Clinic Integration and Data Processing Agreement (version 1.8) 1. About this agreement This agreement is between OpenWide Health Ltd, company no. 17098565, registered at 109 Lever Street, London EC1V 3RQ ("OpenWide", "we") and the clinic(s) named in the onboarding form ("the Clinic", "you"). It is accepted electronically by the person named in the form, who confirms they are authorised to accept it for the Clinic. OpenWide runs the dental marketplace at openwide.clinic (the "Platform"), where patients can see the Clinic's availability and book and pay for appointments. 2. Some definitions - Clinic System: the practice management system the Clinic uses, provided by its practice management system provider, whether OpenWide connects to it through its online API or through a secure connector or agent operated for that system (for example an on-premise bridge for a system that runs on the Clinic's own computers). - Credentials: the API keys, tokens, logins or connector credentials used to connect to the Clinic System. - Booking: an appointment a patient makes with the Clinic through the Platform. - Patient Payment: a payment for a Booking made through the Platform. - Connected Account: the Clinic's Stripe account, linked to OpenWide through Stripe Connect. - Booking Fee: OpenWide's fee, set out in Schedule 1. - Clinic Personal Data: personal data OpenWide processes on the Clinic's behalf under this agreement, as described in Schedule 2. - Data Protection Law: the UK GDPR, the Data Protection Act 2018 and related UK law. 3. Connecting to your system 3.1 The Clinic authorises OpenWide to connect to the Clinic System using the Credentials while this agreement is in place, and to confirm that authorisation to its practice management system provider if asked. That connection may be made directly to the Clinic System's online service or through a secure connector or agent OpenWide provides to run on the Clinic's systems. 3.2 We use that connection only to run the booking service: to read the Clinic's clinicians, treatments and diary availability and show it to patients on the Platform, and to create Bookings in the Clinic's diary. Any cancellation or reschedule only ever applies to Bookings made through OpenWide, and cancellations are confirmed by the Clinic before they take effect. We also send booking confirmations, changes and reminders to patients and to the Clinic's notification email(s). OpenWide may in addition use availability and booking information in anonymised and aggregated form as described in clause 6.10. 3.3 We do not access the Clinic's clinical records, and we do not change anything in the Clinic System beyond what is needed for Bookings. 3.4 We keep the Credentials secure: encrypted at rest, used only from our own server-side systems or from a secure connector we provide, over secure connections, and never shared with patients or exposed publicly. We stop using them as soon as the Clinic revokes them or this agreement ends. 3.5 The Clinic confirms it is permitted, under its terms with its practice management system provider, to give OpenWide this access. 4. Bookings 4.1 The Clinic keeps its diary, prices and treatment information in the Clinic System accurate. The Platform shows availability as the Clinic System reports it. 4.2 Patients can ask to cancel or reschedule a Booking through the Platform or the clinic portal. Those changes apply only to Bookings made through OpenWide, and a cancellation is confirmed by the Clinic before it takes effect. OpenWide uses reasonable efforts to keep the Clinic System in step. Changes the Clinic makes directly in the Clinic System are reflected on the Platform. 4.3 The Clinic is solely responsible for clinical care, consent, treatment decisions and its regulatory duties (including GDC and CQC). OpenWide is a booking and payment facilitator, not a provider of dental services. 4.4 OpenWide uses reasonable efforts to keep the integration running and will tell the Clinic about planned downtime or known sync problems. If a sync problem causes a clash, both parties will work together to rebook the patient. 5. Payments via Stripe Connect 5.1 The Clinic opens a Connected Account and accepts Stripe's Connected Account Agreement, which is a direct contract between the Clinic and Stripe. 5.2 The Clinic is the seller of the dental services and Patient Payments belong to the Clinic. They are taken through Stripe in one of the three ways in clauses 5.3, 5.3a and 5.3b. OpenWide never sees card or bank details. 5.3 OpenWide takes the Booking Fee from each Patient Payment as a Stripe application fee. Payments are made directly on the Clinic's Connected Account, so Stripe's processing fees are the Clinic's. Where a Booking Fee cannot be taken in full from a Patient Payment (for example a free private consultation), OpenWide invoices the balance as set out in clause 5.3c. 5.3a The Clinic may instead choose monthly invoicing (selected when connecting Stripe, in the clinic portal, or as agreed with OpenWide). In that case the Clinic keeps the full Patient Payment and OpenWide invoices the Booking Fees as set out in clause 5.3c. Unpaid Booking Fees remain a debt owed to OpenWide and may be recovered, including by deduction from future payouts or application fees. 5.3b If the Clinic accepts deposits or bookings through the Platform but has not connected a Stripe account, or its Connected Account cannot yet take payments, OpenWide collects Patient Payments on the Clinic's behalf as its commercial agent, through OpenWide's own Stripe account. A patient who pays OpenWide has paid the Clinic. OpenWide pays the Clinic the amount due, which is the Patient Payments collected less the Booking Fees and any refunds, monthly, with the statement in clause 5.7. Refunds due under clause 5.5 are paid from the collected amount. 5.3c Monthly invoices: on or shortly after the 1st of each month, OpenWide invoices the Booking Fees still owed for appointments that took place in the previous month and earlier, with one line per Booking identified by its reference and date. Invoices are payable within 14 days of the invoice date. No invoice is sent for a month in which nothing is owed. A fee credited back under clause 5.5 or Schedule 1 is not invoiced. 5.4 Payouts follow Stripe's payout schedule for the Connected Account. 5.5 Cancellations and refunds are handled in the clinic portal and processed through Stripe: - Cancelled more than 48 hours before the appointment: the Patient Payment is refunded in full and OpenWide refunds its Booking Fee. - Cancelled within 48 hours, or a no-show: no refund is due and OpenWide keeps its Booking Fee. The Clinic may refund the patient at its own discretion. Any such refund is paid by the Clinic and does not change the Booking Fee. - Stripe does not return its own processing fees on refunds. Rescheduling a Booking does not trigger a refund or a new Booking Fee. 5.6 The Clinic is responsible for chargebacks and disputes on its Patient Payments and will provide evidence when asked. If Stripe recovers a disputed amount from OpenWide, the Clinic will repay it within 14 days. 5.7 OpenWide provides a monthly statement of Bookings, Patient Payments, Booking Fees, fees owed and refunds in the clinic portal. 5.8 OpenWide only accesses the Stripe transactions relating to OpenWide Bookings and does not use the Connected Account for anything else. For complete separation, the Clinic may choose to use a dedicated Stripe account for OpenWide bookings. 6. Data protection 6.1 For patient data in the Clinic System, the Clinic is the controller and OpenWide is its processor when it reads or writes that data to manage Bookings. The processor terms in Schedule 2 apply, and Schedule 2 sets out what data this covers, whose it is and how long it is kept. 6.2 Patients who create an OpenWide account also have a direct relationship with OpenWide, which is the controller of that account data under its privacy notice at openwide.clinic. 6.3 We process only the information needed to make and manage Bookings and payments, such as the patient's name and contact details, the details the Clinic System requires to create or match a patient record (for example date of birth and gender), appointment and payment details, and the names of the Clinic's clinicians shown for booking. We do not access clinical records such as medical history, medications or treatment notes. 6.4 The Clinic is responsible for having a lawful basis for the processing it instructs, and will make sure its own privacy notice tells patients that appointments can be booked online through third-party booking services such as OpenWide. 6.5 We process Clinic Personal Data only on the Clinic's documented instructions, which are this agreement and the Clinic's use of the Platform. We will tell the Clinic promptly if we think an instruction breaks Data Protection Law. If the law requires us to process Clinic Personal Data in a way the Clinic has not instructed, we will tell the Clinic before we do so, unless the law prevents us. 6.6 Clinic Personal Data is stored in the UK or EEA. Some of our subprocessors process it elsewhere, as shown in Schedule 3. Where that happens we make sure the transfer is covered by UK adequacy regulations or an appropriate safeguard, such as the UK International Data Transfer Agreement or the UK Addendum to the EU standard contractual clauses. We apply appropriate measures to keep Clinic Personal Data secure. 6.7 We will notify the Clinic without undue delay, and in any event within 48 hours, after becoming aware of a personal data breach affecting Clinic Personal Data. We will send the notice to the Clinic's notification email even if our investigation is not complete, and it will include, as far as we know at the time: what happened, the categories and approximate number of people and records affected, the likely consequences, what we have done or plan to do about it, and a contact for further information. We will send further details as we learn them. The Clinic decides whether to notify the ICO or patients. 6.8 Subprocessors: the Clinic gives OpenWide general authorisation to use subprocessors. Our current subprocessors, what they do and where they process data are listed in Schedule 3 and at openwide.clinic/trust. We will give the Clinic at least 30 days' notice by email before adding or replacing a subprocessor. The Clinic may object on reasonable data protection grounds within that period, and we will work in good faith to resolve the objection. If we cannot, the Clinic may end this agreement without penalty before the change takes effect. We put each subprocessor under data protection terms no less protective than these, and we remain responsible to the Clinic for how our subprocessors meet their data protection obligations. 6.9 If a patient or anyone else asks OpenWide to exercise their data protection rights over the Clinic's records, we will pass the request to the Clinic promptly and will not respond to it ourselves except on the Clinic's instructions. Requests about an OpenWide patient account are handled by OpenWide as controller under clause 6.2. 6.10 OpenWide may create and use anonymised, aggregated information derived from availability and booking activity across the Platform, for example to understand where dental appointments are and are not available across the UK, to improve the Platform, and to support research and advocacy on dental access, including engaging with government and parliament. Before using or publishing it, OpenWide will check and record that the information is genuinely anonymous, taking into account other information it could be combined with, and will aggregate at a regional level and suppress small numbers where needed. OpenWide will never name or identify the Clinic, or any group the Clinic belongs to, as a source of the information or as the subject of a result. Information that does not meet this standard remains Clinic Personal Data and is subject to this agreement. Once anonymised and aggregated to this standard it is no longer personal data and is not subject to the processor restrictions in this agreement, and OpenWide may retain and use it, including after this agreement ends. 7. Liability, term and general 7.1 Each party's total liability in any 12 month period is limited to the Booking Fees paid or payable in that period, or £5,000 if greater. Neither party is liable for indirect loss or loss of profit, revenue or goodwill. 7.2 Nothing limits liability for death or personal injury caused by negligence, for fraud, or for anything that cannot be limited by law. The cap does not apply to clause 5.6. 7.3 The Clinic will indemnify OpenWide against claims arising from the treatment it provides. 7.4 This agreement starts when accepted and runs until the Clinic ends it. The Clinic can stop at any time by emailing [email protected], and OpenWide will stop promptly. Either party may also end it immediately for a material breach not fixed within 14 days, or for insolvency. 7.5 On termination, OpenWide stops using the Credentials, stops taking new Bookings, and deletes or returns Clinic Personal Data within 30 days unless the law requires it to be kept. Copies in our backups are deleted on their normal expiry cycle, which is no longer than 30 days, and are not restored to live use in the meantime. Existing Bookings stay valid and clause 5 continues to apply to them. 7.6 This is the whole agreement on its subject. OpenWide may update it with 30 days' notice, and the Clinic may terminate if it does not accept the change. It is governed by the law of England and Wales. Schedule 1: Booking Fee - Standard Bookings: 20% of the value of each Booking made through the Platform. - Non-general consultations: for any consultation other than a general check-up or examination (for example an implant, Invisalign, cosmetic or other specialist consultation), the Booking Fee is 20% of the Booking value or £20, whichever is higher. This includes consultations offered free of charge, where the fee is £20. Where the fee cannot be taken in full from the Patient Payment, the balance is invoiced under clause 5.3c. This does not apply to NHS appointments. - The fee applies only to the booked entry appointment (such as a check-up or consultation). OpenWide charges nothing on any further treatment, follow-up appointments or other charges the patient pays the Clinic. - The fee is refunded when a Booking is cancelled more than 48 hours before the appointment, or when a Booking fails because of a fault on the Platform. It is not refunded when the Clinic chooses to refund a patient in other circumstances (clause 5.5). - Listing on the Platform is free. - Any discounts or credits agreed with the Clinic are as shown in the onboarding form at acceptance. Schedule 2: Processor terms and details of processing What we process - Subject matter: running online booking and payment for the Clinic through the Platform. - Duration: while this agreement is in place, plus the deletion period in clause 7.5. - Nature and purpose: reading the Clinic's diary availability, clinicians and treatments; creating, matching and updating patient records and Bookings in the Clinic System; sending booking emails; taking Patient Payments through Stripe; and support. - Patients (adults and children): name, email, phone, address and postcode, date of birth, gender, the Clinic System's patient ID, NHS or private status, Booking details (date, time, clinician, treatment type, reference) and payment status, any short note the patient adds when booking, and messages the patient and the Clinic exchange about a Booking through the Platform. OpenWide does not ask patients for clinical information. - Clinicians and staff: names, job titles and GDC numbers where shown for booking or on the Clinic's listing, and the names and work email addresses of Clinic staff who use the clinic portal. - Clinic portal users: login and account details, and technical data such as IP address and browser information. - Special category data: the fact that a person has booked a dental appointment, and any note they choose to add, may be health data. The Clinic is responsible for the lawful basis and Article 9 condition for this processing. - Retention: Bookings and related records are kept while this agreement is in place so the Clinic and patient can manage them, then deleted under clause 7.5. Credentials are deleted when revoked or when this agreement ends. OpenWide will - process Clinic Personal Data only as set out in clause 6.5; - make sure everyone with access is bound by confidentiality, and limit access to staff who need it; - keep appropriate technical and organisational security measures in place, including encryption in transit and at rest, access controls, and logging and monitoring (summarised at openwide.clinic/trust); - use subprocessors only as set out in clause 6.8; - help the Clinic, as far as reasonably possible, to respond to requests from patients exercising their rights, and to meet its duties on security, breach notification, data protection impact assessments and consultation with the ICO; - delete or return Clinic Personal Data at the end of this agreement as set out in clause 7.5; - make available the information the Clinic reasonably needs to show compliance with Article 28 of the UK GDPR, and allow for and contribute to audits as set out below. Audits OpenWide will first answer audit requests with documents, such as our security summary, policies, subprocessor list and answers to a reasonable security questionnaire. If those do not reasonably show compliance, the Clinic, or an independent auditor bound by confidentiality, may carry out an inspection on at least 30 days' written notice, no more than once in any 12 months, during business hours and in a way that does not disrupt our service or put other clinics' data at risk. These limits do not apply where an inspection is needed after a personal data breach affecting Clinic Personal Data, or where the ICO requires it. Each party pays its own costs of an audit, unless the audit shows a material breach of this agreement by OpenWide, in which case OpenWide pays its own costs and the Clinic's reasonable costs. Schedule 3: Subprocessors These are the suppliers that may process Clinic Personal Data on OpenWide's behalf. The current list is also published at openwide.clinic/trust. - Vercel Inc. (website hosting and server-side processing): served from London, UK; server-side processing in the United States. Request data, including Booking and patient details as they pass through. - Supabase Inc. (database, authentication, file storage and encrypted credential storage): Ireland (AWS eu-west-1). All Clinic Personal Data held by OpenWide, and encrypted Credentials. - Resend (transactional email): sending from Ireland; account and log data in the United States. Patient and Clinic email addresses and booking email content. - Stripe (payments, under Stripe Connect): UK, EEA and United States. Patient Payment details. Stripe is also a controller in its own right for payment data under its own terms. - Cloudflare, Inc. (DNS, network security and encrypted connector tunnels for on-premise systems): nearest data centre in Cloudflare's global network, which for UK traffic is normally the UK. Encrypted request data in transit. - Google (Google Workspace email and documents): EEA and United States. Support emails and documents that may contain patient or Clinic staff details. - Functional Software, Inc. (Sentry, error monitoring): Germany (EU region). Technical error data, which may include user IDs and request details; screen text is masked in any session replay. - PostHog, Inc. (product analytics, only with cookie consent): EU region. Clinic portal and patient account IDs and email addresses, and page and booking events. - Upstash, Inc. (rate limiting to protect the Platform from abuse): global, including the United States. IP addresses and account IDs, held for minutes only.