Subscription Agreement

Effective 25 October 2026 · Last updated 25 October 2026

This is the agreement between FlourishBx and a subscribing clinician or clinic. It does not govern Protected Health Information — that is the Business Associate Agreement, a separate instrument which prevails as to PHI. Families using the caregiver app are covered by the Caregiver App Terms of Use instead.

FlourishBx Clinician Dashboard

FlourishBx LLC d/b/a FlourishBx

Effective Date: 25 October 2026 Last Updated: 25 October 2026 Version: 1

NOTICE TO THE READER

THIS IS A LEGALLY BINDING AGREEMENT BETWEEN YOU AND FlourishBx LLC GOVERNING YOUR USE OF THE FLOURISHBX CLINICIAN DASHBOARD.

BY EXECUTING AN ORDER FORM, CREATING AN ACCOUNT, OR ACCESSING OR USING THE SERVICE, YOU ACKNOWLEDGE THAT YOU HAVE READ, UNDERSTOOD, AND AGREE TO BE BOUND BY THIS AGREEMENT. IF YOU DO NOT AGREE, DO NOT USE THE SERVICE.

ARTICLE 9 PROVIDES THAT THE COMPANY EXERCISES NO CLINICAL JUDGMENT AND THAT EVERY CLINICAL DECISION IS YOURS. ARTICLE 10 PROVIDES THAT THE SERVICE IS NOT A SAFETY-CRITICAL OR EMERGENCY SYSTEM AND MUST NOT BE RELIED UPON AS ONE. ARTICLE 28 DISCLAIMS WARRANTIES. ARTICLE 30 LIMITS THE COMPANY'S LIABILITY. ARTICLE 32 GOVERNS DISPUTE RESOLUTION AND CONTAINS A ONE-YEAR LIMITATIONS PERIOD.

NO PROTECTED HEALTH INFORMATION MAY BE PLACED IN THE SERVICE BEFORE A BUSINESS ASSOCIATE AGREEMENT HAS BEEN EXECUTED BETWEEN THE PARTIES. SEE ARTICLE 13.

BACKGROUND

A. The Company is a developer and licensor of software intended for use by providers of Applied Behavior Analysis therapy services and by the families such providers serve.

B. The Company makes available a clinician-facing web application by which a provider may maintain client records, define target behaviors and intervention strategies, receive observations recorded by caregivers, and review reports.

C. The Company is not a health care provider, exercises no clinical judgment, and is not a party to the clinical relationship between the Customer and any Client.

D. The Customer wishes to subscribe to the Service, and the Company is willing to provide it, solely on the terms of this Agreement.

NOW, THEREFORE, in consideration of the mutual covenants below, the parties agree as follows.

SUMMARY (NON-BINDING)

Furnished for convenience. Where it differs from Articles 1 through 35, those Articles govern. See Section 34.13.

  • Your data is yours. The Company holds it for you and claims no ownership. Article 12.
  • The Company will not sell de-identified clinical data, and will not train artificial intelligence on it. Contractually, not merely as policy. Article 26.
  • You can export everything, at any time, at no charge — including while suspended for non-payment. Article 21.
  • Every clinical decision is yours. Article 9.
  • THE SERVICE IS NOT A SAFETY OR EMERGENCY SYSTEM. Article 10.
  • Commercial terms live in the Pricing Policy, which forms part of this Agreement. Article 17.
  • A Business Associate Agreement is required before any PHI is entered. Article 13.
  • The Company indemnifies you against third-party claims that the Service infringes intellectual property. Article 29.

ARTICLE 1 — FORMATION AND PARTIES

1.1 Parties

This Subscription Agreement (this "Agreement") is made between FlourishBx LLC, a limited liability company organized and existing under the laws of the State of North Carolina, United States of America, doing business as FlourishBx (the "Company"), and the person or entity subscribing to the Service (the "Customer," "You," or "Your").

1.2 Formation

This Agreement is formed upon the earliest of: the execution of an Order Form by both parties; the creation of an Account; or Your first access to or use of the Service.

1.3 Authority

Where You accept this Agreement on behalf of an entity, You represent and warrant that You have authority to bind that entity, and "Customer," "You" and "Your" refer to that entity.

1.4 Free Plan subscribers are bound

This Agreement binds a Customer on the Free Plan notwithstanding that no Fee is payable. Consideration for the Company's obligations consists in Your covenants under this Agreement and in the Company's commercial interest in the Free Plan. Sections 28.5 and 30.5 modulate the Company's warranties and liability accordingly.

1.5 Record of acceptance

The Company may create and retain a record of the fact, date, time and version of Your acceptance, and may rely upon that record as evidence of it.

ARTICLE 2 — DEFINITIONS

For the purposes of this Agreement the following capitalized terms have the meanings set out below. Capitalized terms used but not defined here have the meanings given in the Pricing Policy.

2.1 "Account" means the Customer's instance of the Service, including all Authorized User accounts within it.

2.2 "Affiliate" means an entity controlling, controlled by, or under common control with a party, "control" meaning ownership of more than fifty percent (50%) of the voting interests.

2.3 "Applicable Law" means each federal, state and local statute, regulation, rule, ordinance, order and binding regulatory guidance of the United States applicable to a party or to the Service.

2.4 "Authorized User" means an individual authorized by the Customer to access the Service under the Customer's Account, being a Clinician, clinic administrator, or other member of the Customer's workforce.

2.5 "BAA" means a Business Associate Agreement satisfying 45 C.F.R. §§ 164.504(e) and 164.314(a).

2.6 "Breach" has the meaning given at 45 C.F.R. § 164.402.

2.7 "Business Associate" and "Covered Entity" have the meanings given at 45 C.F.R. § 160.103.

2.8 "Business Day" means a day other than a Saturday, a Sunday, or a day on which national banking institutions in the State of North Carolina are authorized or required by law to close.

2.9 "Caregiver" means an individual granted access to a Client's record through the FlourishBx Caregiver App.

2.10 "Caregiver App" means the FlourishBx mobile application for parents and caregivers.

2.11 "Client" means an individual receiving services from the Customer about whom a record is maintained in the Service. A Client is a natural person and is ordinarily a minor.

2.12 "Clinician" means a Board Certified Behavior Analyst or other individual holding credentials to the Service and exercising clinical judgment.

2.13 "Confidential Information" has the meaning given at Section 16.1.

2.14 "Customer Data" means all data, records and content submitted to, uploaded to, or generated within the Service by or on behalf of the Customer, by an Authorized User, or by a Caregiver in respect of the Customer's Client, including Client identifiers, diagnoses, clinical notes, behavior definitions, intervention strategies, behavior logs, session documentation and uploaded media. Customer Data excludes Service Data.

2.15 "De-Identified Information" means information meeting the standard at 45 C.F.R. § 164.514(b).

2.16 "Documentation" means the Company's then-current user documentation for the Service.

2.17 "Fees" means the amounts payable under the Pricing Policy and any Order Form.

2.18 "HIPAA" means the Health Insurance Portability and Accountability Act of 1996, Pub. L. No. 104-191, as amended by the HITECH Act, Pub. L. No. 111-5, together with the regulations at 45 C.F.R. Parts 160, 162 and 164.

2.19 "Intellectual Property Rights" means all patent, copyright, trademark, trade dress, trade secret, database, moral and other intellectual or industrial property rights of any kind, whether registered or unregistered, arising anywhere in the world.

2.20 "Order Form" means a document executed by both parties stating the plan, Committed Minimum, price, Term and billing frequency applicable to a Clinic Account.

2.20A "NPPES" means the National Plan and Provider Enumeration System, the public provider registry maintained by the Centers for Medicare & Medicaid Services at npiregistry.cms.hhs.gov.

2.20A1 "BACB" means the Behavior Analyst Certification Board.

2.20A2 "Certificant Number" means the BACB certificant number submitted by a Clinician at registration. A Certificant Number is self-reported and is not verified by the Company. Section 5.2.7 governs.

2.20B "NPI Screening" means the automated check described at Section 5.2, being a comparison of a submitted National Provider Identifier against NPPES. NPI Screening is a screening measure and is not identity verification. Section 5.3 governs.

2.21 "PHI" means Protected Health Information as defined at 45 C.F.R. § 160.103.

2.22 "Pricing Policy" means the FlourishBx Pricing and Billing Policy — Clinician Dashboard, as amended, available at https://getflourishbx.com/pricing-policy.html, which forms part of this Agreement. It names Stripe as the Payment Processor and states how payment, automatic renewal, dunning and chargebacks operate.

2.23 "Privacy Policy" means the FlourishBx Clinician Dashboard Product Privacy Policy, as amended, available at https://getflourishbx.com/dashboard-privacy.html.

2.24 "Security Incident" means the attempted or successful unauthorized access, use, disclosure, modification or destruction of information, or interference with system operations, consistent with 45 C.F.R. § 164.304.

2.25 "Service" means the FlourishBx Clinician Dashboard, together with the Documentation and any updates, and includes the Company's provision of Caregiver App access to Caregivers in respect of the Customer's Clients.

2.26 "Service Data" means data generated by the Company concerning the operation, performance, security and use of the Service which contains no Customer Data, no PHI and no identifier of any Client, Authorized User or Caregiver.

2.27 "Subprocessor" means a third party engaged by the Company to Process Customer Data.

2.28 "Term" has the meaning given at Article 18.

ARTICLE 3 — RULES OF CONSTRUCTION

3.1 Headings are inserted for convenience only and do not affect construction.

3.2 "Including" and "includes" mean "including without limitation."

3.3 "Or" is inclusive unless the context requires otherwise.

3.4 "Must" and "shall" impose a mandatory obligation; "may" confers a discretion.

3.5 Number and gender. The singular includes the plural and vice versa; words of one gender include every gender.

3.6 Statutory references are to the instrument as amended, re-enacted or replaced, and to any subordinate instrument made under it.

3.7 Time. "Days" means calendar days unless "Business Days" is stated. A period ending on a day that is not a Business Day extends to the next Business Day. Time is computed excluding the first day and including the last.

3.8 Currency. All amounts are in United States Dollars.

3.9 Conspicuous text. Text set in capital letters or in bold is intended to be conspicuous within the meaning of N.C. Gen. Stat. § 25-1-201(b)(10). No provision is rendered less binding by the absence of such emphasis.

3.10 No construction against the drafter. Any rule of construction requiring an ambiguity to be resolved against the drafting party does not apply to this Agreement, this Agreement having been negotiated between commercial parties.

3.11 References. A reference to an Article includes each of its Sections.

ARTICLE 4 — THE DOCUMENTS AND ORDER OF PRECEDENCE

4.1 Documents forming this Agreement

This Agreement comprises: these Articles 1 through 35; the Pricing Policy; any Order Form; any BAA executed between the parties; and any Supplemental Terms presented in respect of a particular feature.

4.2 Incorporation of the Pricing Policy

The Pricing Policy is incorporated by reference and forms part of this Agreement. It governs Fees, billing, proration, commitment, suspension for non-payment, cancellation, refunds, plan changes, price changes, and access to Customer Data by Account state. This Agreement does not restate those terms, and Article 17 does no more than direct the reader to them.

4.3 Order of precedence

In the event of an irreconcilable conflict, the following order applies, from highest to lowest:

4.3.1 any mandatory requirement of Applicable Law;

4.3.2 the BAA, as to PHI;

4.3.3 an Order Form executed by both parties, as to the Account it concerns;

4.3.4 Article 19 of the Pricing Policy, as to Clinic Accounts and Invoiced Accounts;

4.3.5 Articles 1 through 21 of the Pricing Policy, as to Fees and billing;

4.3.6 Supplemental Terms, as to the feature they govern;

4.3.7 Articles 1 through 35 of this Agreement;

4.3.8 the Privacy Policy, as to a matter of privacy not governed by the BAA; and

4.3.9 the non-binding Summary appearing above Article 1.

4.3.10 This ordering is deliberately consistent with Section 1.3 of the Pricing Policy. Where the two orderings appear to differ, Section 1.3 of the Pricing Policy governs as to Fees and billing, and this Section 4.3 governs as to everything else.

ARTICLE 5 — ELIGIBILITY AND PROFESSIONAL STANDING

5.1 Customer representations

The Customer represents and warrants, continuously throughout the Term, that:

5.1.1 it is a health care provider, or an individual practitioner, lawfully providing Applied Behavior Analysis or related services;

5.1.2 each Clinician holding credentials to the Service holds the certification, licensure, registration and supervision required by Applicable Law and by the applicable certifying body to perform the services they perform;

5.1.3 it holds all consents, authorizations and legal bases required to place Client information into the Service and to permit the Company to Process it;

5.1.4 it is not excluded from participation in any federal health care program; and

5.1.5 the information it provides to the Company, including any National Provider Identifier and any Certificant Number, is accurate and relates to the Clinician submitting it; and

5.1.6 each Clinician holds a current, unexpired BACB certification which has not been suspended or revoked.

5.2 NPI Screening — what the Company does check

At registration the Company requires a National Provider Identifier and performs the following automated checks. This Section states them exhaustively.

5.2.1 Registry lookup. The submitted identifier is queried against NPPES, the public registry maintained by the Centers for Medicare & Medicaid Services, and the Company confirms that a record exists for it.

5.2.2 Credential comparison. The Company compares the credential recorded in NPPES against the set BCBA, BCBA-D and BCABA, and treats a credential outside that set as not matching.

5.2.3 Name comparison. The Company compares the name submitted at registration against the name recorded in NPPES. Where not less than eighty percent (80%) of the registry name's words appear in the submitted name, the comparison passes.

5.2.4 Outcome. Where the record exists, the credential matches and the name comparison passes, the account is recorded as screened. Where the credential matches but the name comparison only partially succeeds, the account is flagged for manual review by the Company before access is granted. Where neither succeeds, registration does not proceed.

5.2.5 Integrity of the result. The outcome is determined server-side and written by a privileged process. A Customer cannot set it, and a Customer's assertion as to its own screening status is of no effect.

5.2.6 Point in time. NPI Screening is performed once, at registration. Section 5.3.5 governs.

5.2.7 Certificant Number — collected, not checked.

5.2.7.1 The Company requires each Clinician to submit a Certificant Number at registration and records it against the account.

5.2.7.2 THE COMPANY DOES NOT CHECK THE CERTIFICANT NUMBER AGAINST THE BACB REGISTRY OR ANY OTHER SOURCE, EITHER AT REGISTRATION OR THEREAFTER. The BACB publishes its certificant registry as a web search facility with no programmatic interface, and an automated check is accordingly not available to the Company.

5.2.7.3 Purpose. The Certificant Number is collected so that the Company holds the identifier necessary to look a Clinician up by hand where cause arises, and so that the Clinician has made an identified assertion capable of being checked. A certificant number is publicly searchable, and a false one is therefore detectable after the fact. That is the extent of the control.

5.2.7.4 The representation at Section 5.1.6 is not displaced by the collection of a Certificant Number, and the Company relies upon that representation.

5.3 The limits of NPI Screening — what it does not establish

This Section is not a disclaimer of a check the Company declines to perform. It states the boundary of what the check it does perform can establish, and the Customer acknowledges each limitation.

5.3.1 NPPES IS A PUBLIC REGISTRY. A National Provider Identifier and the name associated with it are published and freely searchable by any person. Submitting a matching identifier and name therefore demonstrates knowledge of a public fact, and does not demonstrate that the submitter is the person to whom the identifier belongs. NPI SCREENING IS NOT IDENTITY VERIFICATION AND THE COMPANY DOES NOT REPRESENT THAT IT IS.

5.3.2 THE NPPES CREDENTIAL FIELD IS SELF-REPORTED. It is furnished by the provider upon enrollment and is not maintained, confirmed or updated by the Behavior Analyst Certification Board. A credential recorded in NPPES is therefore not evidence of current certification.

5.3.3 NO CERTIFICATION-BOARD CHECK IS PERFORMED. The Company does not query the BACB certificant registry, and accordingly does not confirm current certification, expiry, suspension, revocation, or any disciplinary history. The Company collects a Certificant Number under Section 5.2.7 but does not check it, and the Customer shall not treat its collection as a check.

5.3.4 NO LICENSURE CHECK IS PERFORMED. The Company does not verify state licensure, registration, supervision status, or exclusion from any federal health care program.

5.3.5 NO ONGOING MONITORING. NPI Screening is not repeated. A certification or licensure which lapses, is suspended or is revoked after registration will not be detected by the Company, and Section 5.4 places that obligation upon the Customer.

5.3.6 The representations at Section 5.1 are not displaced. NPI Screening supplements those representations; it does not verify them, and the Company relies upon them notwithstanding the screening.

5.3.7 No representation to third parties. Neither party shall represent to any Client, Caregiver, payer or other third party that the Company has verified the identity, certification, licensure or good standing of any Clinician.

5.4 Notification

The Customer shall notify the Company promptly upon any representation at Section 5.1 ceasing to be true, including the lapse, suspension or revocation of a Clinician's certification or licensure. Section 5.3.5 makes this obligation load-bearing: the Company will not otherwise learn of it.

ARTICLE 6 — GRANT

6.1 Right to use

Subject to this Agreement and to payment of the Fees, the Company grants the Customer a non-exclusive, non-transferable, non-sublicensable, revocable right, during the Term, to access and use the Service for the Customer's internal business purposes in delivering services to its Clients, and for no other purpose.

6.2 Authorized Users

6.2.1 The Customer may permit Authorized Users to access the Service, within the quantity for which it is subscribed under the Pricing Policy.

6.2.2 The Customer is responsible for the acts and omissions of its Authorized Users as though they were its own, and each act or omission of an Authorized User in breach of this Agreement is a breach by the Customer.

6.2.3 Credentials are personal to an Authorized User and must not be shared. Article 7 governs.

6.3 Reservation

All rights not expressly granted are reserved to the Company and its licensors. The Service is provided as a service, not sold, and no title passes.

6.4 Restrictions

The Customer shall not, and shall not permit any Person to:

6.4.1 copy, modify, adapt, translate, or create a derivative work of the Service;

6.4.2 reverse engineer, decompile or disassemble the Service, except to the extent such restriction is prohibited by Applicable Law;

6.4.3 rent, lease, lend, sell, sublicense, distribute, or provide the Service to any third party, or use it in a service bureau or time-sharing arrangement;

6.4.4 use the Service to provide services to a client of a person other than the Customer, save as an Order Form expressly permits;

6.4.5 access the Service to build a competing product, or for benchmarking or competitive analysis;

6.4.6 use any robot, scraper or automated means to extract data, other than an interface the Company provides for that purpose;

6.4.7 probe, scan or test the vulnerability of the Service, or breach or circumvent any security or authentication measure, save under a written authorization from the Company;

6.4.8 interfere with or disrupt the Service or impose an unreasonable load upon it; or

6.4.9 remove, obscure or alter any proprietary notice.

ARTICLE 7 — ACCOUNTS, CREDENTIALS AND ACCESS CONTROL

7.1 Accuracy. The Customer shall provide accurate registration information and maintain it.

7.2 Credential security. The Customer is responsible for maintaining the confidentiality of all credentials issued under its Account and for all activity occurring under them, whether or not authorized.

7.3 One credential per individual. Credentials must not be shared between individuals. Attribution of clinical documentation to an identified author is defeated by a shared credential, and the resulting record may not satisfy the Customer's own documentation obligations.

7.4 Prompt deprovisioning. The Customer shall remove an Authorized User's access promptly upon that person ceasing to require it, including upon termination of their employment or engagement. The Company cannot know that a workforce member has departed and does not monitor for it.

7.5 Notification of compromise. The Customer shall notify the Company immediately at contact@getflourishbx.com upon becoming aware of any unauthorized access to its Account.

7.6 Company measures. The Company may impose reasonable security measures, including session expiry, throttling and mandatory credential reset, and may do so without prior notice where necessary to protect the Service or its users.

7.7 Multi-factor authentication. Clinician accounts may enrol a second authentication factor using an authenticator application, and FlourishBx may require it. Following a successful second factor, a browser may be remembered for up to thirty (30) days, during which the password remains required at every sign-in. Any change to a user's enrolled factors revokes every remembered browser for that user. Single-use recovery codes are issued at enrolment.

ARTICLE 8 — CUSTOMER RESPONSIBILITIES

8.1 Clinical responsibility. The Customer is solely responsible for every clinical decision, assessment, treatment plan, intervention and judgment made in connection with a Client, and for the adequacy, accuracy and completeness of the Customer Data.

8.2 Documentation obligations. The Customer is solely responsible for determining whether records maintained in the Service satisfy its own documentation, retention, billing and regulatory obligations, including those of any payer, certifying body or licensing authority. The Company makes no representation that they do.

8.3 Consents. The Customer shall obtain and maintain all consents and authorizations required to place Client information in the Service, to permit Caregiver access, and to permit the Company's Processing.

8.4 Minimum necessary. The Customer shall not place in the Service PHI beyond what is reasonably necessary for the purpose, consistent with 45 C.F.R. § 164.502(b).

8.5 Caregiver access decisions. The Customer determines which Caregivers may access a Client's record, and for how long. Article 11 governs.

8.6 No PHI in support channels. The Customer shall not transmit PHI to the Company by electronic mail or through a general support channel. The Company will request what it requires through a secure route.

8.7 Accuracy of Client records. The Customer shall maintain the accuracy of Client records and shall action a Client's amendment request under Article 9 of the Privacy Policy.

8.8 Compliance. The Customer shall use the Service in compliance with Applicable Law, including HIPAA, and with the ethical requirements of its profession.

8.9 Export of Customer Data to other systems

Many Customers export from the Service into a practice-management or billing system. This Section states where responsibility sits when they do.

8.9.1 The Customer's disclosure, not the Company's. Where the Customer exports Customer Data and transmits it to any other system or third party, that transmission is the Customer's own disclosure, made outside the Service. The Company is not a party to it, does not control it, and assumes no responsibility for it.

8.9.2 No relationship with the recipient. A practice-management, billing, clearinghouse or electronic health record vendor to which the Customer transmits exported data does not thereby become a subprocessor, subcontractor or business associate of the Company, and the Company owes it no duty. The Customer's arrangements with that vendor are the Customer's own.

8.9.3 Direct integrations are different. Section 8.9.1 concerns an export the Customer performs. Where the Company builds a direct integration transmitting Customer Data to a third party on the Customer's instruction, that transmission is made by the Company and Article 13, the BAA and Article 14 apply to it. No such integration exists as at the Effective Date.

8.10 Billing and coding remain the Customer's responsibility

This Section is material where exported data is used to support a claim for payment.

8.10.1 The Company does not code, bill, or advise on either. The Company is not a billing service, is not a clearinghouse, and renders no opinion as to what may lawfully be claimed for any service.

8.10.2 Codes and calculations are conveniences. Where the Service displays, stores or exports a procedure code, a service duration, a unit count or any similar figure, it does so as a convenience reflecting what the Customer or its workforce entered. A unit figure the Service calculates is arithmetic upon an entered duration. IT IS NOT A CODING DETERMINATION, NOT A REPRESENTATION THAT ANY CODE OR UNIT COUNT IS CORRECT OR PAYABLE, AND NOT A RECOMMENDATION AS TO WHAT TO SUBMIT.

8.10.3 The Customer verifies before submitting. THE CUSTOMER IS SOLELY RESPONSIBLE FOR THE ACCURACY OF EVERY CLAIM IT SUBMITS, including the procedure codes, units, durations, dates, rendering provider identifiers and documentation supporting it, and shall verify exported data against its own records before submitting or relying upon it.

8.10.4 Why this matters. A claim submitted to a federal health care program in reliance on inaccurate data may expose the Customer to overpayment liability and to liability under the False Claims Act, 31 U.S.C. §§ 3729–3733, irrespective of where the data originated. The Company's disclaimers do not shift that exposure to the Company, and nothing in this Agreement is a representation that data exported from the Service is adequate to substantiate any claim.

8.10.5 Documentation sufficiency. Section 8.2 applies with full force to exported data. The Company makes no representation that a session record, attestation, signature or export satisfies the documentation requirements of any payer, State Medicaid program, certifying body or licensing authority.

8.10.6 Defects. The Company shall correct a defect in the Service affecting the accuracy of exported data in accordance with Article 27, and shall notify affected Customers where it becomes aware that exported data was materially inaccurate. Section 8.10.3 is not displaced by this Section, the Customer's own verification being the control on which the allocation of responsibility rests.

ARTICLE 9 — NO CLINICAL JUDGMENT BY THE COMPANY

9.1 THE COMPANY IS A DEVELOPER AND LICENSOR OF SOFTWARE. IT IS NOT A HEALTH CARE PROVIDER WITHIN THE MEANING OF 45 C.F.R. § 160.103, IS NOT LICENSED TO PROVIDE BEHAVIORAL, MEDICAL, PSYCHOLOGICAL OR EDUCATIONAL SERVICES IN ANY JURISDICTION, AND PROVIDES NO THERAPY, DIAGNOSIS, ASSESSMENT, TREATMENT OR SUPERVISION.

9.2 NOTHING GENERATED BY OR DISPLAYED IN THE SERVICE — INCLUDING ANY REPORT, METRIC, TREND, CHART, THRESHOLD, SUGGESTED STRATEGY, PROMPT OR ALERT — CONSTITUTES CLINICAL ADVICE OR A RECOMMENDATION THAT ANY COURSE BE FOLLOWED IN RESPECT OF ANY CLIENT.

9.3 The Service does not practice. Any calculation, aggregation or visualization the Service performs is arithmetic upon data the Customer and its Caregivers supplied. It embodies no clinical reasoning, and the Company is not qualified to supply any.

9.4 No supervision. The Service does not supervise, and does not assist in supervising, any Clinician, technician or workforce member. Supervision obligations imposed by a certifying body remain the Customer's entirely.

9.5 No outcome claim. The Company makes no representation that use of the Service will produce any clinical improvement, any change in a Client's behavior, or any other outcome.

9.6 Reliance. A Clinician shall not substitute anything displayed in the Service for their own professional judgment. Where the Service and the Clinician's judgment differ, the Clinician's judgment governs.

ARTICLE 10 — THE SERVICE IS NOT A SAFETY-CRITICAL SYSTEM

10.1 THE SERVICE IS NOT MONITORED IN REAL TIME BY ANY PERSON. IT IS NOT AN EMERGENCY, CRISIS, ALARM, MONITORING, LIFE-SAFETY OR OTHER SAFETY-CRITICAL SYSTEM, AND MUST NOT BE CONFIGURED, HELD OUT, OR RELIED UPON AS ONE.

10.2 NO ALERT, THRESHOLD, NOTIFICATION, FLAG OR REPORT GENERATED BY THE SERVICE CONSTITUTES A WARNING THAT ANY PERSON IS IN DANGER, AND NONE IMPOSES ANY DUTY UPON THE COMPANY TO ACT, TO INVESTIGATE, OR TO NOTIFY ANY PERSON.

10.3 THE COMPANY DOES NOT WARRANT THAT ANY ALERT WILL BE GENERATED, WILL BE GENERATED TIMELY, WILL BE DELIVERED, OR WILL BE DELIVERED TO ANY PARTICULAR PERSON. Generation and delivery depend upon data being entered, upon network availability, upon device and browser configuration, upon third-party infrastructure, and upon the availability of the recipient, none of which the Company controls.

10.4 THE ABSENCE OF AN ALERT IS NOT AN INDICATION THAT NOTHING HAS OCCURRED. It may indicate only that nothing was recorded, that a threshold was configured otherwise, or that a defect exists.

10.5 THE CUSTOMER SHALL NOT ADOPT ANY CLINICAL, SUPERVISORY OR SAFETY PROTOCOL WHICH DEPENDS UPON THE SERVICE GENERATING OR DELIVERING AN ALERT. The Customer shall maintain independent means of becoming aware that a Client is at risk.

10.6 The Customer shall inform each Authorized User of this Article and shall not represent to any Client, Caregiver or third party that the Service performs monitoring.

10.7 In an emergency, the appropriate action is to contact emergency services. The Service is not a means of summoning assistance.

10.8 Nothing in this Article limits any obligation of the Customer under Applicable Law to report suspected abuse or neglect.

ARTICLE 11 — CAREGIVER ACCESS

11.1 The Service permits the Customer to invite Caregivers to record observations in respect of a Client through the Caregiver App.

11.2 The Customer determines who is invited and who is removed. The Company does not make that determination and does not adjudicate a dispute about it.

11.3 A Caregiver holds credentials issued by the Company and accepts the Caregiver App Terms of Use directly with the Company. The Customer is not a party to that agreement, and it confers no right upon the Customer.

11.4 Behavior logs recorded by a Caregiver in respect of the Customer's Client form part of the Customer Data, and the Customer controls them as it controls the remainder of the Client's record.

11.5 Caregivers cannot read one another's behavior logs. The Customer can read all of them, together with the identity of the recording Caregiver. The Customer shall not represent to a Caregiver that their logs are private from the Customer.

11.6 The Customer is responsible for obtaining any consent required to permit a particular Caregiver's access, and for ensuring that its own records reflect that authorization.

11.7 Discharging a Client may terminate Caregiver access and may alter which privacy policy governs the Caregiver's account. Section 1.6 of the Connected Account Privacy Policy governs as between the Company and the Caregiver.

ARTICLE 12 — CUSTOMER DATA

12.1 Ownership

As between the parties, the Customer owns all right, title and interest in the Customer Data. This Agreement transfers no ownership of it to the Company.

12.2 Licence to the Company

The Customer grants the Company a non-exclusive, worldwide, royalty-free licence to host, store, reproduce, transmit, display and Process the Customer Data solely as necessary to provide, maintain, secure and support the Service and to comply with Applicable Law.

12.2.1 The licence is limited to those purposes, is subject to Article 26, and terminates in accordance with Article 21.

12.3 Customer warranties

The Customer represents and warrants that it holds all rights, consents and authorizations necessary to grant the licence at Section 12.2, and that the Customer Data does not infringe the rights of any Person.

12.4 Accuracy

The Company does not review, verify, correct or validate Customer Data, and assumes no responsibility for its accuracy, adequacy or completeness.

12.5 Export

The Customer may export the Customer Data at any time, at no charge, in a structured, machine-readable format. This right subsists while the Account is suspended for non-payment, as Article 12 of the Pricing Policy provides.

12.6 Service Data

The Company may generate and use Service Data to operate, secure, support and improve the Service. Service Data contains no Customer Data, no PHI and no identifier of any Client, Authorized User or Caregiver, and Article 26 is not limited by this Section.

ARTICLE 13 — HIPAA

13.1 Roles

13.1.1 In respect of Customer Data, the Customer is the Covered Entity or acts on behalf of one, and the Company is a Business Associate.

13.1.2 In respect of the Customer's own account and billing information, the Company acts on its own behalf, and the Privacy Policy governs.

13.2 The BAA is required and is a separate instrument

13.2.1 THIS AGREEMENT IS NOT A BUSINESS ASSOCIATE AGREEMENT.

13.2.2 The parties shall execute a BAA before any PHI is placed in the Service. Where they have not, the Customer shall not place PHI in the Service, and the Company's obligations under this Article are unaffected by the Customer's failure to observe that restriction.

13.2.3 The BAA governs as to PHI and prevails over this Agreement to the extent of any conflict. Section 4.3.2 so provides.

13.3 Company undertakings

Without limiting the BAA, the Company shall:

13.3.1 Process PHI only as this Agreement and the BAA permit, and as the Customer instructs;

13.3.2 maintain the safeguards required by 45 C.F.R. Part 164, Subpart C;

13.3.3 ensure that each Subprocessor with access to PHI is bound by obligations no less protective, as 45 C.F.R. § 164.308(b)(2) requires;

13.3.4 assist the Customer in satisfying an individual's rights of access (§ 164.524), amendment (§ 164.526), accounting of disclosures (§ 164.528) and restriction (§ 164.522), as Article 9 of the Privacy Policy describes; and

13.3.5 report a Breach in accordance with Article 15.

13.4 Hosting

13.4.1 The Company shall maintain a BAA with each hosting provider and each other Subprocessor that Processes PHI.

13.5 No sale of PHI

The Company shall not sell PHI within the meaning of 45 C.F.R. § 164.502(a)(5)(ii), and shall not use or disclose PHI for marketing within the meaning of § 164.501.

ARTICLE 14 — SECURITY

14.1 Safeguards. The Company shall maintain administrative, physical and technical safeguards designed to protect Customer Data, including encryption in transit using TLS 1.2 or higher, encryption at rest, access controls enforced at the database layer, session expiry, and throttling of repeated failed authentication attempts.

14.2 Workforce. The Company shall train its workforce on privacy and security consistent with 45 C.F.R. § 164.308(a)(5) and shall apply sanctions for violations.

14.3 Access logging. Reads of a Client record are logged, including reads by Company personnel.

14.4 Least privilege. Company personnel access Customer Data only for a specific operational or support purpose, and only to the extent necessary.

14.5 Subprocessors. The Company shall give the Customer not less than thirty (30) days' notice before engaging a new Subprocessor with access to PHI, and the Customer may terminate under Section 20.3 if it reasonably objects.

14.6 Location. Customer Data is stored and Processed in the United States.

14.7 No guarantee. NO SYSTEM IS COMPLETELY SECURE. The Company does not warrant that Customer Data will never be accessed, disclosed, altered or destroyed without authorization.

14.8 Customer-side security. The Company is not responsible for a compromise arising from the Customer's own systems, devices, networks or credential handling.

ARTICLE 15 — SECURITY INCIDENTS AND BREACH NOTIFICATION

15.1 Notice. The Company shall notify the Customer of a Breach of unsecured PHI without unreasonable delay and in no case later than sixty (60) days after discovery, as 45 C.F.R. § 164.410 requires. The Company targets notice within five (5) Business Days.

15.2 Contents. The notice shall identify, so far as then known: the nature of the incident, the date of occurrence and of discovery, the categories and volume of information involved, the individuals affected or reasonably believed to be affected, the Company's response, and its remediation plan.

15.3 Supplementation. The Company shall not delay an initial notice in order to complete its investigation, and shall supplement as more becomes known.

15.4 Cooperation. The Company shall cooperate reasonably with the Customer's own notification obligations under 45 C.F.R. §§ 164.404 and 164.406 and under applicable state law.

15.5 Individual notification. Notification of affected individuals is the Customer's obligation as Covered Entity. The Company shall not notify an individual without the Customer's instruction, save where Applicable Law requires it.

15.6 Unsuccessful incidents. Routine unsuccessful attempts — pings, port scans, failed log-in attempts and comparable events producing no unauthorized access — require no individual report, and this Section constitutes notice of them.

15.7 Customer reporting. The Customer shall report a suspected Security Incident affecting the Service to contact@getflourishbx.com promptly.

ARTICLE 16 — CONFIDENTIALITY

16.1 Definition. "Confidential Information" means non-public information disclosed by one party to the other which is designated confidential or which a reasonable person would understand to be confidential. Customer Data is the Customer's Confidential Information. The Service, the Documentation and the Company's pricing are the Company's Confidential Information.

16.2 Obligations. Each party shall use the other's Confidential Information only to perform this Agreement, shall protect it with not less than reasonable care, and shall disclose it only to those of its personnel and advisors who need it and who are bound by obligations of confidentiality.

16.3 Exclusions. Confidential Information does not include information which is or becomes public without breach, was known without restriction before disclosure, is received from a third party without restriction, or is independently developed without use of the other party's Confidential Information.

16.4 Compelled disclosure. A party may disclose Confidential Information where Applicable Law requires, provided it gives the other party prompt notice where lawful and reasonably cooperates in seeking protective treatment.

16.5 Survival. This Article survives for three (3) years after termination, and indefinitely as to PHI and trade secrets.

ARTICLE 17 — FEES AND PAYMENT

17.1 Fees, billing, proration, commitment, suspension for non-payment, cancellation, refunds, plan changes and price changes are governed exclusively by the Pricing Policy, which forms part of this Agreement under Section 4.2.

17.2 This Agreement does not restate those terms, and no summary of them appears here. The Customer should read the Pricing Policy.

17.3 Without limiting Section 17.1, the Customer notes that on Self-Serve Accounts the charge is flat and not prorated (Article 6 of the Pricing Policy), that a Clinic Account carries a Committed Minimum and a minimum Term and may not be cancelled mid-Term for convenience (Article 19), and that not less than sixty (60) days' notice precedes any price increase (Article 14).

17.4 Suspension for non-payment does not extinguish the Customer's right to export Customer Data. Section 12.5 and Article 12 of the Pricing Policy govern.

ARTICLE 18 — TERM

18.1 Commencement. This Agreement commences on the date of formation under Section 1.2.

18.2 Self-Serve Accounts. The Term continues month to month until cancelled in accordance with the Pricing Policy.

18.3 Clinic Accounts. The Term is the Initial Term stated in the Order Form and renews as Article 19 of the Pricing Policy provides.

18.4 Free Plan. The Term continues until either party terminates on notice, or until the Customer exceeds the Free Plan limit and does not upgrade.

18.5 Survival of this Agreement over an Order Form. The expiry of an Order Form does not terminate this Agreement where the Customer continues to use the Service.

ARTICLE 19 — SUSPENSION

19.1 The Company may suspend the Account, in whole or in part, where:

19.1.1 Fees are overdue, as the Pricing Policy provides;

19.1.2 the Customer is in material breach of this Agreement;

19.1.3 suspension is reasonably necessary to prevent harm to the Service, to another customer, or to any Person; or

19.1.4 Applicable Law or a lawful demand requires it.

19.2 Notice. The Company shall give notice before suspending, save where an exigency of security or Applicable Law prevents it, in which case notice shall be given as soon as practicable.

19.3 Scope. A suspension shall be no broader and no longer than reasonably necessary.

19.4 Data during suspension. Suspension does not delete Customer Data, and the Customer retains the right to export it. Section 12.5 governs.

19.5 Fees during suspension. Fees continue to accrue during a suspension arising under Section 19.1.1, as Article 10 of the Pricing Policy provides.

ARTICLE 20 — TERMINATION

20.1 By the Customer. The Customer may terminate as the Pricing Policy provides for its plan.

20.2 By either party for material breach. Either party may terminate upon written notice describing a material breach where the other fails to cure it within thirty (30) days.

20.3 By the Customer on a Subprocessor objection. Section 14.5 governs.

20.4 By the Company.

20.4.1 The Company may terminate for the Customer's material breach under Section 20.2, or for non-payment as the Pricing Policy provides.

20.4.2 The Company may terminate a Free Plan Account on thirty (30) days' notice for any reason.

20.4.3 The Company may terminate a paid Account for convenience only on not less than ninety (90) days' notice, and shall refund the unused portion of any prepaid Fees.

20.5 Insolvency. Either party may terminate immediately upon the other's insolvency, assignment for the benefit of creditors, or the appointment of a receiver.

20.6 Effect on an Order Form. Termination of this Agreement terminates each Order Form, subject to Section 19.3.2 of the Pricing Policy as to committed fees.

ARTICLE 21 — EFFECT OF TERMINATION

21.1 Cessation. Upon termination the rights granted at Article 6 cease and the Customer shall discontinue use.

21.2 Export window. The Customer may export the Customer Data for ninety (90) days following closure, as Article 12 of the Pricing Policy provides. The Company shall not withhold export by reason of a dispute as to Fees.

21.3 Return or destruction. Following the export window the Company shall return or destroy the Customer Data, as 45 C.F.R. § 164.504(e)(2)(ii)(J) contemplates, and shall certify destruction in writing upon request.

21.4 Where return or destruction is infeasible. Where destruction is infeasible, the Company shall extend the protections of this Agreement and the BAA to the retained information and limit further use to the purposes making destruction infeasible.

21.5 Backups. Customer Data may persist in encrypted backups until those backups expire in the ordinary cycle, and shall not be restored to the live service save as part of a general disaster recovery.

21.6 Accrued rights. Termination does not affect any right or liability accrued before it.

21.7 Survival. Articles 2, 3, 12 (as to §§ 12.1 and 12.6), 15, 16, 21, 24, 26, 28, 29, 30, 32 and 34 survive termination, together with any provision which by its nature is intended to survive.

ARTICLE 22 — AVAILABILITY AND SUPPORT

22.1 Commercially reasonable efforts. The Company shall use commercially reasonable efforts to make the Service available.

22.2 No service level commitment. THE COMPANY OFFERS NO SERVICE LEVEL AGREEMENT, NO UPTIME COMMITMENT AND NO SERVICE CREDIT, save where an Order Form expressly provides otherwise.

22.2.1 Export availability is not warranted. A Customer that has come to depend upon a periodic export for its own billing cycle should note that Section 22.2 applies to the export function as to every other, and should not schedule a billing process so that an interruption of the Service would prevent it from billing. Section 12.5 confers a right to export; it is not a warranty that export will be available at a particular moment.

22.3 Maintenance. The Company may undertake scheduled maintenance, and shall use reasonable efforts to give advance notice and to schedule it outside ordinary business hours. Emergency maintenance may be undertaken without notice.

22.4 Support. The Company shall provide support by electronic mail at contact@getflourishbx.com, on commercially reasonable efforts. No response time is committed save where an Order Form provides otherwise.

ARTICLE 23 — CHANGES TO THE SERVICE

23.1 The Company may modify the Service from time to time.

23.2 The Company shall not materially degrade or remove a core function of the Service during a Term without not less than sixty (60) days' notice, and where it does so the Customer may terminate and receive a refund of the unused portion of any prepaid Fees.

23.3 "Core function" means client record management, behavior and strategy definition, caregiver log intake, and data export.

23.4 A change made to address a security risk or to comply with Applicable Law may be made without notice.

ARTICLE 24 — INTELLECTUAL PROPERTY

24.1 Ownership. The Service, the Documentation, and all Intellectual Property Rights in them, are and remain the exclusive property of the Company and its licensors.

24.2 Marks. "FlourishBx," the FlourishBx logo and the Company's other marks are the Company's property. Neither party may use the other's marks without prior written consent, save as Section 24.3 permits.

24.3 Publicity. The Company shall not identify the Customer as a customer, by name or logo, in any public material without the Customer's prior written consent.

24.4 Open source. The Service may incorporate open source components licensed under their own terms, which govern as to the components they cover. Notices are available on request.

24.5 Reservation. All rights not expressly granted are reserved.

ARTICLE 25 — FEEDBACK

25.1 Where the Customer or an Authorized User furnishes a suggestion, idea or other feedback concerning the Service, the Company may use and exploit it without restriction and without obligation of attribution, compensation or confidentiality.

25.2 Feedback must not contain Customer Data or PHI, and Section 8.6 applies.

ARTICLE 26 — DE-IDENTIFIED DATA AND ARTIFICIAL INTELLIGENCE

This Article is a contractual covenant of the Company, not a statement of current policy, and the Company may not resile from it by amending a policy document.

26.1 No de-identification for the Company's own purposes. The Company shall not de-identify Customer Data for research, benchmarking, publication, product development, or sale, whether under 45 C.F.R. § 164.514(b) or otherwise.

26.2 No sale. The Company shall not sell, license, rent or otherwise make available to any third party any Customer Data or any dataset derived from it, whether identified, pseudonymized, de-identified or aggregated.

26.3 No model training. The Company shall not use Customer Data to develop, train, fine-tune, evaluate or improve any artificial intelligence or machine learning model, whether the Company's own or a third party's, and shall not transmit Customer Data to any third-party model provider.

26.4 Scope. Sections 26.1 to 26.3 bind the Company, its Affiliates, its Subprocessors and any successor in interest.

26.5 Service Data excepted. Section 12.6 is not limited by this Article, Service Data containing no Customer Data.

26.6 Amendment. This Article may be amended only by a written instrument executed by both parties, and not by the Company's amendment of a policy under Article 33.

ARTICLE 27 — COMPANY WARRANTIES

27.1 The Company warrants that:

27.1.1 it has the authority to enter into this Agreement;

27.1.2 the Service will perform materially in accordance with the Documentation;

27.1.3 it will provide the Service with reasonable skill and care; and

27.1.4 it will not knowingly introduce malicious code into the Service.

27.2 Exclusive remedy. For a breach of Section 27.1.2 the Customer's exclusive remedy is that the Company shall use commercially reasonable efforts to correct the non-conformity and, failing correction within thirty (30) days, the Customer may terminate and receive a refund of the unused portion of any prepaid Fees.

27.3 Section 27.1.2 does not apply to a Free Plan Account. Section 28.5 governs.

ARTICLE 28 — DISCLAIMER OF WARRANTIES

28.1 EXCEPT AS EXPRESSLY STATED IN ARTICLE 27, THE SERVICE IS PROVIDED "AS IS" AND "AS AVAILABLE," WITHOUT WARRANTY OR CONDITION OF ANY KIND, WHETHER EXPRESS, IMPLIED OR STATUTORY.

28.2 TO THE FULLEST EXTENT PERMITTED BY APPLICABLE LAW THE COMPANY DISCLAIMS ALL OTHER WARRANTIES AND CONDITIONS, INCLUDING THE IMPLIED WARRANTIES OF MERCHANTABILITY AND OF FITNESS FOR A PARTICULAR PURPOSE ARISING UNDER N.C. GEN. STAT. §§ 25-2-314 AND 25-2-315 AND THEIR COUNTERPARTS, AND ANY WARRANTY OF TITLE, ACCURACY, SYSTEM INTEGRATION, NON-INFRINGEMENT, OR ARISING FROM COURSE OF DEALING OR USAGE OF TRADE.

28.3 WITHOUT LIMITING SECTION 28.2, THE COMPANY DOES NOT WARRANT THAT: (A) THE SERVICE WILL MEET THE CUSTOMER'S REQUIREMENTS; (B) ACCESS WILL BE UNINTERRUPTED, TIMELY, SECURE OR ERROR-FREE; (C) ANY DEFECT WILL BE CORRECTED; (D) ANY OUTPUT IS ACCURATE, ADEQUATE OR COMPLETE; (E) ANY ALERT WILL BE GENERATED OR DELIVERED; OR (F) CUSTOMER DATA WILL BE PRESERVED WITHOUT LOSS OR CORRUPTION.

28.4 THE COMPANY DISCLAIMS ANY WARRANTY THAT THE SERVICE IS SUITABLE FOR ANY PARTICULAR CLIENT, THAT RECORDS MAINTAINED IN IT SATISFY ANY DOCUMENTATION, RETENTION, BILLING OR REGULATORY OBLIGATION OF THE CUSTOMER, OR THAT ITS USE WILL PRODUCE ANY CLINICAL OUTCOME. ARTICLES 8, 9 AND 10 APPLY.

28.5 FREE PLAN. A FREE PLAN ACCOUNT IS PROVIDED WITHOUT ANY WARRANTY WHATSOEVER, INCLUDING THE WARRANTY AT SECTION 27.1.2, AND MAY BE MODIFIED, SUSPENDED OR DISCONTINUED AT ANY TIME.

28.6 Certain jurisdictions do not permit the exclusion of implied warranties. To the extent such exclusion is impermissible, this Article applies to the maximum extent permitted.

ARTICLE 29 — INDEMNIFICATION

29.1 By the Company — intellectual property

29.1.1 The Company shall defend the Customer against any third-party claim that the Service, as provided and used in accordance with this Agreement, infringes that third party's Intellectual Property Rights, and shall indemnify the Customer against damages and costs finally awarded or agreed in settlement.

29.1.2 Remedies. Where such a claim is made or is reasonably likely, the Company may, at its option and expense: procure the right to continue use; modify or replace the Service so that it is non-infringing while materially equivalent; or, failing either on commercially reasonable terms, terminate and refund the unused portion of any prepaid Fees.

29.1.3 Exclusions. Section 29.1.1 does not apply to a claim arising from Customer Data, from the Customer's combination of the Service with anything not supplied by the Company, from use in breach of this Agreement, or from a modification not made by the Company.

29.2 By the Customer

The Customer shall indemnify and defend the Company against any third-party claim arising from:

29.2.1 Customer Data, including a claim that it infringes a right or was placed in the Service without the necessary consent or authorization;

29.2.2 the Customer's breach of Article 5, Article 8 or Article 13;

29.2.3 any clinical decision, act or omission of the Customer or any Authorized User;

29.2.4 the Customer's reliance upon, or representation to any Person concerning, an alert, threshold or report, contrary to Article 10; or

29.2.5 the Customer's violation of Applicable Law.

29.3 Procedure

The indemnified party shall give prompt notice, grant sole control of the defense and settlement to the indemnifying party, and cooperate at the indemnifying party's expense. A failure to give prompt notice relieves the indemnifying party only to the extent it is materially prejudiced. The indemnifying party shall not settle in a manner imposing an obligation or admission upon the indemnified party without its consent, not to be unreasonably withheld.

29.4 Exclusive remedy

Section 29.1 states the Company's entire liability and the Customer's exclusive remedy for a claim of intellectual property infringement.

ARTICLE 30 — LIMITATION OF LIABILITY

30.1 EXCLUSION OF INDIRECT DAMAGES. TO THE FULLEST EXTENT PERMITTED BY APPLICABLE LAW, NEITHER PARTY SHALL BE LIABLE FOR ANY INDIRECT, INCIDENTAL, SPECIAL, CONSEQUENTIAL, EXEMPLARY OR PUNITIVE DAMAGES, OR FOR ANY LOSS OF PROFITS, REVENUE, GOODWILL, BUSINESS OPPORTUNITY OR ANTICIPATED SAVINGS, ARISING OUT OF OR RELATING TO THIS AGREEMENT, WHETHER IN CONTRACT, TORT (INCLUDING NEGLIGENCE), STRICT LIABILITY, WARRANTY OR OTHERWISE, AND WHETHER OR NOT ADVISED OF THE POSSIBILITY.

30.2 GENERAL CAP. EACH PARTY'S TOTAL AGGREGATE LIABILITY ARISING OUT OF OR RELATING TO THIS AGREEMENT SHALL NOT EXCEED THE GREATER OF (A) THE FEES PAID OR PAYABLE BY THE CUSTOMER IN THE TWELVE (12) MONTHS IMMEDIATELY PRECEDING THE EVENT GIVING RISE TO THE CLAIM, AND (B) FIVE THOUSAND U.S. DOLLARS ($5,000).

30.3 DATA INCIDENTS — NO ENHANCED CAP. SECTION 30.2 APPLIES TO EVERY CLAIM, INCLUDING A CLAIM ARISING FROM A BREACH OF UNSECURED PHI CAUSED BY THE COMPANY. Elected 15 October 2026. Section 30.4 is not limited by this Section, so fraud, gross negligence and wilful misconduct remain uncapped.

30.4 CARVE-OUTS. NOTHING IN THIS ARTICLE LIMITS: (A) THE CUSTOMER'S OBLIGATION TO PAY FEES; (B) EITHER PARTY'S INDEMNIFICATION OBLIGATIONS UNDER ARTICLE 29; (C) LIABILITY FOR FRAUD, FRAUDULENT MISREPRESENTATION, GROSS NEGLIGENCE OR WILFUL MISCONDUCT; (D) LIABILITY FOR DEATH OR PERSONAL INJURY CAUSED BY NEGLIGENCE; OR (E) ANY LIABILITY WHICH CANNOT LAWFULLY BE LIMITED.

30.5 FREE PLAN. THE COMPANY'S TOTAL AGGREGATE LIABILITY IN RESPECT OF A FREE PLAN ACCOUNT SHALL NOT EXCEED ONE HUNDRED U.S. DOLLARS ($100), no Fees having been paid. Section 30.4 is not limited by this Section.

30.6 Basis of the bargain. The disclaimers in Article 28 and the limitations in this Article are a fundamental basis of the bargain, form part of the consideration for the Fees charged, and apply notwithstanding the failure of any limited remedy of its essential purpose.

ARTICLE 31 — INSURANCE

31.1 Reserved.

31.3 The Customer shall maintain professional liability insurance appropriate to its practice.

ARTICLE 32 — DISPUTE RESOLUTION

32.1 Informal resolution. Before commencing any proceeding a party shall notify the other in writing, describing the dispute and the relief sought, and shall negotiate in good faith for not less than thirty (30) days. Compliance is a condition precedent.

32.2 Governing law. This Agreement is governed by the laws of the State of North Carolina, without regard to conflict of laws principles, together with applicable federal law. The United Nations Convention on Contracts for the International Sale of Goods and the Uniform Computer Information Transactions Act are excluded.

32.3 Venue. Any proceeding shall be commenced exclusively in the state or federal courts situated in Mecklenburg County, North Carolina, and each party irrevocably consents to personal jurisdiction and venue there and waives any objection based upon forum non conveniens.

32.4 Limitations period. ANY CLAIM ARISING OUT OF OR RELATING TO THIS AGREEMENT MUST BE COMMENCED WITHIN ONE (1) YEAR AFTER THE CAUSE OF ACTION ACCRUES, FAILING WHICH IT IS PERMANENTLY BARRED. This Section does not apply to a claim for non-payment of Fees, or to an indemnification claim under Article 29.

32.5 Equitable relief. Nothing in this Article prevents a party from seeking injunctive or other equitable relief in respect of the infringement or misuse of Intellectual Property Rights or the breach of Article 16.

ARTICLE 33 — AMENDMENT

33.1 The Company may amend this Agreement and the Pricing Policy on not less than thirty (30) days' notice, and the amendment takes effect at the start of the Customer's next billing period following that notice.

33.2 Material amendment. Where an amendment materially reduces the Customer's rights or materially increases its obligations, the Customer may terminate without penalty before it takes effect, and shall receive a refund of the unused portion of any prepaid Fees.

33.3 Order Form and BAA. An Order Form and the BAA may be amended only by a written instrument executed by both parties.

33.4 Article 26. Section 26.6 governs and this Article does not apply to it.

33.5 Price changes. Article 14 of the Pricing Policy governs, and requires not less than sixty (60) days' notice.

33.6 No retroactive application. The Company shall not apply an amendment retroactively to a dispute arising before it took effect.

ARTICLE 34 — GENERAL PROVISIONS

34.1 Entire agreement. This Agreement, comprising the documents at Section 4.1, constitutes the entire agreement between the parties as to its subject matter and supersedes all prior negotiations, understandings and representations. Neither party relies upon any representation not expressly set out. Nothing in this Section excludes liability for fraudulent misrepresentation.

34.2 No purchase order terms. Any term appearing on a purchase order, acknowledgement or other Customer document is of no effect, notwithstanding acceptance of that document or payment against it.

34.3 Severability. An invalid provision shall be modified to the minimum extent necessary to render it enforceable or, failing that, severed. The remainder continues in force.

34.4 No waiver. A failure or delay in exercising a right is not a waiver of it. A waiver is effective only in writing.

34.5 Assignment. Neither party may assign this Agreement without the other's prior written consent, save that either party may assign it in its entirety, without consent, to a successor in a merger, acquisition or sale of substantially all assets, subject to Section 26.4. Any purported assignment in breach is void.

34.6 No third-party beneficiaries. This Agreement confers no right upon any Person other than the parties, save that a Client is an intended beneficiary of Articles 9, 10, 13 and 26 and may enforce them through a personal representative.

34.7 Relationship. Nothing creates a partnership, joint venture, agency, fiduciary or employment relationship.

34.8 Force majeure. Neither party is liable for a failure or delay caused by an event beyond its reasonable control, including act of God, natural disaster, fire, flood, war, terrorism, civil unrest, epidemic or pandemic, labor dispute, failure of a utility, telecommunications or hosting service, or act of government. This Section does not excuse an obligation to pay Fees.

34.9 Notices. Legal notice must be in writing to the address in Article 35 and is effective upon receipt. Notice by electronic mail to a general or support address is not effective legal notice. Operational notices may be given by electronic mail or in-product message.

34.10 Counterparts and electronic signature. This Agreement may be executed in counterparts and by electronic signature, each of equal effect, under 15 U.S.C. §§ 7001 et seq. and N.C. Gen. Stat. §§ 66-311 et seq.

34.11 Cumulative remedies. Remedies are cumulative and in addition to any other available at law or in equity.

34.12 Language. Drafted in English; the English text governs.

34.13 Summaries are not binding. The Summary and every table are furnished for convenience. Where they differ from an Article, the Article governs.

34.14 No legal or clinical advice. Nothing in this Agreement constitutes legal or clinical advice.

ARTICLE 35 — NOTICES AND CONTACT

FlourishBx LLC d/b/a FlourishBx Attention: Legal 3908 Litchfield Road Charlotte, North Carolina 28211

Purpose Address
Legal notice contact@getflourishbx.com
Security reports contact@getflourishbx.com
Billing contact@getflourishbx.com
Support contact@getflourishbx.com