Privacy Statement for the Matisse Platform

Labmatisse B.V. | Version 2.1 | Effective as of November 9th, 2026

Introduction and scope

1. This Privacy Statement explains how Labmatisse B.V., a private limited liability company incorporated under the laws of the Netherlands, registered with the Dutch Chamber of Commerce under number 74032682 and having its registered office at Zwanensingel 129, 6601 GE Wijchen, the Netherlands (“Labmatisse”, “we”, “us” or “our”), processes personal data in connection with the Matisse Platform.
2. The Matisse Platform is a business-to-business Software-as-a-Service application for dental laboratories, dental practices and other professional users. It includes the websites through which it is offered (including colorisse.ai), the web application, any mobile or desktop applications made available by Labmatisse, and related APIs, documentation and services.
3. This Privacy Statement primarily describes processing for which Labmatisse determines the purposes and means and therefore acts as controller. It also explains, for transparency, the circumstances in which Labmatisse processes patient-related data solely on behalf of a customer as processor or sub-processor. That processing is governed by the applicable Data Processing Agreement (“DPA”).
4. This Privacy Statement does not replace the privacy information that a dental practice, dental laboratory or other customer must provide to its own patients, employees or other data subjects where that customer is the controller.
5. Capitalised terms not defined in this Privacy Statement have the meaning given to them in the Terms and Conditions for the Matisse Platform (the “Terms”), available at Terms and Conditions. The DPA is available at Data Processing Agreement.

Our roles under the GDPR

1. When Labmatisse acts as controller
   1. Labmatisse acts as controller for personal data relating to account holders and Authorized Users, website and Platform visitors, business contacts and prospective customers, billing and subscription administration, service communications, support interactions, and security and access logging, to the extent Labmatisse determines the purposes and means of that processing. This processing is not governed by the DPA.
2. When Labmatisse acts as processor or sub-processor
   1. For personal data contained in photographs, projects and other Content uploaded by a customer to the Platform, the customer determines the purposes and means of the processing and Labmatisse acts as processor. This includes the name or user identifier of an Authorized User insofar as it is recorded in project data, for example as creator or editor of a project.
   2. Where a customer itself acts as processor for a dental practice or another controller, Labmatisse acts as sub-processor. In either case, Labmatisse processes that personal data only on documented instructions and in accordance with the DPA, unless applicable law requires otherwise.
   3. Labmatisse does not use personal data processed on behalf of a customer for Labmatisse’s own purposes. The separate rules for data that has first been irreversibly anonymised are set out in Clause 6.

Personal data we process as controller

1. Depending on how you interact with Labmatisse, we may process the following categories of personal data for the purposes and on the legal bases described below.

   Category	Data	Purpose	Legal basis
   Account and registration data	First and last name; email address; username; company name; company address and telephone number if provided; subscription type and status; authentication credential information, including password information stored in hashed form, where processed by Labmatisse or its authentication provider.	Creating and administering the account; authenticating users; providing access to the Platform; managing subscriptions and the contractual relationship.	Article 6(1)(b) GDPR (performance of a contract or steps requested before entering into a contract).
   Technical, security and usage data	IP address; device and browser information; login records; security logs; Platform usage and technical diagnostic data.	Securing the Platform; detecting abuse and security incidents; preventing fraud and verifying compliance with the Terms; maintaining technical integrity and availability; enforcing access controls.	Article 6(1)(f) GDPR. Our legitimate interests are the security, integrity, reliability and proper use of the Platform.
   Billing and transaction data	Billing contact details; company invoicing details; subscription plan; transaction and invoice references; payment status. Payment-card data is generally handled by the payment provider rather than stored by Labmatisse.	Billing, collecting subscription fees, maintaining accounting records and complying with tax and financial obligations.	Article 6(1)(b) GDPR for contractual billing and Article 6(1)(c) GDPR where processing is required by law.
   Communications and support data	Name; business contact details; correspondence; support requests; onboarding communications; service-related messages and records of interactions.	Providing onboarding and support; responding to requests; communicating about the service and the account; managing the business relationship.	Article 6(1)(b) GDPR where necessary to provide the service or take requested pre-contractual steps; Article 6(1)(f) GDPR for ordinary B2B relationship management and service administration where appropriate.
   Legal and compliance records	Relevant correspondence, account records, security information and transaction records where needed for compliance, dispute handling or legal claims.	Complying with legal obligations and establishing, exercising or defending legal claims.	Article 6(1)(c) GDPR where required by law and Article 6(1)(f) GDPR for the establishment, exercise or defence of legal claims.

2. Where we rely on legitimate interests, we assess whether those interests are overridden by the interests or fundamental rights and freedoms of the individual. You may object to processing based on legitimate interests as explained in Clause 11.
3. Where the details of an Authorized User are provided by the customer, for example when an administrator adds a user to the account, we obtain them from that customer.

Payment processing

1. Payments may be processed by Stripe, LLC or another payment provider made available through the Platform. The payment provider may act as an independent controller for certain payment and transaction data under its own privacy notice.
2. Labmatisse generally receives information necessary to administer the subscription, such as transaction references, payment status and billing information. Labmatisse does not require access to full payment-card details where those details are collected directly by the payment provider.

Patient data processed on behalf of customers

1. The Platform allows professional users to upload photographs of teeth and related project information for the generation of reference or colour codes for ceramic restorations. The personal data processed on behalf of customers may include:
   • photographs of teeth;
   • generated reference or colour codes;
   • project identifiers;
   • upload metadata, including date and time of upload; and
   • other project information entered by the customer to the extent permitted by the Terms.
2. Depending on the context, photographs and project information relating to an identifiable patient may constitute data concerning health and therefore special-category personal data under Article 9 GDPR. The customer, as controller (or the controller on whose behalf the customer acts), is responsible for establishing the applicable legal bases under Articles 6 and, where relevant, 9 GDPR and for providing the required privacy information to patients.
3. Customers are instructed not to include patient names or other directly identifying personal data in photographs, file names or project names. Labmatisse processes patient data only to provide the Platform to the customer, consisting of secure cloud storage, the generation of the requested reference codes and the security, maintenance and support of the Platform, in accordance with the customer’s documented instructions and the DPA.

Irreversible anonymisation, AI development and anonymised datasets

1. The contractual framework permits Labmatisse, on the documented instruction of the customer as controller, to irreversibly anonymise personal data processed on the customer’s behalf so that it can no longer be attributed, directly or indirectly, to an identified or identifiable person, customer, clinic or patient.
2. Labmatisse will not use personal data for the purposes described in this Clause 6, other than to carry out the anonymisation itself. Any such use occurs only after the data has been irreversibly anonymised and the technical and organisational measures required to achieve irreversible anonymisation have been implemented and internally validated.
3. Once data has been irreversibly anonymised so that it no longer relates to an identified or identifiable natural person, it is no longer personal data within the meaning of the GDPR. Anonymised data may include reference codes, colour parameters, material characteristics, performance metrics, statistical correlations and other technical outputs.
4. Labmatisse may use irreversibly anonymised data for:
   • development, training, validation, testing and improvement of algorithms and artificial intelligence models used in the Platform;
   • quality assurance, analytics and statistical research;
   • development, optimisation and evaluation of dental, ceramic and related products, materials and workflows; and
   • creation and commercial exploitation of aggregated or anonymised datasets, including making such datasets available to third parties, provided that the datasets cannot be used to derive information about an identifiable person, customer, clinic or patient and do not disclose proprietary or competitively sensitive customer information.
5. Labmatisse does not sell personal data. The commercial use of data described above concerns only data that has first been irreversibly anonymised and is no longer personal data.
6. Labmatisse will not attempt to re-identify anonymised data and will require third parties receiving anonymised datasets to be contractually prohibited from attempting re-identification or using the datasets in violation of applicable law.

Recipients and service providers

1. Labmatisse limits access to personal data to persons and service providers that need it for the purposes described in this Privacy Statement. Service providers that process personal data on our behalf are subject to appropriate contractual and confidentiality obligations.

   Provider	Service	Processing location
   Amazon Web Services EMEA SARL	Cloud hosting, data storage, infrastructure and backups	European Union
   Auth0, Inc. (Okta)	User authentication and identity management	European Union and United States
   Stripe, LLC	Payment processing and billing services; Stripe may act as an independent controller for payment transaction data	European Union and United States
   Intercom, Inc.	Transactional email, user communications and customer support	European Union and United States

2. The service providers listed above process personal data for which Labmatisse is controller. Amazon Web Services also hosts Content that Labmatisse processes on behalf of customers. The sub-processors for that processing are listed in Appendix 2 to the DPA, available at Data Processing Agreement.
3. We may also disclose personal data where required by applicable law, a binding order of a competent authority, or where reasonably necessary to establish, exercise or defend legal claims, or where a third party sufficiently substantiates that the customer is infringing its rights or the Terms, as described in the Terms, subject to applicable legal safeguards.

International transfers

1. Labmatisse processes personal data primarily within the European Economic Area (“EEA”). Some service providers may process personal data in or provide access from countries outside the EEA, including the United States.
2. Where a transfer outside the EEA constitutes a restricted transfer under the GDPR, Labmatisse uses a lawful transfer mechanism. Transfers to the United States are based on the EU-U.S. Data Privacy Framework where the recipient is certified under it, and otherwise on the European Commission’s Standard Contractual Clauses, supplemented where necessary by additional safeguards.
3. You may contact us using the details in Clause 16 to request further information about the safeguards used for an international transfer and, where applicable, information on how to obtain a copy of the relevant safeguards.

Retention and deletion

1. We keep personal data only for as long as necessary for the purposes for which it was collected, including the duration of the contractual relationship, and thereafter only where retention is required or justified by applicable law, accounting or tax obligations, security requirements, or the establishment, exercise or defence of legal claims.
2. Account and subscription data is generally retained while the account and Agreement remain active. On deletion of the account, Labmatisse permanently deletes personal data relating to the customer and its Authorized Users from active systems without undue delay, except where retention is required for the reasons described in Clause 9.1.
3. Where a customer deletes a project or Content within the Platform, it may remain in a temporary deletion or “Trash” state for up to thirty (30) days to allow recovery. It is not actively processed or used during that period other than for storage and recovery. After that period it is permanently deleted unless retention is legally required or necessary for legal claims.
4. Personal data processed on behalf of a customer is retained for the duration of the Agreement and deleted on account deletion or termination in accordance with the DPA. Limited backup copies and system logs may persist for a short period in accordance with standard retention cycles, after which they are automatically overwritten or securely deleted.
5. Billing, transaction and compliance records are retained for seven 7 years, as required by Dutch tax and accounting law. Security and access logs are retained for up to 12 months and support records for up to 24 months after the request is closed, unless a longer period is necessary for security investigations, dispute handling or legal claims.
6. Once data has been irreversibly anonymised in accordance with Clause 6, it is no longer personal data and the GDPR retention rights applicable to personal data no longer apply to that anonymised data.

Security

1. Labmatisse implements and maintains appropriate technical and organisational measures designed to ensure a level of security appropriate to the risk, including access controls, encryption of personal data in transit and at rest, secure cloud infrastructure and regular security testing and monitoring.
2. No system can be guaranteed to be absolutely secure. Labmatisse reviews its security measures in light of the state of the art, implementation costs, the nature and purposes of processing, and the risks to individuals.

Your rights when Labmatisse acts as controller

1. Subject to the conditions and limitations in the GDPR, you may have the right to:
   • obtain access to your personal data and information about how it is processed;
   • have inaccurate personal data corrected;
   • request erasure of personal data;
   • request restriction of processing;
   • receive personal data you provided in a structured, commonly used and machine-readable format and, where applicable, have it transmitted to another controller;
   • object to processing based on legitimate interests, including on grounds relating to your particular situation;
   • withdraw consent at any time where a specific processing activity is based on consent, without affecting processing carried out before withdrawal; and
   • lodge a complaint with a competent supervisory authority.
2. To exercise rights relating to personal data for which Labmatisse is controller, contact us at info@matisse.ai. We may need to verify your identity before responding. We will respond within the time limits required by applicable data protection law.
3. You may lodge a complaint with the supervisory authority in the Member State of your habitual residence, place of work or place of the alleged infringement. Labmatisse is established in the Netherlands, where the supervisory authority is the Autoriteit Persoonsgegevens. If you are located in France, you may also lodge a complaint with the Commission nationale de l’informatique et des libertés (“CNIL”).

Rights relating to patient data processed on behalf of a customer

1. If your personal data was uploaded to the Platform by a dental practice, dental laboratory or another Labmatisse customer, that organization (or the controller on whose behalf it acts) is responsible for responding to your data-protection request.
2. You should therefore normally direct requests concerning patient data to the relevant dental practice, dental laboratory or other controller. If Labmatisse receives such a request directly, Labmatisse will not independently decide the request and will notify or refer it to the relevant controller, unless applicable law requires otherwise.

Mandatory provision of data

1. Certain account, authentication, subscription and billing information is necessary to create and administer an account, provide the Platform and perform the Agreement. If required information is not provided, Labmatisse may be unable to create or maintain the account or provide the relevant service.
2. Some information may also be required by law, for example information necessary for invoicing, accounting or compliance. Technical and security information may be generated automatically when the Platform is accessed and is necessary for secure operation of the service.

Automated decision-making

1. Labmatisse does not use personal data to make decisions based solely on automated processing that produce legal effects concerning an individual or similarly significantly affect an individual within the meaning of Article 22 GDPR.
2. Reference codes and other technical outputs generated by the Platform are intended as non-binding technical and aesthetic references for professional users and do not constitute automated legal or clinical decisions about patients.

Changes to this Privacy Statement

1. Labmatisse may update this Privacy Statement to reflect changes in the Platform, processing activities, service providers or applicable law. The current version will be made available through the relevant website or Platform.
2. Where a change is material to how Labmatisse processes personal data as controller, Labmatisse will take reasonable steps to bring the change to the attention of affected individuals, for example through the Platform or by email where appropriate, before or when the change takes effect.

Contact

1. For questions about this Privacy Statement or Labmatisse’s processing of personal data, or to exercise your rights where Labmatisse acts as controller, contact:

   Labmatisse B.V.
   Zwanensingel 129
   6601 GE Wijchen
   The Netherlands
   Email: info@matisse.ai

2. If Labmatisse designates a Data Protection Officer, the applicable contact details will be made available through the Platform or website.