Toothworx Ltd. is committed to respecting the privacy of all individuals whose personal information we collect and ensuring the confidentiality of this information in compliance with PIPA. This rule covers the following key principles:

Lawful Collection: We collect personal information in a lawful, transparent, and fair manner, ensuring it is relevant andadequate for the purposes for which it is being collected.

Purpose Limitation: Personal information will only be used for the purposes for which it was collected, unless furtherconsent is obtained.

Accuracy: We have taken all reasonable steps to ensure that personal information is accurate, complete, and up-to-date.

Security : We have implemented appropriate technical and organizational measures to protect personal information from unauthorized access, loss, misuse, or disclosure.

Access and Correction: Individuals have the right to request access to and correction of their personal information.

The types of personal information we collect may include:

Patient Information: Name, contact details, medical history, dental history, insurance information, treatment records, and payment details.

Employee Information: Employment history, contact information, emergency contacts, and payroll information.

Business Associate Information: Contact information of suppliers, service providers, contractors, or others working with Toothworx Ltd.

We will only collect the information necessary to fulfill the purposes outlined in this rule.

Consent Requirement:

We will obtain explicit consent from individuals before collecting their personal information,unless otherwise permitted or required by law. Consent may be obtained in writing or verbally, depending on the natureof the information.

Purpose of Use:

• Personal information may be used for the following purposes:

• Providing dental care and treatment.

• Communicating with patients regarding appointments, billing, and treatment plans.

• Processing insurance claims and payment processing.

• Complying with legal obligations or regulatory requirements.

• Conducting administrative activities, such as staffing, auditing, and patient feedback.

Retention Period: Personal information will be retained only for as long as necessary to fulfill the purposes for which it was collected or as required by law (e.g., tax or healthcare record retention laws).

Deletion: When personal information is no longer required, we will take reasonable steps to securely delete or anonymize it in accordance with applicable laws.

Toothworx Ltd. will take reasonable steps to protect personal information from unauthorized access, disclosure, alteration, or destruction.

This includes:

• Implementing physical, technical, and administrative safeguards to protect data.

• Limiting access to personal information to authorized personnel only.

• Ensuring that all staff, contractors, and third-party service providers understand their obligations to maintain confidentiality

In the event of a data breach (i.e., unauthorized access or disclosure of personal information),Toothworx Ltd.will take the following steps:

• Immediate Action: We will take immediate action to mitigate any potential harm and secure the affected information.

• Notification: If a breach is likely to cause harm to individuals, we will notify the affected individuals and the appropriate authorities within the timeframes set by PIPA.

• Investigation and Corrective Action: We will investigate the cause of the breach and implement corrective actions to prevent future incidents.

Toothworx Ltd. may transfer personal information to third-party service providers, business associates, or affiliates (e.g.,payment processors, IT service providers).

We will:

• Ensure that these third parties are compliant with data protection standards and have adequate safeguards in place to protect personal information.

• Require all third parties to sign contractual agreements specifying their data protection responsibilities.

• Access: Individuals have the right to request access to the personal information we hold about them.

• Correction: Individuals may request corrections to their personal information if they believe it is inaccurate or incomplete.

• Withdrawal of Consent: Individuals may withdraw consent for the collection and use of their personal information at anytime, subject to legal or contractual limitations.

• Deletion: Individuals may request that their personal information be deleted, subject to legal retention obligations.

Requests can be made by contacting Toothworx Ltd. at the contact information provided below.

Ashley@toothworxbda.com

If personal information is transferred to another jurisdiction for processing, we will ensure that the destination jurisdictionprovides an adequate level of data protection or that appropriate safeguards are in place to protect the personal information.

Toothworx Ltd. will regularly review and update this Omnibus Rule to ensure ongoing compliance with PIPA and to adapt to any changes in applicable laws. Failure to adhere to this rule may result in disciplinary actions, up to and including termination of employment or business relationships.

Contact Information

For questions or concerns regarding this rule, or to request access to or correction of your personal information, please contact Ashley Robinson (PIPA Officer):

Toothworx Ltd.

Address: 25 Woodlands Rd, Pembroke HM09 Bermuda

Phone:(441)236-9375 ext 3

Email: Ashley@toothworxbda.com