Acceptable use policy

1 Purpose

• This policy sets out the rules governing acceptable use of the Lumina Service.
• All Authorised Users must comply with this policy.
• The Customer is responsible for ensuring all its Authorised Users are aware of and comply with this policy.

2 Permitted Use

The Service is provided exclusively for dental practice management purposes. Permitted uses include:

• Managing patient records
• Scheduling appointments
• Processing payments
• Clinical workflow management
• Practice administration and analytics
• Communicating with patients through the Service
• Using AI-assisted features for practice-related tasks

The Service must only be used by dental professionals, their authorised staff, and patients accessing the Patient Portal.

3 Prohibited Conduct

The Customer and its Authorised Users must not engage in any of the following:

a) Unlawful Use

• Use the Service for any purpose that violates applicable law or regulation.
• Process data without a valid lawful basis under UK GDPR.
• Store or process data relating to individuals without appropriate authority.

b) Data Misuse

• Upload, store, or process data that is not related to dental practice management, practice operations, billing, or compliance.
• Attempt to access or view data belonging to other organisations or users.
• Circumvent or disable any access control or security features.
• Export data for purposes other than legitimate dental practice operations, except where required to fulfil a patient data subject request, comply with regulatory obligations, or maintain backups in accordance with the Terms of Service.

c) Security Violations

• Attempt to probe, scan, or test the vulnerability of the Service without written authorisation.
• Interfere with or disrupt the integrity or performance of the Service.
• Attempt to gain unauthorised access to the Service, other accounts, systems, or networks.
• Upload or transmit viruses, malware, or any other malicious code.
• Use automated tools (bots, scrapers, crawlers) to access the Service except through published APIs.
• Share account credentials between individuals.
• If you discover a security vulnerability, report it responsibly to security@luminadental.co.uk . Do not publicly disclose or exploit any vulnerability before Lumina has had a reasonable opportunity to address it.

d) Intellectual Property

• Copy, modify, or create derivative works based on the Service.
• Reverse engineer, decompile, or disassemble any aspect of the Service.
• Remove or alter any proprietary notices, labels, or marks.

e) Commercial Misuse

• Sublicense, resell, rent, lease, or lend access to the Service to any third party.
• Use the Service to develop a competing product or service.
• Use the Service for benchmarking purposes without Lumina's written consent.

f) Practice and Surgery Misrepresentation

The Service must be configured to accurately reflect the Customer's real-world dental practice operations. The following are expressly prohibited:

• Configuring multiple physical practice locations as a single Practice within the Service in order to avoid multi-practice subscription fees.
• Creating Surgeries (treatment rooms) within the Service that do not correspond to real, physical treatment rooms at the associated Practice premises.
• Assigning Surgeries to a Practice when those treatment rooms are physically located at a different premises.
• Using Surgeries as a workaround or substitute for configuring separate Practices where the Customer operates from multiple physical locations.
• Any other configuration of the Service that is designed to circumvent subscription tier limits, usage limits, or pricing structures.

For full details, see Section 4.5 of the Terms of Service . Violation of this section may be treated as a material breach.

g) AI Feature Misuse

• Use AI features for purposes other than dental practice management.
• Attempt to extract or reverse-engineer AI models or training data.
• Input deliberately misleading data to manipulate AI outputs.
• Rely on AI-generated content without appropriate professional review.

4 Account Security Obligations

• Sign-in is passwordless by default. Every sign-in requires a one-time code sent to the Authorised User's verified email address or mobile number, so Authorised Users must keep those channels secure and under their sole control.
• Authorised Users must complete passkey or authenticator-app multi-factor authentication setup where their organisation has enabled or required it.
• One-time codes must not be forwarded or shared, and passkeys must not be registered on a device that other people can unlock.
• Account credentials must not be shared between individuals.
• The Customer must promptly disable access for personnel who leave or change role.
• Any suspected security incident must be reported to security@luminadental.co.uk immediately.

5 Enforcement

Lumina may monitor and review usage and security logs to detect violations of this policy, in accordance with our Privacy Policy . Upon discovering a violation, Lumina may, at its discretion:

• Issue a warning
• Suspend the offending user's access
• Suspend the Customer's account
• Terminate the agreement in accordance with the Terms of Service

Lumina will notify the Customer of any enforcement action taken, except where doing so would compromise security or a legal investigation.

Nothing in this policy limits Lumina's right to take any action required by law.

6 Reporting Violations

If you become aware of any violation of this policy, please report it to:

• operations@luminadental.co.uk
• security@luminadental.co.uk (for security-related violations)

7 Changes to This Policy

Lumina may update this Acceptable Use Policy from time to time. Material changes will be communicated with at least 30 days' notice. Continued use of the Service after changes take effect constitutes acceptance.