Payment Services Policy

This Payment Services Policy (the “Policy”) describes how AiroDental Pay works day to day. It is a single, consolidated operational policy that brings together the rules that previously appeared as separate Payment Provider Terms, Payment Security and PCI Rules, Payment Method Rules, and Hardware and Terminal Terms. Those separate pages have been merged into this document so that a practice has one place to read the operational, technical, and compliance rules that govern AiroDental Pay.

This Policy is incorporated by reference into the Payments, Treatment Plan and Financial Features Addendum (the “Addendum”) and the AiroDental Master Services Agreement or Terms of Service (the “MSA”). Core contract rights, such as liability, indemnity, warranty disclaimers, and dispute resolution, live in the Addendum and the MSA. This Policy covers the operational, technical, and compliance details that change more often. Where this Policy conflicts with the Addendum or the MSA on a contractual right, the Addendum and the MSA control.

1. Introduction and Scope

1.1 What this Policy covers

This Policy applies to a dental practice or other customer that uses AiroDental Pay to request, collect, or process payments through AiroDental (the “Practice”). It covers payment providers and processors, the payment methods AiroDental Pay supports, the authorizations each method requires, payment security and PCI rules, card-present hardware and terminals, chargebacks and disputes, payouts and reconciliation, fees, prohibited use, and support.

1.2 AiroDental is not a bank or processor

AiroDental provides software that connects a Practice to third-party payment processors, acquiring banks, and payment networks. AiroDental is not a bank, money transmitter, merchant of record, acquirer, or card network, and does not hold Practice funds, except where a payment provider’s terms expressly state otherwise. The movement, holding, and settlement of funds is performed by the applicable payment provider and its financial partners under their terms.

1.3 Availability of features

AiroDental Pay features are enabled per Practice as they become available and as the applicable payment provider approves them. A rule in this Policy applies to a Practice only once the related feature or payment method is enabled for that Practice. AiroDental may make a feature available in stages, limit it to eligible Practices, or withdraw it, subject to the notice terms in the Addendum.

2. Definitions

The following terms have the meanings below when used in this Policy. Capitalized terms that are not defined here have the meanings given in the Addendum or the MSA.

• ACH means an electronic bank debit or credit processed through the Automated Clearing House network, governed by the Nacha Operating Rules.
• Card networks means Visa, Mastercard, American Express, Discover, and other payment card networks whose rules apply to card transactions.
• Card-present means a payment taken in person on a physical payment terminal or reader, as opposed to an online or keyed transaction.
• Chargeback means a card network dispute in which a cardholder’s issuing bank reverses a transaction.
• PAN means the primary account number, that is, the full payment card number.
• Payment provider or processor means a third-party payment processor, and its acquiring banks and financial partners, that AiroDental engages to onboard merchants, process payments, and settle funds.
• Payment token or method ID means an opaque reference issued by a payment provider that stands in for a card or bank account, so that raw credentials are not stored in AiroDental.
• PCI DSS means the Payment Card Industry Data Security Standard.
• Reserve means funds a payment provider holds back from settlement to cover potential chargebacks, refunds, or losses, under the provider’s terms.
• Settlement or payout means the transfer of collected funds to a Practice’s designated bank account, net of fees, reserves, refunds, and adjustments.

3. Payment Providers and Processors

3.1 Our payment processors

AiroDental engages one or more third-party payment processors to handle card and bank payments. Those processors work with acquiring banks and payment networks to authorize, capture, and settle payments, and they may use ACH providers for bank debits. The specific processor that applies to a Practice, along with a link to that processor’s then-current terms, is shown during payment activation and in the Practice’s payment settings. AiroDental is not the merchant of record, processor, acquirer, or bank, except where a processor’s terms expressly state otherwise.

3.2 Processor terms apply directly

A Practice’s use of payment services is subject to the then-current terms of the applicable payment processor. AiroDental presents or links to those terms during activation so a Practice can review the version in effect at that time. A processor’s terms address items such as prohibited-business rules, reserves, payout timing, and dispute procedures, and they apply directly between the Practice and the processor. A processor may suspend, limit, hold, or reserve funds in accordance with its terms, independent of AiroDental.

3.3 Direct acceptance and onboarding

Some processor terms must be accepted directly by the Practice as part of setting up its merchant or connected account. Where a processor requires direct acceptance, AiroDental presents or links to those terms during activation and does not accept them on the processor’s behalf. Completing processor onboarding, including business and identity verification, commonly called KYB and KYC, and banking setup, is a condition of enabling live processing.

3.4 Changes of processor

AiroDental may add, remove, or change payment processors. When a processor changes, AiroDental updates the processor identity and terms shown during activation and in the Practice’s payment settings. Where a change materially affects a Practice’s economics or liability, AiroDental provides notice as described in the Addendum. If a new processor requires direct acceptance of its terms, the Practice completes that acceptance before continuing to process payments.

4. Processor Approval, Onboarding, and Eligibility

4.1 Approval is required and not guaranteed

Access to payment processing depends on approval by the applicable payment provider and on the provider’s ongoing monitoring. A Practice must complete provider onboarding, identity and business verification, and banking setup before live processing is enabled. AiroDental does not guarantee that a provider will approve, or continue to serve, any Practice, payment method, processing rate, payout schedule, or reserve level.

4.2 Ongoing verification

A payment provider may require updated information about a Practice, its owners, or its business at any time to meet legal, banking, or network requirements. A Practice provides accurate and current information and updates it promptly when it changes. Failure to provide required information may result in a hold, limit, reserve, or suspension of processing by the provider.

4.3 Underwriting decisions

Underwriting, risk scoring, reserve decisions, and account limits are made by the payment provider under its terms. AiroDental does not control those decisions and is not responsible for a provider’s decision to decline, limit, reserve, or offboard a Practice.

5. Supported Payment Methods

5.1 Currently supported

AiroDental Pay currently supports card payments for online treatment-plan and invoice checkout. Stored-card, recurring-card, ACH, and card-present methods are enabled per Practice as those features become available and as the applicable provider approves them. The operational rules for each method are set out in this Section and in Section 6, and they apply when the method is enabled.

5.2 Method availability and eligibility

A payment method is available only when AiroDental has enabled it for the Practice and the payment provider supports and approves it for that Practice. AiroDental may disable a method until the approved workflow and authorizations described in Section 6 are used.

5.3 Card-present

In-person terminal payments are covered by Section 9 (Hardware and Payment Terminals) and apply once card-present hardware is enabled for the Practice.

6. Stored, Recurring, and ACH Authorizations

Storing a payment method, charging on a schedule, and debiting a bank account each require a specific patient authorization and provider approval. Each rule below applies only when the Practice enables that method. AiroDental provides the workflow to capture and store each authorization, and AiroDental may disable a method until the approved authorization workflow is used.

6.1 Stored card (card on file)

Before saving a card for later use, the Practice obtains the patient’s consent to store the payment method and to the permitted future uses. The stored card is held as a token by the payment provider, not as a raw card number in AiroDental. The authorization records what the card may be used for and how the patient can revoke it.

6.2 Recurring card

Before charging a card on a schedule without a new patient action each time, the Practice obtains an authorization that describes the schedule, or the method for determining the amount and timing. The Practice honors the cancellation and revocation rights required by law and by payment-network rules. AiroDental provides the workflow to capture and store this authorization.

6.3 ACH (bank debit)

ACH is available only when enabled for the Practice. Before initiating recurring consumer ACH debits, the Practice obtains a written or similarly authenticated authorization that meets applicable requirements, provides the consumer a copy where required, and follows the notice, revocation, stop-payment, account-validation, and Nacha requirements that apply. The bank account is held as a token by the payment provider, and AiroDental does not store the raw account number. AiroDental may disable ACH unless the approved authorization workflow is used.

6.4 Revocation and cancellation

For any stored, recurring, or ACH authorization, the patient can revoke or cancel using the method stated in the authorization. The Practice processes a valid revocation promptly and stops further charges as required by law and provider rules. The Practice remains responsible for honoring a revocation even if a scheduled charge is already queued.

7. Payment Security and Card Data

This Section describes how AiroDental Pay handles payment data and the security rules that apply to a Practice using it.

7.1 Approved channels only

Card and bank credentials are entered only through the payment fields, hosted pages, terminals, or other components that AiroDental or the payment provider designates for that purpose. These components send the credential directly to the payment provider’s environment. A Practice enters credentials only through these approved channels.

7.2 What AiroDental does not receive or store

AiroDental does not receive or store the following, which stay in the payment provider’s hosted environment:

• Full card numbers (the primary account number, or PAN)
• Card security codes (CVV/CVC), which are never stored and never logged
• Magnetic-stripe track data, PINs, and PIN blocks
• Raw bank account numbers used for ACH

7.3 What AiroDental may store

AiroDental may store the minimum data needed to run payments and show status:

• A payment token or method ID issued and managed by the payment provider
• The card brand and last four digits, for display on receipts and status
• Payment status and history, such as whether a payment succeeded or failed
• Masked settlement account details, bank name, and token or status, for the Practice’s payout account
• Audit metadata, such as timestamps, transaction IDs, and authorization evidence

7.4 Prohibited handling by practices

A Practice must never enter, upload, paste, transmit, or store full card numbers, security codes, track data, PINs, or other raw payment credentials in AiroDental notes, messages, treatment-plan fields, attachments, forms not designated for card capture, support tickets, screenshots, or free-text fields. If a credential is entered in the wrong place, the Practice contacts support so it can be removed.

7.5 Data minimization

Payment descriptions, processor metadata, and statement descriptors carry the minimum necessary information. A Practice must not place diagnoses, tooth numbers, procedure narratives, or other clinical notes into fields intended only to facilitate payment. AiroDental uses opaque patient and reference identifiers with payment providers where reasonably feasible, and keeps treatment descriptions in AiroDental and the Practice’s PMS.

7.6 Practice environment

A Practice is responsible for the security of its users, devices, browsers, local network, physical terminals, passwords, and multi-factor authentication. A Practice promptly disables departed users and reports any suspected compromise, lost or tampered terminal, or fraudulent refund.

8. PCI Compliance

Card data is captured and stored in the PCI-compliant environment of AiroDental’s third-party payment processors rather than in AiroDental, which reduces a Practice’s PCI scope. A Practice remains responsible for following its processor’s PCI requirements, completing any required self-assessment questionnaire, and securing its own environment. AiroDental maintains the security controls for its part of the payment flow. AiroDental makes the relevant PCI compliance information for its processors available to a Practice on request through [email protected].

9. Hardware and Payment Terminals

This Section applies when a Practice uses card-present payment terminals or other physical payment devices with AiroDental Pay. It applies in addition to the security rules in Section 7. Devices are supplied and certified through AiroDental’s third-party payment processors.

9.1 Approved devices

A Practice may use only the payment terminals and devices that AiroDental or its payment processor approves for use with AiroDental Pay. Devices are ordered, activated, and returned through the process AiroDental provides. A Practice will not modify, open, or attach unapproved peripherals to a device.

9.2 Device security and inspection

A Practice will follow the then-current device-security requirements published by AiroDental or its payment processor. The Practice will regularly inspect each device for tampering, substitution, or attached skimming hardware, keep devices in a controlled location, restrict physical access to authorized staff, and report a lost, stolen, or tampered device immediately.

9.3 PCI and encryption

Card-present devices use point-to-point encryption (P2PE) or equivalent controls so that card data is encrypted at the point of interaction and is never available in cleartext to AiroDental or the Practice. The Practice will not attempt to capture, store, or transmit card data outside the approved device, consistent with Section 7.

9.4 Software and configuration

A Practice will keep device software and configurations current and will apply updates that AiroDental or its payment processor requires. A Practice will use only supported configurations and will not disable security features.

9.5 Responsibility for devices

A Practice is responsible for each device assigned to it and for transactions taken on that device, including transactions resulting from failure to secure the device or to follow these terms. Fees, deposits, and return conditions for a device are stated at the time it is ordered. On termination of the payment feature or the return of a device, the Practice will return the device in accordance with the return instructions.

10. Chargebacks, Refunds, Returns, and Disputes

10.1 The Practice owns the underlying obligation

The Practice makes refund decisions and is responsible for the patient’s underlying obligation and for disputes about treatment or service. AiroDental may transmit or facilitate a refund or dispute response but does not decide the underlying matter.

10.2 Network and provider rules control

Chargebacks, ACH returns, retrieval requests, and dispute fees follow the applicable payment provider and card network rules. Time limits, evidence requirements, and outcomes for a dispute are set by the network and the provider, not by AiroDental.

10.3 Practice responsibility for losses

A Practice is responsible for chargebacks, ACH returns, refunds, and related fees and adjustments attributable to its transactions, as provided in the Addendum and the payment provider’s terms. A payment provider may recover these amounts from settlement, from a reserve, or by other means under its terms.

11. Payouts, Settlement, and Reconciliation

11.1 Reconciliation surfaces are for reference

AiroDental shows payment status and reconciliation surfaces to help a Practice track activity. These surfaces are for operational reference. The payment provider, acquirer, and bank settlement records control the actual payout, timing, reserve, and network outcome where they differ, subject to correction of any verified AiroDental software error.

11.2 Payout timing and reserves

Payout schedules, holds, and reserve levels are set by the payment provider under its terms and may change based on the provider’s risk assessment. AiroDental does not control payout timing or reserve decisions and does not hold Practice funds, except where a provider’s terms expressly state otherwise.

11.3 Settlement account

Funds settle to the bank account the Practice designates and verifies during onboarding. A Practice keeps its settlement account information accurate and current. AiroDental is not responsible for a delayed or misdirected payout caused by inaccurate settlement account information provided by the Practice.

12. Fees

Processing rates, per-transaction fees, dispute and chargeback fees, ACH return fees, device fees, and any AiroDental fees for payment features are disclosed during activation, in the Practice’s payment settings, in the Addendum, or in an applicable order. Card network and provider fees are set by the network and the provider and may change under their terms. Fees are generally deducted from settlement or charged as described at the time the feature or device is enabled.

13. Prohibited and Restricted Use

13.1 Permitted use

A Practice may use AiroDental Pay only to collect for its own disclosed, approved dental services. Fraudulent, sham, money-transfer, unrelated, or otherwise prohibited transactions are not allowed.

13.2 Provider and network rules

Payment providers and card networks publish additional prohibited-use and prohibited-business rules that apply to the Practice. Those rules are presented or linked during activation and apply directly between the Practice and the provider. A Practice is responsible for complying with them.

13.3 No processing on behalf of others

A Practice may not use AiroDental Pay to process payments for another business, to aggregate payments for a third party, or to factor, launder, or resell payment processing.

14. Suspension, Reserves, and Termination

A payment provider may hold, limit, reserve, suspend, or terminate a Practice’s processing under its terms, including for risk, suspected fraud, excessive chargebacks, or legal requirements. AiroDental may also suspend or limit access to payment features to protect patients, the Practice, AiroDental, or a payment provider, or to comply with law or provider requirements, consistent with the Addendum. Suspension or termination of payment features does not relieve a Practice of amounts it owes, including chargebacks, refunds, returns, and fees.

15. Practice Responsibilities Summary

In addition to the specific rules above, a Practice is responsible for:

• Completing and maintaining accurate provider onboarding and settlement information
• Obtaining the required patient authorization before storing or scheduling a payment
• Entering payment credentials only through approved channels
• Keeping card, bank, and clinical data out of fields not designated for them
• Securing its users, devices, terminals, and accounts, and disabling departed users
• Making refund decisions and responding to disputes about its treatment or service
• Complying with applicable law and with provider and card network rules
• Reporting suspected fraud, compromise, or a lost or tampered device promptly

16. Support and Incident Escalation

For payment questions, disputes, suspected fraud, provider identification, terminal setup or replacement, or PCI documentation requests, contact AiroDental support at [email protected]. For a payment outage, suspected bank-account compromise, a lost or tampered terminal, or a security incident, mark the message urgent so it routes to the payments on-call path.

17. Changes to This Policy

AiroDental may update this Policy to reflect payment provider changes, security requirements, fraud controls, supported methods, operational requirements, or changes in law. The effective date and version appear at the top of this page. Nonmaterial, technical, security, or compliance changes may become effective on posting or on the effective date stated in the updated Policy. For a material change, AiroDental provides notice as described in the Addendum. Prior versions are archived and linked so a Practice can see the terms in effect on a given date.

18. Relationship to Other Agreements

This Policy is one of the online policies incorporated by reference into the Payments, Treatment Plan and Financial Features Addendum. It works together with the Master Services Agreement, the Business Associate Agreement for HIPAA-specific obligations, the AiroDental Pay Privacy Policy, and the list of Subprocessors. In the event of a conflict, the order of precedence stated in the Addendum and the MSA controls.