Terms and Conditions for Orthodontists

Issued edition:

Sri Lanka

Version

4.2 — Sri Lanka

Issued

24 August 2026

Issued for

Sri Lanka — Part 1 of Schedule 2

Further markets

Added as Parts of Schedule 2, without changing these Terms

Annexes

A — Data Processing Addendum · B — Credential Declaration

Pairs with

Master Terms and Conditions — Patient

A master document. These Terms are drafted to apply globally. The Application section sets out how they operate alongside the country-specific supplements in Schedule 2, which is where local law, local fees and local professional-regulatory requirements are recorded. Adding a country means adding a Part to Schedule 2, not rewriting these Terms.

How these Terms are organised. The numbered clauses apply to every Practice, wherever it is. Schedule 2 holds the country-specific detail — the governing law, the fees and currency, the professional register used for verification, and the payment methods. This edition issues Part 1, Sri Lanka. Further countries are added as new Parts without changing the clauses.

Annex A is the Data Processing Addendum and forms part of this agreement. Annex B is the Credential Declaration each Practitioner completes.

Terms and Conditions — Orthodontist

These Master Terms and Conditions ("Terms") govern access to and use of the Braceys orthodontist role within the Braceys iOS application and the Braceys website portal (together, the "Platform") by dental professionals and practices ("you", "Practitioner", "Practice"). The Platform is operated by SimLanka (Private) Limited, registered number PV 10901, registered office Ranmuthugala Estate, Kadawatha 11850, Sri Lanka ("Braceys", "we", "us"). By creating an orthodontist account you accept these Terms for yourself and on behalf of your Practice. If you lack authority to bind the Practice, or do not agree, do not use the Platform.

Application of these Terms

App.1 These are master terms. They apply to every Practitioner and Practice, in every country in which Braceys is made available, and they are the same for everyone.

App.2 Schedule 2 contains a Part for each country in which Braceys operates, recording the governing law and forum, the fees and currency, the professional register against which verification is carried out, and any additional local requirement. Part 1 — Sri Lanka is the only Part issued in this edition.

App.3 Where your country's Part of Schedule 2 conflicts with the body of these Terms, the Part prevails, but only to the extent of the conflict and only for Practices in that country.

App.4 Nothing in these Terms or in any Part overrides mandatory local law applicable to your Practice, including your professional-regulatory and data-protection obligations.

App.5 Adding a country adds a Part to Schedule 2. It does not change these Terms.

1. Definitions

"Patient" means an individual under your clinical care holding a Braceys patient account linked to you. "Care Link" means an active connection between your account and a Patient. "Link Credentials" means invite codes, share tokens, and link requests. "Patient Data" means personal data relating to a Patient processed through the Platform, including 2D progress photos and alignment metadata, 3D scan models (USDZ/GLB) and capture metadata, time-lapse video, wear sessions and derived statistics, treatment plan and tray records, messages, and (where those features are provided) appointments and appointment notes. "Active Patient" means a linked Patient who opened the App at least once during the calendar month, as described in clause 14.5. "Retainer Patient" means a Patient whose active treatment has ended and who remains linked to you in retention. "DPA" means the Data Processing Addendum at Annex A. "Regulator" means the dental regulatory body governing your practice.

2. Nature of the Platform — what Braceys is and is not

2.1 The Platform is a non-medical visibility, communication, and documentation tool. It surfaces Patient-uploaded imagery, wear-time data, and habit insights, provides messaging, renders progress documentation, and provides such other tools as are made available from time to time.

2.2 Braceys is not a medical device, does not provide clinical decision support, and does not diagnose, prescribe, or recommend treatment. Wear-time insights, statistics, charts, and imagery are descriptive and organisational only.

2.3 Braceys gives no advice and does not practise dentistry. It is a facilitating technology platform. Every item of advice, instruction and guidance reaching a Patient through the Platform — including the treatment plan, the treatment mode, and any triage guidance — originates from you. Braceys reproduces and delivers it; it does not author, review, verify, endorse or take responsibility for it, and it does not supervise your clinical decisions.

2.4 Data limitations you must understand before relying on anything shown. Patient- supplied imagery and data may be incomplete, delayed, mis-captured, poorly lit, mis- aligned, or manually edited. Wear sessions can be entered and edited by the Patient by hand and are self-reported, not device-verified. Reconstructed 3D models are approximations produced on the Patient's device and are not diagnostic-grade imaging. Nothing on the Platform is a substitute for your own examination.

3. Eligibility and mandatory credential verification

3.1 You warrant that you are, and will remain, a dental or orthodontic professional who is duly qualified, licensed, and currently registered with your Regulator, practising within your scope of practice.

3.2 Verification is mandatory and precedes any access to Patient Data. You must provide, and keep current, your full name, qualification, Regulator, and registration number, together with the verification evidence we request namely: your country of registration; your current registration certificate; your awarding university; your practice name and address; your professional indemnity insurer and policy number, with an uploaded copy of the policy; your written confirmation that your indemnity covers remote and technology-mediated care and that you are subject to no current restriction, condition, suspension or investigation; and your signed name and the date of that declaration. Braceys verifies the declared registration against the relevant professional register at sign-up. Until verification is complete, your account cannot invite a Patient, establish a Care Link, set a treatment plan, view any Patient Data, or send any message. We may refuse, suspend, or terminate accounts we cannot verify, and we re-verify at 6-monthly intervals.

3.3 You must notify us immediately if your registration lapses, is suspended, restricted, or subject to conditions or investigation, or if your indemnity cover ends. Your access may be suspended on notice of any of these.

3.4 You warrant that you hold and maintain adequate professional indemnity or liability cover which extends to remote and technology-mediated interactions with patients. Some indemnity policies exclude or limit telehealth — you are responsible for confirming your cover applies.

3.5 Practices are responsible for ensuring every individual they permit to use the Platform meets clauses 3.1 to 3.4.

4. Remote care, teledentistry, and regulatory compliance

4.1 You acknowledge that giving advice or making clinical decisions about an identified patient remotely generally constitutes the practice of dentistry in the jurisdictions where you and your patients are located, and is regulated as such.

4.2 You are solely responsible for complying with your Regulator's requirements for remote care, including but not limited to: requirements for face-to-face clinical assessment before or during treatment; valid and ongoing consent; scope of practice; record-keeping; complaints procedures; advertising rules; and any restrictions on direct-to-consumer or remotely supervised orthodontics.

4.3 You must not use the Platform to deliver treatment that your Regulator requires to be delivered, assessed, or supervised in person. The Platform is intended to supplement in- person care, not replace it.

4.4 Cross-border care. If you interact with a patient located in a jurisdiction where you are not registered, you may be practising unlawfully. You are responsible for determining where your patients are located and whether you may lawfully treat or advise them there. Braceys does not assess this for you.

4.5 You will cooperate with any regulatory or lawful request relating to your use of the Platform.

5. Clinical responsibility

5.1 All clinical judgement, diagnosis, treatment planning, monitoring, escalation, and patient safety are solely your responsibility. Braceys is not a party to your clinical relationship.

5.2 You are responsible for the accuracy of every treatment plan you configure — start date, tray count, days per tray, current tray, wear goal, arch, and schedule settings. The plan you set automatically drives the Patient's reminders, tray-change schedule, and timeline. An error in your configuration will produce incorrect instructions to the Patient, and that is your responsibility.

5.3 You are responsible for reviewing Patient uploads with appropriate professional care, for deciding what clinical weight to give them, and for arranging in-person assessment where clinically indicated.

5.4 You must not rely on the Platform to alert you to clinical problems. The Platform performs no clinical triage, prioritisation, or escalation, and will not flag deterioration, non- compliance, or risk.

6. Messaging — professional obligations and limits

6.1 The Platform provides one-to-one realtime text messaging with linked Patients, with read receipts and push notifications.

6.2 Messaging is not monitored, moderated, triaged, or archived independently by Braceys, and is not an emergency or urgent-care channel. We do not guarantee delivery, timing, or availability.

6.3 You must tell your Patients, in your own patient information, what messaging is for, your expected response times, your availability, and what they must do in an emergency instead. Read receipts may create a patient expectation that you have reviewed and acted on a message — manage that expectation explicitly.

6.4 Messages are clinical communications. Where they contain clinical content, you are responsible for recording them in your own clinical records and retaining them under your professional and legal obligations, independently of the Platform. Do not treat Braceys as your system of record.

6.5 Minors. Many aligner patients are children. You are responsible for conducting messaging with minors in line with your safeguarding obligations, for involving parents or guardians as required, and for following your Regulator's guidance on communicating with children.

6.6 You must not use messaging for marketing, solicitation, or promotion of products or services beyond the Patient's care, or in breach of advertising rules applicable to your profession.

7. Linking to Patients

7.1 Care Links are created via invite codes, share tokens, and link requests, initiated by either side, and may be accepted, declined, cancelled, or ended.

7.2 You must satisfy yourself of the identity of any person you link with and must only link with individuals who are genuinely your patients. Do not link on the basis of a code alone.

7.3 Treat Link Credentials as confidential. Do not publish invite codes or share tokens, or transmit them over insecure channels. Notify us immediately at teambraceys@outlook.com of any exposure.

7.4 You must end a Care Link promptly when the care relationship ends, and must not access data of individuals for whom you have no current clinical relationship.

7.5 Ending a Care Link with a Patient under 18. A Patient under 18 cannot use the App without a clinic. If you end a Care Link with a minor Patient, that Patient cannot continue independently: their account moves to a limited state in which their record is preserved but

nothing new is collected, until a new Care Link is established or they turn 18. Before ending a Care Link with a minor, consider whether you should instead sponsor their retention under clause 14.6, and tell the Patient and their guardian what you have decided.

8. Accounts, Authorised Users, and security

8.1 You are responsible for all activity on your account and for the acts and omissions of anyone you permit to use it.

8.2 Accounts must not be shared. Each individual professional requires their own account. Remove access promptly for anyone who leaves your Practice.

8.3 You must use appropriate device security (passcode, encryption, auto-lock) on any device used to access Patient Data, and must report suspected compromise to us without delay.

8.4 How an account is created. You give us an email address and choose a password. We send a one-time code to that address, which you enter to confirm the address is yours; the account is not usable until that verification is complete, and it cannot access Patient Data until credential verification under clause 3.2 is also complete. Verification emails are delivered for us by Resend. There is no third-party or social sign-in.

8.5 Changing your email address. If you change the email address on your account, you enter the new address and we send a new one-time code to it. The change does not take effect until you enter that code.

8.6 Signing in afterwards. Once verified, signing in on any device needs only your email address and your password. We do not send a code each time you sign in. Anyone holding both can therefore sign in to your account and reach Patient Data, which is why clause 8.1 makes you responsible for all activity on it and clause 8.2 prohibits sharing accounts.

8.7 You must use a practice email address you control, and must tell us without delay if it changes or is compromised, since it is how we verify and recover your account.

9. Appointments

9.1 Where the Platform provides an appointment feature, you may set a Patient's next appointment (time, and optionally location and notes), which will appear in the Patient's app with a reminder.

9.2 If and when that feature is provided, the following apply. You remain responsible for your own appointment system, for confirming and communicating changes, and for any consequence of a missed or incorrectly entered appointment. An appointment shown in the Platform is a convenience record only and does not replace your own scheduling, confirmation or recall processes. Notes you enter are visible to the Patient — write them accordingly.

9.3 Nothing in this clause is a commitment that the feature exists or will be provided. Clause 22.1 applies, and we will tell you if it becomes available.

10. Patient consent — your responsibility

10.1 Before adding a Patient or processing their data through the Platform, you must obtain and record all consents and lawful bases required under the law applicable to that Patient, including explicit consent for health data and for biometric data (see clause 10.5).

10.2 Minors — you must obtain valid parental or guardian consent before you invite them. Where a Patient is under 18, or under the age of majority or the applicable age of consent where they live, you must, before inviting that Patient or establishing a Care Link:

• (a) satisfy yourself of the Patient's age;
• (b) identify the person holding parental responsibility or lawful guardianship;
• (c) obtain from that person valid, informed, verifiable consent — to the minor's use of the Platform, to the processing of the minor's personal data including biometric data, and to the minor exchanging messages with you through the Platform; and
• (d) record that consent in your own records, in a form you can produce on request; and
• (e) ensure the Patient's Braceys account is registered to the parent's or guardian's email address, not the minor's. The account verification code is sent to that address, so the guardian activates the account and can sign in to it at any time.

10.3 Braceys relies on you. By inviting a minor Patient, or by accepting a Care Link with one, you represent and warrant that consent complying with clause 10.2 has been obtained and remains in force. Braceys is entitled to rely on that representation, and to assume for all purposes that valid parental or guardian consent exists for every minor Patient on the Platform under an active Care Link. Braceys does not independently verify it. You must notify us without delay if that consent is withdrawn, lapses, or was not validly obtained, and you must produce evidence of it within 7 days of our request.

10.4 You must give each Patient — and, for a minor, their parent or guardian — your own privacy information explaining that their data is processed through Braceys and stored as described in the DPA, the Part of Schedule 2 for your country, and the Braceys Privacy Policy, including that data is hosted in Mumbai, India and may therefore be transferred across borders.

10.5 Biometric data. Braceys classifies 3D scan models and the facial measurements stored with progress photos as biometric data in every market. You must obtain the separate express written consent that classification requires, from the Patient or, for a minor, their parent or guardian, and must not treat consent to treatment or to app use as covering it.

10.6 You must honour Patient requests to withdraw consent, and must not add or retain a Patient on the Platform without a valid basis.

11. Time-lapse and marketing content

11.1 An end-of-treatment before-and-after time-lapse is generated for each completed Patient.

11.2 You have no access to it unless the Patient releases it to you. The time-lapse is the Patient's Content. You cannot view, download, export or share it unless and until the Patient — or, for a minor, their parent or guardian — has given specific, informed, opt-in consent in the App to release it to you. This restriction is enforced by the Platform. Nothing in these Terms entitles you to a Patient's time-lapse, and the Platform will not supply one in the absence of that release.

11.3 Release under clause 11.2 permits you to view and retain the time-lapse. It does not permit you to publish it. Marketing, promotional, testimonial, social media or any other public use additionally requires the Patient's specific, informed, opt-in, documented consent to that use. Consent to treatment, consent to use the app, and release under clause 11.2 are each not consent to marketing.

11.4 Withdrawal. The Patient may withdraw either consent at any time in the App. On withdrawal your access is revoked automatically, and you must immediately cease further use and remove published material so far as you are able. You must confirm to us in writing within 7 days that you have done so.

11.5 You must comply with your profession's advertising rules, including any restriction on before-and-after imagery and testimonials in your jurisdiction, which may prohibit publication even where the Patient has consented.

11.6 You will indemnify Braceys in full for any breach of this clause 11.

12. Data protection roles and the DPA

12.1 You are the controller. Braceys is your processor. In respect of Patient Data processed through the Platform for your clinical purposes, you (or your Practice) act as controller and Braceys acts solely as your processor, processing that data on your documented instructions and subject to the DPA at Annex A. Braceys does not determine the purposes of that processing.

12.1A Separately, and only for operating, securing, supporting and lawfully administering the Platform itself — account creation and authentication, security and abuse prevention, service integrity, billing, and legal compliance — Braceys acts as an independent controller, as described in the Braceys Privacy Policy.

12.1B Where a patient uses the App with no Care Link, there is no Practice and you have no role. In that case the patient is the controller of their own record and Braceys acts as their processor, as set out in the Patient Terms. Patients under 18 cannot use the App without a Care Link, so this never applies to a minor. Your responsibility under these Terms begins when a Care Link is established and ends when it is ended.

12.2 Two-sided content. Messages, clinician-set plans and, where that feature is provided, appointment notes are generated by both parties. The purpose of Patient messages is to

raise questions or requests about the treatment plan, or other questions for you about the Patient's treatment. That purpose is determined by you as the treating professional, and accordingly, as between you and Braceys, you are the controller of that content; it forms part of the clinical record you are responsible for maintaining under clause 13.1. The Patient retains their own rights in respect of their personal data, including the messages they send, and may exercise those rights as described in the Braceys Privacy Policy.

12.3 Each party will comply with applicable data-protection law, including the Sri Lanka Personal Data Protection Act No. 9 of 2022 as amended and, in respect of Patient Data while it is hosted in India, the India Digital Personal Data Protection Act 2023 and the DPDP Rules 2025.

12.4 You acknowledge Patient Data is hosted in Mumbai, India, with cross-border transfers handled as set out in the DPA.

13. Your records and export on termination

13.1 Braceys is not your clinical record system. The Platform is a patient-engagement, visibility and documentation tool, not a system of record. You must maintain your own clinical records to the standard your Regulator requires, and must not rely on the Platform for clinical-record retention.

13.2 Export before access ends. On termination you should export or otherwise secure any data you are required to retain before your access ends. We will retain your Practice's access to the Patient Data associated with your Practice for 30 days after termination to allow you to do so, after which that data is deleted in accordance with paragraph A8 of the DPA.

13.3 Form of export. We will make an export available by a reasonable means, which may include in-Platform export, a file transfer, or a copy supplied on request, and we will tell you what is available at the time. Where an export is made available, Patient Data is ordinarily provided in a common, machine-readable form — for example, image and 3D-scan files together with a structured data file, such as JSON, containing the associated treatment history. That description is illustrative, and we do not warrant any particular export format or mechanism. Any such export is a personal, non-clinical record. It is not a certified clinical dental record, and it does not discharge your obligation under clause 13.1 to keep your own records.

14. Fees

14.1 Patients are not charged while their Practice is paying. The Practice is the paying customer. Your Practice pays a one-time onboarding and training fee (unless waived under clause 14.7), a monthly base fee, and a monthly surcharge for Active Patients above the number included in the base fee. The amounts for your country are set out in the Part of Schedule 2 for your country, and are published.

14.2 Free tier. Up to 5 Active Patients, free and permanently, with no onboarding or training included. A paid plan applies from the first month in which you have more than 5 Active Patients.

14.3 Base fee. A fixed monthly fee which includes the first 15 Active Patients at no additional charge.

14.4 Surcharge. A monthly charge for each Active Patient above 15, at the banded rates in Schedule 2. The rate falls as the number of Active Patients rises, and each band applies only to the Active Patients falling within it.

14.5 What counts as an Active Patient. An Active Patient is a linked Patient who opened the App at least once during the calendar month. A Patient who is enrolled but did not open the App in that month is not counted and not billed. You may therefore enrol Patients freely. Retainer Patients are not Active Patients; they are counted separately and charged at the lower Retainer Patient rate in Schedule 2.

14.6 Retainer Patients. A Retainer Patient is a Patient whose active treatment has ended and who remains linked to you in retention. Where you sponsor a Retainer Patient, you pay the Retainer Patient rate in Schedule 2. Where you do not, the Patient may subscribe directly under clause 14.10, or keep the free reduced record described in the Patient Terms.

14.7 Onboarding and training fee, and the commitment waiver. The onboarding and training fee is a one-time charge covering the training and set-up we provide when your Practice joins. It is waived in full if you commit to a minimum term of 12 months. If you do not commit to that term, the fee is payable on sign-up. If you commit and then terminate before the end of the 12-month term other than for our material breach, the waived fee becomes payable.

14.8 Billing and payment. The base fee and any surcharge are billed monthly in arrears, on an invoice issued after the end of each calendar month, and are payable within 30 days of the invoice date. Each invoice shows the Active Patient count and the band applied, so that you can check it against the published rates. You may pay by any of the methods listed in the Part of Schedule 2 for your country, and you may change between them at any time.

14.9 Annual prepayment. If you prepay twelve months of the base fee in advance, two of those months are free. Surcharges remain billed monthly in arrears.

14.10 Patients who pay us directly. A Patient who has no linked Practice, or whose treatment has ended without your sponsorship, may subscribe to the App directly at the price in Schedule 2, or take a retainer plan at the annual price in Schedule 2. That is a separate contract between Braceys and the Patient. You are not liable for it and you receive no part of it.

14.11 If you pass the cost on to your patients, you must tell them. You may recover what you pay us through the price you quote for treatment. If you do, that is a matter between you and your Patient, and you remain responsible for describing your own charges accurately and in accordance with the consumer, advertising and professional-conduct rules that apply to you. You must not represent our fees as a charge levied by Braceys on the Patient, and you must not describe the Platform as compulsory where it is not.

14.12 Price changes. We will give at least 30 days' written notice of any change to published prices. A change does not apply to a period you have already prepaid, and does not apply during any minimum term at a rate we have agreed to lock.

14.13 Future charging models. We may introduce additional or alternative charging models. We will give at least 30 days' notice, and no new model will apply to your Practice unless you accept it.

14.14 Unless stated otherwise, fees exclude applicable taxes, which are your responsibility.

14.15 Suspension or termination for non-payment does not relieve you of your clinical, record-keeping or data-protection obligations to your Patients, and clause 13.2 applies. We will not withhold a Patient's own access to their record because of a dispute between us about your fees.

15. Acceptable use

You must not: (a) use the Platform outside a genuine clinical relationship; (b) permit unregistered or unqualified persons to use your account or provide care through it; (c) attempt to re-identify, scrape, bulk-export, or repurpose data beyond providing care; (d) reverse engineer, decompile, or interfere with the Platform or its access controls, except to the extent this restriction is prohibited by law; (e) probe or attempt to bypass authentication or row-level access controls; (f) use the Platform as a bureau or resell access without our written consent; (g) use Patient Data for research, publication, or product development without a separate lawful basis and agreement.

16. Intellectual property

16.1 The Platform, software, designs, and trademarks are owned by Braceys or its licensors. We grant your Practice a limited, non-exclusive, non-transferable, revocable licence to use the orthodontist role for internal clinical purposes during the term.

16.2 Nothing transfers ownership of Patient Data to Braceys beyond the licence needed to operate the Platform. As between you and Braceys, clinical records you generate remain yours.

17. Confidentiality

Each party will keep the other's confidential information secret and use it only to perform these Terms, except where disclosure is legally required. Patient Data is additionally governed by the DPA and by your professional duty of confidentiality.

18. Warranties and disclaimers

18.1 We will provide the Platform with reasonable skill and care. Otherwise, to the maximum extent permitted by law, it is provided "as is" and "as available", without warranties including fitness for a particular purpose, accuracy, or uninterrupted operation.

18.2 We do not warrant that any data, image, model, statistic, or output is clinically accurate, complete, timely, or fit for any clinical purpose, nor that messages or notifications will be delivered.

19. Limitation of liability

19.1 To the maximum extent permitted by law, Braceys is not liable for any clinical decision, diagnosis, treatment, patient outcome, regulatory finding against you, or for indirect, incidental, special, consequential, or punitive loss, or loss of profit, goodwill, or data.

19.2 Cap on liability. Subject to clause 19.3, the total aggregate liability of Braceys to you and your Practice arising out of or in connection with these Terms, the DPA and the Platform — whether in contract, tort (including negligence), breach of statutory duty, restitution or otherwise, and however many claims are made — is limited to LKR 5,000 (five thousand Sri Lankan Rupees). This is a single aggregate cap on all claims and is not a per-claim, per-Patient, per-case or annual limit. It applies regardless of the number of Patients you have on the Platform, regardless of the fees you have paid, and regardless of whether any Patient concerned is a minor.

19.3 What the cap does not cover. Nothing in these Terms excludes or limits any liability that cannot lawfully be excluded or limited, including liability for death or personal injury caused by negligence and for fraud or fraudulent misrepresentation. Where applicable law does not permit the cap in clause 19.2 to apply, that clause applies to the maximum extent that law permits.

19.4 You acknowledge that the allocation of risk in this clause 19 is a material basis on which the Platform is made available at the fees in clause 14, and that your own professional indemnity cover under clause 3.4 — not Braceys — is the primary protection against claims arising from patient care.

20. Indemnity

You will indemnify Braceys against claims, losses, fines, regulatory penalties and costs arising from: (a) your clinical acts or omissions; (b) your breach of these Terms or the DPA; (c) practising without valid registration, scope, or indemnity, or in a jurisdiction where you are not authorised; (d) failure to obtain required Patient consents or lawful bases, including any failure to obtain valid verifiable parental or guardian consent under clause 10.2, or any inaccuracy in the representation you give under clause 10.3; (e) misuse of Patient marketing content or breach of clause 11; or (f) your breach of safeguarding or confidentiality obligations. This indemnity is not subject to the cap in clause 19.2.

21. Suspension and termination

21.1 Either party may terminate on 30 days' notice; either may terminate immediately for material breach.

21.2 We may suspend or terminate immediately on loss, suspension, or restriction of your registration; credible patient-safety or safeguarding concern; suspected unauthorised access; non-payment; or where required by law.

21.3 On termination your licence ends. Handling, export, and deletion of Patient Data are governed by the DPA and clause 13.

22. Changes, governing law, and contact

22.1 We may update these Terms with reasonable notice of material changes.

22.2 These Terms are governed by the laws of the Democratic Socialist Republic of Sri Lanka, with the courts of Colombo, Sri Lanka having exclusive jurisdiction. Nothing overrides mandatory local law applicable to your Practice, including professional-regulatory and data-protection requirements.

22.3 Contact: SimLanka (Private) Limited, Ranmuthugala Estate, Kadawatha 11850, Sri Lanka, teambraceys@outlook.com, +94 114 348 939.

Annex A — Data Processing Addendum

A1. Roles. For Patient Data processed on your documented instructions, the Practice is controller or fiduciary and Braceys is processor. Braceys is an independent controller only for platform operation, security, abuse prevention, and legal compliance.

A2. Subject-matter, duration, nature, purpose. Braceys processes Patient Data solely to operate the Platform: authentication, storing photos, 3D models, time-lapse, wear sessions, plans and messages, and, where those features are provided, appointments and appointment notes; running plan-driven scheduling; delivering notifications; and making data available to you. Duration: for the term plus the retention periods in A8.

A3. Categories of data subject and data. Data subjects: Patients (including minors) and their guardians. Data: as defined in clause 1, including health-related and biometric- adjacent facial data.

A4. Braceys' obligations. Process only on documented instructions; ensure personnel are bound by confidentiality; implement appropriate technical and organisational measures (encryption in transit and at rest, authentication, per-user row-level access controls); assist with data-subject requests, DPIAs, and consultations; notify breaches per A7; and not engage sub-processors except per A5.

A5. Sub-processors. You authorise Braceys to engage the following sub-processors in providing the Platform: Supabase, Inc. (authentication, PostgreSQL database, file storage, realtime messaging and edge functions); Amazon Web Services, Inc. (the underlying cloud infrastructure on which Supabase operates); Apple Inc. (APNs push notification delivery on iOS); Google LLC (Firebase Cloud Messaging on Android, and Google-hosted libraries used to render 3D scans in the web portal); and Cloudflare, Inc. (hosting, DNS and content delivery for the Braceys website and web portal); and Resend, Inc. (delivery of transactional email, including account verification codes). Braceys maintains a current sub- processor list and will give 30 days' notice of any change, with a right to object.

A6. Location and international transfers. Patient Data is hosted in Mumbai, India. Sri Lankan law does not restrict the transfer of Patient Data out of Sri Lanka, and Patient Data may lawfully be stored and processed in India. While it is in India it is subject to the India Digital Personal Data Protection Act 2023, and Braceys will comply with that Act in respect of it. Braceys will tell you before it moves Patient Data to a different country.

A7. Security incidents. Braceys will notify you without undue delay after becoming aware of a personal-data breach affecting Patient Data, with the information reasonably available, and will assist your notifications to regulators and data subjects.

A8. Retention, return, and deletion. On termination or your written request, Braceys will return or delete Patient Data in its control within 30 days, subject to legal retention requirements. This does not affect your independent clinical record-keeping obligations. Backup purge cycle: 7 days.

A9. Patient rights. Braceys will assist you in responding to Patient requests to access, correct, delete, port, or object, and to withdraw consent.

A10. Audit. Braceys will make available information reasonably necessary to demonstrate compliance and allow audits on 30 days' written notice, no more than once in any 12-month period except following a personal-data breach, and subject to confidentiality.

Annex B — Credential Declaration

To be completed and kept current by each Practitioner. It is checked by Braceys against the relevant professional register at sign-up, and re-verified every 6 months.

Field Entry

Full name

Qualification

Regulator

Registration number

Country or state of registration

Practice name and address

Indemnity provider and policy number

Confirmation that indemnity covers remote and technology-mediated care

Confirmation of no current restriction, condition, suspension or investigation

Signature

Date

Schedule 2 — Country Parts

A Part is issued for each country in which Braceys operates and applies to Practices in that country under paragraph App.2. This edition issues Part 1 — Sri Lanka only. Fees are exclusive of tax unless stated, and may change on notice under clause 14.12.

Part 1 — Sri Lanka

Component Price Notes

Free tier LKR 0 Up to 5 Active Patients. No onboarding or training included.

Onboarding and training (clause 14.7) LKR 25,000 One-time. Waived on a 12-month commitment.

Base fee (clause 14.3) LKR 12,500 per Includes the first 15 Active Patients month

Surcharge — Active Patients 16 to 40 LKR 450 Per Active Patient per month

Surcharge — Active Patients 41 to 100 LKR 350 Per Active Patient per month

Surcharge — Active Patients 101 and above LKR 250 Per Active Patient per month

Retainer Patients (clause 14.6) LKR 250 Per Retainer Patient per month, where sponsored by the Practice

Patient direct subscription (clause 14.10) LKR 950 per Paid by the Patient, not the Practice month

Patient retainer plan (clause 14.10) LKR 3,900 per year Paid by the Patient, not the Practice

Item Position for Practices in Sri Lanka

Governing law and forum The laws of Sri Lanka; the courts of Colombo

Currency Sri Lankan Rupees (LKR)

Liability cap (clause 19.2) LKR 5,000

Professional register for verification              The Dental Register maintained by the Sri Lanka Medical
    (clause 3.2)                                        Council under the Medical Ordinance

Payment methods You may pay by Onepay or LankaQR — your Practice chooses which, and may change between them at any time. We may add or withdraw a payment method on notice, and will not withdraw the last remaining method available to you without offering an alternative.

Parts 2 onwards — further markets

A Part will be issued before Braceys is made available in any further country, settled with local counsel and with an adviser on dental professional regulation in that market. Each Part must record local fees and currency, governing law and forum, the professional register used for verification, local advertising restrictions on patient imagery, and any additional data-protection requirement. Adding a Part does not change these Terms.

Braceys — Terms and Conditions for Orthodontists. Version 4.2, issued 24 August 2026 for Sri Lanka. SimLanka (Private) Limited, registered number PV 10901, Ranmuthugala Estate, Kadawatha 11850, Sri Lanka. These Terms should be read together with the Braceys Privacy Policy and the Braceys Terms and Conditions for Patients.