Cloud Computing Services Agreement

This Cloud Computing Services Agreement (this “Agreement” or “CCSA”) is entered into between ClearDATA Networks, Inc., a Delaware corporation (“ClearDATA”) and the company that signs an Order that incorporates this CCSA by reference (“you”). It is effective as of the date of your signature on the Order (“Effective Date”).

For good and valuable consideration, the receipt of which is hereby acknowledged, the Parties agree as follows:

1. DEFINED TERMS. Capitalized terms have the meanings given in this section, or in the section where they are used.

Acceptable Use Policy or AUP means the ClearDATA Acceptable Use Policy published at https://www.cleardata.com/legal/acceptable-use-policy-032118.

Agent(s) means services management software installed on the Public Cloud Provider environment.

Agreement means this CCSA, the SOW(s) and any document referenced in or attached to any of them.

Authorized Users means Customer employees and contractors authorized by Customer to use the Services or Software in support of Customer’s business operations as further described in Section 6.4 (Access Control Lists and Account Information).

Build Sheet is a specification of the implementation of Customer’s Public Cloud Provider Services.

Business Associate Agreement or BAA is the Business Associate Agreement or Subcontractor Business Associate Agreement, as referenced in Subsection 4.1 (HIPAA BAA) or Subsection 4.2 (HIPAA Subcontractor BAA).

Business Associate has the meaning given in HIPAA.

ClearDATA Data means all data created by ClearDATA in the course of providing Services pursuant to this Agreement, including but not limited to Usage Data and De-identified Data (as that term is defined by HIPAA). ClearDATA Data excludes any Customer Data.

Confidential Information means information disclosed by one Party to the other Party, orally or on any media, whether before or after the Effective Date that: (i) the recipient should reasonably understand to be confidential, such as (A) for Customer, all information transmitted to or from, or stored on, the Public Cloud Provider Services, and (B) for ClearDATA, this Agreement, prices and other terms of service, audit and security reports, product features, functionality and development plans, network configuration, vendors and other proprietary information or technology, or (ii) is marked or otherwise conspicuously designated as confidential by the disclosing Party. Confidential Information includes information disclosed by making tangible objects or premises available for inspection. Confidential Information does not include information that: (i) is or becomes publicly known through no fault of recipient or persons to whom recipient has rightfully disclosed the Confidential Information, (ii) is or becomes rightfully known by recipient without confidential or proprietary restriction from a source other than discloser who, to recipient’s knowledge, does not owe a duty of confidentiality to discloser with respect to such information; (iii) is or was developed by recipient without the use of or reference to the Confidential Information of discloser. For the purposes of this Agreement, Personal Health Information (“PHI”) shall not be considered Confidential Information and shall instead be governed by the Business Associate Agreement (“BAA”).

Customer Application means the software application(s) that Customer operates through Public Cloud Provider Services and any related computer code, information, automation tools and third-party components.

Customer Data means any Personal Data to which Customer provides access through the use of Services.

De-Identified Data has the meaning ascribed to it in the HIPAA Privacy Rule.

Feedback means any suggestion or idea for modifying or improving any of ClearDATA products including the Software and Services.

HIPAA means the Health Insurance Portability and Accountability Act of 1996, as amended by Subtitle D of the Health Information Technology for Economic and Clinical Health Act, and their implementing regulations, including the Privacy Standards adopted by the U.S. Department of Health and Human Services as they may be amended from time to time, 45 C.F.R. Part 160 and Part 164, Subparts A and E (the “Privacy Rule”), the Security Standards adopted by the U.S. Department of Health and Human Services as they may be amended from time to time, 45 C.F.R. Part 160 and Part 164, Subpart A and C (the “Security Rule”), the Breach Notification Standards adopted by the U.S. Department of Health and Human Services, as they may be amended from time to time, 45 C.F.R. Part 164, subpart D.

HIPAA Compliant Service means a Public Cloud Provider Service that is listed as a HIPAA Compliant Service in the Service Descriptions.

HIPAA Eligible Service means a Public Cloud Provider Service that the Public Cloud Provider has deemed eligible to host, transmit, or process PHI but ClearDATA has not listed as a HIPAA Compliant Service. If Customer hosts, transmits, or processes PHI with a HIPAA Eligible Service that is not listed as a HIPAA Compliant Service in the Service Descriptions, Customer is responsible for ensuring HIPAA compliance.

HITRUST means the Health Information Trust Alliance, or its successor.

Intellectual Property means, on a worldwide basis, any and all tangible and intangible: (i) copyrights; (ii) trademarks, service marks, logos, trade dress, trade names, and the goodwill associated therewith; (iii) rights relating to know-how or trade secrets; (iv) patents; (v) rights in domain names, universal resource locator addresses, telephone numbers (including toll free numbers), and similar identifiers; (vi) all other intellectual and industrial property rights of every kind and nature, however designated, whether arising by operation of law, contract, license or otherwise; and (vii) all registrations, initial applications (including intent to use applications), renewals, extensions, continuations, divisions, or reissues of any of the foregoing now or hereafter in force (including any rights in any of the foregoing).

Managed Services means ClearDATA’s provisioning and management of Customer’s access to and use of the Software and Customer’s Public Cloud Provider Services as described in the Service Descriptions.

Personal Data means information about an identified or identifiable natural person, including information that may be used to identify an individual or with respect to which there is a reasonable basis to believe the information can be used to identify an individual. Specifically, but without limitation, Personal Data includes all of the following: (i) “electronic protected health information” and PHI as defined in HIPAA, (ii) name, (iii) contact information such as phone, email, or physical address, (iv) user names and access codes for online services, (v) health insurance account numbers and access information, (v) financial account numbers and access information, (vii) device numbers, IP addresses or other means of identification to a particular computing or communication device or Internet address, (viii) identification numbers such as social security or driver’s license numbers, (ix) unique identifiers that are intended to associate a record with an individual, (x) photographs, and (xi) biometric information.

Professional Services means configuration, installation and other services designated as professional services in a SOW.

Public Cloud Provider means the provider of Public Cloud Provider Services and related services as identified in a SOW, such as Amazon Web Services, Inc. for AWS®, Google, Inc. for GCP®, and Microsoft Corporation for Azure®.

Public Cloud Provider Service means cloud infrastructure and related software or service functionality delivered by a Public Cloud Provider.

Responsibility Matrix or RACI means the applicable RACI chart(s) or assignments of responsibility that are part of the Service Descriptions that state who is “responsible,” “accountable,” “consulted,” and “informed” as to activities or decisions for the Services.

Security Controls mean the safeguard(s) or countermeasure(s) required by HIPAA to protect the confidentiality, integrity, and availability of Personal Data.

Service Descriptions means the descriptions of the Services and of the features, functions and approved configurations of the Services at https://www.cleardata.com/services-descriptions/.

Service Level Agreement or SLA means an agreement that describes the response times and other commitments with respect to the performance of the Managed Services and Software Support.

Services means Managed Services, Professional Services and Software Support provided by ClearDATA, as defined in their Service Descriptions.

Software means the ClearDATA software products listed in a SOW and as described in a Service Description.

Software Support means technical product assistance for Software as described at https://www.cleardata.com/services-descriptions/.

Statement of Work or SOW means a statement of work that references this CCSA.

Supported Services are Public Cloud Provider Services that are available for Customer’s use and listed as a Supported Service in the Service Descriptions. A Supported Service is eligible to host, transmit or process PHI and PII only if specifically stated or listed as a HIPAA Compliant Service in the Service Descriptions.

Third Party Technology means a technology product or service not covered by the Service Description or RACI that Customer purchases or licenses directly from a third party or through ClearDATA for use with a Workload.

Unsupported Service means: (i) Third Party Technology or a Public Cloud Provider Service that is not listed as a Supported Service; (ii) any item designated in a SOW or other agreement as “unsupported,” “one-off” “non-standard” “non-compliant,” “end of life,” “eol,” “custom service;” and (iii) a Public Cloud Provider Service used by Customer to store, transmit or process unencrypted PHI or PII.

Usage Data means statistical data and other information collected by ClearDATA with respect to Customer’s use of the Services, Software in aggregated form or as De-identified Data.

Workload means a collection and configuration of customer technology resources, Public Cloud Provider Services, Services, and other code and information that is used to enable execution of an application or technology process.

2. OWNERSHIP, LICENSES AND INTELLECTUAL PROPERTY

2.1 Ownership. As between Customer and ClearDATA, Customer retains ownership of Customer Data, Customer Confidential Information, and any Intellectual Property that Customer transfers to ClearDATA or to which ClearDATA has access in providing the Services. As between Customer and ClearDATA, ClearDATA retains ownership of ClearDATA Confidential Information, ClearDATA Data, the Software and ClearDATA Intellectual Property.

2.2 Limited License.

2.2.1 ClearDATA License to Customer. During the Term, ClearDATA grants Customer, conditioned on payment of the proper fees and compliance with the obligations of the CCSA, a limited, non-exclusive, non-transferable, non-sublicensable license to use the ClearDATA Software, Services and related Confidential Information (“ClearDATA IP”) solely as specified in the Service Descriptions. Customer may not, and may not authorize or allow any third-party, to: (i) gain unauthorized access to any portion of ClearDATA IP; (ii) copy, modify, change, or otherwise prepare derivative works of any part of ClearDATA IP; (iii) reverse engineer, disassemble, or decompile or otherwise attempt to reconstruct, identify or discover any source code, underlying ideas, user interface techniques, or algorithms used by any part of ClearDATA IP; (iv) use ClearDATA IP to transmit malicious code or for fraudulent or illegal activities; (v) input, upload, transmit or otherwise provide to or through ClearDATA IP, any information or materials that are unlawful or injurious to ClearDATA or the rights of any third parties; (vii) use ClearDATA IP to create a competing service or other product; or (viii) use ClearDATA IP for any purpose not expressly permitted by this Agreement. All rights not expressly granted to Customer are reserved by ClearDATA, and Customer has no other or different rights or privileges that may otherwise be implied, by estoppel, or otherwise.

2.2.2 Customer License to ClearDATA. Customer grants ClearDATA a worldwide, non-exclusive, perpetual, royalty-free, fully paid-up license to use Usage Data for business and marketing purposes, including improving the operation of the Services (including development, maintenance, support, and training services), developing products and services, creating benchmarks, performing research, conducting statistical analysis, and distributing aggregated statistics. Neither Party may remove any proprietary rights notices included by the other Party on its Intellectual Property.

2.3 Feedback. ClearDATA owns and Customer hereby assigns to ClearDATA all Intellectual Property rights in any Feedback.

3. CLEARDATA SERVICES

3.1 HIPAA Compliance. ClearDATA will provide the Software and Services in compliance with HIPAA as specified in the applicable parts of its HITRUST Certification and the BAA.

3.3 Customer Data and Applications. Software and Services do not include ClearDATA’s design, development or management of Customer Application(s) or Customer Data, HIPAA standard transactions processing, or maintenance of a “designated record set” (as defined in HIPAA). ClearDATA will interact with Customer Application(s) and Customer Data only to the extent necessary to provide the Services.

3.4 Changes to Software and Services. ClearDATA may, from time to time make changes, updates, or improvements to the Software and Services so long as they do not materially reduce the core functionality set forth in the Service Description or any SOW. ClearDATA will use reasonable efforts to notify Customer prior to implementing any material changes. Customer agrees to utilize the most recent version of the Services and Software.

3.5 Unsupported Services are provided AS IS. ClearDATA is not liable for Customer’s use of Unsupported Services. Customer may not use Unsupported Services to store, transmit or process PHI or PII. ClearDATA has no obligation to provide Managed Services or Software Support for Unsupported Services. SLAs do not apply to Unsupported Services or any other aspect of Services adversely affected by an Unsupported Service.

3.6 Third Party Technology and Services. Third Party Technologies are not part of the Services. Unless otherwise expressly agreed in a SOW, ClearDATA has no obligation to support or maintain any Third Party Technology, and makes no warranty, covenant or representation whatsoever regarding any Third Party Technology including whether they are HIPAA compliant, or if they interoperate with the Services. ClearDATA may, but is not obligated to, assist Customer in the use of a Third-Party Technology, but any such assistance is provided AS IS. Customer’s use of the Third-Party Technology is governed by Customer’s separate agreement with the third party. ClearDATA may disclose to the third-party information about Customer and Customers’ use of their services in accordance with the agreement between Customer and the third party to the same extent as if the third party collected information directly from Customer.

3.7 Quality-Regulated Systems. Customer may not use the Software and Services as part of a quality-regulated system, such as a process regulated by the United States Food, Drug and Cosmetic Act, until Customer signs an Addendum for such use.

3.8 GDPR. Customer may not use the Software and Services for data that is subject to the European Union’s General Data Protection Regulation (“GDPR”) until Customer signs an Addendum for that use. I

4. HIPAA BUSINESS ASSOCIATE AGREEMENT AND HITRUST CERTIFICATION

4.1 Business Associate Agreement. If ClearDATA is Customer’s Business Associate, then the HIPAA Business Associate Agreement attached as Exhibit A shall be effective and fully incorporated herein as of the Effective Date.

4.2 Business Associate Subcontractor Agreement. If ClearDATA is Customer’s Business Associate Subcontractor, then the HIPAA Business Associate Subcontractor Agreement attached as Exhibit A shall be effective and fully incorporated herein as of the Effective Date.

4.3 HITRUST CERTIFICATION. ClearDATA will maintain a certification of compliance with the HITRUST Common Security Framework (“HITRUST Certification”). ClearDATA may substitute an equivalent security framework, such as the AICPA Service Organization Controls or ISO 27017, upon ninety (90) days’ advance written notice to Customer.

5. SERVICE COMMITMENTS, WARRANTIES AND WARRANTY DISCLAIMERS

5.1 Services. Services and Software shall be provided in material conformity with the Service Descriptions. Customer’s sole and exclusive remedy, and ClearDATA’s entire liability, for any breach of this warranty is, at ClearDATA’s option, re-performance of the non-conforming Services or correction of the non-conforming Software; provided that Customer notifies ClearDATA in writing of the non-conformity, in reasonable detail, within thirty (30) days after the non-conformity first occurs. This warranty does not apply to, and ClearDATA has no obligation with respect to, any non-conformity arising from Unsupported Services, Third Party Technology, Customer Applications, Customer Data, Customer’s acts or omissions, or any use of the Services or Software not in accordance with this Agreement or the Service Descriptions.

5.2 Software Support. ClearDATA will provide Software Support in a good and professional manner consistent with the SLA and applicable industry standards.

5.3 Intellectual Property. ClearDATA warrants that Customer’s use of the Services as permitted by this Agreement an any applicable SOW will not infringe the intellectual property rights of any unaffiliated third party, provided, however, that ClearDATA’s sole obligation with respect to a breach of this warranty is indemnification for third party claims as provided in Subsection 11.1 (ClearDATA Indemnification of Customer).

5.4 Additional Services. If ClearDATA provides incidental or ad-hoc assistance that is not part of the Services it is provided on an AS IS, AS AVAILABLE basis.

5.5 Warranty Disclaimer. Except for the warranties expressly stated in this Section 5, ClearDATA, its suppliers, licensors and subcontractors make no representations or warranties whatsoever and expressly disclaim any implied warranty of merchantability, fitness for a particular purpose, and any warranty that would have otherwise arisen through a course of dealing. ClearDATA does not warrant THAT the Services or Software operation will be uninterrupted, meet Your requirements, be error free, OR PROVIDE PERFECT PROTECTION FROM ALL VULNERABILITIES OR SECURITY ATTACKS, INTRUSIONS, OR SECURITY INCIDENTS. If applicable law requires a warranty notwithstanding this limitation, then the warranty is made for a period of 30 days from the date the warranty WAS made.

6. CUSTOMER OBLIGATIONS

6.1 Account Security. Customer will comply with the encryption, security measures and other responsibilities documented in RACI, Build Sheets and Service Descriptions and will otherwise use HIPAA compliant security precautions in connection with Services; and immediately contact ClearDATA if Customer believes the security of its account or its Public Cloud Provider Services have been compromised.

6.2 Compliance with Law, Privacy Policy. Customer will comply with HIPAA and other laws governing the collection, management, transmission, storage and processing of Customer Data as well as its privacy and other policies.

6.3 Third Party Rights. Customer warrants its Customer Application, third-party Personal Data, and any other information, materials or technologies that Customer installs, stores, processes, or transmits to ClearDATA through use of the Services, and ClearDATA’s authorized use and disclosure of such materials in providing the Services, will not violate the rights of any third party, including but not limited to the privacy rights of individuals whose Personal Data is part of Customer Data (the “Data Subjects”). Specifically, but without limitation, Customer warrants that it has obtained consent from the Data Subjects for its and ClearDATA’s use and disclosure of Personal Data as required for ClearDATA to provide Services under this Agreement.

6.4 Access Control Lists and Account Information. Customer must keep account access control permissions, Authorized Users, billing, and other account information up to date. Customer’s Authorized Users have the authority to change Customer’s Workload and Public Cloud Provider Services including but not limited to adoption of new free or chargeable features and associated terms and conditions.

6.5 Backups.  Customer will conduct periodic restoration tests as necessary (a) to verify the integrity and recoverability of Customer Data as necessary to create and maintain retrievable exact copies of Customer Data; and (b) to ensure that Customer meets disaster recovery and business continuity obligations required by the HIPAA Security Rule including but not limited to §164.308(a)(7)(ii)(A) and its own business continuity requirements. Customer will give ClearDATA prior notification of any changes to the Public Cloud Provider Service or Customer Application, data models, encryption methods or other processes that could interfere with successful backups conducted by ClearDATA. You acknowledge that use of the public cloud data backup services provided by ClearDATA does not alone constitute compliance with HIPAA.

6.6 Customer Cooperation

6.6.1 Customer will: (i) provide qualified personnel capable of performing Customer’s duties and tasks; (ii) provide ClearDATA prompt and timely access to Customer’s site, facilities and Public Cloud Provider Services as reasonably required by ClearDATA to perform its obligations including but not limited to performing scheduled and emergency maintenance and patching, investigation or remediation of Services outages, suspected security problems, or breaches of the Agreement; (iii) provide office support (e.g., internet connectivity, printers) as ClearDATA may reasonably request; and (iv) make accurate and complete data, reports, information and other materials required by ClearDATA to perform its obligations (collectively, “Customer Materials”).

6.6.2 ClearDATA is excused for delayed or insufficient performance of Services resulting from Customer’s failure or delay in providing requested cooperation, access, or Customer Materials. In addition to any other remedies available, ClearDATA may reschedule Professional Services and charge rescheduling fees after Customer’s failure or delay in providing requested cooperation, access, or Customer Materials. If ClearDATA re-performs Professional Services for any of the foregoing reasons, ClearDATA’s fees may exceed the amounts stated in a SOW.

7. RESTRICTIONS

7.1 Medical Devices/High Risk Use. The Software and Services are not designed, developed, tested, or intended to be reliable where use or failure could lead to death or serious bodily injury or property or environmental damage. ClearDATA has no responsibility for, and Customer will indemnify, defend and hold harmless ClearDATA, its affiliates and representatives from all claims, suits, demands, and proceedings alleging, claiming, seeking, or asserting, any liability, loss, obligation, risk, cost, damage, award, penalty, settlement, judgment, fine or expense (including attorneys’ fees) arising from or in connection with Customer’s use of the Software and Services on or in a high-risk system.

7.2 Services Management Agent. ClearDATA may use Agents to track system information, manage various service issues, and identify security vulnerabilities. Customer’s Services will be Unsupported Services if Customer disables or interferes with Agents.

7.3 Authorized Users. Customer is responsible for all acts or omissions of its Authorized Users as well as access to or use of the Software and Services through Authorized Users’ credentials or anyone to whom Customer or its Authorized Users allow such access or use.

7.4 Export. Customer will not use the Services or Software in a way that causes ClearDATA to be in violation of the export laws of the United States or other jurisdiction from which the Services or Software are provided.

8. FEES, PAYMENTS

8.1 Payments. Set up fees, required prepayments, and other one-time fees are due on the effective date of a SOW or on the due date indicated on an invoice, whatever is earlier. All other fees are due upon receipt. ClearDATA may charge interest on overdue amounts at the lesser of 1.5% per month or the maximum legal rate. If any amount is overdue by more than thirty (30) calendar days and ClearDATA brings a successful legal action to collect, or engages a collection agency, Customer will pay the reasonable costs of collection, including reasonable attorneys’ fees and court costs. ClearDATA is not obligated to issue any credit under an SLA while any fee is overdue or in dispute. Fees are non-refundable and must be paid in United States Dollars.

8.2 Fees. Customer is responsible for all fees resulting from services Customer adds through the Public Cloud Provider Services, including auto-scaling systems or software defined capacity control mechanisms that increase Customer’s consumption or price of services. ClearDATA may pass through to Customer any fee increases from the Public Cloud Provider or other third-party providers. ClearDATA may increase its fees after the Initial Term on ninety (90) days’ notice. Customer may not offset any credit or other amount due to Customer from ClearDATA against fees due under this Agreement.

8.3 Public Cloud Service Provider Cost and Usage Information. Customer agrees to provide ClearDATA prompt access to detailed cost and usage data from its Public Cloud Provider as required to calculate fees.

8.4 Fee Disputes. If Customer disputes an invoice or portion thereof in good faith, it will timely pay any undisputed portion and provide ClearDATA with a written description of the dispute, in reasonable detail, all on or before the due date of the applicable invoice. The Parties will promptly meet to resolve such dispute in good faith. Invoices not disputed within ninety (90) days of invoice date are conclusively deemed accurate.

8.5 Taxes. All fees are stated exclusive of sales, use, VAT, GST or similar tax (“Sales Tax”). Unless Customer has provided an exemption certificate or direct pay permit, Customer will remit Sales Tax to ClearDATA. Customer warrants that all information Customer has provided to ClearDATA for Sales Tax purposes is accurate and complete. If Customer is required by law to withhold from ClearDATA’ fees any amounts as a withholding or like tax, then the ClearDATA fees subject to this requirement are increased by an amount that results in ClearDATA’ payment net of the withholding equal to the fee. Customer is not required to pay any tax that is assessed based on ClearDATA’s net income.

9. TERM, TERMINATION, SUSPENSION

9.1 Term. This Agreement and any SOW will commence as of their respective Effective Date and continue in full force and effect for a term of three (3) years (“Initial Term”). Each will automatically renew for subsequent twelve (12) month terms (each, a “Renewal Term” and together with the Initial Term, the “Term”) unless either Party provides written notice of non-renewal at least ninety (90) days prior to the then current Term. Expiration or termination of an individual SOW will not effect any other SOW or this Agreement.

9.2 Termination for Material Breach. If either Party materially breaches this Agreement, the other Party will provide notice and thirty (30) days’ to cure. If the breaching Party does not cure, the non-breaching Party may terminate, or suspend performance under this Agreement. ClearDATA may also terminate the Agreement if Customer violates the AUP more than once, even if a prior breach has been cured. Failure to pay undisputed amounts due for more than thirty (30) days is a material breach.

9.3 Termination for Violation of Law, Regulation or Bankruptcy. If either Party determines that its continued performance under this Agreement would cause it to violate applicable law or would place it at material risk of suffering any sanction, penalty, or liability, it may terminate this Agreement immediately upon written notice to the other Party. Either Party may terminate the Agreement if the other Party is insolvent or files for bankruptcy or similar protection that is not discharged within sixty (60) days.

9.4 Suspension. ClearDATA may suspend access to the Software and Services, in whole or in part, as reasonably necessary to address a serious potential security vulnerability. ClearDATA will give Customer at least two (2) business days’ advance notice of the suspension unless circumstances require suspension on shorter notice. ClearDATA will reinstate Customer access to the Software and Services when the grounds for suspension are cured unless ClearDATA has already terminated the Agreement as described in this Section 9.

9.5 Survival. The following terms survive expiration or termination of the Agreement: Section 1 (Definitions) to the extent the terms defined are used in other surviving sections, Section 7 (RESTRICTIONS), Section 8 (Fees, Payments), 9 (Term, Termination, Suspension), Section 10 (Confidential Information), Section 12 (Limits on Liability), Section 13 (Notices), Section 14 (General), other terms that expressly state they survive termination, and terms that by their nature should reasonably be expected to survive termination.

9.6 Preservation of Data. Unless earlier destruction of Customer Data is required by HIPAA, ClearDATA will make Customer Data available for a complete and secure (i.e., encrypted and appropriated authenticated) download for thirty (30) days after termination or expiration of the relevant SOW or CCSA. After such thirty (30) day period, ClearDATA shall have no obligation to maintain or provide Customer Data to You and shall, unless legally prohibited, delete all Customer Data in its systems or otherwise in its possession or under its control.

9.7 Effect of Termination (SOW v. Agreement). Upon the termination or expiration of a SOW: (i) Customer will pay ClearDATA any fees incurred up to and including the date of expiration or termination under the SOW; (ii) Customer will cease using the Software and Services described in the SOW, and (iii) Customer will promptly destroy any ClearDATA Confidential Information or Deliverables provided or acquired pursuant to the SOW and provide written certification of such destruction. Upon the termination or expiration of this Agreement all SOWs will terminate. The termination or expiration of this Agreement will not affect or impair the rights, liabilities, and obligations of either Party that may have accrued prior to such termination or expiration. Except as otherwise provided, remedies are cumulative, not exclusive, and will include all remedies available to a Party at law or in equity.

10. CONFIDENTIAL INFORMATION

Neither Party may use the other Party’s Confidential Information except as necessary for performance under this Agreement, or as required by law. Each Party agrees to protect the confidentiality of the other Party’s Confidential Information using the same degree of care as it uses to protect the confidentiality of its own similar Confidential Information, but in any event no less than reasonable care, and to not intentionally disclose the other Party’s Confidential Information to any third person except as follows: (i) to the Party’s respective service providers, agents and representatives, provided that such service providers, agents or representatives are bound by written confidentiality obligations that provide materially the same protection as these terms; (ii) in response to a subpoena or other legal process, provided that each will give the other prompt advance written notice prior to disclosure as is reasonable under the circumstances; or (iii) as required by law, such as a requirement under a data privacy regulation that a notice of data breach be given to a supervisory authority or regulatory agency. On expiration or earlier termination of the Agreement, each Party will return or destroy the other Party’s Confidential Information. Each Party is responsible for a breach of this Section by third parties to whom it has disclosed the other Party’s Confidential Information. The Parties’ obligations under this section are separate and distinct from their other obligations under this Agreement (including the BAA) with respect to privacy, compliance and security including but not limited to maintenance of the Security Controls.

11. INDEMNIFICATION

11.1 ClearDATA Indemnification of Customer. ClearDATA will defend, indemnify and hold harmless Customer and its affiliates, officers, directors and personnel (“Customer Indemnitees”) from final judgments, related attorney fees, and litigation-related third party expenses (“Losses”) that result from claims by a party not affiliated with Customer Indemnitees, to the extent these claims: (i) assert that Customer’s use of the Services infringe Intellectual Property rights in the United States. ClearDATA’s obligations under this subsection do not extend to a claim to the extent that it (a) is covered by Customer’s indemnification of ClearDATA, (b) is based on Customer’s breach of this Agreement or negligence, or (c) results from Customer’s combination of the Services with technology not provided by ClearDATA, Customer’s use of Unsupported Services, Customer’s unauthorized change to the Public Cloud Provider Services, Software, or Services, or ClearDATA’s compliance with Customer’s specific directives (“Exclusion(s)”).

11.2 Customer Indemnification of ClearDATA. Customer will defend, indemnify and hold harmless ClearDATA and its affiliates, suppliers, and licensors, and each of their officers, directors and personnel (the “ClearDATA Indemnitees”) against Losses that result from claims by a party not affiliated with ClearDATA Indemnities, to the extent those claims: (i) are raised by Customer’s personnel, end users, providers of Customer Application(s), or Data Subjects whose Personal Data is included in Customer Data, unless such claim arises from ClearDATA’s breach of the Security Controls, (ii) asserting the Customer Application or Customer Data infringes or violates the Intellectual Property rights or other rights of a third party in the United States or the European Economic Area, or (iii) are an Exclusion. Customer’s obligations under this Section 11.2 include claims arising out of the acts or omissions of its personnel, agents, Authorized Users, and any other person to whom Customer has given access to the Public Cloud Provider Services, the Software, or Services, and any person who gains access to any of them as a result of Customer’s failure to use reasonable security precautions, even if the acts or omissions of such persons were not authorized.

11.3 Procedures. The indemnified Party must give notice of the claim for indemnification to the indemnifying Party within ten (10) days of the date the claim, or threat of a claim, is made in writing, provided that failure to give notice does not relieve the indemnifying Party of its obligations unless the delay prejudices defense of the claim. The indemnifying Party has the right to select counsel to defend any claim under this Section and has the right to control the defense of the claim, except that the indemnified Party may participate in the defense of the claim at its option and expense, with counsel of its choice. The indemnified Party must comply with any reasonable request for information or cooperation regarding the defense of the claim made by the indemnifying Party. The indemnifying Party may settle any indemnified claim, in its discretion, provided that the settlement fully resolves the indemnified Party’s liability and does not require the indemnified Party’s to make an admission of culpability.

12. LIMITATIONS OF LIABILITY

12.1 NO CONSEQUENTIAL, INDIRECT DAMAGESNEITHER PARTY NOR ITS AFFILIATES, LICENSORS, SUPPLIERS OFFICERS, DIRECTORS, PERSONNEL, OR SUBCONTRACTORS IS LIABLE TO THE OTHER PARTY FOR ANY LOST PROFITS, LOST REVENUE, LOST BUSINESS OPPORTUNITY, OR ANY INDIRECT, SPECIAL, INCIDENTAL, PUNITIVE, OR CONSEQUENTIAL LOSS OR DAMAGE OF ANY KIND, OR ANY LOSS OR DAMAGE THAT COULD HAVE BEEN AVOIDED BY THE CLAIMING PARTY’S REASONABLE MITIGATION, EVEN IF THE OTHER PARTY HAD BEEN ADVISED OF OR SHOULD HAVE BEEN AWARE OF THE POSSIBILITY OF SUCH DAMAGES.

12.2 MAXIMUM LIABILITYNOTWITHSTANDING ANYTHING TO THE CONTRARY IN THIS AGREEMENT, EXCLUDING (I) CLAIMS ARISING FROM A PARTY’S WILLFUL MISCONDUCT AND (II) CUSTOMER’S PAYMENT OBLIGATIONS, ALL OF WHICH SHALL BE UNLIMITED, THE MAXIMUM AGGREGATE LIABILITY OF A PARTY AND ITS AFFILIATES, LICENSORS, SUPPLIERS AND SUBCONTRACTORS UNDER OR IN CONNECTION WITH THIS AGREEMENT FOR ANY AND ALL CLAIMS AND ANY TYPE OF DAMAGES SHALL NOT EXCEED THE FEES PAID BY CUSTOMER IN THE 12 MONTHS PRECEDING THE EVENT GIVING RISE TO THE CLAIM UNDER THE RELEVANT SOW.

12.3 Other. Customer acknowledges ClearDATA has set its prices and entered into this Agreement in reliance on the limitations of liability stated in this Section 12, and they reflect an agreed allocation of risk between the Parties. These limitations apply to any cause of action whatsoever, whether in contract, tort, commercial code, strict liability or otherwise, even if a limited remedy fails of its essential purpose. Nothing herein precludes a Party from seeking specific enforcement, injunctive relief or other non-monetary equitable remedy. If these limitations as written are not permitted by applicable law, they shall apply to the extent permitted.

13. NOTICES

Notices must be given by mail. ClearDATA’s notice to Customer must be given to Customer’s primary account contact. Customer’s notice of breach of this Agreement, request for indemnification or other legal matters must be mailed via 1st class United States mail or overnight delivery to ClearDATA Networks, Inc., ATTN CHIEF FINANCIAL OFFICER, 7415 Southwest Parkway, Building 6, Suite 500, Box 590, Austin, TX 78735 . ClearDATA’s notice of breach of this Agreement, request for indemnification or other legal matters must be sent to the contact information of Customer in the signature block below.

14. GENERAL

14.1 Order Process. Customer may offer to purchase ClearDATA Services by signing and submitting a SOW, or other document provided to Customer by ClearDATA for signature. No SOW or other document binds ClearDATA unless it is also executed by ClearDATA.

14.2 Non-Solicitation. Neither Party shall directly solicit any personnel of the other Party with whom it has interacted in connection with the Agreement to terminate their employment with the other Party, provided however, that this Section does not restrict a Party from employing an individual who responds to a general employment advertisement or notice.  This restriction shall survive expiration or termination of the Agreement for a period of twelve (12) months.

14.3 General Warranty. Each Party warrants to the other that: (i) it has the right, power, and authority to enter into the Agreement and to fully perform its obligations; and (ii) the making of the Agreement does not violate any agreement existing between it and any third party. The individual signing the CCSA and any SOW represents that he or she has the authority to bind the entity on whose behalf they are signing.

14.4 Publicity. ClearDATA may publicly disclose it is providing Services to Customer and may use Customer’s name and logo in its online, printed and other marketing and publicity materials to identify Customer as a ClearDATA customer, subject to reasonable trademark usage guidelines. ClearDATA may use any quotation provided or approved by Customer for marketing purposes in a press release or other publicity.

14.5 Assignment. Neither Party may assign its rights or delegate its obligations under the Agreement without the prior written consent of the other Party, which consent shall not be unreasonably withheld or delayed. ClearDATA may utilize Representative(s) in fulfilling its obligations under this Agreement. Notwithstanding any of the foregoing, either Party may assign its rights and obligations under the Agreement to a parent or affiliate or as part of a corporate reorganization, consolidation, merger or sale of all or substantially all of its assets and such assignment will be effective without the consent of the other Party, provided that the successor agrees in writing to assume all of the assigning Party’s obligations hereunder and has adequate resources to meet its obligations hereunder, and further provided, in the case of Customer, that Customer’s successor is not an existing client or customer of ClearDATA in which case such assignment is not permitted without the written consent of ClearDATA. Any attempted assignment not in accordance with this Section 14.5 shall be null and void. This Agreement and all of its provisions shall be binding upon and inure to the benefit of the Parties and their respective permitted successors and assigns.

14.6 Subcontractors. ClearDATA may use subcontractors to perform all or any part of the Services. For subcontractors that are not Public Cloud Providers, ClearDATA remains responsible for the performance of those subcontractors as if ClearDATA performed the Services itself.

14.7 Public Cloud Provider Pass-Through Terms. The Public Cloud Providers require ClearDATA to include the following clauses in this CCSA: (i) Public Cloud Providers make no representation or warranty to Customer under this Agreement, and none of them has any liability directly to Customer in connection with the Services or any direct indirect, incidental or consequential damages arising from Customer’s use of the Services; and (ii) Customer acknowledges that ClearDATA is not an agent for Amazon Web Services, Inc., Google, Inc., Microsoft Corporation, or its other subcontractors, and that ClearDATA and its subcontractors are independent contractors and not partners or joint venturers.

14.8 Disputes.

14.8.1 Mediation. Except for a request for temporary injunctive or other equitable relief, each Party agrees that it shall not file a lawsuit or other legal action in connection with this Agreement unless it has first given the other Party written notice of the dispute and attempted to resolve the dispute through good faith negotiation. At the request of either Party, the dispute will be submitted for non-binding mediation conducted by a mutually acceptable mediator in Travis County, Texas consent to not be unreasonably withheld, costs to be split evenly. If the dispute is not resolved within forty-five (45) days of the date of the initial demand for mediation, a Party may file suit.

14.8.2 Jurisdiction, Venue, Law, Jury Trial. Any action related to this Agreement shall be brought in state or federal courts having jurisdiction over New York. Neither Party shall dispute the jurisdiction, convenience, or venue of such courts. This Agreement is governed by and interpreted under the laws of the State of New York, without giving effect to its conflicts of law principles. The Parties expressly waive the application of the United Nations Convention on Contracts for the International Sale of Goods and the Uniform Computer Information Transactions Act. Neither the Services nor the Software are “goods” subject to any version of the Uniform Commercial Code. Each Party waives the right to a trial by jury in respect of any dispute arising out of this Agreement.

14.8.3 Expenses Arising from Legal Disputes, Subpoenas Regarding Customer’s Account. Customer agrees to pay or reimburse ClearDATA’s reasonable and actual attorneys’ fees and other expenses incurred in connection with: any dispute challenging control of Customer’s account, or to comply with any third-party subpoena, warrant or other mandated disclosure unrelated to a claim between Customer and ClearDATA.

14.9 Force Majeure. Except for Customer’s payment obligations, neither Party is in violation of the Agreement if the failure to perform is due to an event beyond that Party’s reasonable control, such as a significant failure of the power grid or Internet, denial of service attacks, natural disaster, war, riot, insurrection, epidemic, pandemic, strikes or other organized labor action, terrorism, or other acts or events for which precautions are not generally taken in the industry.

14.10 Interpretations of Certain Words. “business day” means Monday – Friday, 9:00 a.m. – 5:00 p.m., United States Central Time, excluding federal holidays in the United States. The word “affiliate” refers to an individual or entity that controls, is controlled by, or is under common control with the person referred to, where control means ownership of the majority of voting interests of an entity or the right to control the policies of the entity by means of a controlling number of seats on the entity’s governing body. Any requirement that a statement be written is satisfied by an email or other digital form of writing unless expressly stated otherwise. Section captions are for convenience only; they are not part of this Agreement and may not be used to interpret the terms of this Agreement.

14.11 Modifications. Web-published portions of the Agreement are subject to modifications which are effective: (a) to any SOW that is signed after a modification is published, and (b) to existing SOWs, as of the first renewal after the modification is published.

14.12 Whole Agreement and Order of Precedence. The following are incorporated by reference: all exhibits, SOW(s), all content at hyperlinks and the AUP. If there is a conflict between the documents that comprise the “Agreement,” the documents control in the following decreasing order of precedence: (i) the Business Associate Agreement, (ii) the SOW or similar entered into under the Agreement, (iii) this CCSA and (iv) the AUP. No terms or conditions, other than in the Agreement, and no prior agreements or understandings, oral or written regarding the subject matter herein, shall modify or add to these terms and conditions, whether contained in any promotional materials, proposals, acknowledgements, sales or purchase orders, shipping forms, orally or elsewhere are binding.

14.13 Federal Agency Users. The Services were developed solely at private expense and are commercial computer software and related services within the meaning the Federal Acquisition Regulations and applicable agency supplements.

14.14 Third Party Beneficiaries. Unless and to the extent specifically stated there are no third-party beneficiaries to this Agreement. Neither Party’s customers, end users, suppliers, Data Subjects, or other persons shall have the right to enforce this Agreement.

14.15 Severability. In the event one or more of the terms of this Agreement are adjudicated as invalid, illegal, or unenforceable, the adjudicating body may either interpret this Agreement as if such terms had not been included or may reform such terms to the limited extent necessary to make them valid, legal or enforceable, consistent with the economic and legal incentives underlying the Agreement.

14.16 Waiver. Except as otherwise provided herein, no right or remedy arising regarding this Agreement shall be waived by a course of dealing between the Parties, or a Party’s delay in exercising the right or remedy. A Party may waive a right or remedy only by signing a written document that expressly identifies the right or remedy waived. Unless expressly stated in the waiver, it will not be deemed a waiver on any other occasion of the same right or remedy, or any other right or remedy.

14.17 Counterparts; Signatures. This Agreement may be signed in multiple counterparts, which taken together shall be read as one Agreement. A signed agreement transmitted by facsimile, email attachment, or other electronic means shall be considered an original. The Parties agree that electronic or digital signatures shall be given the same effect as a manual signature.

The Agreement is the complete and exclusive agreement between the Parties regarding its subject matter and supersedes and replaces in their entirety any prior or contemporaneous agreement or understanding, written or oral. The Parties have not entered into the Agreement in reliance on any statement other than those in the Agreement.

© ClearDATA Networks, Inc. 2025

CCSA Revision Date October 1, 2025