HealthPlanIQ, Inc.

PART A — CERTIFICATIONS

By accepting these Terms and Certification and uploading a file to the HPIQ Platform, the person uploading (the “Accepting Individual”) accepts these Direct Upload Terms and Certification (these “Terms”) on behalf of the plan sponsor identified in the HPIQ Platform account (the “Plan Sponsor”) and each group health plan whose data is uploaded (each, a “Plan”), and certifies each statement as of the moment of each upload.

- I am an officer or employee of the Plan Sponsor, I am authorized to act for the Plan Sponsor and the Plan, and I am acting in a fiduciary capacity for the Plan to the extent these Terms call for the exercise of fiduciary discretion. I am not a broker, consultant, adviser, or other third party uploading on the Plan Sponsor's behalf.

- The Plan Sponsor has the authority to disclose the Plan's data to HealthPlanIQ, Inc. for the uses described in these Terms, and no agreement with any service provider of the Plan prohibits that disclosure.

- The file contains no direct participant identifiers: no participant, beneficiary, or dependent name, Social Security number, member or subscriber identification number, street address, telephone number, electronic mail address, or date of birth.

- THE FILE CONTAINS NO PROTECTED HEALTH INFORMATION. It is de-identified in accordance with 45 C.F.R. § 164.514(b), or it is summary health information as defined in 45 C.F.R. § 164.504(a), or it is plan-level information (such as contracts, fee schedules, invoices, and plan documents) that does not relate to any individual.

- I have read Part B, including Section 4.C on the Benchmark Database and Section 5 on artificial intelligence, and the Plan Sponsor agrees to these Terms.

PART B — TERMS

These Terms are between HealthPlanIQ, Inc., a corporation with its principal place of business at 14887 Bal Moral Lane #105, Delray Beach, Florida 33446 (“HPIQ”), and the Plan Sponsor. They take effect on the Plan Sponsor's first acceptance (the “Effective Date”) and apply to every file the Plan Sponsor uploads to the HPIQ Platform. HPIQ and the Plan Sponsor may be referred to collectively as the “Parties” and individually as a “Party.” THESE TERMS CONTAIN A BINDING ARBITRATION PROVISION AND A CLASS ACTION WAIVER IN SECTION 12.C.

DEFINITIONS
WHO MAY UPLOAD
1. Plan Sponsor only.
2. Authority.
3. Legal basis.
WHAT MAY BE UPLOADED
1. Formats.
2. No direct participant identifiers.
3. No Protected Health Information.
4. Inadvertent Protected Health Information.
5. Plan documents and state law.
HOW HPIQ USES UPLOADED DATA
1. Platform access and Reports.
2. De-identification and aggregation.
3. Benchmark Database — please read carefully.
4. Dual anonymity.
5. Service operation.
6. Ownership of Uploaded Data.
ARTIFICIAL INTELLIGENCE: DISCLOSURE AND APPROVAL
1. Disclosure.
2. Limits; human review; no training.
3. Approval.
BENCHMARK METHODOLOGY; USE RESTRICTIONS
1. Suppression policy.
2. Use restrictions.
RESPONSIBILITY FOR UPLOADED DATA
1. Reliance.
2. Indemnification.
NO ADVICE; NO FIDUCIARY STATUS
SAFEGUARDS; CONFIDENTIALITY; HOSTING
1. Safeguards.
2. Hosting; subcontractors.
3. Confidentiality.
TERM; DELETION; SURVIVAL
1. Term.
2. Deletion of Uploaded Data.
3. Survival.
DISCLAIMER; LIMITATION OF LIABILITY
1. Disclaimer.
2. Limitation of liability.
3. Time limit to claim breach.
GENERAL TERMS
1. Notices.
2. Governing law.
3. Dispute resolution; arbitration; class waiver.
4. Amendment; re-acceptance.
5. Platform license; acceptable use.
6. Relationship to other agreements; order of precedence.
7. Entire agreement; no third-party beneficiaries.
8. Assignment; severability; waiver; force majeure; relationship.
9. Electronic acceptance; acceptance record.
10. Advice of counsel; interpretation.

A. “Benchmark Database” means the compilation of De-Identified Data derived from Uploaded Data and from data contributed by other HPIQ clients and data partners, together with the statistics, benchmarks, groupings, models, and analyses HPIQ derives from that compilation.

B. “Data Requirements” means the HealthPlanIQ Data Requirements, the versioned specification HPIQ maintains describing the data elements, file formats, and de-identification standards for Uploaded Data. The Data Requirements are referenced by these Terms but are not incorporated into them.

C. “De-Identified Data” means information that (i) does not identify any individual and with respect to which there is no reasonable basis to believe the information can be used to identify an individual, determined in accordance with 45 C.F.R. § 164.514(b), and (ii) cannot reasonably be associated with the Plan Sponsor, any Plan, or any other contributing plan, employer, or data partner (“dual anonymity”).

D. “HIPAA” means the Health Insurance Portability and Accountability Act of 1996, Pub. L. No. 104-191, 110 Stat. 1936, and the regulations promulgated under it at 45 C.F.R. Parts 160 and 164, each as amended.

E. “HPIQ Platform” means the web-based application, portal, and related services HPIQ makes available to the Plan Sponsor, including any successor or replacement platform.

F. “Protected Health Information” has the meaning given in 45 C.F.R. § 160.103.

G. “Reports” means the benchmarking analyses and other outputs HPIQ generates from Uploaded Data and the Benchmark Database and makes available to the Plan Sponsor, including the Consolidated Health Plan Cost Benchmarking Report and the Individual Plan report, together with the versioned legal matter HPIQ includes in each Report (the “Report Disclosures”).

H. “Uploaded Data” means all data and information the Plan Sponsor uploads to the HPIQ Platform, in any form or medium, including eligibility and enrollment data; medical, pharmacy, and behavioral health claims and encounter data in de-identified or summary form; network and carrier contract terms and rates; administrative, access, and service fees; pharmacy benefit manager terms, spreads, and rebates; broker and consultant compensation; stop-loss premiums, factors, and terms; and plan documents, invoices, and fee schedules.

Only the Plan Sponsor, acting through an officer or employee who is authorized to bind it and to act for the Plan, may accept these Terms and upload Uploaded Data. A broker, consultant, adviser, administrator, or other third party may not accept these Terms or upload on the Plan Sponsor's behalf, and HPIQ may reject any upload it reasonably believes was made by a person other than the Plan Sponsor.

The Plan Sponsor represents and warrants, on the Effective Date and again on each upload, that (i) it is the sponsor of each Plan whose data is uploaded; (ii) the Accepting Individual is duly authorized to bind the Plan Sponsor and to act with respect to each Plan, and is acting in a fiduciary capacity with respect to each Plan to the extent these Terms call for the exercise of fiduciary discretion; (iii) the Plan Sponsor holds the authority to disclose the Uploaded Data to HPIQ for the uses described in Section 4, and no agreement with any Plan service provider prohibits that disclosure; and (iv) these Terms constitute the Plan Sponsor's legal, valid, and binding obligation.

Section 404(a)(1) of the Employee Retirement Income Security Act of 1974, as amended (“ERISA”), 29 U.S.C. § 1104(a)(1), requires each Plan fiduciary to evaluate the reasonableness of the compensation paid to the Plan's service providers and the cost and quality of the health care purchased with Plan assets, which requires access to the Plan's own data. Section 201 of Division BB of the Consolidated Appropriations Act, 2021, codified at ERISA § 724, 29 U.S.C. § 1185m, prohibits agreements that restrict a group health plan from accessing its de-identified claims and encounter data or sharing it with a business associate. Nothing in these Terms restricts the Plan Sponsor's or any Plan's own access to its data.

Uploaded Data must conform to the then-current Data Requirements. HPIQ may reject, return, or request re-submission of any file that does not.

Uploaded Data must not contain participant, beneficiary, or dependent names, Social Security numbers, member or subscriber identification numbers, street addresses, telephone numbers, electronic mail addresses, or dates of birth. The Plan Sponsor will remove or mask these fields before upload as the Data Requirements describe.

DO NOT UPLOAD PROTECTED HEALTH INFORMATION. The HPIQ Platform's direct-upload path is designed to receive only De-Identified Data, summary health information within the meaning of 45 C.F.R. § 164.504(a), and plan-level documents that do not relate to any individual. HPIQ is not a business associate of the Plan under these Terms, and no business associate agreement is in effect on this path. If the Plan Sponsor wishes to provide Protected Health Information, it must contact HPIQ and execute HPIQ's Business Associate Agreement before doing so; the upload control does not accept it.

If either Party discovers that Protected Health Information has been uploaded, that Party will notify the other promptly. HPIQ will quarantine the affected file, will not process it for any purpose other than remediation, and will, at the Plan Sponsor's election within ten (10) business days after notice, either securely destroy the file or hold it unprocessed pending execution of HPIQ's Business Associate Agreement, after which HPIQ may process it as that agreement permits. If the Plan Sponsor makes no election within that period, HPIQ will securely destroy the file. Neither the discovery nor the remediation is a waiver of any right or remedy of either Party, and the Plan Sponsor remains responsible under Section 7 for the upload.

Where Uploaded Data includes summary health information disclosed to the Plan Sponsor by a Plan, the Plan Sponsor is responsible for ensuring that the disclosure to it was permitted under 45 C.F.R. § 164.504(f). The Plan Sponsor acknowledges that certain state laws governing consumer health data may apply to data that is not Protected Health Information; HPIQ maintains a consumer health data privacy notice addressing those laws on the HPIQ website.

The Plan Sponsor acknowledges and agrees that HPIQ may use Uploaded Data in the following ways, and in no others:

To make Uploaded Data available to the Plan Sponsor through the HPIQ Platform, and to generate, deliver, and support Reports for the Plan Sponsor.

To create De-Identified Data from Uploaded Data in accordance with 45 C.F.R. § 164.514(b), to aggregate it with data contributed by other HPIQ clients and data partners, and to cleanse the aggregated data so that it does not identify any individual and cannot reasonably be associated with the Plan Sponsor, any Plan, or any other contributor.

To include De-Identified Data in the Benchmark Database. DE-IDENTIFIED DATA AND THE BENCHMARK DATABASE ARE AND REMAIN THE SOLE AND EXCLUSIVE PROPERTY OF HPIQ, constitute HPIQ's intellectual property and confidential information, and may be used, reproduced, distributed, and disclosed by HPIQ in its sole discretion during and after the term of these Terms. To the extent any right in De-Identified Data or the Benchmark Database would not vest in HPIQ, the Plan Sponsor grants HPIQ a perpetual, irrevocable, worldwide, royalty-free, fully paid, transferable, and sublicensable license to use, reproduce, modify, distribute, and disclose it for any purpose consistent with these Terms. THESE RIGHTS ARE PERPETUAL AND SURVIVE DELETION OF UPLOADED DATA, TERMINATION OF THESE TERMS, AND TERMINATION OF THE PLAN SPONSOR'S RELATIONSHIP WITH HPIQ. The Plan Sponsor acknowledges that this survival is a material condition of HPIQ's provision of Reports: benchmarks must be capable of being reproduced, re-validated, and compared over time, and the removal of contributed data would compromise the integrity of benchmarks already delivered to the Plan Sponsor and to others.

HPIQ will not disclose, and will design the Benchmark Database and every Report so as not to permit the derivation of, (i) the identity of any individual, or (ii) the identity of the Plan Sponsor, any Plan, or any other contributing plan, employer, or data partner in connection with any statistic. HPIQ will not attempt to re-identify any individual or contributor, and will not permit any recipient of a Report to do so.

To operate, secure, troubleshoot, and improve the HPIQ Platform and HPIQ's services, and to comply with applicable law and legal process.

As between the Parties, the Plan Sponsor owns Uploaded Data and is solely responsible for it, subject to the rights granted to HPIQ in this Section 4, and except to the extent Uploaded Data is transformed into De-Identified Data.

HPIQ uses artificial intelligence and machine learning tools, including third-party large language models accessed through commercial application programming interfaces, to read, summarize, extract terms from, and classify documents and data that inform Reports, including administrative services agreements, carrier and network contracts, pharmacy benefit manager agreements, stop-loss policies, broker and consultant compensation disclosures, plan documents, invoices, and fee schedules.

HPIQ does not submit Protected Health Information to any artificial intelligence tool and does not use artificial intelligence to process individual-level claims data; processing is limited to plan-level documents and De-Identified Data. No Report is issued, and no output of an artificial intelligence tool is presented as a finding, without review by qualified HPIQ personnel, and HPIQ remains responsible for the content of each Report. HPIQ contracts with its artificial intelligence vendors on terms that prohibit the use of HPIQ's inputs and outputs to train, fine-tune, or improve the vendor's models, and prohibit retention beyond the period necessary to return a result and satisfy the vendor's abuse-monitoring obligations.

THE PLAN SPONSOR ACKNOWLEDGES THE ARTIFICIAL INTELLIGENCE PROCESSING DESCRIBED IN THIS SECTION 5 AND EXPRESSLY APPROVES AND CONSENTS TO IT AS A CONDITION OF RECEIVING REPORTS. The Plan Sponsor may withdraw this approval at any time by written notice to HPIQ; because the described processing is integral to Report generation, withdrawal terminates HPIQ's obligation to generate further Reports. If HPIQ materially expands the scope of artificial intelligence processing beyond what Section 5.A describes, HPIQ will notify the Plan Sponsor at least thirty (30) days in advance and obtain renewed approval before the change applies to the Plan Sponsor's data.

HPIQ compiles the Benchmark Database and generates every benchmark statistic subject to the following minimum safeguards: (i) no statistic is reported unless it reflects data from at least five (5) independent contributing sources; (ii) no single contributing source accounts for more than twenty-five percent (25%) of the weight of any reported statistic; and (iii) all benchmark statistics are derived from historical data and no benchmark reflects current, forward-looking, or prospective pricing. HPIQ suppresses any statistic that does not satisfy these conditions and marks the suppression in the Report. HPIQ compiles the Benchmark Database independently; no contributor participates in the compilation, weighting, or presentation of statistics or has access to another contributor's data. HPIQ publishes its methodology on the HPIQ website and cites it in the Report Disclosures.

The Plan Sponsor will not use any Report, benchmark, or other HPIQ output to set, coordinate, signal, or align prices, fees, wages, or compensation with any competitor, and will not attempt, or permit any person to whom it furnishes a Report to attempt, to identify or derive the identity of any individual or any contributing plan, employer, or data partner. The Plan Sponsor will not remove, alter, or obscure the Report Disclosures from any Report it redistributes, and will redistribute Reports only as the Report Disclosures permit.

HPIQ is entitled to rely, without independent verification, on the certifications in Part A, the representations in Section 2.B, and the accuracy and completeness of Uploaded Data. Each certification and representation is repeated on each upload and is continuing; the Plan Sponsor will notify HPIQ promptly if any ceases to be accurate.

The Plan Sponsor will indemnify and hold harmless HPIQ and its directors, officers, employees, agents, and affiliates from and against any damages, losses, costs, judgments, fines, penalties, and expenses, including reasonable attorneys' fees and investigation costs, actually incurred in connection with any third-party claim or regulatory proceeding to the extent caused by (i) the inaccuracy of any certification in Part A or representation in Section 2.B; (ii) the upload of direct participant identifiers or Protected Health Information in breach of Section 3; (iii) the Plan Sponsor's breach of Section 6.B; or (iv) the Plan Sponsor's negligence, breach of fiduciary duty, or willful misconduct. HPIQ will notify the Plan Sponsor promptly of any such claim and allow the Plan Sponsor to control its defense, provided that no settlement that involves any remedy other than the payment of money by the Plan Sponsor, or that lacks a complete release of HPIQ, may be made without HPIQ's written consent; if the Plan Sponsor fails to assume or diligently conduct the defense, HPIQ may control it at the Plan Sponsor's cost.

Reports are informational benchmarking analyses. HPIQ does not provide legal, tax, actuarial, investment, medical, or fiduciary advice, and is not retained to do so. HPIQ is not a fiduciary of any Plan within the meaning of ERISA § 3(21) by reason of providing the HPIQ Platform or Reports, and does not exercise discretionary authority or control over any Plan or its assets. The Plan Sponsor and the Plan's fiduciaries retain sole responsibility for all Plan decisions, including decisions informed by a Report. Upon a finding by any court or governmental entity with regulatory authority that HPIQ is in any way a fiduciary within the meaning of ERISA § 3(21), HPIQ may terminate these Terms immediately at its sole discretion.

HPIQ will implement and maintain administrative, physical, and technical safeguards reasonably designed to protect the security, confidentiality, and integrity of Uploaded Data in its possession or control. Current information about HPIQ's security posture is maintained on the Security page of the HPIQ website, which is provided for information only and is not incorporated into these Terms.

The HPIQ Platform is hosted on the Jiffy.ai platform provided by [Hosting Vendor legal name] (the “Hosting Vendor”), which has represented to HPIQ that it maintains a SOC 2 examination of its controls and a hosting environment configured to support HIPAA-regulated workloads. HPIQ furnishes those representations for the Plan Sponsor's information and does not itself audit, warrant, or guarantee the Hosting Vendor's controls; HPIQ does not hold a SOC 2 attestation of its own. HPIQ may engage subcontractors to assist in providing the HPIQ Platform and remains responsible for their performance.

Each Party will treat as confidential all non-public information furnished by the other Party and will not disclose it to any third party except (i) as these Terms permit, (ii) to its personnel, subcontractors, and professional advisers who need it and are bound by comparable obligations, (iii) as required by law or legal process, or (iv) with the furnishing Party's written consent. This Section does not apply to De-Identified Data or the Benchmark Database, which Section 4 governs.

These Terms are effective on the Effective Date and remain in effect until terminated by either Party on written notice, or until superseded as Section 12.F provides. HPIQ may terminate these Terms immediately on the Plan Sponsor's material breach or where continued performance would in HPIQ's reasonable judgment violate applicable law.

The Plan Sponsor may delete Uploaded Data through the HPIQ Platform, or request its deletion, at any time. On deletion or termination, HPIQ will delete or return source Uploaded Data in its possession in a secure manner, except that HPIQ may retain (i) a reasonable number of archival copies and copies retained in routine backup media, (ii) copies required to be retained by applicable law or legal process, (iii) Reports already issued, and (iv) De-Identified Data and the Benchmark Database, which Section 4.C governs. Deletion and termination operate prospectively only and do not affect Reports already issued or De-Identified Data already contributed to the Benchmark Database.

Sections 1, 4.C, 4.D, 6.B, 7, 8, 9.C, 10.B, 11, and 12 survive termination of these Terms, together with any other provision that by its nature is intended to survive.

EXCEPT FOR THE EXPRESS WARRANTIES IN THESE TERMS, HPIQ DISCLAIMS ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING THE IMPLIED WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, AND NON-INFRINGEMENT, AND ANY IMPLIED WARRANTIES ARISING FROM STATUTE OR COURSE OF DEALING. HPIQ DOES NOT WARRANT THE ACCURACY OR COMPLETENESS OF UPLOADED DATA, THAT ANY BENCHMARK IS REPRESENTATIVE OF ANY PARTICULAR PLAN, MARKET, OR COHORT, OR THAT THE HPIQ PLATFORM WILL BE UNINTERRUPTED OR ERROR-FREE.

IN NO EVENT WILL EITHER PARTY, INCLUDING ITS AFFILIATES AND AGENTS, BE LIABLE TO THE OTHER PARTY OR ANY THIRD PARTY FOR ANY INDIRECT, INCIDENTAL, SPECIAL, CONSEQUENTIAL, PUNITIVE, OR EXEMPLARY DAMAGES OF ANY KIND, INCLUDING LOSS OF BUSINESS, LOSS OF GOODWILL, BUSINESS INTERRUPTION, LOSS OF DATA, OR LOSS OF BUSINESS INFORMATION, ARISING OUT OF OR CONNECTED WITH THESE TERMS, EVEN IF THE DAMAGE WAS FORESEEABLE OR THE PARTY WAS ADVISED OF THE POSSIBILITY. EXCEPT FOR THE PLAN SPONSOR'S OBLIGATIONS UNDER SECTION 7.B AND ITS BREACH OF SECTION 6.B, AND EITHER PARTY'S FRAUD OR WILLFUL MISCONDUCT, EACH PARTY'S TOTAL AGGREGATE LIABILITY ARISING OUT OF OR RELATING TO THESE TERMS WILL NOT EXCEED THE TOTAL FEES PAID BY THE PLAN SPONSOR TO HPIQ IN THE TWELVE (12) MONTHS PRECEDING THE DATE THE FIRST CLAIM AROSE. THE PLAN SPONSOR ACKNOWLEDGES THAT NO FEES ARE PAYABLE UNDER THESE TERMS, THAT UNTIL FEES ARE PAID UNDER A SEPARATE AGREEMENT THAT AMOUNT IS ZERO, AND THAT HPIQ ACCORDINGLY HAS NO LIABILITY FOR DAMAGES UNDER THESE TERMS UNTIL SUCH FEES HAVE BEEN PAID. MULTIPLE CLAIMS WILL NOT ENLARGE THIS LIMITATION.

No action arising out of any breach or claimed breach of these Terms may be brought by either Party more than one (1) year after the cause of action accrued. A cause of action accrues when a Party knew or reasonably should have known of the breach or claimed breach.

Notices under these Terms must be in writing and are sufficient if delivered personally, sent by registered or certified mail, return receipt requested and postage prepaid, sent by nationally recognized overnight courier, or sent by electronic mail. Notices to HPIQ go to HealthPlanIQ, Inc., 14887 Bal Moral Lane #105, Delray Beach, Florida 33446, Attn: [__], electronic mail [__]. Notices to the Plan Sponsor go to the address and electronic mail address in its HPIQ Platform account. Notices are deemed given when delivered by hand, courier, or electronic mail, or on the third business day after mailing. HPIQ may also give notice through the HPIQ Platform.

These Terms are governed by and construed in accordance with the laws of the State of Florida, without regard to its conflict of laws principles, except to the extent federal law preempts state law.

Any dispute, action, or controversy between the Parties arising out of or relating to these Terms, the HPIQ Platform, or the Reports will first be addressed by good-faith negotiation. If negotiation does not resolve the dispute within thirty (30) days, the Parties will engage in confidential non-binding mediation before a neutral mediator selected by mutual agreement, with the mediator's fees shared equally; mediation is voluntary once commenced and either Party may withdraw at any time. If the Parties cannot agree on a mediator or cannot resolve the dispute through mediation, the dispute will be settled by confidential binding arbitration in Palm Beach County, Florida, administered by the American Arbitration Association under its Commercial Arbitration Rules, before a single arbitrator unless the amount in controversy exceeds $500,000, in which case before a panel of three arbitrators, one selected by each Party and the third by the two so selected. Judgment on the award may be entered in any court of competent jurisdiction. The arbitrator is bound by Section 11.B and will not award damages excluded by it. IN AGREEING TO ARBITRATION, EACH PARTY GIVES UP THE RIGHT TO SUE IN COURT, INCLUDING THE RIGHT TO A TRIAL BY JURY. DISCOVERY IN ARBITRATION IS GENERALLY MORE LIMITED THAN IN COURT, ARBITRATION AWARDS ARE FINAL AND SUBJECT TO VERY LIMITED JUDICIAL REVIEW, AND THE ARBITRATOR NEED NOT EXPLAIN THE REASONS FOR THE AWARD. NO PARTY MAY BRING A PUTATIVE OR CERTIFIED CLASS, COLLECTIVE, OR REPRESENTATIVE ACTION IN ARBITRATION, AND EACH PARTY WAIVES ANY RIGHT TO PARTICIPATE IN ONE. Nothing in this Section prevents either Party from seeking injunctive or other equitable relief in a court of competent jurisdiction to protect its confidential information or intellectual property. The Plan Sponsor is entitled to keep a copy of these Terms and to request a copy at any time.

HPIQ may revise these Terms from time to time. HPIQ will post the revised Terms and notify the Plan Sponsor by electronic mail or through the HPIQ Platform at least thirty (30) days before the revision takes effect. The Plan Sponsor accepts a revision by confirming the certifications when the revised Terms are presented, or by uploading after the effective date of the revision. If the Plan Sponsor does not accept a revision, its sole remedy is to terminate under Section 10.A. This Section does not apply to the Data Requirements.

HPIQ grants the Plan Sponsor a limited, non-exclusive, non-transferable, revocable right to access and use the HPIQ Platform and Reports for the internal administration of the Plans during the term of these Terms. The HPIQ Platform, the Reports (excluding Uploaded Data appearing in them), the Benchmark Database, and all methodologies, models, software, and documentation HPIQ furnishes or develops are and remain HPIQ's exclusive property. The Plan Sponsor will not reverse engineer, decompile, scrape, or create derivative works from the HPIQ Platform or the Benchmark Database, will not use them to build a competing product or service, and is responsible for the acts and omissions of every person it permits to access its account.

If the Plan Sponsor and HPIQ enter into a platform services or subscription agreement, a Plan Sponsor Data Authorization and Disclosure Agreement, or a Business Associate Agreement, that agreement governs its own subject matter from its effective date, and these Terms continue to govern Uploaded Data uploaded before that date except as the later agreement expressly provides. In the event of a conflict, the following order controls: (i) any Business Associate Agreement between the Parties, as to Protected Health Information; (ii) any platform services or subscription agreement, as to the services and fees; (iii) any Plan Sponsor Data Authorization and Disclosure Agreement; (iv) these Terms; (v) the Report Disclosures; and (vi) the Data Requirements.

These Terms, together with the certifications in Part A and the acceptance record, are the entire agreement between the Parties on their subject matter and supersede all prior or contemporaneous proposals, negotiations, and understandings. These Terms confer no right or benefit on any third party, including Plan participants and beneficiaries, unless applicable law requires otherwise.

The Plan Sponsor may not assign these Terms without HPIQ's prior written consent; HPIQ may assign them to a successor by merger, consolidation, or sale of all or substantially all of its business or assets, or to an affiliate; any attempted assignment in breach of this Section is void, and these Terms bind and benefit the Parties' permitted successors and assigns. The invalidity or unenforceability of any provision does not affect the remaining provisions, and an overbroad provision is to be enforced in reduced form. A failure to assert a right is not a waiver of that right, and no course of dealing or performance modifies these Terms. Neither Party is liable for any delay or failure to perform caused by events beyond its reasonable control, including natural disaster, epidemic, act of government, labor shortage, utility or telecommunications failure, or failure of the Internet, and the affected Party will use commercially reasonable efforts to minimize the effect. Nothing in these Terms creates a joint venture, partnership, agency, or employment relationship, and neither Party may bind the other.

The Plan Sponsor consents to receive communications, notices, and records from HPIQ by electronic means and agrees that these Terms are accepted electronically. A recorded confirmation of the certifications and a subsequent upload have the same legal effect as a handwritten signature under the federal Electronic Signatures in Global and National Commerce Act, 15 U.S.C. § 7001 et seq., and the Florida Uniform Electronic Transaction Act, Fla. Stat. § 668.50. For each acceptance and each upload the HPIQ Platform records the Plan Sponsor's legal name and employer identification number, the Plan name and number, the identity of the Accepting Individual, the date and time, the version of these Terms accepted, the certifications confirmed, and an identifier of the file uploaded, and makes the record retrievable by the Plan Sponsor.

The Plan Sponsor represents that it has had the opportunity to obtain independent legal, tax, and other appropriate advice, has read these Terms, understands their terms and consequences, and has not relied on any inducement, promise, or representation other than those expressly stated. These Terms will be interpreted according to their fair meaning as if prepared by both Parties and will not be construed against either Party as drafter. Headings are for convenience only.

Last Updated: September 5, 2026