Article 1. Definitions and applicability
1.1  These Product Terms (version 2026-10) apply to any use of Cadmus, the software-as-a-service offering (the “Service”) of Cadmus Labs B.V., registered in Leiden, Chamber of Commerce no. 94949816 (“Supplier”), by the party using the Service (“Client”).

1.2  In addition, the NLdigital Terms 2025 apply to all offers and agreements between Supplier and Client, as deposited with the District Court Midden-Nederland, location Utrecht. In the event of disputes concerning interpretation of the English version of the NLdigital Terms 2025, the Dutch text prevails. Supplier’s Data Processing Agreement, consisting of Supplier’s Data Pro Statement and the NLdigital Standard Clauses for Data Processing (March 2025 version) forms part of the agreement and constitutes the data processing agreement within the meaning of Article 28(3) GDPR.

1.3  In the event of any conflict between these Product Terms and the NLdigital Terms 2025, these Product Terms prevail, in accordance with Article 1.2 of the NLdigital Terms 2025.

1.4  The agreement between Supplier and Client is concluded when Client, represented by a person authorized to do so, accepts these Product Terms, the NLdigital Terms 2025 and the Data Processing Agreement upon first login to the Service, or when Client otherwise accepts these documents in writing.

1.5  These Product Terms are governed by Dutch law.

1.6  Supplier may issue a new version of these Product Terms. Supplier will make the new version available and notify Client through the Service or by email. For changes that do not materially reduce Client's rights, the change takes effect on notice. For any other change, Client must accept the new version before continuing to use the Service — including existing Clients, on first use after the change. If Client does not accept a required new version, Client may terminate under Article 5.2, and the version previously accepted continues to apply until termination takes effect.


Article 2. The Service
2.1  The Service is an online software-as-a-service platform, with associated interfaces and tools including an inbox, dashboard and API, that enables dental and orthodontic laboratories to release and process orders placed by dentists and orthodontists through intraoral scanner portals.

2.2  The Service does not include implementation services, training, custom development or data migration, unless agreed separately in writing.

2.3  The Service includes automated classification and enrichment of order data using AI (Google Vertex AI), for example to recognise characteristics such as work type, colour, placement and material. This concerns administrative order characteristics only and does not involve any medical assessment or diagnosis. This processing is carried out by Supplier as part of the Service and is further described in the Data Processing Agreement.

2.4  The classification and enrichment referred to in 2.3 constitutes an automated, probability-based interpretation of free text and order characteristics and is intended solely as an administrative aid. Its output may be incomplete or incorrect and does not necessarily reflect the specific circumstances of an individual order. Client is and remains responsible for verifying order data and for the items produced on the basis of it. Supplier is not liable for damage arising from Client relying on the classification without its own verification.

2.5 Supplier may modify and improve the Service in accordance with Article 38 of the NLdigital Terms 2025.

Article 3. Access and acceptance
3.1  Supplier provides Client with access to the Service by creating an account and issuing login credentials, or by enabling Client to create an account.

3.2  Use of the Service requires acceptance of these Product Terms, the NLdigital Terms 2025 and Supplier’s Data Processing Agreement. The person accepting warrants that they are authorized to bind Client.

3.3  Client is responsible for the confidentiality of all credentials, including Service login details, API keys, and credentials for third-party scanner portals and integrated systems, and for all activity carried out under them. Client is responsible for maintaining valid access to the scanner portals and external systems required to generate or retrieve orders.

Article 4. Fees and payment
4.1  Use of the Service is charged on a pay-per-use basis. A billable unit is each order record collected by the Service from a scanner portal, counted as recorded in Supplier's systems, and is billable irrespective of whether it is complete, contains scan data, duplicates an order already collected, is a re-sent, re-synced, test or cancelled order, or is not subsequently used by Client. In accordance with Article 3.4 of the NLdigital Terms 2025, Supplier's records constitute conclusive evidence of usage, without prejudice to Client's right to prove manifest error. No credits, refunds or adjustments are made for collected records, except where required by mandatory law.

4.2  The applicable rate is set out in the Rate Sheet (Annex A). Unless otherwise agreed in writing with Client, the default rate applies. Rates are exclusive of VAT.

4.3  Supplier invoices Client monthly in arrears for orders collected in the preceding calendar month. Supplier may invoice directly or through a billing provider it designates. There is no minimum fee; a period with no billable units results in no charge for usage.

4.4  Payment is due within 14 days of the invoice date. Client may not suspend payment or set off any amount.

4.5  Supplier may adjust the rate once per year in line with the Consumer Price Index (CPI) published by Statistics Netherlands (CBS), effective upon written notice. Any other rate change is made in accordance with Article 3.5 of the NLdigital Terms 2025 (written notice, at least three months). A change to the default rate is published as a new version of the Rate Sheet.

4.6  Third-party costs necessary for providing the Service including fees charged to Supplier by scanner portals or integration partners may be charged to Client. If such a third party introduces or increases fees to Supplier, Supplier may pass these on to Client on a one-to-one basis in addition to the rate.

4.7  In the event of late payment, statutory commercial interest under Section 6:119a of the Dutch Civil Code accrues on the overdue amount from the due date, and Supplier may suspend access to the Service until payment is received in full, without prejudice to its other rights.

Article 5. Term and termination
5.1  The agreement commences upon acceptance in accordance with Article 3.2 and continues for an indefinite period.

5.2  Either party may terminate the agreement at any time, without cause, by written notice (including by email to info@cadmuslabs.nl). On termination, the right to use the Service ends and access may be disabled.

5.3  Supplier may suspend or restrict access where security risks are detected, misuse occurs, or these terms are breached. Supplier will make reasonable efforts to notify Client where possible. Measures relating to excessive use are governed by Article 7.

5.4  Either party may terminate with immediate effect if the other is declared bankrupt, is granted suspension of payments, or ceases operations. On termination for reasons attributable to Client, amounts owed to Supplier become immediately due.

5.5  Provisions that by their nature survive termination including fees accrued, confidentiality, and the data provisions of Article 6 remain in effect.

Article 6. Data and data use
6.1  Client owns and, as between the parties, controls the data it submits to or processes through the Service. Client warrants that: (a) a valid basis under Article 6 GDPR and a valid condition under Article 9 GDPR exist for the processing and disclosure of that data through the Service; (b) it is entitled to make the data available to Supplier, to instruct Supplier to process it, and to authorise Supplier to engage its sub-processors; (c) where the data originates from a dentist, orthodontist or other care provider, a written data processing agreement is in place between Client and that care provider which permits Client to engage Supplier as a sub-processor and which passes the originating controller's instructions down the chain; and (d) Supplier acts as Client's sub-processor, Client acting as the processor of the originating controller; and Supplier is not required to hold, and does not hold, any direct agreement with that controller. Where Client is exceptionally the controller of the data itself, Supplier acts as Client's processor. Client indemnifies Supplier against third-party claims (including from patients, care providers or supervisory authorities) to the extent they arise from breach of the warranties in this Article 6.1.

6.2  The Service is designed to process special categories of personal data within the meaning of Article 9 GDPR, namely health data — comprising intraoral (IOS) scans, clinical photographs, and dental/orthodontic order information — as set out in the data inventory in the Data Pro Statement (§5), which governs the categories of data processed. This is the express arrangement referred to in the Standard Clauses; the general assumption that the Service is not intended for special categories does not apply.

6.3  Supplier processes the personal data referred to in 6.1 solely to provide the Service, in accordance with Client's instructions and the Data Processing Agreement. Those instructions include Supplier applying the de-identification step described in 6.4(a). Without Client's prior instruction or permission, Supplier does not process this personal data other than as provided for in the agreement.

6.4  (a) Supplier may create a de-identified dataset from the operation of the Service by irreversibly removing direct identifiers (including clinician and practice names) and screening free-text order information to remove information capable of identifying a patient or other individual, so that the result no longer constitutes personal data and cannot reasonably be traced to any patient, dentist, orthodontist, laboratory or Client. (b) The de-identified dataset is not personal data and is not processed on Client's behalf; Supplier determines the purposes and means of its use. Supplier may use it to improve, develop, monitor, secure and analyse the Service and Supplier's products and services, to derive aggregated insights, and to train or tune Supplier's own models. Supplier may also share aggregated insights derived from the dataset, and make the de-identified dataset available, to third parties (including partners and service providers), provided the data remains de-identified. (c) Interim. Until Supplier has implemented the de-identification and screening in 6.4(a), Supplier limits the use permitted under 6.4(b) to operational metadata that does not constitute personal data — such as order volumes, work-type codes, processing and turnaround times, timestamps, and portal and laboratory throughput — and does not use free-text order information or clinician identifiers for those purposes.

6.5  The de-identified dataset and operational metadata in 6.4 do not constitute personal data, are not processed on Client's behalf, and fall outside Supplier's obligations to delete or return personal data on termination; Supplier may continue to use them after the agreement ends. This Article does not permit Supplier to use identifiable personal data for the purposes in 6.4(b).

6.6 (a) Scan data, meaning intraoral (IOS) scans, clinical photographs and other files attached to an order, is retained for twelve (12) months from the date of collection and is then deleted, including during the term.

(b) All other order data, including order records and related order information, is retained for three (3) years from the date of collection and is then deleted, including during the term.

(c) Client may request Supplier in writing to delete specific scan data or order data before the end of the applicable retention period, for example following a request from the originating controller or a data subject. Supplier will carry out such a request within a reasonable period. Client is responsible for ensuring that the retention periods in this Article are consistent with the instructions of the originating controller.

(d) On termination, the export functionality remains available for thirty (30) days, during which Client may export its data via the Service or API. After that period no further export is possible, and any remaining personal data is deleted within three (3) months of termination. Client is responsible for timely export or backup of data it wishes to retain; Supplier does not accept responsibility for data loss arising from Client's failure to do so.

(e) This Article does not affect the de-identified dataset and operational metadata referred to in Article 6.4


Article 7. Fair use, acceptable use and API
7.1  Client must use the Service in a reasonable manner consistent with normal business operations. Supplier may apply fair-use limits to protect the stability, security, performance and availability of the Service.

7.2  Usage may be considered excessive where, in Supplier’s reasonable opinion, it places an unreasonable load on the Service including unusually high order volumes, excessive API calls, or automated scraping or extraction of data. Where usage is excessive or abusive, Supplier may throttle or limit access, impose technical restrictions, temporarily suspend access, or request that Client move to a different pricing tier or usage plan. Supplier will make reasonable efforts to notify Client, except where immediate action is needed to protect the security, stability or integrity of the Service.

7.3  Where a connected scanner portal or integration remains inactive for an extended period, Supplier may deactivate the connection to preserve system stability and efficient use of resources. Client may re-enable it at any time by re-authenticating the relevant portal or integration.

7.4  Where the Service provides access through an API, Client may use the API only for legitimate integration with its own systems. Client may not resell API access, share API credentials with unauthorized third parties, or use the API to replicate or compete with the Service. Supplier may apply rate, request, bandwidth or concurrency limits, and may throttle, suspend or terminate API access where usage exceeds reasonable limits.

7.5  Client may not reverse engineer or decompile the Service, systematically scrape or extract data, use unauthorized bots or scripts, attempt unauthorized access, introduce malicious code, or otherwise disrupt the Service or use it unlawfully. Supplier may suspend or terminate access immediately in the event of such misuse.

Article 8. Support and additional services
8.1  The Service is provided on an “as is” and “as available” basis. Supplier does not guarantee uninterrupted availability, error-free operation, or compatibility with third-party systems, and is not obliged to provide support, maintenance or service levels unless expressly agreed in writing. This is without prejudice to Supplier’s obligations under the NLdigital Terms 2025.

8.2  The performance of the Service depends on the continuous and unmodified operation of the third-party scanner portals used to generate and deliver orders. Interruptions, malfunctions or changes to those portals fall outside Supplier’s control.

8.3  Supplier is not obliged to develop, maintain or release updates, features or new versions, or to customize the Service to Client’s particular requirements.

8.4  At Client’s request, Supplier may provide additional services such as implementation, ERP integration, onboarding, training, or the development of custom solutions, interfaces and connection tools. These are provided against payment of hours and expenses at Supplier’s standard rates, with a cost estimate available on request. Supplier may accept or decline such requests at its discretion.

Article 9. Beta features
9.1  Supplier may offer beta or experimental features, provided for testing purposes only. Such features may contain errors, change significantly, or be discontinued at any time. Supplier makes no guarantees regarding their reliability or availability, and the warranties and service expectations applicable to the Service do not apply to them.

Article 10. Enterprise agreements and precedence
10.1  Where Client has entered into a separate written agreement with Supplier (such as a negotiated SaaS, enterprise, partner or service level agreement), that agreement prevails over these Product Terms to the extent of any conflict and may add to them; these Product Terms continue to apply to the extent they do not conflict with it.

10.2  In case of conflict, the following order of precedence applies: (1) any separate written agreement under 10.1; (2) the Data Processing Agreement, in respect of the processing of personal data; (3) these Product Terms; (4) the NLdigital Terms 2025.

Article 11. Liability
11.1 In addition to and in derogation from Article 15 of the NLdigital Terms 2025, Supplier's total liability for direct damage, on any legal basis whatsoever, is limited to € 50,000 per event, whereby a series of connected events counts as a single event. The other limitations and exclusions of Article 15 of the NLdigital Terms 2025 remain in full force. This limitation does not apply to the extent that the damage results from intent or deliberate recklessness on the part of Supplier's management.

Annex A. Rate Sheet
Version 2026-10

Billable unit:
Per order collected from a scanner portal (default rate)

Rate (excl. VAT):
€ 1.25

The default rate applies unless a different rate is agreed in writing with a specific Client. Changes to the default rate are published as a new version of this Rate Sheet in accordance with Article 4.5