CadLink Anywhere™ Cloud Services Agreement

1.  Scope.  These terms and conditions and the Cadwell customer Quote (collectively, the “Agreement”) will apply to access and use of Cloud Services (as defined below) offered by Cadwell Laboratories, Inc., Cadwell Industries, Inc., or CadRent LLC (in each instance “Cadwell”) to customers (each a “Customer”). Any additional or different terms, including terms in any purchase order, will be of no effect unless expressly accepted in writing by Cadwell. Customer’s issuance of a purchase order or other Customer document to procure the Cloud Services, use of the Cloud Services, or payment for the Cloud Services will be deemed to constitute Customer’s acceptance of the Agreement.

2.  Definitions.

2.1.  “Authorized User” means Customer and Customer’s employees, consultants, contractors, and agents who are authorized by Customer to access and use the Cloud Services under the rights granted to Customer pursuant to this Agreement and for whom access to the Cloud Services has been purchased hereunder.

2.2.  “Cadwell IP” means the Cloud Services, the Documentation, and all Intellectual Property provided to Customer or any other Authorized User in connection with the foregoing. For the avoidance of doubt, Cadwell IP includes Aggregated Statistics and any information, data, or other content derived from Cadwell’s monitoring of Customer’s access to or use of the Cloud Services but does not include Customer Data.

2.3.  “Cloud Services” means the provision of the CadLink Software to Customer via remote access and on a subscription basis, and related training, support, and other services provided by Cadwell under this Agreement that are reflected in the Quote and CadCare membership support as described on Cadwell’s website located at https://www.cadwell.com/cadcare/.

2.4.  “Customer Data” means information, data, and other content, in any form or medium, that is submitted, posted, or otherwise transmitted by or on behalf of Customer or any other Authorized User through the Cloud Services.

2.5.  “Documentation” means Cadwell’s user manuals, handbooks, and guides relating to the Cloud Services provided by Cadwell to Customer either electronically or in hard copy form.

2.6.  “Effective Date” means the date of first use of the Cloud Services by the Customer.

2.7.  “Intellectual Property” means Patents, copyrights, trade secrets, Know How and any other intellectual property rights arising by operation of law, contract, license, or otherwise.

2.8.  “Know-How” means any proprietary technology, information, methods of use, processes, techniques, ideas, or innovations.

2.9.  “Patents” means issued patents, patent applications, continuations, continuation-in-parts, divisions, reexaminations, reissues, and any foreign counterparts thereof.

2.10.  “Personal Information” means any information relating to an identified or identifiable natural person or household, which is collected, stored, accessed, or otherwise Processed by Cadwell for Customer.

2.11.  “Software” means firmware, standalone software, application program interfaces, administrative interfaces, and updates, upgrades, or new versions of such Software as are made available by Cadwell to Customer.

2.12.  “Third-Party Products” means any products, content, services, information, websites, or other materials that are owned by third parties and are incorporated into or accessible through the Cloud Services.

3.  Access and Use.

3.1.  Provision of Access.  Subject to the terms and conditions of this Agreement and full and timely payment of all fees owed hereunder, Cadwell hereby grants Customer a limited, non-exclusive, non-transferable, non-assignable, non-sublicensable, and revocable right to access and use the Cloud Services and the associated Documentation during the Term solely for Customer’s own internal business operations by Authorized Users in accordance with the terms of this Agreement. Customer is responsible for all acts of its Authorized Users in connection with the Cloud Services. Customer will take all commercially reasonable steps to ensure that no person or entity will have unauthorized access to or use of the Cloud Services through Customer or an Authorized User.

3.2.  Use Restrictions.  Customer will not, directly or indirectly, and will not permit any Authorized Users to: (i) use the Cloud Services or Documentation for any purposes beyond the scope of access granted in this Agreement; (ii) copy, modify, or create derivative works of the Cloud Services, any Software component of the Cloud Services, or Documentation, in whole or in part; (iii) rent, lease, lend, sell, license, sublicense, assign, distribute, publish, transfer, or otherwise make available the Cloud Services or Documentation except as expressly permitted under this Agreement; (iv) reverse engineer, disassemble, decompile, decode, adapt, or otherwise attempt to derive or gain access to any Software component of the Cloud Services, in whole or in part; (v) remove any proprietary notices from the Cloud Services or Documentation; (v) use the Cloud Services or Documentation in any manner that infringes, misappropriates, or otherwise violates any Intellectual Property right or other right of any person, or that violates any applicable law, regulation, or rule; (vi) use the Cloud Services to send or store infringing, libelous, or otherwise unlawful or tortious material, or to store or submit malicious or harmful code; (vii) interfere with or disrupt the integrity or performance of the Cloud Services or the data contained therein; (viii) attempt to gain unauthorized access to the Cloud Services or its related systems or networks; or (ix) disclose the results of any benchmark or performance tests of the Subscription Service.

3.3.  Audit Rights.  Cadwell will have the right to monitor use of the Cloud Services and Software by Customer electronically at any time, or by on-site audit of Customer’s use of the Cloud Services and Software, during normal business hours during the Term of this Agreement and for three years thereafter, to verify that Customer’s use has not exceeded the scope of the rights acquired under the Agreement. In the event that any such inspection or audit reveals that Customer has exceeded the scope of the applicable license, Cadwell will deliver written notice of noncompliance to Customer with an invoice for all fees and other amounts due and unpaid relating to such noncompliance at the then current fee rates together with accrued interest (accruing from the date on which the scope of the license rights purchased by Customer was exceeded.

3.4.  Aggregated Statistics.  Cadwell may monitor Customer’s use of the Cloud Services and collect and compile data and information related to Customer’s use of the Cloud Services to be used by Cadwell in an aggregated and anonymized manner, including but not limited to compiling statistical and performance information related to the provision and operation of the Cloud Services (“Aggregated Statistics”). As between Cadwell and Customer, all right, title, and interest in Aggregated Statistics, and all Intellectual Property rights therein, belong to and are retained solely by Cadwell. Customer acknowledges that Cadwell may compile Aggregated Statistics based on Customer Data input into the Cloud Services.

3.5.  Reservation of Rights.  Cadwell reserves all rights not expressly granted to Customer in this Agreement. Except for the limited rights and licenses expressly granted under this Agreement, nothing in this Agreement grants, by implication, waiver, estoppel, or otherwise, to Customer or any third party any Intellectual Property rights or other right, title, or interest in or to the Cadwell IP.

3.6.  Suspension.  Notwithstanding anything to the contrary in this Agreement, Cadwell may temporarily or permanently suspend Customer’s and any other Authorized User’s access to any portion or all of the Cloud Services if: (i) Cadwell reasonably determines that there is a threat or attack on any of the Cadwell IP; (ii) Customer’s or any Authorized User’s use of the Cadwell IP disrupts or poses a security risk to the Cadwell IP or to any other customer or vendor of Cadwell; (iii) Customer or any Authorized User is using the Cadwell IP for fraudulent or illegal activities; (iv) subject to applicable law, Customer has ceased to continue its business in the ordinary course, made an assignment for the benefit of creditors or similar disposition of its assets, or become the subject of any bankruptcy, reorganization, liquidation, dissolution, or similar proceeding; (v) Cadwell’s provision of the Cloud Services to Customer or any Authorized User is prohibited by applicable law; (vi) any vendor of Cadwell has suspended or terminated Cadwell’s access to or use of any Third-Party Products or services required to enable Customer to access the Cloud Services; and (vii) in accordance with Section 6.3. Cadwell will use commercially reasonable efforts to provide written notice of any suspension to Customer and to provide updates regarding resumption of access to the Cloud Services following any suspension. Cadwell will use commercially reasonable efforts to resume providing access to the Cloud Services as soon as reasonably possible after the event giving rise to the Cloud Services suspension is cured. Cadwell will have no liability for any damage, liabilities, losses (including any loss of or profits), or any other consequences that Customer or any Authorized User may incur as a result of a suspension.

3.7.  Uptime.  Cadwell will use commercially reasonable efforts to provide the Software 24 hours a day, seven days a week, except for: (i) planned maintenance; (ii) unscheduled maintenance necessary for the proper functioning of the Software; and (iii) any Excusable Delay event per Section 14.9 of this Agreement. Cadwell will use commercially reasonable efforts to notify Customer at least fourteen (14) days in advance of any routine maintenance. In the event of an unscheduled maintenance event, Cadwell will use commercially reasonable efforts to notify Customer as soon as is reasonably practical.

3.8.  Changes.  Cadwell may change the Cloud Services at any time. If such changes materially diminish the functionality of the Cloud Services, Customer will have the right to terminate the subscription for the Cloud Services by providing written notice to Cadwell within 10 days of the changes and will receive a prorated refund of the fees paid by Customer for the Cloud Services for the remainder of the Term. The termination right and refund described herein is Customer’s sole and exclusive remedy for Cadwell’s change to the Cloud Services.

4.  Customer Responsibilities.

4.1.  Cloud Service Usage.  Customer is responsible for all activities that occur in connection with use of the Cloud Services by the Customer and its Authorized Users, including the security of any passwords and any data privacy of Personal Information included in the Customer Data. Customer is responsible for keeping your passwords and access credentials associated with the Cloud Services confidential. Customer will not sell or transfer them to any other person or entity. Customer will promptly notify Cadwell about any unauthorized access to the passwords or access credentials.

4.2.  System Requirements.  Customer is responsible for obtaining and maintaining all computer or other hardware, software, communications, or other equipment and any other infrastructure, services, facilities, or resources not supplied by Cadwell or its service Cadwell and needed to access and use the Cloud Services (“Customer Equipment”) and for all problems, conditions, delays, delivery failures, and all other loss or damage arising from or relating to such Customer Equipment. Customer will maintain commercially reasonable security standards for its and its Authorized Users’ use of the Cloud Services, including without limitation the use of regular required password changes. Customer must ensure that the Customer Equipment used to access the Cloud Services complies with any system requirements designated by Cadwell. Such systems requirements include the implementation and maintenance programs for network firewall provisioning, intrusion detection, and regular vulnerability assessments. Customer further agrees to maintain network security that conforms to generally recognized industry standards and best practices to prevent malware from being coded or introduced, or other unauthorized intrusions, into the Customer Equipment used in connection with the Cloud Services.

4.3.  Third-Party Products.  The Cloud Services may permit access to Third-Party Products. For purposes of this Agreement, such Third-Party Products are subject to their own terms and conditions presented to you for acceptance within the Cloud Services by website link or otherwise. If Customer does not agree to abide by the applicable terms for any such Third-Party Products, then Customer will not install, access, or use such Third-Party Products.

5.  Customer Data and Personal Information.

5.1.  License.  Customer hereby grants Cadwell a non-exclusive, royalty-free, worldwide license, as allowed by law, to reproduce, distribute, and otherwise use and display the Customer Data and perform all acts with respect to the Customer Data as may be necessary for Cadwell to provide the Cloud Services to Customer and its Authorized Users. Customer will ensure that Customer Data and any Authorized User’s use of Customer Data will not violate any policy or terms referenced in or incorporated into this Agreement or any applicable law. Customer is solely responsible for its and its Authorized Users’ development, content, operation, maintenance, and use of Customer Data.

5.2.  Customer Data.  Customer represents and warrants that: (i) Customer owns all rights, title, and interest in and to Customer Data and that both the Customer Data and Customer’s use of the Cloud Services are in compliance with the terms and conditions of this Agreement; and (ii) Customer has obtained all necessary consents and permissions to transfer the Customer Data to Cadwell and to allow its use in accordance with this Agreement.

5.3.  Personal Information and Protected Health Information.  Cadwell, Cadwell will handle protected health information (“PHI”) in accordance with the Business Associate Agreement in place with Customer, or if none, in accordance with the Health Insurance Portability and Accountability Act of 1996, as codified at 42 U.S.C. § 1320d (“HIPAA”), the Health Information Technology for Economic and Clinical Health Act of 2009, as codified at 42 U.S.C. § 17901 et seq. (“HITECH Act”), and any current and future regulations promulgated under HIPAA or the HITECH Act (collectively “HIPAA”). Cadwell’s processing of Personal Information shall be governed by the CadCare Connect Data Processing Addendum available at Appendix 1 hereto, which is hereby incorporated by reference.

6.  Fees and Payment.

6.1.  Fees.  Customer will pay Cadwell the agreed upon fees in accordance with terms of the Quote. Services upgrades and add-ons may be subject to an additional charge. Payment terms are net thirty (30) days from date of invoice on approved credit. All payments made after thirty (30) calendar days are subject to a service charge equal to 2% of the total amount due for each month the payment is in arrears. Cadwell reserves the right to charge credit card transaction fees at its discretion. Customer agrees to pay collection expenses and legal fees incurred by Cadwell in collecting past due balances.

6.2.  Excess Data Egress Fees.  Normal usage of the Cloud Services incurs Cadwell data egress fees from hosting platforms. These fees are absorbed into Cloud Services pricing plans. Should Customer usage incur excess fees, Cadwell reserves the right to charge Customer for fees. Cloud Services fees are calculated monthly.

6.3.  Delinquent Account.  Cadwell reserves the right to suspend or terminate this Agreement and/or Customer’s access to the Cloud Services in the event Customer’s account becomes delinquent. Customer’s obligation to pay the fees for the Cloud Services will continue during any such period of suspension.

7.  Cloud Services Warranty.

7.1.  Cadwell Warranties.  Cadwell warrants that it either owns or has the right to provide the Cloud Services, and that the Cloud Services will substantially conform to the specifications stated in the Documentation. Cadwell further warrants that the Cloud Services will be performed in a prompt, diligent, competent, and workmanlike manner. Customer’s sole and exclusive remedy, and Cadwell’s entire liability for breach of the limited warranty in this Section, will be correction of the non-conformity or, if Cadwell fails to correct the non-conformity after using reasonable commercial efforts, Cadwell’s termination of Customer’s access to the non-conforming Cloud Services and refund of the fees paid by Customer for such Services for the remainder of the Term.

7.2.  Exceptions.  The limited warranties set forth in Section 7.1 will not apply if: (i) Customer has misused or negligently used the Cloud Services; (ii) Customer has failed to use the Cloud Services in accordance with this Agreement or the Documentation; (iii) Customer has failed to report to Cadwell a defect or error within ten (10) days of its first occurrence; (iv) the defect or error was caused, in whole or in part, by a product, Software, or service not originating from Cadwell; or (v) Customer is otherwise in breach of this Agreement. The limited warranties set forth in this Agreement are made for Customer’s benefit only.

7.3.  EXCEPT FOR THE LIMITED WARRANTY SET FORTH IN SECTION 7.1, THE CLOUD SERVICES ARE PROVIDED “AS IS” AND CADWELL SPECIFICALLY DISCLAIMS ALL WARRANTIES, WHETHER EXPRESS, IMPLIED, STATUTORY, OR OTHERWISE. CADWELL SPECIFICALLY DISCLAIMS ALL IMPLIED WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, TITLE, AND NON-INFRINGEMENT, AND ALL WARRANTIES ARISING FROM COURSE OF DEALING, USAGE, OR TRADE PRACTICE. CADWELL MAKES NO WARRANTY OF ANY KIND THAT THE CLOUD SERVICES, OR ANY PRODUCTS OR RESULTS OF THE USE THEREOF, WILL MEET CUSTOMER’S OR ANY OTHER PERSON’S OR ENTITY’S REQUIREMENTS, OPERATE WITHOUT INTERRUPTION, ACHIEVE ANY INTENDED RESULT, BE COMPATIBLE OR WORK WITH ANY OF CUSTOMER’S OR ANY THIRD PARTY’S SOFTWARE, SYSTEM, OR OTHER SERVICES, OR BE SECURE, ACCURATE, COMPLETE, FREE OF HARMFUL CODE, OR ERROR-FREE, OR THAT ANY ERRORS OR DEFECTS CAN OR WILL BE CORRECTED.

8.  Security.

8.1.  Cadwell will use commercially reasonable security technologies in providing the Cloud Services. Where Cadwell hosts Customer Data, Cadwell will retain Customer Data on a secure server and maintain data recovery and data backup facilities in accordance with accepted industry practices.

8.2.  Customer acknowledges and agrees that the reliability, availability, integrity, and performance of resources accessed through the internet or other services connected to the Cloud Services Software are beyond the control of Cadwell and are not warranted or supported by Cadwell.

8.3.  Cadwell contracts with an independent organization to periodically review its Software for security flaws. Each review covers common software and business process vulnerabilities, including third-party components and libraries. Cadwell will track all security issues uncovered during the Software development lifecycle, whether design, implementation, testing, deployment or operational issues. The risk associated with each security issue will be evaluated and documented by Cadwell, and Cadwell will implement a fix, patch, or other measure to remedy the issue after discovery.

9.  Intellectual Property; Feedback.

9.1.  As between Customer and Cadwell, Cadwell owns all right, title, and interest, including all Intellectual Property rights, in and to the Cloud Services, and Customer owns all right, title, and interest, including all Intellectual Property rights, in and to Customer Data.

9.2.  Feedback.  Notwithstanding anything to the contrary in this Agreement, if Customer or its Authorized Users provide Cadwell with any comments, recommendations, suggestions, or other feedback regarding the modification, correction, improvement, or enhancement of the Cloud Services, Software, Documentation, or any other aspect of Cadwell’s business (collectively, “Feedback”), then: (i) Cadwell has no confidentiality obligations with respect to such Feedback even if it is designated as confidential; (ii) Customer acknowledges and agrees that Cadwell will own and may freely use and exploit such Feedback without limitation on a perpetual and irrevocable basis for any purpose without any further obligation to Customer; and (iii) if any Intellectual Property arises from or relate to such Feedback, Cadwell will exclusively own all such Intellectual Property, and Customer hereby assigns to Cadwell on its behalf, and will cause its Authorized Users to assign, all right, title, and interest in the Feedback to Cadwell.

10.  Confidentiality.

10.1.  Each party agrees to hold the other party’s business, technical, and proprietary information, including Product pricing (“Confidential Information”) in strict confidence and to treat such Confidential Information with the same degree of care with which it would treat its own confidential information of a like nature, and in no case with less than a reasonable degree of care. Each party will use such information only in connection the provision of Products by Cadwell to Customer and will not disclose such information except as required by law. Each party will limit disclosure of such Confidential Information to those of its employees and contractors who have a need to know the information and are bound by confidentiality obligations as regards the Confidential Information that are no less stringent than those stated herein. Upon request by a party, the other party will return the party’s Confidential Information. The parties expressly agree that Confidential Information will include information discussed or disclosed between the parties relating to the Cloud Services prior to, or after, the Effective Date.

10.2.  A party’s Confidential Information will not be deemed to include information that: (i) is or becomes generally known to the public through no act or omission of the other party; (ii) was in the other party’s lawful possession prior to the disclosure and had not been obtained by the other party either directly or indirectly from the disclosing party; (iii) is lawfully disclosed to the other party by a third-party without restriction on disclosure; or (iv) is independently developed by the other party without use of or reference to the disclosing party’s Confidential Information.

10.3.  Notwithstanding Section 10.1, each party may disclose Confidential Information to the limited extent required (i) to comply with the order of a court or other governmental body, or as otherwise necessary to comply with applicable law, provided that the party making the disclosure pursuant to the order shall first have given written notice to the other party and made a reasonable effort to obtain a protective order; or (ii) to establish a party’s rights under this Agreement, including to make required court filings.

10.4.  Each party’s obligations of non-disclosure with regard to Confidential Information are effective as of the date such Confidential Information is first disclosed to the receiving party and will expire five years thereafter; provided, however, with respect to any Confidential Information that constitutes a trade secret (as determined under applicable law), such obligations of non-disclosure will survive the termination or expiration of this Agreement for as long as such Confidential Information remains subject to trade secret protection under applicable law.

11.  Indemnification.

11.1.  Cadwell Indemnification.

11.1.1.  Cadwell will indemnify, defend, and hold Customer harmless from and against any and all losses, damages, liabilities, deficiencies, penalties, fines, costs, or expenses of whatever kind, including reasonable attorneys’ fees (“Losses”) incurred by Customer resulting from any third-party claim, suit, action, or proceeding (“Third-Party Claim”) that the Cloud Services, or any use of the Cloud Services in accordance with this Agreement, infringes or misappropriates such third party’s US intellectual property rights, provided that Customer promptly notifies Cadwell in writing of the Third-Party Claim, cooperates with Cadwell, and allows Cadwell sole authority to control the defense and settlement of such Third-Party Claim.

11.1.2.  If such a Third-Party Claim is made or Cadwell reasonably anticipates such a Third-Party Claim will be made, Customer agrees to permit Cadwell, at Cadwell’s sole discretion, to: (i) modify or replace the Cloud Services, or component or part thereof, to make it non-infringing, or (ii) obtain the right for Customer to continue use of the Cloud Services. If Cadwell determines that neither alternative is reasonably available, Cadwell may terminate this Agreement, in its entirety or with respect to the affected component or part, effective immediately on written notice to Customer. This Section 11.1.2 sets forth Customer’s sole remedies and Cadwell’s sole liability and obligation for any actual, threatened, or alleged Third-Party Claims that the Cloud Services infringe, misappropriate, or otherwise violate any Intellectual Property rights of any third party.

11.1.3.  This Section 11.1 will not apply to the extent that any such Third-Party Claim arises from Customer Data or Third-Party Products.

11.2.  Customer Indemnification.  Customer will indemnify, hold harmless, and, at Cadwell’s option, defend Cadwell and its officers, directors, employees, agents, affiliates, successors, and assigns from and against any and all Losses arising from or relating to any Third-Party Claim which relate to: (i) any breach of this Agreement by Customer, including, without limitation, any breach of any representation or warranty of Customer; (ii) any negligence or intentional misconduct of Customer or any officer, director, employee, representative, or Authorized User of Customer; (iii) Customer Data (except to the extent such claim arises from Cadwell’s use of Customer Data in violation of this Agreement); or (iv) any claim for Intellectual Property infringement or misappropriation related to any use or operation (including in combination with hardware or software not authorized by Cadwell) of the Software or Cloud Services to the extent that the Software or Cloud Services has been modified or altered by Customer in any way, or is used in combination with any other hardware or software not authorized by Cadwell, or is used in a manner that does not comply with this Agreement or the Documentation.

12.  Limitations of Liability.  IN NO EVENT WILL CADWELL BE LIABLE UNDER OR IN CONNECTION WITH THIS AGREEMENT UNDER ANY LEGAL OR EQUITABLE THEORY, INCLUDING BREACH OF CONTRACT, TORT (INCLUDING NEGLIGENCE), STRICT LIABILITY, OR OTHERWISE, FOR ANY: (i) CONSEQUENTIAL, INCIDENTAL, INDIRECT, EXEMPLARY, SPECIAL, ENHANCED, OR PUNITIVE DAMAGES; (ii) INCREASED COSTS, DIMINUTION IN VALUE OR LOST BUSINESS, PRODUCTION, REVENUES, OR PROFITS; (iii) LOSS OF GOODWILL OR REPUTATION; (iv) USE, INABILITY TO USE, LOSS, INTERRUPTION, DELAY OR RECOVERY OF ANY DATA, OR BREACH OF DATA OR SYSTEM SECURITY; OR (v) COST OF REPLACEMENT GOODS OR SERVICES, IN EACH CASE REGARDLESS OF WHETHER CADWELL WAS ADVISED OF THE POSSIBILITY OF SUCH LOSSES OR DAMAGES OR SUCH LOSSES OR DAMAGES WERE OTHERWISE FORESEEABLE. IN NO EVENT WILL CADWELL’S AGGREGATE LIABILITY ARISING OUT OF OR RELATED TO THIS AGREEMENT UNDER ANY LEGAL OR EQUITABLE THEORY, INCLUDING BREACH OF CONTRACT, TORT (INCLUDING NEGLIGENCE), STRICT LIABILITY, OR OTHERWISE, EXCEED THE TOTAL AMOUNTS PAID TO CADWELL UNDER THIS AGREEMENT IN THE TWELVE MONTHS PRECEDING THE DATE ON WHICH THE CLAIM ARISES.

13.  Term and Termination.

13.1.  Term.  The term of this Agreement commences on the Effective Date and continues for one (1) calendar year. Thereafter, the Agreement will automatically renew in thirty (30) day increments, until terminated per Section 13.2.

13.2.  Termination.  In addition to any other express termination rights set forth in this Agreement:

13.2.1.  Cadwell may terminate this Agreement, for any reason upon thirty (30) days advance written notice.

13.2.2.  Customer may terminate this Agreement for any reason upon sixty (60) days advance written notice.

13.2.3.  Either party may terminate this Agreement, effective on written notice to the other party, if the other party materially breaches this Agreement, and such breach: (i) is incapable of cure; or (ii) being capable of cure, remains uncured 30 days after the non-breaching party provides the breaching party with written notice of such breach.

13.2.4.  Either party may terminate this Agreement, effective immediately upon written notice to the other party, if the other party: (i) becomes insolvent or is generally unable to pay, or fails to pay, its debts as they become due; (ii) files or has filed against it, a petition for voluntary or involuntary bankruptcy or otherwise becomes subject, voluntarily or involuntarily, to any proceeding under any domestic or foreign bankruptcy or insolvency law; (iii) makes or seeks to make a general assignment for the benefit of its creditors; or (iv) applies for or has appointed a receiver, trustee, custodian, or similar agent appointed by order of any court of competent jurisdiction to take charge of or sell any material portion of its property or business.

13.3.  Effect of Termination.

13.3.1.  Upon termination of this Agreement, all rights and licenses granted to Customer will expire and terminate, and Customer will stop using Cadwell IP and Confidential Information, refrain from further use of the Cloud Services, and deliver to Cadwell or destroy all copies of Cadwell’s Software, Documentation, and Confidential Information. No termination of this Agreement will affect Customer’s obligation to pay all fees that may have become due before such termination or entitle Customer to any refund.

13.3.2.  Cadwell will retain Customer Data for a period of 90 days after termination of this Agreement, and upon request of Customer, will provide a copy of such data in a reasonably accessible electronic format. Cadwell will delete Customer Data 90 days after termination of this Agreement.

14.  Miscellaneous.

14.1.  Notice.  All notices permitted or required under this Agreement must be delivered in writing by personal delivery or delivery by professional courier. Such notice will be effective upon receipt. All notices sent by Cadwell will be sent to the address to which Cadwell regularly invoices Customer or, at Cadwell’s election, to Customer’s address set forth in the Quote. All notices sent by Customer must be sent to the Cadwell address set forth in the Quote, Attn: Legal. An address for notice may be changed by giving written notice of such change in the manner provided above.

14.2.  Entire Agreement.  This Agreement represents the entire understanding of the parties with respect to the subject matter of the Agreement, and supersede all prior or contemporaneous agreements, representations, or understandings, written or oral, explicit or implied, concerning the subject matter of the Agreement. The Agreement may not be modified except in a writing signed by a duly authorized employee of Cadwell and Customer.

14.3.  Subcontracting.  Cadwell may in its sole discretion subcontract parts of the Services to third parties, provided however, that Cadwell will assume responsibility for such subcontractors’ breaches of the Agreement as if they were the breaches of Cadwell.

14.4.  Construction.  The Agreement will be interpreted fairly in accordance with its terms and without any construction in favor of or against either party.

14.5.  Relationship; Third Party Beneficiaries.  The parties are independent contractors, and the Agreement does not constitute a partnership, agency, joint venture, or employment relationship. Nothing in the Agreement gives one party the right, power, or authority to bind the other. The Agreement does not create any right in, or inure to the benefit of, any third parties.

14.6.  Default; Remedy.  In the event of default, Cadwell may pursue any remedies at law or equity, including without limitation, declaring any amount outstanding due immediately, or without any further notice to Customer, Cadwell may retake possession of the Products securing the sale.

14.7.  Assignment.  Customer may not, without Cadwell’s prior written consent, assign, delegate, pledge, or otherwise any of its rights or obligations under the Agreement, whether voluntarily or by operation of law, including by way of sale of assets, merger, or consolidation. Any purported assignment, transfer, delegation, or other disposition by Customer will be null and void. Subject to the foregoing, the Agreement will be binding upon and will inure to the benefit of the parties and their respective successors and assigns.

14.8.  No Waiver.  The failure of a party to enforce at any time any provision hereof will not be construed to be a waiver of such provision or of the right of the party thereafter to enforce each such provision, nor will any single or partial exercise of any right or remedy hereunder preclude a party from any other or further exercise thereof or the exercise of any other right or remedy.

14.9.  Excusable Delay.  Cadwell will not be responsible for any delay or non-performance of its obligations hereunder to the extent and for such periods of time as such delay or non-performance is due to causes beyond its reasonable control. Excusable delays include, but are not limited to, acts of God, war, action or inaction of any government in either its sovereign or contractual capacity, fire, explosions, sabotage, the elements, epidemics, internet service Cadwell failure or delay, denial of service attack, quarantine restrictions, strikes, lockout, embargoes, severe weather, delays in transportation, airline schedule, fuel shortages, or delays of suppliers or subcontractors. In particular, Cadwell will not be responsible for any delay or non-performance of its obligations hereunder to the extent and for such periods of time as such delay or non-performance is due to: (i) Customer’s failure to complete any site preparation or equipment acquisition or maintenance needed for Cadwell to be able to perform hereunder; (ii) Customer’s failure to obtain and maintain all computer or other hardware, software, communications or other equipment and any other infrastructure, services, facilities or resources needed to properly access and use the Cloud Services; or (iii) insufficient, unstable or unreliable inbound and/or outbound communication services, capacities, speeds, or outages.

14.10.  Severability.  If any provision of the Agreement is found unenforceable, the remainder will be enforced as fully as possible and the unenforceable provision will be deemed modified to the limited extent required to permit its enforcement in a manner most closely representing the intention of the parties as expressed herein.

14.11.  Governing Law; Jurisdiction.  The Agreement will be governed by the laws of the State of Washington, without giving effect to choice of law or conflict of law rules or provisions (whether of the State of Washington or any other jurisdiction) that would cause the application of the laws of any jurisdiction other than the State of Washington. All disputes arising out of or related to the Agreement will be subject to the exclusive jurisdiction of the courts located in Benton County, Washington, and the parties agree and submit to the exclusive jurisdiction and venue of such courts.

14.12.  Dispute Resolution.  In the event of any dispute, controversy, or claim arising out of or relating to this Agreement (“Dispute”), the parties will endeavor in good faith to resolve the Dispute through reasonable negotiations. If the parties fail to resolve the Dispute within a reasonable amount of time, the parties will settle the Dispute through binding arbitration, by a single arbitrator, in Benton County, Washington, under the rules of the American Arbitration Association. Judgment on the award rendered by the arbitrator may be entered in any court having jurisdiction thereof. The substantially prevailing party in such arbitration will be entitled to recover costs, including attorney’s fees, as part of the award.

14.13.  Time Limit on Customer Commencing Legal Actions.  Customer must commence any Dispute within one (1) year from the date the Dispute first occurred or will be barred from bringing such a Dispute thereafter.

14.14.  Injunctive Relief.  The parties acknowledge that certain breaches may result in damage not adequately redressed by monetary damages and legal remedies alone. Accordingly, if either party discloses or threatens to disclose the other party’s Confidential Information or breaches any provision of this Agreement regarding Intellectual Property Rights, that non-breaching party is entitled to seek injunctive and other equitable relief, including, without limitation, preliminary and permanent injunctions and specific performance, without the requirement of posting bond.

14.15.  Compliance with Laws.  Each party will comply with all federal and state laws, ordinances, regulations, and codes applicable to the Cloud Services and the party’s performance under the Agreement including applicable data privacy laws and regulations. Each party agrees to fully comply with the Health Insurance Portability and Accountability Act of 1996 and its associated regulations including 45 C.F.R. §§ 160 and 164, Standards for Privacy of Individually Identifiable Health Information, Final Rule (the “Final Privacy Rule”), and 45 C.F.R. §§ 160, 162 and 164, Health Insurance Reform: Security Standards, Final Rule (the “Final Security Rule”), collectively referred to as (“HIPAA”), as they may be applicable to the party. Cadwell will use patient protected health information only in connection with Cloud Services performed under the Agreement or as otherwise authorized by HIPAA or Customer.

14.16.  Government Users.  The Software and Software documentation are “commercial items” as defined in 48 C.F.R. 2.101, consisting of “commercial computer software” and “commercial computer software documentation” as such terms are used in 48 C.F.R. 12.212. If the end user is a U.S. Government agency, department, or instrumentality, then the use, duplication, reproduction, release, modification, disclosure or transfer of the Software and any data relating thereto or derived therefrom, is restricted in accordance with 48 C.F.R. §12.211, 48 C.F.R. §12.212, 48 C.F.R. §227.7102-2, and 48 C.F.R. §227.7202, as applicable. The object code of the Software and the Software documentation are copyrighted and published products of Cadwell (except source code, which is copyrighted but unpublished), and all rights not granted expressly herein are reserved.

14.17.  Suspended or Debarred Parties.  Each party represents, warrants and covenants that it, including its consultants and agents and its and their officers, directors, and employees, are not debarred, suspended, or proposed for debarment by any agency or department of the U.S. Government or otherwise declared ineligible by any agency or department of the U.S. Government for award of contracts or subcontracts. Each party will provide the other immediate written notice if the preceding representation becomes untrue.

14.18.  Access to Books and Records.  To the extent required by Section 1395x(v)(1)(I) of Title 42 of the United States Code and 42 CFR 420.302, if requested in writing by the Secretary of HHS, by the U.S. Comptroller, or by an authorized representative of either of them, Cadwell will make available a copy of the books, documents, and records necessary to certify the nature and extent of the costs of the services provided by Cadwell to Customer. Cadwell will continue to make those items available for four years after Cadwell furnishes the final Products under the Agreement. Cadwell further agrees that in the event it carries out any of its duties for Customer through a subcontract with a related organization with a value or cost of $10,000.00 or more over a 12 month period, such subcontract will contain a provision requiring the subcontractor to make available until the expiration of four years after the furnishing of subcontracted services upon written request of the Secretary of HHS, the U.S. Comptroller, or an authorized representative of either of them, a copy of such subcontract and such books, documents, and records of the subcontractor as are necessary to verify the nature and extent of the subcontracted services.

14.19.  Export Controls.  The Services, Software, and/or Documentation may be subject to United States export control laws. Customer acknowledges and agrees that the Services, Software, and Documentation will not be transferred or otherwise exported or re-exported to prohibited or restricted countries, to restricted or prohibited persons or entities or for any prohibited or restricted end uses under applicable U.S. laws, as amended from time to time.

14.20.  Survival.  Sections 2, 3.4, 5, 6.1, 7.3, 9, 10, 11, 2,13.3 and 14., and any other terms that by their nature should survive the termination or expiration of this Agreement, will survive such termination or expiration.

Appendix 1

Data Processing Addendum

This Data Processing Addendum (“Addendum”) reflects the parties’ agreement specifically as it relates to the collection, usage, and sharing of Personal Information (as defined below) provided to Cadwell Industries, Inc. (herein “Processor”) by Licensee (herein “Controller”) or collected, used, shared, or processed by Processor at Controller’s instruction, in accordance with and pursuant to Applicable Privacy Laws (as defined below). Unless otherwise noted, in the event of any conflict between the terms of this Addendum and the terms of the Agreement, the terms of this Addendum prevail. Capitalized terms not defined herein are defined as set forth in the Agreement.

1.  Definitions.

1.1.  “Applicable Data Protection Laws” means all laws and regulations applicable to the Processing of Personal Information under this Addendum, including, without limitation, the California Consumer Privacy Act of 2018 as amended by the California Privacy Rights Act of 2020 (the “CCPA”), the Virginia Consumer Data Protection Act, the Colorado Privacy Act, the Texas Data Privacy and Security Act, and all other enacted U.S. State privacy laws.

1.2.  “Authorized Persons” means persons authorized by Processor to access Personal Information, including Processor employees, contractors, agents, subcontractors, and Sub-Processors.

1.3.  “Consumer” means any natural person who is a resident of a U.S. state with an enacted privacy law.

1.4.  “Consumer Request” means any request by a Consumer to exercise rights under Applicable Data Protection Laws, such as access, correction, deletion, or portability.

1.5.  “Controller” means the natural or legal person, public authority, agency, or other body which, alone or jointly with others, determines the purposes and means of the Processing of Personal Information. For the purposes of U.S. state privacy laws, “Controller” shall include a “Business” as defined by the CCPA.

1.6.  “Personal Information” means, for purposes of this Addendum, any personal information or data, as defined in the Applicable Data Protection Laws, which is collected, stored, accessed, or otherwise Processed by Processor for Controller.

1.7.  “Process” or “Processing” means any operation performed on Personal Information, such as collection, use, storage, disclosure, erasure, or destruction.

1.8.  “Processor” means the natural or legal person, public authority, agency, or other body which Processes Personal Information on behalf of the Controller. For the purposes of U.S. state privacy laws, “Processor” shall include a “Service Provider” or “Contractor” as defined by the CCPA.

1.9.  “Regulator” means any governmental authority, department, or agency that has the jurisdiction to enforce compliance with Applicable Data Privacy Laws, including but not limited the California Attorney General’s Office, California Privacy Protection Agency, and other relevant data protection authorities in the EEA.

1.10.  “Sensitive Data” means Personal Information that reveals a Consumer’s past, present, or future physical or mental health status, condition, or diagnosis.

1.11.  “Services” means those certain services and obligations of Processor under the Agreement.

1.12.  “Sub-Processor” means any third party engaged by Processor to Process Personal Information.

2.  Purpose and Scope.  This Addendum governs Processor’s Processing of Personal Information provided or made accessible by Controller in connection with the Agreement. The specific details of the Processing operations, including the subject matter, nature, purpose, categories of Consumers, and types of Personal Information, are set forth in Annex 1 (Description of Processing), which is incorporated herein by reference.

3.  Roles of the Parties.

3.1.  Controller Role. Controller determines the purposes and means of Processing of Personal Information. Controller represents and warrants that it has a valid legal basis under the Applicable Data Protection Laws for the Processing of Personal Information by Processor, including having obtained any necessary consents.

3.2.  Processor Role. Processor will Process Personal Information solely in accordance with Controller’s documented instructions, and will not retain, use, or disclose Personal Information except as permitted by this Addendum or Applicable Data Protection Laws.

4.  Processing Instructions.

4.1.  Processor will comply with all obligations applicable to it as a “Processor”, “Service Provider”, or “Contractor” under Applicable Data Protection Laws and shall provide the level of privacy protection as is required by such laws. Further, Processor will provide the same level of privacy protection as is required of the Controller.

4.2.  Processor will process Personal Information on behalf of Controller in accordance with Applicable Data Protection Laws and only for the following business purposes: (i) performing Services on behalf of Controller as described in the Agreement; (ii) in accordance with Controller’s documented instructions; and (iii) as required by Applicable Data Protection Laws.

4.3.  Processor is prohibited from: (i) selling or “sharing” (for cross-context behavioral advertising) Personal Information; (ii) retaining, using, or disclosing Personal Information for any purpose other than for the specific business purposes of performing the Services as defined in the Agreement; (iii) processing Personal Information outside the direct business relationship between Processor and Controller; and (iv) combining Personal Information received from Controller with Personal Information received from other sources, except as permitted by Applicable Data Protection Laws.

4.4.  Processor shall not process Sensitive Data for any purpose other than those strictly necessary to provide the Services.

4.5.  Processor shall provide reasonable assistance to Controller, taking into account the nature of the processing and the information available to Processor, for: (i) fulfilling Controller’s obligation to respond to Consumer requests to exercise their rights (e.g., access, deletion, correction, and opt-outs); (ii) meeting obligations regarding the security of processing and notification of Personal Information Breaches; and (iii) providing necessary information to assist Controller in conducting and documenting “Data Protection Impact Assessments” or “Data Protection Assessments” where required.

4.6.  Processor will retain Personal Information only for as long as necessary to fulfill the purposes of the Agreement. Upon termination or expiration of the Agreement Processor will securely delete all Personal Information unless retention is required by Applicable Data Protection Laws.

5.  Personal Information Location.  Processor will host and Process Personal Information exclusively within the U.S.

6.  Confidentiality and Security.

6.1.  Processor will ensure that Authorized Persons are bound by appropriate confidentiality obligations no less stringent than those contained herein.

6.2.  Processor will implement and maintain industry standard technical and organizational security measures to protect Personal Information against accidental or unlawful destruction, loss, alteration, unauthorized disclosure, or access, consistent with Applicable Data Protection Laws.

7.  Sub-Processors.

7.1.  Controller hereby grants Processor a general authorization to engage Sub-Processors, including the Sub-Processors listed in Annex 1.

7.2.  Where Processor engages a Sub-Processor, Processor shall enter into a written agreement with such Sub-Processor imposing data protection obligations no less protective than those set out in this Addendum. Processor is liable for the acts and omissions of its Sub-Processors. The subject matter, nature and duration of the Processing activities carried out by the Sub-Processor(s) will not exceed the subject matter, nature and duration of the Processing activities as described in this Addendum.

7.3.  Processor shall inform Controller in advance of any intended changes concerning the addition or replacement of Sub-Processors, thereby giving Controller the opportunity to object to such changes within a reasonable period.

8.  Consumer Requests.  Processor will notify Controller without undue delay, and in any event within 72 hours, of any Consumer Request regarding data Processed by Processor. Processor will not respond directly to such requests without Controller’s prior written approval unless required by law. Processor will support the Controller in responding to such requests and provide reasonable assistance in fulfilling Consumer Requests (e.g., access, deletion) and complying with legal obligations.

9.  Personal Information Breach.  Processor will notify Controller without undue delay, and in any event within 72 hours, after becoming aware of a Personal Information breach, provide detailed information about the Personal Information breach, and cooperate in mitigation efforts.

10.  Audit Rights.

10.1.  Controller may audit Processor’s compliance with this Addendum once per year or as required by Applicable Data Protection Laws, either by itself or through an independent third-party auditor. Controller shall first exercise its audit right by reviewing Processor’s most recent SOC2 Type II report, ISO 27001 certification, or self-assessment. A physical or third-party audit shall only be permitted if such reports do not provide sufficient information to demonstrate compliance. In such instance, the audit will be performed upon reasonable notice and during regular business hours.

10.2.  Compliance, Verification, and Cure.  Processor shall make available to Controller all information necessary to demonstrate compliance with the obligations in this Addendum. Controller shall have the right, upon notice, to take reasonable and appropriate steps to stop and remediate any unauthorized use of Personal Information.

11.  Term and Termination.  This Addendum will survive termination of the Agreement.

12.  Governing Law. This Addendum shall be governed by the laws of the State of Washington, provided that privacy obligations will be consistently with the law of the applicable State.

Annex 1

Description of Processing

1.  Subject Matter and Duration.

The subject matter involves the centralized management, storage, and remote review of neurodiagnostic and neuromonitoring data. The processing duration is for the term of the CadLink Cloud subscription plus a standard post-termination retention period for clinical data transition.

2.  Nature and Purpose of Processing. 

Processor provides a cloud-hosted infrastructure to:

• Store and synchronize patient records, waveforms, and video across multiple recording stations.
• Facilitate real-time and retrospective review of EEG, EMG, and IONM data by physicians and technicians via the internet or VPN.
• Support bidirectional HL7 integration with hospital EMR systems to import demographics and export clinical reports.
• Centrally manage user permissions, custom test settings, and audit logs for HIPAA compliance.

3.  Categories of Data Subjects.

 The Processing primarily involves:

• Patients undergoing neurodiagnostic or surgical monitoring procedures.
• Clinicians and healthcare using the CadLink software to perform or review studies.

4.  Categories of Personal Information.

CadLink processes comprehensive clinical and administrative data:

• Patient Identifiers.  Name, date of birth, gender, and unique patient ID (MRN).
• Clinical Diagnostic Data.  Physiological waveforms (EEG/EMG traces), synchronized clinical video, and snapshots captured during user events.
• Administrative Metadata.  User login IDs, time-stamped audit trails of study access, and “CadChat” communication logs between team members.
• Contact Information.  Professional email and business contact details for authorized clinician users.

5.  Special Categories of Data / Sensitive Data. 

Health Data – diagnosis information, surgical monitoring events, and neurological diagnostic outcomes.

6.  Sub-Processor(s).

Microsoft Azure secure, HIPAA-compliant cloud storage facilities (e.g., specialized medical-grade cloud providers) with point-to-point encryption for all data in transit.

Rev 070126