Terms and Conditions

Acceptance and authority

You accept these Terms by signing an Order Form that incorporates them, creating or using an account, clicking an acceptance control, or otherwise accessing the Service after receiving notice of the Terms. If you do not agree, do not access or use the Service.

If you accept on behalf of a company, practice, DSO, billing organization, employer, provider group, or other legal entity, you represent that you have authority to bind that entity. If you are an Authorized User, your access is also subject to the Customer's policies and instructions. The Customer is responsible for its Authorized Users and their compliance with these Terms.

The Service is offered for business and professional use. It is not intended for personal, family, or household use, and it is not a consumer health record, emergency service, or substitute for a licensed healthcare professional.

Contract structure and priority

The complete agreement may include these Terms, an Order Form, statement of work, service schedule, BAA, DPA, security addendum, support policy, and other document expressly incorporated by reference (collectively, the "Agreement").

If documents conflict, the following order applies unless a signed document states otherwise:

1. the BAA controls for PHI and HIPAA-specific obligations;
2. the DPA controls for regulated personal-data processing;
3. a negotiated, signed master agreement or Order Form controls commercial and service-specific terms;
4. a statement of work controls only the professional services described in it; and
5. these online Terms control the remaining use of the Service and website.

A purchase order is for administrative convenience only. Additional or conflicting purchase-order terms do not amend the Agreement unless DentalXpand expressly signs them.

Definitions

Authorized User

An individual whom Customer authorizes to access the Service under Customer's account, including employees, contractors, providers, and administrators.

Customer

The organization that purchases, receives, or controls a DentalXpand workspace.

Customer Content

Data, records, files, prompts, images, messages, configurations, and other material submitted to or generated in Customer's workspace.

Documentation

DentalXpand user guides, resources, technical instructions, and written usage policies made available for the Service.

Order Form

A quote, order, invoice, online checkout, subscription record, or signed document identifying purchased Service, term, usage, and fees.

Service

The DentalXpand website, hosted and desktop applications, modules, integrations, APIs, support, and related services purchased or made available to Customer.

Eligibility, accounts, and administrators

Authorized Users must be at least 18 years old and legally able to enter a binding agreement. Accounts must use accurate current information and may not be shared. Customer must designate authorized administrators and maintain accurate organization, practice, role, provider, and user assignments.

Customer is responsible for:

• protecting passwords, authentication tokens, API keys, OAuth grants, recovery methods, and devices;
• using least-privilege roles and promptly disabling access for departed or reassigned personnel;
• reviewing administrator actions, support access, exports, and connected integrations;
• all activity under its accounts except to the extent directly caused by DentalXpand's breach of the Agreement; and
• notifying DentalXpand promptly of suspected unauthorized access, credential compromise, or security incidents.

DentalXpand may rely on instructions from Customer's designated administrators. We are not responsible for an internal dispute over who should hold an administrative role unless and until Customer provides legally sufficient instructions.

The Service and permitted access

Subject to the Agreement and payment of applicable fees, DentalXpand grants Customer a limited, non-exclusive, non-transferable, non-sublicensable right during the subscription term to permit Authorized Users to access and use the purchased Service for Customer's internal business operations.

Available modules may include dashboards, tasks, attendance, time tracking, meetings, messaging, documents, HR, loans, leave, expenses, revenue, reports, provider and practice administration, eligibility, VOB, AR, claims, billing, credentialing, agreements, lead generation, outreach, support, and AI-assisted tools. An Order Form may limit modules, users, practices, organizations, storage, transactions, support, or integrations.

Changes and availability

We may update the Service to improve security, usability, compliance, or functionality. We will not materially reduce the core purchased functionality during a paid term without reasonable notice, except where necessary to address law, security, third-party dependency, abuse, or an urgent technical issue. Features identified as preview, beta, local-only, experimental, or third-party dependent may change or be discontinued at any time.

Scheduled maintenance, emergency maintenance, internet conditions, Customer systems, payer portals, clearinghouses, model providers, and other third parties can affect availability. Any service-level commitment applies only if stated in a signed Order Form or service-level agreement.

Subscriptions, fees, taxes, and payment

Customer will pay fees, taxes, usage charges, and reimbursable expenses stated in the Order Form. Unless the Order Form states otherwise, fees are in U.S. dollars, invoiced in advance, due within the stated payment period, and non-cancelable and non-refundable except where the Agreement expressly provides a credit or refund.

• Renewal. A subscription renews automatically only if the Order Form or accepted checkout terms say so. Renewal price changes will be communicated as required by the Agreement or law.
• Usage. Customer is responsible for authorized usage, including third-party transaction, model, communication, storage, or overage charges disclosed in the Order Form.
• Taxes. Fees exclude sales, use, value-added, withholding, and similar taxes. Customer is responsible for applicable taxes except taxes based on DentalXpand's net income.
• Disputes. Customer must raise a good-faith invoice dispute promptly and pay undisputed amounts when due.
• Late payment. Overdue undisputed amounts may accrue the lesser of 1.5% per month or the maximum legal rate, plus reasonable collection costs, after required notice and cure.

DentalXpand may change free or trial offerings, impose limits, or require a paid subscription at any time on reasonable notice. Promotional credits have no cash value and expire as stated when issued.

Customer Content and data rights

As between the parties, Customer retains its rights in Customer Content. Customer grants DentalXpand and its approved subcontractors a limited right to host, copy, transmit, transform, display, and otherwise process Customer Content only as needed to provide, secure, support, and improve the Customer-facing Service, follow lawful Customer instructions, and meet legal obligations.

Customer represents and warrants that it has all rights, notices, authorizations, consents, and lawful bases necessary to submit and process Customer Content, including information relating to patients, providers, employees, applicants, leads, guarantors, and third parties. Customer must not direct DentalXpand to process information in violation of law, professional duty, contract, payer rule, or individual rights.

Aggregate and deidentified information

DentalXpand may create and use aggregate or deidentified information for security, capacity planning, product quality, benchmarking, and business operations if the information does not identify Customer or an individual and is not reidentified. A BAA, DPA, or Order Form may impose additional limits.

Backups and exports

Customer is responsible for maintaining copies required by its record-retention, continuity, legal, or professional obligations. The Service is not Customer's sole legally required archive unless a signed agreement expressly says otherwise. Exports may contain sensitive data and become Customer's responsibility when downloaded or transmitted to a Customer-selected destination.

Protected health information and regulated healthcare data

Customer may submit PHI only if: (a) Customer is legally permitted to do so; (b) the intended DentalXpand module and deployment are approved for that use; (c) the parties have executed any required BAA; and (d) Customer follows the BAA, Documentation, minimum-necessary principles, and applicable privacy and security law.

The BAA, not these Terms, defines permitted PHI uses, breach and security-incident duties, subcontractor requirements, access and amendment assistance, accounting support, and return or destruction obligations. If no BAA is in effect, the Service is not authorized for PHI.

Customer remains the covered entity, business associate, healthcare provider, payer, or record custodian responsible for patient notices, authorizations, retention, individual requests, clinical decisions, and regulatory reporting except to the extent the BAA expressly assigns an obligation to DentalXpand.

Customer responsibilities

Customer is responsible for its business, professional, legal, and operational use of the Service, including:

• the accuracy, quality, legality, and provenance of Customer Content;
• configuring organizations, practices, roles, permissions, integrations, retention, and support access;
• verifying payer, claim, credentialing, coding, payment, provider, HR, financial, and AI-assisted output before use;
• maintaining professional licenses, payer enrollment, provider credentials, policies, consents, and required records;
• giving employees, applicants, patients, providers, and recipients all notices and choices required by law;
• ensuring that only authorized personnel access PHI, financial data, credentials, recordings, screenshots, and other sensitive information;
• using supported browsers, secure networks, compatible devices, and properly configured Customer systems; and
• following Documentation, integration terms, payer and clearinghouse rules, and reasonable security instructions.

Customer will cooperate reasonably with DentalXpand in investigating misuse, correcting configuration issues, responding to incidents, and satisfying lawful requests related to Customer Content.

Acceptable use restrictions

Customer and Authorized Users must not, and must not help another person to:

• use the Service unlawfully, deceptively, abusively, or in violation of privacy, healthcare, employment, communications, intellectual-property, export, sanctions, or professional rules;
• access another Customer's data, impersonate another person, misstate authority, or bypass authentication, tenant, role, practice, or storage controls;
• probe, scan, test, attack, overload, disrupt, or introduce malicious code into the Service without prior written authorization;
• reverse engineer, decompile, disassemble, copy, frame, mirror, scrape, or derive source code or non-public models from the Service except where a non-waivable law permits it;
• resell, sublicense, time-share, or provide the Service as a standalone bureau service unless the Order Form expressly permits managed services or client access;
• upload content that is unlawful, infringing, defamatory, harassing, discriminatory, fraudulent, or designed to cause harm;
• use the Service to make a decision based on protected characteristics or to engage in unlawful discrimination;
• use credentials, tokens, provider portal access, or Google authorization belonging to another person without permission;
• send spam, unlawful robocalls or texts, deceptive outreach, or communications that ignore opt-outs or do-not-contact requests;
• capture screenshots, recordings, audio, video, messages, or device activity without required notice and consent; or
• remove proprietary notices, conceal audit activity, or use the Service to create a competing product through systematic extraction.

Reasonable API use, approved data migration, authorized security testing, and Customer-directed exports remain permitted when documented and within purchased limits.

Lead generation, email, calling, and communications

DentalXpand can help Customers identify public business information, organize leads, draft or send email, schedule meetings, record call notes, and manage outreach. DentalXpand does not determine whether a particular contact, message, call, recording, list, or campaign is lawful.

Customer is solely responsible for:

• having a lawful basis for collecting, enriching, importing, and contacting each lead;
• using accurate sender and caller identity, non-deceptive subjects and content, and required advertising disclosures;
• including a valid business address and working unsubscribe method where required;
• honoring email opt-outs, revocation of consent, internal suppression lists, and applicable do-not-call registries promptly;
• obtaining prior express or written consent for automated, prerecorded, artificial-voice, text, or marketing communications where required;
• complying with CAN-SPAM, the TCPA, the Telemarketing Sales Rule, state mini-TCPA and recording laws, GDPR and ePrivacy rules, and comparable laws in every recipient jurisdiction; and
• maintaining evidence of consent, source, campaign instructions, suppression, and compliance.

Customer must not use scraped or public business information in a way that violates a source's terms, robots restrictions, intellectual-property rights, privacy rights, or applicable law. Public availability does not by itself create permission for every use.

Time tracking and workforce monitoring

When Customer enables attendance, presence, task timers, work diaries, active-window or URL data, screenshots, call recording, meeting recording, or similar monitoring, Customer acts as the party deciding why and how monitoring occurs. Customer must conduct a jurisdiction-specific legal review before activation.

Customer will:

• provide clear, timely notice describing what is collected, when collection occurs, who can review it, the purpose, and retention;
• obtain affirmative consent where required and preserve evidence of that consent;
• offer any required alternative process and respect rights under employment, labor, wiretap, privacy, and collective-bargaining law;
• limit monitoring to authorized work activity and avoid capturing personal, privileged, confidential third-party, or legally protected content;
• configure access and retention proportionately and respond to employee access, correction, deletion, or complaint requests; and
• not use monitoring data for unlawful discrimination, retaliation, or a decision that legally requires additional safeguards.

DentalXpand does not provide employment-law advice and does not warrant that a Customer's monitoring configuration is lawful in any jurisdiction.

AI-assisted and automated features

AI features may generate summaries, drafts, extraction, classifications, suggestions, or answers from prompts and selected Customer Content. Outputs are probabilistic and may be inaccurate, incomplete, biased, duplicated, or unsuitable for Customer's purpose.

Required human oversight

Customer must ensure that a qualified human reviews AI output before it affects patient care, coverage communication, claim submission, coding, payment, credentialing, licensing, employment, compensation, lending, legal rights, or another material decision. AI output is not medical, dental, legal, accounting, coding, credentialing, human-resources, or financial advice.

Data and model configuration

Customer may be able to choose a local or remote model provider and select context or attachments. Customer is responsible for ensuring that the chosen provider, region, BAA, DPA, retention setting, and intended data are authorized. Do not send PHI, credentialing passwords, financial-account credentials, government IDs, or other restricted data to an AI provider unless expressly approved under the Agreement and applicable law.

Reviewed learning

Where enabled, sanitized interactions may enter a human review queue and approved material may improve retrieval or model behavior for the authorized environment. Automated masking is not guaranteed to remove every identifier. Customer must configure, review, and approve this feature consistently with its BAA, notices, consents, and data policies. Google user data may not be used for generalized model training.

Customer may not use AI output to mislead another person about human authorship where disclosure is required, infringe rights, generate unlawful content, or make a solely automated legally significant decision without a valid basis and required safeguards.

Healthcare, eligibility, claim, and credentialing limitations

DentalXpand organizes and transmits operational information but does not independently verify every source response and is not the payer, clearinghouse, provider, credentialing authority, licensing board, or clinical decision-maker.

• Eligibility and benefits. A verification is a point-in-time response, not a guarantee of coverage or payment. Benefits can change and may depend on plan documents, treatment, frequency, history, network, authorization, coordination, limitations, exclusions, and claim adjudication.
• Claims and coding. Customer is responsible for accurate diagnosis and procedure coding, documentation, medical necessity, payer rules, timely filing, claim content, appeals, and refund or overpayment duties.
• Credentialing. Customer and each provider are responsible for truthful, current applications, disclosures, licenses, signatures, attestations, portal use, deadlines, and payer follow-up. DentalXpand does not guarantee enrollment, effective dates, network participation, or reimbursement.
• Documents and extraction. OCR, PDF parsing, autofill, and AI extraction require comparison against the source document. Customer must correct errors before submission or reliance.
• No clinical use. The Service does not diagnose, treat, prescribe, establish a provider-patient relationship, or replace emergency services.

Customer must independently confirm critical information with the payer, patient, provider, source document, or responsible authority and must communicate uncertainty accurately.

Third-party services and integrations

The Service may interoperate with Google, Supabase, payer and clearinghouse services, claim and eligibility networks, AI model providers, communications and meeting services, maps and search sources, email and push providers, practice systems, Guardian systems, and other Customer-selected services.

Third-party services are governed by their own agreements, privacy notices, availability, pricing, verification, acceptable-use rules, and data practices. Customer authorizes DentalXpand to exchange information with an integration when Customer or an Authorized User connects, configures, or invokes it.

DentalXpand is not responsible for a third party's acts, omissions, data accuracy, downtime, policy changes, account suspension, API limits, security, or use of Customer Content, except to the extent the third party is DentalXpand's subcontractor and the Agreement assigns responsibility to us. We may suspend or modify an integration if required by the provider, law, security, or technical feasibility.

Customer is responsible for third-party accounts, credentials, permissions, licenses, and fees, and for disconnecting access when no longer needed.

Google-connected features

If an Authorized User connects Google, Customer authorizes DentalXpand to use granted account identity, Gmail sending, and Google Calendar event permissions to provide the visible connected features selected by the user. DentalXpand's use and transfer of Google API data will comply with the Google API Services User Data Policy, including Limited Use requirements.

Customer and users must comply with Google's terms, use only accounts they are authorized to connect, review requested scopes, and promptly revoke access for a compromised or departed user. Disconnecting Google prevents future API access but does not automatically delete messages, calendar records, audit data, or copies already delivered to recipients.

Google-connected data may not be used through DentalXpand for advertising, surveillance, data brokerage, creditworthiness, or other prohibited purposes. Customer may not direct DentalXpand or an Authorized User to circumvent Google authorization, consent, scope, or policy requirements.

Intellectual property and feedback

DentalXpand and its licensors own the Service, Documentation, website, software, interfaces, designs, workflows, models, compilations, trademarks, logos, and all related intellectual-property rights, excluding Customer Content and third-party materials. No right is granted except the limited access right stated in the Agreement.

If Customer provides feedback, suggestions, error reports, or ideas, Customer grants DentalXpand a perpetual, worldwide, irrevocable, royalty-free right to use and incorporate that feedback without identifying Customer or disclosing Customer Confidential Information. Customer is not required to provide feedback.

Open-source and third-party components remain subject to their applicable licenses. Nothing in the Agreement grants a right to use DentalXpand names, marks, or logos in publicity without prior written permission, except factual internal references to Customer's authorized use.

Confidentiality

"Confidential Information" means non-public information disclosed by one party that is marked confidential or reasonably should be understood as confidential, including Customer Content, PHI, security information, credentials, pricing, product plans, source code, and business records.

The receiving party will:

• use Confidential Information only to perform or exercise rights under the Agreement;
• protect it with at least reasonable care and no less care than used for its own similar information;
• disclose it only to personnel, advisers, and subcontractors who need it and are bound by appropriate duties; and
• notify the disclosing party of unauthorized disclosure as required by the Agreement or law.

Confidential Information excludes information that the receiving party can document was lawfully known without restriction, independently developed without use, lawfully received from a third party, or made public without breach. If law requires disclosure, the receiving party will provide advance notice where legally permitted and disclose only what is required.

Security, support, and incident cooperation

DentalXpand will maintain reasonable administrative, technical, and organizational safeguards appropriate to the Service and data, as further described in any BAA, DPA, security addendum, or Documentation. Safeguards do not eliminate all risk, and Customer must maintain its own security program.

Customer will not conduct penetration testing, vulnerability scanning, or load testing without written authorization. Good-faith vulnerability reports should be sent privately to the support contact and must not include unnecessary access, disruption, extortion, public disclosure before remediation, or retention of Customer data.

Support access

Customer may authorize DentalXpand personnel to access a workspace for support. Support access may be reason-documented, time-limited, scoped, and audited. Customer should provide the minimum necessary data and use approved secure channels. DentalXpand may refuse passwords, unnecessary PHI, or sensitive information sent through an unapproved channel.

Incident cooperation

Each party will promptly notify the other of a confirmed incident affecting the other party's data or systems where required by the Agreement, preserve relevant evidence, take reasonable containment steps, and cooperate with legally required notices. Neither party will make a public statement assigning fault to the other without consultation, unless law requires it.

Suspension and protective action

DentalXpand may limit or suspend access to all or part of the Service if reasonably necessary to:

• prevent or contain a security threat, unlawful activity, material privacy risk, or harm to another Customer;
• respond to a legal requirement or third-party service restriction;
• address material violation of the Agreement or Acceptable Use restrictions;
• protect Service integrity from abusive volume, automated extraction, or technical disruption; or
• address undisputed overdue fees after required notice and cure.

Where practical, we will notify Customer, limit suspension to affected users or functions, and restore access after the issue is resolved. Emergency or legally restricted circumstances may prevent advance notice. Suspension does not relieve Customer of fees accrued before or during a suspension caused by Customer.

Term, termination, and data transition

The Agreement begins when accepted and continues through the subscription term. Renewal and cancellation rules are stated in the Order Form. Either party may terminate for material breach if the breach is not cured within 30 days after written notice, or sooner if the breach cannot reasonably be cured. Either party may terminate as stated in the Order Form for insolvency or cessation of business, subject to applicable law.

Effect of termination

• Customer's right to use the Service ends and Authorized Users must stop access.
• Customer must pay fees accrued through termination and any non-cancelable committed fees, except where termination results from DentalXpand's uncured material breach.
• On timely request and subject to account standing, DentalXpand will make Customer Content available for export in a reasonably available format during the transition period stated in the Order Form or, if none is stated, for 30 days after termination.
• After the transition period, DentalXpand may delete Customer Content from active systems according to the Privacy Policy, BAA, DPA, backup cycles, and legal holds.
• Customer must revoke integrations, rotate shared credentials, retrieve required records, and notify users and counterparties as appropriate.

Provisions that by their nature should survive will survive, including accrued payment, confidentiality, intellectual property, disclaimers, indemnity, liability limits, dispute terms, and lawful retention obligations.

Limited warranties and disclaimers

DentalXpand warrants that, during a paid subscription term, the Service will perform materially in accordance with its applicable Documentation under normal authorized use, and professional services will be performed in a professional and workmanlike manner. Customer's exclusive remedy for a verified breach is for DentalXpand to use reasonable efforts to correct or reperform the affected Service, or if we cannot do so within a reasonable period, to terminate the affected Order Form and refund prepaid fees for the unused affected period.

The warranty does not apply to issues caused by Customer Content, Customer configuration, unsupported systems, third-party services, unauthorized changes, misuse, free or beta features, or use contrary to Documentation.

Nothing in the Agreement excludes a warranty or right that cannot legally be excluded.

Indemnification

Customer will defend, indemnify, and hold harmless DentalXpand, its affiliates, and their personnel from third-party claims, damages, penalties, losses, and reasonable legal fees arising from:

• Customer Content or Customer's lack of required rights, notices, consents, or authorizations;
• Customer's or an Authorized User's unlawful or prohibited use of the Service;
• Customer's patient care, billing, coding, claim, credentialing, employment, lending, monitoring, outreach, recording, or professional decision;
• Customer's violation of privacy, healthcare, employment, communications, intellectual-property, payer, or other applicable requirements; or
• a Customer-controlled integration, export, credential, system, or recipient.

This obligation does not apply to the extent a claim is caused by DentalXpand's breach of the Agreement, gross negligence, willful misconduct, or infringement by the unmodified Service. DentalXpand will provide prompt notice and reasonable cooperation. Customer may control the defense, but may not admit fault for DentalXpand or impose a non-monetary obligation on DentalXpand without written consent.

Any DentalXpand intellectual-property indemnity, defense procedure, or exclusive remedy applies only if expressly included in a signed Order Form or master agreement.

Limitation of liability

To the maximum extent permitted by law, neither party will be liable under the Agreement for lost profits, revenues, goodwill, business opportunities, or data; business interruption; substitute services; or indirect, incidental, special, exemplary, punitive, or consequential damages, even if advised that such damages were possible.

Except for excluded claims below, each party's total aggregate liability arising out of or relating to the Agreement will not exceed the fees paid or payable by Customer for the affected Service during the 12 months immediately before the event giving rise to the claim. For a free Service, DentalXpand's aggregate liability will not exceed USD 100.

The exclusions and cap do not limit: (a) Customer's payment obligations; (b) Customer's breach of acceptable-use restrictions or misuse of DentalXpand intellectual property; (c) Customer's indemnification obligations; (d) either party's fraud, willful misconduct, or gross negligence to the extent liability cannot be limited; or (e) any liability that applicable law prohibits the parties from limiting. A signed agreement may state a different or enhanced cap for confidentiality, security, privacy, or PHI claims.

These limitations allocate risk between the parties and are an essential basis of the bargain. They apply regardless of legal theory and even if a limited remedy fails of its essential purpose.

General terms, disputes, and contact

Compliance, export, and sanctions

Each party will comply with laws applicable to its performance. Customer may not use or export the Service in violation of U.S. or other applicable export-control or sanctions laws and represents that it is not prohibited from receiving the Service.

Governing law and forum

The governing law and forum stated in the applicable signed agreement or Order Form control. If none is stated, these Terms are governed by the laws applicable to the DentalXpand contracting provider identified in Customer's invoice or contracting document, without regard to conflict-of-law rules, and the parties consent to courts located at that provider's principal place of business. Mandatory rights that cannot be waived remain unaffected.

Good-faith dispute process

Before filing a claim, the party raising it will provide written notice describing the dispute and requested resolution. Authorized business representatives will attempt in good faith to resolve it for at least 30 days, unless urgent injunctive relief, a limitation period, security, confidentiality, or legal process requires earlier action.

Notices

Formal notices must be sent to the addresses in the Order Form. Operational notices may be delivered through the Service or to the account email. A notice is effective when received, except that email is effective when no delivery failure is returned and the Agreement permits email notice.

Assignment, force majeure, and relationship

Neither party may assign the Agreement without the other's consent, except to an affiliate or in connection with a merger, reorganization, financing, or sale of substantially all relevant assets, provided the assignee assumes the Agreement and is not a direct competitor where a reasonable objection applies. Neither party is liable for delay caused by events beyond reasonable control, except payment obligations. The parties are independent contractors, and the Agreement creates no partnership, agency, fiduciary duty, franchise, employment, or joint venture.

Entire agreement and interpretation

The Agreement is the entire agreement concerning its subject and supersedes prior proposals and discussions. Amendments must be in a signed writing unless the Agreement expressly permits an online update. Failure to enforce a term is not a waiver. Invalid terms will be modified to the minimum extent necessary, and the remainder remains effective. Headings aid reading and do not limit meaning. "Including" means "including without limitation." Electronic signatures and counterparts are valid.

Changes to online Terms

We may update these Terms for future purchases or renewals and may update them during a term to address law, security, abuse, third-party requirements, or non-material operational changes. We will post the new date and provide additional notice where a change materially reduces Customer rights or increases Customer obligations. A negotiated signed agreement will not be amended by an online update unless it expressly allows that method.

These online Terms are designed for the current DentalXpand website and product. The contracting entity name, notice address, governing law, commercial pricing, service levels, and negotiated risk terms should be confirmed in the applicable Order Form or master agreement.