Professional Contract Drafting Assistant

Software Development and Consulting Services Agreement

between

NIGHTFALL DIGITAL SOLUTIONS LLC (Developer)

and

BRIGHTPATH WELLNESS, INC. (Client)

Effective Date: November 1, 2026

RECITALS

A. Nightfall Digital Solutions LLC is a Colorado limited liability company with its principal office at 4120 Larimer Street, Suite 220, Denver, CO 80205 ("Developer"). Developer designs, develops, integrates, and supports custom software applications.

B. Brightpath Wellness, Inc. is a Delaware corporation with its principal office at 900 Marina Boulevard, Suite 310, Oakland, CA 94607 ("Client"). Client provides wellness and telehealth services. Client wants to get a custom telehealth scheduling and patient-intake web application.

C. Client wants to hire Developer to design, build, test, and deploy that application in three development phases, and to provide bug-fix support after launch. Once development is complete, Client may also want to receive ongoing maintenance and support services.

D. The application will create, receive, maintain, or transmit protected health information. The Parties therefore intend to perform this Agreement in compliance with HIPAA and to sign a Business Associate Agreement.

E. Developer is willing to provide these services, and Client is willing to engage Developer, on the terms and conditions of this Agreement.

NOW, THEREFORE, in consideration of the mutual covenants in this Agreement and other good and valuable consideration, the receipt and sufficiency of which are acknowledged, the Parties agree as follows:

1. DEFINITIONS

1.1 Defined Terms. Capitalized terms have the meanings given below or where they are first defined in this Agreement.

1.1.1 "Acceptance" means (a) Client's written confirmation that a Deliverable or Milestone meets the applicable Acceptance Criteria, or (b) deemed acceptance under Section 4.4. "Accepted" has a matching meaning.

1.1.2 "Acceptance Criteria" means the functional, performance, security, and other criteria for each Milestone set out in Exhibit A, plus the applicable Specifications.

1.1.3 "Acceptance Period" has the meaning given in Section 4.2.

1.1.4 "Affiliate" means any entity that directly or indirectly controls, is controlled by, or is under common control with a Party. "Control" means owning more than 50% of the voting interests of the entity, or otherwise having the power to direct its management and policies.

1.1.5 "Agreement" means this Software Development and Consulting Services Agreement, including all Exhibits and all Change Orders signed under Section 3.4.

1.1.6 "Application" means the custom telehealth scheduling and patient-intake web application described in Section 2.2 and Exhibit A. It includes all desktop and mobile-responsive interfaces, modules, integrations, and related documentation.

1.1.7 "Business Associate Agreement" or "BAA" means the business associate agreement between the Parties in the form attached as Exhibit C, as amended from time to time.

1.1.8 "Business Day" means any day other than a Saturday, Sunday, or a federal holiday in the United States.

1.1.9 "Change Order" means a written document signed by both Parties' authorized representatives that changes the Services, Deliverables, Specifications, schedule, or Fees, as described in Section 3.4.

1.1.10 "Client Materials" means all data, content, trademarks, logos, specifications, credentials, API keys, systems access, and other materials that Client or its agents provide to Developer, including Client Data.

1.1.11 "Client Data" means all data and information that Client, its Affiliates, patients, providers, or end users submit to the Application or give to Developer, including PHI and personal information.

1.1.12 "Confidential Information" has the meaning given in Section 8.1.

1.1.13 "Deliverables" means all software code (source and object), designs, wireframes, documentation, configurations, databases, test scripts, and other work product that Developer creates, alone or with others, specifically for Client under this Agreement. Deliverables do not include Developer Pre-Existing IP or Third-Party Components.

1.1.14 "Developer Pre-Existing IP" means all software, code libraries, frameworks, tools, templates, methodologies, know-how, and other materials that Developer owned or licensed before the Effective Date, or that Developer develops independently of this Agreement without using Client Confidential Information. This includes any improvements to those items that are not specific to Client.

1.1.15 "Documentation" means user guides, administrator guides, technical architecture documents, API documentation, deployment runbooks, and similar materials that Developer delivers with the Application.

1.1.16 "Effective Date" means November 1, 2026.

1.1.17 "EHR API" means the Epic-compatible electronic health record application programming interface that Client uses or licenses, as identified in Exhibit A.

1.1.18 "Fees" means the Fixed Fee, the Maintenance Fee, and any other amounts payable under this Agreement or a Change Order.

1.1.19 "Final Acceptance" means Acceptance of all Phase 3 Deliverables and of the Application as a whole, as described in Exhibit A.

1.1.20 "Fixed Fee" means the total fixed fee of One Hundred Eighty-Six Thousand U.S. Dollars (US $186,000) for the Development Services described in Section 6.1.

1.1.21 "Force Majeure Event" has the meaning given in Section 16.1.

1.1.22 "Go-Live" means the Application has been deployed to Client's production environment and is available for use by Client's patients and providers.

1.1.23 "HIPAA" means the Health Insurance Portability and Accountability Act of 1996, the Health Information Technology for Economic and Clinical Health Act (HITECH), and their implementing regulations at 45 C.F.R. Parts 160 and 164, each as amended.

1.1.24 "Initial Term" has the meaning given in Section 14.1.

1.1.25 "Intellectual Property Rights" means all patents, copyrights, trademarks, trade secrets, moral rights, database rights, and other intellectual property or proprietary rights worldwide, whether registered or unregistered, including all applications, renewals, and extensions.

1.1.26 "Maintenance Fee" means the monthly fee for Maintenance Services described in Section 6.2.

1.1.27 "Maintenance Services" means the ongoing maintenance and support services described in Section 5.3 and Exhibit D, which Developer provides during any Renewal Term.

1.1.28 "Milestone" means each of the four payment milestones described in Section 6.1 and Exhibit A.

1.1.29 "Nonconformity" means any failure of a Deliverable or the Application to materially meet the applicable Acceptance Criteria, Specifications, or Documentation.

1.1.30 "Open-Source Software" means software licensed under terms approved by the Open Source Initiative or similar "free," "open-source," or "copyleft" licensing models.

1.1.31 "Party" means Developer or Client, and "Parties" means both of them.

1.1.32 "Phase" means each of Phase 1, Phase 2, and Phase 3 of the Development Services, as described in Exhibit A.

1.1.33 "PHI" means "protected health information" as defined in 45 C.F.R. § 160.103, limited to information that Developer creates, receives, maintains, or transmits for Client.

1.1.34 "Project Manager" has the meaning given in Section 3.1.

1.1.35 "Renewal Term" has the meaning given in Section 14.2.

1.1.36 "Security Incident" means any actual or reasonably suspected unauthorized access to, or unauthorized acquisition, use, disclosure, modification, or destruction of, Client Data. This includes a "Breach of Unsecured PHI" as defined under HIPAA.

1.1.37 "Services" means, together, the Development Services, the Warranty Support Services, the Maintenance Services, and any other services Developer performs under this Agreement.

1.1.38 "Development Services" means the design, development, testing, integration, and deployment services for Phases 1 through 3 described in Section 2.2 and Exhibit A.

1.1.39 "Specifications" means the functional and technical specifications for the Application in Exhibit A, as refined in the design documents approved under Phase 1 and as changed by any Change Order.

1.1.40 "Term" means the Initial Term together with all Renewal Terms.

1.1.41 "Third-Party Components" means software, services, libraries, APIs, or other materials owned by a third party, including Open-Source Software, that are incorporated into or used with the Application. Examples include the Stripe platform and the EHR API.

1.1.42 "Warranty Period" means the ninety (90) day period after Final Acceptance.

1.1.43 "Warranty Support Services" means the post-launch bug-fix support described in Section 5.1.

1.2 Interpretation. In this Agreement:

• Headings are for convenience only and do not affect interpretation.
• "Including" means "including without limitation."
• The singular includes the plural and the reverse.
• A reference to a Section or Exhibit means a Section of, or Exhibit to, this Agreement.
• A reference to a statute or regulation includes it as amended or replaced.

If the body of this Agreement conflicts with an Exhibit, the body controls unless the Exhibit expressly states otherwise. However, the BAA controls on any matter involving PHI.

2. ENGAGEMENT AND SCOPE OF SERVICES

2.1 Engagement. Client engages Developer, and Developer agrees, to perform the Services and provide the Deliverables under this Agreement.

2.2 Scope of Development Services. Developer will design, build, test, and deploy the Application. The Application will be a desktop and mobile-responsive web application consisting of the following components, each as further described in Exhibit A:

2.2.1 Patient Booking Portal. A patient-facing portal for appointment booking. It will support account creation and authentication, provider and appointment-type search, real-time availability, booking, rescheduling, cancellation, automated confirmations and reminders, and digital patient-intake forms.

2.2.2 Provider Dashboard. A provider-facing dashboard. It will support schedule management, availability configuration, appointment and intake review, and two-way calendar synchronization with the calendar platforms identified in Exhibit A.

2.2.3 Secure Messaging Module. A secure messaging module between patients and providers. It will be designed and implemented with the administrative, physical, and technical safeguards required by HIPAA, including encryption in transit and at rest, role-based access controls, audit logging, and session management.

2.2.4 Integrations.

• (a) Integration with Client's existing Stripe billing system for appointment-related payments, deposits, and payment status.
• (b) Integration with the EHR API for the patient demographic, scheduling, and encounter data exchange described in Exhibit A.

2.2.5 Post-Launch Support. Warranty Support Services during the Warranty Period, as described in Section 5.1.

2.3 Phased Delivery. Developer will perform the Development Services in three Phases, following the Milestones, target dates, and Deliverables in Exhibit A. Target dates are good-faith estimates. They are binding only as stated in Exhibit A or Section 4.6, and they will be adjusted fairly for delays caused by Client, Third-Party Components outside Developer's control, or Force Majeure Events.

2.4 Standards of Performance. Developer will perform the Services:

• in a professional and workmanlike manner;
• consistent with generally accepted industry standards for similar healthcare software projects;
• using personnel with the skills, training, and experience the work requires; and
• in compliance with applicable law, including HIPAA and the BAA.

2.5 Personnel and Subcontractors.

• 2.5.1 Developer decides how, when, and by whom the Services are performed, subject to this Agreement.
• 2.5.2 Developer may use subcontractors only with Client's prior written consent, which Client will not unreasonably withhold, condition, or delay.
• 2.5.3 Before any subcontractor may access PHI, it must sign a written subcontractor business associate agreement that is at least as protective as the BAA, and written confidentiality obligations at least as protective as Section 8.
• 2.5.4 Developer remains fully responsible for the acts and omissions of its subcontractors.
• 2.5.5 Developer will not perform any Services involving access to PHI from outside the United States, or allow any PHI to be stored or processed outside the United States, without Client's prior written consent.

2.6 Independent Contractor. Developer is an independent contractor. Nothing in this Agreement creates a partnership, joint venture, agency, fiduciary, or employment relationship between the Parties. Developer is solely responsible for its personnel's compensation, benefits, withholding, and employment taxes.

2.7 Third-Party and Open-Source Components. Developer will use Third-Party Components only as listed in Exhibit B or as Client otherwise approves in writing. The Exhibit B list is: [Insert list of any third-party/open-source components to be incorporated].

Developer will not incorporate any Open-Source Software licensed under terms that would do any of the following, without Client's prior written consent:

• (a) require disclosure or distribution of the Application's proprietary source code;
• (b) grant third parties rights to modify or redistribute the Deliverables; or
• (c) restrict Client's ability to charge for the Application.

The GNU GPL and AGPL are examples of licenses that may have these effects.

3. PROJECT GOVERNANCE AND CLIENT RESPONSIBILITIES

3.1 Project Managers. Each Party designates the following project manager ("Project Manager"). Each Project Manager is the primary point of contact and has authority to make day-to-day project decisions. Only an authorized officer of a Party may sign Change Orders or amendments.

• 3.1.1 Client's Project Manager: [Insert Client's designated Project Manager name and email]
• 3.1.2 Developer's Project Manager: [Insert Developer's designated Project Manager name and email]

Either Party may replace its Project Manager by written notice to the other. Developer will not replace its Project Manager during a Phase without reasonable prior notice to Client, except in cases of resignation, termination, illness, or leave.

3.2 Status Reporting. Developer will send Client written status reports every two weeks. Each report will cover progress against the Milestones, open issues, risks, and any expected delays. The Project Managers will meet, virtually or in person, at least every two weeks during the Development Services.

3.3 Client Responsibilities. Client will, at its own cost and in a timely manner:

• 3.3.1 give Developer the Client Materials, information, decisions, and approvals that Developer reasonably requests to perform the Services;
• 3.3.2 give Developer appropriate access to Client's Stripe account (sandbox and production), EHR API credentials and environments, hosting environments, and other systems, and obtain any third-party consents, licenses, or vendor approvals those access rights require (including any required approvals from Client's EHR vendor);
• 3.3.3 make knowledgeable personnel reasonably available for requirements sessions, reviews, and acceptance testing;
• 3.3.4 procure and maintain, in Client's name and at Client's expense, the production hosting, domain, third-party subscriptions, and other services specified as Client's responsibility in Exhibit A; and
• 3.3.5 ensure that Client Materials, and Client's use of them with the Application, do not infringe third-party rights or violate applicable law.

If Client fails to meet these responsibilities, and the failure delays or prevents Developer's performance, then Developer is excused from its affected obligations to the extent of the failure. The affected dates will be extended fairly. Developer must promptly notify Client in writing of any failure it intends to rely on under this Section.

3.4 Change Orders.

• 3.4.1 Either Party may request a change to the Services, Deliverables, Specifications, or schedule by written notice.
• 3.4.2 Within ten (10) Business Days after receiving or issuing a change request, Developer will give Client a written proposal describing the change and its effect on the schedule, Fees, and Acceptance Criteria.
• 3.4.3 No change is binding until both Parties sign a Change Order.
• 3.4.4 Unless a Change Order says otherwise, additional work will be priced at Developer's then-current rates in Exhibit A.
• 3.4.5 Developer is not obligated to perform, and Client is not obligated to pay for, any work outside the scope of this Agreement unless a signed Change Order covers it.

4. DELIVERY AND ACCEPTANCE

4.1 Delivery. When Developer completes the Deliverables for a Milestone, it will deliver them to Client with written notice that they are ready for acceptance testing. Deliverables will be delivered in the staging environment specified in Exhibit A, with the related Documentation and test results.

4.2 Acceptance Testing. Client will have ten (10) Business Days after receiving Developer's notice (the "Acceptance Period") to test the Deliverables against the Acceptance Criteria. The Acceptance Criteria for each Milestone are: [Insert specific milestone acceptance test criteria per Exhibit A]. Developer will provide reasonable assistance with testing. Before the end of the Acceptance Period, Client will do one of the following in writing:

• 4.2.1 accept the Deliverables; or
• 4.2.2 reject the Deliverables, with a reasonably detailed description of each Nonconformity, including the steps needed to reproduce it where applicable.

4.3 Correction and Re-Testing. If Client rejects Deliverables under Section 4.2.2, Developer will correct the reported Nonconformities and redeliver the Deliverables. Developer will do this within ten (10) Business Days, or within any other reasonable period the Project Managers agree in writing given how complex the Nonconformities are. Client will then have a new Acceptance Period of five (5) Business Days, limited to (a) testing the corrected Nonconformities and (b) regression testing of functionality those corrections affect.

4.4 Deemed Acceptance. Deliverables are deemed Accepted in either of these cases:

• 4.4.1 Client does not give written acceptance or a compliant rejection notice before the Acceptance Period expires, and then fails to respond within three (3) Business Days after receiving Developer's written reminder that refers to this Section 4.4; or
• 4.4.2 Client uses the Deliverables in a live production environment for commercial purposes, other than for acceptance testing or a pilot the Parties have agreed in writing.

4.5 Minor Nonconformities. Client will not withhold Acceptance because of Nonconformities that are cosmetic or that do not materially affect the functionality, security, or performance of the Deliverables. Developer will correct these Nonconformities within a reasonable time.

4.6 Repeated Failure. If Deliverables still contain a material Nonconformity after two (2) correction cycles under Section 4.3, Client may choose one of the following remedies by written notice:

• 4.6.1 give Developer another correction cycle;
• 4.6.2 accept the Deliverables subject to a fair reduction in the related Milestone payment, agreed in good faith; or
• 4.6.3 treat the failure as a material breach and terminate this Agreement under Section 14.4. In that case, Section 14.6.2 applies.

4.7 Final Acceptance and Go-Live. Final Acceptance happens when all Phase 3 Deliverables and the complete Application have been Accepted, including successful end-to-end integration testing of the Stripe and EHR API integrations and completion of the security testing described in Exhibit A. Go-Live will occur on a date the Parties agree after Final Acceptance.

If Go-Live does not occur within fifteen (15) Business Days after Final Acceptance for reasons not attributable to Developer, then the Milestone 4 payment becomes payable as if Go-Live had occurred on the fifteenth (15th) Business Day.

5. WARRANTY SUPPORT AND MAINTENANCE SERVICES

5.1 Warranty Support Services. During the Warranty Period, Developer will correct, at no extra charge, any reproducible Nonconformity in the Application that Client reports in writing. Developer will respond to and resolve reported Nonconformities according to the severity levels and response targets in Exhibit D.

Warranty Support Services are included in the Fixed Fee. They do not include the following, which Developer will address only under a Change Order or as Maintenance Services:

• 5.1.1 new features or enhancements;
• 5.1.2 issues caused by changes to the Application made by anyone other than Developer or its subcontractors;
• 5.1.3 issues caused by Client Materials, Client's hosting environment, or Third-Party Components (including changes to the Stripe platform or the EHR API made after Final Acceptance); or
• 5.1.4 issues caused by use of the Application other than as described in the Documentation.

5.2 Extension of Warranty Period. If Developer fails to resolve a Severity 1 or Severity 2 Nonconformity (as defined in Exhibit D) within the applicable resolution target, the Warranty Period will be extended by the number of days the Nonconformity remains unresolved beyond that target.

5.3 Maintenance Services. During each Renewal Term, Developer will provide the Maintenance Services described in Exhibit D for the Maintenance Fee. These include:

• ongoing bug fixes;
• security patching and dependency updates;
• compatibility updates for changes to the Stripe platform and EHR API;
• monitoring and incident response support; and
• a monthly allocation of minor enhancement hours, as specified in Exhibit D.

5.4 Overlap with Warranty Period. If any part of the Warranty Period falls within a Renewal Term, Developer will continue to provide Warranty Support Services at no charge for the rest of the Warranty Period. The Maintenance Fee for that period covers only the Maintenance Services that go beyond Warranty Support Services.

6. FEES AND PAYMENT

6.1 Fixed Fee for Development Services. In exchange for the Development Services and Warranty Support Services, Client will pay Developer the Fixed Fee of US $186,000, in the following installments:

6.1.1 The Fixed Fee covers all labor, overhead, and Developer's ordinary business expenses for the Development Services. It does not cover third-party license, subscription, hosting, or usage fees, which are Client's responsibility as specified in Exhibit A. It also does not cover work under Change Orders.

6.1.2 Travel expenses are reimbursable only if Client approves them in advance and in writing, and only in accordance with Client's reasonable travel policy provided to Developer.

6.2 Maintenance Fee. Starting on the first day of the first Renewal Term, Client will pay Developer a Maintenance Fee of Eight Thousand Five Hundred U.S. Dollars (US $8,500) per month. The Maintenance Fee will be invoiced monthly in advance. It will be prorated for any partial month.

Developer may adjust the Maintenance Fee for any Renewal Term by giving Client written notice at least sixty (60) days before that Renewal Term begins. Any increase is limited to [five percent (5%)] over the rate for the immediately preceding Renewal Term, unless Client agrees otherwise in writing.

6.3 Invoicing and Payment Terms.

• 6.3.1 Milestone 1 Invoice. Developer will issue the Milestone 1 invoice when this Agreement is signed. Client will pay it within fifteen (15) days after signing. Developer may postpone starting the Development Services until it receives this payment. If it does, all target dates will be extended day-for-day.
• 6.3.2 Milestone 2–4 Invoices. Developer will issue each invoice for Milestones 2 through 4 on or after the date of the applicable Acceptance (or the date determined under Section 4.7). Each is due Net fifteen (15) days from the date of that Acceptance or the Section 4.7 date, or from the invoice date if later.
• 6.3.3 Maintenance Invoices. Maintenance Fee invoices are due Net fifteen (15) days from the invoice date.
• 6.3.4 Payment Method. Client will pay all amounts in U.S. Dollars by ACH or wire transfer to the account Developer designates in writing. Developer will verify any change to its payment instructions with Client by telephone using a known contact before Client is required to follow them.

6.4 Late Payment. Any undisputed amount not paid when due will accrue a late charge of one and one-half percent (1.5%) per month, or the maximum rate permitted by applicable law if lower. The late charge accrues from the due date until paid. [Insert late fee interest rate if different from statutory default]

If any undisputed amount remains unpaid more than thirty (30) days after its due date, Developer may, after at least ten (10) Business Days' prior written notice, suspend the Services until all past-due amounts are paid. Suspension will not apply to any obligations under the BAA or Section 9. All affected dates will be extended by the length of the suspension.

6.5 Disputed Invoices. If Client disputes any invoice in good faith, it must notify Developer in writing within ten (10) Business Days after receiving the invoice, with a reasonably detailed explanation. Client must pay the undisputed portion on time. The Parties will resolve the dispute under Section 15.

No late charge accrues on disputed amounts while the dispute is pending. If the dispute is resolved in Developer's favor, late charges on the disputed amount will accrue from the original due date.

6.6 Taxes. All Fees exclude taxes. Client is responsible for all applicable sales, use, value-added, and similar taxes on the Services or Deliverables, other than taxes on Developer's net income, property, or employees. If Developer is required to collect any such tax, it will list the tax separately on the invoice, and Client will pay it unless Client provides a valid exemption certificate. Each Party will reasonably cooperate to minimize taxes lawfully, including by structuring delivery of Deliverables electronically where appropriate.

7. INTELLECTUAL PROPERTY

7.1 Ownership of Deliverables. Subject to Client's payment of the Milestone payments that apply to the relevant Deliverables, all right, title, and interest in and to the Deliverables, including all Intellectual Property Rights in them, belongs exclusively to Client.

7.1.1 To the extent permitted by law, the Deliverables are "works made for hire" for Client under the U.S. Copyright Act.

7.1.2 To the extent any Deliverable is not a work made for hire, Developer irrevocably assigns to Client, effective upon receipt of the applicable payment, all of Developer's right, title, and interest in and to that Deliverable.

7.1.3 Developer will sign any further documents and take any further actions Client reasonably requests, at Client's expense, to perfect, register, or enforce Client's rights in the Deliverables.

7.1.4 Developer waives, and will cause its personnel and subcontractors to waive, any moral rights in the Deliverables, to the extent permitted by law.

7.2 Interim License. Until a Deliverable is assigned to Client under Section 7.1, Developer grants Client a non-exclusive, non-transferable, royalty-free license to use that Deliverable internally for evaluation and acceptance testing only.

7.3 Developer Pre-Existing IP. Developer retains all right, title, and interest in and to the Developer Pre-Existing IP. To the extent any Developer Pre-Existing IP is incorporated into or needed to use the Deliverables, Developer grants Client and its Affiliates a license to use it that is:

• non-exclusive, perpetual, irrevocable, worldwide, royalty-free, and fully paid-up;
• effective on payment of the applicable Milestone;
• transferable only together with the Deliverables; and
• sufficient to use, copy, modify, create derivative works of, and distribute that Developer Pre-Existing IP, solely as part of or in connection with the Application.

Developer will identify all material Developer Pre-Existing IP incorporated into the Deliverables in Exhibit B or in the Documentation.

7.4 Third-Party Components. Third-Party Components are licensed to Client under their own license terms. The Parties will list them in Exhibit B. Developer will pass through to Client any licenses and warranties Developer receives for Third-Party Components, to the extent permitted. Client is responsible for maintaining its own accounts and agreements with Stripe, its EHR vendor, and other third-party service providers.

7.5 Client Materials. Client retains all right, title, and interest in and to the Client Materials. Client grants Developer a non-exclusive, non-transferable, royalty-free license during the Term to use the Client Materials solely to perform the Services. This license is subject to Section 8, Section 9, and the BAA.

7.6 Source Code Delivery. On each Acceptance, and in any event upon Final Acceptance, Developer will deliver to Client (or make available in a Client-controlled repository) the complete source code for the Accepted Deliverables. Delivery will include build scripts, configuration files, deployment instructions, and the Documentation, so that a reasonably skilled developer could maintain and build the Application.

7.7 General Knowledge. Developer and its personnel may freely use general skills, knowledge, and experience, and general ideas, concepts, and techniques, retained in unaided memory from performing the Services. This right does not permit Developer to:

• (a) use or disclose Client Confidential Information or Client Data;
• (b) copy any Deliverable or substantial part of one; or
• (c) infringe Client's Intellectual Property Rights.

7.8 Reservation of Rights. All rights not expressly granted in this Agreement are reserved.

8. CONFIDENTIALITY AND NON-DISCLOSURE

8.1 Definition. "Confidential Information" means all non-public information disclosed by or for one Party (the "Disclosing Party") to the other Party (the "Receiving Party"), in any form, that is marked confidential or that a reasonable person would understand to be confidential given its nature and the circumstances of disclosure. It includes:

• business plans, pricing, product roadmaps, technical data, source code, security information, and customer and patient information; and
• the terms of this Agreement.

Client Data is Client's Confidential Information. PHI is also governed by the BAA.

8.2 Exclusions. Confidential Information does not include information that the Receiving Party can demonstrate with written records:

• 8.2.1 is or becomes publicly available through no fault of the Receiving Party;
• 8.2.2 was lawfully known to the Receiving Party, without a confidentiality obligation, before the Disclosing Party disclosed it;
• 8.2.3 is lawfully received from a third party without a confidentiality obligation; or
• 8.2.4 is independently developed by the Receiving Party without using or referring to the Disclosing Party's Confidential Information.

These exclusions do not apply to PHI.

8.3 Obligations. The Receiving Party will:

• 8.3.1 use Confidential Information only to perform its obligations or exercise its rights under this Agreement;
• 8.3.2 disclose Confidential Information only to its and its Affiliates' employees, contractors, and professional advisors who need to know it for those purposes and who are bound by written or professional confidentiality obligations at least as protective as this Section 8; and
• 8.3.3 protect Confidential Information using at least the same degree of care it uses for its own similar information, and no less than reasonable care.

8.4 Compelled Disclosure. The Receiving Party may disclose Confidential Information to the extent required by law, regulation, or court order. Before doing so, and where legally permitted, it must give the Disclosing Party prompt written notice and reasonable cooperation so the Disclosing Party can seek a protective order. The Receiving Party will disclose only the portion legally required.

8.5 Return or Destruction. When this Agreement ends, or earlier on written request, the Receiving Party will promptly return or securely destroy the Disclosing Party's Confidential Information and certify that it has done so in writing. The Receiving Party may retain copies required by law or held in routine backup systems, as long as those copies remain subject to this Section 8. PHI will be returned or destroyed in accordance with the BAA.

8.6 Duration. The obligations in this Section 8 continue during the Term and for five (5) years afterward. However, obligations for trade secrets, source code, and security information continue for as long as that information remains a trade secret or confidential under applicable law, and obligations for PHI continue as required by the BAA and HIPAA.

8.7 Equitable Relief. A breach of this Section 8 may cause the Disclosing Party irreparable harm for which money damages would be inadequate. The Disclosing Party may therefore seek injunctive or other equitable relief under Section 15.5, in addition to its other remedies.

9. DATA PROTECTION, HIPAA, AND SECURITY

9.1 Business Associate Agreement. The Parties will sign the BAA at the same time as this Agreement. Developer will not access, create, receive, maintain, or transmit PHI until the BAA is in effect. The BAA is incorporated into this Agreement by reference.

9.2 Security Program. Developer will maintain a written information security program with administrative, physical, and technical safeguards that:

• are appropriate to the nature of Client Data;
• comply with the HIPAA Security Rule (45 C.F.R. Part 164, Subpart C); and
• meet the minimum requirements in Exhibit A.

Those minimum requirements include:

• 9.2.1 encryption of Client Data in transit (TLS 1.2 or higher) and at rest (AES-256 or equivalent);
• 9.2.2 multi-factor authentication for Developer personnel accessing production systems or PHI;
• 9.2.3 least-privilege access controls and logging of access to PHI;
• 9.2.4 secure software development practices, including code review and vulnerability scanning, aligned with the OWASP Top 10 or a similar recognized framework; and
• 9.2.5 independent penetration testing of the Application before Go-Live. Developer will remediate all critical and high-severity findings before Go-Live.

9.3 Development Data. Developer will use de-identified or synthetic data for development and testing. It will not use production PHI in non-production environments unless Client authorizes that use in writing and the environment meets the safeguards in Section 9.2.

9.4 Payment Card Data. Developer will implement the Stripe integration using Stripe-hosted or tokenized payment elements, so that cardholder data is not stored, processed, or transmitted by the Application's servers. This is intended to minimize Client's PCI DSS compliance scope. Client remains responsible for its own PCI DSS compliance and its Stripe account configuration.

9.5 Security Incidents. Developer will notify Client in writing without unreasonable delay, and in any event within [seventy-two (72) hours], after discovering a Security Incident. Developer will:

• give Client the information Client reasonably needs to meet its legal obligations;
• take reasonable steps to contain and remediate the Security Incident; and
• cooperate with Client's investigation.

Notification obligations for Breaches of Unsecured PHI are also governed by the BAA.

9.6 Compliance with Laws. Each Party will comply with all data protection and privacy laws that apply to it, including HIPAA and applicable state health-privacy and consumer-privacy laws, such as the California Confidentiality of Medical Information Act where applicable to Client. Client is responsible for:

• providing any notices to, and obtaining any consents from, patients and providers that are required for Client's use of the Application; and
• the clinical, regulatory, and licensing aspects of its telehealth services.

10. REPRESENTATIONS, WARRANTIES, AND DISCLAIMERS

10.1 Mutual Representations. Each Party represents and warrants to the other that:

• 10.1.1 it is duly organized, validly existing, and in good standing under the laws of its jurisdiction of organization;
• 10.1.2 it has full power and authority to enter into and perform this Agreement;
• 10.1.3 signing and performing this Agreement does not conflict with any other agreement or obligation that binds it; and
• 10.1.4 this Agreement is a legal, valid, and binding obligation, enforceable against it in accordance with its terms.

10.2 Developer Warranties. Developer represents and warrants to Client that:

• 10.2.1 the Services will be performed in accordance with Section 2.4;
• 10.2.2 during the Warranty Period, the Application will perform materially in accordance with the Specifications, the Acceptance Criteria, and the Documentation;
• 10.2.3 when delivered, the Deliverables will not contain any virus, malware, time bomb, back door, or other harmful code, and will not contain any undisclosed disabling or license-key mechanism;
• 10.2.4 to Developer's knowledge, the Deliverables and Developer Pre-Existing IP, as delivered, will not infringe or misappropriate any third party's Intellectual Property Rights;
• 10.2.5 the Deliverables will not include any Open-Source Software or other Third-Party Components not disclosed in Exhibit B, and Developer will comply with the license terms of all Third-Party Components it incorporates; and
• 10.2.6 neither Developer nor any of its personnel performing the Services is excluded, debarred, or suspended from any federal healthcare program, including under 42 U.S.C. § 1320a-7. Developer will notify Client promptly if this changes.

10.3 Warranty Remedy. If Developer breaches the warranty in Section 10.2.1 or Section 10.2.2, Developer will, as its primary obligation and at no additional charge, re-perform the non-conforming Services or correct the Nonconformity. If Developer cannot do so within a reasonable time after written notice, Client may pursue its other rights and remedies under this Agreement, subject to Section 12.

10.4 Client Warranties. Client represents and warrants to Developer that:

• 10.4.1 Client has, and will maintain, all rights, licenses, and consents needed to provide the Client Materials to Developer and to allow Developer to access Client's third-party systems (including Stripe and the EHR API) for the Services; and
• 10.4.2 Client's use of the Application will comply with applicable law.

10.5 DISCLAIMER. EXCEPT FOR THE EXPRESS WARRANTIES IN THIS AGREEMENT AND THE BAA, NEITHER PARTY MAKES ANY OTHER WARRANTY, WHETHER EXPRESS, IMPLIED, STATUTORY, OR OTHERWISE. EACH PARTY SPECIFICALLY DISCLAIMS ALL IMPLIED WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, TITLE, AND NON-INFRINGEMENT, AND ALL WARRANTIES ARISING FROM COURSE OF DEALING OR USAGE OF TRADE. DEVELOPER DOES NOT WARRANT THAT THE APPLICATION WILL BE ERROR-FREE OR UNINTERRUPTED. DEVELOPER MAKES NO WARRANTY ABOUT THIRD-PARTY COMPONENTS, THE STRIPE PLATFORM, OR THE EHR API, WHICH ARE PROVIDED BY THIRD PARTIES UNDER THEIR OWN TERMS. THE APPLICATION IS AN ADMINISTRATIVE AND COMMUNICATIONS TOOL. IT DOES NOT PROVIDE MEDICAL ADVICE, AND CLIENT IS SOLELY RESPONSIBLE FOR ALL CLINICAL DECISIONS AND PATIENT CARE.

11. INDEMNIFICATION

11.1 Indemnification by Developer. Developer will defend Client, its Affiliates, and their respective officers, directors, employees, and agents (the "Client Indemnitees") against any claim, suit, or proceeding brought by a third party (a "Third-Party Claim"). Developer will also indemnify and hold the Client Indemnitees harmless from all resulting damages, fines, penalties, settlements, and costs (including reasonable attorneys' fees), to the extent the Third-Party Claim arises from:

• 11.1.1 an allegation that the Deliverables or Developer Pre-Existing IP, as delivered by Developer, infringe or misappropriate a third party's U.S. Intellectual Property Rights;
• 11.1.2 Developer's breach of Section 9 or the BAA, or a Security Incident caused by Developer or its subcontractors, including reasonable costs of legally required breach notifications, credit monitoring, and regulatory fines and penalties;
• 11.1.3 bodily injury, death, or damage to tangible property caused by the negligence or willful misconduct of Developer or its personnel; or
• 11.1.4 Developer's violation of applicable law in performing the Services.

11.2 Infringement Exclusions and Remedies.

• 11.2.1 Exclusions. Developer has no obligation under Section 11.1.1 to the extent the claim arises from:
  • (a) Client Materials or Specifications that Client provided and required;
  • (b) modification of the Deliverables by anyone other than Developer or its subcontractors;
  • (c) combination of the Deliverables with items not provided or specified by Developer, where the Deliverables alone would not infringe; or
  • (d) Third-Party Components that Client selected or required.
• 11.2.2 Remedies. If the Deliverables become, or in Developer's reasonable opinion are likely to become, the subject of an infringement claim, Developer will, at its expense and option, do one of the following:
  • (a) procure the right for Client to continue using them;
  • (b) modify or replace them so they are non-infringing without material loss of functionality; or
  • (c) if neither (a) nor (b) is commercially reasonable, accept return of the affected Deliverables and refund the Fees paid for them, less straight-line depreciation over a five-year useful life.

11.3 Indemnification by Client. Client will defend Developer, its Affiliates, and their respective officers, managers, members, employees, and agents (the "Developer Indemnitees") against any Third-Party Claim. Client will also indemnify and hold the Developer Indemnitees harmless from all resulting damages, fines, penalties, settlements, and costs (including reasonable attorneys' fees), to the extent the Third-Party Claim arises from:

• 11.3.1 an allegation that the Client Materials infringe or misappropriate a third party's Intellectual Property Rights, or that providing or using them as permitted under this Agreement violates applicable law;
• 11.3.2 Client's provision of clinical or telehealth services, including any claim of medical malpractice or professional negligence;
• 11.3.3 bodily injury, death, or damage to tangible property caused by the negligence or willful misconduct of Client or its personnel; or
• 11.3.4 Client's violation of applicable law, including HIPAA, in its use of the Application.

11.4 Procedure. The Party seeking indemnification (the "Indemnified Party") will:

• 11.4.1 promptly notify the other Party (the "Indemnifying Party") in writing of the Third-Party Claim. A failure to notify promptly relieves the Indemnifying Party only to the extent it is materially prejudiced by the failure;
• 11.4.2 give the Indemnifying Party sole control of the defense and settlement of the claim. However, the Indemnifying Party may not agree to any settlement that imposes non-monetary obligations or an admission of fault on the Indemnified Party without that Party's prior written consent, which will not be unreasonably withheld; and
• 11.4.3 provide reasonable cooperation at the Indemnifying Party's expense.

The Indemnified Party may participate in the defense with counsel of its own choice, at its own expense.

11.5 Exclusive Remedy. Sections 11.1.1 and 11.2 set out Developer's entire liability, and Client's exclusive remedy, for third-party claims of infringement or misappropriation.

12. LIMITATION OF LIABILITY

12.1 Exclusion of Consequential Damages. EXCEPT FOR EXCLUDED CLAIMS (DEFINED IN SECTION 12.4), NEITHER PARTY WILL BE LIABLE TO THE OTHER FOR ANY INDIRECT, INCIDENTAL, CONSEQUENTIAL, SPECIAL, EXEMPLARY, OR PUNITIVE DAMAGES, OR FOR ANY LOSS OF PROFITS, REVENUE, BUSINESS, OR GOODWILL, ARISING OUT OF OR RELATING TO THIS AGREEMENT. THIS APPLIES REGARDLESS OF THE THEORY OF LIABILITY, AND EVEN IF THE PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES.

12.2 General Cap. EXCEPT FOR EXCLUDED CLAIMS AND CLAIMS SUBJECT TO SECTION 12.3, EACH PARTY'S TOTAL CUMULATIVE LIABILITY ARISING OUT OF OR RELATING TO THIS AGREEMENT WILL NOT EXCEED THE GREATER OF:

• (A) THE FIXED FEE; OR
• (B) THE TOTAL FEES PAID AND PAYABLE UNDER THIS AGREEMENT IN THE TWELVE (12) MONTHS BEFORE THE EVENT GIVING RISE TO THE CLAIM.

12.3 Data Protection Super-Cap. EACH PARTY'S TOTAL CUMULATIVE LIABILITY FOR BREACH OF SECTION 9 OR THE BAA, AND DEVELOPER'S OBLIGATIONS UNDER SECTION 11.1.2, WILL NOT EXCEED [TWO (2) TIMES] THE AMOUNT DETERMINED UNDER SECTION 12.2. THIS SUPER-CAP IS SEPARATE FROM, AND IN ADDITION TO, THE GENERAL CAP. [Consider aligning with the limits of Developer's cyber liability insurance under Section 13.]

12.4 Excluded Claims. The limitations in Sections 12.1 and 12.2 do not apply to the following ("Excluded Claims"):

• 12.4.1 a Party's defense and indemnification obligations under Section 11.1.1, 11.1.3, 11.1.4, or 11.3;
• 12.4.2 a Party's gross negligence, fraud, or willful misconduct;
• 12.4.3 a Party's breach of Section 8, except for breaches involving Client Data, which are governed by Section 12.3;
• 12.4.4 a Party's infringement or misappropriation of the other Party's Intellectual Property Rights; or
• 12.4.5 Client's obligation to pay undisputed Fees.

12.5 Basis of the Bargain. The Parties agree that the limitations in this Section 12 reflect a reasonable allocation of risk and are an essential basis of their bargain. These limitations apply to the fullest extent permitted by applicable law.

13. INSURANCE

13.1 Developer Insurance. During the Term and for at least one (1) year afterward, Developer will maintain, with insurers rated A- or better by A.M. Best, the following minimum coverage:

• 13.1.1 commercial general liability insurance of at least [$1,000,000] per occurrence and [$2,000,000] aggregate;
• 13.1.2 technology errors and omissions (professional liability) insurance of at least [$2,000,000] per claim and aggregate;
• 13.1.3 cyber liability / network security and privacy insurance, including coverage for breach response costs and regulatory fines where insurable, of at least [$2,000,000] per claim and aggregate; and
• 13.1.4 workers' compensation insurance as required by law.

Developer will provide certificates of insurance on request. Developer will give Client at least thirty (30) days' prior written notice of cancellation or material reduction of any required coverage.

13.2 Client Insurance. Client will maintain insurance customary for a telehealth provider of its size, including professional (medical malpractice) liability insurance and cyber liability insurance.

14. TERM AND TERMINATION

14.1 Initial Term. This Agreement begins on the Effective Date and continues for nine (9) months, through July 31, 2027 (the "Initial Term"), unless terminated earlier under this Section 14. The Initial Term covers the three development Phases.

If Final Acceptance has not occurred by the end of the Initial Term, the Initial Term automatically extends until Final Acceptance. The extension does not change the Fixed Fee. However, if the delay is attributable to Client, a Change Order may be issued under Section 3.4. This extension does not waive any rights or remedies either Party may have for delay.

14.2 Renewal Terms. After the Initial Term, this Agreement automatically renews for successive three (3) month maintenance and support terms (each a "Renewal Term"). Either Party may prevent renewal by giving the other written notice of non-renewal at least thirty (30) days before the end of the then-current Initial Term or Renewal Term.

14.3 Termination for Convenience.

• 14.3.1 By Client. Client may terminate this Agreement, or the remaining Services, for convenience at any time by giving Developer at least thirty (30) days' prior written notice.
• 14.3.2 By Developer. Developer may terminate this Agreement for convenience only during a Renewal Term, by giving Client at least sixty (60) days' prior written notice. [Note: This restriction protects Client during active development. Consider whether a mutual right is commercially preferable.]

14.4 Termination for Cause. Either Party may terminate this Agreement by written notice to the other Party if:

• 14.4.1 the other Party materially breaches this Agreement and does not cure the breach within thirty (30) days after receiving written notice describing it in reasonable detail. For non-payment of undisputed Fees, the cure period is ten (10) Business Days;
• 14.4.2 the other Party becomes insolvent, makes a general assignment for the benefit of creditors, has a receiver or trustee appointed, or becomes the subject of any voluntary or involuntary bankruptcy proceeding that is not dismissed within sixty (60) days; or
• 14.4.3 in the case of Client, Developer materially breaches the BAA, as provided in the BAA.

14.5 Termination for Extended Force Majeure. Either Party may terminate this Agreement under Section 16.3.

14.6 Effect of Termination. When this Agreement expires or terminates for any reason:

• 14.6.1 Termination for convenience by Client, or for cause by Developer. Client will pay Developer:
  • (a) all Milestone payments for Milestones Accepted before the termination date;
  • (b) for the Phase in progress, a pro rata share of the related Milestone payment, based on the percentage of that Phase's work completed as of the termination date, documented by Developer and reasonably verified by Client. If the Parties dispute the percentage, it will be resolved under Section 15; and
  • (c) any accrued Maintenance Fees and pre-approved reimbursable expenses.
• 14.6.2 Termination for cause by Client. Client will pay only for Milestones Accepted before the termination date. Developer will refund any portion of the Milestone 1 payment that exceeds the fair value of the work Developer delivered to Client in usable form, as agreed by the Parties or determined under Section 15. Client may also pursue its other remedies, subject to Section 12.
• 14.6.3 Delivery of work in progress. Once Client has paid all amounts due under Section 14.6.1 or 14.6.2, as applicable, Developer will deliver to Client all Deliverables and work in progress, in their then-current form, including source code and Documentation. Client will own them under Section 7.
• 14.6.4 Transition assistance. At Client's request, Developer will provide reasonable transition assistance for up to sixty (60) days at Developer's then-current hourly rates in Exhibit A. This includes knowledge transfer and cooperation with any replacement vendor.
• 14.6.5 Confidential Information and PHI. Each Party will return or destroy the other Party's Confidential Information under Section 8.5. Developer will return or destroy PHI as required by the BAA.

14.7 Survival. The following survive expiration or termination of this Agreement, together with any other provision that by its nature is intended to survive:

• Section 1 (Definitions);
• Section 6 (Fees and Payment), for amounts accrued;
• Section 7 (Intellectual Property);
• Section 8 (Confidentiality);
• Section 9 (Data Protection, HIPAA, and Security), until all Client Data is returned or destroyed;
• Section 10.5 (Disclaimer);
• Section 11 (Indemnification);
• Section 12 (Limitation of Liability);
• Section 13 (Insurance), for the stated period;
• Section 14.6 (Effect of Termination);
• Section 14.7 (Survival);
• Section 15 (Dispute Resolution);
• Section 17 (General Provisions);
• Section 18 (Governing Law and Jurisdiction); and
• the BAA, to the extent it states that it survives.

15. DISPUTE RESOLUTION

15.1 Informal Negotiation. If any dispute, claim, or controversy arises out of or relates to this Agreement, including its breach, termination, validity, or interpretation (a "Dispute"), a Party may begin the dispute process by giving the other Party written notice describing the Dispute in reasonable detail (a "Dispute Notice").

• 15.1.1 The Project Managers will meet, in person or by video conference, within ten (10) Business Days after the Dispute Notice to try to resolve the Dispute in good faith.
• 15.1.2 If the Project Managers do not resolve the Dispute within that period, it will be escalated to a senior executive of each Party with authority to settle it. Those executives will meet within ten (10) Business Days after escalation.
• 15.1.3 All negotiations under this Section 15.1 are confidential. They are treated as compromise and settlement negotiations under Colorado Rule of Evidence 408 and any similar rules.

15.2 Binding Arbitration. If the Dispute is not resolved within thirty (30) days after the Dispute Notice is delivered, either Party may submit the Dispute to final and binding arbitration.

• 15.2.1 The arbitration will be administered by JAMS under its Streamlined Arbitration Rules & Procedures in effect when the arbitration begins (the "JAMS Rules"). The Parties agree that the JAMS Streamlined Rules apply regardless of the amount in controversy.
• 15.2.2 The arbitration will be conducted by a single neutral arbitrator. The arbitrator must be a retired judge or an attorney with at least fifteen (15) years of experience in commercial technology or software-related disputes, and will be selected under the JAMS Rules.
• 15.2.3 The seat and place of arbitration is Denver, Colorado. Hearings may be held by video conference if the arbitrator permits.
• 15.2.4 The arbitration will be conducted in English.
• 15.2.5 The arbitrator will apply the substantive law of the State of Colorado, as specified in Section 18, and the Federal Arbitration Act, 9 U.S.C. § 1 et seq.
• 15.2.6 The arbitrator has no authority to award damages excluded by, or in excess of, the limitations in Section 12. The arbitrator also has no authority to modify any term of this Agreement.
• 15.2.7 The arbitrator will issue a reasoned written award. The award is final and binding. Judgment on the award may be entered in any court of competent jurisdiction.

15.3 Costs. Each Party will bear its own attorneys' fees and costs, and the Parties will share JAMS administrative fees and arbitrator compensation equally. However, the arbitrator may award the prevailing Party its reasonable attorneys' fees and costs, including its share of JAMS fees, if the arbitrator finds that the other Party's claims or defenses were frivolous or brought in bad faith. [Alternative: prevailing party recovers fees in all cases.]

15.4 Confidentiality of Arbitration. The arbitration proceedings, submissions, and award are Confidential Information of both Parties. They may be disclosed only as needed to enforce or challenge the award, or as required by law.

15.5 Injunctive Relief. Notwithstanding Sections 15.1 and 15.2, either Party may seek temporary, preliminary, or permanent injunctive relief, specific performance, or other equitable relief from a court of competent jurisdiction under Section 18.2. It may do so without first following the negotiation process or posting a bond (to the extent permitted by law), for any actual or threatened breach of:

• Section 7 (Intellectual Property);
• Section 8 (Confidentiality);
• Section 9 (Data Protection, HIPAA, and Security); or
• the BAA, or any other infringement or misappropriation of its Intellectual Property Rights.

Seeking this relief does not waive the right to arbitrate. The merits of the underlying Dispute will be resolved by arbitration under Section 15.2.

15.6 Continued Performance. While a Dispute is pending, each Party will continue to perform its obligations under this Agreement, unless the Agreement has been terminated or the Services have been suspended in accordance with its terms.

15.7 Limitations Period. Any arbitration or court action arising from this Agreement must be started within two (2) years after the claiming Party knew, or reasonably should have known, of the facts giving rise to the claim, unless a longer period is required by law.

16. FORCE MAJEURE

16.1 Definition. "Force Majeure Event" means any event beyond a Party's reasonable control that prevents or delays its performance and that it could not have prevented or avoided by exercising reasonable diligence. Examples include:

• acts of God, fire, flood, earthquake, pandemic, or epidemic;
• war, terrorism, civil unrest, or government action;
• labor disputes, other than those involving the affected Party's own workforce; and
• widespread failures of the internet, utilities, or public cloud infrastructure, or outages of third-party platforms (including Stripe or the EHR API) that are not caused by the affected Party.

A Force Majeure Event does not include:

• a Party's lack of funds;
• cyberattacks that the affected Party's compliance with Section 9 would reasonably have prevented; or
• failures of a Party's subcontractors, unless the failure itself results from a Force Majeure Event.

16.2 Effect. A Party affected by a Force Majeure Event is excused from performance, and performance deadlines are extended, to the extent and for as long as the Force Majeure Event prevents or delays performance. The affected Party must:

• 16.2.1 notify the other Party promptly in writing, describing the event and its expected duration;
• 16.2.2 use commercially reasonable efforts to mitigate the effects and resume performance; and
• 16.2.3 continue to perform all obligations not affected by the event.

A Force Majeure Event does not excuse:

• any payment obligation for Services already performed; or
• Developer's obligations under Section 9, the BAA, or any business continuity and disaster recovery obligations set out in Exhibit D.

16.3 Extended Force Majeure. If a Force Majeure Event prevents a Party's performance of material obligations for more than forty-five (45) consecutive days, either Party may terminate this Agreement on written notice. If it does, Section 14.6.1 applies to the payment of Fees.

17. GENERAL PROVISIONS

17.1 Assignment. Neither Party may assign or transfer this Agreement, or any of its rights or obligations under it, without the other Party's prior written consent, which will not be unreasonably withheld, conditioned, or delayed. However, either Party may assign this Agreement without consent, on written notice, to an Affiliate or to a successor in a merger, acquisition, corporate reorganization, or sale of all or substantially all of its assets or business relating to this Agreement. The assignee must:

• agree in writing to be bound by this Agreement;
• not be a direct competitor of the non-assigning Party; and
• in the case of Developer, be able to meet the obligations of Section 9 and the BAA.

Any attempted assignment in violation of this Section is void. This Agreement binds and benefits the Parties and their permitted successors and assigns.

17.2 Notices. All notices under this Agreement must be in writing and delivered by one of the following methods:

• personal delivery;
• a nationally recognized overnight courier;
• certified U.S. mail, return receipt requested; or
• email, but only if a copy is also sent by one of the other methods within two (2) Business Days. Notices of breach, termination, or a Dispute must be sent by a method other than email alone.

Notices must be sent to the addresses below, or to any other address a Party designates by notice:

[Insert notice addresses for both parties]

Notices are effective:

• when delivered, if delivered personally;
• one (1) Business Day after dispatch, if sent by overnight courier;
• three (3) Business Days after mailing, if sent by certified mail; or
• when sent, if sent by email during business hours of the recipient, provided the required confirmation copy is sent.

17.3 Severability. If any provision of this Agreement is held invalid, illegal, or unenforceable, that provision will be enforced to the maximum extent permitted and modified to the minimum extent needed to make it enforceable. The remaining provisions stay in full force and effect.

17.4 Entire Agreement. This Agreement, including all Exhibits, the BAA, and any Change Orders, is the entire agreement between the Parties on its subject matter. It supersedes all prior and contemporaneous proposals, negotiations, understandings, and agreements, whether written or oral. Any pre-printed terms on a purchase order, invoice, or similar document have no effect.

17.5 Amendments and Waivers. This Agreement may be amended only by a written document that expressly refers to this Agreement and is signed by an authorized officer of each Party. A waiver is effective only if it is in writing and signed by the waiving Party. A failure or delay in exercising a right is not a waiver of that right.

17.6 Non-Solicitation. During the Term and for twelve (12) months afterward, neither Party will directly solicit for employment any employee of the other Party who was materially involved in the Services, without the other Party's prior written consent. This Section does not restrict:

• general solicitations not targeted at those employees, such as job postings; or
• hiring any person who responds to a general solicitation or who contacts the hiring Party on their own initiative.

17.7 Publicity. Neither Party will use the other Party's name, logo, or trademarks in any publicity, marketing, or client list without the other Party's prior written consent.

17.8 Compliance; Anti-Kickback. Each Party will comply with all laws that apply to its performance. Nothing in this Agreement requires or rewards the referral of patients or any business reimbursable by a federal healthcare program.

17.9 Records and Audit. Developer will keep accurate records of the Services and of its compliance with Section 9 during the Term and for three (3) years afterward. On at least thirty (30) days' written notice, and no more than once per year (or at any time after a Security Incident), Client or its independent auditor may audit those records to verify compliance. Audits will take place during normal business hours and are subject to reasonable confidentiality obligations. Client bears the cost of the audit.

17.10 No Third-Party Beneficiaries. This Agreement is for the sole benefit of the Parties and their permitted successors and assigns. The only exception is the Indemnitees under Section 11. Nothing in this Agreement gives any other person any legal or equitable right or remedy.

17.11 Cumulative Remedies. Except as expressly stated in this Agreement, all rights and remedies are cumulative and in addition to any other rights and remedies available at law or in equity.

17.12 Construction. This Agreement was negotiated by both Parties with the opportunity to consult counsel. No provision will be interpreted against a Party because that Party drafted it.

17.13 Counterparts; Electronic Signatures. This Agreement may be signed in counterparts. Each counterpart is an original, and all counterparts together form one instrument. Signatures delivered by electronic means (including PDF or a recognized e-signature platform) are valid and binding under the Colorado Uniform Electronic Transactions Act and the federal E-SIGN Act.

18. GOVERNING LAW AND JURISDICTION

18.1 Governing Law. This Agreement, and all Disputes arising out of or relating to it, are governed by and interpreted under the laws of the State of Colorado, United States, without regard to its conflict-of-laws principles. The Federal Arbitration Act governs the interpretation and enforcement of Section 15. The United Nations Convention on Contracts for the International Sale of Goods and the Uniform Computer Information Transactions Act (in any form enacted) do not apply to this Agreement.

18.2 Jurisdiction and Venue. Subject to the Parties' agreement to arbitrate in Section 15, each Party irrevocably submits to the exclusive jurisdiction of the state courts located in the City and County of Denver, Colorado, and the United States District Court for the District of Colorado, for:

• 18.2.1 actions seeking injunctive or equitable relief under Section 15.5;
• 18.2.2 actions to compel arbitration or to confirm, modify, vacate, or enforce an arbitration award; and
• 18.2.3 any other matter that is not subject to arbitration.

Each Party waives any objection to venue in those courts, including any objection based on forum non conveniens. A judgment on an arbitration award may also be entered in any court with jurisdiction.

18.3 Jury Trial Waiver. TO THE FULLEST EXTENT PERMITTED BY LAW, EACH PARTY KNOWINGLY AND VOLUNTARILY WAIVES ANY RIGHT TO A TRIAL BY JURY IN ANY PROCEEDING ARISING OUT OF OR RELATING TO THIS AGREEMENT THAT IS HEARD IN COURT.

SIGNATURES

IN WITNESS WHEREOF, the Parties have caused this Agreement to be signed by their duly authorized representatives as of the Effective Date.

[Insert signature names, titles, and dates]

EXHIBIT A — STATEMENT OF WORK, MILESTONES, AND ACCEPTANCE CRITERIA

A.1 Proposed Phase Structure (target dates are subject to confirmation by the Parties)

A.2 Acceptance Criteria: [Insert specific milestone acceptance test criteria per Exhibit A]

A.3 Environments and Client-Procured Services: [Hosting provider (HIPAA-eligible, with signed BAA), domains, email/SMS providers, calendar APIs, EHR vendor access]

A.4 Supported Browsers and Devices: [e.g., last two major versions of Chrome, Safari, Edge, and Firefox; iOS and Android mobile browsers]

A.5 Minimum Security Requirements: [Supplement Section 9.2 as needed]

A.6 Change Order Rates: [Role-based hourly rates]

EXHIBIT B — THIRD-PARTY AND OPEN-SOURCE COMPONENTS; DEVELOPER PRE-EXISTING IP

[Insert list of any third-party/open-source components to be incorporated]

EXHIBIT C — BUSINESS ASSOCIATE AGREEMENT

[Attach the full BAA. At minimum, it must address the elements required by 45 C.F.R. § 164.504(e):

• permitted and required uses and disclosures of PHI;
• appropriate safeguards and compliance with the Security Rule;
• reporting of Security Incidents and Breaches of Unsecured PHI;
• flow-down to subcontractors;
• support for individuals' rights of access, amendment, and accounting of disclosures;
• availability of books and records to HHS;
• return or destruction of PHI at termination; and
• termination for material breach.]

EXHIBIT D — WARRANTY SUPPORT AND MAINTENANCE SERVICES

[Severity definitions (Severity 1–4); response and resolution targets; support hours and channels; monitoring; security patch cadence; monthly enhancement-hour allocation included in the $8,500 Maintenance Fee; rate for hours beyond that allocation; backup and disaster recovery obligations (RPO/RTO)]

Assumptions Made

• Signing payment. "Due upon signing" is treated as payable within 15 days of signing, and Developer may delay starting work until it is paid. For Milestones 2–4, "Net 15 from acceptance" runs from the Acceptance date.
• Go-Live payment. The Milestone 4 payment depends on both Final Acceptance and Go-Live. To stop Client-side delays from holding back that payment indefinitely, it becomes payable anyway 15 Business Days after Final Acceptance if Go-Live is delayed for reasons not caused by Developer.
• Development overrun. If Final Acceptance happens after July 31, 2027, the Initial Term extends automatically at no extra fixed fee. Maintenance Terms, and the $8,500/month fee, start only after that. The 90-day bug-fix period may overlap a Renewal Term, and Section 5.4 prevents Client from paying twice for warranty fixes.
• Late fee. 1.5% per month (18% per year) is well below Colorado's 45% annual cap for agreed rates under C.R.S. § 5-12-103, and a "lower of" savings clause is included. Colorado's statutory default rate is 8% per year. Keep the late-fee placeholder only if you want to change the rate.
• Arbitration rules. JAMS says its Streamlined Arbitration Rules took effect June 1, 2021. The draft says those rules apply "regardless of the amount in controversy." This is because JAMS normally uses its Comprehensive Rules for larger claims, and the Parties need to agree expressly to use the Streamlined Rules.
• HIPAA. Developer is assumed to be a HIPAA business associate. The draft requires a separate BAA (Exhibit C) covering the elements required by 45 C.F.R. § 164.504(e). It also assumes Stripe-hosted payment fields so card data stays out of the Application.
• Balancing terms. Some terms I set myself are in brackets for you to confirm:
  • liability cap: the greater of the Fixed Fee or 12 months of fees, with a 2x super-cap for data breaches;
  • insurance limits;
  • 72-hour deadline for notifying Client of a security incident;
  • 5% cap on Maintenance Fee increases;
  • Developer can terminate for convenience only during Renewal Terms, while Client can terminate for convenience at any time on 30 days' notice.
• "ACH wire transfer." This is read as ACH or wire transfer.
• Phase contents and dates. The Phase breakdown in Exhibit A is only a suggested allocation. The deal summary didn't specify what goes into each Phase.

Reminder: This is a template. It must be reviewed by an attorney licensed in the State of Colorado, United States, before anyone signs it or relies on it.

Sources:

• JAMS Streamlined Arbitration Rules & Procedures
• C.R.S. § 5-12-103 (Justia)
• C.R.S. § 5-12-102 (Justia)
• HHS – Business Associates guidance
• 45 C.F.R. § 164.504 (Cornell LII)