Terms of service

1 Definitions

In these Terms, the following definitions apply unless the context requires otherwise:

• "Acceptable Use Policy" means Lumina's acceptable use policy at luminadental.co.uk/acceptable-use , as updated from time to time in accordance with Section 18.
• "Acceptance" means the acceptance of a Terms Release on behalf of the Customer through the stages described in Section 1A.1.
• "Acceptance Record" means the records Lumina retains of an Acceptance, as described in Section 1A.7.
• "Active Patient" has the meaning given in Schedule 1.
• "AI Usage Policy" means Lumina's AI usage policy at luminadental.co.uk/ai-policy , as updated from time to time in accordance with Section 18.
• "Authorised Officer" means an owner, partner, director or other officer of the Customer who is authorised to enter into contracts on the Customer's behalf.
• "Authorised Users" means individuals whom the Customer authorises to access and use the Service under the Customer's subscription.
• "Business Hours" means 08:00 to 18:00 UK time, Monday to Friday, excluding English public holidays. This definition applies throughout these Terms and the SLA.
• "Clinician" has the meaning given in Schedule 1.
• "Confidential Information" means any information disclosed by either party to the other that is marked as confidential or that a reasonable person would understand to be confidential given the nature of the information and the circumstances of disclosure.
• "Contract Year" means each successive period of 12 months beginning on the Effective Date and on each anniversary of the Effective Date.
• "Customer Data" means all data, including Personal Data, that is uploaded, submitted, stored, or transmitted by the Customer or its Authorised Users through the Service.
• "Data and Security Claims" has the meaning given in Section 12.3.
• "Data Processing Agreement" or "DPA" means the data processing agreement between Lumina and the Customer, available at luminadental.co.uk/dpa , which forms part of these Terms.
• "Documentation" means the user guides, help articles, in-product guidance and technical descriptions of the Service that Lumina makes generally available to customers, as current at the relevant time.
• "Effective Date" means the date on which Lumina records the Customer's registration under stage 1 of Section 1A.1. Where Section 1A.6 applies, it means the date of first access to the Service.
• "Enhanced Cap" has the meaning given in Section 12.3A.
• "Extra Usage" has the meaning given in Section 6.4.
• "Insolvency Event" means, in relation to a party, that party being unable to pay its debts within the meaning of section 123 of the Insolvency Act 1986 (including on the grounds that the value of that party's assets is less than its liabilities, taking into account contingent and prospective liabilities), or that party entering into administration, receivership, a company voluntary arrangement, or any analogous procedure in any jurisdiction, or the making of a winding-up order or a resolution for that party's winding up, in each case other than for the purpose of a solvent amalgamation or reconstruction.
• "Live Mode" has the meaning given in Section 1A.8.
• "New Patient" has the meaning given in Schedule 1.
• "Personal Data", "Data Controller", "Data Processor", "Personal Data Breach" and "Processing" have the meanings given to them in the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
• "Plan Limits" means the usage limits that apply to the Customer's plan, as set out in Schedule 1 for the Starter Practice plan and in the Service Confirmation or the applicable schedule for any other plan.
• "Practice" means a single, distinct physical dental practice location operated by the Customer at a specific postal address from which dental services are provided to patients. For the avoidance of doubt, each separate physical premises at which dental care is delivered constitutes a separate Practice, regardless of whether such premises are operated under the same business name, legal entity, or ownership.
• "Practice Configuration" means the configuration of Practices and Surgeries within the Service as set up by the Customer, including the number of Practices, the number of Surgeries assigned to each Practice, and the association between Surgeries and their respective Practice.
• "Read-Only Period" has the meaning given in Section 15.1.
• "Sandbox Mode" has the meaning given in Section 1A.8.
• "Service" means the Lumina cloud-based dental practice management platform, including the Lumina Core, Lumina Admin, and Lumina Patient Portal applications, together with any associated APIs, Documentation, and support services.
• "Service Confirmation" means the customer-specific document issued by Lumina and accepted by the Customer that records the Customer's legal identity (including, where different, the identity of the Controller), the Customer's notice address, the Customer's plan and Plan Limits, the Terms Release accepted, the Customer's Practice Configuration (its Practices and Surgeries), the Customer's data protection contact, and any special terms agreed in writing. The Service Confirmation forms part of this agreement.
• "SLA" means Lumina's service level agreement at luminadental.co.uk/sla , as updated from time to time in accordance with Section 18.
• "Starter Limits" means the Plan Limits for the Starter Practice plan, set out in Schedule 1.
• "Sub-processor Schedule" means the list of Lumina's sub-processors at luminadental.co.uk/subprocessors , as updated from time to time in accordance with the DPA.
• "Subscription Fee" means the fees payable by the Customer for access to the Service as set out in the Service Confirmation or, where the Service Confirmation refers to a published plan, in that plan.
• "Subscription Term" means the initial subscription period and any subsequent renewal periods.
• "Surgery" (also referred to as a "treatment room" or "operatory") means a single, physically distinct room or clinical area within a Practice that is equipped and used for the examination or treatment of patients. Each Surgery configured within the Service must correspond to a real, physical treatment room that exists at the associated Practice premises.
• "Team User" has the meaning given in Schedule 1.
• "Terms Release" means a numbered, dated version of these Terms together with the versions of the documents listed in Section 1A.4 that were published with it. Each Terms Release carries a release identifier and a content hash.

1A Agreement Structure, Acceptance and Order of Precedence

1A.1 How this agreement is formed

This agreement is formed in three stages. It is formed when the Customer registers. It is confirmed and signed in the Service before the Customer uses the Service. It is completed by a Service Confirmation before the Customer goes live.

Stage 1. Registration. On the sign-up form on Lumina's website, the person registering gives their name, their email address and the name of their practice, and ticks the following box, which is presented unticked and which must be ticked before the account can be created:

The Terms of Service linked from that box are the Terms Release current at the time. This agreement is formed on that Terms Release when Lumina records the registration, and Lumina creates the Customer's organisation in Sandbox Mode. The sign-up form also links the other documents listed in Section 1A.4, together with the Privacy Policy and the Cookie Policy, neither of which is part of this agreement.

Stage 2. Acceptance in the Service. Before the Customer uses the Service, an Authorised Officer signs in to Lumina Admin and completes an acceptance step. Each of the documents listed in Section 1A.4 is linked in that step and can be read there. The Authorised Officer ticks each of the following boxes, which are presented unticked and which are required:

The Authorised Officer then types their full legal name in the signature block, which displays the statement: "Typing your name here acts as your electronic signature." This stage confirms and signs the agreement formed at stage 1. It does not create a second agreement.

Stage 3. The Service Confirmation, and going live. Before the Customer enters, imports or otherwise processes real patient data, an Authorised Officer completes the Service Confirmation, which records the matters listed in Section 1A.3, including the Customer's legal entity and the identity of the Data Controller where that is not the Customer. The Authorised Officer ticks each of the following boxes, which are presented unticked and which are required:

The Authorised Officer then types their full legal name and their role or job title in the signature block, which displays the statement: "Typing your name here acts as your electronic signature." Live Mode begins when Lumina has enabled it for the Customer's organisation. Section 1A.8 governs the two modes.

The Service Confirmation is not a precondition to this agreement existing. The agreement is formed at stage 1 and is signed at stage 2. What the Service Confirmation does is fix the Customer's legal entity, the identity of the Data Controller and the customer-specific terms, and unlock Live Mode.

Lumina records each stage as set out in Section 1A.7. Lumina will send the person registering a confirmation email, will give the accepting Authorised Officer a copy of the accepted Terms Release at stage 2, and will give the Customer a copy of its Service Confirmation at stage 3.

Where an existing Customer is asked to accept a new Terms Release under Section 18.3, it does so through the acceptance step described at stage 2. Registration is not repeated.

1A.2 Authority

The person who registers the Customer at stage 1 of Section 1A.1 warrants to Lumina that they are authorised to enter into this agreement on the Customer's behalf. The individual who completes stage 2 or stage 3 warrants to Lumina that they are an Authorised Officer of the Customer and are authorised to bind the Customer. The Customer is bound by an acceptance made at any of those stages by a person who holds themselves out as having that authority, to the extent permitted by law. This Section does not by itself confer authority on any person.

1A.2A Business use, and that the Customer is not a consumer

The Customer enters into this agreement for the purposes of its business, trade or profession, and not as a consumer. The Customer acknowledges and agrees that:

• 1. it is not a consumer for the purposes of the Consumer Rights Act 2015 or of any other consumer protection legislation;
• 2. legislation that applies only to consumers, including the Consumer Rights Act 2015, does not apply to this agreement; and
• 3. Lumina supplies the Service, and sets its prices and the liability limits in Section 12, in reliance on this acknowledgement.

This Section sits alongside the authority confirmation in Section 1A.2 and the eligibility statement in Section 3.1. It does not exclude any right that cannot be excluded by agreement.

1A.3 The Service Confirmation

The Service Confirmation is the customer-specific layer of this agreement. It records the Customer's legal entity name and, where the Customer is a company or LLP, its registered number and registered office; where the Customer is not itself the Data Controller, it also records the Controller's identity. It records the plan, the Plan Limits, the Terms Release accepted, the Practices and Surgeries covered, the notice address, the Customer's data protection contact, and any special terms agreed in writing. Where the Service Confirmation and these Terms differ, the Service Confirmation applies to the extent of the difference, subject to Section 1A.5.

The Customer completes its Service Confirmation as described at stage 3 of Section 1A.1, and Live Mode begins when Lumina has enabled it, as set out in Section 1A.8.

Lumina will issue a revised Service Confirmation when the Customer's plan, Practices, Surgeries or Plan Limits change. A revised Service Confirmation takes effect when the Customer accepts it.

1A.4 Documents that form this agreement

This agreement consists of:

• 1. the Service Confirmation;
• 2. these Terms, including Schedule 1 (Plan Limits) and Schedule 2;
• 3. the Data Processing Agreement;
• 4. the Acceptable Use Policy;
• 5. the AI Usage Policy;
• 6. the Service Level Agreement;
• 7. the Sub-processor Schedule, which is incorporated into the DPA.

Until the Customer completes its Service Confirmation, this agreement consists of the documents listed at 2 to 7 above, and the Customer is identified by the details it gave on registration, as set out in Section 1A.8.

The Privacy Policy is not part of this agreement. It is a transparency notice describing the Personal Data for which Lumina acts as a Data Controller in its own right. It is provided for information and creates no contractual obligation on either party. Nothing in this Section limits Lumina's obligations under data protection law.

1A.5 Order of precedence

If there is a conflict or inconsistency between the documents listed in Section 1A.4, the following order applies, with the higher-ranked document prevailing to the extent of the conflict:

• 1. the Service Confirmation;
• 2. the DPA, in respect of data protection matters only;
• 3. these Terms;
• 4. the Acceptable Use Policy, the AI Usage Policy, the SLA and the Sub-processor Schedule.

Three consequences of this order are stated expressly, to remove doubt:

• Suspension and termination. The grounds on which Lumina may suspend or terminate the Customer's access are those set out in Section 14 of these Terms. Any wider power expressed in the Acceptable Use Policy is subject to Section 14 and does not extend those grounds.
• Data protection floor. Nothing in the Service Confirmation or these Terms reduces the obligations that Article 28 of the UK GDPR requires a processor contract to contain. If the Service Confirmation would have that effect, the DPA prevails on that point.
• Sub-processor Schedule. The Sub-processor Schedule is incorporated into the DPA (Section 1A.4.7 and DPA Section 7.2). A conflict about who Lumina's Sub-processors are, what each processes, or where, is resolved at rank 2 above, under the DPA, and not at rank 4.

1A.6 Access without a recorded Acceptance (fallback)

Where the Customer or its Authorised Users access the Service and Lumina holds no Acceptance Record for the Customer, that access is on the basis of the Terms Release current at the time of access. Lumina will invite the Customer to complete the acceptance stages in Section 1A.1 as soon as reasonably practicable.

This Section is a fallback. It exists so that use of the Service is never unregulated. It is not the intended route to formation, and it is not evidence of the terms of any earlier arrangement between the parties. Where Lumina has not retained evidence of an earlier acceptance, the Acceptance recorded under Section 1A.1 is the acceptance on which Lumina relies from the Effective Date onwards.

1A.7 Electronic acceptance and records

The parties agree that acceptance by the electronic means described in Section 1A.1 is valid and binding, and that a typed name is a signature. Lumina keeps an append-only record of each stage. Together those records are the Customer's Acceptance Record.

• 1. Registration. The release identifier and content hash of the Terms Release then current, the name, email address and practice name given on the sign-up form, a timestamp, and the IP address and browser user agent from which the registration was made.
• 2. Acceptance in the Service. The release identifier and content hash of the Terms Release presented, the exact wording of each box and of the signature statement shown, the typed name, the identity of the authenticated user account, a timestamp, and the network and device information captured at the time.
• 3. The Service Confirmation. The Service Confirmation as accepted, the exact wording of each box and of the signature statement shown, the typed name and role, the identity of the authenticated user account, a timestamp, and the network and device information captured at the time.

The wording of the box shown at registration is set out at stage 1 of Section 1A.1. The wording shown at stages 2 and 3 is recorded verbatim.

Lumina retains Acceptance Records for at least seven years after the end of this agreement and will provide the Customer with a copy on request.

The Customer agrees that Acceptance Records may be adduced as evidence of the terms accepted and of the fact and time of acceptance.

1A.8 Sandbox Mode and Live Mode

The Customer's organisation operates in one of two modes. Every organisation starts in Sandbox Mode.

• Sandbox Mode. When the Customer accepts a Terms Release on registration, Lumina creates the Customer's organisation in Sandbox Mode. Sandbox Mode is for exploring, configuring and trying out the Service. Before using the Service, the Customer completes the acceptance step at stage 2 of Section 1A.1. No Service Confirmation is required to use the Service in Sandbox Mode.
• Live Mode. Live Mode applies once the Customer has completed a Service Confirmation and Lumina has enabled Live Mode for the Customer's organisation. The Service Confirmation records the Customer's legal entity, the identity of the Data Controller where that is not the Customer, and the electronic signature of an Authorised Officer, as set out in Sections 1A.1 and 1A.3.

Real patient data. The Customer must not use Sandbox Mode to process the Personal Data of real patients. Before the Customer enters, imports or otherwise processes real patient data in the Service, the Customer must complete its Service Confirmation and its organisation must be in Live Mode.

Telling Lumina. Lumina does not know when the Customer is ready to treat real patients. It is for the Customer to tell Lumina, and to complete its Service Confirmation, before that happens. Lumina will issue the Service Confirmation and enable Live Mode without undue delay once the Customer asks. Lumina may contact the Customer about going live.

The DPA applies in both modes. The DPA applies to all Customer Data that the Customer or its Authorised Users put into the Service, in Sandbox Mode and in Live Mode alike. Lumina is the processor of that Customer Data from the moment it is first processed, in either mode, and whether or not a Service Confirmation has been issued. This Section places an obligation on the Customer about what it puts into Sandbox Mode. It does not postpone the start of the DPA, and where Customer Data containing real patient data is processed in Sandbox Mode, Lumina's obligations as processor apply to it in full. The data protection floor in Section 1A.5 applies to this Section.

Who Lumina is contracting with in Sandbox Mode. In Sandbox Mode the Customer has not yet identified its legal entity or its Data Controller to Lumina. Until it does, Lumina's record of who the Customer is consists of the details the Customer gave on registration, held in the Acceptance Record. Those details identify the Customer for the purposes of this agreement until a Service Confirmation records otherwise. The Customer is responsible for the accuracy of those details under Section 3.2.

What differs between the modes. Some features and limits may differ in Sandbox Mode. Where they do, Lumina will make the difference clear in the Service or the Documentation.

2 The Service

2.1 Service Description

Lumina provides a cloud-based software platform designed for dental practice management, on a software-as-a-service (SaaS) basis. Depending on the Customer's plan, the Service includes:

• Patient records management and clinical workflows
• Appointment scheduling and booking
• Billing, invoicing, and payment processing
• Practice administration and analytics
• A patient-facing portal for appointment management and records access
• Optional AI-assisted features (see Section 6)

2.2 Not a Medical Device, and What Lumina Remains Responsible For

The Service is a practice management and administrative tool. It is not a medical device, clinical decision support system, or diagnostic tool. The Service does not provide clinical advice, and no output of the Service (including any AI-generated content) should be treated as a substitute for the professional judgment of a qualified dental practitioner. All clinical decisions remain the sole responsibility of the Customer and its qualified clinicians.

Lumina remains responsible for the Service performing materially as described in these Terms and the Documentation. Defects in the Service, failures to record, retain, display or transmit information accurately, failures of access control, and security failures are Lumina's responsibility, subject to Section 12. This Section allocates clinical judgement to the Customer. It does not transfer to the Customer the consequences of the Service not working as described.

2.3 Infrastructure and Where Customer Data Is Held

Customer Data is hosted and stored in Amazon Web Services (AWS) in the United Kingdom (AWS London region). The Service operates across multiple availability zones for resilience.

Limited processing by named sub-processors, for example payment processing by Stripe, may occur outside the United Kingdom. Where that happens, an appropriate transfer safeguard under Article 46 of the UK GDPR applies. The sub-processors, the categories of data each processes and the location of each are listed on the Sub-processor Schedule, and the transfer safeguards are described in the DPA.

Further details of our security practices are available at luminadental.co.uk/security .

3 Account Registration and Security

3.1 Eligibility and Business Use

The Service is intended for use by UK dental practices, dental professionals, and their authorised staff. It is supplied for business purposes only and is not supplied to consumers. Where the Customer is an individual, such as a sole practitioner, the Customer confirms that it is contracting for the purposes of its business, trade or profession. Section 1A.2A sets out the Customer's acknowledgement that it is not a consumer and that consumer protection legislation does not apply to this agreement.

By registering for the Service, the individual registering represents and warrants that they are authorised to enter into this agreement on behalf of the Customer, as set out in Section 1A.2.

3.2 Account Information

The Customer agrees to provide accurate, current, and complete information during registration and in its Service Confirmation, and to keep that information accurate, current, and complete. Lumina may suspend or terminate accounts where registration information is found to be materially inaccurate, in accordance with Section 14.

3.3 Account Security

The Customer is responsible for maintaining the confidentiality of all account credentials associated with its subscription. The Customer must:

• use the authentication method the Service provides and not circumvent or share it
• keep account credentials and one-time sign-in codes confidential, and not share an account between individuals
• enable and enforce, for its own users, the additional authentication factors the Service makes available, including passkeys and authenticator-app multi-factor authentication, where the Customer's own policy or risk assessment requires it
• promptly revoke access for personnel who are no longer authorised
• notify Lumina immediately at security@luminadental.co.uk on becoming aware of any unauthorised access or security incident affecting the Service

Lumina provides a managed authentication service for the Service. Sign-in is passwordless by default. Every sign-in requires a one-time code sent to the Authorised User's verified email address or mobile number, so access always depends on control of a verified channel rather than a stored password. Passkeys and authenticator-app multi-factor authentication are supported and recommended, and the Customer may require additional factors for its staff using the organisation-level controls in the Service. Lumina does not mandate one particular additional factor for every account across the platform. Where the Customer needs a stronger authentication posture than the Service currently enforces, the Customer should raise it with Lumina before relying on the Service for that purpose.

The Customer is responsible for activity conducted through its accounts, except where that activity results from a failure of Lumina's security controls, a defect in the Service, or a breach by Lumina of this agreement.

4 Subscription, Plan Limits and Fees

4.1 Plans

The Service is offered on several plans (Starter Practice, Growing Practice and Enterprise), each with a different feature set, Plan Limits and price. The plan that applies to the Customer is stated in its Service Confirmation.

The Starter Practice plan is provided free of charge. No Subscription Fee is payable for it, and no payment card is required. It is subject to the Starter Limits in Schedule 1. Lumina may change or withdraw a plan only in accordance with Section 18, and may terminate for convenience only in accordance with Section 14.2.

4.2 Billing

Where a Subscription Fee is payable, it is billed in advance on a monthly or annual basis, as selected by the Customer and recorded in the Service Confirmation. All fees are quoted in pounds sterling and are exclusive of VAT, which is added where applicable at the prevailing rate. Payment is processed by Stripe, Lumina's payment processor. The Customer is responsible for maintaining valid payment information.

4.3 Renewal and Fee Changes

Subscriptions renew automatically at the end of each billing period unless the Customer cancels before the renewal date. Lumina will give at least 30 days' written notice of any change to Subscription Fees. A fee change takes effect at the start of the next renewal period and never during a period already paid for. A fee change is a material change for the purposes of Section 18, and the Customer may terminate instead of accepting it.

4.4 Refunds, and What Cancelling Does

Subscription Fees are non-refundable except:

• where a refund is required by law;
• where the Customer rejects a material or major change under Section 18, in which case Lumina will refund the Subscription Fee for the unexpired part of the current period on a pro rata basis;
• where Section 13.2 requires a refund.

To be clear about what cancellation does. Cancelling stops the subscription renewing. It does not shorten the period the Customer has already paid for, and it does not produce a refund of that period. If the Customer is on an annual period and cancels part-way through it, access to the Service continues until the end of that annual period and no refund is due for the remainder. The Customer may of course stop using the Service at any time.

The Starter Practice plan is free, so no Subscription Fee is payable and no refund can arise on cancellation of it.

4.5 Practice and Surgery Configuration

The Customer's subscription is based on the number of Practices and the features available within the Customer's selected plan. The Customer acknowledges and agrees that:

• Accurate representation required. The Customer must configure the Service to accurately reflect its real-world dental practice operations. Each Practice configured within the Service must correspond to a genuine, distinct physical dental practice premises operated by the Customer. Each Surgery configured within a Practice must correspond to a real, physical treatment room at that Practice's premises.
• One Practice per physical location. Each separate physical premises from which the Customer delivers dental services must be configured as a separate Practice within the Service. The Customer must not consolidate multiple physical locations into a single Practice within the Service, nor create Surgeries under one Practice that are physically located at a different premises.
• No fictitious Surgeries. The Customer must not create Surgeries within the Service that do not correspond to real, physical treatment rooms at the associated Practice premises. Surgeries must not be used as a substitute for separate Practices or to circumvent plan limits.
• Subscription adjustment. If the Customer operates multiple physical Practice locations, the Customer must subscribe to a plan that covers the correct number of Practices. Operating additional Practice locations without moving to the appropriate subscription constitutes a material breach of these Terms.
• Verification. Lumina may review the Customer's Practice Configuration at any time to check that it reflects the Customer's real-world operations. The Customer agrees to provide reasonable evidence of its Practice and Surgery configuration on request (for example, Care Quality Commission, Healthcare Improvement Scotland or Healthcare Inspectorate Wales registration details, as applicable, practice addresses, or photographs of premises). Lumina may use automated monitoring to detect configurations that are inconsistent with normal dental practice operations.

4.6 Remedies for Misconfiguration

If Lumina determines, acting reasonably and on evidence, that the Customer's Practice Configuration does not reflect its real-world operations, Lumina will notify the Customer in writing, setting out what Lumina has found and the evidence for it. Lumina may then:

• 1. require the Customer to correct its configuration within 14 days of the notice;
• 2. where the Customer has misrepresented its Practice Configuration and, as a result, has paid less than the Subscription Fees that would have been payable had the configuration been accurate, recover from the Customer the difference between the Subscription Fees paid and the Subscription Fees that would have been payable for the period of the misrepresentation, as a debt; and
• 3. suspend the Customer's access in accordance with Section 14.4, or terminate it in accordance with Section 14.3, if the misconfiguration is not corrected within the period set out in the notice.

Recovery under paragraph 2 is a recovery of amounts Lumina would have received had the Customer's representations been accurate. It is not a charge for breach and is not intended to exceed Lumina's loss. Lumina will provide the Customer with the calculation and the evidence relied on, and the Customer may dispute it under Section 19. Lumina will not apply paragraph 2 to a configuration error that the Customer corrects within the 14-day period, or to an honest mistake that the Customer notifies to Lumina.

Persistent or deliberate misconfiguration is a material breach of these Terms.

No amount is recoverable under this Section in respect of use in excess of a Plan Limit. Exceeding a Plan Limit is dealt with under Section 4.8 and Schedule 1, not by retrospective charging.

4.7 Non-Payment

If a payment fails, Lumina will notify the Customer and allow a reasonable period, not less than 14 days, to resolve the issue. Persistent non-payment may result in suspension or termination of access in accordance with Section 14.

4.7A Late Payment Interest

Without prejudice to Lumina's other rights and remedies under Section 4.7 and Section 14, any Subscription Fee, Extra Usage charge or other sum payable by the Customer under these Terms that remains unpaid after its due date bears interest, accruing daily from the due date until paid in full (whether before or after judgment), at a rate of 4% per annum above the Bank of England base rate from time to time in force. This Section does not apply to the Starter Practice plan, under which no Subscription Fee is ever payable.

4.8 Plan Limits and What Happens if the Customer Goes Over One

The Plan Limits are part of this agreement. For the Starter Practice plan they are set out in Schedule 1, together with the definitions used to measure them and the steps Lumina will take before restricting anything.

Three points apply to every plan:

• 1. Lumina will never restrict the Customer's access to records the Customer has already created, place the Customer's account into read-only mode, or restrict the Customer's ability to export Customer Data, because a Plan Limit has been exceeded.
• 2. Lumina will never move the Customer to a paid plan, or start charging the Customer, because a Plan Limit has been exceeded. Moving to a paid plan always requires the Customer's express action.
• 3. Lumina will not charge retrospectively for use above a Plan Limit.

Changes to Plan Limits are changes to these Terms and are made only in accordance with Section 18. A reduction in a Plan Limit on the Customer's current plan is a material change.

4.9 Changes to Plan Features

Lumina may add to or improve the features on a plan at any time. Lumina may reduce or remove features, or change Plan Limits, only in accordance with Section 18. A material reduction to features or limits on the Customer's current plan requires 30 days' notice and gives the Customer the right to terminate under Section 18.4.

5 Customer Data and Data Protection

5.1 Data Roles

For Personal Data contained in Customer Data, including patient records, clinical notes and any other personal information entered into the Service by the Customer or its Authorised Users:

• The Customer is the Data Controller. The Customer determines the purposes and means of processing Personal Data within the Service.
• Lumina is the Data Processor. Lumina processes that Personal Data only on behalf of the Customer and in accordance with the Customer's documented instructions, as set out in the DPA.

Lumina acts as a Data Controller in its own right only in respect of:

• Customer account and organisational information, including the Service Confirmation and Acceptance Records
• Billing and payment information
• Website visitor data for luminadental.co.uk
• Marketing communications, where the recipient has consented or another lawful basis applies
• Security and audit information that Lumina generates to protect and operate the Service

5.2 Data Processing Agreement

The processing of Personal Data under this agreement is governed by the Data Processing Agreement , which forms part of this agreement. If there is a conflict between these Terms and the DPA on a data protection matter, the DPA prevails, as set out in Section 1A.5.

5.3 Customer Obligations as Data Controller

As Data Controller, the Customer is responsible for:

• Ensuring a valid lawful basis exists for all Personal Data processed through the Service, including a valid basis for processing special category data
• Providing appropriate privacy notices to data subjects, including patients
• Responding to data subject access requests and other rights requests, with the assistance Lumina provides under the DPA
• Ensuring its use of the Service complies with applicable data protection law
• Obtaining any necessary consents where required
• Keeping its own records in line with its professional and statutory record retention duties, and not relying on the Service as its only record of patient care

5.4 Data Residency

Customer Data is hosted and stored in the United Kingdom (AWS London region). Limited processing by named sub-processors, for example Stripe for payment processing, may occur outside the United Kingdom under an appropriate Article 46 transfer safeguard. The sub-processors and the location of each are listed on the Sub-processor Schedule , and the safeguards are set out in the DPA .

5.5 Security Measures

Lumina implements appropriate technical and organisational measures to protect Customer Data, including:

• Encryption at rest and in transit using industry-standard cryptographic protections
• A managed authentication service with passwordless, one-time code sign-in to a verified email address or mobile number, and support for passkeys and authenticator-app multi-factor authentication, as described in Section 3.3
• Role-based access control with granular permissions
• Audit logging of changes to records and of security-relevant events
• 35-day rolling backups with point-in-time recovery for production database records
• Multi-availability-zone infrastructure for resilience

Fuller detail is set out in the DPA and on the Security page . The DPA is the contractual statement of Lumina's security obligations. Where the Security page and the DPA differ, the DPA governs.

5.6 Incident Notification

If there is a Personal Data Breach affecting Customer Data, Lumina will notify the Customer without undue delay after becoming aware of it. The notification will include, to the extent known, the nature of the breach, the categories and approximate volume of data affected, the likely consequences and the measures taken or proposed. The parties' detailed obligations on breach notification, including any backstop period, are set out in the DPA.

6 AI-Assisted Features

6.1 Availability and Activation

The Service includes optional AI-assisted features (such as clinical note generation, appointment suggestions, and other automated assistance). AI features are not enabled by default. The Customer must actively choose to enable AI features and may disable them at any time. Use of AI features is subject to the allowance for the Customer's plan.

6.2 How AI Data Is Handled

When AI features are used:

• Feature-specific data minimisation, pseudonymisation and payload controls reduce identifiable patient information where it is not required for the feature
• Retention differs by layer and is not a single period. Nothing is durably retained at the model layer. Requests and responses are not stored there
• Transient clinical AI content, such as an AI charting request or streamed dictation audio, is processed for the duration of the request only and is not retained as stored AI content
• Where an AI feature keeps a conversation or session history, that history is deleted automatically at the end of the period for that feature. Booking assistant conversations are retained for 7 days, form builder conversations for 7 days, Lumina Intelligence conversations for 90 days by default, and Lumina Intelligence attachments for 30 days
• AI-generated output that a clinician accepts into a patient record becomes part of the clinical record and follows the normal clinical-record lifecycle. AI-drafted notes that have not been accepted are retained in the patient record pending clinical review and do not expire automatically
• Audit and compliance metadata, such as the identity of the user who initiated the request, the timestamp and the feature used, is retained for audit and compliance purposes. It does not include the content of transient AI requests
• No identifiable patient data is used to train AI models
• AI processing is carried out on Amazon Bedrock. Requests are ordinarily served on infrastructure in the United Kingdom (AWS London region). Where a model is invoked through a European geographic inference profile, the request and the response may be processed in another AWS region within the United Kingdom or the European Economic Area. The European Economic Area is covered by UK adequacy regulations, so no separate Article 46 safeguard is required for that movement, and the Sub-processor Schedule records the regions in scope. Customer Data is not processed outside the United Kingdom and the European Economic Area for AI processing

For full details, see our AI Usage Policy .

6.3 Limitations

AI-generated outputs are an assistive tool. The Customer acknowledges and agrees that:

• AI features are not clinical decision support and must not be relied on as such
• All AI-generated outputs must be reviewed by a suitably qualified professional before being acted on or incorporated into clinical records
• Lumina does not warrant the accuracy, completeness, or suitability of AI-generated content for any particular purpose
• The Customer is responsible for verifying and approving any AI-generated content before use

Lumina is not liable for a clinical decision made in reliance on AI-generated content, to the extent set out in Section 12.4. Nothing in this Section excludes Lumina's liability for the Service failing to record, retain or display accurately the content a clinician has reviewed and approved, or for a failure of the Service to operate as described.

6.4 AI Usage, Allowances, and Extra Usage

Each plan includes a daily AI usage allowance for each Practice. The allowance applicable to each plan is set out in Schedule 1 for Starter Practice, and on the pricing page or in the Service Confirmation for other plans. Allowances are measured in usage units that reflect the computational cost of AI-assisted activity. A typical AI-assisted activity (such as generating clinical notes for a single patient exam) consumes a small portion of the daily allowance.

Allowances reset at 00:00 UK time each day. Unused allowance does not roll over between days.

By default, once a Practice's daily allowance is exhausted, AI features become unavailable at that Practice until the next daily reset, and the Customer will not incur any charges beyond the Subscription Fee. The rest of the Service is unaffected.

The Customer may, at its option, enable Extra Usage through the Service to allow AI-assisted activity to continue beyond the daily allowance. Extra Usage is opt-in. Extra Usage requires a payment method on file, because it results in a charge; the Starter Practice plan does not require a payment method to use the rest of the Service, so a Starter Practice customer must add one before Extra Usage can be enabled. Until a payment method is added and Extra Usage is enabled, AI features simply pause at the daily allowance and resume at the next daily reset, as described above; no charge arises and nothing else about the Service is affected. When Extra Usage is enabled, additional activity is billed on a pay-as-you-go basis at the rate published on the pricing page or set out in the Service Confirmation, invoiced alongside the next Subscription Fee. Extra Usage may be disabled at any time with immediate effect and will not affect charges already incurred in the current billing period.

Lumina may adjust daily allowances, the definition of a usage unit and Extra Usage rates to reflect changes in underlying technology and operating costs. A material reduction in an included allowance, or an increase in an Extra Usage rate, is a material change under Section 18 and requires 30 days' notice.

Lumina may apply reasonable anti-abuse limits at the organisation, user, or Practice level to prevent fraud, automated scraping, or use inconsistent with normal dental practice operations. Lumina will tell the Customer when it applies such a limit and why.

7 Intellectual Property

7.1 Lumina's IP

The Service, including all software, source code, algorithms, user interfaces, designs, Documentation, trademarks, and other intellectual property embodied in or related to the Service, is and remains the property of Lumina Dental Limited and its licensors. Nothing in these Terms transfers any ownership of Lumina's intellectual property to the Customer.

7.2 Licence to Use the Service

Subject to the Customer's compliance with these Terms and payment of any applicable Subscription Fees, Lumina grants the Customer a non-exclusive, non-transferable, non-sublicensable licence to access and use the Service during the Subscription Term for the Customer's internal dental practice management purposes, and to permit its Authorised Users to do so.

The licence may be suspended or revoked only in accordance with Section 14, or as expressly permitted elsewhere in these Terms. It is not revocable at will.

7.3 Customer Data Ownership

The Customer retains all rights, title, and interest in and to Customer Data. Lumina acquires no ownership rights in Customer Data. The Customer grants Lumina a limited licence to host, process, and transmit Customer Data only as necessary to provide, maintain, secure and support the Service in accordance with these Terms and the DPA. That licence ends when Customer Data is deleted under Section 15.

7.4 Feedback

If the Customer provides suggestions, feature requests, or other feedback regarding the Service ("Feedback"), Lumina may use such Feedback without restriction or obligation to the Customer. The Customer is not required to provide Feedback. Feedback must not contain Customer Data or Personal Data.

8 Aggregated and Anonymised Data

Lumina may create aggregated and anonymised datasets derived from Customer Data, provided that such data:

• Has been irreversibly anonymised such that it cannot, by any reasonable means, be used to identify any individual, patient, or specific dental practice
• Is combined with data from multiple sources such that no individual Customer's data can be isolated or reconstructed

Lumina may use such aggregated and anonymised data for the purposes of:

• Improving and developing the Service
• Generating industry benchmarks and analytics
• Conducting research and statistical analysis
• Compiling reports on industry trends

For the avoidance of doubt, aggregated and anonymised data does not constitute Customer Data or Personal Data for the purposes of these Terms or the DPA. Lumina owns all rights in aggregated and anonymised datasets it creates.

Lumina will not attempt to re-identify anonymised data. Lumina will not disclose or sell Customer Data or identifiable patient information to any third party except as necessary to provide the Service, as instructed by the Customer, or as required by law.

9 Service Availability

9.1 Availability Target

Lumina is designed for and targets 99.9% availability, measured on a calendar month basis. This is a design objective and operational target, not a guarantee. Lumina does not currently offer service credits for downtime on standard plans. Enterprise customers may agree specific availability commitments in a separate agreement.

Nothing in this Section limits Lumina's obligations under Section 10A or the Customer's remedies for breach of them.

9.2 Scheduled Maintenance

Lumina may perform scheduled maintenance on the Service. Where practicable, scheduled maintenance will be conducted outside of Business Hours. Lumina will provide reasonable advance notice of scheduled maintenance that is expected to cause service disruption. Scheduled maintenance periods are excluded from availability calculations.

9.3 Exclusions

The following are excluded from availability calculations:

• Scheduled maintenance windows
• Force majeure events (see Section 20.1)
• Issues caused by the Customer's systems, networks, or equipment
• Issues caused by third-party services or internet connectivity outside Lumina's control
• Suspension due to the Customer's breach of these Terms

9.4 Backup and Recovery

Lumina will maintain, for production database records, a rolling point-in-time recovery window of not less than 35 days, and will maintain version history for documents and files stored in the Service. These two are express obligations, not targets.

Lumina's internal recovery time objective for critical service components is 4 hours. Unlike the two express obligations above, the recovery time objective is an operational target, not a contractual commitment.

Lumina's express backup obligations under the first paragraph of this Section, and the corresponding obligations in the DPA, are the obligations referred to in Section 12.4. The recovery time objective in the second paragraph is not.

9.5 Real-Time and Emergency Alert Features

The Service includes real-time features, including the practice-wide emergency alert system, that rely on active internet connectivity, WebSocket connections, and device availability. The Customer acknowledges and agrees that:

• Real-time features, including emergency alerts, are provided as a supplementary communication tool and must not be relied upon as the sole or primary method of raising an emergency or communicating urgent information within the practice
• The delivery and timeliness of real-time notifications depend on factors outside Lumina's control, including the Customer's local network conditions, internet connectivity, device state (e.g. whether a device is powered on, connected, and running the Service), and the performance of third-party infrastructure providers
• Lumina does not warrant that real-time features will operate without latency, interruption, or failure in all circumstances
• The Customer is responsible for maintaining independent emergency procedures and communication methods (such as verbal alerts, physical alarm systems, intercoms, or other manual processes) in accordance with applicable regulatory requirements, including Care Quality Commission, Healthcare Improvement Scotland or Healthcare Inspectorate Wales standards (as applicable) and the Customer's own risk assessments

Lumina's liability arising from the failure, delay or unavailability of real-time features is limited as set out in Section 12, and is not excluded. Section 12.1 applies in full.

10 Support

10.1 How Support Is Provided

Support is provided in accordance with the Customer's plan and the SLA. Support response times are targets only and are not guaranteed unless expressly agreed in writing.

10.2 Response Targets by Plan

10.3 Incident Severity and How It Interacts With Plan Hours

The SLA sets out incident severity levels and the target response for each. Severity targets are measured within the support hours for the Customer's plan, as set out in Section 10.2 and the SLA. They are not a commitment to respond outside those hours unless the Customer's Service Confirmation says so.

For the most serious incidents, being those where the Service is unavailable or where a security incident is suspected, Lumina targets an initial response within 1 hour during Business Hours.

Suspected security incidents should always be reported to security@luminadental.co.uk as well as through the normal support channel.

10.4 What Is Not Included

Onboarding, data migration and training are not included in the support obligations in this Section unless the Customer's Service Confirmation says otherwise. Where Lumina provides them, it does so as a separately described service.

10A Warranties

10A.1 Lumina's Warranties

Lumina warrants that:

• 1. it will provide the Service, and any support and professional services, with reasonable care and skill. The parties acknowledge that this reflects the implied term in section 13 of the Supply of Goods and Services Act 1982, which is not excluded;
• 2. the Service will conform in all material respects to the Documentation;
• 3. it will use industry-standard measures to detect and prevent the introduction of malicious code into the Service;
• 4. it has the right to grant the licence in Section 7.2 and to provide the Service;
• 5. it will comply with the DPA and with applicable data protection law in its processing of Customer Data; and
• 6. it will comply with applicable law in providing the Service.

If the Service does not conform to the warranty in paragraph 2, the Customer should notify Lumina, and Lumina will use reasonable endeavours to correct the non-conformity within a reasonable period. This is in addition to, and does not replace, the Customer's other remedies.

10A.2 The Customer's Warranties

The Customer warrants that:

• 1. it has authority to enter into this agreement, as set out in Section 1A.2;
• 2. it has and will maintain a valid lawful basis for the Personal Data it processes through the Service;
• 3. Customer Data, and its use of the Service, will not infringe the rights of any third party or breach applicable law; and
• 4. the information in its Service Confirmation, including its Practice Configuration, is accurate.

10A.3 What Is Not Warranted

Lumina does not warrant that the Service will be uninterrupted or error-free, that it will meet requirements Lumina has not agreed in writing, or that AI-generated outputs will be accurate, complete or suitable for a particular purpose. Features clearly identified in the Service as beta, preview or experimental are provided as they are, without warranty, and the Customer should not use them for clinical or regulatory purposes.

Except as set out in Section 10A.1, and to the extent permitted by law, all terms and warranties implied by statute or common law are excluded. This exclusion does not apply to any term or warranty that cannot lawfully be excluded, and does not apply to section 13 of the Supply of Goods and Services Act 1982, which Lumina does not exclude.

11 Customer Obligations and Acceptable Use

11.1 General Obligations

The Customer shall:

• Use the Service only for lawful purposes and in accordance with these Terms
• Comply with the Acceptable Use Policy
• Ensure that all Authorised Users are made aware of and comply with these Terms and the Acceptable Use Policy
• Maintain appropriate security practices within its organisation, including staff training on data protection
• Not attempt to access, tamper with, or use non-public areas of the Service, Lumina's systems, or Lumina's technical delivery systems

11.2 Prohibited Conduct

Without limiting the Acceptable Use Policy, the Customer shall not:

• Use the Service in any manner that breaches applicable law or regulation
• Sublicense, resell, or make the Service available to third parties other than the Customer's Authorised Users
• Reverse engineer, decompile, or disassemble any aspect of the Service, except to the extent the law permits
• Attempt to gain unauthorised access to other customers' data or accounts
• Introduce malicious software or conduct any activity that could harm the Service or other users
• Use the Service to store or process data unrelated to dental practice management
• Misrepresent the Customer's Practice Configuration, including by consolidating multiple physical practice locations into a single Practice, creating fictitious Surgeries, or otherwise configuring the Service in a manner that does not accurately reflect the Customer's real-world dental practice operations (see Section 4.5)

11.3 How the Acceptable Use Policy Is Enforced

If Lumina considers that the Customer has breached the Acceptable Use Policy, Lumina will notify the Customer and, where the breach is capable of being corrected, allow a reasonable period to correct it. Lumina may suspend or terminate access only on the grounds and in the manner set out in Section 14. The Acceptable Use Policy does not give Lumina any wider right of suspension or termination than Section 14 provides.

12 Limitation of Liability

This Section limits the amount either party can recover from the other. Please read it. Section 12.1 lists the liabilities that are never limited.

12.1 Liabilities That Are Not Excluded or Limited

Nothing in this agreement excludes or limits either party's liability for:

• Death or personal injury caused by its negligence
• Fraud or fraudulent misrepresentation
• Any other liability that cannot be excluded or limited by applicable law

This Section overrides every other provision of this agreement, including any provision elsewhere that purports to exclude liability "to the fullest extent permitted by law".

12.2 General Cap

Subject to Section 12.1, and except for Data and Security Claims, which are dealt with in Section 12.3, Lumina's total liability to the Customer under or in connection with this agreement, whether in contract, tort (including negligence), breach of statutory duty or otherwise, shall not exceed, in aggregate in each Contract Year, the greater of:

• 100% of the Subscription Fees paid or payable by the Customer to Lumina in the 12 months immediately before the event giving rise to the claim. Where that event occurs in the Customer's first 12 months, this amount is the Subscription Fees paid or payable by the Customer from the Effective Date up to the date of that event. No annualisation, grossing up or projection of fees is applied; and
• £5,000.

Section 12.2A explains how the cap is aggregated and how connected claims are treated.

Why there is a fixed floor. The Starter Practice plan is supplied free of charge, so the first limb of this cap produces nothing for a Customer on that plan. A cap that produced no remedy at all would operate as a total exclusion of liability. That would put the whole of this Section at risk of being unreasonable under the Unfair Contract Terms Act 1977, and would leave the Customer with a contract that gave it no remedy for any failure. The floor exists so that a Customer paying nothing still has a real and enforceable remedy. The parties agree that the floor is a genuine pre-estimate of a proportionate remedy for a service supplied at no charge, and that it is reasonable to include on that basis. Section 12.6 records the wider basis of the risk allocation.

12.2A Contract Year, Aggregation and Connected Claims

This Section applies to the cap in Section 12.2, the cap in Section 12.3, any Enhanced Cap under Section 12.3A, and the Customer's cap in Section 12.5.

• 1. Each cap is an aggregate cap. It applies to all claims arising in the same Contract Year taken together. It is not a cap on each claim.
• 2. Each cap applies for each Contract Year. A Contract Year is each successive period of 12 months beginning on the Effective Date and on each anniversary of the Effective Date.
• 3. Connected claims count as one claim. A series of connected claims is treated as a single claim. Claims are connected if they arise from the same facts, events or circumstances, or from facts, events or circumstances that are connected to one another, including a continuing state of affairs and a repeated or continuing act or omission. A connected series is treated as one claim arising in the Contract Year in which the first claim in the series arose, and is subject to the cap for that Contract Year only.
• 4. The two caps do not stack. Sections 12.2 and 12.3 create two separate aggregate caps. Section 12.3 applies instead of Section 12.2 for Data and Security Claims, and never in addition to it. No claim, and no connected series of claims, may be recovered under both.

12.3 Data and Security Claims Cap

Subject to Section 12.1, Lumina's total liability for Data and Security Claims shall not exceed, in aggregate in each Contract Year, £50,000.

"Data and Security Claims" means claims against Lumina, however arising, in respect of any of the following four categories:

• 1. Data protection. Breach by Lumina of applicable data protection law, or of the DPA, including a Personal Data Breach caused by Lumina or its sub-processors.
• 2. Confidentiality. Breach by Lumina of its confidentiality obligations in Section 16.
• 3. Loss or corruption of Customer Data. Loss, corruption, destruction or unauthorised alteration of Customer Data, except to the extent excluded by Section 12.4.
• 4. Security. Failure of Lumina's security obligations under Section 5.5, the DPA and Annex 2 to the DPA, including unauthorised access to, or unauthorised disclosure of, Customer Data.

The cap in this Section applies instead of the cap in Section 12.2 for Data and Security Claims, and never in addition to it. The two caps are separate aggregate caps, and an amount recovered under one does not reduce the other. Section 12.2A applies to this cap in the same way as it applies to the cap in Section 12.2.

12.3A Enhanced Cap for Enterprise Customers

Where the Customer is on the Enterprise plan, its Service Confirmation may record a higher general cap, a higher Data and Security Claims cap, or both (an "Enhanced Cap"). Lumina will agree an Enhanced Cap only where the Enhanced Cap is supported by the Subscription Fees payable for the relevant period.

Where the Service Confirmation records an Enhanced Cap, that figure applies in place of the corresponding figure in Section 12.2 or Section 12.3, and the rest of this Section 12 applies unchanged, including Section 12.2A. Where the Service Confirmation records no Enhanced Cap, the figures in Sections 12.2 and 12.3 apply.

12.4 Excluded Losses

Two overriding rules apply to this Section 12.4, and both are read before any bullet below.

First, Section 12.1 always overrides this Section: nothing in this Section 12.4 excludes or limits a liability listed in Section 12.1.

Second, nothing in this Section 12.4 excludes or limits a liability that Section 12.3 makes recoverable as a Data and Security Claim. Where a loss falls within one of the four categories in Section 12.3, it is recoverable as a Data and Security Claim subject to the cap in that Section, and every bullet below is read subject to that. Excluding a loss under this Section is a separate question from capping the amount recoverable for a loss that is not excluded.

Subject to those two rules, Lumina shall not be liable to the Customer for:

• Indirect, incidental, special, or consequential loss or damage
• Loss of profits or revenue
• Loss of business or business opportunity
• Loss of anticipated savings
• Loss of goodwill or reputation
• Loss or corruption of Customer Data, which is recoverable only as a Data and Security Claim under Section 12.3 and subject to the cap in that Section, and which is excluded only to the extent that Lumina has complied with its express backup obligations under Section 9.4 and the corresponding obligations in the DPA (the point-in-time recovery window and document versioning; not the recovery time objective, which is a target and not a compliance standard for this purpose), and the loss or corruption was not caused by a defect in the Service or by Lumina's breach of this agreement. Loss or corruption of Customer Data caused by a defect in the Service, by a failure of Lumina's express backup obligations, or by Lumina's breach of its security obligations, is not excluded
• Loss arising from the Customer's misuse of data after export from the Service. This does not exclude loss caused by Lumina exporting, transmitting or disclosing Customer Data to the wrong recipient, which is a Data and Security Claim
• Loss arising from a clinical decision made by the Customer or its personnel in the exercise of their independent professional judgement, where the information the Service recorded, retained, displayed and transmitted to them was accurate and complete. This exclusion does not apply to loss caused by the Service failing to record, retain, display or transmit information accurately or completely, by the Service presenting information that is wrong, out of date or attributed to the wrong patient, or by the Service being unavailable
• Loss arising from the acts or omissions of third-party services or providers that Lumina has not engaged as a sub-processor. Lumina remains responsible for its sub-processors as set out in the DPA, and a claim arising from the act or omission of a sub-processor is a Data and Security Claim where it falls within Section 12.3

What this Section does not exclude. So that the second overriding rule is not in doubt, the following are recoverable as Data and Security Claims under Section 12.3, subject to the cap in that Section, and no bullet above excludes them:

• 1. compensation the Customer is required to pay to a data subject, and the Customer's reasonable costs of defending a data subject's claim;
• 2. the Customer's reasonable costs of investigating, containing, notifying and remediating a Personal Data Breach, including notification to the Information Commissioner and to affected data subjects, and the reasonable cost of credit or identity monitoring where it is reasonably required;
• 3. the Customer's reasonable costs of restoring, reconstituting or re-creating Customer Data that has been lost, corrupted, destroyed or altered, except where the loss or corruption is excluded by the sixth bullet above; and
• 4. amounts payable to the Customer under Lumina's data protection indemnity in Section 13.3, which is itself subject to the cap in Section 12.3.

12.5 The Customer's Liability

Subject to Section 12.1, the Customer's total liability to Lumina under or in connection with this agreement shall not exceed, in aggregate in each Contract Year, the greater of the two amounts in Section 12.2, calculated on the same basis. Section 12.2A applies to that cap in the same way as it applies to Lumina's caps.

Where the Customer's liability arises from a claim that would be a Data and Security Claim if it were made against Lumina, the cap in Section 12.3 applies to the Customer instead of the cap in the paragraph above, on the same basis. This mirrors Section 14.1(f) of the DPA, which applies both limits to both parties on the same basis.

The cap in this Section does not apply to:

• the Customer's obligation to pay Subscription Fees, Extra Usage charges and amounts recoverable under Section 4.6; and
• the Customer's liability under the indemnity in Section 13.1.

12.6 Basis of the Risk Allocation

The parties agree that the limits in this Section are reasonable, and record the following as the basis on which they were agreed:

• 1. Price. The limits reflect the price of the Service, including that the Starter Practice plan is supplied free of charge.
• 2. Why there is a floor. The floor in Section 12.2 exists so that a Customer paying nothing is not left without a remedy. A cap at fees paid alone would produce a nil remedy on a free plan, which would operate as a total exclusion and would put the whole of this Section at risk of being unreasonable under the Unfair Contract Terms Act 1977. The parties agree that the floor is a genuine pre-estimate of a proportionate remedy for a service supplied at no charge.
• 3. Why the data cap is higher. The separate and higher cap in Section 12.3 reflects the sensitivity of the health data Lumina processes for the Customer, and the fact that the four categories in that Section are the risks the Customer is least able to control for itself.
• 4. Division of responsibility. The Customer is responsible for its own clinical governance, record keeping, emergency procedures and retention duties, and Lumina is responsible for the Service performing materially as described, as Sections 2.2 and 10A set out.
• 5. Protections the Customer keeps whatever the cap. The caps do not reduce the Customer's rights under Section 9.4 (Lumina's express backup obligations), Section 15 (the Read-Only Period and export), or paragraphs 5 and 6 of Schedule 1 (Lumina will never lock the Customer out of records it has already created because of a Plan Limit, and the emergency care override).
• 6. Presentation. The limits are drawn to the Customer's attention in the key points at the top of these Terms and again at Acceptance, and each party has had the opportunity to consider them before accepting them.

12.6A The Caps Allocate Liability Between the Parties Only

This Section 12 allocates liability between Lumina and the Customer. It does nothing else. In particular, nothing in this Section:

• 1. limits or affects any claim a data subject may bring directly against either party, including a claim for compensation under Article 82 of the UK GDPR;
• 2. limits or affects any investigation, enforcement action, penalty or fine by the Information Commissioner or by any other regulator against either party;
• 3. limits or affects either party's own obligations under data protection law, or any other liability that cannot lawfully be limited or excluded; or
• 4. limits or affects a party's right of contribution or recovery under Article 82(5) of the UK GDPR or under the Civil Liability (Contribution) Act 1978, except that the amount one party may recover from the other under those rights is subject to the applicable cap in this Section, as Section 14.3 of the DPA provides.

Neither party may rely on this Section against a data subject or against a regulator.

12.7 Mitigation and Time Limits

Each party shall take reasonable steps to mitigate its loss. Nothing in this agreement shortens any statutory limitation period.

13 Indemnities

13.1 The Customer's Indemnity

The Customer shall indemnify Lumina against all losses, liabilities, damages, and reasonable costs (including reasonable legal fees) that Lumina incurs as a result of a third-party claim, in each case to the extent arising from:

• The Customer's breach of these Terms or the DPA
• The Customer's failure to comply with its obligations as Data Controller, including failure to maintain a valid lawful basis for processing
• Claims brought by data subjects arising from the Customer's processing activities or instructions
• The Customer's violation of any applicable law or regulation

This indemnity covers third-party claims only. It does not extend to Lumina's own losses, which are dealt with under Section 12.5. The words "to the extent arising from" mean that the indemnity is reduced to reflect any part of the loss caused by Lumina, its sub-processors or a defect in the Service.

13.2 Lumina's Intellectual Property Indemnity

Lumina shall indemnify the Customer against all losses, liabilities, damages and reasonable costs (including reasonable legal fees) that the Customer incurs as a result of a third-party claim that the Customer's use of the Service in accordance with this agreement infringes that third party's intellectual property rights in the United Kingdom.

This indemnity does not apply to a claim arising from:

• Modification of the Service by anyone other than Lumina
• Combination or use of the Service with hardware, software, data or services not supplied or approved by Lumina, where the claim would not have arisen without that combination
• Use of the Service outside the licence in Section 7.2, contrary to the Documentation, or contrary to Lumina's written instructions
• Customer Data, or any specification or content the Customer supplied
• The Customer's continued use of an allegedly infringing version after Lumina has made a non-infringing version or workaround available at no additional cost

If a claim under this Section is made or threatened, Lumina may, at its option and cost:

• 1. procure for the Customer the right to continue using the Service;
• 2. modify or replace the Service so that it is no longer infringing, while keeping it materially equivalent in function; or
• 3. if neither option 1 nor option 2 is achievable on commercially reasonable terms, terminate this agreement on written notice and refund the Subscription Fees the Customer has paid for the unexpired part of the current period. Where the Customer is on a free plan, no fee refund arises. In either case, Lumina will give the Customer the full Read-Only Period and export rights in Section 15, and reasonable assistance in migrating to another system.

The remedies in this Section are the Customer's only remedies for a claim that the Service infringes a third party's intellectual property rights. Lumina's liability under this Section is subject to the cap in Section 12.2.

13.3 Lumina's Data Protection Indemnity

Lumina shall indemnify the Customer against:

• Administrative fines imposed on the Customer by the Information Commissioner's Office; and
• Compensation and reasonable costs the Customer is required to pay to a data subject,

in each case to the extent arising from Lumina's breach of the DPA, Lumina's breach of its security obligations under this agreement, or a Personal Data Breach caused by Lumina or its sub-processors.

The indemnity does not apply to the extent that the fine, compensation or cost arises from the Customer's own instructions, the Customer's own breach of data protection law, or the Customer's failure to mitigate. Lumina's liability under this Section is subject to the cap in Section 12.3.

13.4 Conduct of Indemnified Claims

The party seeking indemnity ("Indemnified Party") shall:

• 1. notify the other party ("Indemnifying Party") promptly in writing of the claim, and in any event within a period that does not prejudice the defence;
• 2. not admit liability or settle the claim without the Indemnifying Party's written consent, which shall not be unreasonably withheld;
• 3. give the Indemnifying Party control of the defence and settlement of the claim, provided that no settlement may impose a non-monetary obligation on, or admit fault by, the Indemnified Party without its written consent; and
• 4. give the Indemnifying Party reasonable assistance at the Indemnifying Party's cost.

A failure to comply with this Section reduces the Indemnifying Party's obligation only to the extent the failure has caused prejudice.

14 Term and Termination

14.1 Term

This agreement takes effect on the Effective Date and continues for the Subscription Term. The Subscription Term renews automatically in accordance with Section 4.3 unless terminated in accordance with this Section.

14.2 Termination for Convenience

The Customer may terminate this agreement at any time by cancelling the subscription. Termination takes effect at the end of the current paid billing period. On a free plan, termination takes effect on the date the Customer specifies, or immediately if none is specified.

Lumina may terminate this agreement for convenience only by giving at least 90 days' written notice. This applies to free plans as well as paid plans.

14.3 Termination for Cause

Either party may terminate this agreement with immediate effect by written notice if:

• The other party commits a material breach of this agreement and, where the breach is capable of remedy, fails to remedy it within 30 days of written notice requiring it to do so; or
• An Insolvency Event occurs in relation to the other party, or the other party ceases or threatens to cease carrying on business.

14.4 Suspension

Lumina may suspend the Customer's access, in whole or in part, with immediate effect if:

• The Customer fails to pay Subscription Fees after the notice period in Section 4.7;
• The Customer's use of the Service poses a security risk to the Service, to Lumina or to other customers;
• The Customer's use of the Service breaches applicable law;
• The Customer's Practice Configuration remains materially inconsistent with its real-world operations after the correction period given in a notice under Section 4.6(1); or
• The Customer's registration information, including the information in its Service Confirmation, is materially inaccurate and the Customer has not corrected it within a reasonable period, of not less than 14 days, after Lumina's written notice under Section 3.2.

These are the only grounds for immediate suspension. Where Lumina suspends access, it will:

• 1. tell the Customer why, at the time of suspension or as soon as practicable afterwards;
• 2. limit the suspension to what is necessary to address the ground relied on;
• 3. lift the suspension promptly once the ground has been addressed; and
• 4. except where the Customer's use is unlawful or an active security threat, preserve the Customer's read-only access to, and ability to export, Customer Data during the suspension.

Where suspension would prevent the Customer from accessing clinical records needed for patient care, Lumina will, unless prevented by law or by an active security threat, provide a means for the Customer to obtain those records.

15 Effects of Termination

15.1 Read-Only Period

Following the effective date of termination, the Customer will have a read-only access period of 90 days (the "Read-Only Period"), during which the Customer may view and export Customer Data. During the Read-Only Period the Customer will not be able to create, modify or delete records.

The Read-Only Period is set to allow a practice time to migrate to another system while continuing to meet its own record retention duties. The Read-Only Period runs from the effective date of termination regardless of the reason for termination, except where the Service has been suspended because the Customer's use is unlawful or presents an active security threat, in which case Lumina will provide access by another reasonable means.

15.2 Data Export

The Customer may request a full export of Customer Data at any time during the Subscription Term and at any time during the Read-Only Period. There is no limit on the number of export requests.

Lumina will provide the export within 10 business days of the request, in a documented, structured, machine-readable format, together with a description of the format. Lumina will provide the export by a secure method agreed with the Customer. The Customer is responsible for storing exported data securely once it has been received.

15.3 Retention and Deletion

Unless the Customer instructs otherwise in writing, or applicable law requires retention, the following applies after the Read-Only Period ends:

• Customer Data will be retained in encrypted form for a further 30 days (the "Retention Buffer"), to allow for outstanding export requests or dispute resolution;
• After the Retention Buffer expires, Customer Data will be deleted from Lumina's active systems in accordance with the DPA;
• Backup copies expire within 35 days of deletion from active systems, in accordance with Lumina's rolling backup policy;
• Lumina will provide written confirmation of deletion on request.

The DPA describes how deletion is carried out, including where records are first flagged as deleted and later purged, and the timescales for each stage. Where these Terms and the DPA differ on deletion, the DPA governs.

15.4 Extended Archive

If the Customer needs Customer Data retained beyond the timeline in Section 15.3, for example to meet a professional or statutory record retention duty, the Customer must give Lumina written instructions before the end of the Retention Buffer. Lumina will offer extended archival on reasonable commercial terms, under a separate written agreement, and will not unreasonably refuse a request made in time.

The Customer is reminded that dental records carry long retention periods under professional and NHS guidance, and that those duties rest on the Customer. The Customer should not rely on the Service, or on Lumina's archive, as its only means of meeting them. Exporting Customer Data before termination takes effect is the safest course.

15.5 Survival

The following survive termination or expiry: Sections 1 (Definitions), 1A.5 (Order of precedence), 1A.7 (Electronic acceptance and records), 4.6 and 6.4 (in respect of amounts that accrued before termination), 5 (Customer Data and Data Protection), 7 (Intellectual Property), 8 (Aggregated and Anonymised Data), 10A (Warranties, in respect of accrued claims), 12 (Limitation of Liability), 13 (Indemnities), 15 (Effects of Termination), 16 (Confidentiality), 18.5 (Versioning and supersession), 19 (Governing Law, Disputes and Jurisdiction) and 20 (General Provisions).

16 Confidentiality

16.1 Obligations

Each party agrees to keep confidential all Confidential Information received from the other party and not to disclose such information to any third party except as permitted under these Terms. Each party shall use the same degree of care to protect the other party's Confidential Information as it uses to protect its own (and in any event no less than reasonable care). Each party may disclose Confidential Information to its personnel and professional advisers who need it, provided they are bound by equivalent obligations.

16.2 Exceptions

The obligations of confidentiality do not apply to information that:

• Is or becomes publicly available through no fault of the receiving party
• Was rightfully known to the receiving party prior to disclosure
• Is independently developed by the receiving party without reference to the disclosing party's Confidential Information
• Is required to be disclosed by law, regulation, or court order, provided the receiving party gives prompt notice (where permitted) to the disclosing party

16.3 Relationship to Data Protection

Personal Data within Customer Data is governed by Section 5 and the DPA. Where this Section and the DPA differ in respect of Personal Data, the DPA governs.

17 Third-Party Services

The Service integrates with or depends on certain third-party services. A current list of sub-processors is maintained at luminadental.co.uk/subprocessors .

The Customer acknowledges that:

• Third-party services are subject to their own terms of service and privacy policies
• Where the Customer enables an optional third-party integration that Lumina has not engaged as a sub-processor, the Customer is responsible for reviewing the terms and suitability of that service
• Lumina is not responsible for the availability, performance, or data practices of a third-party service that the Customer has chosen to connect and that Lumina has not engaged as a sub-processor

Lumina remains responsible for its sub-processors as set out in the DPA, including for the acts and omissions of Amazon Web Services and Stripe in providing the Service. Lumina's liability in relation to third-party services is limited as set out in Section 12, and is not excluded. Section 12.1 applies in full.

18 Changes to These Terms and Versioning

18.1 When Lumina May Make Changes, and the Limits on That Power

Lumina may change these Terms and the documents listed in Section 1A.4 from time to time, acting reasonably and in good faith, and only for one or more of the following reasons:

• A change in law, regulation or professional guidance, or a decision or requirement of a regulator
• Security, integrity or resilience of the Service
• A change in Lumina's technology, infrastructure or sub-processors
• Adding, improving or reorganising features
• A change in Lumina's costs of providing the Service
• Correcting an error or ambiguity, or improving clarity

Two limits apply to every change:

• 1. No retrospective effect. A change takes effect prospectively only. It does not affect any right or liability that has already accrued, and it does not apply to any act, omission, incident or claim that occurred before the change took effect.
• 2. Proportionality. Lumina will not use this Section to make a change that is disproportionate to the reason for it, or to reduce the Customer's rights beyond what the reason requires.

18.2 Three Kinds of Change

Minor changes. Changes that do not adversely affect the Customer's rights or obligations in any material way. Examples: typographical corrections, clarification of existing wording, restructuring or renumbering, updated contact details, new or improved features, and additions to the Documentation. Minor changes take effect on publication, without notice.

Material changes. Changes that adversely affect the Customer's rights or obligations in a way that is more than trivial, but that do not fall within Section 18.3. Examples: a reduction in a Plan Limit on the Customer's current plan, a material reduction in features on the Customer's current plan, a change to Subscription Fees, a reduction in an included AI allowance, an increase in an Extra Usage rate, and a change to support targets. Lumina will give the Customer at least 30 days' written notice of a material change. The change takes effect at the end of the notice period or, for a change to Subscription Fees, at the start of the next renewal period.

Major changes. Changes in the categories listed in Section 18.3. A major change does not take effect for the Customer until the Customer accepts it, in the manner described in Section 18.3.

18.3 Changes That Require the Customer to Accept Them Again

A change in any of the following categories takes effect for the Customer only when an Authorised Officer accepts the new Terms Release using the process in Section 1A.1:

• 1. limitation or exclusion of liability, or the amount of any cap;
• 2. the substance of the DPA or how Personal Data is processed;
• 3. the structure of Lumina's use of sub-processors, or the addition of a sub-processor that processes Customer Data in a new country;
• 4. international transfers of Customer Data, or the transfer safeguards relied on;
• 5. any use of patient data beyond providing the Service, including any new use for training, research or analytics;
• 6. pricing structure, automatic charging, or any change that could result in the Customer being charged where it previously was not;
• 7. dispute resolution, governing law or jurisdiction;
• 8. termination rights, the Read-Only Period, or data retention and deletion;
• 9. any material reduction in the Customer's access to clinical records.

Lumina will give at least 30 days' notice of a major change and will make the new Terms Release available for review during that period. Continued use of the Service does not constitute acceptance of a major change.

If the Customer has not accepted a major change by the date it is due to take effect, Lumina will not apply the change to the Customer, and the parties will discuss how to proceed. If the change is one Lumina cannot reasonably continue the Service without, Lumina may terminate under Section 14.2 on 90 days' notice, and Section 15 applies in full.

18.4 If the Customer Does Not Agree to a Change

If the Customer does not agree to a material or a major change, the Customer may terminate this agreement by written notice given before the change takes effect. On termination under this Section:

• Lumina will refund the Subscription Fee for the unexpired part of the current period on a pro rata basis;
• The Read-Only Period and the export rights in Section 15 apply in full; and
• The change never applies to the Customer.

For material changes only, if the Customer continues to use the Service after the 30-day notice period has ended, the Customer accepts the change. This does not apply to major changes, which always require acceptance under Section 18.3.

18.5 Versioning and Supersession

Each Terms Release has a release identifier and a content hash, and includes the versions of the documents in Section 1A.4 published with it. Lumina maintains an archive of every Terms Release and will provide any release to the Customer on request.

Which release governs. The Terms Release in force between the parties at the time of the relevant act, omission, incident or claim governs that act, omission, incident or claim. A later release does not govern something that happened before it took effect.

Supersession. When the Customer accepts a new Terms Release, that release supersedes all earlier releases from the date of acceptance onwards, in respect of matters arising from that date. Acceptance of a new release does not vary, waive or release anything that accrued under an earlier release.

Record. Lumina retains an Acceptance Record for every release the Customer accepts, as described in Section 1A.7.

18.6 How Lumina Gives Notice of Changes

Lumina gives notice of a material or major change by email to the Customer's notice address recorded in the Service Confirmation. Lumina will also publish the change on the relevant page of its website, and will show a notice in the Service where in-product notification is available. Email to the notice address is the operative channel, and a change is validly notified if that email is sent, whether or not an in-product notice is shown.

The Customer must keep its notice address current. Section 20.6 applies to notices under this Section.

19 Governing Law, Disputes and Jurisdiction

19.1 Governing Law

This agreement, and any dispute or claim arising out of or in connection with it (including non-contractual disputes or claims), is governed by and construed in accordance with the laws of England and Wales.

19.2 Escalation

If a dispute arises, either party may give the other written notice of the dispute, setting out what it is about and what the party wants. Within 14 days of that notice, each party shall nominate a senior representative with authority to settle the dispute, and those representatives shall meet, in person or remotely, and negotiate in good faith to resolve it. Each party shall provide the other with the information reasonably needed for that discussion.

19.3 Mediation

If the dispute has not been resolved within 30 days of the notice under Section 19.2, either party may propose mediation. Where both parties agree to mediate, the mediation will be conducted by a mediator appointed by the Centre for Effective Dispute Resolution (CEDR) under CEDR's Model Mediation Procedure current at the time. Each party bears its own costs, and the mediator's fees are shared equally. Mediation is optional and neither party is obliged to agree to it.

19.4 Court Proceedings

The courts of England and Wales shall have exclusive jurisdiction to settle any dispute or claim arising out of or in connection with this agreement.

Sections 19.2 and 19.3 do not prevent either party from:

• Applying for interim or injunctive relief at any time;
• Bringing a claim for non-payment of undisputed sums;
• Bringing a claim to protect its intellectual property or Confidential Information; or
• Bringing proceedings where waiting would cause a limitation period to expire.

Nothing in this Section extends or shortens a limitation period.

19.5 Complaints

Nothing in this Section prevents the Customer or a data subject from making a complaint to the Information Commissioner's Office or any other competent regulator.

20 General Provisions

20.1 Force Majeure

Neither party shall be liable for any failure or delay in performing its obligations under these Terms to the extent that such failure or delay is caused by circumstances beyond that party's reasonable control, including (without limitation) natural disasters, acts of government, pandemic, epidemic, war, terrorism, civil unrest, power failure, internet disruption, or failure of third-party infrastructure providers. The affected party shall promptly notify the other party and use reasonable efforts to mitigate the impact. If a force majeure event continues for more than 60 consecutive days, either party may terminate this agreement by written notice, and Section 15 applies.

An inability to pay is not a force majeure event.

20.2 Severability

If any provision of this agreement is found by a court of competent jurisdiction to be invalid, illegal, or unenforceable, that provision shall be modified to the minimum extent necessary to make it valid, legal, and enforceable. If such modification is not possible, the provision shall be severed from this agreement without affecting the validity and enforceability of the remaining provisions.

20.3 No Waiver

A failure or delay by either party to exercise any right or remedy under these Terms shall not constitute a waiver of that right or remedy. A single or partial exercise of any right or remedy shall not prevent any further exercise of that or any other right or remedy.

20.4 Entire Agreement

This agreement, consisting of the documents listed in Section 1A.4 (namely the Service Confirmation, these Terms, including Schedule 1 and Schedule 2, the Data Processing Agreement, the Acceptable Use Policy, the AI Usage Policy, the Service Level Agreement and the Sub-processor Schedule), is the entire agreement between the parties with respect to the subject matter hereof and supersedes all prior or contemporaneous agreements, understandings, and representations, whether written or oral.

The Privacy Policy is not part of this agreement. It is a transparency notice, as explained in Section 1A.4.

Each party acknowledges that in entering into this agreement it has not relied on any statement, representation or assurance that is not set out in this agreement. Nothing in this Section limits liability for fraud or fraudulent misrepresentation.

20.5 Assignment

The Customer may not assign or transfer these Terms or any rights or obligations hereunder without Lumina's prior written consent, which shall not be unreasonably withheld where the assignee is a successor to the Customer's dental practice business. Lumina may assign these Terms in connection with a merger, acquisition, or sale of all or substantially all of its assets, provided that the assignee agrees to be bound by these Terms. Lumina will notify the Customer of any such assignment.

20.6 Notices

Notices under this agreement shall be in writing and sent by email or by first-class post to the addresses recorded for each party. Notices to the Customer are sent to the notice address in the Service Confirmation. Notices to Lumina are sent to:

A notice sent by email is deemed received on the next business day after sending. A notice sent by first-class post is deemed received two business days after posting. A notice of termination, of a material or major change, or of a claim, must be sent by email and confirmed by post if the recipient asks.

20.7 Third-Party Rights

These Terms do not confer any rights on any person or party other than the parties to these Terms and their respective successors and permitted assigns. The Contracts (Rights of Third Parties) Act 1999 is excluded.

20.8 No Partnership or Agency

Nothing in this agreement creates a partnership, joint venture, agency or employment relationship between the parties.

20.9 Interpretation

Section headings are for convenience and do not affect interpretation. "Including" and "for example" are not words of limitation. References to a statute include that statute as amended or replaced. Where a period is expressed in days, it means calendar days unless "business days" is stated, and a business day is a day other than a Saturday, Sunday or English public holiday.

20.10 Non-Solicitation of Staff

During the Subscription Term and for 12 months after its end, neither party shall, without the other party's prior written consent, solicit or induce any employee or contractor of the other party who has been materially involved in the provision or receipt of the Service to leave that other party's employment or engagement. This Section does not restrict either party from responding to a genuine, general recruitment advertisement not specifically targeted at the other party's personnel.

21 Contact Information

For questions about these Terms or the Service, please contact:

S1 Schedule 1. Plan Limits (Starter Practice)

This Schedule is part of these Terms. It sets out the Starter Limits, how each is measured, and what Lumina will do before restricting anything. The Plan Limits for other plans are set out in the Service Confirmation or in the schedule for that plan.

1. The Starter Limits

Because no single file may exceed 10 MB on the Starter Practice plan, large imaging files, for example CBCT volumes, cannot be stored on this plan. The Customer should keep such files in its imaging system or move to a plan that supports them.

2. How Each Limit Is Measured

Active Patient means a patient record in the Customer's organisation that meets any of the following:

• (a) an appointment attended within the previous 18 months;
• (b) a booked future appointment;
• (c) an outstanding balance owed to the practice; or
• (d) an open treatment plan.

Archived patient records do not count as Active Patients. The Active Patient count is assessed on a daily snapshot.

New Patient means a patient record first created in the Customer's organisation during the current calendar month (UK time), through any route, including staff entry, public online booking, patient portal registration and the API. Each record counts once. The following do not count as New Patients:

• (i) records imported through a bulk migration agreed with Lumina, which count towards the Active Patient limit only;
• (ii) duplicate records merged in the same calendar month, which count once between them;
• (iii) records created in error and removed in the same calendar month; and
• (iv) test or demonstration records created or flagged by Lumina.

Reactivating an archived patient record is not a New Patient. The New Patient count resets at 00:00 UK time on the first day of each calendar month. Measurement is by calendar month, not by rolling 30 days.

Clinician means an active user account assigned a clinical role that can be scheduled to deliver treatment, for example dentist, hygienist or therapist.

Team User means any other active staff account.

Patient portal accounts count towards neither the Clinician nor the Team User limit.

Storage means the total size of files, documents and images stored for the Customer's organisation, measured at least daily. Clinical database records, audit logs and Lumina's own backups do not count towards the Customer's storage limit.

Daily AI usage allowance is measured in usage units, as described in Section 6.4 of these Terms, and applies to each Practice. It resets at 00:00 UK time each day and does not carry over.

3. What Happens as the Customer Approaches a Limit

Lumina provides usage meters in the Service and will notify the Customer at 75%, 90% and 100% of the Active Patient limit and of the monthly New Patient limit.

4. What Happens at a Limit

Active Patients. On reaching 100% of the Active Patient limit, the Customer has a grace period of 14 days. After the grace period, Lumina may block the creation of new patient records until the Customer's Active Patient count is back within the limit or the Customer moves to a plan with a higher limit.

New Patients in a month. On reaching 100% of the monthly New Patient limit, Lumina may block the creation of further new patient records until the start of the next calendar month.

Storage and file size. On reaching the storage limit, Lumina may prevent further uploads until the Customer reduces its stored data or moves to a plan with more storage. A single file over the upload limit will not be accepted.

Clinicians and Team Users. On reaching a user limit, Lumina may prevent the creation of further accounts of that type until the Customer deactivates an existing one or moves to a plan with a higher limit.

AI allowance. Section 6.4 of these Terms applies.

5. What Lumina Will Never Do

Lumina will never do any of the following because a Starter Limit has been exceeded:

• Restrict access to patient records or other Customer Data the Customer has already created
• Put the Customer's account into read-only mode
• Restrict or delay a data export
• Delete Customer Data
• Move the Customer to a paid plan, or start charging the Customer; or
• Charge retrospectively for use above a limit

Moving to a paid plan always requires the Customer's express action.

6. Emergency Care Override

If a patient needs urgent or emergency care and the Customer is at or over the Active Patient or New Patient limit, the Customer may still create the patient record and record the care. The Service provides an emergency override for this purpose. Records created under the override are flagged so that the parties can discuss the Customer's plan afterwards. Lumina will not use the override as a ground for suspension, and will not charge for it.

7. Monitoring and Honesty About Enforcement

Some Starter Limits are monitored by Lumina rather than enforced automatically in the Service. Where that is the case, Lumina will still give the notifications in paragraph 3 and the grace period in paragraph 4 before restricting anything, and paragraph 5 still applies in full. Lumina will not treat the absence of an automated block as a licence to charge retrospectively or to restrict access.

8. Changing a Plan Limit

A reduction in a Starter Limit is a material change under Section 18.2 of these Terms and requires 30 days' notice. An increase in a Starter Limit is a minor change. Changes to a Plan Limit never take effect retrospectively.

S2 Schedule 2. Documents Forming This Agreement and Order of Precedence

Where two documents at rank 4 conflict with each other, these Terms resolve the conflict, and where a rank 4 document conflicts with these Terms, these Terms prevail. *Because the Sub-processor Schedule is incorporated into the DPA, a conflict about Sub-processors specifically is resolved at rank 2, under the DPA, not at rank 4 (Section 1A.5).