ongeldig wordt verklaard of wordt gewijzigd; of (iii) indien wijzigingen in het lidmaatschap van een land van de Europese Unie of de Europese Economische Ruimte een dergelijke wijziging vereisen.

7. Internationale Doorgiften

Dandy geeft geen Persoonsgegevens door buiten de Europese Economische Ruimte, tenzij zij waarborgt dat de doorgifte onderworpen is aan passende waarborgen overeenkomstig artikel 46 AVG. Dergelijke passende waarborgen kunnen onder meer omvatten: (a) een adequaatheidsbesluit van de Europese Commissie op grond van artikel 45 AVG; (b) door de Europese Commissie vastgestelde SCC’s op grond van artikel 46, lid 2, onder c), AVG; (c) certificering op grond van het EU-VS Data Privacy Framework; of (d) enig ander geldig doorgiftemechanisme op grond van Toepasselijke Wetgeving.

8. Melding van een Inbreuk in verband met Persoonsgegevens

Dandy stelt de Praktijk onverwijld (en in elk geval binnen 72 uur) in kennis nadat zij kennis heeft genomen van een Inbreuk in verband met Persoonsgegevens, met verstrekking van voldoende informatie om de Praktijk in staat te stellen te voldoen aan haar meldingsverplichtingen jegens de bevoegde toezichthoudende autoriteit voor gegevensbescherming. Nadere informatie over de Inbreuk in verband met Persoonsgegevens wordt gefaseerd verstrekt naarmate meer gegevens beschikbaar komen.

9. Verwijdering of Teruggave

Naar keuze van de Praktijk verwijdert Dandy alle Persoonsgegevens of geeft deze terug aan de Praktijk na afloop van de dienstverlening, en verwijdert zij bestaande kopieën, tenzij toepasselijke wetgeving verdere opslag vereist.

BIJLAGE 1: GEGEVENS OVER DE VERWERKING

●      Onderwerp en Doel: De verlening van de diensten aan U op grond van de Samenwerkingsovereenkomst.     

●      Aard: Ontvangst, veilige opslag en verzending van gebitsscans en klinische dossiers die door de Verwerkingsverantwoordelijke via het Dandy-platform worden ingediend; cloudhosting van patiëntgegevens en dossiers; 3D-modellering, digitaal ontwerp en vervaardiging van tandheelkundige prothesen; casemanagement en werkstroomrouting; verdere verstrekking van dossiergegevens aan de door Dandy gemachtigde subverwerkers ten behoeve van ontwerp en vervaardiging; teruggave van digitale output (zoals ontwerpbestanden en behandelplannen) aan de Verwerkingsverantwoordelijke; klantenondersteuning en communicatie over dossiers; en verzending en logistieke verwerking voor de levering van afgewerkte tandheelkundige restauraties aan de Verwerkingsverantwoordelijke.

●      Duur: De looptijd van de Samenwerkingsovereenkomst, vermeerderd met de periode totdat alle gegevens zijn verwijderd.

●      Categorieën van Betrokkenen: Patiënten en gemachtigde eindgebruikers van de Praktijk.

●   Categorieën van Persoonsgegevens: Namen, e-mailadressen, adressen, beroepsregistratienummers, en gezondheidsgegevens van patiënten (met inbegrip van, maar niet beperkt tot, afspraakgegevens, klinische dossiers en gebitsscans).

●      Gevoelige Gegevens en Toegepaste Waarborgen: Gezondheidsgegevens van patiënten (bijzondere categorieën van persoonsgegevens in de zin van artikel 9 AVG). Toegepaste waarborgen omvatten: strikte doelbinding tot de verlening van tandtechnische laboratoriumdiensten; toegangsbeperkingen tot uitsluitend gemachtigd personeel; versleuteling van gegevens tijdens verzending en opslag; het bijhouden van lijsten van geautoriseerd personeel met toegang tot patiëntgegevens, met een beschrijving van hun hoedanigheid ten opzichte van de verwerking van de patiëntgegevens; en beperkingen op verdere doorgifte, behoudens voor zover toegestaan op grond van deze Verwerkersovereenkomst.

●      Frequentie van Doorgifte: Doorlopend, aangezien gebitsscans en klinische dossiers op continue basis worden verzonden als onderdeel van de dienstverlening.

●   Verwerking door Subverwerkers: Subverwerkers kunnen Persoonsgegevens verwerken ten behoeve van cloudhosting, gegevensopslag en IT-infrastructuurdiensten. Het onderwerp, de aard en de duur van de verwerking door subverwerkers stemmen overeen met de hierboven beschreven verwerking en gaan de looptijd van de Samenwerkingsovereenkomst niet te boven. Een lijst van gemachtigde subverwerkers is beschikbaar via het Trust Center van Dandy op https://trust.meetdandy.com/subprocessors. 

BIJLAGE 2: BEVEILIGINGSMAATREGELEN

●          Bestuur en personeel. Vastgelegde verantwoordelijkheid voor informatiebeveiliging binnen de organisatie, op eindpunten en binnen de infrastructuur; gedocumenteerd beleid inzake aanvaardbaar gebruik, toegangsbeheer, incidentrespons, bedrijfscontinuïteit en risicobeheer, periodiek geëvalueerd; en periodieke risicobeoordelingen, herhaald bij materiële wijziging van de Diensten. Personeel wordt gescreend voor zover toegestaan op grond van toepasselijk recht, is gebonden aan schriftelijke geheimhoudingsverplichtingen, krijgt toegang verleend en ontzegd via vastgestelde in- en uitdiensttredingsprocedures met onmiddellijke intrekking bij beëindiging van het dienstverband of functiewijziging, en wordt bij indiensttreding en periodiek daarna opgeleid op het gebied van beveiliging en gegevensbescherming.

●          Toegangsbeheer. Rolgebaseerde toegang tot Persoonsgegevens volgens het beginsel van minimale toegangsrechten en noodzaak tot kennisname, met multifactorauthenticatie en individueel herleidbare inloggegevens vereist voor productiesystemen, gedeelde productieaccounts verboden, systeem- en service-inloggegevens beheerd via gecontroleerde mechanismen, toegangsrechten periodiek geëvalueerd, en toegang tot Persoonsgegevens gelogd en controleerbaar.

●          Versleuteling en gegevensbescherming. Persoonsgegevens worden tijdens verzending versleuteld met TLS 1.2 of hoger en in rust met AES-256 of gelijkwaardige, in de sector gangbare algoritmen, waarbij sleutels worden beheerd via gecontroleerde processen met beperkte toegang en periodieke vervanging. Klantgegevens worden logisch gescheiden in multi-tenant-omgevingen, beperkt tot hetgeen de Diensten vereisen, en waar mogelijk gepseudonimiseerd; productiegegevens worden niet gebruikt in ontwikkel- of testomgevingen.

●          Infrastructuur-, eindpunt- en ontwikkelbeveiliging. Grensbeveiliging, netwerksegmentatie, bescherming tegen denial-of-service-aanvallen, en multifactorauthenticatie voor administratieve toegang; monitoring en alarmering binnen de productie-infrastructuur, waarbij auditlogs worden bewaard en beschermd tegen ongeoorloofde toegang, wijziging en verwijdering; en beheerde configuratiebaselines, waarbij wijzigingsbeheer een beoordeling en gedocumenteerde goedkeuring vereist voorafgaand aan implementatie in productie. Eindpunten worden centraal beheerd en zijn onderworpen aan malwarebescherming, versleuteling en patchbeheer. Een gedocumenteerde veilige ontwikkelcyclus voorziet in codebeoordeling, geautomatiseerd beveiligingsonderzoek van applicatiecode en afhankelijkheden van derden, scheiding van omgevingen, en gecontroleerde implementatie, ondersteund door periodieke onafhankelijke penetratietests waarvan de bevindingen worden opgevolgd tot herstel.

●          Veerkracht en incidentrespons. Redundante hostinginfrastructuur, regelmatige back-ups van Persoonsgegevens met periodieke tests van herstelprocedures, en een periodiek geëvalueerd en getest bedrijfscontinuïteits- en noodherstelplan. Een gedocumenteerd incidentresponsproces voorziet in de identificatie, escalatie en oplossing van beveiligingsincidenten, alsmede in kennisgeving aan de Verwerkingsverantwoordelijke zonder onredelijke vertraging zodra de Verwerker kennis heeft genomen van een Inbreuk in verband met Persoonsgegevens, met redelijke medewerking en de informatie waarover de Verwerker beschikt.

●          Hosting, derden en samenwerking. Persoonsgegevens worden gehost in faciliteiten van derden die fysieke en omgevingsgebonden beheersmaatregelen toepassen, met inbegrip van bewaakte en gecontroleerde toegang. Door de Verwerker beheerde bedrijfsruimten waar toegang wordt verkregen tot Persoonsgegevens, zijn onderworpen aan fysieke en omgevingsgebonden beveiligingsmaatregelen die passend zijn bij de aard van de locatie. Subverwerkers worden vóór inschakeling onderworpen aan due diligence op het gebied van beveiliging en gegevensbescherming en periodiek opnieuw beoordeeld, en componenten van derden en open source die in de Diensten worden gebruikt, worden geïnventariseerd en gecontroleerd op bekende kwetsbaarheden. Persoonsgegevens worden niet langer bewaard dan noodzakelijk is voor de doeleinden waarvoor zij worden verwerkt en om te voldoen aan wettelijke, boekhoudkundige of rapportageverplichtingen, waarna zij worden verwijderd of teruggegeven overeenkomstig de Overeenkomst. Rekening houdend met de aard van de verwerking, verleent de Verwerker, voor zover mogelijk, redelijke bijstand aan de Verwerkingsverantwoordelijke bij het voldoen aan diens verplichting om verzoeken van betrokkenen te beantwoorden en aan de verplichtingen uit hoofde van de artikelen 32 tot en met 36 van de AVG.

Sweden

These additional terms & conditions (“Terms”) to the Practice Agreement including the Data Privacy Agreement form part of the Agreement (together the “Agreement”) and are entered into by and between Dandy Labs Europe SAS (“Dandy” or “We”), and you and your dental practice or office (“You” or “Practice”), and are effective as of the date the Practice Agreement is entered into (“Effective Date”). If You accept the Agreement  on behalf of an entity, partnership, corporation, or organization, “You” includes You, that entity, and all entity users and You hereby represent that You have the authority to bind all such users. Dandy and You will each be referred to as a “Party” and together, the “Parties”. Terms defined herein or elsewhere in the Agreement shall have the defined term apply across the Agreement. For good and valuable consideration as set forth in the Practice Agreement, the Parties agree to the following:

1. Billing & Payments: All amounts payable pursuant to this Agreement are in Euros (€) and may be made by transfer of Euros only (with any foreign exchange fees and bank fees, if applicable, borne by You) and exclusive of applicable Value Added Tax (VAT that shall, where applicable, be charged in addition to the invoiced amounts and paid by You, upon receipt of a valid invoice as required by Applicable Law).  We accept payment by SEPA Direct Debit, bank transfer, debit card or credit card, and You are required to keep a valid payment method on file at all times. Time of payment is of the essence. Without prejudice to the foregoing, the Parties agree that all invoices shall be paid within a maximum period of thirty (30) days from the date of receipt of the invoice or, if later, from the date of receipt of goods or services. Discounts and promotions cannot be used to pay for processing, shipping, cancellation, or other fees. Dandy has the right to charge (and You agree to pay) the maximum interest amount allowed by Applicable Law, or 1.5% per month if none is specified by Applicable Law. Interest shall accrue daily from the due date until actual payment, whether before or after judgment. Dandy does not accept paper checks, prepaid credit cards, peer-to-peer payments, or cryptocurrency as valid payment methods. In the event You have any unpaid balances for sixty (60) days or more, or the amount owed to Dandy is 10,000 € (EUR) or more, Dandy reserves the right to pause your account until all unpaid balances are remitted. In the event of continuing non-payment, Dandy may cancel or suspend any or all agreements with You, which shall not extinguish the debt or any accrual of interest. You are expected to manage your patients’ expectations of the timing of the supply of the Dandy Products ordered for them accordingly. 

Except as provided below, each Party shall be solely responsible for its own tax obligations arising in connection with this Agreement. All payments by You under this Agreement shall be made without deduction or withholding for any taxes, except as required by Applicable Law. To the extent any payment under this Agreement gives rise to any obligation on You to deduct, withhold, or remit any amount to any governmental authority under Applicable Law, the amounts due and payable under this Agreement shall be increased so that We receive an amount equal to the amount we would have received had no such deduction or withholding been made. For reporting purposes, You agree to deliver to Dandy evidence that such taxes were paid to a governmental authority, including the original or a certified copy of a receipt issued by that authority evidencing the payment.

You further acknowledge that Dandy has disclosed the possibility of processing fees and has provided the opportunity to ask any questions regarding such fees prior to entering this Agreement. You agree to indemnify and hold Dandy harmless from any claims, damages, or losses arising from any such surcharges imposed by third-party service providers. Dandy reserves the right to change pricing for Dandy Products (defined below) at any time upon forty-five (45) days’ notice. You agree that You shall have no right of set-off, counterclaim deduction or withholding against amounts owed by Dandy to You. You agree that Dandy may at any time and without limiting any other rights or remedies it may have, set-off any amount owing by You against any amount payable by Dandy to You. Dandy does not accept payments from patients, including payments in the patient’s name forwarded by You.

2. Equipment. The risk of loss, theft, damage or destruction of the Equipment shall pass to You on Delivery. The Equipment shall remain at your sole risk during the term of this Agreement and any further term during which the Equipment is in your possession, custody or control (the “Risk Period“) until the Equipment is redelivered to Dandy. You shall give immediate written notice to Dandy in the event of any loss, accident or damage to the Equipment arising out of or in connection with your possession or use of the Equipment. Dandy will provide shipping labels and a box to return the Equipment. 

You will not modify, damage, or destroy the Equipment in any way or remove any of the Equipment from your practice site. Dandy will supply You with support, technical service and software maintenance for the Equipment. You agree to be responsible for properly maintaining the Equipment daily, including cleaning and safely storing it. You are responsible for the Equipment while it is in your possession, and You accept the risk of loss should there be any. If there is partial damage to the Equipment due to user error, including but not limited to improper installation, misuse, or abuse of the Equipment, Dandy may charge you a replacement parts fee of up to 3,000 € (EUR) in its sole discretion.

3. Dandy’s Warranty: We stand behind the quality of Dandy Products. Titanium implant abutments have a lifetime warranty against the product breaking during the ordinary course of use due to a defect in materials, manufacturing, or workmanship. All fixed products (namely, crowns, bridges, implant crowns, implant bridges, inlays, onlays, veneers, and Zirconia implant abutments, each to the extent available in your market) have a lifetime warranty against the product breaking during the ordinary course of use due to a defect in materials, manufacturing, or workmanship. To the extent available in your market, all partial and full dentures, night guards, splints, sleep apnea devices, clear aligners, retainers and bleaching trays have a warranty against wear-and-tear for the first six (6) months from the Delivery date, and have a ten (10) year warranty against the product breaking during the ordinary course of use due to a defect in materials, manufacturing, or workmanship. Under Dandy’s warranty, and as the sole remedy, Dandy will repair or replace the product or refund the original price paid, at Dandy’s sole discretion. The warranty will be voided if the restoration is not regularly maintained and checked by a qualified dental professional. 

Third-party products included in the equipment will benefit from manufacturer warranties that might be assigned by Dandy to You, but otherwise do not benefit from the Dandy warranty provided above. 

To the maximum extent permitted by Applicable Law, the warranties in this section 3 are the sole warranties for products supplied by Dandy, and all other express and implied warranties are disclaimed, including implied warranties of merchantability, fitness or suitability for a particular purpose, and non-infringement.

4. IT Requirements. You agree to provide and maintain a high-speed internet connection for use in connection with the Equipment, and You agree to follow the IT Policies included in the online terms and conditions.

5. Training: You, and anyone in your dental practice who will use Dandy’s provided software, as may be updated to include Chairside, the Dandy Practice Portal, any digital services or support, any hardware and/or software, or fixed and removable Dandy Products (together, the “Dandy Offerings”) will attend a Dandy virtual training prior to using or discussing the Dandy Offerings with patients.

6. Indemnity: You shall indemnify, keep indemnified, defend and hold harmless Dandy against and from any and all claims, causes of actions, damages, debts, liabilities, losses, obligations, payments, costs and expenses (including legal expenses), arising from or relating to: (a) breach by You of any term of any agreement with Dandy; (b) breach by You of any term of any agreement between You and your patient or any acts or failures in respect of a patient (including actions by any professional body regulating You or any national regulator(s) or licensing body), including without limitation, negligence or willful acts regarding patient care or the provision of any incorrect clinical data; and (c) provision by You of incorrect or incomplete information, documents, scans or impressions or failure to timely provide Dandy with any information we request from You.

7. Practice Change of Control: If your dental practice undergoes a Change of Control from an ownership perspective, You agree to inform Dandy with written notice within five (5) business days before the day such Change of Control becomes effective. For the purposes of this clause, a “Change of Control” situation shall include any transaction or series of transactions resulting in a change in the direct or indirect ownership of more than fifty percent (50%) of the voting rights or share capital of your dental practice, or any merger, consolidation, or sale of substantially all of its assets.

8. Medical Disclaimer: Your practice is solely responsible for the treatment of patients using any Dandy Offerings, and for providing your patients with all relevant information about the Dandy Offerings and any related risk prior to and after treatment. The Dandy Offerings are offered solely as a supplement to your dental practice and do not constitute medical, dental or other healthcare advice, diagnosis or treatment to or for your patients. You agree not to make any representations or warranties regarding the Dandy Offerings to your patients. You represent to Dandy that your practice will comply with all Applicable Law, regulations, guidance and professional codes of conduct regarding professionals who are authorized to practice dentistry and to conduct intraoral scans on practice patients. Except as otherwise expressly provided herein, the Dandy Offerings provided to you hereunder are provided “AS IS” and are provided pursuant to your prescription for the individual patient. 

The Parties acknowledge that this Agreement creates no direct contractual relationship between Dandy and Your patients. Any claims, demands, or actions brought by a patient or regulatory body arising out of your clinical decisions, treatment management, prescription errors, or the provision of faulty data (such as defective scans or impressions) shall be subject to your full indemnification obligations as set out in section 6.

You agree to comply with your obligations under Regulation (EU) 2017/745 on medical devices to the extent applicable. You agree to handle all communications and other activities in relation to any recall or other regulatory activity in accordance with all our reasonable instructions and to not reach out or otherwise communicate with a competent authority prior to consultation with us. This obligation as well as related indemnification arrangements of the Online Terms and Conditions shall survive termination of this Practice Agreement for the period medical devices supplied by us remain in use.

9. Amendment. These Terms and the Agreement may be changed by mutual written agreement of the Parties. These Terms and the Agreement may otherwise be amended by Dandy and Dandy will notify You of any material changes. Such material changes shall become effective thirty (30) days after notification unless You terminate by written notice within that period. In such cases, Dandy will honor existing Terms for sixty (60) days or until the Equipment is returned.

10. Entire Agreement. The Practice Agreement, these Terms, the Data Privacy Agreement (“DPA”) (Schedule A), and the IT Policies constitute the “Agreement”. This Agreement supersedes all prior conflicting agreements.

11. Non-assignability. You may not transfer or assign the Agreement to a third party without Dandy’s prior written consent.

12. Legal Compliance. Both Parties agree to comply with all applicable health and data laws in the jurisdiction where You and Dandy are both established, relevant regulatory standards issued by European and national authorities, and guidance issued by professional regulatory bodies.

13. Governing Law & Jurisdiction.

  1. Governing Law. You agree that the Agreement shall be governed by and construed in accordance with the laws of the jurisdiction where the Practice is established (the “Applicable Law”). 
  2. Jurisdiction. Any disputes arising out of or in connection with the Agreement shall be submitted to the exclusive jurisdiction of the courts of the applicable jurisdiction where the Practice is established, as set forth in the table below.
CountryJurisdiction
BelgiumTribunal of Brussels
FrankrijkTribunaal voor Economische Activiteiten van Parijs
IrelandCourts of Dublin 
ItalyTribunal of Milan
The NetherlandsThe competent court in Amsterdam, the Netherlands
SpainCourts and Tribunals of Madrid
GermanyCourts of Frankfurt am Main
SwedenCourts of Stockholm

14. VAT & Tax. Dandy will charge applicable Value Added Tax (“VAT”) at the applicable rate in addition to any price, charge or amount due under the Agreement and such VAT shall be payable by You, where applicable. If You are exempt, You must provide a valid VAT exemption certificate or evidence satisfactory to the relevant tax administration, when available or justify the basis for the VAT exemption.

15. Data Privacy. Because Dandy processes personal data, including health data (“Personal Data”) on your behalf:

Data Protection Roles. The Parties acknowledge that:

Data Protection Contact. Any privacy-related notices or requests under this Agreement should be directed to Dandy at [email protected]

Schedule A: Data Privacy Agreement (“DPA”)

This DPA is incorporated into the Agreement where Dandy acts as a processor on behalf of the Practice as controller. The nature, purpose, and duration of the processing are set out in Appendix 1 (“Data Processing Details”).

1. Definitions

2. Subject Matter & Instructions

Dandy shall process Personal Data only on the documented instructions of the Practice, including with regard to transfers of Personal Data to a Third Country, unless required to do so by applicable laws, to which Dandy is subject; in such a case, Dandy shall inform the Practice of that legal requirement before Processing, unless that law prohibits such information on important grounds of public interest. If Dandy believes any instruction infringes Applicable Laws, it shall immediately inform the Practice and shall be entitled to suspend the execution of the relevant instruction until the Practice confirms, amends or withdraws it. Any oral instructions shall be confirmed by the Practice in writing without undue delay.

The Practice shall ensure it has a lawful basis under Article 6 of the GDPR for processing Personal Data, as well as an exemption under Article 9 of the GDPR for processing Special Category Data, in the context contemplated in this DPA.

3. Obligations of Dandy (the “Processor”)

4. Sub-Processing

4.1 The Practice hereby grants Dandy general written authorisation to engage the sub-processors listed within Dandy’s Trust Center, which can be found at https://trust.meetdandy.com/subprocessors, and subject to this clause 4.

4.2 If Dandy appoints a new sub-processor or intends to make any changes concerning the addition or replacement of the sub-processors, it shall provide the Practice with twenty (20) business days’ prior written notice, during which the Practice can object against the appointment or replacement on reasonable and documented grounds related to the confidentiality or security of Personal Data or the sub-processor’s compliance with Applicable Laws. If the Practice does not object, Dandy may proceed with the appointment or replacement. If the Practice objects and Dandy cannot reasonably accommodate the objection, the Practice may terminate this DPA and the Agreement upon written notice. Dandy shall ensure that it has a written agreement in place with all sub-processors which imposes obligations on the sub-processor which are no less onerous on the relevant sub-processor than the obligations on Dandy under this DPA.

5. Practice’s Obligations

5.1 The Practice warrants that: (i) the legislation applicable to it does not prevent Dandy from fulfilling the instructions received from the Practice and performing Dandy’s obligations under this DPA; and (ii) it has complied and continues to comply with the Applicable Laws, in particular that it has obtained any necessary consents or given any necessary notices, and otherwise has a legitimate ground to disclose the data to Dandy and enable the Processing of the Personal Data by Dandy as set out in this DPA.

5.2 The Practice agrees that it will indemnify and hold harmless Dandy on demand from and against all claims, liabilities, costs, expenses, loss or damage (including consequential losses, loss of profit and loss of reputation and all interest, penalties and legal and other professional costs and expenses) incurred by Dandy arising directly or indirectly from a breach of this clause 5.

6. Changes in Applicable Laws

The Parties agree to negotiate in good faith modifications to this DPA if changes are required for Dandy to continue to process the Personal Data as contemplated by this DPA in compliance with the Applicable Laws, including (i) to comply with the GDPR or any national legislation implementing it, and any guidance on the interpretation of any of their respective provisions; (ii) if the SCCs or any other mechanisms or findings of adequacy are invalidated or amended; or (iii) if changes to the membership status of a country in the European Union or the European Economic Area require such modification.

7. International Transfers

Dandy shall not transfer Personal Data outside the European Economic Area unless it ensures that the transfer is subject to appropriate safeguards in accordance with Article 46 GDPR. Such appropriate safeguards may include: (a) an adequacy decision of the European Commission pursuant to Article 45 GDPR; (b) SCCs adopted by the European Commission pursuant to Article 46(2)(c) GDPR; (c) certification under the EU-US Data Privacy Framework; or (d) any other valid transfer mechanism under Applicable Laws.

8. Personal Data Breach Notification

Dandy shall notify the Practice without undue delay (and in any event within 72 hours) after becoming aware of a Personal Data Breach, providing sufficient information to allow the Practice to meet any reporting obligations to the relevant data protection authority. Further information about the Personal Data Breach shall be provided in phases as more details become available.

9. Deletion or Return 

At the choice of the Practice, Dandy shall delete or return all Personal Data to the Practice after the end of the provision of services and delete existing copies unless applicable laws require continued storage.

APPENDIX 1: DATA PROCESSING DETAILS

APPENDIX 2: SECURITY MEASURES

Zin om nu even te praten?

Bel ons team nu meteen en krijg direct antwoord op je vragen
Bel ons: (289)-985-0325

Zin om nu even te praten?

Bel ons team nu meteen en krijg direct antwoord op je vragen
Bel ons: +44 020 4572 6011
Bel ons: 289-985-0325
Bel ons: +44 020 4572 6011