PART I: ACCEPTANCE AND RELATIONSHIP TO OTHER AGREEMENTS

Section 1. Clickwrap Acceptance

1.1 Formation of Agreement. This SaaS Subscription Agreement (this "Agreement") between Sancta, LLC ("Provider") and the individual or entity accepting this Agreement ("Subscriber") is formed and becomes legally binding upon the earliest of the following events: (a) Subscriber clicking the "I Agree," "I Accept," "Subscribe," or substantially similar button presented during the checkout or registration process; (b) Subscriber completing the checkout process and submitting payment information for any Subscription Fees; or (c) Subscriber creating an account on the Platform.

1.2 No Signature Required. This Agreement is a clickwrap agreement and does not require a handwritten or wet-ink signature from either party. Subscriber acknowledges and agrees that no physical, manual, or handwritten signature is necessary for this Agreement to constitute a valid, binding, and enforceable contract between the parties.

1.3 Electronic Acceptance. Subscriber expressly acknowledges and agrees that Subscriber's act of clicking the acceptance button, completing the checkout process, or creating an account constitutes Subscriber's electronic signature and manifests Subscriber's intent to be bound by the terms and conditions of this Agreement. Such electronic acceptance carries the same legal force, validity, and enforceability as a handwritten signature on a paper-based contract.

1.4 Governing Electronic Transaction Laws. This Agreement is entered into in accordance with, and Subscriber's electronic acceptance is valid and enforceable under, the Electronic Signatures in Global and National Commerce Act (E-SIGN Act), 15 U.S.C. §§ 7001–7031, and the Uniform Electronic Transactions Act (UETA) as adopted by the applicable state jurisdiction. Subscriber waives any defense or objection to the enforceability of this Agreement based solely on the electronic form of acceptance or the absence of a handwritten signature.

1.5 Record Retention. Provider shall maintain an electronic record of Subscriber's acceptance, including the date, time, IP address, and method of acceptance. Subscriber agrees that such record constitutes reasonable evidence of Subscriber's acceptance of and consent to this Agreement. Provider may, but is not obligated to, deliver a copy of this Agreement to Subscriber via the email address provided during registration.

1.6 Authority to Bind. If Subscriber is accepting this Agreement on behalf of a legal entity (including but not limited to a professional corporation, professional limited liability company, partnership, or sole proprietorship), the individual clicking the acceptance button represents and warrants that such individual has the requisite authority to bind such entity to this Agreement. If such individual does not have the requisite authority, such individual shall be personally liable for all obligations under this Agreement.

Section 2. Relationship to Terms of Service and Other Agreements

2.1 Master Commercial Contract. This Agreement constitutes the master commercial contract governing Subscriber’s subscription to and use of the Platform and Services. This Agreement establishes the commercial, financial, intellectual property, liability, and regulatory compliance terms between Provider and Subscriber. The Terms of Service (the "TOS") published on the Platform govern the day-to-day operational rules and acceptable conduct for Platform access and usage.

2.2 Incorporation by Reference. The following documents are incorporated into and made a part of this Agreement by reference, each as amended by Provider from time to time in accordance with the amendment procedures set forth therein or in this Agreement: (a) the Terms of Service; (b) the Business Associate Agreement; (c) the Acceptable Use Policy; and (d) the Privacy Policy. Subscriber acknowledges that Subscriber has been provided access to each incorporated document and has had the opportunity to review them prior to accepting this Agreement.

2.3 Conflict and Order of Precedence. In the event of any conflict, inconsistency, or ambiguity between or among this Agreement and any of the incorporated documents, the conflict shall be resolved according to the following order of precedence (with the higher-numbered document prevailing over the lower-numbered document to the extent of the conflict):

(1) Business Associate Agreement (BAA) — With respect to any matter involving the creation, receipt, maintenance, use, disclosure, or security of Protected Health Information (PHI), the BAA shall control and supersede all other documents regardless of their position in this hierarchy.

(2) This SaaS Subscription Agreement — With respect to all commercial terms, payment obligations, intellectual property rights, representations and warranties, limitations of liability, indemnification, term, and termination.

(3) Terms of Service (TOS) — With respect to operational rules, account management, Platform features, and day-to-day usage guidelines.

(4) Acceptable Use Policy (AUP) — With respect to prohibited conduct, content restrictions, and enforcement actions related to Platform misuse.

(5) Privacy Policy — With respect to the collection, use, and disclosure of non-PHI personal information and usage data.

2.4 Entire Agreement. This Agreement (together with the documents incorporated by reference herein and any Order or Subscription Selection submitted by Subscriber) constitutes the entire agreement between the parties with respect to the subject matter hereof and supersedes all prior and contemporaneous understandings, agreements, representations, warranties, and communications, whether written or oral, with respect to such subject matter.

2.5 TOS Amendments. Provider may amend the TOS, AUP, and Privacy Policy upon thirty (30) days’ prior written notice to Subscriber (which may be provided via email, in-Platform notification, or posting to the Platform website). Subscriber’s continued use of the Platform following the effective date of any such amendment constitutes acceptance of the amended terms. If Subscriber does not agree to any amendment, Subscriber’s sole remedy is to terminate the subscription in accordance with the termination provisions of this Agreement.

Section 3. Definitions

As used in this Agreement, the following capitalized terms shall have the meanings set forth below. Capitalized terms used but not defined in this Agreement shall have the meanings assigned to them in the TOS, unless the context requires otherwise.

"Acceptable Use Policy" or "AUP" means the policy published by Provider on the Platform website (as updated from time to time in accordance with Section 2.5) that establishes the rules governing permitted and prohibited uses of the Platform, including but not limited to content standards, prohibited activities, messaging and communication restrictions, and enforcement mechanisms for violations thereof.

"AI Features" means any artificial intelligence, machine learning, natural language processing, or automated decision-making capabilities made available through the Platform, including but not limited to AI-assisted content generation, AI-powered chatbots, automated patient communication tools, predictive analytics, clinical workflow suggestions, and any other features that employ algorithmic or statistical models to generate, analyze, classify, or recommend content or actions. AI Features may be provided by Provider directly or through Third-Party Services integrated into the Platform.

"Authorized User" means any individual who is authorized by Subscriber to access and use the Platform on Subscriber’s behalf under Subscriber’s account, including but not limited to Subscriber’s employees, independent contractors, clinical staff, administrative personnel, and virtual assistants, subject to any limitations on the number of Authorized Users specified in Subscriber’s Order or Subscription Selection and the applicable subscription tier.

"Business Associate Agreement" or "BAA" means the HIPAA Business Associate Agreement entered into between Provider and Subscriber (either as a standalone document or as an exhibit to this Agreement) that establishes the parties’ respective obligations with respect to the use, disclosure, and safeguarding of Protected Health Information in accordance with HIPAA.

"Confidential Information" means any and all non-public information disclosed by one party (the “Disclosing Party”) to the other party (the “Receiving Party”), whether orally, in writing, electronically, or by inspection, that is designated as confidential or that reasonably should be understood to be confidential given the nature of the information and the circumstances of disclosure. Confidential Information includes, without limitation: (a) with respect to Provider: the Platform’s source code, algorithms, architecture, pricing models, product roadmap, security configurations, and business strategies; and (b) with respect to Subscriber: patient lists, clinical protocols, business operations data, and financial information. Confidential Information does not include information that: (i) is or becomes publicly available without breach of this Agreement; (ii) was known to the Receiving Party prior to disclosure without restriction; (iii) is received from a third party without breach of any obligation of confidentiality; or (iv) is independently developed by the Receiving Party without use of or reference to the Disclosing Party’s Confidential Information. For the avoidance of doubt, Protected Health Information is governed exclusively by the BAA and is not subject to the confidentiality provisions of this Agreement except to the extent the BAA expressly incorporates such provisions.

"Covered Entity" has the meaning ascribed to it under 45 C.F.R. § 160.103 and, for purposes of this Agreement, refers to Subscriber in its capacity as a healthcare provider that transmits health information in electronic form in connection with a transaction covered by HIPAA.

"Documentation" means all user manuals, help files, knowledge base articles, onboarding guides, training materials, API documentation, video tutorials, and other written or electronic materials made available by Provider that describe the functionality, features, requirements, and operation of the Platform and Services, as updated by Provider from time to time.

"End Users" or "Patients" means the individuals (including patients, clients, prospective patients, and other healthcare consumers) who interact with or receive services through Subscriber’s single dedicated account workspace, including but not limited to individuals who: (a) schedule appointments through Subscriber’s booking pages; (b) receive communications (including emails, SMS messages, and chat messages) sent through the Platform on Subscriber’s behalf; (c) access patient portals, membership areas, or course content created by Subscriber; (d) submit intake forms or other information through the Platform; or (e) otherwise engage with Subscriber’s practice through the Platform.

"Fees" means, collectively, all amounts payable by Subscriber to Provider under this Agreement, including:

(a) Subscription Fees: the recurring fees (monthly or annual, as selected by Subscriber) charged for access to the Platform at the applicable subscription tier, as set forth in Provider’s then-current published pricing schedule presented to Subscriber during the checkout and enrollment process; and

(b) Usage-Based Fees: variable fees assessed based on Subscriber’s actual consumption of metered services, including but not limited to SMS/MMS messaging, email volume in excess of plan allowances, telephony minutes, AI usage credits, premium feature add-ons, additional Authorized Users in excess of plan limits, and transactional fees for payment processing conducted through the Platform.

"HIPAA" means the Health Insurance Portability and Accountability Act of 1996 (Pub. L. 104-191), as amended by the Health Information Technology for Economic and Clinical Health Act (the “HITECH Act”) (Pub. L. 111-5), and all regulations promulgated thereunder, including the Standards for Privacy of Individually Identifiable Health Information (the “Privacy Rule”) at 45 C.F.R. Part 160 and Part 164, Subparts A and E, and the Security Standards for the Protection of Electronic Protected Health Information (the “Security Rule”) at 45 C.F.R. Part 160 and Part 164, Subparts A and C, each as amended from time to time.

"Intellectual Property" means all patents, patent applications, copyrights, trademarks, service marks, trade names, trade dress, trade secrets, know-how, inventions, methodologies, algorithms, software (in source code and object code form), databases, domain names, and all other intellectual property rights and proprietary rights, whether registered or unregistered, and all applications, renewals, extensions, and restorations thereof, in each case under the laws of any jurisdiction.

"Order" or "Subscription Selection" means the specific subscription tier, plan configuration, add-on features, billing frequency, and pricing selected by Subscriber through the Platform’s checkout process or otherwise agreed upon in writing by the parties. Each Order or Subscription Selection is incorporated into and governed by this Agreement. In the event of a conflict between an Order or Subscription Selection and the body of this Agreement, this Agreement shall control unless the Order or Subscription Selection expressly states that it is intended to modify a specific provision of this Agreement.

"Protected Health Information" or "PHI" has the meaning ascribed to it under 45 C.F.R. § 160.103 and includes all individually identifiable health information transmitted or maintained by Provider on behalf of Subscriber in connection with the Services, in any form or medium, including electronic Protected Health Information (“ePHI”). The creation, receipt, maintenance, use, disclosure, and security of PHI are governed exclusively by the BAA.

"Platform" means the Sancta, LLC, software-as-a-service platform, which is a white-labeled implementation of the GoHighLevel technology stack, together with all associated web applications, mobile applications, APIs, integrations, and infrastructure operated or made available by Provider for Subscriber’s use, as such Platform may be modified, updated, or enhanced by Provider from time to time.

"Provider" means Sancta, LLC, a limited liability company organized under the laws of the State of Florida, including its successors, assigns, and authorized representatives.

"Services" means, collectively, all services provided by Provider to Subscriber through or in connection with the Platform, including but not limited to: (a) access to and use of the Platform’s features and functionality at the applicable subscription tier; (b) customer support and technical assistance; (c) onboarding and training; (d) hosting and infrastructure; (e) security and data protection; (f) system maintenance, updates, and enhancements; and (g) any professional services, consulting, or implementation services separately agreed upon by the parties in writing.

"Sub-Account" means the single dedicated, logically segregated account workspace provisioned within the Platform for Subscriber’s exclusive use, through which Subscriber manages its practice operations, patient communications, marketing, scheduling, and other business functions. Each Subscriber receives one (1) Sub-Account, which contains Subscriber’s configurations, data, workflows, and customizations.

"Subscriber" means the healthcare provider (whether an individual practitioner, professional corporation, professional limited liability company, group practice, or other legal entity) that accepts this Agreement and subscribes to the Platform. For purposes of this Agreement, Subscriber is a Covered Entity under HIPAA and is responsible for ensuring that its use of the Platform complies with all applicable federal, state, and local laws, regulations, and professional licensing requirements governing the practice of healthcare.

"Subscriber Content" means all content, materials, and information uploaded, created, transmitted, stored, or otherwise made available by or on behalf of Subscriber through the Platform, including but not limited to: (a) website and funnel content; (b) marketing materials, email templates, and SMS/MMS message content; (c) course and membership content; (d) intake forms and questionnaires; (e) images, videos, audio files, and documents; (f) workflow and automation configurations; and (g) any other content created or provided by Subscriber. Subscriber Content does not include Subscriber Data or PHI, which are governed by separate provisions of this Agreement and the BAA, respectively.

"Subscriber Data" means all data and information (other than PHI) that is: (a) provided by Subscriber or its Authorized Users to the Platform; (b) collected through the Platform on Subscriber’s behalf from End Users or Patients; or (c) generated through Subscriber’s use of the Platform, including but not limited to contact records, appointment data, transaction records, communication logs, form submissions, analytics data, CRM records, and pipeline data. Subscriber Data does not include Usage Data or PHI.

"Subscription Term" means the initial period of the subscription as specified in the Order or Subscription Selection (whether monthly or annual), together with any renewal periods, commencing on the date Subscriber’s access to the Platform is activated and continuing until terminated in accordance with the termination provisions of this Agreement.

"Third-Party Platform Provider" means HighLevel, Inc. (d/b/a GoHighLevel), the technology company that develops, operates, and maintains the underlying SaaS platform infrastructure upon which the Sancta, LLC, Platform is built and deployed as a white-labeled solution. Provider’s ability to deliver certain Platform features and functionality is dependent upon the continued availability and performance of the Third-Party Platform Provider’s technology.

"Third-Party Services" means any software, applications, integrations, APIs, tools, or services provided by parties other than Provider or the Third-Party Platform Provider that are accessible through, integrated with, or otherwise used in connection with the Platform, including but not limited to: payment processors (e.g., Stripe), communication providers (e.g., Twilio, Mailgun), calendar integrations, electronic health record systems, telehealth video platforms, AI service providers, social media platforms, and any other external services that Subscriber may connect to or access through the Platform.

"Usage Data" means anonymized, aggregated, and de-identified data derived from Subscriber’s and its Authorized Users’ use of the Platform, including but not limited to: feature utilization metrics, performance data, system logs, error reports, configuration patterns, and statistical information regarding Platform usage. Usage Data does not identify Subscriber, any Authorized User, any End User, or any Patient, and does not constitute Subscriber Data, Subscriber Content, Confidential Information, or PHI. Provider may collect, use, and disclose Usage Data for any lawful business purpose, including product improvement, benchmarking, and analytics.

PART II: SUBSCRIPTION AND ACCESS

4. Subscription Plans and Selection

4.1 Plan Selection. Subscriber shall select a subscription plan (the "Plan") during the checkout and enrollment process. The fees applicable to the Plan shall be as set forth in Provider’s then-current published pricing schedule presented to Subscriber during the checkout and enrollment process, together with the features, functionality, and usage limitations displayed to Subscriber at that time.

4.2 Multiple Tiers. Provider may, in its sole discretion, offer multiple subscription tiers, each with varying levels of access, features, and pricing. The scope of Subscriber's rights under this Agreement shall be limited to the features and functionality included within the Plan selected by Subscriber at the time of enrollment, as such Plan may be modified from time to time in accordance with the terms of this Agreement.

4.3 Plan Descriptions. The features, functionality, usage limitations, and premium add-on services, if applicable, for each Plan shall be as displayed to Subscriber during the checkout and enrollment process. The applicable fees are governed by Section 4.1.

4.4 Plan Modifications by Provider. Provider reserves the right to modify, discontinue, or introduce new Plans at any time upon thirty (30) days' prior written notice to Subscriber. Any modification to Subscriber's then-current Plan that materially diminishes the features or functionality included therein shall not take effect until the commencement of Subscriber's next Renewal Term, unless Subscriber affirmatively consents to such modification.

4.5 Plan Upgrades and Downgrades. Subscriber may request an upgrade or downgrade to a different Plan at any time through the Platform interface. Upgrades shall take effect immediately or at the start of the next billing cycle, as determined by Provider. Downgrades shall take effect at the commencement of the next billing cycle. No refunds or credits shall be issued for downgrades made mid-cycle unless expressly stated in the applicable Plan terms.

5. License Grant

5.1 Grant of License. Subject to Subscriber's compliance with all terms and conditions of this Agreement, including timely payment of all applicable fees, Provider hereby grants to Subscriber a limited, non-exclusive, non-transferable, non-sublicensable, revocable license to access and use the Platform during the Subscription Term solely for Subscriber's own internal healthcare practice operations.

5.2 Scope of License. The license granted under Section 5.1 permits Subscriber to: (a) access and use the Platform features and functionality included within Subscriber's selected Plan; (b) access and manage the single dedicated account workspace provisioned for Subscriber; (c) configure the Platform to support Subscriber's healthcare practice workflows, patient communications, scheduling, and related operational activities; and (d) permit Authorized Users to access and use the Platform in accordance with this Agreement.

5.3 License Restrictions. The license granted herein is subject to the restrictions and limitations set forth in the Terms of Service, which are incorporated herein by reference in their entirety. Without limiting the generality of the foregoing, Subscriber shall not: (a) sublicense, resell, distribute, or otherwise make the Platform available to any third party, except as expressly permitted for Authorized Users under this Agreement; (b) use the Platform for the benefit of any entity other than Subscriber's own healthcare practice; (c) reverse engineer, decompile, disassemble, or otherwise attempt to derive the source code or underlying algorithms of the Platform; (d) modify, adapt, translate, or create derivative works based upon the Platform; (e) remove, alter, or obscure any proprietary notices, labels, or marks on the Platform; (f) use the Platform in any manner that violates applicable law, regulation, or professional ethical standards; or (g) use the Platform to develop a competing product or service.

5.4 Reservation of Rights. All rights not expressly granted to Subscriber under this Agreement are reserved by Provider. Subscriber acknowledges and agrees that the Platform, including all intellectual property rights therein, is and shall remain the sole and exclusive property of Provider and its licensors. No title to or ownership of the Platform or any intellectual property rights therein is transferred to Subscriber under this Agreement.

5.5 Revocation. Provider may revoke the license granted hereunder immediately upon written notice to Subscriber in the event of: (a) Subscriber's material breach of this Agreement; (b) Subscriber's failure to cure a curable breach within the applicable cure period; (c) Subscriber's use of the Platform in a manner that poses a security risk or threatens the integrity of the Platform; or (d) termination or expiration of this Agreement for any reason.

6. Onboarding and Account Activation

6.1 Account Activation. Subscriber's account shall be activated upon the successful completion of all of the following: (a) completion of the registration process, including provision of all required information; (b) selection of a subscription Plan; (c) acceptance of this Agreement, the Terms of Service, the Privacy Policy, and any other applicable policies; and (d) successful processing of the initial payment for the selected Plan.

6.2 Activation Timeline. Provider shall use commercially reasonable efforts to activate Subscriber's account within twenty-four (24) hours of Subscriber's completion of all activation requirements set forth in Section 6.1. Provider shall not be liable for any delays in activation resulting from incomplete registration information, failed payment processing, or circumstances beyond Provider's reasonable control.

6.3 Onboarding Assistance. Provider may, in its sole discretion, offer onboarding assistance to Subscriber, which may include but is not limited to: (a) guided setup tutorials and documentation; (b) pre-configured templates and workflows tailored to healthcare practice operations; (c) live or recorded training sessions; and (d) dedicated onboarding support for a limited period following account activation. The availability, scope, and duration of onboarding assistance may vary by Plan and is subject to change at Provider's discretion.

6.4 Subscriber Configuration Responsibilities. Subscriber is solely responsible for configuring the Platform to meet Subscriber's specific operational needs, including but not limited to: (a) setting up practice branding and customization; (b) configuring appointment scheduling parameters; (c) establishing patient communication workflows and templates; (d) importing or inputting patient and contact data in compliance with applicable privacy laws; (e) configuring billing and payment integrations; (f) establishing user roles and permissions for Authorized Users; and (g) ensuring all configurations comply with applicable healthcare regulations, including but not limited to HIPAA, state telehealth laws, and professional licensing requirements.

6.5 No Guarantee of Suitability. Provider does not represent or warrant that the Platform, as configured by Subscriber, will comply with any specific legal, regulatory, or professional requirements applicable to Subscriber's healthcare practice. Subscriber acknowledges that it bears sole responsibility for ensuring that its use and configuration of the Platform complies with all applicable laws and regulations.

7. Authorized Users and Account Workspace

7.1 Authorized Users Defined. "Authorized Users" means individuals whom Subscriber authorizes to access and use the Platform under Subscriber's account, including but not limited to: Subscriber's employees, independent contractors, clinical staff, administrative personnel, and other agents who require access to the Platform in connection with Subscriber's healthcare practice operations.

7.2 Subscriber Control of Access. Subscriber shall have sole authority and responsibility for: (a) determining which individuals are granted access to the Platform as Authorized Users; (b) assigning appropriate roles, permissions, and access levels to each Authorized User; (c) ensuring that each Authorized User's access is limited to the minimum scope necessary for such user's role; (d) promptly revoking access for any individual who is no longer authorized or whose access should be restricted; and (e) maintaining accurate and current records of all Authorized Users.

7.3 Subscriber Responsibility for Authorized User Activity. Subscriber is fully responsible and liable for all acts and omissions of its Authorized Users in connection with the Platform, including but not limited to: (a) compliance with this Agreement, the Terms of Service, and all applicable policies; (b) protection of login credentials and account security; (c) appropriate handling of patient data and protected health information; and (d) compliance with all applicable laws and regulations. Any breach of this Agreement by an Authorized User shall be deemed a breach by Subscriber.

7.4 Authorized User Obligations. Subscriber shall ensure that each Authorized User: (a) is informed of and agrees to comply with all applicable terms and conditions governing use of the Platform; (b) uses unique login credentials and does not share credentials with any other individual; (c) maintains the confidentiality of all account credentials and immediately reports any unauthorized access or suspected security breach; (d) completes any required training prior to accessing the Platform; and (e) uses the Platform solely for purposes authorized by Subscriber and consistent with this Agreement.

7.5 Account Workspace. Each Subscriber receives one (1) account. The Platform provides each Subscriber with a single dedicated account workspace for Subscriber’s exclusive use, through which Subscriber manages its practice operations, patient communications, marketing, scheduling, and other business functions. The account workspace contains Subscriber’s configurations, data, workflows, and customizations.

7.6 Single-Account Limitation. Each Subscriber is limited to one (1) account and one (1) dedicated account workspace. Subscriber shall not create or maintain additional accounts or workspaces for itself or any unrelated third party or separate legal entity.

7.7 Account Workspace Administration. Subscriber shall be solely responsible for the administration, configuration, and oversight of its account workspace. Provider shall have no obligation to monitor or manage the account workspace. All data, content, and activity within the account workspace shall be subject to the same terms and conditions as Subscriber's account.

7.8 Credential Security. Subscriber acknowledges that the security of the Platform depends upon the proper management of access credentials. Subscriber shall implement reasonable security measures, including but not limited to: (a) requiring strong, unique passwords for all Authorized Users; (b) enabling multi-factor authentication where available; (c) conducting periodic access reviews; and (d) promptly deactivating accounts of former employees or contractors. Provider shall not be liable for any unauthorized access resulting from Subscriber's failure to maintain adequate credential security.

PART III: FEES, PAYMENT, AND BILLING

Section 8. Subscription Fees

8.1 Fee Structure

Subscriber shall pay the applicable Subscription Fees for the plan selected by Subscriber (the “Selected Plan”) as set forth in Provider’s then-current published pricing schedule presented to Subscriber during the checkout and enrollment process. Subscription Fees are billed in advance on a monthly or annual basis, as selected by Subscriber at checkout. All fees are denominated and payable in United States Dollars (USD).

8.2 Billing Cycle

For monthly billing cycles, Subscription Fees are due and payable on the same calendar day each month as the original enrollment date (or the last day of the month if such date does not exist in a given month). For annual billing cycles, Subscription Fees are due and payable on the anniversary of the original enrollment date. The billing cycle commences on the Effective Date of this Agreement.

8.3 Non-Refundable Nature of Fees

Except as expressly set forth in Section 14 (Refund Policy) of this Agreement, all Subscription Fees are non-refundable. Subscriber acknowledges and agrees that Subscription Fees, once paid, shall not be subject to proration, credit, or refund for any partial period of non-use, voluntary cancellation, or downgrade during a billing cycle.

8.4 Plan Tiers and Feature Entitlements

Provider may offer multiple subscription tiers, each of which may include different features, usage allocations, integrations, and support levels. The features, usage limits, and pricing applicable to each tier are as displayed to Subscriber at the time of enrollment and as set forth on Provider’s pricing page, which may be updated from time to time. Subscriber's entitlements shall be limited to those associated with the Selected Plan.

8.5 Activation and First Payment

Subscriber's obligation to pay Subscription Fees commences immediately upon completion of the enrollment process and acceptance of this Agreement through the clickwrap mechanism. Provider shall charge the applicable Subscription Fee to Subscriber's designated payment method upon successful enrollment. Access to the Platform shall be provisioned promptly following successful payment processing.

Section 9. Auto-Renewal and Cancellation

9.1 Automatic Renewal

SUBSCRIBER ACKNOWLEDGES AND AGREES THAT ALL SUBSCRIPTIONS SHALL AUTOMATICALLY RENEW FOR SUCCESSIVE PERIODS EQUAL IN DURATION TO THE INITIAL SUBSCRIPTION TERM (EACH A "RENEWAL TERM") UNLESS SUBSCRIBER CANCELS THE SUBSCRIPTION IN ACCORDANCE WITH SECTION 9.2. FOR MONTHLY SUBSCRIPTIONS, THE RENEWAL TERM SHALL BE ONE (1) MONTH. FOR ANNUAL SUBSCRIPTIONS, THE RENEWAL TERM SHALL BE ONE (1) YEAR. EACH RENEWAL TERM SHALL COMMENCE IMMEDIATELY FOLLOWING THE EXPIRATION OF THE THEN-CURRENT TERM.

9.2 Cancellation Procedure

Subscriber may initiate cancellation of auto-renewal at any time through any of the cancellation methods described in Section 37.1. The selected cancellation mechanism—whether a button, email, portal, or other mechanism—initiates the cancellation process but does not itself make cancellation effective. Cancellation shall take effect in accordance with Section 37.2, subject to the annual cooling-off right in Section 37.6. Subscriber's access to the Platform shall continue through the applicable effective date of cancellation. Upon the effective date of cancellation, the subscription shall not renew thereafter.

9.3 Notice of Fee Changes at Renewal

Provider shall provide Subscriber with at least thirty (30) days' advance written notice of any change to Subscription Fees that will take effect at the next Renewal Term. Such notice shall be delivered via the electronic mail address associated with Subscriber's account or through a conspicuous notice within the Platform. If Subscriber does not cancel prior to the Renewal Term in which the new fees take effect, Subscriber shall be deemed to have accepted the modified fees.

9.4 Compliance with State and Federal Auto-Renewal Laws

Provider represents and warrants that its auto-renewal and cancellation practices comply with all applicable federal and state consumer protection laws governing automatic renewal and continuous service offers, including without limitation:

(a) The California Automatic Renewal Law (Cal. Bus. & Prof. Code §§ 17600–17606), including the requirement to present automatic renewal terms in a clear and conspicuous manner before the purchasing decision, obtain affirmative consent, and provide a cost-effective and timely cancellation mechanism;

(b) New York General Business Law § 527 and related regulations governing automatic renewal clauses in consumer contracts;

(c) The Federal Trade Commission's "Click-to-Cancel" Rule (16 C.F.R. Part 425, as amended), requiring that the mechanism for cancellation be at least as simple and accessible as the mechanism for enrollment; and

(d) Any other applicable state or federal law governing automatic renewal offers, negative option marketing, or continuous service contracts.

9.5 Pre-Renewal Reminder

For annual subscriptions, Provider shall send a renewal reminder notice to Subscriber no fewer than thirty (30) days and no more than sixty (60) days prior to the renewal date. Such reminder shall identify: (i) the upcoming renewal date; (ii) the applicable renewal fee; (iii) the cancellation deadline; and (iv) instructions for cancellation.

Section 10. Usage-Based Fees

10.1 General

In addition to Subscription Fees, Subscriber shall be responsible for Usage-Based Fees incurred through Subscriber's use of the Platform in excess of any usage allocations included in Subscriber's Selected Plan. Usage-Based Fees are billed monthly in arrears and are calculated based on actual consumption during the preceding billing period.

10.2 SMS Messaging Fees

Subscriber shall be charged for Short Message Service (SMS) and Multimedia Messaging Service (MMS) communications transmitted through the Platform on a per-segment basis. A "segment" is defined as a single SMS message unit of up to one hundred sixty (160) characters (for GSM-7 encoded messages) or seventy (70) characters (for UCS-2 encoded messages). Messages exceeding the applicable character limit shall be divided into multiple segments, each billed individually. Rates may vary based on destination country, carrier, and message type (local, toll-free, or short code).

10.3 Voice Minutes

Subscriber shall be charged for outbound and inbound voice telephony minutes consumed through the Platform. Voice minutes are calculated in one-minute increments, with any partial minute rounded up to the next full minute. Rates may vary based on call type (local, long-distance, or international) and whether the call originates from or terminates to a standard telephone number or toll-free number.

10.4 AI Voice Minutes

Subscriber shall be charged for minutes consumed through the Platform's artificial intelligence voice agent functionality. AI voice minutes are calculated separately from standard voice minutes and are billed at the applicable per-minute rate. AI voice minutes include all time during which the AI voice agent is actively engaged in a conversation, inclusive of processing latency and silence intervals within an active session.

10.5 Email Volume Overages

Each Selected Plan includes a monthly email sending allocation. Subscriber shall be charged for emails sent through the Platform in excess of the monthly allocation included in Subscriber's Selected Plan. Overage emails are billed at the applicable per-email rate. For purposes of this Section, each unique recipient of a single email transmission constitutes one (1) email.

10.6 Storage Overages

Each Selected Plan includes a defined allocation of data storage capacity (inclusive of media files, documents, recordings, and other digital assets stored on the Platform). Subscriber shall be charged for storage consumption in excess of the included allocation at the applicable per-gigabyte (GB) per-month rate. Storage usage is calculated as the peak storage consumption during the billing period.

10.7 Calculation and Records

All Usage-Based Fees shall be calculated exclusively from Provider's system records and metering infrastructure. Provider's records shall be presumptively accurate absent manifest error. Subscriber may access usage reports and consumption data through the Platform's administrative dashboard on a real-time or near-real-time basis.

10.8 Dispute Window

Subscriber must submit any dispute regarding Usage-Based Fees in writing within thirty (30) days from the date of the invoice reflecting such charges. Disputes must identify the specific charges contested and provide a reasonable basis for the dispute. Provider shall investigate disputed charges in good faith and provide a written response within fifteen (15) business days. Failure to dispute charges within the thirty (30) day window shall constitute acceptance of such charges as accurate and final.

10.9 Usage Alerts and Notifications

Provider shall use commercially reasonable efforts to provide Subscriber with automated notifications when Subscriber's usage approaches or exceeds the allocations included in Subscriber's Selected Plan. However, the failure to provide such notifications shall not relieve Subscriber of the obligation to pay applicable Usage-Based Fees.

Section 11. Payment Methods and Late Payment

11.1 Accepted Payment Methods

Subscriber must maintain a valid, current payment method on file with Provider at all times during the term of this Agreement. Accepted payment methods include: (a) a valid credit card (Visa, Mastercard, American Express, or Discover); or (b) an Automated Clearing House (ACH) bank transfer authorization. Subscriber authorizes Provider to charge the payment method on file for all Subscription Fees, Usage-Based Fees, and any other charges incurred under this Agreement.

11.2 Payment Authorization

By providing a payment method and accepting this Agreement through the clickwrap enrollment process, Subscriber expressly authorizes Provider to initiate recurring charges to Subscriber's designated payment method in accordance with the billing cycle applicable to Subscriber's Selected Plan. This authorization shall remain in effect until this Agreement is terminated or Subscriber updates the payment method on file through the Platform's account management portal.

11.3 Failed Payment and Dunning Process

In the event that a scheduled charge to Subscriber's payment method is declined, fails, or cannot be processed for any reason, Provider shall implement the following dunning process:

(a) Initial Failure Notification: Provider shall notify Subscriber of the failed payment within twenty-four (24) hours via electronic mail and in-platform notification, requesting that Subscriber update the payment method on file.

(b) First Retry: Provider shall reattempt to process the payment seven (7) calendar days following the initial failure.

(c) Second Notification and Grace Period: If the first retry fails, Provider shall send a second notification advising Subscriber that the account is at risk of suspension and providing an additional seven (7) calendar days to cure the payment failure.

(d) Account Suspension: If payment remains unsuccessful following the grace period described in subsection (c), Provider may immediately suspend Subscriber's access to the Platform without further notice. During suspension, Subscriber's data shall be retained in accordance with Provider's data retention policy, but Subscriber shall not be able to access Platform functionality.

(e) Reactivation: Subscriber may reactivate a suspended account by curing all outstanding payment obligations, including any accrued late fees or interest. Reactivation is subject to Provider's then-current terms and pricing.

11.4 Thirty-Day Arrears and Termination

If Subscriber's account remains in arrears for a period of thirty (30) or more consecutive calendar days from the original payment due date, Provider shall have the right, but not the obligation, to terminate this Agreement immediately upon written notice to Subscriber. Such termination shall not relieve Subscriber of the obligation to pay all outstanding fees, charges, interest, and costs accrued through the date of termination.

11.5 Late Payment Interest

Any amounts not paid when due shall accrue interest at the rate of one and one-half percent (1.5%) per month (or, if lower, the maximum rate permitted by applicable law), compounded monthly, from the original due date until paid in full. Interest shall accrue on the full outstanding balance, inclusive of any previously accrued and unpaid interest.

11.6 Collection Costs

In the event that Provider engages third-party collection services, retains legal counsel, or initiates legal proceedings to recover amounts owed by Subscriber under this Agreement, Subscriber shall be liable for all reasonable costs of collection, including without limitation: attorneys' fees, court costs, filing fees, collection agency commissions, and any other expenses reasonably incurred in connection with the enforcement of Provider's rights under this Agreement.

Section 12. Fee Modifications

12.1 Right to Modify Fees

Provider may modify Subscription Fees, Usage-Based Fees, and any other charges under this Agreement from time to time in its reasonable business discretion upon at least thirty (30) days’ advance written notice to Subscriber. Fee modifications may reflect changes in Provider's operating costs, third-party platform fees, infrastructure costs, market conditions, or the addition of new features and functionality to the Platform.

12.2 Advance Notice

Provider shall provide Subscriber with at least thirty (30) days' advance written notice of any fee modification. Such notice shall be delivered via: (a) electronic mail to the address associated with Subscriber's account; (b) a conspicuous in-platform notification; or (c) both. The notice shall identify the current fee, the modified fee, and the effective date of the modification.

12.3 Effective Date

Fee modifications shall take effect on a going-forward basis at the commencement of the next Renewal Term after the expiration of the thirty (30)-day notice period. Fee modifications shall not apply retroactively to any prepaid period. For annual subscribers, any fee increase shall not take effect until the next annual renewal date.

12.4 Subscriber's Right to Cancel

If Subscriber objects to a fee modification, Subscriber's sole and exclusive remedy shall be to cancel the subscription prior to the effective date of the modification in accordance with Section 9.2 (Cancellation Procedure). If Subscriber does not cancel prior to the effective date of the modification, Subscriber shall be deemed to have accepted the modified fees, and the modified fees shall apply to all subsequent billing periods.

12.5 Grandfathering

Provider may, in its sole discretion, offer existing subscribers grandfathered pricing, promotional rates, or transition periods in connection with fee modifications. Any such offer shall be communicated in writing and shall be subject to such terms and conditions as Provider may specify.

Section 13. Taxes

13.1 Fees Exclusive of Taxes

All Subscription Fees, Usage-Based Fees, and other charges set forth in this Agreement are exclusive of, and Subscriber is responsible for, all applicable taxes, levies, duties, and governmental assessments of any nature, including without limitation: sales tax, use tax, value-added tax (VAT), goods and services tax (GST), excise tax, telecommunications tax, and any other tax or fee imposed by any federal, state, local, or foreign taxing authority in connection with the services provided hereunder.

13.2 Subscriber's Tax Obligations for Patient Services

Subscriber acknowledges and agrees that Subscriber is solely responsible for the determination, collection, reporting, and remittance of all taxes applicable to Subscriber's own services provided to patients or clients through the Platform. Provider makes no representation regarding the taxability of Subscriber's healthcare services and provides no tax advice. Subscriber shall indemnify and hold harmless Provider from any liability arising from Subscriber's failure to comply with applicable tax obligations related to Subscriber's patient services.

13.3 Tax Exemption Certificates

If Subscriber claims exemption from any applicable tax, Subscriber must provide Provider with a valid, properly executed tax exemption certificate or other documentation reasonably satisfactory to Provider prior to the commencement of the billing period in which the exemption is claimed. Provider shall apply any valid exemption prospectively from the date of receipt of proper documentation. Provider reserves the right to reject any exemption certificate that it reasonably determines to be invalid, incomplete, or inapplicable.

13.4 Withholding Taxes

If Subscriber is required by law to withhold or deduct any tax from payments due to Provider under this Agreement, Subscriber shall: (a) make such withholding or deduction; (b) pay the withheld or deducted amount to the relevant taxing authority in accordance with applicable law; (c) provide Provider with official tax receipts or other documentation evidencing such payment; and (d) increase the payment to Provider such that, after all required withholdings and deductions, Provider receives the full amount it would have received had no withholding or deduction been required (i.e., "gross-up" the payment).

13.5 Tax Cooperation

Each party shall cooperate reasonably with the other party in connection with any tax audit, dispute, or similar proceeding relating to taxes imposed in connection with this Agreement, including providing documentation, records, and information reasonably requested by the other party or any taxing authority.

Section 14. Refund Policy

14.1 General Non-Refundability

Except as expressly provided in this Section 14, all fees paid under this Agreement are non-refundable. Subscriber acknowledges that Provider incurs costs in provisioning and maintaining the Platform, and that the non-refundable nature of fees reflects the allocation of risk and cost between the parties. Subscriber shall not be entitled to any refund, credit, or proration for: (a) voluntary cancellation mid-term; (b) periods of non-use; (c) downgrade to a lower-tier plan; or (d) dissatisfaction with the Platform's features or functionality.

14.2 Statutory Cooling-Off Periods

Notwithstanding Section 14.1, Provider acknowledges and shall comply with all applicable statutory cooling-off periods, right-of-rescission laws, and consumer cancellation rights mandated by federal, state, or local law. In addition, a Subscriber who selects an annual Subscription Term may cancel within seven (7) calendar days of the Effective Date in accordance with Section 37.6 and receive a full refund of any Subscription Fees paid. Where any such law grants Subscriber a right to cancel and receive a refund within a specified period following enrollment, such statutory right shall not be limited, waived, or modified by this Agreement. Provider shall process refunds required by applicable law within the timeframe mandated by such law, or, if no timeframe is specified, within ten (10) business days of receiving a valid cancellation notice within the statutory period.

14.3 Service Credits for Verified Outages

In the event of a verified Platform outage (as determined by Provider's system monitoring infrastructure) that materially impairs Subscriber's access to core Platform functionality for a period exceeding four (4) consecutive hours during any calendar month, Provider may, in its sole discretion, issue a service credit to Subscriber's account. Service credits, if issued, shall be calculated on a pro-rata basis relative to the monthly Subscription Fee and the duration of the verified outage. Service credits: (i) shall be applied to future billing periods only; (ii) are not redeemable for cash; (iii) expire if not utilized within twelve (12) months of issuance; and (iv) shall not exceed the total Subscription Fee for the month in which the outage occurred.

14.4 Prorated Refund Upon Termination Without Cause by Provider

If Provider terminates this Agreement without cause (i.e., for reasons other than Subscriber's breach, violation of applicable law, or conduct that threatens the security or integrity of the Platform) during a prepaid annual subscription term, Provider shall refund Subscriber a prorated portion of the prepaid annual Subscription Fee corresponding to the unused remainder of the annual term, calculated from the effective date of termination through the end of the prepaid period. Such refund shall be processed within thirty (30) days of the effective date of termination and shall be remitted to the payment method on file or, if such method is no longer valid, by check to Subscriber's address of record.

14.5 No Other Refunds

Except as expressly set forth in Sections 14.2, 14.3, and 14.4, Subscriber shall not be entitled to any refund under any circumstances, including without limitation: termination for Subscriber's breach, termination by Subscriber for convenience, expiration of the subscription term, or any Force Majeure event. Usage-Based Fees incurred prior to cancellation or termination are non-refundable regardless of the circumstances of termination.

14.6 Refund Process

All refund requests must be submitted in writing to Provider's designated support address. Provider shall acknowledge receipt of a refund request within five (5) business days and shall provide a determination within fifteen (15) business days of receipt. Subscriber bears the burden of demonstrating entitlement to a refund under the provisions of this Section 14.

PART IV: HIPAA AND HEALTHCARE COMPLIANCE

Section 15. Processing of Protected Health Information

15.1 Platform Capability. The Platform is technically capable of processing Protected Health Information ("PHI") as defined under the Health Insurance Portability and Accountability Act of 1996, as amended, and its implementing regulations at 45 C.F.R. Parts 160 and 164 (collectively, "HIPAA"). The mere technical capability of the Platform to process PHI does not, standing alone, constitute a representation or warranty that the Platform is compliant with HIPAA or any other federal, state, or local healthcare privacy or security law.

15.2 No Warranty of HIPAA Compliance Absent BAA. Provider does not represent or warrant that the Platform, in its default configuration or as utilized by Subscriber, satisfies the requirements of HIPAA, the Health Information Technology for Economic and Clinical Health Act ("HITECH Act"), or any analogous state law unless and until Subscriber has (a) executed a Business Associate Agreement ("BAA") with Provider; (b) enrolled in a HIPAA-eligible subscription tier; and (c) configured the Platform in accordance with Provider's published HIPAA configuration guidance.

15.3 Subscriber Determination. Subscriber is solely responsible for determining whether its intended use of the Platform triggers obligations under HIPAA, including but not limited to whether Subscriber qualifies as a "Covered Entity" or "Business Associate" under 45 C.F.R. § 160.103, and whether the information Subscriber processes through the Platform constitutes PHI. Provider shall have no liability arising from Subscriber's failure to correctly assess its HIPAA obligations.

15.4 Non-HIPAA Use. If Subscriber determines that its use of the Platform does not involve PHI or does not trigger HIPAA obligations, Subscriber assumes all risk associated with such determination and agrees to indemnify Provider against any claim, loss, or regulatory action arising from an erroneous determination.

Section 16. Business Associate Agreement Requirement and Execution

16.1 BAA Prerequisite. Subscriber shall not introduce, transmit, store, or otherwise process any PHI through the Platform unless and until a Business Associate Agreement has been fully executed between Provider and Subscriber. Any processing of PHI absent a valid, executed BAA constitutes a material breach of this Agreement and shall entitle Provider to immediately suspend Subscriber's access to the Platform without liability.

16.2 Incorporation by Reference. Upon execution, the BAA shall be incorporated into and form an integral part of this Agreement. In the event of any conflict between the terms of the BAA and the terms of this Agreement with respect to the processing of PHI, the BAA shall control.

16.3 HIPAA-Eligible Subscription Tier. The availability of a BAA is conditioned upon Subscriber's enrollment in, and continuous maintenance of, a HIPAA-eligible subscription tier as designated by Provider. The HIPAA-eligible subscription tier includes additional fees as set forth in Provider’s then-current pricing schedule, which may be updated from time to time. Provider may, in its discretion, pass the HIPAA add-on cost through to Subscriber as part of the HIPAA-eligible tier pricing or as a separate line item.

16.4 Automatic Termination Upon Tier Lapse. In the event that Subscriber's HIPAA-eligible subscription tier lapses, is downgraded, or is otherwise discontinued for any reason—including but not limited to non-payment, voluntary downgrade, or administrative cancellation—the BAA shall automatically and immediately terminate without further notice or action by either party. Upon such automatic termination:

(a) Subscriber shall immediately cease all processing of PHI through the Platform;

(b) Subscriber shall, within fourteen (14) calendar days, retrieve or direct the disposition of all PHI stored within the Platform;

(c) Provider shall have no further obligations as a Business Associate with respect to any PHI remaining on the Platform after the fourteen (14) day retrieval period; and

(d) Subscriber shall remain solely responsible for any HIPAA violations, breach notifications, or regulatory consequences arising from the lapse period.

16.5 Continuous Tier Maintenance. Subscriber represents and warrants that it shall maintain a qualifying HIPAA-eligible subscription tier throughout any period during which PHI is processed, stored, or maintained on the Platform. A gap of even one (1) day in qualifying tier coverage shall trigger the automatic BAA termination provisions of Section 16.4.

16.6 Upstream BAA Cascade. Subscriber acknowledges that Provider's ability to offer BAA coverage is dependent upon Provider's own BAA with its upstream technology provider (GoHighLevel, Inc. or its affiliates). In the event the upstream BAA is terminated or materially modified, Provider shall use commercially reasonable efforts to notify Subscriber within five (5) business days, and the parties shall negotiate in good faith to address the resulting gap in BAA coverage. Notwithstanding Sections 16.4 and 16.5, if the upstream BAA is terminated and subsequently restored within a cure period not exceeding thirty (30) days, Provider may re-execute the downstream BAA with Subscriber without requiring a new enrollment, and continuity of BAA coverage shall be deemed uninterrupted for purposes of this Agreement.

Section 17. Subscriber's HIPAA Safeguards

17.1 General Obligation. Where Subscriber's use of the Platform involves PHI, Subscriber shall implement and maintain administrative, physical, and technical safeguards that reasonably and appropriately protect the confidentiality, integrity, and availability of electronic PHI ("ePHI") as required by the HIPAA Security Rule, 45 C.F.R. Part 164, Subpart C. Subscriber's obligation to maintain appropriate safeguards exists independently of and in addition to any safeguards provided by the Platform.

A. Administrative Safeguards

17.2 Security Officer Designation. Subscriber shall designate a Security Officer responsible for the development and implementation of the policies and procedures required by the HIPAA Security Rule as they relate to Subscriber's use of the Platform. Subscriber shall provide the name and contact information of its designated Security Officer to Provider within thirty (30) days of executing the BAA and shall notify Provider of any change in designation within fourteen (14) days.

17.3 Workforce Training. Subscriber shall implement a security awareness and training program for all members of its workforce (as defined in 45 C.F.R. § 160.103) who have access to the Platform or to PHI processed through the Platform. Such training shall include, at a minimum:

(a) HIPAA Privacy Rule requirements applicable to Subscriber's practice;

(b) HIPAA Security Rule requirements, including password management, phishing awareness, and incident reporting;

(c) Proper use of the Platform in compliance with this Agreement and the BAA;

(d) Prohibitions on the use of AI features for PHI processing (as set forth in Section 20);

(e) Procedures for reporting suspected or confirmed security incidents; and

(f) State telehealth and scope-of-practice requirements applicable to Subscriber's jurisdiction(s).

17.4 Training Frequency and Documentation. Workforce training shall be conducted (a) upon initial hire or engagement, (b) upon material changes to policies or procedures, and (c) at least annually thereafter. Subscriber shall maintain written records of all training sessions, including dates, attendees, and content covered, and shall make such records available to Provider upon reasonable request.

[NOTE TO CLIENT: Consider requiring Subscribers to submit an annual HIPAA training certification to Provider (e.g., a signed attestation confirming that all workforce members with Platform access have completed the annual training). This creates a documented compliance trail and shifts risk away from Provider in the event of a downstream breach caused by Subscriber's untrained workforce.]

17.5 Access Management. Subscriber shall implement policies and procedures for authorizing access to the Platform and to ePHI processed through the Platform, including:

(a) Establishing and maintaining unique user identifiers for each workforce member;

(b) Implementing procedures for obtaining necessary access and terminating access when no longer required;

(c) Conducting periodic reviews (no less than quarterly) of user access rights to confirm appropriateness; and

(d) Immediately revoking access upon workforce member termination or role change that eliminates the need for PHI access.

17.6 Risk Analysis. Subscriber shall conduct, and periodically update (no less than annually), an accurate and thorough assessment of the potential risks and vulnerabilities to the confidentiality, integrity, and availability of ePHI held or processed through the Platform. Subscriber shall implement security measures sufficient to reduce risks and vulnerabilities to a reasonable and appropriate level.

17.7 Contingency Planning. Subscriber shall establish and implement policies and procedures for responding to an emergency or other occurrence that damages systems containing ePHI, including a data backup plan, disaster recovery plan, and emergency mode operation plan, each as they relate to PHI processed through the Platform.

17.8 Sanctions Policy. Subscriber shall implement and apply appropriate sanctions against workforce members who fail to comply with Subscriber's HIPAA policies and procedures as they relate to Platform use.

B. Physical Safeguards

17.9 Workstation Controls. Subscriber shall implement policies and procedures that specify the proper functions to be performed, the manner in which those functions are to be performed, and the physical attributes of the surroundings of workstations that access the Platform and ePHI. At a minimum, Subscriber shall require:

(a) Auto-lock or automatic logoff after no more than fifteen (15) minutes of inactivity on any workstation accessing the Platform;

(b) Physical positioning of screens to prevent unauthorized viewing of PHI in clinical and non-clinical environments;

(c) Prohibition on accessing PHI through the Platform on shared or public workstations without additional compensating controls; and

(d) Policies governing the use of mobile devices to access the Platform, including requirements for device encryption, remote wipe capability, and passcode/biometric lock.

17.10 Device and Media Controls. Subscriber shall implement policies and procedures that govern the receipt and removal of hardware and electronic media that contain ePHI into and out of Subscriber's facilities, and the movement of these items within Subscriber's facilities, including secure disposal procedures.

C. Technical Safeguards

17.11 Multi-Factor Authentication Requirement. Subscriber shall enable and enforce multi-factor authentication ("MFA") for all user accounts that access the Platform. Acceptable MFA methods include time-based one-time passwords (TOTP), hardware security keys (FIDO2/WebAuthn), or push-based authentication through a verified mobile application. SMS-based one-time codes are strongly discouraged but not prohibited. Subscriber's failure to enable and enforce MFA shall constitute a material breach of this Agreement.

17.12 Encryption Requirements. Subscriber shall ensure that all ePHI transmitted to or from the Platform is encrypted in transit using Transport Layer Security (TLS) version 1.2 or higher, or equivalent encryption standard. Subscriber shall further ensure that any ePHI stored on Subscriber-controlled devices (including mobile devices, laptops, and portable media) is encrypted at rest using AES-256 or equivalent encryption standard.

17.13 Audit Controls. Subscriber shall implement hardware, software, and procedural mechanisms that record and examine activity in the Platform related to ePHI access. Subscriber shall regularly review audit logs (no less than monthly) for evidence of unauthorized access or anomalous activity and shall report any suspicious findings to Provider's Security Officer.

17.14 Integrity Controls. Subscriber shall implement policies and procedures to protect ePHI from improper alteration or destruction, including implementation of electronic mechanisms to corroborate that ePHI has not been altered or destroyed in an unauthorized manner.

17.15 Transmission Security. In addition to encryption requirements set forth in Section 17.12, Subscriber shall implement security measures to ensure that electronically transmitted ePHI is not improperly modified without detection until disposed of, and shall implement a mechanism to encrypt ePHI whenever deemed appropriate based on Subscriber's risk analysis.

Section 18. Minimum Necessary Standard

18.1 Application of Standard. Subscriber acknowledges that the HIPAA Minimum Necessary Standard (45 C.F.R. § 164.502(b)) requires that when using or disclosing PHI, or when requesting PHI from another covered entity or business associate, a covered entity must make reasonable efforts to limit PHI to the minimum necessary to accomplish the intended purpose of the use, disclosure, or request.

18.2 Role-Based Access Configuration. Subscriber shall configure the Platform's role-based access control features to limit each workforce member's access to only the PHI that is reasonably necessary for that workforce member to perform their assigned duties. Subscriber shall:

(a) Identify the persons or classes of persons in its workforce who require access to PHI to carry out their duties;

(b) For each person or class of persons, identify the category or categories of PHI to which access is needed and any conditions appropriate to such access;

(c) Configure the Platform's user roles, permissions, and access levels to reflect the determinations made in subsections (a) and (b);

(d) Review and update role-based access configurations no less than quarterly and upon any material change in workforce composition or duties; and

(e) Document all role-based access configurations and maintain such documentation for a minimum of six (6) years.

18.3 Limitation on PHI Access. Subscriber shall not grant any workforce member access to PHI fields, records, or datasets beyond what is reasonably necessary for that workforce member's job function. Granting blanket administrative access to all PHI within the Platform without documented justification shall be presumptively unreasonable for purposes of this Section.

18.4 Provider Not Responsible for Configuration. Provider is not responsible for configuring Subscriber's role-based access controls and shall have no liability arising from Subscriber's failure to properly configure or maintain Minimum Necessary Standard controls within the Platform.

Section 19. Breach Notification

19.1 Provider Notification Obligation. Upon confirming a Breach of Unsecured PHI (as defined in 45 C.F.R. § 164.402) that arises from Provider's systems or operations, Provider shall notify Subscriber without unreasonable delay and in no event later than seventy-two (72) hours after confirmation of the Breach. For purposes of this Section, a Breach is "confirmed" when Provider has completed a reasonable investigation and determined that an impermissible acquisition, access, use, or disclosure of PHI occurred and is not subject to any exception under 45 C.F.R. § 164.402(1).

19.2 Contents of Provider Notification. Provider's notification to Subscriber shall include, to the extent reasonably available at the time of notification:

(a) A description of the nature of the Breach, including the date(s) of the Breach and the date of discovery;

(b) A description of the types of PHI involved in the Breach (e.g., names, Social Security numbers, dates of birth, diagnoses, treatment information);

(c) The categories of individuals whose PHI was or is reasonably believed to have been affected;

(d) A description of the measures Provider has taken or proposes to take to investigate the Breach, mitigate harm, and prevent future occurrences;

(e) The estimated number of individuals affected, if known; and

(f) The identity of any third party who may have received or accessed the PHI as a result of the Breach, if known.

19.3 Supplemental Information. If Provider is unable to provide all information specified in Section 19.2 at the time of the initial notification, Provider shall provide such information in supplemental notifications as it becomes available, without unreasonable delay.

19.4 Subscriber's Downstream Notification Obligations. Subscriber is solely and exclusively responsible for all downstream breach notification obligations, including but not limited to:

(a) Individual notification to affected patients or clients as required by 45 C.F.R. § 164.404;

(b) Notification to the Secretary of the U.S. Department of Health and Human Services as required by 45 C.F.R. § 164.408;

(c) Media notification for breaches affecting five hundred (500) or more individuals in a single state or jurisdiction as required by 45 C.F.R. § 164.406;

(d) Any notification required under state breach notification laws, state health privacy laws, or other applicable law; and

(e) All costs and expenses associated with such notifications, including credit monitoring, identity theft protection, call center services, mailing costs, and regulatory fines or penalties.

19.5 Cooperation. Subscriber shall cooperate fully with Provider in the investigation of any suspected or confirmed Breach, including providing timely access to relevant information, systems, and personnel. Provider shall cooperate with Subscriber's reasonable requests for information necessary to fulfill Subscriber's notification obligations.

19.6 Mitigation. Upon learning of a Breach, each party shall take immediate steps within its respective control to mitigate, to the extent practicable, any harmful effect of the Breach.

19.7 Documentation. Provider shall maintain a log of all Breach notifications provided to Subscriber pursuant to this Section, and Subscriber shall maintain a log of all downstream notifications issued in connection with such Breaches, in each case for a minimum of six (6) years.

Section 20. AI Features and PHI Prohibition

20.1 Strict Prohibition. Subscriber shall not input, transmit, submit, or otherwise introduce any PHI into any artificial intelligence, machine learning, natural language processing, or automated decision-making feature of the Platform (collectively, "AI Features"). This prohibition applies to all AI Features, including but not limited to:

(a) AI-powered chatbots, virtual assistants, and conversational interfaces;

(b) Content generation tools (including email drafting, SMS composition, and social media content);

(c) Predictive analytics and lead scoring;

(d) Automated workflow triggers that process free-text input;

(e) Voice AI and call transcription features;

(f) Image or document analysis features; and

(g) Any future AI Feature added to the Platform, regardless of whether specifically enumerated herein.

20.2 Upstream Technology Restriction. Subscriber acknowledges that the prohibition set forth in Section 20.1 reflects a restriction imposed by the upstream technology provider and is not merely a contractual preference of Provider. The upstream technology provider's terms of service expressly prohibit the processing of PHI through AI Features, and violation of this prohibition may result in immediate termination of Provider's access to the upstream platform, thereby disrupting service to all of Provider's subscribers.

20.3 Material Breach. Any introduction of PHI into AI Features shall constitute a material breach of this Agreement. Upon discovery of such breach, Provider may, in its sole discretion and without liability:

(a) Immediately suspend Subscriber's access to all AI Features;

(b) Immediately suspend Subscriber's access to the entire Platform;

(c) Terminate this Agreement effective immediately upon written notice; and/or

(d) Pursue any and all remedies available at law or in equity, including recovery of damages caused by the upstream platform's response to the violation.

20.4 Workforce Training Obligation. Subscriber shall specifically train all workforce members who have access to the Platform regarding the prohibition on PHI in AI Features. Such training shall include clear examples of prohibited conduct, the consequences of violation, and procedures for de-identifying information prior to any use of AI Features. Subscriber shall document such training and make records available to Provider upon request.

20.5 AI Interaction Disclosure to Patients. Subscriber shall disclose to patients when AI-generated content is used in communications with such patients, including but not limited to AI-generated emails, text messages, chatbot responses, and appointment reminders. Such disclosure shall be clear, conspicuous, and provided in a manner that allows the patient to understand that the communication was generated or assisted by artificial intelligence rather than composed directly by a licensed healthcare provider.

20.6 De-Identification Safe Harbor. Notwithstanding the prohibition in Section 20.1, Subscriber may use AI Features with information that has been de-identified in accordance with 45 C.F.R. § 164.514(a)-(c), provided that Subscriber has documented its de-identification methodology and can demonstrate compliance with either the Expert Determination method (§ 164.514(b)(1)) or the Safe Harbor method (§ 164.514(b)(2)).

20.7 No Provider Monitoring Obligation. Provider is not obligated to monitor Subscriber's use of AI Features for compliance with this Section 20. However, Provider reserves the right to implement automated scanning or monitoring tools and to take immediate action upon detection of PHI in AI Feature inputs or outputs.

Section 21. State Telehealth and Scope-of-Practice Compliance

21.1 Sole Responsibility. Subscriber is solely and exclusively responsible for compliance with all applicable federal, state, and local laws, regulations, rules, and professional licensing requirements governing telehealth, telemedicine, remote patient monitoring, and the practice of nursing or advanced practice nursing, including but not limited to:

(a) State nurse practice acts and regulations governing Nurse Practitioners (NPs), Advanced Practice Registered Nurses (APRNs), and analogous licensure categories;

(b) State-specific telehealth practice requirements, including requirements for informed consent, patient-provider relationships, prescribing authority via telehealth, and in-person visit requirements;

(c) Interstate practice requirements, including any applicable nurse licensure compact (NLC/eNLC) provisions and restrictions;

(d) Collaborative practice agreement requirements in states requiring physician supervision or collaboration;

(e) State-specific prescribing rules for telehealth encounters, including DEA registration requirements and state-specific controlled substance prescribing restrictions via telehealth;

(f) Professional liability insurance requirements for telehealth practice;

(g) Corporate practice of medicine (or nursing) doctrine limitations applicable in Subscriber's jurisdiction(s); and

(h) Any emergency telehealth flexibilities and their expiration dates, waivers, or sunset provisions.

21.2 Multi-State Practice. If Subscriber provides telehealth services to patients located in states other than Subscriber's state of licensure, Subscriber is solely responsible for obtaining and maintaining all necessary licenses, permits, and authorizations required to practice in each such state. Provider makes no representation regarding the sufficiency of any license or compact membership for multi-state practice.

21.3 Platform Not Legal or Compliance Advice. The Platform's features, templates, workflows, and configurations do not constitute legal advice, compliance advice, or professional practice guidance. Subscriber shall not rely on the Platform's features or default settings as evidence of compliance with any telehealth or scope-of-practice requirement.

21.4 No Provider Liability. Provider shall have no liability whatsoever arising from Subscriber's violation of any telehealth, scope-of-practice, or professional licensing requirement. Subscriber shall indemnify, defend, and hold harmless Provider from and against any claim, action, proceeding, fine, penalty, or judgment arising from Subscriber's non-compliance with applicable telehealth or scope-of-practice laws or regulations.

21.5 Regulatory Change. Subscriber acknowledges that telehealth regulations are evolving rapidly across jurisdictions. Subscriber is solely responsible for monitoring regulatory changes and adjusting its use of the Platform accordingly. Provider may, but is not obligated to, provide informational notices regarding significant regulatory changes; any such notices do not constitute legal advice and do not modify Subscriber's independent compliance obligations.

PART V: DATA OWNERSHIP, PROCESSING, AND PRIVACY

Section 22. Subscriber Data Ownership

22.1 Subscriber Retains All Rights

As between Provider and Subscriber, Subscriber is and shall remain the sole and exclusive owner of all right, title, and interest in and to all Subscriber Data, including all intellectual property rights therein. Nothing in this Agreement shall be construed to transfer, assign, or convey any ownership interest in Subscriber Data from Subscriber to Provider. "Subscriber Data" means all data, information, content, records, files, communications, images, and materials that Subscriber or any Authorized User uploads, transmits, creates, stores, or otherwise makes available through the Platform in connection with Subscriber's use of the Services, including without limitation patient records, clinical documentation, appointment information, billing data, marketing materials, contact lists, form submissions, workflow configurations, and any data derived directly from the foregoing at Subscriber's direction.

22.2 Provider's Limited Processing License

Subscriber hereby grants to Provider a limited, non-exclusive, non-transferable, non-sublicensable (except as expressly provided in Section 23), revocable license to access, collect, use, process, store, transmit, and display Subscriber Data solely to the extent necessary to: (a) provide, operate, maintain, and improve the Services; (b) perform Provider's obligations under this Agreement; (c) comply with applicable law or valid legal process; and (d) generate Aggregated Data as set forth in Section 23.3. This license terminates automatically upon termination or expiration of this Agreement, subject to the data retention provisions set forth in Sections 25 and 26.

22.3 No Implied Rights

Provider acquires no right, title, or interest in Subscriber Data other than the limited license expressly granted in Section 22.2. Provider shall not access, use, or process Subscriber Data for any purpose other than as expressly authorized herein or as directed in writing by Subscriber.

22.4 Subscriber Representations

Subscriber represents and warrants that: (a) Subscriber has all necessary rights, authority, and consents to provide Subscriber Data to Provider and to grant the license set forth in Section 22.2; (b) the provision of Subscriber Data to Provider does not and will not violate any applicable law, rule, regulation, or third-party right; and (c) Subscriber has obtained all consents, authorizations, and permissions required under applicable law (including HIPAA, TCPA, CCPA/CPRA, and state privacy laws) in connection with the collection, use, and processing of Subscriber Data through the Platform.

Section 23. License to Process Subscriber Data

23.1 Purpose Limitation

Provider shall process Subscriber Data solely for the purpose of providing the Services to Subscriber in accordance with this Agreement, any applicable Order Form, and Subscriber's documented instructions. Provider shall not sell, rent, lease, disclose, or otherwise make Subscriber Data available to any third party except as expressly permitted in this Section 23 or as required by applicable law. For the avoidance of doubt, Provider does not "sell" or "share" (as those terms are defined under the California Consumer Privacy Act, as amended by the California Privacy Rights Act, Cal. Civ. Code §§ 1798.100 et seq.) Subscriber Data.

23.2 Sub-Processors

Subscriber acknowledges and agrees that Provider may engage sub-processors to assist in providing the Services, provided that: (a) Provider maintains a current list of sub-processors and makes such list available to Subscriber upon written request; (b) Provider enters into written agreements with each sub-processor imposing data protection obligations no less protective than those set forth in this Agreement; (c) Provider remains fully liable and responsible to Subscriber for the acts and omissions of its sub-processors to the same extent as if such acts or omissions were those of Provider; and (d) Provider notifies Subscriber of any intended addition or replacement of a sub-processor at least thirty (30) days in advance, during which period Subscriber may object in writing on reasonable data protection grounds.

Third-Party Platform Provider as Sub-Processor. Subscriber expressly acknowledges and agrees that the Third-Party Platform Provider (GoHighLevel, LLC, d/b/a HighLevel) is a sub-processor engaged by Provider to provide the underlying platform infrastructure upon which the Services are delivered. Subscriber Data processed through the Platform will be accessible to and processed by the Third-Party Platform Provider in accordance with such provider's terms of service, privacy policy, and data processing agreement. Provider shall use commercially reasonable efforts to ensure that the Third-Party Platform Provider maintains appropriate technical and organizational measures to protect Subscriber Data, but Subscriber acknowledges that Provider's ability to impose additional security requirements on the Third-Party Platform Provider may be limited by the terms of Provider's own agreement with such provider.

23.3 Aggregated and De-Identified Data

Notwithstanding any other provision of this Agreement, Provider may collect, compile, use, and disclose Aggregated Data for any lawful business purpose, including without limitation: (a) industry analysis, benchmarking, and research; (b) improvement and enhancement of the Services and development of new products and services; (c) creation of analytical reports and market intelligence; and (d) marketing and promotional purposes. "Aggregated Data" means data derived from Subscriber Data that has been aggregated with data from other subscribers and de-identified such that it: (i) cannot reasonably be used to identify Subscriber, any Authorized User, or any individual patient or data subject; (ii) does not constitute "protected health information" as defined under HIPAA; and (iii) does not constitute "personal information" or "personal data" as defined under any applicable privacy law. Provider shall employ industry-standard de-identification techniques consistent with the HIPAA Safe Harbor method (45 C.F.R. § 164.514(b)) or Expert Determination method (45 C.F.R. § 164.514(a)) when creating Aggregated Data from Subscriber Data that includes protected health information.

23.4 No Sale of Subscriber Data

Under no circumstances shall Provider sell Subscriber Data to any third party. Provider shall not use Subscriber Data for the purposes of targeted advertising directed at the individuals whose information is contained in the Subscriber Data. Provider shall not retain, use, or disclose Subscriber Data for any commercial purpose other than providing the Services as specified in this Agreement.

Section 24. Subscriber's Privacy Obligations

24.1 Subscriber's Privacy Policy

Subscriber shall at all times during the Term maintain and make publicly available (on Subscriber's website and within Subscriber's practice communications, as applicable) a comprehensive, accurate, and legally compliant privacy policy (the "Subscriber Privacy Policy") that: (a) accurately describes Subscriber's data collection, use, disclosure, and retention practices in connection with the Services; (b) discloses the use of third-party service providers, including Provider, in the processing of patient and consumer data; (c) provides notice of all data subject rights available under applicable law; (d) complies with all requirements of HIPAA, the TCPA, the CCPA/CPRA, and all other applicable federal, state, and local privacy and data protection laws; and (e) is kept current and updated to reflect changes in Subscriber's practices or applicable law.

24.2 Consent Obligations

Subscriber is solely responsible for obtaining all necessary consents, authorizations, and permissions from patients, consumers, and other individuals whose data is processed through the Platform, including without limitation:

(a) HIPAA Authorizations. To the extent Subscriber uses the Platform to process protected health information ("PHI") for purposes beyond treatment, payment, and health care operations (as defined under 45 C.F.R. § 164.501), Subscriber shall obtain valid written authorizations from patients in compliance with 45 C.F.R. § 164.508.

(b) TCPA Consent. Prior to using the Platform to send or initiate any text message, telephone call (including calls using an automatic telephone dialing system or prerecorded/artificial voice), or facsimile to any individual, Subscriber shall obtain prior express written consent in compliance with the Telephone Consumer Protection Act, 47 U.S.C. § 227, and its implementing regulations at 47 C.F.R. Part 64, including but not limited to the requirements for written consent set forth in 47 C.F.R. § 64.1200(f)(9).

(c) State Privacy Law Consents. Subscriber shall obtain all consents, provide all notices, and honor all opt-out rights required under applicable state privacy laws, including the California Consumer Privacy Act/California Privacy Rights Act (Cal. Civ. Code §§ 1798.100 et seq.), the Texas Data Privacy and Security Act (Tex. Bus. & Com. Code Ch. 541), the Virginia Consumer Data Protection Act (Va. Code §§ 59.1-575 et seq.), and any other applicable state privacy legislation.

(d) Marketing Consents. Subscriber shall obtain all required consents for email marketing communications in compliance with the CAN-SPAM Act (15 U.S.C. §§ 7701–7713) and applicable state anti-spam laws, including maintaining compliant unsubscribe mechanisms and honoring opt-out requests within the timeframes required by law.

24.3 Data Subject Rights Requests

Subscriber is solely responsible for receiving, evaluating, and responding to all requests from data subjects (including patients, consumers, and other individuals) to exercise their rights under applicable privacy laws, including rights of access, correction, deletion, portability, restriction of processing, opt-out of sale/sharing, and any other rights provided under HIPAA, CCPA/CPRA, TDPSA, or other applicable law. Provider shall, upon Subscriber's written request and at Subscriber's expense, provide reasonable cooperation and assistance to enable Subscriber to fulfill verified data subject rights requests, including by providing Subscriber with access to relevant Subscriber Data maintained on the Platform and implementing Subscriber-directed deletions within a commercially reasonable timeframe.

24.4 CCPA/CPRA Compliance

To the extent that the California Consumer Privacy Act, as amended by the California Privacy Rights Act (collectively, "CCPA"), applies to Subscriber's processing of personal information through the Platform, the parties agree that: (a) Provider acts as a "service provider" (as defined in Cal. Civ. Code § 1798.140(ag)) with respect to Subscriber Data constituting personal information of California consumers; (b) Provider shall not retain, use, or disclose such personal information for any purpose other than as set forth in this Agreement and as permitted for service providers under the CCPA; (c) Provider shall not combine such personal information with personal information received from other sources except as permitted by the CCPA; and (d) Provider certifies that it understands and shall comply with the restrictions set forth in this Section 24.4 and the CCPA.

24.5 Texas Data Privacy and Security Act Compliance

To the extent that the Texas Data Privacy and Security Act ("TDPSA"), Tex. Bus. & Com. Code Ch. 541, applies to Subscriber's processing of personal data through the Platform, the parties agree that: (a) Provider processes personal data on behalf of Subscriber as a "processor" (as defined in the TDPSA); (b) the nature and purpose of the processing, the type of personal data subject to processing, and the duration of processing are as described in this Agreement; (c) Provider shall assist Subscriber in meeting Subscriber's obligations under the TDPSA, including obligations relating to the security of processing and notification of data breaches; and (d) Provider shall make available to Subscriber all information necessary to demonstrate compliance with the TDPSA upon reasonable request.

24.6 Subscriber Indemnification for Privacy Failures

Subscriber shall indemnify, defend, and hold harmless Provider from and against any and all claims, damages, losses, liabilities, costs, and expenses (including reasonable attorneys' fees) arising from or relating to: (a) Subscriber's failure to maintain a compliant privacy policy; (b) Subscriber's failure to obtain required consents or authorizations; (c) Subscriber's failure to respond to data subject rights requests; or (d) any violation of applicable privacy or data protection law attributable to Subscriber's acts or omissions.

Section 25. Data Retention During Term

25.1 Standard Retention Practices

During the Term, Provider shall maintain Subscriber Data on the Platform in accordance with Provider's standard data retention practices, as updated from time to time. Provider shall employ commercially reasonable measures to ensure the availability, integrity, and security of Subscriber Data stored on the Platform, including regular backup procedures, redundant storage systems, and disaster recovery capabilities consistent with industry standards for cloud-based SaaS platforms.

25.2 Subscriber's Records Retention Obligations

Subscriber acknowledges and agrees that Subscriber is solely responsible for ensuring that Subscriber's use of the Platform and retention of data thereon complies with all applicable medical records retention laws and regulations, including without limitation: (a) state medical records retention requirements (which may require retention of adult patient records for periods ranging from five (5) to ten (10) years or longer from the date of last treatment, and pediatric records for specified periods beyond the age of majority); (b) federal requirements under Medicare and Medicaid program conditions of participation; (c) HIPAA requirements to retain documentation of policies, procedures, and compliance activities for six (6) years; and (d) any other applicable records retention requirements imposed by professional licensing boards, accreditation organizations, or contractual obligations.

25.3 Platform Is Not a Primary Clinical Records Repository

SUBSCRIBER EXPRESSLY ACKNOWLEDGES AND AGREES THAT THE PLATFORM IS NOT DESIGNED, INTENDED, OR WARRANTED TO SERVE AS A PRIMARY CLINICAL RECORDS REPOSITORY OR ELECTRONIC HEALTH RECORD ("EHR") SYSTEM. The Platform is a marketing, communication, workflow automation, and practice management tool. While certain clinical or patient-related information may be stored on the Platform in connection with Subscriber's use of the Services, Provider strongly recommends that Subscriber maintain a separate, certified Electronic Health Record (EHR) system as Subscriber's primary repository for clinical records, medical documentation, and patient health information. Subscriber assumes all risk associated with any decision to rely on the Platform as a primary repository for clinical records.

25.4 No Guaranteed Retention Period

While Provider intends to maintain Subscriber Data throughout the Term, Provider does not guarantee uninterrupted availability of historical data beyond Provider's standard retention periods as disclosed in Provider's then-current documentation. Subscriber is responsible for maintaining its own backups of critical data and shall not rely solely on the Platform for long-term records preservation.

Section 26. Data Retention and Deletion Post-Termination

26.1 Post-Termination Retrieval Period

Following the effective date of termination or expiration of this Agreement (the "Termination Date"), Provider shall maintain Subscriber Data on the Platform in a read-only, non-operational state for a period of thirty (30) calendar days (the "Retrieval Period"). During the Retrieval Period, Subscriber may access the Platform solely for the purpose of retrieving and exporting Subscriber Data using the export tools described in Section 27. Subscriber's access during the Retrieval Period shall be limited to data export functionality and shall not include access to operational features of the Services.

26.2 Permanent Deletion

Upon expiration of the Retrieval Period, Provider shall permanently and irreversibly delete all Subscriber Data from Provider's active production systems within thirty (30) calendar days. Such deletion shall be performed using industry-standard data sanitization methods that render the data unrecoverable through commercially available means. Provider shall provide written certification of deletion to Subscriber upon written request made within sixty (60) days following completion of deletion.

26.3 Backup Deletion

Provider shall delete all copies of Subscriber Data from Provider's backup, archival, and disaster recovery systems within ninety (90) calendar days following the expiration of the Retrieval Period (i.e., within one hundred twenty (120) calendar days following the Termination Date). Provider acknowledges that during the period between deletion from production systems and deletion from backup systems, any Subscriber Data remaining in backup systems shall continue to be protected in accordance with the security and confidentiality provisions of this Agreement and shall not be actively processed for any purpose other than backup system maintenance.

26.4 Exceptions for Legal Holds

Notwithstanding Sections 26.2 and 26.3, Provider may retain Subscriber Data (or specific portions thereof) beyond the timeframes set forth above to the extent retention is: (a) required by applicable law, regulation, or governmental order; (b) necessary to comply with a valid litigation hold, subpoena, or discovery obligation; (c) required for Provider to exercise or defend its legal rights under this Agreement (including collection of unpaid fees); or (d) required to comply with data retention obligations imposed by applicable regulatory authorities. Provider shall notify Subscriber in writing of any such retention (to the extent not prohibited by law) and shall limit such retention to the minimum scope and duration necessary to satisfy the applicable legal requirement. Upon expiration of the legal basis for retention, Provider shall promptly delete the retained data in accordance with Section 26.2.

26.5 Export Formats

During the Retrieval Period, Subscriber may export only contacts and customer data in CSV (comma-separated values) format through the Platform’s available export functionality. Export functionality is limited to contacts and customer data in CSV format; workflow configurations, automation settings, custom-built elements, and other data types are not available for export.

Section 27. Data Portability

27.1 Export Tools

Provider shall make available to Subscriber, through the Platform's administrative interface, self-service data export tools that enable Subscriber to export contacts and customer data in CSV format during the Term and during the Retrieval Period. Such export tools shall be accessible to Subscriber's administrative users without requiring assistance from Provider's support personnel for standard export operations.

27.2 Standard Machine-Readable Formats

The Platform’s standard export functionality is limited to contacts and customer data in CSV format. Workflow configurations, automation settings, custom-built elements, and other data types are not available for export through the standard functionality. No other standard export format or functionality is promised under this Agreement.

27.3 Data Subject Portability Requests

Subscriber is solely responsible for fulfilling data portability requests received from individual data subjects pursuant to applicable privacy laws (including Article 20 of the GDPR, Cal. Civ. Code § 1798.100(d), and analogous state privacy law provisions). Subscriber shall use the Platform's export tools to extract relevant contacts and customer data in CSV format, to the extent available through the Platform’s standard export functionality, and provide it to the requesting data subject in a structured, commonly used, and machine-readable format as required by applicable law. Subscriber remains responsible for addressing any request involving data not available through the Platform’s standard export functionality. Provider shall not be obligated to respond directly to data subject portability requests; however, Provider shall provide reasonable technical assistance to Subscriber to facilitate such requests through the Platform's standard export functionality.

27.4 Beyond-Standard Portability Assistance

In the event Subscriber requires data portability assistance beyond what is available through the Platform's standard self-service export tools (including without limitation custom data extraction, format conversion, API-based data transfer to third-party systems, or assistance with complex data migration projects), Provider may, at its sole discretion, provide such assistance subject to: (a) mutual written agreement on the scope of assistance; (b) payment by Subscriber at Provider's then-current professional services rates; and (c) a commercially reasonable timeline for completion. Provider shall not unreasonably withhold agreement to provide such beyond-standard assistance.

Section 28. Data Breach Notification

28.1 Provider's Notification Obligation

In the event Provider becomes aware of a confirmed Security Incident involving unauthorized access to, acquisition of, disclosure of, or loss of Subscriber Data (a "Data Breach"), Provider shall notify Subscriber of such Data Breach without unreasonable delay and in no event later than seventy-two (72) hours after Provider's confirmation of the Data Breach. For purposes of this Section 28, "confirmation" means the point at which Provider has a reasonable degree of certainty that a Security Incident involving Subscriber Data has occurred, as distinguished from a mere suspicion or unconfirmed report. Notification shall be provided via email to the administrative contact designated in Subscriber's account, with a follow-up notification via telephone if the Data Breach involves categories of data likely to result in a high risk to the rights and freedoms of individuals.

28.2 Content of Breach Notice

Provider's Data Breach notification shall include, to the extent reasonably available at the time of notification (with supplemental information provided on a rolling basis as it becomes available):

(a) A description of the nature of the Data Breach, including the categories and approximate number of data subjects affected and the categories and approximate number of records concerned;

(b) The date and time of the Data Breach (or best estimate thereof) and the date of Provider's discovery;

(c) A description of the categories of Subscriber Data affected (e.g., names, contact information, health information, financial data);

(d) A description of the likely consequences of the Data Breach;

(e) A description of the measures taken or proposed to be taken by Provider to address the Data Breach, including measures to mitigate its adverse effects;

(f) The identity of any third parties known or reasonably believed to have accessed the affected data;

(g) The name and contact details of Provider's designated point of contact for further information; and

(h) Recommendations for steps Subscriber may take to mitigate potential harm to affected individuals.

28.3 Subscriber's Downstream Notification Responsibility

Subscriber is solely and exclusively responsible for: (a) determining whether the Data Breach triggers notification obligations to affected individuals, regulatory authorities, or other third parties under applicable law (including HIPAA breach notification requirements at 45 C.F.R. §§ 164.404–164.410, state data breach notification statutes, and GDPR Articles 33–34); (b) preparing and issuing all required breach notifications in compliance with applicable law; (c) providing any required credit monitoring or identity protection services to affected individuals; and (d) managing all communications with affected individuals, regulatory authorities, media, and other stakeholders. Provider shall not issue any notification to Subscriber's patients, customers, or other data subjects, or to any regulatory authority on Subscriber's behalf, without Subscriber's prior written authorization, except as required by law with respect to Provider's own independent notification obligations.

28.4 Cooperation

Following a Data Breach, Provider shall: (a) cooperate fully with Subscriber's investigation of the Data Breach, including providing timely access to relevant logs, records, and personnel; (b) take immediate steps to contain the Data Breach and prevent further unauthorized access; (c) preserve all evidence relating to the Data Breach in accordance with industry-standard forensic practices; (d) implement reasonable corrective measures to prevent recurrence of similar breaches; and (e) provide Subscriber with updates regarding the status of Provider's investigation and remediation efforts at reasonable intervals until the matter is resolved. Provider shall not take any action that would compromise the integrity of evidence or impair Subscriber's ability to investigate the Data Breach or comply with its legal obligations.

28.5 Third-Party Platform Provider Breaches

In the event a Data Breach originates from or is caused by the Third-Party Platform Provider's systems, Provider shall: (a) notify Subscriber as set forth in Section 28.1 upon receiving notice from the Third-Party Platform Provider; (b) use commercially reasonable efforts to obtain detailed breach information from the Third-Party Platform Provider for inclusion in the notice required by Section 28.2; (c) cooperate with Subscriber to the extent feasible given Provider's level of access to the Third-Party Platform Provider's systems and information; and (d) advocate on Subscriber's behalf in seeking remediation from the Third-Party Platform Provider. Subscriber acknowledges that Provider's ability to investigate and remediate breaches originating in the Third-Party Platform Provider's infrastructure may be limited.

Section 29. Data Processing Agreement

29.1 GDPR/UK GDPR Data Processing Agreement

To the extent that: (a) Subscriber processes personal data of data subjects located in the European Economic Area ("EEA") or the United Kingdom ("UK") through the Platform; and (b) such processing is subject to the General Data Protection Regulation (Regulation (EU) 2016/679) ("GDPR") or the UK General Data Protection Regulation (as defined in the Data Protection Act 2018) ("UK GDPR"), the parties shall enter into a Data Processing Agreement ("DPA") incorporating the terms required by Article 28 of the GDPR/UK GDPR. Such DPA shall be substantially in the form attached hereto as Exhibit [__] or, if no exhibit is attached, shall be executed as a separate document within thirty (30) days of Subscriber's written request. The DPA shall include, at a minimum: (i) the subject matter and duration of processing; (ii) the nature and purpose of processing; (iii) the types of personal data processed; (iv) the categories of data subjects; (v) the obligations and rights of the controller; and (vi) the obligations of the processor as required by Article 28(3) of the GDPR.

29.2 Standard Contractual Clauses

To the extent that the processing of personal data under this Agreement involves transfers of personal data from the EEA or UK to jurisdictions that have not received an adequacy determination from the European Commission or the UK Secretary of State (as applicable), the parties agree to enter into the Standard Contractual Clauses (as approved by European Commission Implementing Decision (EU) 2021/914) or the UK International Data Transfer Agreement/Addendum (as applicable) as a transfer mechanism to ensure an adequate level of protection for such data. The applicable module(s) and annexes shall be completed and incorporated by reference into the DPA.

29.3 CCPA/State Privacy Law Contractual Provisions

The provisions set forth in Section 24.4 (CCPA/CPRA Compliance) and Section 24.5 (TDPSA Compliance) of this Agreement constitute the contractual provisions required under applicable state privacy laws governing the relationship between a business/controller and a service provider/processor. These provisions, together with the other data protection obligations set forth in this Part V, satisfy the requirements of: (a) Cal. Civ. Code § 1798.100(d) requiring written contracts with service providers; (b) Tex. Bus. & Com. Code § 541.054 requiring contracts between controllers and processors; (c) Va. Code § 59.1-579 requiring contracts between controllers and processors; and (d) analogous requirements under other applicable state privacy laws. To the extent any applicable state privacy law requires additional or different contractual provisions, the parties shall negotiate in good faith to amend this Agreement or enter into supplemental agreements to ensure compliance.

29.4 Sub-Processor Obligations

Any DPA entered into pursuant to this Section 29 shall address the engagement of sub-processors in accordance with Section 23.2, including: (a) the requirement for prior specific or general written authorization from Subscriber for the engagement of sub-processors; (b) the obligation to impose on sub-processors data protection obligations no less protective than those set forth in the DPA; (c) Provider's ongoing liability for the acts and omissions of its sub-processors; and (d) the procedure for notifying Subscriber of intended changes to sub-processors and Subscriber's right to object to such changes. The current list of sub-processors, including the Third-Party Platform Provider, shall be set forth in an annex to the DPA and updated in accordance with the notification procedures described therein.

29.5 Audit Rights

Subject to reasonable confidentiality restrictions and upon at least thirty (30) days' prior written notice, Subscriber (or its authorized third-party auditor bound by appropriate confidentiality obligations) may conduct an audit of Provider's data processing activities to verify compliance with this Part V and any applicable DPA, no more than once per twelve (12) month period (unless a Data Breach has occurred or a regulatory authority requires an audit, in which case additional audits may be conducted as reasonably necessary). Such audit shall be conducted during normal business hours, shall not unreasonably interfere with Provider's operations, and shall be at Subscriber's sole expense. Provider may satisfy audit requests by providing: (a) relevant third-party audit reports (such as SOC 2 Type II reports); (b) certifications from qualified independent assessors; or (c) responses to reasonable written audit questionnaires, in each case in lieu of on-site inspections where such alternatives reasonably address Subscriber's audit objectives.

PART VI

CONFIDENTIALITY

Section 30. Confidentiality Obligations

30.1 Mutual Confidentiality

Each Party (as "Disclosing Party") may disclose to the other Party (as "Receiving Party") certain non-public, proprietary, or confidential information in connection with this Agreement. The Parties acknowledge that in the course of performing their respective obligations under this Agreement, each Party may have access to Confidential Information of the other Party.

30.2 Definition of Confidential Information

"Confidential Information" means any and all information or data, in any form or medium (whether oral, written, electronic, or visual), that is disclosed by or on behalf of the Disclosing Party to the Receiving Party, whether before or after the Effective Date, that: (a) is designated as "confidential," "proprietary," or with a similar legend at the time of disclosure; (b) is disclosed orally and identified as confidential at the time of disclosure and confirmed in writing within thirty (30) days thereafter; or (c) by its nature or the circumstances of disclosure, would reasonably be understood to be confidential.

Without limiting the foregoing, Confidential Information includes: (i) the Platform's source code, algorithms, architecture, APIs, documentation, and technical specifications; (ii) business plans, pricing, financial information, customer lists, and marketing strategies; (iii) trade secrets, know-how, inventions, and intellectual property; (iv) the terms and conditions of this Agreement (including pricing and fee structures); (v) Protected Health Information as defined under HIPAA; and (vi) any information derived from or relating to the foregoing.

30.3 Exclusions from Confidential Information

Confidential Information does not include information that the Receiving Party can demonstrate by competent evidence:

(a) Was publicly available at the time of disclosure or becomes publicly available thereafter through no fault, act, or omission of the Receiving Party;

(b) Was independently developed by the Receiving Party without use of or reference to the Disclosing Party's Confidential Information, as evidenced by contemporaneous written records;

(c) Was lawfully received by the Receiving Party from a third party without restriction on disclosure and without breach of any obligation of confidentiality owed to the Disclosing Party;

(d) Was already known to the Receiving Party at the time of disclosure, as evidenced by written records predating such disclosure; or

(e) Was approved for release or disclosure by the Disclosing Party in writing.

30.4 Non-Disclosure Obligations

The Receiving Party shall: (a) hold all Confidential Information of the Disclosing Party in strict confidence; (b) not disclose, publish, or otherwise disseminate any Confidential Information to any third party except as expressly permitted under this Agreement; (c) use the Confidential Information solely for the purpose of exercising its rights or performing its obligations under this Agreement; (d) protect the Confidential Information using at least the same degree of care it uses to protect its own confidential information of a similar nature, but in no event less than a reasonable standard of care; and (e) limit access to Confidential Information to those employees, contractors, and agents who have a need to know such information and who are bound by written confidentiality obligations no less restrictive than those contained herein.

30.5 Permitted Disclosures

Notwithstanding Section 30.4, the Receiving Party may disclose Confidential Information:

(a) Legal Compulsion. To the extent required by applicable law, regulation, court order, subpoena, or governmental order, provided that the Receiving Party shall: (i) provide the Disclosing Party with prompt written notice of such requirement (to the extent legally permissible) so that the Disclosing Party may seek a protective order or other appropriate remedy; (ii) cooperate with the Disclosing Party's reasonable efforts to resist or narrow the scope of such disclosure; and (iii) disclose only that portion of the Confidential Information that is legally required to be disclosed.

(b) Professional Advisors. To the Receiving Party's attorneys, accountants, financial advisors, and other professional advisors who are bound by professional duties of confidentiality, solely to the extent necessary for such advisors to provide services to the Receiving Party in connection with this Agreement.

30.6 Survival of Confidentiality Obligations

The confidentiality obligations of Subscriber under this Section 30 with respect to Provider’s Confidential Information shall survive the expiration or termination of this Agreement for five (5) years following the date of such expiration or termination. Provider’s confidentiality obligations with respect to Subscriber’s Confidential Information shall terminate upon expiration or termination of this Agreement. Notwithstanding the foregoing, the obligations of both Parties with respect to Confidential Information that constitutes a trade secret under applicable law shall survive for so long as such information remains a trade secret, which may be indefinitely.

30.7 Return or Destruction Upon Termination

Upon the expiration or termination of this Agreement, or upon the Disclosing Party's earlier written request, the Receiving Party shall, at the Disclosing Party's election: (a) promptly return to the Disclosing Party all tangible materials containing or embodying Confidential Information; or (b) destroy all copies of Confidential Information in the Receiving Party's possession or control, including any electronic copies stored on servers, backup systems, or other media. The Receiving Party shall certify in writing within thirty (30) days of such request that it has complied with this Section 30.7.

Notwithstanding the foregoing, the Receiving Party may retain: (i) one (1) archival copy of Confidential Information solely for purposes of compliance with legal or regulatory requirements and dispute resolution, subject to the continuing confidentiality obligations of this Agreement; and (ii) copies of Confidential Information contained in routine electronic backup systems, provided that such copies shall be destroyed in the ordinary course of the Receiving Party's backup rotation schedule and shall remain subject to the confidentiality obligations herein until destroyed.

PART VII

DISCLAIMERS, LIABILITY, AND INDEMNIFICATION

Section 31. Disclaimer of Warranties

31.1 AS-IS / AS-AVAILABLE

EXCEPT AS EXPRESSLY SET FORTH IN THIS AGREEMENT, THE PLATFORM AND ALL SERVICES, FEATURES, CONTENT, FUNCTIONALITY, AI FEATURES, INTEGRATIONS, AND MATERIALS PROVIDED HEREUNDER ARE PROVIDED ON AN "AS IS" AND "AS AVAILABLE" BASIS, WITHOUT WARRANTY OF ANY KIND, WHETHER EXPRESS, IMPLIED, STATUTORY, OR OTHERWISE. PROVIDER HEREBY DISCLAIMS ALL WARRANTIES, INCLUDING WITHOUT LIMITATION ANY IMPLIED WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, TITLE, NON-INFRINGEMENT, ACCURACY, RELIABILITY, COMPLETENESS, QUIET ENJOYMENT, AND ANY WARRANTIES ARISING OUT OF COURSE OF DEALING, USAGE, OR TRADE PRACTICE.

31.2 No Warranty of Uninterrupted Service

PROVIDER DOES NOT WARRANT THAT THE PLATFORM WILL BE UNINTERRUPTED, TIMELY, SECURE, OR ERROR-FREE, THAT DEFECTS WILL BE CORRECTED, THAT THE PLATFORM OR THE SERVERS THAT MAKE THE PLATFORM AVAILABLE ARE FREE OF VIRUSES OR OTHER HARMFUL COMPONENTS, OR THAT THE PLATFORM WILL MEET SUBSCRIBER'S REQUIREMENTS OR EXPECTATIONS. ANY CONTENT, MATERIALS, OR INFORMATION DOWNLOADED OR OTHERWISE OBTAINED THROUGH THE USE OF THE PLATFORM IS ACCESSED AT SUBSCRIBER'S OWN DISCRETION AND RISK.

31.3 No Warranty of Regulatory Compliance

PROVIDER DOES NOT WARRANT THAT THE PLATFORM, IN AND OF ITSELF, WILL ENSURE SUBSCRIBER'S COMPLIANCE WITH ANY APPLICABLE LAW, REGULATION, OR INDUSTRY STANDARD, INCLUDING WITHOUT LIMITATION HIPAA, HITECH, THE FTC ACT, TCPA, CAN-SPAM, STATE TELEHEALTH LAWS, NURSE PRACTICE ACTS, STATE DATA PRIVACY LAWS, OR ANY OTHER HEALTHCARE OR DATA PROTECTION REGULATION. SUBSCRIBER IS SOLELY RESPONSIBLE FOR ENSURING THAT ITS USE OF THE PLATFORM COMPLIES WITH ALL APPLICABLE LAWS AND PROFESSIONAL LICENSING REQUIREMENTS. PROVIDER'S PROVISION OF HIPAA-COMPLIANT INFRASTRUCTURE DOES NOT CONSTITUTE A GUARANTEE THAT SUBSCRIBER'S SPECIFIC USE CASE, WORKFLOWS, OR CONFIGURATIONS WILL ACHIEVE OR MAINTAIN REGULATORY COMPLIANCE.

31.4 No Warranty Regarding AI Accuracy

PROVIDER MAKES NO WARRANTY, REPRESENTATION, OR GUARANTEE REGARDING THE ACCURACY, COMPLETENESS, RELIABILITY, SUITABILITY, OR TIMELINESS OF ANY OUTPUT, RECOMMENDATION, SUGGESTION, CONTENT, OR ANALYSIS GENERATED BY ANY ARTIFICIAL INTELLIGENCE, MACHINE LEARNING, NATURAL LANGUAGE PROCESSING, OR OTHER AUTOMATED FEATURES OF THE PLATFORM (COLLECTIVELY, "AI OUTPUTS"). AI OUTPUTS ARE PROVIDED FOR INFORMATIONAL AND ASSISTIVE PURPOSES ONLY AND DO NOT CONSTITUTE MEDICAL ADVICE, CLINICAL GUIDANCE, DIAGNOSIS, OR TREATMENT RECOMMENDATIONS. SUBSCRIBER ACKNOWLEDGES THAT AI OUTPUTS MAY CONTAIN ERRORS, INACCURACIES, HALLUCINATIONS, OR BIASES, AND SUBSCRIBER ASSUMES ALL RISK ASSOCIATED WITH ANY RELIANCE ON SUCH OUTPUTS. SUBSCRIBER SHALL EXERCISE INDEPENDENT PROFESSIONAL JUDGMENT IN ALL CLINICAL AND BUSINESS DECISIONS AND SHALL NOT RELY ON AI OUTPUTS AS A SUBSTITUTE FOR QUALIFIED PROFESSIONAL ADVICE.

31.5 No Warranty Regarding Third-Party Services

PROVIDER MAKES NO WARRANTY REGARDING ANY THIRD-PARTY SERVICES, INTEGRATIONS, APPLICATIONS, PAYMENT PROCESSORS, TELEPHONY PROVIDERS, SMS CARRIERS, EMAIL DELIVERY SERVICES, OR OTHER THIRD-PARTY COMPONENTS THAT INTERACT WITH OR ARE ACCESSIBLE THROUGH THE PLATFORM. THE AVAILABILITY, ACCURACY, PERFORMANCE, AND FUNCTIONALITY OF SUCH THIRD-PARTY SERVICES ARE BEYOND PROVIDER'S CONTROL, AND SUBSCRIBER'S USE THEREOF IS AT SUBSCRIBER'S SOLE RISK AND SUBJECT TO THE APPLICABLE THIRD PARTY'S TERMS OF SERVICE.

31.6 Platform Is Not a Medical Device

THE PLATFORM IS NOT A MEDICAL DEVICE, CLINICAL DECISION SUPPORT SYSTEM, OR ELECTRONIC HEALTH RECORD SYSTEM AS DEFINED UNDER APPLICABLE LAW. THE PLATFORM HAS NOT BEEN CLEARED, APPROVED, OR CERTIFIED BY THE U.S. FOOD AND DRUG ADMINISTRATION OR ANY OTHER REGULATORY AUTHORITY FOR USE AS A MEDICAL DEVICE OR FOR ANY CLINICAL, DIAGNOSTIC, OR THERAPEUTIC PURPOSE. THE PLATFORM IS A BUSINESS OPERATIONS AND MARKETING AUTOMATION TOOL AND SHALL NOT BE USED AS A SUBSTITUTE FOR PROFESSIONAL MEDICAL JUDGMENT, CERTIFIED EHR TECHNOLOGY, OR FDA-CLEARED MEDICAL DEVICES.

31.7 Incorporation of Terms of Service Disclaimers

In addition to the disclaimers set forth in this Section 31, the warranty disclaimers contained in the Terms of Service (as defined in Section 2 of this Agreement) are hereby incorporated by reference as if fully set forth herein. To the extent of any conflict between the warranty disclaimers in this Agreement and those in the Terms of Service, the more protective (to Provider) disclaimer shall control.

Section 32. Limitation of Liability

32.1 Exclusion of Consequential Damages

TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW, IN NO EVENT SHALL EITHER PARTY BE LIABLE TO THE OTHER PARTY OR TO ANY THIRD PARTY FOR ANY INDIRECT, INCIDENTAL, SPECIAL, CONSEQUENTIAL, PUNITIVE, OR EXEMPLARY DAMAGES, INCLUDING WITHOUT LIMITATION DAMAGES FOR LOSS OF PROFITS, LOSS OF REVENUE, LOSS OF BUSINESS, LOSS OF GOODWILL, LOSS OF DATA, LOSS OF PATIENTS, COST OF PROCUREMENT OF SUBSTITUTE SERVICES, BUSINESS INTERRUPTION, OR ANY OTHER COMMERCIAL DAMAGES OR LOSSES, ARISING OUT OF OR RELATING TO THIS AGREEMENT, HOWEVER CAUSED AND UNDER ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, TORT (INCLUDING NEGLIGENCE), STRICT LIABILITY, OR OTHERWISE, EVEN IF SUCH PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES AND EVEN IF A LIMITED REMEDY SET FORTH HEREIN IS FOUND TO HAVE FAILED OF ITS ESSENTIAL PURPOSE.

32.2 Aggregate Liability Cap

Subject to Section 32.4 (Carve-Outs), the total aggregate liability of Provider arising out of or relating to this Agreement, whether in contract, tort (including negligence), strict liability, or any other legal or equitable theory, shall not exceed the total amount of Fees actually paid by Subscriber to Provider during the three (3) month period immediately preceding the event giving rise to the claim (the "Liability Cap").

32.3 Cap for Non-Paying Users

Notwithstanding Section 32.2, if Subscriber is utilizing the Platform under a free trial, free tier, promotional period, or otherwise has not paid any Fees to Provider during the twelve (12) month period preceding the event giving rise to the claim, Provider's total aggregate liability to such Subscriber shall not exceed One Hundred United States Dollars ($100.00 USD).

32.4 Carve-Outs from Liability Cap

The limitations set forth in Sections 32.1 and 32.2 shall not apply to liability arising from:

(a) A Party's gross negligence or willful misconduct;

(b) A Party's intentional breach of its confidentiality obligations with respect to Protected Health Information, including any intentional unauthorized access, use, or disclosure of PHI in violation of the BAA;

(c) A Party's infringement or misappropriation of the other Party's intellectual property rights;

(d) Fraud, intentional misrepresentation, or criminal conduct by a Party;

(e) Subscriber's indemnification obligations under Section 33 of this Agreement; and

(f) Either Party's obligations to pay amounts due under this Agreement (including, for Subscriber, all Fees, penalties, and other amounts owed to Provider).

32.5 Essential Basis of the Bargain

Subscriber acknowledges and agrees that Provider has set its prices and entered into this Agreement in reliance upon the limitations of liability and the disclaimers of warranties and damages set forth herein, and that the same form an essential basis of the bargain between the Parties. The Parties agree that the limitations and exclusions of liability and disclaimers specified in this Agreement allocate the risks between the Parties as contemplated by the Parties, and the Parties would not have entered into this Agreement without such limitations, exclusions, and disclaimers.

32.6 Multiple Claims; Aggregation

The existence of one or more claims by Subscriber shall not enlarge or extend the Liability Cap. Subscriber agrees that all claims arising under or relating to this Agreement shall be aggregated together for purposes of the Liability Cap, and the Liability Cap constitutes the maximum total liability of Provider regardless of the number of claims, causes of action, or theories of recovery asserted by Subscriber. For the avoidance of doubt, the Liability Cap applies to all claims arising under this Agreement in the aggregate and is not applied on a per-claim, per-incident, or per-annum basis.

Section 33. Subscriber Indemnification

33.1 Subscriber Indemnification Obligations

Subscriber shall defend, indemnify, and hold harmless Provider, its parent companies, affiliates, subsidiaries, officers, directors, employees, agents, successors, and assigns (collectively, "Provider Indemnitees") from and against any and all claims, actions, suits, proceedings, losses, damages, liabilities, judgments, costs, and expenses (including reasonable attorneys' fees and costs of litigation) (collectively, "Losses") arising out of or relating to any of the following:

(a) Breach of Agreement. Any breach by Subscriber of any representation, warranty, covenant, or obligation under this Agreement, including without limitation the Terms of Service, Acceptable Use Policy, BAA, or any Order Form;

(b) Violation of Law. Any violation by Subscriber or its Authorized Users of any applicable federal, state, or local law, rule, or regulation in connection with Subscriber's use of the Platform, including without limitation the Health Insurance Portability and Accountability Act (HIPAA), the Health Information Technology for Economic and Clinical Health Act (HITECH), the Telephone Consumer Protection Act (TCPA), the Controlling the Assault of Non-Solicited Pornography and Marketing Act (CAN-SPAM), the Federal Trade Commission Act (FTC Act), state consumer protection statutes, state telehealth practice laws, state nurse practice acts, state data privacy and breach notification laws, and any other healthcare, telecommunications, or data protection regulation;

(c) Misuse of Platform. Any use of the Platform by Subscriber or its Authorized Users that exceeds the scope of the license granted herein, violates the Acceptable Use Policy, or constitutes an unauthorized, unlawful, or tortious use, including without limitation using the Platform to practice medicine without appropriate licensure, providing clinical services outside the scope of Subscriber's professional license, or operating in jurisdictions where Subscriber is not licensed;

(d) HIPAA Violations and PHI Breaches. Any unauthorized access, use, disclosure, or breach of Protected Health Information caused by or attributable to Subscriber's acts or omissions, including without limitation failure to implement required administrative, physical, or technical safeguards, failure to train workforce members, failure to obtain required patient authorizations, failure to provide required breach notifications, or any HIPAA violation arising from Subscriber's configuration of the Platform, Subscriber's workflows, or Subscriber's selection of non-compliant third-party applications;

(e) TCPA Violations. Any claim arising from Subscriber's use of the Platform's messaging, calling, or communication features in violation of the TCPA or analogous state laws, including without limitation sending text messages or making calls without prior express written consent, failing to honor opt-out requests, using artificial or prerecorded voices without consent, calling numbers on the National Do Not Call Registry, or exceeding the scope of consent obtained from message recipients;

(f) Patient and End-User Claims. Any claim, demand, or cause of action brought by a patient, client, consumer, end user, or any other third party arising from or relating to: (i) Subscriber's provision of healthcare services (or failure to provide such services); (ii) Subscriber's clinical judgment, diagnosis, treatment, or referral decisions; (iii) medical malpractice, negligence, or professional misconduct by Subscriber; (iv) adverse patient outcomes; (v) any content, advice, or communications disseminated by Subscriber through the Platform; or (vi) interactions between Subscriber (or its staff) and patients facilitated through the Platform;

(g) Data Breaches Caused by Subscriber. Any data breach, security incident, or unauthorized access to Subscriber Data or patient information caused by or attributable to: (i) Subscriber's failure to maintain adequate security measures (including strong passwords, multi-factor authentication, and access controls); (ii) Subscriber's sharing of login credentials; (iii) Subscriber's use of unsecured networks or devices; (iv) Subscriber's failure to timely update or patch systems within Subscriber's control; or (v) any act or omission of Subscriber's employees, contractors, agents, or Authorized Users;

(h) Tax Claims. Any claim by any governmental authority for unpaid taxes, fees, assessments, or penalties arising from Subscriber's business operations, including without limitation income taxes, employment taxes, sales taxes, use taxes, or any taxes that Subscriber is obligated to collect or remit in connection with its provision of healthcare or other professional services through the Platform;

(i) Third-Party Intellectual Property and Privacy Rights. Any claim that Subscriber Content, Subscriber Data, Subscriber's trademarks, Subscriber's marketing materials, or any materials uploaded, submitted, or transmitted by Subscriber through the Platform infringe, misappropriate, or otherwise violate any third party's intellectual property rights (including patents, copyrights, trademarks, and trade secrets), rights of publicity, rights of privacy, or other proprietary rights;

(j) AI Feature Claims. Any claim arising from Subscriber's use of, reliance upon, or dissemination of AI Outputs generated by the Platform's AI Features, including without limitation claims arising from: (i) clinical decisions influenced by AI Outputs; (ii) patient harm or adverse outcomes resulting from reliance on AI Outputs; (iii) inaccurate, incomplete, or misleading AI-generated content distributed to patients or third parties; (iv) Subscriber's failure to review, verify, or override AI Outputs as required by this Agreement; or (v) Subscriber's representation to patients or third parties that AI Outputs constitute professional medical advice.

33.2 Scope of Subscriber Indemnification

The indemnification obligations set forth in this Section 33 shall apply regardless of whether the Losses arise in whole or in part from the negligence (but not the gross negligence or willful misconduct) of Provider, and shall survive the expiration or termination of this Agreement with respect to claims arising from acts or omissions occurring during the Term.

Section 34. Provider Indemnification

34.1 Provider Indemnification Obligations

Provider shall defend, indemnify, and hold harmless Subscriber from and against any Losses arising out of any third-party claim that Subscriber's authorized use of the Platform (excluding Subscriber Content and Third-Party Services) in accordance with this Agreement directly infringes any issued United States patent, registered United States copyright, registered United States trademark, or misappropriates any third party's trade secrets (an "IP Claim").

34.2 Carve-Outs from Provider Indemnification

Provider shall have no obligation under Section 34.1 with respect to any IP Claim to the extent arising from or attributable to:

(a) Modifications made to the Platform by Subscriber or any third party acting at Subscriber's direction, where the infringement would not have occurred but for such modification;

(b) The combination, operation, or use of the Platform with any software, hardware, data, systems, or materials not provided, specified, or approved by Provider, where the infringement would not have occurred but for such combination;

(c) Subscriber Content, Subscriber Data, or any materials provided by Subscriber that are incorporated into or used with the Platform;

(d) Subscriber's continued use of the Platform (or any infringing component thereof) after Provider has provided Subscriber with a non-infringing replacement, modification, or alternative, or after Provider has notified Subscriber that continued use may constitute infringement;

(e) Subscriber's use of the Platform in a manner not authorized by this Agreement or in violation of the documentation provided by Provider;

(f) Any version of the Platform other than the then-current release, where the infringement would have been avoided by use of the current release; or

(g) Open-source software components identified in the Platform's documentation and licensed to Subscriber under separate open-source license terms.

34.3 Additional Provider Indemnification

Provider shall additionally indemnify Subscriber from and against any Losses arising out of third-party claims directly resulting from Provider's gross negligence or willful misconduct in the performance of its obligations under this Agreement, including without limitation the grossly negligent or intentional breach of Provider's security obligations with respect to the Platform infrastructure.

34.4 Subject to Liability Cap

Provider's aggregate indemnification obligations under this Section 34 shall be subject to the Liability Cap set forth in Section 32.2 of this Agreement, except to the extent the underlying claim falls within the carve-outs specified in Section 32.4.

Section 35. Indemnification Procedures

35.1 Prompt Notice

A Party seeking indemnification ("Indemnified Party") shall promptly notify the indemnifying party ("Indemnifying Party") in writing of any claim, action, or proceeding for which indemnification is sought (a "Claim Notice"). The Claim Notice shall describe the claim in reasonable detail and include copies of all relevant documentation. Failure to provide prompt notice shall not relieve the Indemnifying Party of its indemnification obligations except to the extent that the Indemnifying Party is materially prejudiced by such delay.

35.2 Control of Defense

The Indemnifying Party shall have the right, at its sole option and expense, to assume exclusive control of the defense and settlement of any claim for which indemnification is sought, using counsel of its own choosing (which counsel shall be reasonably acceptable to the Indemnified Party). Upon the Indemnifying Party's assumption of defense, the Indemnified Party shall have the right to participate in the defense at its own expense with counsel of its own choosing; provided that the Indemnifying Party shall retain sole control over all strategic decisions, including the selection of counsel, the conduct of discovery, the filing of motions, and the strategy of defense. If the Indemnifying Party fails to assume the defense within thirty (30) days of receiving the Claim Notice, the Indemnified Party may assume control of the defense at the Indemnifying Party's expense.

35.3 Cooperation

The Indemnified Party shall provide reasonable cooperation to the Indemnifying Party in the defense of any claim, including making available relevant documents, records, and personnel as witnesses, at the Indemnifying Party's expense (excluding the Indemnified Party's internal costs of making personnel available, unless otherwise agreed). The Indemnified Party shall not make any admission of liability or take any action that would prejudice the defense of any claim without the Indemnifying Party's prior written consent.

35.4 Settlement Restrictions

The Indemnifying Party shall not settle, compromise, or consent to the entry of any judgment with respect to any claim without the Indemnified Party's prior written consent (which consent shall not be unreasonably withheld, conditioned, or delayed), unless such settlement: (a) involves only the payment of monetary damages by the Indemnifying Party; (b) does not require any admission of liability or wrongdoing by the Indemnified Party; (c) includes an unconditional release of the Indemnified Party from all claims and liabilities related to the subject matter of the claim; and (d) does not impose any restriction, injunction, or obligation on the Indemnified Party.

35.5 Sole Remedy for IP Claims

In the event that the Platform (or any component thereof) is held to constitute, or in Provider's reasonable opinion is likely to constitute, an infringement of any third party's intellectual property rights, Provider may, at its sole option and expense:

(a) Procure for Subscriber the right to continue using the Platform (or the affected component) without infringement;

(b) Modify or replace the Platform (or the affected component) to make it non-infringing, provided that such modification or replacement does not materially diminish the functionality of the Platform; or

(c) If neither (a) nor (b) is commercially practicable, terminate this Agreement (or the affected component thereof) upon thirty (30) days' written notice to Subscriber and refund to Subscriber a pro-rata portion of any prepaid Fees attributable to the terminated period of service following the effective date of termination.

The remedies set forth in this Section 35.5 shall constitute Subscriber's sole and exclusive remedy, and Provider's entire liability, with respect to any IP Claim for which Provider provides indemnification under Section 34.1.

PART VIII: TERM, TERMINATION, AND TRANSITION

36. Subscription Term

36.1 Commencement. The subscription term (the "Subscription Term") shall commence on the date upon which Subscriber's account is activated on the Platform (the "Effective Date"). Account activation shall be deemed to occur upon the earlier of: (a) Subscriber's completion of the registration and checkout process, including submission of valid payment credentials; or (b) Subscriber's first login to the Platform following completion of account provisioning by Provider.

36.2 Duration. The initial Subscription Term shall be either monthly or annual, as selected by Subscriber during the checkout process. A monthly Subscription Term shall consist of successive thirty (30)-day periods (or calendar month periods, as determined by the billing system) commencing on the Effective Date. An annual Subscription Term shall consist of a twelve (12)-month period commencing on the Effective Date.

36.3 Auto-Renewal. Unless Subscriber cancels the subscription in accordance with Section 37 of this Agreement, the Subscription Term shall automatically renew for successive periods of the same duration as the initial Subscription Term (each, a "Renewal Term"), subject to the then-current pricing, terms, and conditions. The auto-renewal provisions set forth in Section 9 of this Agreement are incorporated herein by reference and shall govern all automatic renewals. Provider shall provide Subscriber with no less than thirty (30) days' advance notice prior to each Renewal Term of any changes to pricing or material terms applicable to the upcoming Renewal Term.

36.4 Subscription Term Modifications. Provider reserves the right to modify the available Subscription Term options at any time. Any such modification shall not affect Subscriber's then-current Subscription Term or Renewal Term but shall apply to subsequent renewals or new subscriptions, as applicable.

37. Cancellation by Subscriber

37.1 Methods of Cancellation. Subscriber may initiate a cancellation request at any time by utilizing any of the following methods: (a) through the account settings and cancellation interface within the Platform; (b) by sending a written cancellation request to Provider via email at the designated support email address; or (c) by submitting a cancellation request through Provider's customer support portal. Provider shall acknowledge receipt of any cancellation request within two (2) business days.

37.2 Effective Date of Cancellation. A Subscriber who selects a monthly Subscription Term (a “Monthly Subscriber”) is subject to a minimum commitment period of three (3) consecutive months from the Effective Date (the “Minimum Commitment Period”). During the Minimum Commitment Period, a Monthly Subscriber may initiate a cancellation request using a method in Section 37.1, but may not cancel the subscription before the end of the Minimum Commitment Period and remains obligated for all Fees through the end of the Minimum Commitment Period. Except as provided in Section 37.6, all cancellations shall become effective at the later of: (a) the end of the Minimum Commitment Period, for a Monthly Subscriber whose cancellation request is received during the Minimum Commitment Period; or (b) the end of the then-current billing period. After the Minimum Commitment Period, a Monthly Subscriber may cancel at any time through a method in Section 37.1, effective at the end of the then-current billing period. For clarity, the cancellation mechanism—whether a button, email, portal, or other mechanism—initiates the cancellation process but does not make cancellation effective until the applicable effective date described in this Section. Subscriber shall retain full access to the Platform and all features included within Subscriber's Plan until the effective date of cancellation. No partial-period cancellations shall be permitted, and Subscriber shall remain responsible for all Fees through the effective date of cancellation.

37.3 No Refund of Prepaid Fees — Monthly Subscribers. For Subscribers on a monthly billing cycle, no refunds or credits shall be issued for any prepaid fees, unused time, or unused features within the current billing period following submission of a cancellation request. If the cancellation request is received during the Minimum Commitment Period, Subscriber remains responsible for all Fees through the end of the Minimum Commitment Period.

37.4 No Refund of Prepaid Fees — Annual Subscribers. For Subscribers on an annual billing cycle, no refunds or credits shall be issued for any prepaid fees, unused time, or unused features remaining within the current annual Subscription Term, except as expressly provided in Sections 14.2, 37.6 (seven-day cooling-off period), and 39.5 (prorated refund in the event Provider terminates without cause). Annual subscription commitments are non-cancellable during the initial or any renewal annual Subscription Term after the period described in Section 37.6, and Subscriber acknowledges and agrees that the annual subscription fee is fully earned by Provider upon the commencement of each annual period.

37.5 Non-Cancellability of Annual Commitments. Subject to the cooling-off right in Section 37.6, Subscriber acknowledges and agrees that selection of an annual Subscription Term constitutes a binding commitment for the full twelve (12)-month period. Annual subscriptions may not be cancelled, terminated, or converted to monthly subscriptions mid-term by Subscriber. Early termination fees, if any, shall not apply; however, Subscriber remains obligated for the full annual fee regardless of actual usage or desire to discontinue service prior to the expiration of the annual Subscription Term.

37.6 Annual Cooling-Off Period. Notwithstanding Sections 37.2, 37.4, and 37.5, a Subscriber who selects an annual Subscription Term may cancel within seven (7) calendar days of the Effective Date through any cancellation method described in Section 37.1 and receive a full refund of any Subscription Fees paid. The refund shall be processed in accordance with Section 14.2.

37.7 Confirmation and Post-Cancellation Obligations. Upon processing of Subscriber's cancellation, Provider shall send written confirmation to Subscriber's email address on file. Following the effective date of cancellation, Subscriber's obligations under this Agreement with respect to data retrieval, transition, and survival provisions shall continue in accordance with Sections 39, 40, and 41.

38. Termination by Provider

38.1 Termination for Material Breach. Provider may terminate this Agreement and Subscriber's access to the Platform if Subscriber commits a material breach of any term or condition of this Agreement, provided that Provider shall first deliver written notice to Subscriber specifying the nature of the breach in reasonable detail, and Subscriber shall have thirty (30) calendar days from receipt of such notice to cure the breach to Provider's reasonable satisfaction. If Subscriber fails to cure the breach within the thirty (30)-day cure period, termination shall be effective immediately upon expiration of such period without further notice.

38.2 Termination for Non-Payment. Notwithstanding Section 38.1, if Subscriber fails to make any payment when due under this Agreement, Provider shall deliver written notice of non-payment to Subscriber. Subscriber shall have five (5) business days from receipt of such notice to remit full payment of all outstanding amounts. If Subscriber fails to remit full payment within such five (5)-business-day period, Provider shall deliver a second notice providing an additional fifteen (15) calendar days to cure the payment default. If Subscriber fails to cure the payment default within such fifteen (15)-day period, Provider may immediately terminate this Agreement and suspend or terminate Subscriber's access to the Platform without further notice or liability.

38.3 Immediate Termination for AUP Violation. Provider may immediately terminate this Agreement and Subscriber's access to the Platform, without prior notice or opportunity to cure, if Subscriber or any Authorized User violates the Acceptable Use Policy in a manner that, in Provider's reasonable judgment: (a) poses an immediate risk to the security, integrity, or availability of the Platform; (b) exposes Provider to legal or regulatory liability; (c) involves the transmission of unlawful content; (d) constitutes harassment, abuse, or exploitation; or (e) involves any use of the Platform in connection with fraudulent, deceptive, or illegal activity.

38.4 Immediate Termination for HIPAA or PHI Breach. Provider may immediately terminate this Agreement and Subscriber's access to the Platform, without prior notice or opportunity to cure, if: (a) Subscriber or any Authorized User engages in conduct that constitutes a breach of unsecured Protected Health Information as defined under the HIPAA Breach Notification Rule (45 C.F.R. §§ 164.400–414); (b) Subscriber fails to implement or maintain the minimum administrative, physical, or technical safeguards required under the Business Associate Agreement; (c) Subscriber uses the Platform in a manner that creates an imminent risk of unauthorized disclosure of PHI; or (d) Subscriber's continued use of the Platform would, in Provider's reasonable judgment, cause Provider to violate its obligations under HIPAA, HITECH, or any applicable state health privacy law.

38.5 Termination Due to Legal Requirement. Provider may immediately terminate this Agreement and Subscriber's access to the Platform if Provider is required to do so by: (a) a court order, subpoena, or other legal process; (b) a regulatory directive, enforcement action, or compliance order issued by a governmental authority with jurisdiction over Provider's operations; or (c) changes in applicable law or regulation that render Provider's continued performance of this Agreement unlawful or commercially impracticable.

38.6 Termination for Extended Inactivity. Provider may terminate this Agreement and Subscriber's access to the Platform if Subscriber's account has been inactive for a continuous period of twelve (12) months or more, as determined by the absence of any login, API call, or administrative activity within Subscriber's account during such period. Prior to termination under this Section, Provider shall deliver written notice to Subscriber at least thirty (30) calendar days in advance, during which time Subscriber may reactivate the account by logging in or otherwise demonstrating active use. If Subscriber fails to reactivate the account within the thirty (30)-day notice period, termination shall be effective immediately upon expiration of such period.

38.7 Suspension Pending Investigation. In addition to its termination rights, Provider reserves the right to immediately suspend Subscriber's access to the Platform pending investigation of any suspected violation described in Sections 38.3,

38.4, or 38.5. During any period of suspension, Subscriber's payment obligations shall continue, and Provider shall use commercially reasonable efforts to complete its investigation within fifteen (15) business days. Upon completion of the investigation, Provider shall either reinstate Subscriber's access or terminate this Agreement in accordance with the applicable provision of this Section 38.

39. Effect of Termination

39.1 Termination of License. Upon the effective date of termination or expiration of this Agreement for any reason, the license granted to Subscriber under Section 5 shall immediately and automatically terminate. Subscriber's right to access and use the Platform, including all features, integrations, the single dedicated account workspace, and associated services, shall cease as of the effective date of termination, except for the limited read-only data retrieval and export access expressly provided in Sections 26.1, 27, 39.2, and 40. Subscriber shall immediately cease all use of the Platform and any Provider intellectual property, including trademarks, logos, and proprietary materials.

39.2 Data Retrieval Period. Following the effective date of termination or expiration, Provider shall maintain Subscriber's data (including, but not limited to, patient records, contacts, workflows, templates, and any other content uploaded or generated by Subscriber) in a retrievable state for a period of thirty (30) calendar days (the "Data Retrieval Period"). During the Data Retrieval Period, Subscriber may request export of its data in accordance with Section 40. Provider shall not be obligated to maintain any specific level of service, uptime, or functionality during the Data Retrieval Period, but shall ensure that Subscriber's data remains accessible for export purposes.

39.3 Permanent Deletion. Following expiration of the Data Retrieval Period, Provider shall permanently delete Subscriber’s data from Provider's active production systems in accordance with Section 26.2 and shall delete copies from backup, archival, and disaster recovery systems in accordance with Section 26.3. Such deletion shall be performed using commercially reasonable methods designed to render data unrecoverable. Notwithstanding the foregoing, Provider may retain de-identified, aggregated, or anonymized data that does not constitute Protected Health Information and cannot reasonably be used to identify any individual, for purposes of analytics, service improvement, and reporting.

39.4 Accrued Fees. All fees, charges, and other amounts that have accrued prior to or as of the effective date of termination shall become immediately due and payable upon termination. Termination of this Agreement shall not relieve Subscriber of the obligation to pay any fees or amounts that were due and owing prior to the effective date of termination. Provider may invoice Subscriber for any outstanding amounts, and Subscriber shall remit payment within ten (10) business days of receipt of such invoice.

39.5 Prorated Refund for Annual Subscribers. In the event that Provider terminates this Agreement without cause (i.e., not pursuant to Sections 38.1 through 38.6) during an annual Subscription Term, Provider shall issue a prorated refund to Subscriber for the unused portion of the prepaid annual fee, calculated on a monthly basis from the effective date of termination through the end of the then-current annual Subscription Term. No prorated refund shall be issued if termination is for cause, if termination is initiated by Subscriber, or if Subscriber is on a monthly billing cycle, in each case subject to any full-refund right under Section 14.2.

39.6 No Liability for Termination. Except as expressly provided in Section 39.5, neither party shall be liable to the other for any damages, losses, costs, or expenses arising out of or relating to the termination or expiration of this Agreement in accordance with its terms, including without limitation any loss of revenue, anticipated profits, goodwill, or business opportunities.

40. Transition Assistance

40.1 Cooperation in Transition. Upon termination or expiration of this Agreement, Provider shall cooperate with Subscriber in good faith to facilitate a reasonable and orderly transition of Subscriber's operations from the Platform to an alternative solution. Such cooperation shall be limited to commercially reasonable efforts and shall not require Provider to incur material costs or divert substantial resources from its ongoing operations.

40.2 Data Export Formats. During the Data Retrieval Period, Provider shall make contacts and customer data available for export in CSV format through the Platform’s standard export functionality. Workflow configurations, automation settings, custom-built elements, and other data types are not available for export through the standard functionality. Any assistance beyond this standard functionality is subject to Section 27.4.

40.3 Export Assistance. Upon Subscriber's written request during the Data Retrieval Period, Provider shall provide reasonable assistance in facilitating the export and transfer of Subscriber's data, subject to the following: (a) Provider may charge reasonable fees for export assistance that exceeds one (1) standard data export request; (b) Provider shall complete export requests within ten (10) business days of receipt of a properly submitted request; and (c) all data exports shall be transmitted via secure, encrypted channels in accordance with HIPAA requirements.

40.4 No Ongoing Integration Obligations. Following the effective date of termination, Provider shall have no obligation to maintain, support, or otherwise ensure the continued functionality of any integrations, API connections, webhooks, or other technical interfaces between the Platform and any third-party systems utilized by Subscriber. Subscriber acknowledges that all such integrations shall cease functioning upon termination of access to the Platform.

40.5 Third-Party Service Connections. Subscriber acknowledges and agrees that any third-party services connected to or through the Platform (including, but not limited to, payment processors, telephony providers, email services, and calendar integrations) are governed by separate agreements between Subscriber and such third-party providers. Provider shall have no responsibility for the continuation, migration, or termination of any third-party service relationships following termination of this Agreement.

41. Survival

41.1 Surviving Provisions. The following provisions of this Agreement shall survive the termination or expiration of this Agreement for any reason, and shall continue in full force and effect in accordance with their respective terms: (a) the confidentiality obligations that survive under Section 30.6 and in any applicable Non-Disclosure Agreement; (b) all limitations of liability and disclaimers of warranties; (c) all indemnification obligations; (d) all data deletion and post-termination data handling obligations; (e) all intellectual property ownership provisions; (f) all dispute resolution provisions, including the arbitration agreement and class action waiver; (g) all payment obligations accrued prior to termination; (h) all representations and warranties made by either party; and (i) any other provisions which by their nature are intended to survive or which are necessary to give effect to the parties' rights and obligations following termination.

41.2 Duration of Survival. Unless otherwise specified in the applicable provision, surviving obligations shall continue for a period of three (3) years following the effective date of termination, except that: (a) confidentiality obligations shall survive only for the periods specified in Section 30.6; (b) obligations related to Protected Health Information shall survive in accordance with HIPAA requirements; and (c) intellectual property ownership provisions shall survive in perpetuity.

PART IX: DISPUTE RESOLUTION

42. Governing Law

42.1 Choice of Law. This Agreement, and all claims or causes of action (whether in contract, tort, statute, or otherwise) that may be based upon, arise out of, or relate to this Agreement, or the negotiation, execution, or performance of this Agreement, shall be governed by and construed in accordance with the laws of the State of Florida, without giving effect to any choice-of-law or conflict-of-law rules or provisions (whether of the State of Florida or any other jurisdiction) that would cause the application of the laws of any jurisdiction other than the State of Florida.

42.2 Federal Law. To the extent that any federal law, rule, or regulation (including, without limitation, HIPAA, HITECH, the Federal Arbitration Act, the CAN-SPAM Act, and the Telephone Consumer Protection Act) applies to the subject matter of this Agreement, such federal law shall apply and shall preempt any inconsistent state law to the extent required by applicable federal preemption principles.

42.3 Venue for Court Proceedings. To the extent that any dispute, claim, or proceeding is not subject to arbitration under Section 44 or falls within the exceptions set forth in Sections 46 or 47, the parties agree that exclusive jurisdiction and venue shall lie in the state and federal courts located in Palm Beach County, Florida, and each party hereby irrevocably consents to the personal jurisdiction and venue of such courts. For purposes of this Section, the applicable federal court shall be the United States District Court for the Southern District of Florida.

43. Informal Resolution

43.1 Mandatory Pre-Arbitration Negotiation. Before initiating any arbitration proceeding or court action under this Agreement, the aggrieved party must first attempt to resolve the dispute informally by sending written notice to the other party describing the nature of the claim, the specific relief sought, and the factual basis for the claim (a "Dispute Notice"). The Dispute Notice shall be sent to Provider at its registered business address or designated legal notice email, and to Subscriber at the email address on file in Subscriber's account.

43.2 Negotiation Period. Upon receipt of a Dispute Notice, the parties shall engage in good-faith negotiations for a period of thirty (30) calendar days (the "Negotiation Period"). During the Negotiation Period, the parties shall make themselves reasonably available for telephone or video conference discussions and shall exchange relevant information reasonably necessary to evaluate the dispute. Neither party shall initiate arbitration or file a court action during the Negotiation Period, except to seek emergency injunctive relief as permitted under Section 47.

43.3 Escalation. If the dispute is not resolved within the initial thirty (30)-day Negotiation Period, either party may escalate the matter to a senior executive or authorized representative of each party for an additional fifteen (15)-day escalation period. Participation in the escalation process is voluntary but encouraged.

43.4 Condition Precedent. Completion of the informal resolution process set forth in this Section 43 (or the expiration of the Negotiation Period without resolution) is a mandatory condition precedent to the initiation of any arbitration proceeding under Section 44. Any arbitration demand filed prior to the expiration of the Negotiation Period may be dismissed without prejudice by the arbitrator.

44. Binding Arbitration

44.1 Agreement to Arbitrate. Except as expressly provided in Sections 46 and 47 of this Agreement, Subscriber and Provider mutually agree that any and all disputes, claims, or controversies arising out of or relating to this Agreement, the Platform, the services provided hereunder, or the relationship between the parties (including claims arising before the execution of this Agreement or after its termination), whether based in contract, tort, statute, fraud, misrepresentation, or any other legal theory, shall be resolved exclusively through final and binding arbitration administered by the American Arbitration Association ("AAA") under its Commercial Arbitration Rules and Mediation Procedures then in effect (the "AAA Rules").

44.2 Arbitrator Selection. The arbitration shall be conducted by a single neutral arbitrator who shall be selected in accordance with the AAA Rules. The arbitrator shall be a licensed attorney with at least ten (10) years of experience in commercial contract disputes and, to the extent practicable, familiarity with technology licensing agreements or healthcare regulatory matters.

44.3 Venue and Format. The arbitration shall be conducted in Boynton Beach, Florida, or, at the election of either party, by videoconference using a secure, commercially available video conferencing platform. The arbitrator shall determine whether any in-person hearings are required, taking into account the complexity of the dispute, the amount in controversy, and the parties' preferences. For claims involving amounts less than Twenty-Five Thousand Dollars ($25,000), the arbitration shall be conducted on a documents-only basis unless the arbitrator determines that a hearing is necessary for a fair resolution.

44.4 Arbitrator Authority. The arbitrator shall have exclusive authority to resolve all disputes arising out of or relating to the interpretation, applicability, enforceability, or formation of this Agreement, including but not limited to any claim that all or any part of this Agreement is void or voidable. The arbitrator shall have the authority to grant any remedy or relief that a court of competent jurisdiction could grant, including declaratory relief, injunctive relief (subject to Section 47), and monetary damages. The arbitrator shall issue a reasoned written decision sufficient to explain the essential findings and conclusions on which the award is based.

44.5 Costs and Fees. The parties shall share equally the administrative fees and arbitrator compensation charged by the AAA, unless the arbitrator determines that one party's claims or defenses were frivolous or brought in bad faith, in which case the arbitrator may allocate all or a portion of such costs to the non-prevailing party. Each party shall bear its own attorneys' fees and costs, subject to the prevailing party fee-shifting provision set forth in Section 48.

44.6 Confidentiality of Arbitration. The parties agree that the arbitration proceeding, including all filings, evidence, testimony, and the arbitrator's award, shall be treated as confidential information and shall not be disclosed to any third party except: (a) as required by law; (b) to the parties' legal counsel, accountants, and financial advisors; (c) in connection with enforcement of the arbitration award; or (d) with the written consent of both parties.

44.7 Federal Arbitration Act. This arbitration agreement is governed by the Federal Arbitration Act, 9 U.S.C. §§ 1–16 (the "FAA"), and not by any state arbitration statute. The parties agree that the FAA preempts any inconsistent state law with respect to the enforceability of this arbitration provision.

45. Class Action Waiver

45.1 Individual Claims Only. TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW, SUBSCRIBER AND PROVIDER EACH AGREE THAT ANY AND ALL DISPUTES, CLAIMS, OR CAUSES OF ACTION ARISING OUT OF OR RELATING TO THIS AGREEMENT OR THE PLATFORM SHALL BE RESOLVED ON AN INDIVIDUAL BASIS ONLY. NEITHER PARTY SHALL HAVE THE RIGHT TO BRING, JOIN, OR PARTICIPATE IN ANY CLASS, COLLECTIVE, CONSOLIDATED, REPRESENTATIVE, OR MULTI-PARTY ACTION, WHETHER IN ARBITRATION, IN COURT, OR IN ANY OTHER FORUM.

45.2 Waiver of Class, Collective, and Representative Proceedings. Subscriber expressly waives any right to: (a) commence, join, or participate in any class action lawsuit; (b) bring claims as a representative or member of a class; (c) participate in any collective, consolidated, or multi-district action; (d) bring claims in a representative capacity on behalf of others, including under any private attorney general theory; or (e) combine Subscriber's claims with the claims of any other person or entity for purposes of arbitration or litigation.

45.3 Arbitrator's Authority. The arbitrator shall have no authority to: (a) certify a class or conduct class-wide arbitration; (b) consolidate separate arbitration proceedings involving different parties; (c) award relief to any person or entity not a party to the arbitration; or (d) preside over any form of representative, collective, or class proceeding.

45.4 Severability of Class Action Waiver. If any court or arbitrator of competent jurisdiction determines that the class action waiver set forth in this Section 45 is unenforceable as to a particular claim or request for relief (such as a request for public injunctive relief), and all appeals from that determination have been exhausted (or the determination is otherwise final), then the parties agree that such particular claim or request for relief shall be severed from the arbitration and may be litigated in a court of competent jurisdiction. All remaining claims shall remain subject to arbitration under Section 44.

45.5 Thirty-Day Opt-Out Right. Subscriber may opt out of this arbitration agreement and class action waiver by delivering written notice to Provider within thirty (30) calendar days of the Effective Date of this Agreement. The opt-out notice must be sent to Provider at its registered business address and must include: (a) Subscriber's full legal name and account identifier; (b) Subscriber's mailing address and email address; and (c) a clear, unambiguous statement that Subscriber wishes to opt out of the arbitration agreement and class action waiver contained in Sections 44 and 45 of this Agreement. If Subscriber timely and properly exercises the opt-out right, all disputes shall be resolved exclusively in the courts identified in Section 42.3. If Subscriber does not opt out within the thirty (30)-day period, Subscriber shall be bound by the arbitration agreement and class action waiver for the duration of this Agreement and any renewals thereof.

46. Small Claims Exception

46.1 Small Claims Court Jurisdiction. Notwithstanding the arbitration agreement set forth in Section 44, either party may bring an individual action in a small claims court of competent jurisdiction for any dispute or claim that is within the jurisdictional limits of such court, provided that the action remains in small claims court and is not transferred, consolidated, or appealed to a court of general jurisdiction. If the claim is removed, transferred, or escalated beyond the jurisdictional limits of the small claims court, the matter shall be subject to the arbitration provisions of Section 44.

46.2 Limitations. The small claims exception set forth in this Section 46 shall apply only to claims brought on an individual basis. No party may use the small claims court process to initiate or maintain a class, collective, or representative action.

47. Equitable Relief

47.1 Right to Seek Injunctive Relief. Notwithstanding the arbitration agreement set forth in Section 44, either party may seek temporary, preliminary, or permanent injunctive relief, specific performance, or other equitable remedies from any court of competent jurisdiction, without first exhausting the informal resolution process set forth in Section 43 or the arbitration process set forth in Section 44, in the event of an actual or threatened: (a) misappropriation, infringement, or other violation of a party's intellectual property rights, including patents, copyrights, trademarks, or trade secrets; (b) unauthorized use, disclosure, or misappropriation of trade secrets or proprietary information; (c) breach of confidentiality obligations set forth in this Agreement or any related Non-Disclosure Agreement; or (d) any other act or omission for which monetary damages would be inadequate to protect the aggrieved party's interests and irreparable harm would result absent injunctive relief.

47.2 No Waiver of Arbitration Rights. The seeking or obtaining of equitable relief pursuant to this Section 47 shall not constitute a waiver of either party's right to compel arbitration of the underlying dispute under Section 44, and any award of equitable relief shall not affect the arbitrator's jurisdiction over the merits of the dispute. The parties agree that the court's role under this Section is limited to determining whether equitable relief is warranted and, if so, granting such relief, while the arbitrator retains exclusive authority over all other aspects of the dispute.

47.3 Bond Waiver. In the event that injunctive relief is sought and granted under this Section 47, the party seeking such relief shall not be required to post a bond or other security as a condition to obtaining injunctive relief, unless required by applicable law or court rule that cannot be waived by agreement of the parties.

48. Prevailing Party Attorneys' Fees

48.1 Fee-Shifting. In any arbitration, litigation, or other proceeding arising out of or relating to this Agreement, the prevailing party shall be entitled to recover its reasonable attorneys' fees, costs, and expenses (including expert witness fees, arbitrator fees, court costs, and all costs of appeal) from the non-prevailing party, in addition to any other relief to which the prevailing party may be entitled.

48.2 Determination of Prevailing Party. For purposes of this Section, the "prevailing party" shall be the party that substantially prevails on the merits of the claims or defenses at issue in the proceeding, as determined by the arbitrator or court, as applicable. A party need not prevail on all claims to be deemed the prevailing party; rather, the arbitrator or court shall consider the totality of the outcome, including the relative success on the claims and defenses asserted, the relief sought versus the relief obtained, and the overall context of the dispute.

48.3 Interim Fee Awards. In the event of protracted arbitration or litigation, the arbitrator or court may, in its discretion, award interim attorneys' fees and costs upon a showing that one party has substantially prevailed on significant dispositive motions or threshold legal issues, subject to final adjustment upon resolution of all claims.

PART X: GENERAL PROVISIONS

49. Entire Agreement

49.1 Complete Agreement. This Agreement, together with the Terms of Service ("TOS"), Privacy Policy, Acceptable Use Policy ("AUP"), Business Associate Agreement ("BAA") (if applicable), and all Order Forms, Statements of Work, addenda, exhibits, and schedules referenced herein or executed by the Parties (collectively, the "Agreement Documents"), constitutes the entire agreement between Provider and Subscriber with respect to the subject matter hereof and supersedes all prior and contemporaneous agreements, proposals, negotiations, representations, warranties, understandings, and communications, whether oral or written, between the Parties relating to such subject matter.

49.2 Supersession of Prior Agreements. Without limiting the generality of the foregoing, this Agreement expressly supersedes: (a) any prior terms of service, subscription agreements, or click-through agreements between the Parties; (b) any representations or commitments made by Provider's sales, marketing, or support personnel that are not expressly set forth in the Agreement Documents; and (c) any course of dealing, trade usage, or industry practice that conflicts with the express terms hereof.

49.3 Order of Precedence. In the event of a conflict or inconsistency between or among the Agreement Documents, the following order of precedence shall apply (from highest to lowest priority): (a) any executed BAA (solely with respect to Protected Health Information); (b) this Master Subscription Agreement; (c) Order Forms or Statements of Work (with later-dated documents controlling over earlier-dated documents); (d) the AUP; (e) the TOS; and (f) the Privacy Policy.

49.4 No Reliance. Each Party acknowledges that, in entering into this Agreement, it has not relied on any statement, representation, warranty, or understanding (whether negligently or innocently made) of any person other than as expressly set forth in the Agreement Documents.

50. Severability

50.1 Invalid Provisions. If any provision of this Agreement, or the application thereof to any person or circumstance, is held by a court of competent jurisdiction or arbitral tribunal to be invalid, illegal, void, or unenforceable to any extent, such provision shall be deemed modified to the minimum extent necessary to make it valid, legal, and enforceable. If such modification is not possible, such provision shall be deemed severed from this Agreement.

50.2 Remaining Provisions. The invalidity, illegality, or unenforceability of any provision shall not affect the validity, legality, or enforceability of the remaining provisions of this Agreement, all of which shall continue in full force and effect. The remaining provisions shall be construed and enforced as if the invalid, illegal, or unenforceable provision had never been included herein.

50.3 Reformation. If any provision is held to be invalid, illegal, or unenforceable but can be made valid, legal, or enforceable by modification, the Parties agree that the court or arbitral tribunal making such determination shall have the power to reduce the scope, duration, area, or applicability of the provision, to delete specific words or phrases, or to replace the provision with a provision that is valid, legal, and enforceable and that comes closest to expressing the original intention of the Parties, and this Agreement shall be enforceable as so modified.

50.4 Essential Terms. Notwithstanding the foregoing, the Parties acknowledge and agree that the provisions relating to limitation of liability (Part VII), indemnification (Part VII), intellectual property ownership (including Sections 5 and 22), HIPAA compliance (Part IV), the arbitration clause (Part IX), and payment obligations (Part III) are essential terms of this Agreement, and the invalidity of any such provision in its entirety shall entitle the affected Party to terminate this Agreement upon written notice.

51. Waiver

51.1 Written Waiver Required. No waiver of any term, provision, condition, or obligation of this Agreement shall be valid or effective unless set forth in a written instrument signed by the Party against whom enforcement of such waiver is sought. No waiver shall be implied from any delay or failure by a Party to exercise any right or remedy hereunder, nor shall any single or partial exercise of any right or remedy preclude any other or further exercise thereof or the exercise of any other right or remedy.

51.2 No Waiver by Conduct. The failure of either Party to enforce any provision of this Agreement on one or more occasions shall not constitute a waiver of such provision or of such Party's right to enforce such provision on any subsequent occasion. No course of dealing between the Parties, no act of forbearance or delay on the part of either Party, and no acceptance of partial performance shall operate as a waiver or modification of any right, power, privilege, or remedy under this Agreement.

51.3 Specificity of Waiver. A waiver of any breach or default under this Agreement shall not constitute a waiver of any subsequent breach or default of the same or any other provision. A waiver given on one occasion shall not be construed as a waiver on any subsequent occasion or as a bar to the enforcement of any other provision of this Agreement.

52. Assignment

52.1 Provider Assignment Rights. Provider may freely assign, transfer, delegate, or otherwise dispose of this Agreement, or any of its rights, interests, or obligations hereunder, in whole or in part, without the prior consent of Subscriber, including without limitation in connection with: (a) a merger, acquisition, consolidation, or reorganization of Provider; (b) a sale of all or substantially all of Provider's assets or business; (c) a change of control of Provider (whether by stock sale, asset sale, or otherwise); (d) a transfer to an affiliate, subsidiary, or parent entity of Provider; or (e) any corporate restructuring or financing transaction. Provider shall provide Subscriber with written notice of any such assignment within thirty (30) days following its effective date.

52.2 Subscriber Assignment Restrictions. Subscriber may not assign, transfer, delegate, sublicense, or otherwise dispose of this Agreement, or any of its rights or obligations hereunder, in whole or in part, whether voluntarily, involuntarily, by operation of law, or otherwise, without the prior written consent of Provider, which consent may be withheld in Provider's sole and absolute discretion. Any purported assignment or transfer in violation of this Section 52.2 shall be null, void, and of no force or effect.

52.3 Binding on Successors. Subject to the restrictions set forth in this Section 52, this Agreement shall be binding upon and inure to the benefit of the Parties and their respective permitted successors and assigns.

53. Force Majeure

53.1 Definition. "Force Majeure Event" means any event or circumstance beyond the reasonable control of the affected Party that prevents or materially impairs the performance of its obligations under this Agreement, including but not limited to: (a) acts of God, including floods, earthquakes, hurricanes, tornadoes, tsunamis, volcanic eruptions, wildfires, or other natural disasters; (b) epidemics, pandemics, quarantines, or public health emergencies (including without limitation COVID-19 and any variant thereof or successor pandemic); (c) war (whether declared or undeclared), armed conflict, invasion, terrorism, insurrection, civil unrest, riots, or revolution; (d) cyber attacks, ransomware attacks, distributed denial-of-service attacks, data breaches, or other malicious interference with computer systems or networks; (e) acts, orders, regulations, embargoes, sanctions, or restrictions imposed by any governmental authority, including executive orders, legislative enactments, and regulatory mandates; (f) failures, outages, or disruptions of the internet, telecommunications infrastructure, power grids, or cloud computing services; (g) strikes, lockouts, labor disputes, or work stoppages (excluding those involving the affected Party's own employees); (h) shortages of materials, components, or supplies; (i) fire, explosion, or structural collapse; and (j) failure of third-party vendors, platforms, or service providers upon which the affected Party's performance depends, including GoHighLevel, payment processors, and cloud hosting providers.

53.2 Excuse of Performance. Neither Party shall be liable to the other for any failure or delay in the performance of any obligation under this Agreement (other than payment obligations) to the extent that such failure or delay is caused by a Force Majeure Event, provided that the affected Party: (a) provides written notice to the other Party within five (5) business days of becoming aware of the Force Majeure Event, specifying the nature of the event and its anticipated duration; (b) uses commercially reasonable efforts to mitigate the effects of the Force Majeure Event and to resume performance as soon as practicable; and (c) provides periodic updates (no less frequently than every ten (10) days) regarding the status of the Force Majeure Event and the affected Party's mitigation efforts.

53.3 Termination Trigger. If a Force Majeure Event prevents or materially impairs the affected Party's performance of its material obligations under this Agreement for a continuous period exceeding sixty (60) calendar days, or for an aggregate of ninety (90) calendar days within any twelve (12) month period, either Party may terminate this Agreement upon fifteen (15) days' written notice to the other Party, without liability or penalty (other than for obligations accrued prior to the date of termination). Upon such termination, Provider shall refund to Subscriber a pro rata portion of any prepaid fees attributable to the period following the effective date of termination.

53.4 Limitations. A Force Majeure Event shall not excuse: (a) any obligation to make payments that accrued prior to the occurrence of the Force Majeure Event; (b) any obligation relating to the protection, security, or confidentiality of Subscriber Data, Protected Health Information, or Confidential Information; or (c) any obligation that could reasonably have been performed notwithstanding the Force Majeure Event through the implementation of a disaster recovery or business continuity plan.

54. Notices

54.1 Routine Communications. Routine operational communications, including account notifications, feature updates, maintenance announcements, billing reminders, and general customer communications, may be delivered by Provider via: (a) email to the address associated with Subscriber's account; (b) in-app notifications within the Platform interface; (c) push notifications (if Subscriber has enabled such notifications); or (d) dashboard banners or system messages displayed upon login.

54.2 Legal Notices. All legal notices, demands, requests for consent, and other formal communications required or permitted under this Agreement (including without limitation notices of breach, notices of termination, notices of dispute, subpoenas, and legal process) shall be in writing and shall be deemed duly given when: (a) delivered personally; (b) sent by nationally recognized overnight courier service (with tracking and confirmation of delivery); (c) sent by certified or registered mail, return receipt requested, postage prepaid; or (d) sent by email with confirmed receipt (automatic delivery receipts alone shall not constitute confirmation; affirmative acknowledgment of receipt shall be required).

54.3 Addresses. Legal notices shall be sent to the addresses set forth in the Order Form or account registration information, or to such other address as a Party may designate in writing from time to time. It is Subscriber's sole responsibility to maintain current and accurate contact information in its account settings. Provider shall not be liable for any failure to receive notice resulting from Subscriber's failure to maintain current contact information.

54.4 Provider Notice Address. Unless otherwise specified in the Order Form, legal notices to Provider shall be sent to:

54.5 In-App Notifications. Subscriber acknowledges and agrees that Provider may use in-app notifications, platform banners, and similar electronic communications for non-legal communications, including but not limited to: feature announcements, scheduled maintenance windows, policy updates (other than material changes requiring affirmative acceptance), best practice recommendations, and promotional offers. Such in-app notifications shall be deemed received when displayed within the Platform interface, regardless of whether Subscriber actually views or reads such notifications.

55. Independent Contractors

55.1 Relationship of the Parties. The relationship between Provider and Subscriber is solely that of independent contractors. Nothing in this Agreement shall be construed to create a partnership, joint venture, agency, franchisor-franchisee, employer-employee, master-servant, or any other fiduciary or representative relationship between the Parties. Neither Party is the agent, representative, partner, or employee of the other Party for any purpose whatsoever.

55.2 No Authority to Bind. Neither Party shall have any right, power, or authority to create any obligation, express or implied, on behalf of the other Party, or to bind the other Party in any manner whatsoever. Neither Party shall hold itself out to any third party as having any authority to act on behalf of, or to bind, the other Party.

55.3 Personnel. Each Party shall be solely responsible for: (a) the supervision, direction, control, compensation, benefits, and withholding obligations relating to its own employees, agents, and contractors; (b) any workers' compensation, unemployment insurance, or other employment-related obligations; and (c) all taxes, contributions, and charges arising from the employment or engagement of its own personnel.

55.4 No Healthcare Provider Relationship. For the avoidance of doubt, Provider does not provide healthcare services, medical advice, clinical supervision, or professional healthcare guidance to Subscriber or Subscriber's patients. Provider is a technology services company, and the Platform is a technology tool. The provision of healthcare services by Subscriber through the Platform does not create any healthcare provider-patient relationship between Provider and Subscriber's patients, nor does it create any clinical supervision or professional oversight relationship between Provider and Subscriber.

56. No Third-Party Beneficiaries

56.1 General Rule. Except as expressly set forth in this Section 56, this Agreement is for the sole benefit of the Parties and their respective permitted successors and assigns. Nothing in this Agreement, express or implied, is intended to or shall confer upon any other person or entity any legal or equitable right, benefit, remedy, or claim of any nature whatsoever under or by reason of this Agreement.

56.2 Exceptions. Notwithstanding Section 56.1, the Parties acknowledge and agree that: (a) Provider's licensors, technology partners, and upstream service providers (including without limitation GoHighLevel, LLC and its affiliates) are intended third-party beneficiaries of the limitations of liability, disclaimers of warranties, and intellectual property provisions of this Agreement, and shall have the right to enforce such provisions directly against Subscriber; (b) Provider's suppliers, hosting providers, and subcontractors are intended third-party beneficiaries of the indemnification obligations set forth in this Agreement to the extent such provisions expressly name them as indemnitees; and (c) nothing herein shall limit or restrict the rights of any governmental authority, regulatory body, or law enforcement agency.

56.3 No Patient Rights. For the avoidance of doubt, Subscriber's patients, clients, and end users are not third-party beneficiaries of this Agreement and shall have no right to enforce any provision hereof against Provider. Any obligations of Provider relating to the protection of patient data arise solely under applicable law and the BAA, and not by virtue of any third-party beneficiary status under this Agreement.

57. Amendments

57.1 Provider's Right to Modify. Provider reserves the right to modify, amend, supplement, or update any provision of this Agreement at any time, in its sole discretion, by posting the revised terms on its website or within the Platform and providing notice to Subscriber in accordance with Section 54.

57.2 Notice of Material Changes. For any amendment that constitutes a material change to this Agreement (including without limitation changes to the scope of the license grant, data handling practices, limitation of liability, indemnification obligations, or governing law), Provider shall provide Subscriber with no less than thirty (30) days' prior written notice before such amendment takes effect. The notice shall clearly identify the amended provisions, summarize the nature of the changes, and specify the effective date.

57.3 Acceptance by Continued Use. Subject to Section 57.4, Subscriber's continued access to or use of the Platform after the expiration of the applicable notice period shall constitute Subscriber's binding acceptance of the amended terms. If Subscriber does not agree to any amendment, Subscriber's sole and exclusive remedy is to terminate this Agreement prior to the effective date of such amendment, in which case Provider shall refund a pro rata portion of any prepaid fees attributable to the period following the effective date of termination.

57.4 Affirmative Acceptance Required. Notwithstanding Section 57.3, the following categories of amendments shall not take effect unless and until Subscriber provides affirmative acceptance through an express mechanism designated by Provider (such as a click-to-accept dialogue, electronic signature, or written acknowledgment): (a) increases to subscription fees or the introduction of new fees (other than fees for newly introduced optional add-on services); (b) modifications to the arbitration clause, class action waiver, or dispute resolution procedures; (c) changes that would expand Provider's rights to use, share, or monetize Subscriber Data or Protected Health Information; and (d) changes to the BAA (which require separate execution in accordance with HIPAA requirements).

57.5 Non-Material Changes. Provider may make non-material changes to this Agreement (including corrections of typographical errors, clarifications that do not alter the meaning or intent of any provision, updates to reflect changes in applicable law, and administrative updates) at any time without prior notice. Such changes shall be effective immediately upon posting.

58. Electronic Communications Consent

58.1 Consent to Electronic Communications. By entering into this Agreement and creating an account on the Platform, Subscriber affirmatively consents to receive all communications from Provider in electronic form. Subscriber agrees that all notices, disclosures, agreements, authorizations, acknowledgments, and other communications that Provider provides to Subscriber electronically satisfy any legal requirement that such communications be in writing, to the fullest extent permitted by applicable law, including without limitation the requirements of the Electronic Signatures in Global and National Commerce Act (E-SIGN Act, 15 U.S.C. § 7001 et seq.) and the Uniform Electronic Transactions Act (UETA) as adopted in Provider's state of organization.

58.2 Electronic Delivery Methods. Provider may deliver electronic communications to Subscriber via any one or more of the following methods: (a) email to the address on file; (b) in-platform notifications, messages, or alerts; (c) posting on Provider's website or within the Platform dashboard; (d) text messages or SMS (if Subscriber has provided a mobile telephone number and consented to SMS communications); or (e) any other electronic means reasonably calculated to provide actual notice to Subscriber.

58.3 Electronic Records. Subscriber consents to the use of electronic records for all purposes under this Agreement. Subscriber acknowledges that Provider may maintain records of this Agreement, all amendments, all notices, and all other communications in electronic form, and that such electronic records shall be admissible in any legal proceeding to the same extent as paper records.

58.4 Hardware and Software Requirements. Subscriber acknowledges that, in order to access and retain electronic communications, Subscriber must have: (a) a computer or mobile device with internet access; (b) a current web browser capable of supporting the Platform; (c) a valid email address; and (d) sufficient storage capacity to save communications or a printer to print them. Subscriber is responsible for maintaining the hardware, software, and internet connectivity necessary to receive electronic communications.

58.5 Withdrawal of Consent. Subscriber may withdraw its consent to receive electronic communications by providing written notice to Provider in accordance with Section 54.2; provided, however, that withdrawal of consent to electronic communications may result in the termination of Subscriber's account, as electronic communications are essential to the operation of the Platform and the administration of this Agreement.

59. Export Compliance

59.1 Export Control Compliance. Subscriber acknowledges that the Platform, including all software, technology, documentation, and technical data provided hereunder, may be subject to the export control and sanctions laws and regulations of the United States, including without limitation the Export Administration Regulations (EAR, 15 C.F.R. Parts 730-774) administered by the Bureau of Industry and Security (BIS), the International Traffic in Arms Regulations (ITAR, 22 C.F.R. Parts 120-130), and the economic sanctions programs administered by the Office of Foreign Assets Control (OFAC, 31 C.F.R. Part 500 et seq.) of the U.S. Department of the Treasury.

59.2 Subscriber Obligations. Subscriber shall not, directly or indirectly, export, re-export, transfer, divert, release, or otherwise make available the Platform or any portion thereof: (a) to any country, territory, or region subject to comprehensive U.S. economic sanctions (currently including Cuba, Iran, North Korea, Syria, and the Crimea, Donetsk, and Luhansk regions of Ukraine, as such list may be updated from time to time); (b) to any person or entity identified on the Specially Designated Nationals and Blocked Persons List (SDN List), the Entity List, the Denied Persons List, the Unverified List, or any other restricted party list maintained by any U.S. governmental authority; (c) for any end-use prohibited by applicable export control laws, including without limitation the design, development, production, stockpiling, or use of nuclear, chemical, or biological weapons or missile technology; or (d) in any manner that would violate any applicable export control law or regulation.

59.3 Representations. Subscriber represents and warrants that: (a) Subscriber is not located in, organized under the laws of, or a national or resident of any sanctioned country or territory; (b) Subscriber is not identified on any restricted party list; (c) Subscriber will not permit any person or entity identified on any restricted party list to access or use the Platform; and (d) Subscriber will comply with all applicable export control and sanctions laws in connection with its use of the Platform.

59.4 U.S.-Based Service. The Platform is designed for and intended to be accessed and used solely within the United States. Provider makes no representation that the Platform is appropriate or available for use in any jurisdiction outside the United States. Subscriber shall not access or use the Platform from any location outside the United States without Provider's prior written consent. Provider may, in its sole discretion, authorize access from locations outside the United States upon Subscriber’s prior written request and Provider’s written consent, subject to such additional terms and conditions as Provider may require.

60. Headings and Construction

60.1 Headings. The headings, captions, and section titles contained in this Agreement are inserted for convenience of reference only and shall not affect the meaning, interpretation, or construction of any provision of this Agreement. No heading shall be deemed to limit, characterize, or in any way affect the scope or intent of any provision hereof.

60.2 Inclusive Language. As used in this Agreement, the word "including" (and correlative words such as "include," "includes," and "included") means "including but not limited to" and "including without limitation," whether or not such additional words are expressly stated. The use of examples or illustrative lists shall not be construed to limit the generality of any term or provision to which such examples relate.

60.3 No Strict Construction Against Drafter. This Agreement has been negotiated by the Parties and shall be interpreted fairly in accordance with its terms. No rule of strict construction shall be applied against either Party on the basis that such Party (or its counsel) drafted or prepared this Agreement or any particular provision hereof. Any ambiguity in this Agreement shall not be construed against the drafting Party.

60.4 Interpretation. Unless the context otherwise requires: (a) words in the singular include the plural, and words in the plural include the singular; (b) references to "Sections," "Parts," "Exhibits," or "Schedules" are to sections, parts, exhibits, or schedules of this Agreement; (c) references to "days" mean calendar days unless "business days" are expressly specified; (d) "or" is not exclusive unless the context clearly requires an exclusive meaning; (e) "shall" and "will" are mandatory, and "may" is permissive; (f) references to statutes include all regulations promulgated thereunder and all amendments, successors, and replacements thereof; (g) references to "writing" or "written" include electronic communications satisfying the requirements of Section 58; and (h) references to monetary amounts are to United States dollars unless otherwise specified.

60.5 Counterparts and Electronic Execution. This Agreement may be executed in one or more counterparts, each of which shall be deemed an original and all of which together shall constitute one and the same instrument. Electronic signatures, digital signatures, and signatures transmitted by facsimile, PDF, or other electronic means shall be deemed original signatures for all purposes and shall have the same legal force and effect as original ink signatures.

PART XI: ACCEPTABLE USE POLICY

EXHIBIT A

ACCEPTABLE USE POLICY

This Acceptable Use Policy ("AUP") governs Subscriber's use of the Sancta platform (the "Platform"), a white-labeled GoHighLevel healthcare SaaS solution designed for Nurse Practitioners ("NPs") and Advanced Practice Registered Nurses ("APRNs"). This AUP is incorporated by reference into the SaaS Subscription Agreement (the "Agreement") between Provider and Subscriber. Capitalized terms not defined herein shall have the meanings ascribed to them in the Agreement.

Violation of this AUP may result in suspension or termination of Subscriber's access to the Platform, as described in Section G below. Provider reserves the right to modify this AUP at any time upon thirty (30) days' written notice to Subscriber.

A. General Prohibitions

Subscriber shall not, and shall not permit any End User, employee, contractor, agent, or other person with access to Subscriber’s account workspace to use the Platform to engage in or facilitate any of the following:

1. Illegal Activity

Any activity that violates any applicable federal, state, local, or international law, statute, regulation, ordinance, or governmental order, including but not limited to laws governing healthcare, consumer protection, data privacy, telecommunications, and anti-fraud.

2. Harmful Content

The creation, transmission, distribution, or storage of any content that: (a) is unlawful, threatening, abusive, harassing, defamatory, libelous, deceptive, fraudulent, invasive of another's privacy, tortious, or otherwise objectionable; (b) promotes or facilitates violence, self-harm, or harm to others; (c) contains sexually explicit material involving minors; or (d) constitutes hate speech targeting individuals or groups based on race, ethnicity, national origin, religion, gender, sexual orientation, disability, or any other protected characteristic.

3. Interference with Platform

Any activity that: (a) interferes with, disrupts, degrades, or impairs the Platform or any servers, networks, or infrastructure connected thereto; (b) imposes an unreasonable or disproportionately large load on Platform infrastructure; (c) introduces viruses, worms, Trojan horses, ransomware, or other malicious code; or (d) attempts to probe, scan, or test the vulnerability of the Platform or any related system or network without prior written authorization from Provider.

4. Unauthorized Access

Any attempt to gain unauthorized access to: (a) the Platform or any portion thereof to which Subscriber has not been granted access; (b) other Subscribers' accounts, data, or account workspaces; (c) Provider's internal systems, databases, or administrative interfaces; or (d) any systems, networks, or data accessible through the Platform that Subscriber is not authorized to access.

5. Impersonation

Impersonating any person or entity, including but not limited to Provider, its employees, another Subscriber, a government official, a healthcare regulatory authority, or any licensed healthcare professional; or falsely stating or otherwise misrepresenting Subscriber's affiliation with any person or entity.

6. Fraud and Deceptive Practices

Any activity constituting fraud, deception, or material misrepresentation, including but not limited to: (a) phishing or social engineering; (b) creation of fraudulent credentials, certifications, or licenses; (c) bait-and-switch tactics in marketing healthcare services; (d) material misrepresentation of services offered, qualifications held, or outcomes achieved; or (e) any scheme to defraud patients, payors, or government programs.

B. Healthcare-Specific Prohibitions

Given the healthcare-focused nature of the Platform and the regulatory obligations incumbent upon NP/APRN Subscribers, the following additional prohibitions apply:

1. Unauthorized PHI Handling Without BAA

Subscriber shall not input, store, transmit, or process Protected Health Information ("PHI") as defined under the Health Insurance Portability and Accountability Act of 1996, as amended ("HIPAA"), 45 C.F.R. Parts 160 and 164, through the Platform unless and until: (a) a Business Associate Agreement ("BAA") has been duly executed between Provider and Subscriber; (b) Subscriber has implemented all minimum required administrative, technical, and physical safeguards as specified in the BAA; and (c) Subscriber has verified that its use case falls within the permitted uses and disclosures set forth in the BAA.

2. Prohibition on PHI in AI Features

Subscriber shall not input, paste, upload, or otherwise introduce any PHI, individually identifiable health information, or patient data into any artificial intelligence, machine learning, chatbot, or automated content generation features of the Platform (collectively, "AI Features"), including but not limited to: (a) AI-powered content generators; (b) automated workflow builders that process patient data; (c) chatbot or conversational AI interfaces; and (d) any third-party AI integrations accessible through the Platform. Subscriber acknowledges that AI Features may not maintain the same level of data protection as HIPAA-compliant components of the Platform, and that the introduction of PHI into AI Features may constitute an unauthorized disclosure under HIPAA.

3. No Facilitation of Unlicensed Practice

Subscriber shall not use the Platform to: (a) facilitate the practice of medicine, nursing, or any other healthcare profession by any individual who does not hold a current, valid, unrestricted license in the applicable jurisdiction; (b) enable any person to hold themselves out as a licensed healthcare professional when they are not; (c) allow unlicensed staff to perform clinical functions beyond their authorized scope through Platform workflows; or (d) circumvent collaborative practice agreement or supervisory requirements applicable under state law.

4. HIPAA Compliance Requirements

Subscriber shall at all times maintain compliance with HIPAA and the Health Information Technology for Economic and Clinical Health Act ("HITECH Act"), 42 U.S.C. §§ 17921 et seq., including but not limited to: (a) implementing the minimum necessary standard for all PHI accessed through the Platform; (b) maintaining appropriate access controls and audit logs; (c) conducting regular risk assessments of Platform-related workflows; (d) providing HIPAA training to all workforce members who access the Platform; (e) maintaining breach notification procedures consistent with 45 C.F.R. Part 164, Subpart D; and (f) ensuring all patient communications through the Platform comply with applicable privacy requirements.

5. No False Clinical Claims

Subscriber shall not use the Platform to make, publish, or distribute: (a) false or misleading claims regarding clinical outcomes, cure rates, or treatment efficacy; (b) guarantees of specific health outcomes; (c) testimonials that are fabricated, materially altered, or unrepresentative of typical results without appropriate disclaimers; (d) claims that a treatment or service is FDA-approved when it is not; or (e) any clinical claim that is not supported by competent and reliable scientific evidence as required by the Federal Trade Commission ("FTC") Health Products Compliance Guidance.

6. State Telehealth Compliance

Subscriber shall not use the Platform to provide or facilitate telehealth services in any manner that violates applicable state telehealth laws, including but not limited to: (a) providing telehealth services in states where Subscriber does not hold an active license or privilege to practice; (b) failing to comply with state-specific informed consent requirements for telehealth; (c) violating state requirements regarding initial in-person visits where mandated; (d) failing to establish a proper provider-patient relationship as required by applicable state law; (e) prescribing controlled substances via telehealth in violation of the Ryan Haight Online Pharmacy Consumer Protection Act, 21 U.S.C. § 829(e), or applicable DEA regulations; or (f) failing to comply with state-specific telehealth technology and documentation requirements.

7. Scope of Practice Limitations

Subscriber shall not use the Platform to engage in, facilitate, or advertise any clinical services that exceed Subscriber's authorized scope of practice under applicable state nurse practice acts, collaborative practice agreements, or other governing authority. Subscriber acknowledges that NP/APRN scope of practice varies by state and that Subscriber is solely responsible for ensuring all clinical activities conducted through or advertised on the Platform fall within Subscriber's authorized scope.

C. Communications Prohibitions

The Platform provides communications functionality including SMS/MMS messaging, voice calling, and email capabilities. Subscriber shall comply with all applicable communications laws, including the following specific requirements:

1. Telephone Consumer Protection Act (TCPA) Compliance

Subscriber shall comply with the Telephone Consumer Protection Act, 47 U.S.C. § 227, and all implementing regulations of the Federal Communications Commission ("FCC"), including 47 C.F.R. Part 64, as follows:

(a) Marketing Communications. Prior to sending any marketing or promotional communication via SMS, MMS, or automated voice call, Subscriber shall obtain prior express written consent from each recipient in compliance with 47 C.F.R. § 64.1200(a)(2). Such consent must: (i) be in writing (which may be electronic); (ii) bear the signature of the consenting party (which may be electronic); (iii) clearly authorize the specific seller to deliver marketing messages; (iv) include the telephone number to which calls or texts may be made; (v) not be a condition of purchasing any good or service; and (vi) include a clear and conspicuous disclosure that the recipient will receive marketing messages and that consent is not required for purchase.

(b) Informational/Transactional Communications. Prior to sending any informational or transactional communication (including appointment reminders, prescription notifications, or billing communications) via SMS, MMS, or automated voice call, Subscriber shall obtain prior express consent from each recipient. Such consent may be oral or written but must be documented and retained by Subscriber.

(c) Revocation of Consent. Subscriber shall honor all opt-out requests immediately (and in no event later than ten (10) business days) and shall implement commercially reasonable mechanisms to process opt-out requests received by any reasonable means, including but not limited to the reply keywords "STOP," "UNSUBSCRIBE," "CANCEL," "END," and "QUIT."

2. CAN-SPAM Act Compliance

Subscriber shall comply with the Controlling the Assault of Non-Solicited Pornography and Marketing Act, 15 U.S.C. §§ 7701–7713 ("CAN-SPAM Act"), and all implementing FTC regulations, 16 C.F.R. Part 316, including:

(a) Unsubscribe Mechanism. Every commercial email message shall include a clear, conspicuous, and functional mechanism for recipients to opt out of future commercial messages. Opt-out requests must be honored within ten (10) business days.

(b) Accurate Header Information. The "From," "To," "Reply-To," and routing information in all email messages must be accurate and identify the person or entity who initiated the message.

(c) No Deceptive Subject Lines. Subject lines must not be misleading and must accurately reflect the content of the message body.

(d) Identification as Advertisement. Where required, commercial emails must be clearly and conspicuously identified as advertisements and must include the sender's valid physical postal address.

3. Consent Documentation Requirements

Subscriber shall maintain records of all consent obtained for communications, including: (a) the date, time, and method by which consent was obtained; (b) the specific language of the consent disclosure presented to the consumer; (c) the telephone number or email address for which consent was granted; (d) the identity of the consenting party; and (e) any revocation of consent, including the date and method of revocation. Such records shall be retained for a minimum of five (5) years from the date consent was obtained or revoked, whichever is later.

4. Prohibited Content in Communications

Subscriber shall not transmit through the Platform any communication that: (a) contains false or misleading health claims; (b) promotes controlled substances or prescription medications in violation of applicable law; (c) includes PHI of a patient directed to a recipient other than that patient without proper authorization; (d) constitutes unsolicited commercial communication (spam); (e) contains malware, phishing links, or deceptive URLs; or (f) violates any carrier-imposed content standards applicable to A2P messaging.

5. A2P 10DLC Registration Requirements

Subscriber shall comply with all Application-to-Person ("A2P") 10-digit long code ("10DLC") registration requirements imposed by The Campaign Registry ("TCR"), wireless carriers, and Provider, including: (a) registering Subscriber's brand with TCR; (b) registering all messaging campaigns with accurate use case descriptions; (c) providing truthful information regarding message volume, content, and opt-in methods; (d) maintaining compliance with registered campaign parameters; and (e) promptly updating registration information upon any material change. Failure to complete or maintain proper A2P 10DLC registration may result in message filtering, blocking, or suspension of messaging capabilities.

6. Do-Not-Call Registry Compliance

Subscriber shall comply with the National Do-Not-Call Registry, 47 C.F.R. § 64.1200(c), and all applicable state do-not-call registries, including: (a) scrubbing all outbound calling and texting lists against the National DNC Registry at least every thirty-one (31) days; (b) maintaining an internal do-not-call list and honoring all requests to be placed on such list; (c) complying with state-specific DNC requirements in each state where recipients are located; and (d) maintaining records of DNC compliance for a minimum of five (5) years.

D. Technical Prohibitions

Subscriber shall not, and shall not permit any third party to, engage in any of the following technical activities:

1. Reverse Engineering

Reverse engineering, decompiling, disassembling, or otherwise attempting to derive the source code, underlying algorithms, data structures, or architecture of the Platform or any component thereof, except to the limited extent that such restriction is expressly prohibited by applicable law notwithstanding a contractual obligation to the contrary.

2. Competitive Use

(a) Benchmarking. Using the Platform or any performance data, response times, uptime statistics, or other operational metrics derived from Platform use to create, publish, or distribute any benchmark or comparison study without Provider's prior written consent.

(b) Building Competing Products. Using the Platform, its documentation, APIs, or any knowledge gained through access to the Platform to develop, enhance, or market any product or service that competes with the Platform or any of Provider's offerings. For purposes of this subsection, "competes" includes any healthcare SaaS platform, patient engagement platform, or healthcare marketing automation tool.

(c) Resale or Sublicensing. Reselling, sublicensing, or otherwise providing access to the Platform to any third party except as expressly authorized under the Agreement.

3. Security Circumvention

Circumventing, disabling, or otherwise interfering with any security features, access controls, authentication mechanisms, encryption, or technological protection measures of the Platform, including but not limited to: (a) bypassing multi-factor authentication; (b) exploiting session management vulnerabilities; (c) escalating privileges beyond those assigned; or (d) circumventing IP-based access restrictions.

4. Scraping and Crawling

Using any automated means, including bots, crawlers, scrapers, spiders, or data mining tools, to access, collect, harvest, or extract data from the Platform, except through APIs expressly provided and authorized by Provider for such purpose and within documented rate limits.

5. Malware Distribution

Uploading, transmitting, or distributing through the Platform any virus, worm, Trojan horse, ransomware, spyware, adware, keylogger, rootkit, or other malicious software or code designed to: (a) damage, disable, or impair any computer system or data; (b) surreptitiously intercept or expropriate data; (c) encrypt data for ransom; or (d) provide unauthorized remote access.

6. Unauthorized Load Testing

Conducting any load testing, stress testing, penetration testing, vulnerability scanning, or similar activity against the Platform or its infrastructure without Provider's prior written authorization. Authorized testing must be conducted only during agreed-upon windows, with agreed-upon parameters, and in coordination with Provider's technical team.

7. Unauthorized API Use

Accessing, using, or interfacing with the Platform's application programming interfaces ("APIs") in any manner not expressly authorized in the Agreement or Provider's API documentation, including but not limited to: (a) using undocumented or internal APIs; (b) accessing deprecated API endpoints; (c) using API keys or credentials belonging to another Subscriber; or (d) making API calls from unauthorized applications or environments.

8. Exceeding Rate Limits

Exceeding any published or documented rate limits, usage quotas, storage limits, or other quantitative restrictions applicable to Subscriber's subscription tier, whether through direct access, API calls, or automated processes. Subscriber shall implement appropriate throttling, queuing, or retry-with-backoff mechanisms to prevent inadvertent rate limit violations.

9. Circumventing Usage Limits

Attempting to circumvent, bypass, or manipulate any usage limits, subscription tier restrictions, or metering mechanisms through any means, including but not limited to: (a) creating multiple accounts to aggregate limits; (b) manipulating timestamps, counters, or usage records; (c) exploiting billing cycle boundaries; or (d) using technical measures to avoid accurate metering of resource consumption.

E. Anti-Kickback and Referral Compliance

Subscriber acknowledges that as a healthcare provider, Subscriber is subject to federal and state laws governing financial relationships among healthcare providers and entities. Subscriber shall not use the Platform in any manner that violates the following:

1. Federal Anti-Kickback Statute

Subscriber shall not use the Platform to knowingly and willfully solicit, receive, offer, or pay any remuneration (including any kickback, bribe, or rebate), directly or indirectly, overtly or covertly, in cash or in kind, in exchange for or to induce: (a) the referral of an individual for the furnishing of any item or service payable under a Federal health care program; or (b) the purchasing, leasing, ordering, or arranging for any good, facility, service, or item payable under a Federal health care program, in violation of the Anti-Kickback Statute, 42 U.S.C. § 1320a-7b(b).

Without limiting the foregoing, Subscriber shall not use the Platform's referral tracking, affiliate marketing, or revenue-sharing features in any manner that would constitute illegal remuneration for patient referrals involving services payable by Medicare, Medicaid, TRICARE, or any other Federal health care program.

2. Stark Law (Physician Self-Referral Law)

To the extent applicable to Subscriber's practice (including where Subscriber practices under physician supervision or in a group practice with physicians), Subscriber shall not use the Platform to facilitate any referral for designated health services ("DHS") to an entity with which Subscriber or a member of Subscriber's immediate family has a financial relationship, unless such referral falls within a recognized exception under the Stark Law, 42 U.S.C. § 1395nn, and its implementing regulations at 42 C.F.R. Part 411, Subpart J.

3. State Referral and Fee-Splitting Laws

Subscriber shall not use the Platform to engage in any patient referral arrangement, fee-splitting agreement, or payment for referrals that violates applicable state anti-kickback statutes, fee-splitting prohibitions, or patient brokering laws. Subscriber acknowledges that many states have anti-kickback and referral laws that are broader than federal law and may apply regardless of payor source.

4. No Facilitation of Illegal Referral Arrangements

Subscriber shall not use any feature of the Platform—including but not limited to automated workflows, referral tracking, commission calculation, affiliate link generation, or revenue-sharing dashboards—to structure, facilitate, track, or conceal any referral arrangement that violates federal or state anti-kickback, self-referral, or fee-splitting laws. This prohibition applies regardless of whether the arrangement involves Federal health care program patients.

F. Content Standards

All content created, published, or distributed by Subscriber through the Platform, including but not limited to website content, landing pages, email campaigns, SMS messages, social media posts, blog articles, and patient-facing materials, shall comply with the following standards:

1. Accuracy and Truthfulness

All content shall be accurate, truthful, and not misleading. Claims regarding Subscriber's qualifications, experience, services, outcomes, or affiliations shall be verifiable and substantiated. Subscriber shall promptly correct or remove any content that is or becomes inaccurate.

2. Non-Misleading

Content shall not create false impressions regarding: (a) the nature, characteristics, or quality of services offered; (b) Subscriber's qualifications, credentials, or licensure status; (c) expected outcomes or results of treatment; (d) pricing, costs, or financial obligations; (e) insurance acceptance or coverage; or (f) the relationship between Subscriber and Provider or the Platform.

3. No Defamatory Content

Subscriber shall not publish or distribute content that is defamatory, libelous, or slanderous toward any individual or entity, including but not limited to other healthcare providers, competitors, payors, or regulatory authorities.

4. Third-Party Intellectual Property Rights

Subscriber shall not publish or distribute through the Platform any content that infringes, misappropriates, or violates the intellectual property rights of any third party, including copyrights, trademarks, trade secrets, patents, rights of publicity, or rights of privacy. Subscriber represents and warrants that it holds all necessary rights, licenses, and permissions for all content published through the Platform.

5. Healthcare Advertising Compliance

All advertising and marketing content for healthcare services shall comply with: (a) FTC Act, 15 U.S.C. § 45, prohibitions on unfair or deceptive acts or practices; (b) FTC Health Products Compliance Guidance regarding substantiation of health claims; (c) applicable state advertising regulations for healthcare professionals, including state medical board and nursing board advertising rules; (d) state consumer protection statutes; (e) CMS marketing guidelines where applicable to services reimbursed by Federal health care programs; and (f) any specialty-specific advertising standards promulgated by applicable professional organizations or credentialing bodies.

6. Patient Testimonials and Reviews

Where Subscriber solicits, publishes, or utilizes patient testimonials or reviews through the Platform, Subscriber shall: (a) obtain proper HIPAA authorization before publishing any testimonial that contains or could reveal PHI; (b) comply with FTC Endorsement Guides, 16 C.F.R. Part 255, including disclosure of any material connections; (c) not fabricate, materially alter, or selectively publish reviews in a manner that creates a misleading impression; (d) include appropriate disclaimers where results are not typical; and (e) comply with applicable state laws governing patient testimonials in healthcare advertising.

G. Enforcement and Graduated Response

Provider takes violations of this AUP seriously and will respond to confirmed or suspected violations in a manner proportionate to the severity of the violation, the risk of harm, and Subscriber's compliance history. Provider reserves the right, in its sole discretion, to take any of the following enforcement actions:

1. Graduated Response Framework

Step 1 — Warning and Education. For first-time, minor, or inadvertent violations, Provider may issue a written warning to Subscriber identifying the violation, explaining the applicable policy, and providing guidance on how to achieve compliance. Subscriber shall have fourteen (14) calendar days from receipt of such warning to cure the violation and confirm corrective action in writing.

Step 2 — Feature Restriction. If Subscriber fails to cure a violation after warning, or if the violation involves a specific Platform feature, Provider may restrict or disable Subscriber's access to the specific feature(s) implicated in the violation while maintaining access to other Platform functionality. Provider shall notify Subscriber in writing of any feature restriction, the reason therefor, and the conditions for restoration.

Step 3 — Temporary Suspension. For repeated violations, material violations, or violations that pose an imminent risk of harm, Provider may temporarily suspend Subscriber's access to the Platform in whole or in part. Temporary suspension shall not exceed thirty (30) calendar days unless extended by mutual agreement or as required by law. During suspension, Subscriber's data shall be preserved but inaccessible. Subscriber shall remain responsible for all fees during any suspension resulting from Subscriber's AUP violation.

Step 4 — Termination. For severe violations, repeated violations after prior enforcement action, or violations that expose Provider to material legal liability, Provider may terminate the Agreement and Subscriber's access to the Platform in accordance with the termination provisions of the Agreement. Upon termination for AUP violation, the data retrieval and transition provisions of the Agreement shall apply, subject to any legal holds or preservation obligations.

Step 5 — Reporting to Authorities. Where Provider reasonably determines that a violation involves conduct that is illegal or poses a risk to patient safety or public health, Provider may report such violation to the appropriate authorities, including but not limited to: (a) the U.S. Department of Health and Human Services, Office for Civil Rights ("HHS OCR") for HIPAA violations; (b) the Federal Communications Commission ("FCC") for TCPA violations; (c) the Federal Trade Commission ("FTC") for deceptive practices or CAN-SPAM violations; (d) applicable state licensing boards for scope of practice or licensure violations; (e) the Drug Enforcement Administration ("DEA") for controlled substance violations; or (f) state attorneys general for consumer protection violations.

2. Provider's Discretion

The graduated response framework set forth above is intended as a general guide and does not create any obligation on the part of Provider to follow any particular sequence of enforcement actions. Provider reserves the right, in its sole and absolute discretion, to determine which enforcement action is appropriate under the circumstances, taking into account the nature and severity of the violation, the risk of harm to patients or third parties, Subscriber's compliance history, and any other factors Provider deems relevant.

3. Immediate Action for Severe Violations

Notwithstanding the graduated response framework, Provider may immediately suspend or terminate Subscriber's access without prior warning for violations that: (a) pose an imminent risk to patient safety; (b) involve actual or suspected HIPAA breaches affecting patient PHI; (c) constitute illegal activity, including healthcare fraud; (d) expose Provider to material legal liability; (e) threaten the security or integrity of the Platform or other Subscribers' data; (f) involve law enforcement requests or legal process; or (g) constitute willful, egregious, or repeated violations demonstrating a pattern of non-compliance.

4. Appeal Process

Subscriber may appeal any enforcement action by submitting a written appeal to Provider within fifteen (15) calendar days of receiving notice of the enforcement action. The appeal shall include: (a) a detailed explanation of why Subscriber believes the enforcement action is unwarranted or disproportionate; (b) any evidence supporting Subscriber's position; and (c) a description of corrective measures Subscriber has taken or proposes to take. Provider shall review the appeal and issue a written determination within thirty (30) calendar days of receipt. Provider's determination on appeal shall be final and binding, except that Subscriber retains all rights under the dispute resolution provisions of the Agreement.

5. Cooperation

Subscriber shall cooperate fully with Provider in connection with any investigation of a suspected AUP violation, including providing timely access to relevant records, logs, communications, and personnel. Failure to cooperate with a Provider investigation shall itself constitute a violation of this AUP.

6. No Waiver

Provider's failure to enforce any provision of this AUP at any time shall not constitute a waiver of such provision or of Provider's right to enforce such provision at any later time. Provider's decision not to take enforcement action with respect to a particular violation shall not preclude Provider from taking enforcement action with respect to the same or similar violations in the future.

PART XII: CONTACT INFORMATION

All notices, requests, and communications under this Agreement shall be directed to the following:

Provider Contact Information

Legal Entity Name: Sancta, LLC

Doing Business As (d/b/a): www.mysancta.io

Principal Business Address: 2240 W. Woolbright Road, Suite 304, Boynton Beach, FL 33426

Email for Legal Notices: [email protected]

Email for Support: [email protected]

Email for Privacy Inquiries: [email protected]

Telephone: 1-866-773-1733

Website: www.mysancta.io

Notice Requirements

All legal notices required or permitted under this Agreement shall be in writing and shall be deemed duly given: (a) upon delivery, if delivered personally; (b) upon confirmation of receipt, if sent by email to the Email for Legal Notices address set forth above; (c) one (1) business day after deposit with a nationally recognized overnight courier service, prepaid; or (d) three (3) business days after deposit in the United States mail, postage prepaid, certified mail, return receipt requested, addressed to the applicable party at the address set forth above or such other address as such party may designate by written notice.

Subscriber's contact information for notices shall be as set forth in Subscriber's account registration or as subsequently updated by Subscriber through the Platform's account settings. Subscriber shall maintain current and accurate contact information at all times. Failure to maintain current contact information shall not relieve Subscriber of any obligation under this Agreement or delay the effectiveness of any notice properly sent to the last known address.