TERMS AND CONDITIONS

Product: nxtDMD

Provider: NxtStep IT Solutions

Effective Date: September 28, 2026

Last Updated: September 28, 2026

These Terms and Conditions ("Terms") constitute a legal agreement between NxtStep IT Solutions ("NxtStep," "Company," "we," "us," or "our") and the dental clinic, dental practice, dentist, organization, or other entity subscribing to or using nxtDMD ("Customer," "Clinic," "you," or "your").

nxtDMD is a cloud-based dental practice management platform that provides tools for patient management, appointments, dental records, dental imaging, X-rays, 3D files, billing, online payments, communications, and related practice-management functions.

By creating an account, accepting these Terms electronically, subscribing to nxtDMD, or using any part of the Service, you agree to these Terms.

1. DEFINITIONS

For purposes of these Terms:

1. "nxtDMD" means the software platform, website, applications, APIs, features, and related services provided by NxtStep IT Solutions.
2. "Customer Data" means information, records, files, documents, images, patient information, appointment information, billing information, and other information submitted, uploaded, entered, or generated by the Customer or its Authorized Users through nxtDMD.
3. "Patient Data" means personal information relating to patients that is processed through nxtDMD.
4. "Authorized User" means an individual authorized by the Customer to access nxtDMD.
5. "Subscription" means the paid or trial subscription selected by the Customer.
6. "Service" means nxtDMD and related services provided by NxtStep IT Solutions.

2. DESCRIPTION OF nxtDMD

Depending on the Customer's subscription, nxtDMD may provide:

1. Patient management and electronic dental records
2. Dental charts and odontograms
3. Treatment planning
4. Clinical notes
5. Appointment scheduling
6. Online appointment requests
7. Patient reminders and notifications
8. Dental photographs
9. X-rays and radiographic files
10. 3D dental scans and digital dental models
11. Supported files such as DICOM, STL, OBJ, PLY, JPG, PNG, PDF, or other formats
12. Document storage
13. Billing and invoicing
14. Online patient payments
15. Payment transaction records
16. Staff and user management
17. Reports and analytics
18. Inventory management
19. Third-party integrations
20. Other features made available by NxtStep from time to time

Features may vary depending on the Customer's subscription plan.

nxtDMD is a software platform and does not itself provide dental diagnosis, treatment, medical advice, or other professional healthcare services.

3. ELIGIBILITY AND AUTHORITY

The Customer represents that:

1. It is legally capable of entering into this agreement;
2. The person accepting these Terms has authority to bind the Customer, where applicable;
3. Information supplied during registration is accurate;
4. nxtDMD will be used only for lawful purposes; and
5. The Customer will comply with applicable Philippine laws and regulations.

4. CUSTOMER ACCOUNT

The Customer must provide accurate and current account information.

The Customer is responsible for:

1. Protecting account credentials;
2. Maintaining appropriate password security;
3. Managing Authorized Users;
4. Assigning appropriate access permissions;
5. Reviewing user access periodically;
6. Removing unauthorized or inactive users; and
7. Reporting suspected unauthorized access to NxtStep promptly.

The Customer shall not share individual login credentials where individual user accounts are available.

5. AUTHORIZED USERS

The Customer may provide access to dentists, dental hygienists, dental assistants, receptionists, administrators, accountants, managers, and other authorized personnel.

The Customer is responsible for ensuring that Authorized Users:

1. Access only information necessary for their role;
2. Maintain confidentiality;
3. Do not share credentials;
4. Do not download or disclose Patient Data without authorization;
5. Follow applicable privacy and security policies; and
6. Comply with these Terms.

6. SUBSCRIPTION

nxtDMD is provided on a subscription basis.

The selected plan may specify limits relating to:

1. Number of users;
2. Number of branches;
3. Number of patients;
4. Storage;
5. Imaging storage;
6. 3D-file storage;
7. Online appointment volume;
8. Transactions;
9. Features; and
10. Support.

The applicable pricing page, quotation, order form, or subscription agreement forms part of these Terms.

7. FEES AND PAYMENT

Subscription fees are payable according to the Customer's selected plan.

Unless otherwise agreed:

1. Fees are billed in advance;
2. Subscriptions may automatically renew;
3. Applicable taxes may apply;
4. Third-party payment-processing fees may apply;
5. Failed payments may result in suspension after reasonable notice; and
6. Refunds are subject to the applicable refund policy and applicable law.

NxtStep may change subscription prices by providing reasonable advance notice before the change applies to a renewal period.

8. ONLINE PATIENT PAYMENTS

nxtDMD may allow Clinics to accept online payments from patients.

Online payment transactions may be processed by third-party payment providers.

The Clinic remains responsible for:

1. The accuracy of charges;
2. Invoices;
3. Discounts;
4. Refunds;
5. Cancellation policies;
6. Treatment fees; and
7. Communication with patients concerning payments.

NxtStep does not guarantee that a payment transaction will be approved, completed, settled, or refunded.

Where technically and commercially appropriate, payment-card information will be handled by the applicable payment processor rather than stored directly by nxtDMD.

NxtStep does not intentionally store complete card numbers or card security codes unless expressly disclosed and supported by appropriate security and compliance controls.

Third-party payment providers may have their own terms and privacy policies.

9. ONLINE APPOINTMENTS

nxtDMD may provide online appointment booking or appointment-request functionality.

Unless the Clinic's configuration expressly provides otherwise, submission of an online appointment request does not constitute a confirmed appointment.

The Clinic is responsible for:

1. Maintaining its availability;
2. Setting appointment rules;
3. Confirming appointments;
4. Managing cancellations;
5. Rescheduling appointments;
6. Communicating appointment changes; and
7. Processing information collected through online booking lawfully.

NxtStep is not responsible for the Clinic's failure to honor, confirm, or manage an appointment.

10. CUSTOMER DATA

The Customer retains ownership of Customer Data.

The Customer grants NxtStep a limited right to process Customer Data as reasonably necessary to provide, secure, maintain, support, and improve nxtDMD in accordance with these Terms and the applicable Data Processing Agreement.

Customer Data may include:

1. Patient names;
2. Contact information;
3. Demographic information;
4. Dental history;
5. Medical history;
6. Treatment records;
7. Dental charts;
8. Clinical notes;
9. Dental photographs;
10. X-rays;
11. Radiographs;
12. CBCT or similar imaging;
13. 3D scans;
14. STL, OBJ, PLY, DICOM, or other supported files;
15. Appointment information;
16. Billing information;
17. Payment transaction information;
18. Insurance information; and
19. Other patient-related information.

11. HEALTH AND SENSITIVE PERSONAL INFORMATION

The parties acknowledge that dental records, medical history, X-rays, dental images, 3D scans, and other health-related information may constitute sensitive personal information under Philippine law.

The Customer is responsible for determining the appropriate lawful basis and purpose for processing Patient Data.

NxtStep shall process Patient Data as necessary to provide nxtDMD and in accordance with the applicable Data Processing Agreement.

12. DATA PRIVACY

The parties shall comply with applicable Philippine privacy laws, including Republic Act No. 10173, the Data Privacy Act of 2012, its implementing rules and regulations, and applicable National Privacy Commission issuances.

The Customer shall provide patients with appropriate privacy notices and obtain consent where consent is the applicable lawful basis.

The Customer shall remain responsible for determining:

1. What Patient Data is collected;
2. Why it is collected;
3. The lawful basis for processing;
4. Retention requirements;
5. Authorized recipients; and
6. Applicable data-subject procedures.

13. DENTAL IMAGES, X-RAYS AND 3D FILES

The Customer may upload dental photographs, X-rays, radiographs, CBCT images, 3D scans, digital models, and other dental files supported by nxtDMD.

The Customer is responsible for ensuring that:

1. Files are associated with the correct patient;
2. Users have appropriate access;
3. Files are accurate and complete;
4. Clinical professionals review information before relying upon it;
5. Files are retained according to applicable requirements; and
6. Appropriate backup/export procedures are maintained.

NxtStep does not independently verify the identity of the patient associated with an uploaded file or the clinical accuracy of the file.

14. CLINICAL RESPONSIBILITY

nxtDMD does not provide dental diagnosis or treatment.

Dentists and other licensed healthcare professionals remain responsible for:

1. Diagnosis;
2. Interpretation of X-rays;
3. Interpretation of dental images;
4. Interpretation of 3D scans;
5. Treatment planning;
6. Clinical notes;
7. Treatment decisions;
8. Patient communication; and
9. Patient care.

NxtStep does not guarantee clinical outcomes.

15. SECURITY MEASURES AND SAFEGUARDS

NxtStep shall maintain reasonable organizational, physical, and technical safeguards appropriate to the nature and risks of processing Customer Data.

Security measures may include:

1. Authentication;
2. Role-based access controls;
3. Encryption in transit;
4. Encryption or equivalent protection for stored data;
5. Access logging;
6. Backup procedures;
7. Monitoring;
8. Security testing;
9. Vulnerability management;
10. Incident-response procedures; and
11. Confidentiality obligations for personnel.

No online system can guarantee absolute security.

16. CYBERSECURITY, HACKING AND UNAUTHORIZED ACCESS

NxtStep shall use reasonable and proportionate technical and organizational safeguards designed to reduce the risk of unauthorized access, hacking, malware, data theft, alteration, disclosure, or destruction of Customer Data. No safeguard can eliminate every risk, and NxtStep does not warrant that the Service will be immune from every cyberattack or security incident.

Where appropriate to the Service and its technical environment, safeguards may include secure authentication and password controls; multi-factor authentication for privileged or administrative accounts; role-based and least-privilege access; separation of clinic accounts and data; encryption in transit and appropriate protection of stored data; secure software-development and change-management practices; timely security updates and vulnerability remediation; rate limiting and protections against common web attacks; monitoring and access logs; malware and file-upload controls; backup and recovery procedures; and periodic security reviews or testing.

The safeguards described in this section are risk-based measures and are not a representation that every listed control is active in every deployment or subscription. NxtStep shall not describe a control as implemented unless it has been deployed and maintained in the relevant environment.

17. CUSTOMER SECURITY OBLIGATIONS AND PROHIBITED CONDUCT

The Customer shall promptly notify NxtStep of suspected hacking, compromised credentials, unauthorized disclosure, unusual account activity, or other security concerns. The Customer shall preserve relevant information and reasonably cooperate with investigation and containment.

The Customer shall take reasonable steps to protect its own devices, email accounts, networks, credentials, and Authorized Users. The Customer shall promptly remove access for departing or unauthorized personnel, use available security features, avoid sharing credentials, and not upload malicious files or attempt to bypass security controls.

The Customer shall not conduct or authorize penetration testing, vulnerability scanning, scraping, denial-of-service testing, or other security testing against nxtDMD without NxtStep's prior written authorization, except to the extent such restriction is prohibited by applicable law.

18. SECURITY INCIDENTS AND PERSONAL DATA BREACHES

NxtStep shall maintain procedures for identifying, investigating, containing, and responding to security incidents.

If NxtStep becomes aware of a suspected or confirmed security incident that may materially affect Customer Data, NxtStep shall take reasonable steps to assess, contain, investigate, and mitigate the incident. If a personal data breach affecting Customer Data is confirmed, NxtStep shall notify the Customer without undue delay, subject to applicable law and legitimate security or investigative requirements. The notice shall include information reasonably available at the time and may be supplemented as the investigation progresses.

The Parties shall reasonably cooperate in determining whether regulatory or data-subject notification is required. The Customer remains responsible for its legal obligations as the applicable Personal Information Controller.

A cyberattack by itself does not automatically establish that NxtStep is liable or that NxtStep is free from liability. The parties shall reasonably cooperate to establish the cause, limit further harm, preserve relevant evidence, and meet applicable legal and regulatory obligations.

To the extent permitted by applicable law, NxtStep shall not be responsible for an incident to the extent it was caused by compromised Customer or Authorized User credentials, the Customer's devices or systems, unauthorized actions of the Customer's personnel, the Customer's failure to follow reasonable security instructions, or a third-party service or event outside NxtStep's reasonable control, provided that this clause does not exclude responsibility for NxtStep's own breach of these Terms, negligence, wilful misconduct, or other liability that cannot legally be excluded.

Responsibility for a security incident, loss, corruption, unauthorized disclosure, or unauthorized access shall be assessed according to the facts, the applicable law, and the extent to which the incident was caused or contributed to by a party's acts or omissions, including any breach of these Terms or failure to perform its applicable security obligations.

19. SUBPROCESSORS

NxtStep may engage third-party providers to support nxtDMD, including providers of:

1. Cloud hosting;
2. Database services;
3. File and image storage;
4. X-ray and 3D storage;
5. Payment processing;
6. Email;
7. SMS;
8. Authentication;
9. Security;
10. Monitoring;
11. Analytics; and
12. Customer support.

NxtStep shall require relevant subprocessors to implement appropriate privacy and security obligations consistent with their role.

20. INTERNATIONAL DATA PROCESSING

Certain infrastructure or service providers used by NxtStep may store or process data outside the Philippines.

Where applicable, NxtStep shall implement appropriate safeguards required by applicable law and contractual arrangements.

21. DATA RETENTION

NxtStep shall retain Customer Data for as long as reasonably necessary to provide the Service and fulfill applicable contractual, legal, security, accounting, and legitimate business requirements.

The Clinic remains responsible for determining appropriate retention periods for patient records.

22. DATA EXPORT

During an active subscription, the Customer may export available Customer Data using available nxtDMD functionality.

Depending on technical capabilities, exports may include:

1. Patient records;
2. Appointment records;
3. Billing records;
4. Images;
5. X-rays;
6. Documents; and
7. Other Customer Data.

Large imaging and 3D datasets may be subject to technical limitations, storage limitations, or additional export procedures.

23. INTELLECTUAL PROPERTY

NxtStep owns or licenses all intellectual property relating to nxtDMD, including its:

1. Software;
2. Source code;
3. Interface;
4. Design;
5. Documentation;
6. Workflows;
7. Trademarks;
8. Branding; and
9. Underlying technology.

The Customer receives only a limited, non-exclusive, non-transferable right to use nxtDMD during its active subscription.

24. ACCEPTABLE USE

The Customer shall not:

1. Access information without authorization;
2. Attempt to bypass security controls;
3. Introduce malware;
4. Interfere with the Service;
5. Reverse engineer nxtDMD except where legally permitted;
6. Resell nxtDMD without authorization;
7. Use nxtDMD for unlawful purposes;
8. Upload content that unlawfully infringes third-party rights; or
9. Permit unauthorized access to Patient Data.

25. SERVICE AVAILABILITY

NxtStep will use commercially reasonable efforts to maintain availability of nxtDMD.

Service interruptions may occur because of maintenance, infrastructure failures, internet outages, third-party services, security incidents, natural disasters, or other circumstances beyond NxtStep's reasonable control.

Any separate Service Level Agreement shall govern specific availability commitments.

26. BACKUPS

NxtStep may maintain backups for disaster recovery and business continuity.

Backups do not constitute a guarantee that every file or record can always be restored.

The Customer should maintain appropriate exports or other copies where required for clinical, regulatory, legal, or business purposes.

27. SUSPENSION

NxtStep may temporarily suspend access where reasonably necessary to:

1. Protect the Service;
2. Address a security threat;
3. Prevent unlawful activity;
4. Address serious abuse;
5. Comply with law; or
6. Address materially overdue fees.

Where reasonably practicable, NxtStep shall provide notice.

28. TERMINATION

Either party may terminate the subscription according to the applicable subscription agreement.

NxtStep may terminate or suspend the account for material breach, unlawful use, serious security risk, or prolonged non-payment, subject to applicable law.

29. POST-TERMINATION DATA

Following termination, the Customer may retrieve available Customer Data during the applicable export period.

After that period, NxtStep may delete Customer Data subject to legal retention requirements, backup cycles, and other applicable obligations.

30. DISCLAIMER OF WARRANTIES

To the maximum extent permitted by law, nxtDMD is provided on an "as is" and "as available" basis.

NxtStep does not guarantee that nxtDMD will:

1. Operate continuously;
2. Be completely error-free;
3. Meet every Customer requirement;
4. Prevent every cybersecurity incident;
5. Preserve every file indefinitely; or
6. Produce any particular business or clinical outcome.

31. LIMITATION OF LIABILITY

To the maximum extent permitted by applicable law, NxtStep shall not be liable for indirect, incidental, special, consequential, or punitive damages, including loss of profits, revenue, goodwill, business opportunities, or data.

Subject to applicable law, NxtStep's aggregate liability shall not exceed the subscription fees actually paid by the Customer during the twelve (12) months preceding the event giving rise to the claim.

Nothing in these Terms excludes liability that cannot legally be excluded under Philippine law.

32. CUSTOMER INDEMNIFICATION

To the extent permitted by law, the Customer shall indemnify NxtStep against third-party claims arising from:

1. Unlawful use of nxtDMD;
2. Unauthorized processing of Patient Data by the Customer;
3. Failure to provide legally required notices;
4. Failure to obtain required consent where applicable;
5. Clinical decisions;
6. Treatment decisions;
7. Content uploaded by the Customer; or
8. Breach of these Terms by the Customer.

33. CHANGES TO nxtDMD

NxtStep may modify, improve, add, or remove features from nxtDMD.

If a material change substantially reduces the core functionality of a paid subscription, NxtStep shall provide reasonable notice where practicable.

34. CHANGES TO THESE TERMS

NxtStep may update these Terms from time to time.

Material changes may be communicated through nxtDMD, email, or another reasonable method.

Continued use after the effective date of revised Terms constitutes acceptance to the extent permitted by law.

35. GOVERNING LAW

These Terms shall be governed by the laws of the Republic of the Philippines.

Subject to applicable law, disputes shall be brought before the appropriate courts.

36. CONTACT INFORMATION

NxtStep IT Solutions

Product: nxtDMD

Email: contact@nxtdmd.com / contact@nxtstepitsolutions.com

Website: nxtdmd.com / nxtstepitsolutions.com

PRIVACY POLICY

Product: nxtDMD

Provider: NxtStep IT Solutions

Effective Date: September 28, 2026

Last Updated: September 28, 2026

NxtStep IT Solutions ("NxtStep," "we," "us," or "our") respects your privacy and is committed to protecting personal information processed through nxtDMD in connection with the nxtDMD Terms and Conditions.

This Privacy Policy describes how we collect, use, store, disclose, protect, and otherwise process personal information in connection with our website, software platform, patient-facing features, customer accounts, online appointments, online payments, and related services.

1. WHO WE ARE

NxtStep IT Solutions

Email: contact@nxtstepitsolutions.com

Website: nxtstepitsolutions.com

nxtDMD is a technology platform used by dental clinics. For patient information relating to dental care, treatment, appointments, and clinical records, the dental clinic generally acts as the Personal Information Controller and determines the purposes and means of processing.

2. INFORMATION WE MAY PROCESS

Depending on how nxtDMD is used, processed information may include:

1. Account Information: Name, email address, telephone number, username, authentication information, organization information.
2. Clinic Information: Clinic name, address, contact information, staff information, subscription information, billing information.
3. Patient Information: Name, date of birth, contact information, address, appointment information, dental history, medical history, treatment records, dental charts, clinical notes, dental photographs, X-rays, radiographs, CBCT images, 3D dental scans, digital dental models, STL, DICOM, OBJ, PLY, PDF, JPG, PNG, and other supported files, insurance information, billing information, payment transaction information.

Health information and health records constitute sensitive personal information under Philippine law (Republic Act No. 10173, Data Privacy Act of 2012).

3. HOW INFORMATION IS COLLECTED

Information may be collected through various touchpoints across nxtDMD:

1. Directly from users;
2. Through a dental clinic;
3. Through online appointment forms;
4. Through patient portals;
5. Through online payment transactions;
6. Through customer account registration;
7. Through communications with NxtStep;
8. Through authorized integrations; or
9. Automatically through use of the Service.

4. PURPOSES OF PROCESSING

Information may be processed to:

1. Provide nxtDMD services and features;
2. Manage customer accounts;
3. Manage patient appointments;
4. Facilitate online appointment requests;
5. Maintain dental records;
6. Store dental images and X-rays;
7. Store 3D dental files;
8. Process or record online payments;
9. Send appointment reminders;
10. Provide customer support;
11. Maintain system security;
12. Prevent fraud and abuse;
13. Troubleshoot technical issues;
14. Perform backups and disaster recovery;
15. Improve the Service;
16. Comply with legal obligations; and
17. Perform other purposes disclosed at the time of collection.

5. PATIENT INFORMATION RESPONSIBILITY

Where a dental clinic uses nxtDMD to process patient information, the clinic generally determines the purposes and means of processing as the Personal Information Controller. The clinic is responsible for providing appropriate privacy notices and establishing the applicable lawful basis for processing under applicable privacy laws.

NxtStep generally processes such information as a Data Processor to provide the nxtDMD platform to the clinic in accordance with the Data Processing Agreement.

6. LAWFUL PROCESSING

Personal information shall be processed only where permitted under applicable law. Depending on the circumstances, processing may be based on:

1. Consent;
2. Contractual necessity;
3. Compliance with legal obligations;
4. Protection of vital interests; or
5. Another lawful basis recognized under applicable law.

The applicable lawful basis depends on the specific processing activity.

7. ONLINE APPOINTMENTS

When a patient submits an appointment request through nxtDMD, information provided by the patient may be transmitted to the applicable dental clinic. The clinic may use the information to:

1. Process the appointment request;
2. Confirm or reject an appointment;
3. Contact the patient;
4. Reschedule an appointment; or
5. Provide related services.

Submitting an appointment request does not necessarily mean that an appointment is confirmed.

8. ONLINE PAYMENTS

Where enabled by a dental clinic, nxtDMD may facilitate online payments through a third-party payment provider. Payment information may include:

1. Transaction amount;
2. Transaction date;
3. Payment status;
4. Payment reference;
5. Payment method; and
6. Refund information.

Complete card information may be handled directly by the payment provider. Third-party payment providers may have separate privacy policies and terms.

9. DENTAL IMAGES, X-RAYS AND 3D FILES

Dental photographs, X-rays, radiographs, CBCT images, 3D scans, digital models, and other dental files may be stored through nxtDMD. Such information may be accessible to authorized personnel of the applicable dental clinic based on their role and access permissions.

10. DISCLOSURE OF INFORMATION

Information may be disclosed to:

1. The applicable dental clinic;
2. Authorized clinic personnel;
3. NxtStep personnel with a legitimate need to access information;
4. Cloud hosting providers;
5. Storage providers;
6. Payment processors;
7. SMS and email providers;
8. Security providers;
9. Technical service providers;
10. Professional advisers;
11. Government authorities where legally required; and
12. Other parties where authorized by law.

NxtStep does not sell patient health information.

11. SUBPROCESSORS

NxtStep may use third-party providers to operate nxtDMD. These may include providers of:

1. Cloud infrastructure;
2. Databases;
3. File storage;
4. Image storage;
5. 3D-file storage;
6. Payment processing;
7. Email;
8. SMS;
9. Authentication;
10. Monitoring;
11. Security;
12. Analytics; and
13. Support.

NxtStep shall take reasonable measures to ensure that relevant service providers maintain appropriate privacy and security protections consistent with their role.

12. INTERNATIONAL PROCESSING

Some third-party infrastructure providers may process or store information outside the Philippines. Where applicable, NxtStep shall implement appropriate safeguards required under applicable privacy laws.

13. SECURITY MEASURES AND SAFEGUARDS

NxtStep maintains reasonable organizational, physical, and technical safeguards designed to protect personal information, as detailed in Sections 15 & 16 of the nxtDMD Terms and Conditions.

These safeguards include:

1. Authentication and password controls;
2. Access controls and role-based permissions;
3. Encryption in transit and at rest;
4. Audit logging and monitoring;
5. Regular backups;
6. Security testing and vulnerability management;
7. Incident-response procedures; and
8. Confidentiality obligations for personnel.

No electronic system can guarantee absolute security.

14. RETENTION

We retain information only for as long as reasonably necessary for the purpose for which it was collected, applicable contractual requirements, legal obligations, security, dispute resolution, and other lawful purposes. Patient-record retention periods may be controlled by the applicable dental clinic in accordance with healthcare regulation.

15. DATA SUBJECT RIGHTS

Subject to Republic Act No. 10173 (Data Privacy Act of 2012) and applicable law, data subjects have the following rights:

1. Right to be informed;
2. Right to access;
3. Right to correct inaccurate information;
4. Right to object;
5. Right to request erasure or blocking where legally applicable;
6. Right to data portability where applicable; and
7. Right to file a complaint regarding unlawful processing.

Requests relating to a patient's dental records should generally be directed to the applicable dental clinic.

16. WITHDRAWAL OF CONSENT

Where processing is based on consent, consent may be withdrawn subject to applicable law. Withdrawal does not affect processing lawfully performed before withdrawal. Information may still be retained where required by law or another lawful basis applies.

17. PERSONAL DATA BREACHES

NxtStep maintains procedures for responding to security incidents and personal data breaches as set forth in Section 18 of the Terms and Conditions. Where notification is legally required, NxtStep shall cooperate with the applicable parties in fulfilling notification and regulatory obligations under National Privacy Commission guidelines.

18. CHILDREN'S PRIVACY

nxtDMD may be used by dental clinics to maintain records concerning minors. The applicable dental clinic is responsible for complying with legal requirements relating to parental or legal-representative authority, consent, privacy notices, and processing of children's information.

19. COOKIES AND SIMILAR TECHNOLOGIES

Our website and Service may use cookies and similar technologies for:

1. Authentication;
2. Security;
3. Preferences;
4. Analytics;
5. Performance; and
6. Service improvement.

Where required, appropriate notices or controls will be provided.

20. CHANGES TO THIS POLICY

We may update this Privacy Policy from time to time. Material changes may be communicated through nxtDMD, our website, email, or another reasonable method.

21. CONTACT INFORMATION

For privacy questions or concerns:

NxtStep IT Solutions

Product: nxtDMD

Email: contact@nxtdmd.com / contact@nxtstepitsolutions.com

Website: nxtdmd.com / nxtstepitsolutions.com

DATA PROCESSING AGREEMENT

Product: nxtDMD

Provider: NxtStep IT Solutions

Effective Date: September 28, 2026

Last Updated: September 28, 2026

This Data Processing Agreement ("DPA") forms part of the agreement for the subscription and use of nxtDMD between:

1. NxtStep IT Solutions, provider of the nxtDMD platform ("NxtStep" or "Service Provider"); and
2. [DENTAL CLINIC LEGAL NAME], with principal address at [ADDRESS] ("Customer" or "Clinic").
3. 
   

This DPA supplements the nxtDMD Terms and Conditions and nxtDMD Privacy Policy, setting forth the specific terms governing the processing of personal data on behalf of the Clinic.

1. PURPOSE AND SCOPE

This DPA governs the processing of personal information and sensitive personal information by NxtStep on behalf of the Clinic through nxtDMD.

The parties intend to comply with applicable Philippine privacy laws, including Republic Act No. 10173, the Data Privacy Act of 2012, its implementing rules and regulations, and applicable National Privacy Commission issuances.

2. CUSTOMER DATA AND PATIENT RECORDS

Customer Data processed under this DPA includes:

1. Patient names;
2. Contact information;
3. Demographic information;
4. Dental history;
5. Medical history;
6. Dental charts;
7. Clinical notes;
8. Treatment records;
9. Dental photographs;
10. X-rays;
11. Radiographs;
12. CBCT images;
13. 3D dental scans;
14. Digital dental models;
15. STL, DICOM, OBJ, PLY, PDF, JPG, PNG, and other supported files;
16. Appointment information;
17. Billing information;
18. Insurance information;
19. Payment transaction information; and
20. Other information submitted to nxtDMD.

3. PROCESSING INSTRUCTIONS

NxtStep shall act as a Data Processor and process Customer Data only as reasonably necessary to:

1. Provide nxtDMD services and features;
2. Host and store Customer Data;
3. Provide technical support;
4. Maintain system security;
5. Perform backups;
6. Provide disaster recovery;
7. Monitor system performance;
8. Prevent fraud and abuse;
9. Troubleshoot technical issues;
10. Maintain and improve the platform using appropriately aggregated, anonymized, or de-identified information where applicable; and
11. Comply with applicable law.

NxtStep shall not intentionally use Patient Data for unrelated purposes without an appropriate lawful basis or authorization.

4. CUSTOMER RESPONSIBILITIES

The Clinic acts as the Personal Information Controller and is responsible for:

1. Determining the purpose of processing;
2. Establishing the appropriate lawful basis;
3. Providing required privacy notices;
4. Obtaining consent where applicable;
5. Ensuring information is accurate;
6. Determining appropriate retention periods;
7. Managing Authorized Users;
8. Establishing appropriate access permissions;
9. Responding to data-subject requests; and
10. Complying with applicable healthcare and privacy requirements.

5. NXTSTEP OBLIGATIONS

NxtStep shall:

1. Process Customer Data according to this DPA and documented instructions;
2. Maintain reasonable security safeguards;
3. Restrict access to authorized personnel;
4. Maintain confidentiality obligations;
5. Assist the Clinic where reasonably necessary to comply with privacy obligations;
6. Maintain incident-response procedures;
7. Manage subprocessors appropriately;
8. Support reasonable data-subject requests; and
9. Delete or return Customer Data according to the applicable termination and retention procedures.

6. CONFIDENTIALITY

Personnel authorized to access Customer Data shall be subject to appropriate confidentiality obligations or statutory secrecy duties.

7. SECURITY MEASURES AND SAFEGUARDS

NxtStep shall maintain reasonable security measures appropriate to the nature and risks of processing, aligned with Section 15 and 16 of the nxtDMD Terms and Conditions.

These measures include:

1. Secure authentication and password controls;
2. Role-based access and least-privilege permissions;
3. Encryption in transit and at rest;
4. Access logging and monitoring;
5. Regular backup and disaster recovery procedures;
6. Vulnerability management and security testing;
7. Incident-response workflows; and
8. Secure software-development practices.

8. SUBPROCESSORS

NxtStep may appoint subprocessors to provide infrastructure and supporting services, aligned with Section 19 of the Terms and Conditions and Section 11 of the Privacy Policy.

Subprocessors may include providers for:

1. Cloud hosting;
2. Storage;
3. Database services;
4. Imaging;
5. 3D-file storage;
6. Payment processing;
7. Email;
8. SMS;
9. Authentication;
10. Security;
11. Analytics; and
12. Technical support.

NxtStep shall require appropriate contractual privacy and security obligations from relevant subprocessors.

9. PERSONAL DATA BREACHES

If NxtStep becomes aware of a confirmed personal data breach affecting Customer Data, NxtStep shall notify the Clinic without undue delay, in accordance with Section 18 of the Terms and Conditions and Section 17 of the Privacy Policy.

Where reasonably available, the notification shall include:

1. Description of the incident;
2. Categories of data affected;
3. Approximate number of affected data subjects, if known;
4. Measures taken to contain the incident;
5. Remedial measures;
6. Recommended mitigation steps; and
7. Contact details for the person managing the incident.

The parties shall reasonably cooperate in determining whether notification to affected individuals or the National Privacy Commission is required.

10. DATA SUBJECT REQUESTS

If NxtStep receives a request from a patient concerning Customer Data, NxtStep may direct the requester to the Clinic.

NxtStep shall provide reasonable technical assistance where appropriate, including assistance with:

1. Access;
2. Correction;
3. Export;
4. Deletion; or
5. Other technically supported data-subject requests.

11. DATA RETENTION

Customer Data shall be retained according to the applicable Service agreement and the Clinic's lawful instructions, subject to legal, security, backup, and legitimate business requirements.

The Clinic remains responsible for establishing appropriate retention periods for patient records.

12. DATA RETURN AND DELETION

Following termination, NxtStep shall provide the Customer with a reasonable opportunity to export available Customer Data in accordance with Section 22 of the Terms and Conditions.

After the applicable export period, NxtStep may delete Customer Data, subject to:

1. Applicable law;
2. Legal retention requirements;
3. Backup cycles;
4. Security requirements; and
5. Other legitimate obligations.
6. 
   

13. INTERNATIONAL DATA PROCESSING

Customer Data may be processed outside the Philippines where necessary to provide nxtDMD, in accordance with Section 20 of the Terms and Conditions and Section 12 of the Privacy Policy.

Where applicable, NxtStep shall implement appropriate safeguards required under Philippine law.

14. AUDIT AND COMPLIANCE

Upon reasonable written request, NxtStep may provide information reasonably necessary to demonstrate compliance with its contractual privacy obligations.

Any audit must:

1. Be reasonably scheduled;
2. Protect other customers' confidential information;
3. Not compromise system security;
4. Occur during reasonable business hours; and
5. Be conducted at the Customer's reasonable expense unless otherwise agreed.
6. 
   

15. TERM

This DPA remains effective for as long as NxtStep processes Customer Data on behalf of the Clinic.

16. GOVERNING LAW

This DPA shall be governed by the laws of the Republic of the Philippines.

17. CONFLICT

If there is a conflict between this DPA and the nxtDMD Terms and Conditions concerning data-protection obligations, this DPA shall control to the extent of the conflict.

REFUND POLICY

Product: nxtDMD

Provider: NxtStep IT Solutions

Effective Date: September 28, 2026

Last Updated: September 28, 2026

This Refund Policy governs subscription payments, cancellations, and billing adjustments for the nxtDMD dental practice management platform provided by NxtStep IT Solutions ("NxtStep," "we," "us," or "our").

This policy forms part of the nxtDMD Terms and Conditions (specifically Section 7 Fees and Payment). By subscribing to nxtDMD, you agree to the terms outlined below.

1. SUBSCRIPTION FEES AND BILLING

nxtDMD is billed on a recurring subscription basis (monthly or annually) according to the selected subscription plan.

Subscription fees are charged in advance at the beginning of each billing cycle. All listed fees are exclusive of applicable taxes or third-party payment processing fees unless explicitly stated otherwise.

2. FREE TRIALS AND EVALUATION PERIODS

If your Clinic signs up for a free trial or promotional evaluation period, you will not be charged during the trial.

To avoid being charged, you must cancel your subscription before the free trial period expires.

Once the trial period ends and a paid subscription commences, standard subscription billing terms apply.

3. CANCELLATIONS

You may cancel your nxtDMD subscription at any time through your Account Settings or by contacting NxtStep customer support.

Upon cancellation:

1. Your subscription will remain active until the end of the current paid billing period;
2. You will not be billed for subsequent renewal cycles; and
3. You retain access to export Customer Data prior to account suspension or deletion, in accordance with Section 20 and 27 of the Terms and Conditions.

4. GENERAL NON-REFUNDABLE POLICY

Except as expressly stated in this policy or required by applicable Philippine law:

1. Subscription fees paid in advance are non-refundable;
2. No partial refunds or pro-rated credits are issued for unused days, unused user seats, or early cancellation within a monthly or annual billing cycle; and
3. Add-on module fees, storage upgrades, and setup fees are non-refundable once activated.

5. EXCEPTIONS AND BILLING DISPUTES

NxtStep may, at its sole discretion, evaluate refund or credit requests on a case-by-case basis under the following extraordinary circumstances:

1. Technical Service Failure: Extended, unannounced platform downtime or critical failure verified by NxtStep that prevents platform access for a prolonged period;
2. Duplicate Charges: Billing errors resulting in duplicate transactions for the same subscription period; or
3. Unprocessed Cancellations: Charges incurred after a verified, timely cancellation request was successfully submitted by the Clinic prior to the renewal date.

To request a billing review, you must notify NxtStep within fourteen (14) days of the transaction date.

6. ONLINE PATIENT PAYMENTS AND CLINIC-PATIENT TRANSACTIONS

nxtDMD facilitates online payment collection for clinics via third-party payment processors.

NxtStep is an administrative platform provider and does not collect or manage treatment fees on behalf of clinics. The Clinic remains solely responsible for:

1. Resolving patient payment disputes, chargebacks, or refund requests concerning dental services, appointments, or treatment fees;
2. Establishing and communicating its own clinic-level refund and cancellation policies to patients; and
3. Processing treatment-related refunds directly to patients.

NxtStep is not liable for patient payment refunds, transaction fee disputes, or clinic cancellation policies.

7. CHANGES TO THIS REFUND POLICY

NxtStep reserves the right to modify this Refund Policy at any time. Any changes will take effect upon posting to nxtDMD.

8. CONTACT INFORMATION

For billing inquiries or refund requests:

NxtStep IT Solutions

Product: nxtDMD

Email: contact@nxtdmd.com / contact@nxtstepitsolutions.com

Website: nxtdmd.com / nxtstepitsolutions.com

SUB-PROCESSOR LIST

Product: nxtDMD

Provider: NxtStep IT Solutions

Effective Date: September 28, 2026

Last Updated: September 28, 2026

This Sub-processor List forms an integral part of the nxtDMD Terms and Conditions, Privacy Policy, and Data Processing Agreement (DPA).

To deliver the nxtDMD dental practice management platform, NxtStep IT Solutions ("NxtStep," "we," "us," or "our") engages third-party service providers ("Sub-processors") to process certain Customer Data and Patient Data on our behalf.

1. OVERVIEW AND COMPLIANCE

NxtStep requires all engaged Sub-processors to maintain organizational, physical, and technical data protection measures equivalent to those set forth in the nxtDMD Data Processing Agreement and applicable privacy laws, including Republic Act No. 10173 (Data Privacy Act of 2012).

2. AUTHORIZED THIRD-PARTY SUB-PROCESSORS

The following third-party infrastructure and service providers are currently engaged by NxtStep to support the nxtDMD platform:

1. Infrastructure & Cloud Hosting: Cloud hosting infrastructure, database maintenance, encrypted file storage for electronic dental records, patient images, X-rays, DICOM, and 3D dental files (e.g., AWS / Google Cloud Platform / Microsoft Azure). Processing Location: Global / Regional Cloud Data Centers.
2. Payment Processing Gateways: Processing online patient billings, clinic subscription fee collection, credit card, e-wallet, and bank transfer transactions (e.g., PayMongo / Xendit / Stripe). Processing Location: Philippines / International.
3. Communications & Notifications: Transmitting transactional SMS appointment reminders, automated system notifications, and email communications to patients and clinic personnel (e.g., Twilio / Semaphore / SendGrid). Processing Location: Philippines / Global.
4. Authentication & Security Services: User identity verification, multi-factor authentication (MFA), firewall protection, bot mitigation, and access control management. Processing Location: Global.
5. System Monitoring & Error Logging: Application performance monitoring, error logging, and diagnostic infrastructure tracking to ensure platform availability and troubleshooting. Processing Location: Global.

3. UPDATES AND NOTIFICATIONS

NxtStep may update this Sub-processor List from time to time as our infrastructure and technical service offerings evolve.

When we engage any new Sub-processor that processes Customer Data or Patient Data, we will update this document and provide reasonable advance notice to subscribing Clinics in accordance with the Data Processing Agreement.

4. CONTACT INFORMATION

For questions regarding our Sub-processors or data protection practices:

NxtStep IT Solutions

Product: nxtDMD

Email: contact@nxtdmd.com / contact@nxtstepitsolutions.com

Website: nxtdmd.com / nxtstepitsolutions.com

DISCLAIMER

Product: nxtDMD

Provider: NxtStep IT Solutions

Effective Date: September 28, 2026

Last Updated: [DATE]

This Disclaimer applies to the nxtDMD software platform, website, applications, APIs, features, and related services ("nxtDMD" or "Service") operated by NxtStep IT Solutions ("NxtStep," "we," "us," or "our").

By accessing, subscribing to, or using nxtDMD, you acknowledge and agree to the disclaimers set forth herein in connection with the nxtDMD Terms and Conditions, Privacy Policy, and Data Processing Agreement.

1. NO CLINICAL OR MEDICAL DIAGNOSIS

nxtDMD is a practice management and administrative software platform only. nxtDMD does not provide medical or dental advice, diagnosis, treatment, or professional healthcare services.

Licensed dentists, healthcare professionals, and authorized clinic personnel retain sole clinical responsibility for patient care, including:

1. Reviewing and evaluating dental charts, clinical notes, and medical histories;
2. Interpreting X-rays, radiographs, CBCT images, 3D scans, and digital dental models;
3. Formulating treatment plans, prescriptions, and clinical decisions; and
4. Direct patient communication and healthcare delivery.

NxtStep does not independently verify the clinical accuracy or completeness of any files, images, or records processed through nxtDMD.

2. "AS IS" AND "AS AVAILABLE" SERVICE

To the maximum extent permitted by applicable law, nxtDMD is provided on an "as is" and "as available" basis without warranties of any kind, whether express, implied, statutory, or otherwise.

NxtStep does not warrant or guarantee that:

1. nxtDMD will operate continuously, uninterrupted, or completely error-free;
2. The platform will meet every clinic requirement or operational workflow;
3. Defective functions or software bugs will be corrected immediately; or
4. nxtDMD will produce any specific business, financial, operational, or clinical outcome.

3. CYBERSECURITY AND DATA SECURITY LIMITATIONS

NxtStep maintains reasonable technical, physical, and organizational security safeguards aligned with Section 15 and 16 of the nxtDMD Terms and Conditions.

However, no cloud platform or electronic transmission over the internet can be guaranteed to be completely immune to cyberattacks, security threats, or unauthorized intrusion.

NxtStep does not warrant that nxtDMD will be immune from all cyberattacks, security breaches, system outages, or data loss beyond NxtStep's reasonable control.

4. ACCURACY OF CUSTOMER AND PATIENT DATA

nxtDMD processes records submitted by Customer clinics and Authorized Users. NxtStep is not responsible for errors, omissions, misidentifications, or inaccuracies in Customer Data or Patient Data uploaded by clinic personnel.

Clinics remain responsible for maintaining appropriate local copies, backups, and exports of clinical records where required by applicable laws and professional regulations.

5. THIRD-PARTY SERVICES AND INTEGRATIONS

nxtDMD may integrate with or link to third-party services, including payment processors, SMS gateways, cloud hosting infrastructure, and communications providers.

NxtStep does not control, endorse, or assume responsibility for the performance, availability, privacy practices, or content of third-party service providers.

6. LIMITATION OF LIABILITY

To the maximum extent permitted under Philippine law, NxtStep IT Solutions shall not be liable for any indirect, incidental, consequential, special, or punitive damages, including loss of profits, lost revenue, lost business opportunities, or data loss arising out of or related to your use of nxtDMD, as detailed in Section 31 of the nxtDMD Terms and Conditions.

7. CONTACT INFORMATION

For questions regarding this Disclaimer:

NxtStep IT Solutions

Product: nxtDMD

Email: contact@nxtdmd.com / contact@nxtstepitsolutions.com

Website: nxtdmd.com / nxtstepitsolutions.com

COOKIE POLICY

Product: nxtDMD

Provider: NxtStep IT Solutions

Effective Date: September 28, 2026

Last Updated: September 28, 2026

NxtStep IT Solutions ("NxtStep," "we," "us," or "our") uses cookies and similar tracking technologies on the nxtDMD website, web platform, patient portals, and related applications.

This Cookie Policy explains what cookies are, how we use them, the types of cookies deployed across nxtDMD, and how you can manage your cookie preferences in connection with the nxtDMD Terms and Conditions and Privacy Policy.

1. WHAT ARE COOKIES?

Cookies are small data files placed on your computer, tablet, or mobile device when you visit a website or access a web application.

They are widely used by web application providers to make systems function efficiently, improve user experience, maintain secure user sessions, and provide reporting information.

2. HOW nxtDMD USES COOKIES

nxtDMD uses cookies and similar technologies (such as local storage, session storage, and web beacons) to:

1. Authenticate Authorized Users and maintain secure login sessions;
2. Remember clinic user preferences and dashboard configurations;
3. Protect system security and prevent unauthorized access or fraudulent activity;
4. Optimize web platform performance and server responsiveness; and
5. Analyze aggregated usage trends to improve nxtDMD features and user experience.

3. TYPES OF COOKIES WE USE

We categorize the cookies used across nxtDMD into the following types:

1. Strictly Necessary Cookies: Essential for the operation of nxtDMD. These allow Authorized Users to log into secure account areas, navigate between patient management tools, and process payments safely. Without these cookies, core parts of nxtDMD cannot function.
2. Functional / Preference Cookies: Used to recognize you when you return to nxtDMD and remember choices you have made (such as language, preferred clinic branch, display preferences, or odontogram views).
3. Security Cookies: Used to identify and prevent security risks, detect brute-force login attempts, enforce rate limits, and secure Customer Data.
4. Performance and Analytics Cookies: Collect aggregated, anonymized information about how users interact with our platform (such as page load times, system performance, and feature utilization) to help us troubleshoot technical issues and optimize performance.

4. THIRD-PARTY COOKIES AND INTEGRATIONS

In certain instances, third-party service providers engaged by NxtStep may place cookies on your device when interacting with nxtDMD.

These third parties may include:

1. Payment Processors: To securely process online patient payments and detect fraudulent transactions;
2. Authentication & Security Providers: To enforce multi-factor authentication, bot detection, and access controls; and
3. Infrastructure & Monitoring Services: To track system uptime, error logging, and cloud performance.

NxtStep does not permit third-party advertising or targeting cookies on nxtDMD. We do not sell or monetize personal or health information.

5. MANAGING COOKIE PREFERENCES

Most web browsers automatically accept cookies by default. You can control or block cookies through your web browser settings.

Please note that if you choose to block or disable Strictly Necessary cookies, certain features of nxtDMD (such as secure authentication, appointment booking, or accessing electronic dental records) may not function properly or may become unavailable.

6. CHANGES TO THIS COOKIE POLICY

NxtStep may update this Cookie Policy from time to time to reflect technical, operational, or legal changes.

Any updates will be published on nxtDMD with a revised Last Updated date.

7. CONTACT INFORMATION

For questions regarding this Cookie Policy or our privacy practices:

NxtStep IT Solutions

Product: nxtDMD

Email: contact@nxtdmd.com / contact@nxtstepitsolutions.com

Website: nxtdmd.com / nxtstepitsolutions.com