1. Amendment

These Terms and the Agreement cannot be changed unless we both agree in writing. If Cosmilab makes material changes to either the Terms or the Agreement, Cosmilab will notify you of such change. Any material change will become effective thirty (30) days after we notify you, unless you notify us in writing that you wish to terminate the Agreement. In that case, the change will not take effect and Cosmilab will honor the existing Agreement for sixty (60) days or until you return the scanner and any other Cosmilab equipment that may be in your possession.

2. Notice and Versioning

Cosmilab will give the notice required by Section 1 by email to the practice email address identified in the Agreement and by a notice posted in the Cosmilab ordering platform. Each version of these Terms is published with an effective date, and the superseded version remains available on request. A change that is not material may be made without notice, provided the effective date is updated.

3. Entire Agreement

The Agreement, these Terms and the Business Associate Agreement constitute our entire agreement. Anything communicated in any other method outside of these documents is not binding. This Agreement supersedes any other conflicting agreement we may have made in the past.

4. Non-assignability

Cosmilab is partnering with you, so you may not transfer or assign the Agreement and Terms to a third party unless we both agree in writing.

5. Legal Compliance

Both Parties agree to comply with all applicable health laws and regulations in the United States, including HIPAA, among others.

6. Indemnity

You will indemnify, defend, and hold harmless Cosmilab against and from all claims, causes of actions, damages, debts, liabilities, losses, obligations, payments, costs, and expenses (including legal expenses), arising from or relating to: (a) your breach of any term of the Agreement, these Terms and/or the Business Associate Agreement; (b) your breach of any term of any agreement between you and any patient, or any negligent, reckless or willful acts or failures with respect to your care of a patient; (c) your provision of incorrect or incomplete information, scans, documents, or data to Cosmilab, or any failure to timely provide Cosmilab with any information it requests from you, your practice, or any of your Dentists; and (d) any and all dealings with federal, state or local administrative agencies, regulators, licensing, or professional bodies.

7. Limitation of Liability

To the maximum extent permitted by applicable law, neither Party will be liable for any indirect, incidental, special, consequential, exemplary or punitive damages, or for any loss of profits, revenue, data, goodwill, or business opportunity, arising out of or relating to the Agreement, these Terms, or the Cosmilab Offerings, whether based in contract, tort, or any other theory, even if advised of the possibility of such damages. Cosmilab's total aggregate liability for all claims arising out of or relating to the Agreement, these Terms, and the Business Associate Agreement will not exceed the total amounts paid by you to Cosmilab during the twelve (12) months immediately preceding the event giving rise to the claim. Nothing in this Section limits either Party's liability for fraud, willful misconduct, or any liability that cannot be limited under applicable law. The Parties acknowledge that the pricing of the Cosmilab Offerings reflects this allocation of risk.

8. Dispute Resolution and Arbitration

Cosmilab hopes that we never encounter any meaningful disagreements about our Agreement, these Terms, and the Business Associate Agreement, and Cosmilab very much prefers to resolve any disagreements in the most amicable way possible. If something does arise that we are unable to resolve through amicable problem solving within thirty (30) days of written notice from one Party to the other, we both commit to resolve the issue through binding arbitration administered by the American Arbitration Association under its Commercial Arbitration Rules, including the Expedited Procedures where the AAA rules make them applicable, before a single arbitrator. The seat of the arbitration is New York County, New York, and the Agreement, these Terms and the Business Associate Agreement are governed by the laws of the State of New York, without regard to its conflict of laws rules. The arbitrator's award may be entered in any court of competent jurisdiction. Either Party may instead bring an individual claim in a small claims court with jurisdiction over the Parties, and either Party may seek injunctive relief in court to protect its confidential information or intellectual property. Each Party waives any right to bring or participate in a class, collective, or representative action.

9. Sales Tax

Cosmilab will charge sales tax, as applicable, on our products, equipment and services based on your geographical location. The amount of sales tax will be presented on your monthly invoice, and payment will be collected as described herein as well as in your Agreement. If you are exempt from paying sales tax, you agree to provide Cosmilab with a valid exemption certificate acceptable to each taxing jurisdiction where exempt status is claimed.

10. Severability and Survival

If any provision of these Terms is held invalid or unenforceable, that provision will be modified to the minimum extent necessary to make it enforceable, and the remaining provisions will remain in full force and effect. Sections 6, 7, 8 and 9, and any provision that by its nature should survive, will survive termination of the Agreement.

Recitals

WHEREAS, Covered Entity is a "covered entity" as that term is defined at 45 C.F.R. § 160.103;

WHEREAS, BA may, on behalf of Covered Entity, create, receive, maintain, or transmit certain Protected Health Information in order to provide services to Covered Entity pursuant to the Agreement;

WHEREAS, Covered Entity is subject to the Administrative Simplification requirements of the Health Insurance Portability and Accountability Act of 1996 and regulations promulgated thereunder, including the Standards for Privacy of Individually Identifiable Health Information and the Security Standards for the Protection of Electronic Protected Health Information at 45 C.F.R. Parts 160 and 164 (collectively, the "Privacy and Security Regulations");

WHEREAS, the Privacy and Security Regulations require Covered Entity to enter into a contract with BA in order to mandate certain protections for the privacy and security of Protected Health Information, and those Regulations prohibit the disclosure of Protected Health Information from Covered Entity to BA if such a contract is not in place;

WHEREAS, this Addendum shall be applicable only in the event that BA meets, with respect to Covered Entity, the definition of "business associate" set forth in 45 C.F.R. § 160.103.

In consideration of the foregoing, and for other good and valuable consideration, the receipt and adequacy of which is hereby acknowledged, the parties agree as follows:

1. Definitions

1.1"Breach" shall have the meaning given to the term "breach" at 45 C.F.R. § 164.402, as applied to the Unsecured PHI created, received, maintained, or transmitted by BA from or on behalf of Covered Entity.

1.2"Electronic Protected Health Information" or "ePHI" shall have the meaning given to that term at 45 C.F.R. § 160.103, as applied to the information created, received, maintained, or transmitted by BA from or on behalf of Covered Entity.

1.3"Protected Health Information" or "PHI" shall have the meaning given to that term at 45 C.F.R. § 160.103, as applied to the information created, received, maintained, or transmitted by BA from or on behalf of Covered Entity.

1.4"Reportable Event" means any (1) use or disclosure of PHI not provided for by this Addendum; (2) Security Incident; (3) Breach of Unsecured PHI; or (4) any data incident involving PHI for which data breach notification is required under applicable foreign, federal, or state law.

1.5"Services" mean the services provided by BA to Covered Entity as set forth in the Agreement.

1.6"Security Incident" shall have the meaning given to that term at 45 C.F.R. § 164.304, as applied to the ePHI created, received, maintained, or transmitted by BA from or on behalf of Covered Entity.

Terms used, but not otherwise defined, in this Addendum shall have the same meaning as those terms in the Privacy and Security Regulations including, but not limited to, 45 C.F.R. Sections 160.103 and 164.501. Any inconsistency in the definition of a term shall be resolved in favor of a meaning that permits compliance with HIPAA.

2. Permitted Uses and Disclosures of PHI

Except as otherwise limited in this Addendum or the Agreement, BA may do any or all of the following:

2.1Use or disclose PHI to perform functions, activities, or services for, or on behalf of, Covered Entity, to the extent permitted in the Agreement, provided that such use or disclosure would not violate the Privacy Rule or any applicable state law if done by Covered Entity.

2.2Use PHI, but only to the minimum extent necessary, for the proper management and administration of BA, for debt collection practices of BA, or to carry out the legal responsibilities of BA.

2.3Disclose PHI, but only to the minimum extent necessary, for the proper management and administration of BA or to carry out the legal responsibilities of BA, provided that the disclosures are Required by Law, or BA obtains reasonable assurances from the third party to whom the PHI is disclosed that such information shall remain confidential and shall be used or further disclosed only as Required By Law or for the purpose for which it was disclosed, and such person agrees to promptly notify BA of any instance of which it is aware in which the confidentiality of the information has been breached.

2.4Use PHI to report violations of law to appropriate federal, state, and local authorities, consistent with 45 C.F.R. § 164.502(j).

2.5Use PHI to provide Data Aggregation services relating to the health care operations of Covered Entity, as permitted by 45 C.F.R. § 164.504(e)(2)(i)(B).

2.6Use PHI to create de-identified information in accordance with 45 C.F.R. §§ 164.502(d) and 164.514(a)-(c).

3. Obligations of Business Associate

3.1Limited by Agreement and Law. BA may not use or disclose PHI other than as permitted or required by this Addendum and the Agreement or as Required by Law.

3.2Compliance with HIPAA. To the extent that BA is responsible for carrying out an obligation of Covered Entity under HIPAA pursuant to this Addendum or the Agreement, BA shall comply with the requirements of HIPAA that apply to Covered Entity in the performance of such obligation.

3.3Appropriate Safeguards for PHI. BA shall implement and maintain appropriate safeguards to prevent the Use or Disclosure of PHI in any manner other than as permitted by the Agreement and this Addendum.

3.4Use of Subcontractors. If BA discloses PHI to a subcontractor or allows a subcontractor to create, receive, maintain, or transmit PHI on its behalf, BA shall require the subcontractor to execute a written agreement obligating the subcontractor to comply with all the terms of this Addendum.

3.5Availability of Internal Practices, Books and Records to Government Agencies. BA agrees to make its internal practices, books and records relating to the Use and Disclosure of PHI available to the Secretary of the United States Department of Health and Human Services for purposes of determining Covered Entity's compliance with HIPAA.

3.6Access to and Amendment of PHI. To the extent that BA maintains PHI in a Designated Record Set, BA shall make such PHI available to the individuals identified by Covered Entity as being entitled to access, and make amendments to such PHI as directed or agreed to by Covered Entity, within the time and in the manner that meets the requirements of 45 C.F.R. § 164.524, § 164.526, and applicable state law.

3.7Accounting of Disclosures. Upon Covered Entity's request, BA shall provide to Covered Entity an accounting of the disclosures of an Individual's PHI in a time and manner that meets the requirements of 45 C.F.R. § 164.528.

3.8Minimum Necessary. BA agrees that it shall comply with HIPAA's minimum necessary requirements.

3.9Reportable Events. BA shall report to Covered Entity any Reportable Event of which it becomes aware. All such reports shall be made without unreasonable delay and in no case later than ten (10) business days after BA's discovery of a Reportable Event.

3.10BA shall cooperate with Covered Entity in investigating a Reportable Event and assist Covered Entity in determining whether a Reportable Event constitutes a Breach of Unsecured PHI. BA shall mitigate, to the extent practicable, any harmful effect that is known to BA of a Reportable Event.

3.11The parties acknowledge and agree that this section constitutes notice by BA to Covered Entity of the ongoing existence and occurrence of attempted but unsuccessful Security Incidents that do not result in unauthorized access to, or use, loss, modification, destruction, or disclosure of, PHI, such as pings and other broadcast attacks on BA's firewall, port scans, unsuccessful log-on attempts, unsuccessful denial of service attacks, or any combination thereof.

4. Obligations of Covered Entity

4.1Notice of Privacy Practices. Covered Entity shall notify BA in writing of any limitations in its notice of privacy practices, to the extent that such limitations may affect BA's use or disclosure of PHI.

4.2Notification of Revocations. Covered Entity shall notify BA in writing of any changes in, or revocation of, authorization by an Individual to use or disclose PHI, to the extent that such changes or revocation may affect BA's use or disclosure of PHI.

4.3Notification of Restrictions. Covered Entity shall notify BA in writing of any restriction to the use or disclosure of PHI that Covered Entity has agreed to or is required to abide by in accordance with 45 C.F.R. § 164.522, to the extent that such restriction may affect BA's use or disclosure of PHI.

4.4Permissible Requests. Covered Entity shall not request that BA use or disclose PHI in any manner that would not be permissible under HIPAA or other applicable federal or state law if done by Covered Entity.

5. Term and Termination

5.1Term. The term of this Addendum shall be the same as the term of the Agreement, but shall terminate as of the earliest occurrence of any of the following: (a) the Agreement expires or is terminated with or without cause; (b) this Addendum is terminated for cause as described in Section 5.2 below; (c) the parties mutually agree to terminate this Addendum; or (d) this Addendum is terminated under applicable federal, state, or local law.

5.2Termination for Cause. Upon either party's determination of a breach of a material term of this Addendum by the other party, the non-breaching party shall provide written notice of that breach in sufficient detail to enable the breaching party to understand the specific nature of that breach and afford it an opportunity to cure the breach; provided, however, that if the breaching party fails to cure the breach within thirty (30) days of receipt of such notice, the non-breaching party may terminate this Addendum and the Agreement.

5.3Effect of Termination. Upon termination of this Addendum for any reason, BA shall return or destroy all PHI that BA still maintains in any form, and shall retain no copies of such PHI. If return or destruction of any or all PHI is not feasible, BA shall: (i) retain only that PHI for which return or destruction is not feasible; (ii) return to Covered Entity or destroy the remaining PHI; (iii) extend the protections of this Addendum to any retained PHI, continue to use appropriate safeguards, and comply with the Security Rule with respect to ePHI, for as long as BA retains the PHI; (iv) not use or disclose the PHI retained by BA other than for the purposes for which such PHI was retained and subject to the same conditions set forth in this Addendum that applied prior to termination; and (v) return to Covered Entity or destroy the PHI retained by BA if and when it becomes feasible to do so. These provisions shall apply to PHI that is in the possession of subcontractors or agents of BA. This Section 5.3 shall survive termination of this Addendum.

6. Miscellaneous

6.1Regulatory References. A reference in this Addendum to a section in HIPAA means the section as in effect or as amended at the time this Addendum is executed or amended.

6.2Amendment; No Waiver. Upon the effective date of any federal statute or regulation amending or expanding HIPAA that is applicable to this Addendum, this Addendum shall be automatically amended, such that the obligations imposed on Covered Entity and BA remain in compliance with such requirements, unless the parties agree otherwise by mutual consent. Except as provided otherwise in this paragraph, no waiver, change, modification, or amendment of any provision of this Addendum shall be made unless it is in writing and is signed by the parties hereto.

6.3Interpretation. Any ambiguity in this Addendum shall be resolved in favor of a meaning that permits compliance with HIPAA. In the event of an inconsistency between the provisions of this Addendum and the mandatory terms of HIPAA, the interpretation of the Secretary, a court, or another regulatory agency with authority over the parties shall prevail.

6.4Relationship to Agreement Provisions. In the event that a provision of this Addendum is contrary to a provision of the Agreement, the provision of this Addendum shall control. Otherwise, this Addendum shall be construed under, and in accordance with, the terms of the Agreement.

6.5Relationship of Parties. The parties to this Addendum are independent contractors. None of the provisions of this Addendum are intended to create, nor shall they be interpreted or construed to create, any relationship between Covered Entity and BA other than that of independent contractors.

6.6No Third Party Beneficiaries. This Addendum is between the parties hereto. Nothing express or implied in this Addendum is intended to confer any rights, remedies, obligations, or liabilities whatsoever upon any person other than Covered Entity and BA and any respective successors and assigns.

6.7Invalid or Unenforceable Provision. The provisions of this Addendum shall be severable. The invalidity or unenforceability of any particular provision shall be construed, in all respects, as if such invalid or unenforceable provision had been omitted, and shall not affect the validity and enforceability of the other provisions hereof.

6.8Assignment. The parties' rights and obligations with respect to assignment of this Addendum shall be subject to the assignment provision set forth in the Agreement.

6.9Applicable Law. This Addendum shall be construed, administered, and governed by the governing law set forth in the Agreement, except to the extent preempted by applicable federal law. In the event that the Agreement does not identify the governing law, this Addendum shall be governed under the laws of the State of New York, except to the extent preempted by applicable federal law.

6.10Notices. All notices hereunder shall be in writing, and either delivered by hand, or sent by mail, or delivered in such other manner as the parties may agree upon, to the following:

To Covered Entity: Practice's email address identified in the Agreement.

To BA: COSMILAB US INC., Attention: Legal Department, 1297 North Avenue, New Rochelle, NY 10804, info@cosmilab.us.

Each party reserves the right to change its address for receiving notice during the term of this Addendum upon written notice to the other party.