Customer Agreement

OralAI Customer Agreement

Version date: September 28, 2026

This Customer Agreement (the “Agreement”) is between Dental Dial Inc., doing business as OralAI (“OralAI”), and the customer that signs or accepts an Order that references it (“Customer”). It covers free trials and paid subscriptions. Defined terms are shown in bold where they first appear.

1. The Services

1.1 What OralAI provides. OralAI provides AI-powered phone answering and related software for dental practices. Depending on Customer’s plan and settings, the services may answer and route calls, answer questions using information Customer provides, schedule appointments in Customer’s practice systems, take messages, collect intake details, flag urgent calls, send notifications, and provide a web app for reviewing calls (together with any related features OralAI provides, the “Services”).

1.2 Orders. An “Order” is any signature page, order form, quote, or proposal from OralAI that Customer accepts by signing or by email, and any invoice or checkout page Customer pays for a new plan or location. Each Order is part of this Agreement and sets Customer’s plan, price, locations, and any trial or discount. Price changes to an existing plan follow Section 6.5. If Orders conflict, the one Customer accepted most recently controls.

1.3 Updates. OralAI regularly improves the Services and may change features, AI models, and service providers at any time. OralAI will not materially reduce the core functions of a paid plan during a period Customer has paid for. If a change does, Customer may cancel and receive a refund of prepaid fees for the unused period.

1.4 New and early-access features. OralAI may offer new features, including features that contact patients, insurance payers, or other third parties for Customer. OralAI will not turn on a feature that calls or texts patients or contacts third parties for Customer unless Customer asks for it in writing (email is enough). Features labeled beta, pilot, preview, or early access are optional, may change or end at any time, and are provided as-is.

1.5 Support and availability. OralAI provides support by email, text, or phone during normal business hours and responds to urgent service issues as quickly as it reasonably can. OralAI works to keep the Services available around the clock but does not guarantee uninterrupted service. Maintenance, carrier or internet outages, and problems with third-party systems can interrupt the Services.

2. Free Trials

2.1 Length. Unless the Order says otherwise, a free trial lasts 30 days or 150 call minutes per location, whichever comes first. OralAI may extend a trial in writing (email is enough). There are no fees during a trial.

2.2 After the trial. If Customer has agreed to a plan, paid service starts when the trial ends unless Customer tells OralAI before then that it does not want to continue (email is enough). OralAI will remind Customer before paid service starts. If no plan has been agreed, the Services end when the trial ends.

2.3 Trial terms. During a trial, the Services are provided as-is, and OralAI may end the trial on at least 7 days’ notice (or immediately for a security threat or abuse). Everything else in this Agreement applies during a trial, including all privacy and security obligations and the BAA.

3. Setup and Customer Responsibilities

3.1 Practice information. OralAI sets up the Services using Customer’s website and the information Customer provides, such as hours, providers, appointment types, policies, insurance accepted, emergency instructions, and notification contacts. Before go-live, OralAI will give Customer a written summary of how the Services will handle Customer’s calls, including urgent calls and notification contacts. Customer will review it, keep its information accurate, and tell OralAI about changes. The Services rely on this information.

3.2 Phones. Customer controls its own phone numbers and phone system, including forwarding calls to the Services. Phone numbers that OralAI provides for the Services belong to OralAI or its carrier. If Customer wants to keep an OralAI-provided number when the Agreement ends, OralAI will reasonably help transfer it where the carrier allows, and Customer pays any carrier fees.

3.3 Practice systems. If Customer uses scheduling or other integrations, Customer authorizes OralAI to access, read, and write information in Customer’s practice management and related systems, directly or through integration providers, as needed to provide the Services. For example, the Services may look up patients, create patient records, and book, move, or cancel appointments. OralAI will tell Customer whether each integration provider works for OralAI (and is covered by Section 7.5 and the BAA) or for Customer under Customer’s own agreement with it. Some integrations require Customer to install software or accept a third party’s terms; those terms are between Customer and that provider. Customer will review new patient records the Services create, which may include placeholder values (such as an email address) where the practice system requires a field the caller could not provide. During setup and troubleshooting, OralAI may create clearly labeled test records and appointments and will remove or mark them when done.

3.4 User accounts. Customer is responsible for its staff’s use of their accounts and for keeping logins secure. Customer will give access only to its authorized staff, remove access for people who leave, and tell OralAI promptly about any suspected unauthorized access.

3.5 Notifications. The Services can send alerts, summaries, and reports by email, text message, or other channels to recipients Customer chooses. Customer chooses the recipients and, where the Services offer settings, the level of detail. Customer confirms that each person it signs up for text alerts has agreed to receive them; recipients can reply STOP to opt out. Email and text messages are not always encrypted end to end, so Customer should use recipients and devices it controls, and it is responsible for securing them.

3.6 Records. Customer’s own systems remain its system of record. Customer is responsible for keeping any records the law requires it to keep, including copies of any information from the Services that it needs.

4. Calls, AI, and Emergencies

4.1 Caller notice. The Services tell callers at the start of each call that they are speaking with an AI assistant, and Customer will not turn that off. The Services also tell callers that the call is recorded, unless Customer chooses to give that notice itself. Customer may choose this only by confirming in writing (email is enough) that its own phone system tells every caller that the call may be recorded before the call reaches the Services, including calls forwarded after hours or when no one answers. Customer is then responsible for that notice, will tell OralAI promptly if its phone setup changes, and agrees that OralAI may test the notice and turn its own notice back on at any time. Customer may otherwise customize its greeting but will not remove or weaken these disclosures without OralAI’s written agreement. The Services are designed not to claim to be a human or a licensed professional (such as a dentist, hygienist, or dental assistant). Customer consents, for itself and its staff, to the recording and transcription of calls the Services handle or transfer. Any other notice Customer’s patients must receive, such as its notice of privacy practices or an AI-use notice required of health care providers, is Customer’s responsibility, and OralAI will suggest wording on request.

4.2 Emergencies. The Services are not an emergency service and do not replace 911, Customer’s staff, or Customer’s on-call procedures. Customer decides what counts as urgent and how those calls are handled (for example, a transfer to an on-call number, a staff alert, or instructions to seek emergency care), and it is responsible for monitoring and responding to alerts. The Services are designed to tell callers who describe a life-threatening emergency to hang up and call 911, and Customer will not turn that off. Customer and OralAI will test emergency handling, transfer numbers, and alert recipients at go-live, and Customer will test them again after it changes them and tell OralAI promptly if alerts stop arriving.

4.3 No clinical advice. The Services do not diagnose, give dental or medical advice, or make clinical decisions. Any urgency screening follows Customer’s instructions and is used only to route calls and alert staff. Customer is responsible for all clinical judgment and patient care.

4.4 AI output. The Services use artificial intelligence, which can mishear callers and produce incomplete, inaccurate, or unexpected results, including in transcripts, summaries, messages, and bookings. Customer is responsible for checking important information (such as appointments, insurance details, and urgent messages) before relying on it. OralAI does not guarantee that every call will be answered or completed, or that every request will be handled correctly.

4.5 Caller verification. Customer decides what callers must confirm before the Services discuss, book, or change a patient’s appointments or records, including when a parent, guardian, or other person calls for a patient. OralAI will set up the Services to follow those rules. Customer is responsible for deciding who may act for a patient and for telling OralAI about restrictions the Services should follow, such as custody limits or confidential-communication requests.

4.6 Service problems. OralAI will tell Customer promptly, by text or phone as well as email, if it learns that the Services have stopped answering Customer’s calls or sending urgent alerts, and again when they are working. If OralAI learns that the Services mishandled any of Customer’s calls in a way that could affect a patient (for example, an urgent call that was not alerted, or an appointment booked, moved, or cancelled in error), it will tell Customer promptly with the details it has.

4.7 Call screening. The Services may screen, limit, or end calls that appear to be spam, abusive, or fraudulent, but they are designed to give Customer’s emergency instructions before ending a call that may involve an emergency.

5. Outreach and Third-Party Contacts

This Section applies only if Customer turns on features that contact people or organizations for it.

5.1 Patient outreach. If Customer uses features that call or text patients or other individuals (for example, confirmations, reminders, or follow-ups), Customer approves who may be contacted (including any rules the Services use to choose whom to contact), the purpose, and the content, and is responsible for having the consents the law requires, including consent to calls and texts that use AI or automated technology. Customer will not use these features for marketing messages unless it has the consent the law requires for them. Outreach calls will say at the start that they are from an AI assistant calling for Customer and, if recorded, that the call is recorded. OralAI will identify Customer as the sender, honor opt-out requests it receives, and apply reasonable limits on calling hours and frequency. Customer will tell OralAI promptly about opt-outs it receives through other channels. Customer authorizes OralAI to register Customer’s messaging brand and campaigns with carriers and messaging registries using Customer’s business information, and Customer will publish (or let OralAI host for it) the privacy and messaging terms carriers require.

5.2 Insurance and other third parties. If Customer uses features that contact insurance payers, clearinghouses, or other third parties (for example, to check eligibility and benefits), Customer authorizes OralAI to contact them for Customer for that purpose, to identify itself as calling for Customer, to use Customer’s identifiers (such as its practice name, NPI, and tax ID) and the minimum patient information needed, and to receive the results for Customer. OralAI’s calls to third parties will say that they are made by an AI assistant for Customer and, where recorded, that the call is recorded. Results come from third parties and may be incomplete or wrong, and Customer is responsible for confirming coverage and benefits where it matters.

6. Fees and Payment

6.1 Fees. Customer will pay the fees in its Order. Unless the Order says otherwise, subscription fees are billed monthly in advance for each location, usage beyond any included minutes is billed monthly in arrears at the Order’s overage rate, and fees are in US dollars. Plans cover calls for Customer’s own practice locations.

6.2 Discounts. Discounts and promotional pricing apply as stated in the Order. A discount described as ongoing lasts for as long as Customer’s subscription stays active without interruption.

6.3 Payment. Invoices are due by the due date on the invoice, or within 15 days if none is stated. If Customer saves a payment method, Customer authorizes OralAI and its payment processor to charge it for fees when due. Customer should raise any billing question within 60 days of the invoice date.

6.4 Late payment. If an invoice is more than 15 days overdue, OralAI may suspend the Services after giving at least 10 days’ written notice.

6.5 Price changes. OralAI may change its prices on at least 30 days’ notice. A change applies from Customer’s next billing period after the notice period ends, and Customer may cancel before the change takes effect.

6.6 Taxes. Fees do not include taxes. Customer will pay any sales, use, or similar taxes on the Services, other than taxes on OralAI’s income.

6.7 Refunds. Fees are non-refundable except where this Agreement says otherwise.

7. Customer Data and Privacy

7.1 Customer Data. “Customer Data” means information that Customer, its staff, or its callers and patients provide to the Services, or that the Services create for Customer, including call audio, transcripts, summaries, messages, and information from Customer’s practice systems. As between the parties, Customer owns Customer Data.

7.2 How OralAI uses Customer Data. OralAI will use Customer Data only to provide, support, maintain, and secure the Services for Customer, to follow Customer’s instructions, to prevent fraud and abuse, and to comply with law. This includes reviewing Customer’s calls to fix problems and improve how the Services handle Customer’s calls. OralAI handles call content only as Customer’s service provider and does not use it for its own purposes, other than as the BAA permits for OralAI’s administration and legal obligations. OralAI does not sell Customer Data or use it for advertising.

7.3 No AI training. OralAI does not use Customer Data, including de-identified call content, to train AI models, and does not allow the AI providers it uses to train their models on Customer Data, unless Customer agrees in writing.

7.4 Aggregated Data. OralAI may collect and use statistics about the use and performance of the Services, such as call volumes, call times, durations, and feature use, to operate, analyze, and improve its services and to publish aggregate insights. These statistics will not identify Customer, any patient, or any caller, and will not include the content of calls or messages (“Aggregated Data”). OralAI owns Aggregated Data.

7.5 Service providers. OralAI uses third-party providers to deliver the Services, such as cloud hosting, telecommunications, speech and AI processing, messaging, and practice-system integrations. OralAI requires providers that handle Customer’s patient information to protect it under written agreements, including business associate agreements where HIPAA requires them, and it remains responsible for their performance of OralAI’s obligations. OralAI will answer reasonable written requests for information about the providers that process Customer’s patient information.

7.6 Location. OralAI stores Customer Data in the United States.

7.7 Security. OralAI maintains reasonable administrative, physical, and technical safeguards designed to protect Customer Data, including encryption of Customer Data at rest and in transit within the Services, access limited to personnel who need it, and training for those personnel. Once a year on request, OralAI will answer a reasonable security questionnaire.

7.8 Patient information (HIPAA). If Customer is a HIPAA covered entity (or a business associate of one), the Business Associate Agreement in Attachment A (the “BAA”) applies to protected health information that OralAI handles for Customer and controls over this Agreement for that information. The BAA takes effect on the Effective Date. If Customer is not a HIPAA covered entity, OralAI will still protect patient information as the BAA describes.

7.9 Canada. If Customer is located in Canada, the Canadian Privacy Addendum in Attachment B applies and controls over this Agreement for Canadian Personal Information (as defined there). OralAI does not currently offer the Services to customers located in Quebec.

7.10 Other privacy laws. Where other privacy laws treat OralAI as Customer’s service provider, processor, or contractor, OralAI will process personal information in Customer Data only to provide the Services, will not sell or share it (as those laws define those terms) or combine it with other data except as those laws allow, and will tell Customer if it can no longer meet these obligations.

7.11 Legal requests. If OralAI receives a subpoena, court order, or government request for Customer Data, OralAI will refer the requester to Customer where possible and will notify Customer before disclosing, unless the law prohibits notice.

7.12 Retention, export, and deletion. OralAI may set reasonable retention periods for call audio and other Customer Data while the Services are active, and it will give Customer at least 30 days’ notice before shortening them. On request, OralAI will preserve specific records Customer identifies (for example, for a patient complaint or claim) until Customer releases them. Customer can request an export of its Customer Data in a common format at any time during its subscription and for 30 days after the Agreement ends, along with a copy of the practice information in its setup (such as hours, providers, policies, and emergency instructions). OralAI will then delete Customer Data within 90 days after the Agreement ends, except for copies in backups (deleted in the normal backup cycle) and data the law requires OralAI to keep, which remain protected by this Agreement and the BAA. When the Agreement ends, OralAI will stop accessing Customer’s practice systems, and Customer should also remove OralAI’s access through its integration providers.

8. Confidentiality

8.1 Definition. “Confidential Information” means non-public information that one party shares with the other that is marked confidential or that a reasonable person would understand to be confidential. OralAI’s Confidential Information includes non-public details about the Services, such as how its AI agents are designed, prompted, and configured, its workflows, and its pricing. Customer’s Confidential Information includes Customer Data.

8.2 Protection. The receiving party will use the other party’s Confidential Information only for this Agreement, protect it with at least reasonable care, and share it only with its personnel, contractors, and advisers who need it and are bound by confidentiality obligations at least as protective as these.

8.3 Exceptions. These obligations do not apply to information that is or becomes public through no fault of the receiving party, that the receiving party already knew or independently developed without using the other party’s information, or that it received from someone else without a duty of confidentiality. These exceptions do not apply to personal information in Customer Data, which stays protected under Section 7 and the BAA. A party may disclose Confidential Information when the law requires, after giving the other party notice where lawful.

9. Ownership and Acceptable Use

9.1 OralAI’s property. OralAI and its licensors own the Services and everything used to provide them, including software, AI agent designs, prompts, templates, workflows, and improvements, even if developed with Customer’s input or feedback. Customer receives a limited, non-exclusive, non-transferable right to use the Services for its own practice during its subscription.

9.2 Customer’s materials. Customer owns its name, logo, website content, and other materials it provides (“Customer Materials”). Customer grants OralAI the right to use Customer Materials and Customer Data as needed to provide the Services.

9.3 Feedback. OralAI may use any suggestions or feedback from Customer without restriction or payment. Any Customer Data in feedback, including details of flagged calls, remains subject to Section 7 and the BAA.

9.4 Acceptable use. Customer will not, and will not let others:

• (a) use the Services to break the law, to deceive or harass anyone, or to infringe anyone’s rights;
• (b) set up the Services to claim to be a human or a licensed professional, or to remove the caller disclosures in Section 4.1 except as that Section allows;
• (c) send calls or texts without the consents the law requires;
• (d) resell or provide the Services to others, or use them to build a competing product;
• (e) reverse engineer the Services, or try to extract their prompts, models, or configurations, except where the law allows this despite this restriction; or
• (f) interfere with the Services’ security or operation, introduce malicious code, or try to access another customer’s data.

9.5 Suspension. OralAI may suspend all or part of the Services if reasonably needed to address a security threat, a breach of Section 9.4, a legal requirement, or overdue payment under Section 6.4. OralAI will limit any suspension to what is reasonably necessary, give notice in advance where practical so Customer can adjust its call forwarding, and restore the Services promptly once the issue is resolved. While the Services are suspended, calls to Customer’s OralAI-provided numbers will get a short message directing callers to Customer.

10. Term and Termination

10.1 Term. This Agreement starts on the date Customer signs or accepts it (the “Effective Date”) and continues until all subscriptions have ended. Subscriptions run month to month and renew automatically each billing period unless the Order sets a different term. A subscription with a fixed term (such as annual) renews for the same length unless either party gives notice at least 30 days before the term ends.

10.2 Cancellation. Customer may cancel a month-to-month subscription, or individual locations, at any time by telling OralAI (email is enough). Cancellation takes effect at the end of the current billing period, and fees already paid are not refunded. OralAI may end a subscription for any reason with at least 30 days’ notice and will refund prepaid fees for any unused period.

10.3 Termination for breach. Either party may terminate this Agreement if the other party materially breaches it and does not cure the breach within 30 days after written notice (10 days for non-payment). If Customer terminates because of OralAI’s breach, OralAI will refund prepaid fees for the unused period.

10.4 Effect of termination. When a subscription ends, Customer’s access to it ends, and Customer will pay any fees owed through the end date. Customer must stop forwarding calls to the Services by the end date, and OralAI will remind Customer before then. For 30 days after the end date, OralAI will answer calls to Customer’s OralAI-provided numbers with a short message directing callers to Customer, without recording or transcribing them, and it will not assign those numbers to another customer for at least 90 days. Otherwise, OralAI is not responsible for calls forwarded after the end date. Section 7.12 then applies to Customer Data. Sections 3.2, 4, 5, 6, 7, 8, 9.1 to 9.3, 10.4, and 11 to 16 survive, along with any other terms that by their nature should survive.

11. Warranties and Disclaimers

11.1 Authority. Each party represents that it has the authority to enter into this Agreement.

11.2 OralAI’s warranty. OralAI will provide the paid Services in a professional manner and in material compliance with the laws that apply to OralAI as their provider. If the paid Services do not perform as this Agreement describes, Customer should tell OralAI. OralAI will make reasonable efforts to fix the problem, and if it cannot do so within 30 days, either party may end the affected subscription, and OralAI will refund prepaid fees for the unused period.

11.3 Disclaimer. Except as expressly stated in this Agreement, the Services are provided “as is” and “as available.” OralAI disclaims all other warranties, express or implied, including warranties of merchantability, fitness for a particular purpose, accuracy, and non-infringement, and any warranty that the Services will be uninterrupted or error-free or will produce any particular result, such as more appointments or revenue. Free trials and early-access features are provided without any warranty. OralAI does not warrant that any single AI output will be accurate, but Section 11.2 applies to the Services as a whole.

12. Indemnities

12.1 By OralAI (intellectual property). OralAI will defend Customer against any third-party claim that the Services, as provided by OralAI, infringe that third party’s intellectual property rights, and will pay the damages and costs finally awarded or agreed in settlement. This does not apply to claims caused by Customer Materials, Customer’s changes, or combinations with things OralAI did not provide. If the Services become or may become subject to such a claim, OralAI may modify them, get the needed rights, or end the affected Services and refund prepaid fees for the unused period.

12.2 By OralAI (patient data). OralAI will defend Customer against any third-party claim arising from a breach of Section 7 or the BAA by OralAI or its service providers, and will pay the damages and costs finally awarded or agreed in settlement.

12.3 By Customer. Customer will defend OralAI against any third-party claim arising from (a) Customer Materials, or OralAI following Customer’s written instructions as given, (b) Customer’s failure to give notices or obtain consents that this Agreement makes Customer’s responsibility, including a recording notice Customer chooses to give itself under Section 4.1 or any change Customer makes to the caller disclosures, (c) Customer’s breach of Section 9.4 or of law, or (d) dental or medical care Customer provides. This does not apply to the extent the claim arises from the Services not handling a call, message, booking, or alert as Customer instructed, or from OralAI’s breach of this Agreement, negligence, or willful misconduct. Customer will pay the damages and costs finally awarded or agreed in settlement.

12.4 Process. The party seeking defense must notify the other party promptly, let it control the defense and settlement, and cooperate reasonably at the defending party’s expense. No settlement may admit fault by, or impose obligations on, the defended party without its consent.

13. Limitation of Liability

13.1 Excluded damages. Neither party is liable for indirect, incidental, special, consequential, exemplary, or punitive damages, or for lost profits, revenue, patients, appointments, goodwill, or data, even if it was told they were possible.

13.2 Cap. Each party’s total liability arising out of or relating to this Agreement, including the BAA and all Orders, is limited to the greater of (a) the fees Customer paid or owed to OralAI in the 12 months before the event giving rise to the liability and (b) US$1,000.

13.3 Data protection cap. For OralAI’s liability arising from its breach of Section 7 or the BAA (including costs under Section 6 of the BAA and claims under Section 12.2), the limit in Section 13.2 is instead the greater of (a) three times the amount in Section 13.2(a) and (b) US$25,000.

13.4 Exceptions. Sections 13.1 to 13.3 do not limit Customer’s obligation to pay fees, a party’s liability for its fraud, gross negligence, or willful misconduct, or any liability that cannot be limited by law.

13.5 Scope. These limits apply to all claims, whether in contract, tort, or otherwise, and are an essential part of the parties’ bargain.

14. Publicity

OralAI may identify Customer by name and logo as an OralAI customer on its website and in sales materials. Customer can opt out at any time by email, and OralAI will stop new uses within 30 days. OralAI will not publish quotes, testimonials, or case studies about Customer without Customer’s permission, and it will never disclose patient information.

15. Changes to This Agreement

15.1 Updates. OralAI may update this Agreement, the BAA, or the Canadian Privacy Addendum by giving Customer at least 30 days’ notice by email or in the Services, with the updated version attached or posted online and a summary of what changed. Updates apply from the date stated in the notice and only going forward; they do not apply to disputes that arose earlier. An update will not reduce OralAI’s privacy and security commitments in Section 7, Section 8, or the BAA unless the law requires it or Customer agrees in writing.

15.2 Customer’s option. If an update materially reduces Customer’s rights, Customer may cancel before it takes effect and receive a refund of prepaid fees for the unused period. Otherwise, continued use of the Services after an update takes effect means Customer accepts it.

15.3 Shorter notice. Updates required by law (including changes to HIPAA or other privacy laws) and updates that do not reduce Customer’s rights (such as terms for new optional features) may take effect on shorter notice.

15.4 Other changes. Any other change to this Agreement requires a written amendment signed by both parties. Electronic signatures count.

16. General

16.1 Governing law and venue. California law governs this Agreement, without regard to its conflict-of-law rules. Any lawsuit under this Agreement must be brought in the state or federal courts where the defendant has its principal office, except that either party may seek urgent injunctive relief in any court with jurisdiction. Before filing a lawsuit (other than for urgent injunctive relief), the parties will try in good faith to resolve the dispute through direct discussion for at least 30 days after written notice.

16.2 Notices. Notices must be in writing and may be sent by email: to OralAI at hello@oralai.com, and to Customer at the admin email in its Order, or to updated addresses either party provides. Notices of breach or termination should say so in the subject line.

16.3 Assignment. Neither party may assign this Agreement without the other’s consent, except that either party may assign it with notice to an affiliate or to a successor in a merger, acquisition, or sale of all or substantially all of its related business or assets.

16.4 Independent contractors. The parties are independent contractors. This Agreement does not create a partnership, joint venture, employment, or agency relationship. Section 5.2 gives OralAI only limited authority to make inquiries for Customer, and the Canadian Privacy Addendum uses “agent” only as Canadian privacy laws define it.

16.5 Force majeure. Neither party is liable for delays or failures caused by events beyond its reasonable control, such as natural disasters, widespread power, internet, or telecommunications outages, or government action. This does not excuse payment obligations.

16.6 Affiliates and locations. If Customer adds locations or practices run by its affiliates, Customer confirms it has authority to bind them. This Agreement, including the BAA, covers each of them, and Customer is responsible for their compliance with it.

16.7 Entire agreement; order of precedence. This Agreement, including each Order, the BAA, and the Canadian Privacy Addendum, is the parties’ entire agreement about the Services. It replaces all earlier agreements, proposals, and understandings about them, including any earlier OralAI trial agreement, terms, or business associate agreement. If documents conflict, this order controls: (1) the BAA for protected health information, and the Canadian Privacy Addendum for Canadian Personal Information; (2) the Order, but only for Customer’s plan, pricing, trial, and locations; and (3) the rest of this Agreement. Terms in Customer’s purchase orders or other forms do not apply.

16.8 Other terms. If any part of this Agreement is unenforceable, it will be enforced to the maximum extent allowed, and the rest stays in effect. Not enforcing a provision is not a waiver. There are no third-party beneficiaries. Electronic signatures and records are valid, and this Agreement may be signed in counterparts. “Including” means “including without limitation.” Headings are for convenience only.

Attachment A: Business Associate Agreement

Part of the OralAI Customer Agreement. Version date: September 28, 2026

This Business Associate Agreement (the “BAA”) is part of the OralAI Customer Agreement (the “Agreement”) between the Customer named in the Order (“Customer”) and Dental Dial Inc., doing business as OralAI (“OralAI”). It applies when Customer is a covered entity under HIPAA, or a business associate of one, and OralAI creates, receives, maintains, or transmits protected health information for Customer in providing the Services. It takes effect on the Effective Date and covers all such information, including any that OralAI received before the Effective Date.

1. Definitions

1.1 “HIPAA” means the Health Insurance Portability and Accountability Act of 1996, the HITECH Act, and their implementing regulations at 45 C.F.R. Parts 160 and 164, as amended.

1.2 “PHI” means protected health information, as defined in HIPAA, that OralAI creates, receives, maintains, or transmits on behalf of Customer.

1.3 Other capitalized terms used in this BAA and not defined in it or in the Agreement (such as Breach, Designated Record Set, Individual, Required by Law, Secretary, Security Incident, Subcontractor, and Unsecured PHI) have the meanings given to them in HIPAA.

1.4 If Customer is a business associate of a covered entity, OralAI is Customer’s subcontractor, and this BAA applies to the PHI that OralAI handles for Customer in that role.

2. Permitted Uses and Disclosures

2.1 Services. OralAI may use and disclose PHI to provide the Services under the Agreement and as Customer instructs, as Required by Law, and as permitted in this Section 2.

2.2 Management and administration. OralAI may use PHI for its proper management and administration and to carry out its legal responsibilities. OralAI may disclose PHI for those purposes if the disclosure is Required by Law, or if OralAI first obtains reasonable assurances from the recipient that it will keep the PHI confidential, use or further disclose it only as Required by Law or for the purpose for which it was disclosed, and notify OralAI of any instance it knows of in which the confidentiality of the PHI has been breached.

2.3 De-identification. OralAI may de-identify PHI in accordance with 45 C.F.R. § 164.514(a) to (c), but only to create the Aggregated Data described in the Agreement.

2.4 Limits. OralAI will not use or disclose PHI in a manner that would violate Subpart E of 45 C.F.R. Part 164 if done by Customer, except as permitted by Section 2.2. OralAI will limit its uses, disclosures, and requests of PHI to the minimum necessary to accomplish the intended purpose. OralAI will not sell PHI, use or disclose it for marketing, or use it to train AI models, except with Customer’s written authorization and as HIPAA permits.

3. OralAI’s Obligations

3.1 Use limits. OralAI will not use or disclose PHI other than as permitted or required by this BAA or as Required by Law.

3.2 Safeguards. OralAI will use appropriate safeguards, and comply with Subpart C of 45 C.F.R. Part 164 with respect to electronic PHI, to prevent use or disclosure of PHI other than as provided for by this BAA.

3.3 Reporting. OralAI will report to Customer (a) any use or disclosure of PHI not provided for by this BAA of which it becomes aware, including any Breach of Unsecured PHI as required by 45 C.F.R. § 164.410, and (b) any Security Incident of which it becomes aware. OralAI will make an initial report without unreasonable delay, and in any event within 72 hours after discovery (determined as described in 45 C.F.R. § 164.410(a)(2)) of an incident that OralAI reasonably believes is a Breach of Unsecured PHI, and within five (5) business days after discovery of any other matter under this Section. OralAI will send reports to Customer’s admin contact by email and phone, supplement them promptly as more information becomes available, and cooperate with Customer’s investigation. For a Breach of Unsecured PHI, the report will include, to the extent available, the identity of each affected Individual and the other information Customer needs to meet its obligations under 45 C.F.R. § 164.404(c). OralAI will not notify affected Individuals, regulators, or the media about Customer’s PHI without Customer’s consent unless the law requires it. Delays requested by law enforcement under 45 C.F.R. § 164.412 are permitted.

3.4 Unsuccessful Security Incidents. The parties agree that this Section is notice of the ongoing existence of unsuccessful Security Incidents, such as pings, port scans, blocked log-in attempts, and denial-of-service attacks that do not result in unauthorized access to, or use, disclosure, modification, or destruction of, PHI. No further notice of them is required.

3.5 Mitigation. OralAI will mitigate, to the extent practicable, any harmful effect known to OralAI of a use or disclosure of PHI by OralAI in violation of this BAA.

3.6 Subcontractors. In accordance with 45 C.F.R. §§ 164.502(e)(1)(ii) and 164.308(b)(2), OralAI will ensure that any Subcontractor that creates, receives, maintains, or transmits PHI on behalf of OralAI agrees in writing to the same restrictions, conditions, and requirements that apply to OralAI with respect to that PHI.

3.7 Access. To the extent OralAI maintains PHI in a Designated Record Set, OralAI will make that PHI available to Customer within ten (10) business days after Customer’s request, so that Customer can meet its obligations under 45 C.F.R. § 164.524. The parties do not expect OralAI to maintain a Designated Record Set; Customer’s practice systems are its system of record.

3.8 Amendment. To the extent OralAI maintains PHI in a Designated Record Set, OralAI will make any amendment to that PHI that Customer directs under 45 C.F.R. § 164.526 within ten (10) business days after Customer’s request.

3.9 Accounting. OralAI will document disclosures of PHI as needed for Customer to respond to a request for an accounting of disclosures under 45 C.F.R. § 164.528, and will provide that information to Customer within ten (10) business days after Customer’s request.

3.10 Requests from Individuals. OralAI will forward to Customer, within five (5) business days, any request it receives directly from an Individual for access, amendment, or an accounting, and will not respond to it except as Customer directs or as Required by Law.

3.11 Customer’s obligations. To the extent OralAI carries out any of Customer’s obligations under Subpart E of 45 C.F.R. Part 164, OralAI will comply with the requirements of Subpart E that apply to Customer in performing that obligation.

3.12 Books and records. OralAI will make its internal practices, books, and records relating to the use and disclosure of PHI available to the Secretary for purposes of determining compliance with HIPAA.

3.13 Workforce. OralAI will ensure that its personnel who access PHI are trained on, and bound by, appropriate confidentiality obligations.

3.14 Location. OralAI will store PHI in the United States.

4. Customer’s Obligations

Customer will:

4.1 Notify OralAI of any limitation in its notice of privacy practices, any change in or revocation of an Individual’s permission to use or disclose PHI, and any restriction on the use or disclosure of PHI that Customer has agreed to under 45 C.F.R. § 164.522, to the extent it may affect OralAI’s use or disclosure of PHI.

4.2 Not ask OralAI to use or disclose PHI in any manner that would not be permissible under HIPAA if done by Customer, except as permitted by Section 2.2.

4.3 Provide PHI to OralAI only through the Services or other secure methods OralAI approves, and only as much as the Services need.

4.4 Obtain any patient consent or authorization the law requires for what Customer asks OralAI to do (for example, consent to marketing messages).

5. Term and Termination

5.1 Term. This BAA remains in effect for as long as the Agreement is in effect, and afterward until OralAI has returned or destroyed all PHI under Section 5.3.

5.2 Termination for breach. If either party determines that the other has violated a material term of this BAA, it may give written notice. If the violation is not cured within 30 days after the notice, the notifying party may terminate this BAA and the Agreement.

5.3 Return or destruction. When the Agreement ends, OralAI will return PHI (by making it available for export under Section 7.12 of the Agreement) or destroy it, in any form, keep no copies, and ensure its Subcontractors do the same. OralAI will complete this within 90 days after the Agreement ends. Where return or destruction by OralAI or its Subcontractors is not feasible (for example, PHI in backups until they are overwritten in the ordinary course, or PHI subject to a legal hold), OralAI will extend the protections of this BAA to that PHI and limit further uses and disclosures to the purposes that make return or destruction infeasible, for as long as OralAI maintains it. OralAI will confirm destruction in writing on request.

6. Breach Costs

If a Breach of Unsecured PHI results from a breach of this BAA by OralAI or its Subcontractor, OralAI will reimburse Customer’s reasonable, documented, out-of-pocket costs of (a) the notifications the law requires, (b) a reasonable call center for affected Individuals, and (c) identity-protection services where the law requires them. The parties agree that these costs are direct damages. They are subject to the limit in Section 13.3 of the Agreement.

7. General

7.1 Independent contractor. OralAI is an independent contractor and is not Customer’s agent. OralAI controls the manner and means by which it provides the Services. Customer’s settings and instructions define what the Services do, not how OralAI performs its work.

7.2 Changes in law. The parties will amend this BAA as needed to comply with changes to HIPAA or other applicable law, and OralAI may update it for that purpose under Section 15 of the Agreement.

7.3 State law. OralAI will comply with state medical privacy laws to the extent they apply to OralAI in its role as Customer’s service provider, including the California Confidentiality of Medical Information Act. Customer authorizes OralAI to receive medical information to provide administrative services to Customer, and OralAI will not further disclose it except as this BAA permits or the law requires.

7.4 Interpretation. Any ambiguity in this BAA will be resolved to permit compliance with HIPAA. A reference to a section of HIPAA means that section as amended.

7.5 Relationship to the Agreement. This BAA is part of the Agreement. If they conflict about PHI, this BAA controls. The limitations of liability in the Agreement apply to this BAA. This BAA replaces any earlier business associate agreement between the parties.

7.6 Survival; no third-party beneficiaries. Sections 5.3, 6, and 7 survive termination. Nothing in this BAA gives any rights to anyone other than the parties.

Attachment B: Canadian Privacy Addendum

Part of the OralAI Customer Agreement. Version date: September 28, 2026

This Canadian Privacy Addendum (the “Addendum”) is part of the OralAI Customer Agreement (the “Agreement”). It applies if Customer is located in Canada, to personal information, including personal health information, about individuals that OralAI handles for Customer through the Services (“Canadian Personal Information”). It controls over the Agreement for Canadian Personal Information. “Canadian Privacy Laws” means the federal Personal Information Protection and Electronic Documents Act and the provincial privacy and health information laws that apply to Customer, such as Ontario’s Personal Health Information Protection Act, 2004, Alberta’s Health Information Act, and the Personal Information Protection Acts of Alberta and British Columbia.

1. Roles. Customer controls Canadian Personal Information and is responsible for it under Canadian Privacy Laws, including as a health information custodian or custodian where those laws apply. OralAI handles Canadian Personal Information only for Customer, as its service provider and, where applicable, as its agent under Ontario’s Personal Health Information Protection Act, 2004 and its information manager under Alberta’s Health Information Act. OralAI acts only on Customer’s instructions, as set out in the Agreement and in Customer’s settings.

2. Purpose. OralAI will collect, use, and disclose Canadian Personal Information only to provide the Services to Customer (answering and handling Customer’s calls, scheduling, taking messages, sending notifications, and related support) and as required by law. OralAI will not use Canadian Personal Information for its own purposes, sell it, use it for marketing, use it to train AI models, or create de-identified data from it, and it will not try to re-identify any individual. OralAI may use service data that does not identify individuals, such as call counts and durations, to operate, bill for, and support the Services.

3. Safeguards. OralAI will protect Canadian Personal Information with security safeguards appropriate to the sensitivity of health information, including confidentiality commitments and privacy training for personnel who access it, access limited to personnel who need it, encryption at rest and in transit within the Services, and secure disposal. OralAI’s privacy contact can be reached at hello@oralai.com.

4. Location and foreign access. OralAI stores Canadian Personal Information in the United States, and OralAI and its service providers may process it outside Canada. Wherever it is stored or processed, it may be accessible to the courts, law enforcement, and national security authorities of that country under its laws. Unless the law prohibits it, OralAI will notify Customer of any legal demand for Canadian Personal Information and will disclose only what it is legally required to disclose. Customer will tell its patients, in its privacy notices, that their information may be processed outside Canada by service providers, and OralAI can supply suggested wording.

5. Service providers. OralAI may use service providers to handle Canadian Personal Information under written agreements that require protections at least equivalent to this Addendum, and OralAI remains responsible for them. On request, OralAI will provide information about them. OralAI will give Customer notice of any material change in how or where Canadian Personal Information is handled. If Customer reasonably objects, it may terminate the Agreement and receive a refund of prepaid fees for the unused period.

6. Privacy incidents. OralAI will notify Customer without undue delay after becoming aware of any theft or loss of, or unauthorized access to or collection, use, disclosure, copying, modification, or disposal of, Canadian Personal Information (a “Privacy Incident”), and in any case within any time required by Canadian Privacy Laws, including at the first reasonable opportunity under Ontario’s Personal Health Information Protection Act, 2004 and as soon as practicable under Alberta’s Health Information Act. OralAI will give Customer the information it reasonably needs to assess the incident, meet its notification and record-keeping obligations, and reduce harm. OralAI will take reasonable steps to contain the incident and will not notify individuals or regulators about it on Customer’s behalf without Customer’s consent, unless the law requires it.

7. Individuals’ requests and wishes. OralAI will promptly forward to Customer any request it receives from an individual to access or correct their information, and any complaint about how it is handled, and will help Customer respond. Customer will tell OralAI about any expressed wishes of an individual that affect how OralAI handles their information, and OralAI will follow them to the extent the Services allow.

8. Retention, return, and destruction. OralAI will keep Canadian Personal Information only as long as needed to provide the Services, and will delete it sooner when Customer asks, to the extent the Services allow. When the Agreement ends, OralAI will return or destroy Canadian Personal Information as described in Section 7.12 of the Agreement and will confirm destruction in writing on request.

9. Assurance. On reasonable request, and not more than once a year unless there has been a Privacy Incident, OralAI will provide written information about its privacy and security practices and answer reasonable questionnaires. OralAI will also give Customer a plain-language description of the Services’ functions and safeguards that Customer can use for a privacy impact assessment.

10. Customer’s responsibilities. Customer will:

• (a) give patients and callers the notices Canadian Privacy Laws require, including that calls are answered by an AI assistant, are recorded and transcribed, and may be processed outside Canada;
• (b) obtain the consents that apply to any outbound calls or messages, including under Canada’s Anti-Spam Legislation, the CRTC Unsolicited Telecommunications Rules, and health privacy rules on marketing;
• (c) complete any privacy impact assessment or filing the law requires of Customer before using the Services, such as a privacy impact assessment under Alberta’s Health Information Act; and
• (d) make any notifications to individuals and regulators that Canadian Privacy Laws require of Customer.

11. Alberta. Where Alberta’s Health Information Act applies, OralAI will comply with that Act and its regulations as Customer’s information manager, and this Addendum and the Agreement are the written agreement required by section 66 of that Act and section 7.2 of the Health Information Regulation, and the agreement for storage and use outside Alberta under section 8(4) of that Regulation. Under them: the objective is to provide the Services to Customer; OralAI may collect, use, and disclose health information only as described in Section 2; requests for access and correction are handled under Section 7; health information is protected, returned, and destroyed under Sections 3 and 8; expressed wishes are handled under Section 7; Customer remains in control of the information and may monitor compliance under Section 9; and the arrangement may be terminated under Section 10 of the Agreement, with the remedies available under the Agreement.

12. Quebec. The Services are not offered to customers located in Quebec. Customer confirms that it is not located in Quebec and will not use the Services for a location in Quebec without OralAI’s written agreement.

13. Changes in law. OralAI may update this Addendum to reflect changes in Canadian Privacy Laws under Section 15 of the Agreement. If Customer reasonably objects to an update, it may terminate the Agreement and receive a refund of prepaid fees for any unused period.