ClinicX Software-as-a-Service Agreement

1. Definitions

1.1 “Services” means ClinicX’s hosted software, platform, APIs, and related services described in Schedule A (Service Description) and the applicable Order Form.

1.2 “PHI” has the meaning set forth in HIPAA, 45 C.F.R. § 160.103.

1.3 “Customer Data” means data submitted or made available by or for Customer to the Services, including PHI, de-identified data, and non-PHI data.

1.4 “User” means Customer’s employees, contractors, or end users authorized to access the Services.

1.5 “Documentation” means ClinicX’s user guides, policies, and technical specifications provided or made available by ClinicX.

1.6 “Order Form” means an ordering document executed by the Parties specifying Service subscriptions, fees, term, and any professional services.

2. Access and Use

2.1 Provision of Services. Subject to this Agreement and the Order Form, ClinicX grants Customer a non-exclusive, non-transferable, limited right for authorized Users to access and use the Services during the Subscription Term solely for Customer’s internal business purposes.

2.2 Restrictions. Customer shall not: (a) copy, modify, or create derivative works of the Services; (b) reverse engineer or decompile any part of the Services; (c) use the Services to provide time-sharing or service bureau services; (d) remove or obscure proprietary notices; or (e) access the Services to build a competing product. Usage restrictions contained in the Documentation also apply.

2.3 Customer Responsibilities. Customer is responsible for (a) the accuracy and legality of Customer Data; (b) obtaining consents and authorizations required by law; (c) maintaining the confidentiality of User credentials; and (d) ensuring Users’ compliance with this Agreement.

2.4 Clinical and Coding Authority. The Services provide tooling, workflow automation, and decision support for clinical documentation and billing. Customer retains sole and final authority over diagnosis and procedure code selection, documentation, prescribing, and the decision to submit any claim, in each case through review and approval by Customer’s licensed or qualified personnel. ClinicX does not select, alter, or upgrade codes without Customer approval, does not practice medicine or provide clinical advice, and does not conduct payer contract negotiations on Customer’s behalf.

3. Security; Compliance; HIPAA

3.1 Administrative, Physical, and Technical Safeguards. ClinicX will implement and maintain appropriate safeguards designed to protect Customer Data consistent with Schedule B (Security & Compliance Controls), including access controls, encryption at rest and in transit, vulnerability management, logging and monitoring, secure SDLC, change management, and incident response.

3.2 Compliance. ClinicX shall (a) comply with applicable federal and state laws and regulations governing the Services, including HIPAA and HITECH, to the extent applicable; and (b) maintain any industry-standard security certifications or audits specified in the Order Form.

3.3 Business Associate Agreement. Where ClinicX is a Business Associate, the Parties shall execute the BAA before any PHI is transmitted to or accessed by the Services. The BAA governs the Parties’ respective HIPAA obligations regarding PHI.

3.4 De-Identification. ClinicX may de-identify Customer Data in accordance with 45 C.F.R. § 164.514. De-identified data is not PHI and may be used as permitted under Section 9.4, provided such use does not re-identify or attempt to re-identify individuals.

3.5 Incident and Breach Notification. ClinicX will notify Customer of any Security Incident affecting Customer Data and any Breach of Unsecured PHI as defined by HITECH, following the timelines and content requirements specified in the BAA and Schedule B.

3.6 Subprocessors. ClinicX may use subcontractors and subprocessors to provide the Services. ClinicX shall (a) impose data protection and confidentiality obligations no less protective than those in this Agreement and the BAA, and (b) maintain an up-to-date list of subprocessors, available upon request. Customer may object to a new subprocessor on reasonable grounds related to data protection, and the Parties will work in good faith to address the objection.

4. Service Levels; Support; Maintenance

4.1 Availability. ClinicX will provide the Services with a Monthly Uptime Percentage of 99.5%, excluding Scheduled Maintenance and the other exclusions set forth in Schedule C. Service level credits, if any, are set forth in Schedule C and are Customer’s sole and exclusive remedy for failure to meet the uptime commitment.

4.2 Support. ClinicX will provide support per Schedule C, including standard support hours, severity definitions, response and restore targets, and escalation paths.

4.3 Maintenance. ClinicX may perform updates, upgrades, and patches. ClinicX will use reasonable efforts to provide notice for Scheduled Maintenance that materially impacts availability, as set forth in Schedule C.

5. Fees; Taxes; Payment

5.1 Fees. Customer shall pay the fees specified in each Order Form. Except as expressly stated, fees are non-cancelable and non-refundable.

5.2 Invoicing and Payment. Invoices are due net thirty (30) days from the invoice date unless a different period is specified in the Order Form. Late payments may accrue interest at 1.5% per month or the maximum allowed by law, whichever is less.

5.3 Taxes. Fees are exclusive of taxes. Customer is responsible for applicable sales, use, and other taxes, excluding taxes based on ClinicX’s net income.

5.4 Pass-Through Costs. Third-party clearinghouse, eRx, payment processing, and telecom or messaging fees are not included in the subscription fee unless expressly stated in the Order Form.

5.5 Collections-Based Fees. Where an Order Form specifies a fee calculated as a percentage of Net Collections, the following apply. (a) The fee is calculated and invoiced monthly in arrears, with a supporting statement identifying the Net Collections used. (b) Net Collections has the meaning given in the Order Form. (c) Customer shall provide ClinicX with the remittance and payment data reasonably necessary to calculate the fee. (d) Customer may dispute a calculation in writing within thirty (30) days of the invoice date; undisputed amounts remain payable pending resolution. (e) If an amount included in Net Collections is later recouped, refunded, reversed, or charged back, the corresponding fee is credited against the next invoice. (f) Customer may exercise the verification right set forth in the Order Form. (g) Any post-termination application of the fee is limited to the tail period specified in the Order Form.

5.6 Fee Basis and Health Care Compliance. The Parties intend that all fees represent fair market value for the Services actually provided. No fee under this Agreement is paid in consideration of patient referrals or the recommendation, ordering, purchasing, or arranging for any item or service reimbursable by a federal or state health care program. ClinicX’s compensation is not determined by, and does not vary with, the level or intensity of coding assigned to any encounter. Each Party is responsible for its own compliance with applicable federal and state fee-splitting, corporate practice of medicine, patient brokering, and anti-kickback requirements, and the Parties will negotiate in good faith to amend the fee structure if a change in law or regulatory guidance makes it non-compliant in a jurisdiction where Customer operates.

6. Confidentiality

6.1 “Confidential Information” means non-public information disclosed by a Party, including business, technical, and security information. Customer Data, including PHI, is Customer’s Confidential Information.

6.2 Protection. Each Party will use at least the same degree of care it uses for its own Confidential Information, but not less than reasonable care, to protect the other Party’s Confidential Information.

6.3 Permitted Disclosures. Confidential Information may be disclosed to affiliates, employees, contractors, or advisors with a need to know, subject to confidentiality obligations, and as required by law, with prompt notice unless prohibited.

7. Data Rights; Backups; Return and Deletion

7.1 Ownership. Customer retains all rights, title, and interest in Customer Data. ClinicX retains all rights in the Services and Deliverables, including improvements and intellectual property.

7.2 Data Backups and Export. ClinicX will perform regular backups per Schedule B. Customer may export Customer Data via the Services or request a one-time export in a commonly used, machine-readable format within thirty (30) days after termination, subject to reasonable fees.

7.3 Deletion. Following termination or expiration, ClinicX will delete or de-identify Customer Data within sixty (60) days, except to the extent retention is required by law or the BAA.

8. Warranties; Disclaimers

8.1 Services Warranty. ClinicX warrants the Services will materially conform to the Documentation and will be provided in a professional and workmanlike manner.

8.2 Compliance Warranty. ClinicX warrants it will comply with applicable laws and the BAA regarding PHI.

8.3 Disclaimer. Except as stated herein, the Services are provided “AS IS.” ClinicX disclaims all other warranties, express or implied, including merchantability, fitness for a particular purpose, and non-infringement. USE OF THE SERVICES DOES NOT GUARANTEE ANY REIMBURSEMENT OUTCOME OR REVENUE PERFORMANCE.

9. Intellectual Property; Feedback; Analytics

9.1 Reservation of Rights. No rights are granted except as expressly set forth in this Agreement.

9.2 Feedback. Customer grants ClinicX a royalty-free, worldwide, irrevocable license to use Feedback to improve the Services, without identifying Customer.

9.3 Usage Data. ClinicX may collect and use aggregated, anonymized usage statistics for operating, improving, and benchmarking the Services, provided such data does not identify Customer or any individual.

9.4 De-Identified Data. ClinicX may use de-identified data, as described in Section 3.4, for research, analytics, and product improvement, provided such use complies with HIPAA de-identification standards and the BAA.

10. Indemnification

10.1 ClinicX IP Indemnity. ClinicX will defend and indemnify Customer against third-party claims alleging the Services infringe intellectual property rights, and pay damages and costs finally awarded or approved in settlement, provided Customer promptly notifies ClinicX and ClinicX controls the defense. ClinicX may (a) modify the Services; (b) procure a license; or (c) terminate the affected subscription and refund prepaid, unused fees.

10.2 Customer Data and Use Indemnity. Customer will defend and indemnify ClinicX against claims arising from Customer Data, Customer’s use of the Services in violation of law or this Agreement, or combinations not authorized by ClinicX.

10.3 HIPAA and HITECH Indemnity. ClinicX will defend and indemnify Customer against third-party claims, and reimburse Customer for reasonable and documented Breach-related costs, to the extent caused by ClinicX’s breach of the BAA or failure to maintain the safeguards required under Schedule B. Recoverable Breach-related costs include forensic investigation, required individual and regulatory notification, and credit monitoring where required by law. This indemnity is subject to the limitation of liability in Section 11.

11. Limitation of Liability

11.1 Exclusion of Damages. Neither Party is liable for indirect, incidental, consequential, special, exemplary, or punitive damages, including lost profits or data, arising out of or related to this Agreement, even if advised of the possibility.

11.2 Cap. Each Party’s total aggregate liability under this Agreement shall not exceed the amounts paid or payable by Customer to ClinicX under the applicable Order Form in the twelve (12) months preceding the event giving rise to the claim.

11.3 Exceptions. The cap in Section 11.2 does not apply to: (a) Customer’s payment obligations; (b) either Party’s indemnification obligations under Sections 10.1 and 10.2; (c) a Party’s willful misconduct or fraud; or (d) breach of confidentiality obligations under Section 6, other than with respect to PHI.

11.4 Liability Relating to PHI. Notwithstanding Section 11.3, all liability of either Party arising out of or relating to PHI, the BAA, or the indemnity in Section 10.3 is subject to the cap in Section 11.2. The Parties may adjust the cap and the exceptions in an Order Form or in the BAA.

12. Term; Termination; Suspension

12.1 Term. This Agreement begins on the Effective Date of the first Order Form and continues until terminated as set forth herein. Each Order Form specifies its own Subscription Term.

12.2 Termination for Cause. Either Party may terminate for material breach not cured within thirty (30) days after written notice.

12.3 Termination for Insolvency. Either Party may terminate if the other Party becomes insolvent, makes an assignment for the benefit of creditors, or is subject to bankruptcy proceedings.

12.4 Suspension. ClinicX may suspend access to the Services for (a) non-payment; (b) security threat or unlawful activity; or (c) violation of this Agreement, with prompt notice and restoration upon cure. ClinicX will use reasonable efforts to limit suspension to the affected functionality and will not suspend access to Customer Data export functions during any wind-down period.

12.5 Effect of Termination. Upon termination, Customer will cease use of the Services and pay outstanding fees. ClinicX shall provide data export per Section 7.2 and delete or de-identify Customer Data per Section 7.3.

13. Insurance

ClinicX shall maintain insurance coverage during the Term, including: (a) Commercial General Liability; (b) Technology Errors & Omissions / Cyber Liability of not less than $1,000,000 per claim; and (c) Workers’ Compensation as required by law. ClinicX shall provide certificates of insurance upon request.

14. Audits

Upon reasonable prior written notice, Customer may review ClinicX’s relevant audit reports or certifications annually. Customer may conduct a security questionnaire or remote audit limited to security and privacy controls once per year, subject to reasonable confidentiality and operational constraints. On-site audits require mutual agreement. Nothing in this Section limits the access rights of the Secretary of Health and Human Services under the BAA.

15. Regulatory Addenda

If Customer is subject to additional regulations, for example 42 C.F.R. Part 2 for substance use disorder records or applicable state privacy laws, the Parties will execute applicable addenda incorporated herein by reference.

16. Publicity

ClinicX may identify Customer as a customer, by name and logo, in lists and marketing materials upon Customer’s prior written consent. No use of PHI or patient names in publicity is permitted.

17. Government Terms

If Customer is a government entity, additional government procurement terms may apply as set forth in an addendum.

18. General

18.1 Order of Precedence. In case of conflict, the following order applies: (a) the BAA controls with respect to PHI; (b) the Order Form controls over this Agreement; (c) this Agreement controls over the Documentation.

18.2 Modification of Terms. The version of this Agreement in effect on the Effective Date of an Order Form governs that Order Form for its then-current Subscription Term. ClinicX may update this Agreement for subsequent renewal terms by giving Customer at least forty-five (45) days’ written notice before the renewal date. If Customer objects to the updated terms, Customer may elect not to renew. Archived versions are available at clinicx.io/legal/archive.

18.3 Assignment. Neither Party may assign without the other Party’s written consent, except to an affiliate or in connection with a merger, acquisition, or sale of substantially all assets, provided the assignee is not a competitor of the non-assigning Party and assumes all obligations.

18.4 Governing Law; Venue. This Agreement is governed by the laws of the State of New Jersey, excluding its conflict of law rules. The Parties consent to exclusive jurisdiction and venue in the state and federal courts located in Monmouth County, New Jersey.

18.5 Notices. Notices must be in writing and sent to the addresses set forth in the Order Form via recognized courier or certified mail. Legal notices to ClinicX must be sent to 68 Mill Road, Manalapan, NJ 07726, with a copy to support@clinicx.io. Routine operational communications may be sent to support@clinicx.io.

18.6 Force Majeure. Neither Party is liable for delays or failures due to causes beyond its reasonable control. This Section does not excuse Customer’s payment obligations or either Party’s obligations under the BAA.

18.7 Entire Agreement; Amendments; Waiver. This Agreement, the Order Form(s), the Schedules, and the BAA constitute the entire agreement. Amendments must be in writing. No waiver is implied.

18.8 Severability. If any provision is unenforceable, the remainder remains in effect.

18.9 Counterparts. Order Forms may be executed in counterparts and by electronic signature, each of which is an original and all of which together constitute one instrument.