SaaS Subscription Terms

These SaaS Subscription Terms and Conditions (the "Terms") govern each order form, online order, statement of work, or other ordering document that references them (each, an "Order") between Pharmacore Inc. ("Pharmacore," "we," "us," or "our") and the customer identified in the Order ("Customer"). Customer agrees to the Agreement when an individual with authority to bind Customer signs an Order or accepts these Terms electronically through Pharmacore's account-owner enrollment process, which requires that individual to confirm that authority. The person accepting represents that he or she has authority to bind Customer. An Authorized User's access to or use of the Service, or acceptance of the End User Terms, does not by itself constitute Customer's acceptance of, or an amendment to, the Agreement.

1. Agreement and order of precedence

The "Agreement" consists of the applicable Order, these Terms (including Schedule 1 (Service Description and Responsibility Matrix), Schedule 2 (Security Addendum), and Schedule 3 (Support and Service Levels)), any statement of work for implementation, onboarding, or training services, the Business Associate Agreement attached as Exhibit A ("BAA"), and any data processing addendum expressly incorporated by reference. If documents conflict, the following order applies only to the subject of the conflict: (a) the BAA for protected health information; (b) an applicable data processing addendum for regulated personal data; (c) Schedule 2 for security safeguards; (d) the Order; (e) Schedule 3 for support and service levels; (f) a statement of work; and (g) the remainder of these Terms, including Schedule 1. An Order or statement of work may add to, but will not reduce, a commitment in the BAA or Schedule 2 unless it expressly identifies the provision being changed. No Order or statement of work may obligate Pharmacore to perform clinical, pharmacy, or consulting services; Section 4 and Part 2 of Schedule 1 control over any conflicting Order or statement of work unless changed in a writing signed by a Pharmacore officer that expressly references Section 4. Purchase-order terms or other Customer forms do not modify the Agreement unless signed by an authorized Pharmacore officer.

Related documents. The End User License and Terms of Use (the "End User Terms") govern each Authorized User's individual conduct, and Pharmacore's Privacy Policy describes how Pharmacore handles personal information in its own capacity. Neither is part of the Agreement. No update to the End User Terms, the Privacy Policy, or the Documentation, and no Authorized User's acceptance of any of them, will modify the Agreement, impose fees or other obligations on Customer, shorten Customer's notice or cure periods, or reduce Pharmacore's commitments under the Agreement. If either document conflicts with the Agreement, the Agreement controls.

2. Definitions

"Authorized User" means an individual whom Customer authorizes to use the Service under Customer's account, including a licensed healthcare professional or authorized support, administrative, or technical personnel.

"Completed Report" means a medication regimen review, irregularity report, recommendation, note, or other document that an Authorized User has reviewed and finalized, signed, or exported from the Service, including any Output it incorporates.

"Covered Facility" means a skilled nursing facility, nursing facility, assisted living community, or other facility identified in an Order or configured by Customer in the Service, for whose residents Customer uses the Service.

"Customer Data" means data, records, files, text, instructions, and other content submitted to, generated through, or stored in the Service by or for Customer, including PHI, Output, and Completed Reports, but excluding Usage Data and Pharmacore Technology.

"Documentation" means Pharmacore's then-current user instructions, training materials, in-product notices, and intended-use descriptions made available to Customer.

"Output" means an observation, issue, recommendation, draft note, report, summary, or other content generated or suggested by the Service for Customer from Customer Data.

"Pharmacore Technology" means the Service, Documentation, software, models, prompts, algorithms, clinical logic, templates, workflows, user interface, and know-how, and all improvements and derivatives of them.

"PHI" has the meaning assigned to protected health information under the Health Insurance Portability and Accountability Act and its implementing regulations ("HIPAA").

"Reviewing Pharmacist" means a licensed pharmacist employed or engaged by Customer (or by a Covered Facility, where applicable) who performs medication regimen reviews or other clinical functions using the Service.

"Service" means the hosted Pharmacore platform described in Schedule 1, related Documentation, and the implementation, onboarding, training, and support services identified in an Order. The Service does not include clinical, pharmacy, or consulting services (see Section 4).

"Usage Data" means telemetry, logs, configuration, performance, and statistical data about operation and use of the Service that contains no PHI and does not identify a patient. Usage Data includes aggregate statistics about how Authorized Users accept, modify, or reject Output (such as counts and rates), but not the content of Customer Data, Output, or an Authorized User's edits to Output.

3. Access to and use of the Service

Subject to the Agreement (including Sections 18 and 19) and payment of applicable fees, Pharmacore grants Customer, during the subscription term (and, for read-only access, during any suspension under Section 19 and the Transition Period), a limited, non-exclusive, non-transferable, non-sublicensable right to permit the number and type of Authorized Users stated in the Order to access and use the Service for Customer's business operations, including providing pharmacy and clinical services to Covered Facilities and their residents, and the intended purposes described in the Documentation.

1. Customer will designate account administrators. Administrators may provision and disable users, assign roles, access account information, and act for Customer within the Service.

2. Each Authorized User must accept the then-current End User Terms, which govern that individual's conduct only (see Section 1). Customer is responsible for its Authorized Users' compliance with the Agreement.

3. Customer may not exceed purchased user, facility, bed, record, transaction, or other usage limits. The parties may address excess use through an updated Order or additional charges stated in the Order.

4. Pharmacore may update the Service and Documentation. Except where necessary for security, safety, legal compliance, or third-party platform changes, Pharmacore will not materially reduce the core functionality purchased during a paid subscription term without reasonable notice, and will not reduce the safeguards in Schedule 2.

4. Clinical decision support and professional responsibility

Clinical-use boundary: The Service supports professional review. Pharmacore provides software only. It does not perform medication regimen reviews, replace the pharmacist, provide direct patient care, make autonomous clinical decisions, or become the authoritative clinical record.

Customer acknowledges and agrees that the Service is intended for use by licensed healthcare professionals as clinical decision support and workflow software. It is not intended for emergency use, diagnosis or treatment by patients or caregivers, pharmacy dispensing, e-prescribing, or autonomous clinical decision-making.

Software only. Pharmacore provides software and related implementation, training, and support services only. Pharmacore does not perform, and does not employ, supply, or supervise pharmacists or other clinicians to perform, medication regimen reviews, drug regimen reviews, medical chart reviews, physical medication counts, reconciliation of medication administration records, clinical dosage reviews, or any other pharmacy, clinical, or consulting service for Customer, a Covered Facility, or a resident. Those services are performed by Customer's Reviewing Pharmacists and other personnel, as allocated in Schedule 1. Pharmacore support personnel do not give clinical advice.

Monthly review requirements. Where a Covered Facility (or Customer, if Customer operates the facility) is subject to 42 C.F.R. § 483.45 or comparable federal or state requirements, Customer is responsible, as between the parties, for ensuring that: (a) each resident's drug regimen is reviewed at least once a month by a licensed pharmacist, including a review of the resident's medical chart; (b) each irregularity the pharmacist identifies is documented in a separate written report to the attending physician, the facility's medical director, and the director of nursing that lists, at a minimum, the resident's name, the relevant drug, and the irregularity identified, and that the report is acted upon as those requirements specify; and (c) the facility's policies and procedures for monthly drug regimen reviews, including timeframes and the steps for irregularities requiring urgent action, are followed. The Service can help a Reviewing Pharmacist organize, document, and deliver this work, but use of the Service does not by itself satisfy these requirements, and the Service's analysis of uploaded records is not a review of the resident's medical chart.

5. A qualified, appropriately licensed professional must independently review the relevant patient record, data inputs, assumptions, basis, source material, warnings, and each Output before using, communicating, signing, or acting on it.

6. Authorized Users may accept, reject, or modify Outputs. Customer must not configure a workflow that causes an Output to become a clinical order, patient communication, facility instruction, or authoritative record without the required professional review and approval.

7. As between the parties, Customer and its professionals are responsible for clinical judgment, patient care, medication regimen reviews, prescribing and treatment recommendations, legal and professional duties, documentation, irregularity reporting, follow-up, and all clinical decisions or actions taken or not taken. Pharmacore remains responsible for performing its own obligations under the Agreement, including Section 14, the BAA, and Schedule 2.

8. Outputs may be incomplete, inaccurate, outdated, or inappropriate for a particular patient. Users must verify material information against current patient records, authoritative drug information, applicable clinical guidance, and Customer policies.

9. Customer will ensure that only personnel with appropriate credentials, training, scope of practice, and need to know use clinical functions, and will maintain escalation, quality-assurance, and record-retention procedures appropriate to its practice.

10. The Service is not a substitute for calling emergency services, a poison control center, the treating provider, or another appropriate clinical resource when urgent action may be required.

5. Customer responsibilities and acceptable use

Customer is responsible for the legality, quality, completeness, and accuracy of Customer Data; obtaining all rights, notices, consents, authorizations, and agreements needed for Pharmacore to process it; and using the Service in compliance with law, professional standards, facility and payer requirements, and the Agreement.

Customer and Authorized Users must not:

11. provide access to a patient, resident, family member, caregiver, consumer, or other person who is not an Authorized User under the applicable Order;

12. share credentials, impersonate another person, circumvent access controls or usage limits, or access an account without authorization;

13. upload PHI before a BAA is effective, place PHI in an unsupported field or support channel, or submit information Customer is not authorized to disclose;

14. reverse engineer, decompile, disassemble, copy, frame, scrape, or attempt to discover source code, models, prompts, algorithms, or non-public components, except to the limited extent a restriction is prohibited by law;

15. resell, sublicense, or time-share the Service, or make the Service available to anyone other than Authorized Users, except as expressly permitted by an Order (this does not restrict sharing Output or Completed Reports as permitted by Section 12.3);

16. use the Service or Outputs to develop, train, validate, or benchmark a competing product or model, or publish comparative performance results without Pharmacore's prior written consent;

17. introduce malicious code; conduct unauthorized vulnerability testing; interfere with integrity, security, availability, or performance; or attempt to access another customer's data; or

18. use the Service unlawfully, outside its intended use, or in a way that creates a material risk to patient safety, privacy, security, or Pharmacore's systems.

Customer will maintain its authoritative records, backups, and legally required documentation outside the Service unless an Order expressly identifies the Service as a supported record repository for that purpose. Pharmacore will make Customer Data available for export as described in Sections 18 and 19.

6. Customer Data, PHI, and data rights

As between the parties, Customer retains all rights in Customer Data, including Output and Completed Reports (see Section 12.2). Customer grants Pharmacore and its approved subcontractors a limited right to host, copy, transmit, display, transform, and otherwise process Customer Data only to provide, secure, and support the Service for Customer; create and use De-identified Data as permitted by Section 6.3; comply with the Agreement and Customer's documented instructions; prevent fraud or misuse; and satisfy law. Pharmacore will use and disclose PHI only as permitted by the BAA and HIPAA. No provision of these Terms, the End User Terms, or the Privacy Policy independently authorizes any use or disclosure of PHI beyond what the BAA and applicable law permit.

6.1 HIPAA and Business Associate Agreement

If Pharmacore creates, receives, maintains, or transmits PHI on behalf of Customer, the BAA attached as Exhibit A applies and must be signed or accepted by Customer's authorized representative before Customer or an Authorized User submits PHI. Customer will not upload PHI until the BAA is effective. The BAA governs permitted uses and disclosures, safeguards, subcontractors, incident and breach reporting, individual-rights assistance, and return or destruction of PHI. If the BAA and these Terms conflict regarding PHI, the BAA controls.

Pharmacore's BAA. The BAA is designed to be consistent with the business associate agreements Pharmacore holds with its own subcontractors, so that the commitments Pharmacore makes to Customer are supported by commitments its subcontractors make to Pharmacore. The parties will therefore use Pharmacore's BAA for the Service. A business associate agreement proposed by Customer or a Covered Facility does not apply unless signed by an authorized Pharmacore officer. The version of the BAA in effect when Customer accepts it governs until the parties agree otherwise in writing; a current copy is available for download at https://pharmacore.ai/legal/baa/.

Contracting chain. (a) If Customer is a covered entity (for example, a facility, or a pharmacy acting as a covered entity), Pharmacore is Customer's business associate. (b) If Customer is a business associate of a Covered Facility (for example, a consultant pharmacy or pharmacy group serving a nursing facility), Pharmacore is Customer's subcontractor business associate. Customer represents and warrants that it has, and will maintain while it submits a Covered Facility's PHI, a business associate agreement with that Covered Facility that permits Customer to disclose PHI to Pharmacore as its subcontractor on terms consistent with the BAA, and will provide a written attestation to that effect at onboarding and on Pharmacore's reasonable request. (c) A Covered Facility does not become a party to the Agreement, and Pharmacore does not contract directly with it, unless the Covered Facility signs its own Order and BAA.

Subcontractor BAAs. Before a subcontractor creates, receives, maintains, or transmits PHI for Pharmacore, Pharmacore will have a written business associate agreement in place under which the subcontractor agrees to the same restrictions and conditions that apply to Pharmacore with respect to that PHI, and will keep a copy on file. Schedule 2 describes Pharmacore's subcontractor list and notice commitments.

6.2 AI processing and model training

Pharmacore may use third-party artificial intelligence and infrastructure providers as service providers or business associate subcontractors to process Customer Data only as necessary to provide the Service and subject to contractual safeguards appropriate to the data, including a business associate agreement for any provider that receives PHI.

Permitted processing. Pharmacore may submit Customer Data to artificial intelligence or machine-learning models, including models operated by its subcontractors, only to generate Output for Customer and to monitor, troubleshoot, and secure that processing. Processing Customer Data to generate Output for Customer is not training.

Restricted uses. Except as authorized under the next paragraph, Pharmacore will not, and will not permit any subcontractor to, use Customer Data (including PHI, Output, and Completed Reports) or Customer's other Confidential Information to train, retrain, fine-tune, evaluate, benchmark, or otherwise develop any artificial intelligence or machine-learning model, whether general-purpose or specialized and whether operated by Pharmacore or a third party, or to build evaluation, validation, testing, or benchmarking datasets. Pharmacore will configure each AI subcontractor that receives PHI so that the subcontractor does not use PHI to train its models and retains it no longer than that subcontractor's business associate agreement permits.

Express authorization. A restricted use is permitted only if (a) Customer authorizes it in a signed writing (which may be an Order) that identifies the data, the purpose, and the models or datasets concerned; and (b) for PHI, the BAA and HIPAA permit the use. Customer may withdraw an authorization for future use by written notice. Nothing in this Section 6.2 restricts creating or using De-identified Data under Section 6.3, which is not Customer Data or Customer's Confidential Information for purposes of this Section.

6.3 De-identified Data and Usage Data

As permitted by the BAA, Pharmacore may de-identify PHI in accordance with 45 C.F.R. § 164.514(a)-(c), using the safe harbor method or an expert determination, and may use the resulting De-identified Data for its own internal purposes, including security, quality assurance, testing, analytics, and improving the Service and Pharmacore's own models (including models a subcontractor hosts or fine-tunes solely for Pharmacore). Customer authorizes Pharmacore to create De-identified Data and to license, sell and disclose that data and analyses derived from it for research, medication-trend analysis, benchmarking and other lawful commercial purposes, subject to Section 6.3. This authorization applies only to data for which Customer has the necessary rights under applicable law and its upstream agreements De-identified Data that Pharmacore discloses will not identify Customer or a Covered Facility. "De-identified Data" means information derived from Customer Data that (a) for PHI, has been de-identified as described above; and (b) for other Customer Data, does not identify and cannot reasonably be linked to Customer, a Covered Facility, an Authorized User, or a patient. Aggregating, summarizing, or tokenizing records does not by itself make information De-identified Data. Pharmacore will not attempt to re-identify De-identified Data except as permitted by law to validate de-identification, and will contractually prohibit each recipient from attempting to re-identify it and from further disclosing it to anyone not bound by the same restrictions.

Pharmacore may collect and use Usage Data to operate, secure, support, measure, and improve the Service. Usage Data will contain no PHI, and Pharmacore will not disclose Usage Data in a form that identifies Customer or an Authorized User except to Customer, to its subcontractors, to its professional advisers, auditors, insurers, and actual or prospective financing sources or acquirers under a duty of confidentiality, to a permitted successor under Section 22, or as required by law.

7. Privacy and security

Pharmacore will implement and maintain the administrative, technical, and physical safeguards described in Schedule 2 (Security Addendum), which are designed to protect Customer Data against unauthorized access, use, alteration, and disclosure. Schedule 2 states Pharmacore's commitments on encryption in transit and at rest, multi-factor authentication, access controls, audit logging, monitoring, backups and recovery targets, security-incident notification deadlines, and subcontractor responsibility. Specific commitments in the BAA control if they conflict with this section or Schedule 2.

Customer is responsible for its devices, networks, identity systems, user provisioning, endpoint security, password practices, exports, and acts or omissions outside Pharmacore's control. No system can be guaranteed completely secure. Customer will notify Pharmacore promptly at security@pharmacore.ai of suspected unauthorized access, compromised credentials, or misuse.

Pharmacore's Privacy Policy at https://pharmacore.ai/privacy/ explains how Pharmacore handles personal information in its own capacity. Customer's privacy notices and BAA govern PHI and other Customer Data processed by Pharmacore on Customer's behalf.

Insurance. During the term, Pharmacore will maintain technology errors and omissions insurance and cyber liability insurance (covering network security and privacy liability, including breach response costs), which may be provided under a combined policy with a shared limit of not less than US$2,000,000 per claim and in the annual aggregate, with insurers rated A- or better by A.M. Best, and will provide a certificate of insurance on request. Because Pharmacore does not supply clinicians (Section 4), it does not carry professional liability insurance for clinical services. Customer will maintain professional liability insurance covering its Reviewing Pharmacists and other clinical personnel, and general liability insurance, in amounts customary for its operations.

8. Third-party services, integrations, and AI components

The Service may interoperate with third-party pharmacy, clinical, identity, payment, communications, infrastructure, analytics, or AI services. Customer's use of a Customer-selected third-party service is governed by its agreement with that provider. Pharmacore is not responsible for a Customer-selected third-party service, data changes made by it, or its availability. Pharmacore remains responsible for its subcontractors' performance of Pharmacore's obligations as if they were its own. Pharmacore may replace subcontractors as its architecture evolves, subject to the notice and objection rights in Schedule 2, the BAA, and any data processing addendum.

9. Support, maintenance, and availability

Pharmacore will provide the support and service levels stated in Schedule 3 and any onboarding, implementation, or training stated in the Order. Customer will provide reasonably requested cooperation, access, sample files, contacts, and accurate information. Pharmacore may perform scheduled or emergency maintenance as described in Schedule 3 and may temporarily limit functionality to address security, legal, safety, or integrity risks. Schedule 3 states Customer's remedies if the Service does not meet its availability commitment, including where unavailability interferes with Customer's monthly reviews. Except as stated in Schedule 3, the Service is not warranted to be uninterrupted or error-free.

10. Fees, billing, and taxes

19. Customer will pay the fees and expenses stated in the Order. Fees are based on rights purchased and not actual use, are non-cancelable during the committed term, and are non-refundable except as expressly stated in the Agreement (including Sections 14 and 18 and Schedules 2 and 3).

20. Fees for self-service plans are charged in advance to Customer's payment method at the start of each billing period. Invoiced fees are due within thirty (30) days after the invoice date unless the Order states otherwise. Undisputed overdue amounts may accrue interest at the lesser of 1.5% per month or the maximum lawful rate, plus reasonable collection costs.

21. Customer must dispute an invoice in good faith within 30 days after receipt and timely pay all undisputed amounts. Pharmacore will not charge interest on, or suspend the Service for, amounts disputed in good faith while the parties work to resolve the dispute.

22. Fees exclude sales, use, value-added, withholding, and similar taxes. Customer is responsible for such taxes other than taxes on Pharmacore's net income. If withholding is required, Customer will provide appropriate documentation and, unless prohibited by law, gross up the payment so Pharmacore receives the invoiced amount.

23. Unless an Order states otherwise: (a) monthly subscriptions renew automatically for successive one-month periods unless either party gives notice of non-renewal before the end of the then-current month; and (b) annual or other committed subscriptions renew automatically for successive twelve-month periods unless either party gives notice of non-renewal at least 30 days before the end of the then-current term. Pharmacore may change fees for a renewal term with at least 60 days' notice before the renewal, except that a price lock stated in an Order (such as founding-member pricing) applies for the period the Order states.

11. Confidentiality

"Confidential Information" means non-public information disclosed by a party that is marked confidential or reasonably should be understood as confidential, including Customer Data, PHI, security information, product plans, pricing, and non-public technology. It excludes information the recipient can document: (a) is publicly available without breach; (b) was lawfully known without restriction; (c) is received lawfully from a third party without duty; or (d) is independently developed without use of the discloser's information.

The recipient will use Confidential Information only to perform or exercise rights under the Agreement, protect it using at least reasonable care, and disclose it only to personnel, professional advisers, and subcontractors who need to know and are bound to protect it. If legally compelled to disclose, the recipient will give advance notice when lawful and reasonably assist in seeking protection. These duties continue for five years after disclosure, except trade secrets remain protected while legally qualifying as trade secrets and PHI remains protected as required by the BAA and law. Customer's disclosure of Output or Completed Reports as permitted by Section 12.3 does not breach this Section.

12. Intellectual property and feedback

12.1 Pharmacore Technology

Pharmacore and its licensors own the Pharmacore Technology and all related intellectual property. No rights are granted except those expressly stated in the Agreement. Customer's ownership of Output does not extend to the Pharmacore Technology used to generate it.

12.2 Customer Data, Output, and Completed Reports

As between the parties, Customer owns Customer Data, including Output and Completed Reports. To the extent any Pharmacore Technology (such as a template, format, or standard text) is embedded in Output or a Completed Report, Pharmacore grants Customer a perpetual, irrevocable, worldwide, royalty-free, non-exclusive license to use, copy, modify, distribute, and retain it as part of that Output or Completed Report for Customer's healthcare operations, patient-care, regulatory, legal, and recordkeeping purposes, including after the Agreement ends. Because AI systems may generate similar content for different users, Pharmacore does not represent that an Output is unique or protectable.

12.3 Sharing Output and Completed Reports

Customer and its Authorized Users may disclose Output and Completed Reports to: (a) Covered Facilities and their administrators, medical directors, directors of nursing, and nursing staff; (b) attending physicians, prescribers, and other treating or consulting providers; (c) dispensing pharmacies; (d) residents and their legal representatives as required or permitted by law; (e) federal and state survey agencies, the Centers for Medicare & Medicaid Services, licensing boards, and other regulators, accreditors, and payers; (f) Customer's legal counsel, auditors, and insurers; and (g) any other person as required by law or as Customer's healthcare operations reasonably require. These disclosures remain subject to HIPAA and other applicable law but are not restricted by Sections 3, 5, or 11. Customer may not use Output to make the Service itself available to a third party.

12.4 Feedback

If Customer or an Authorized User provides feedback, suggestions, or ideas, Pharmacore may use them without restriction or payment, provided Pharmacore does not identify Customer publicly without permission and does not use PHI except as permitted by the BAA.

13. Early access and beta features

Features labeled beta, pilot, preview, experimental, early access, or similar are optional evaluation features, may be incomplete, may change or be discontinued, and may have reduced support, availability, security review, or functionality. They are provided "as is" to the maximum extent permitted by law and should not be used for production clinical workflows unless the Order and Documentation expressly permit that use. Additional terms presented for a feature apply upon use.

14. Warranties

Each party warrants that it has authority to enter the Agreement. Pharmacore warrants that, during a paid subscription term: (a) the Service will perform in all material respects according to the applicable Documentation and Schedule 1 when used as authorized; (b) Pharmacore will perform implementation, training, and support services in a professional and workmanlike manner consistent with generally accepted industry standards, using appropriately skilled personnel; and (c) Pharmacore will not materially decrease the safeguards in Schedule 2. Customer's exclusive remedy for breach of clause (a) or (b) is for Pharmacore to use commercially reasonable efforts to correct the nonconformity or re-perform the services; if Pharmacore cannot do so within thirty (30) days after Customer's written notice, Customer may terminate the affected Service and receive a refund of prepaid fees covering the terminated period after the effective termination date. Remedies for breach of clause (c), the BAA, or Schedule 2 are not limited by this paragraph. The warranty does not apply to misuse, unauthorized modifications, unsupported configurations, third-party services not provided by Pharmacore or its subcontractors, Customer Data, or early-access features.

15. Disclaimers

EXCEPT FOR THE EXPRESS WARRANTIES ABOVE AND TO THE MAXIMUM EXTENT PERMITTED BY LAW, THE SERVICE, OUTPUTS, DOCUMENTATION, AND IMPLEMENTATION, TRAINING, AND SUPPORT SERVICES ARE PROVIDED "AS IS" AND "AS AVAILABLE." PHARMACORE AND ITS LICENSORS DISCLAIM ALL IMPLIED OR STATUTORY WARRANTIES, INCLUDING MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, TITLE, NON-INFRINGEMENT, ACCURACY, COMPLETENESS, AND ANY WARRANTY ARISING FROM COURSE OF DEALING OR USAGE OF TRADE.

PHARMACORE DOES NOT WARRANT THAT THE SERVICE OR ANY OUTPUT WILL IDENTIFY EVERY MEDICATION-RELATED ISSUE, BE CLINICALLY APPROPRIATE FOR A PARTICULAR PATIENT, BE CURRENT OR ERROR-FREE, SATISFY A CUSTOMER'S PROFESSIONAL OR REGULATORY OBLIGATIONS, OR PRODUCE ANY PARTICULAR CLINICAL, OPERATIONAL, OR FINANCIAL OUTCOME. CUSTOMER IS NOT RELIEVED OF PROFESSIONAL JUDGMENT, INDEPENDENT VERIFICATION, DOCUMENTATION, FOLLOW-UP, OR LEGAL DUTIES. NOTHING IN THIS SECTION LIMITS PHARMACORE'S EXPRESS OBLIGATIONS UNDER THE BAA OR SCHEDULE 2.

16. Indemnification

16.1 By Pharmacore

Pharmacore will defend Customer against a third-party claim that Customer's authorized use of the unmodified Service infringes a U.S. patent, copyright, or trademark or misappropriates a trade secret, and will pay damages and costs finally awarded or agreed in settlement. Pharmacore has no obligation for claims arising from Customer Data, Outputs as used or modified by Customer, third-party services, combinations not supplied by Pharmacore, use outside the Agreement or Documentation, or continued use after notice of an alleged infringement. Pharmacore may modify or replace the affected Service or terminate it and refund prepaid fees for the unused terminated period. This section states Customer's exclusive remedy for intellectual-property infringement claims.

16.2 By Customer

Customer will defend Pharmacore and its affiliates, officers, directors, and personnel against a third-party claim arising from: (a) Customer Data or Customer's lack of rights to provide it, including any failure to maintain a business associate agreement required by Section 6.1; (b) Customer's or an Authorized User's unlawful or unauthorized use of the Service; (c) a clinical decision, patient-care act or omission, medication regimen review, or professional service by Customer, its Reviewing Pharmacists, or its other personnel; or (d) Customer's breach of Sections 4, 5, or 6, and will pay damages and costs finally awarded or agreed in settlement. Customer's obligations are reduced to the extent a claim is caused by Pharmacore's breach of the Agreement, the BAA, or Schedule 2, or by the negligence, gross negligence, or willful misconduct of Pharmacore or its subcontractors, so that each party bears responsibility for the claim in proportion to its fault.

16.3 Procedure

The indemnified party will promptly notify the indemnifying party, provide reasonable cooperation at the indemnifying party's expense, and allow it to control the defense and settlement. A delay relieves obligations only to the extent materially prejudicial. No settlement may admit fault by, impose non-monetary obligations on, or fail to fully release the indemnified party without its written consent, not to be unreasonably withheld.

17. Limitation of liability

TO THE MAXIMUM EXTENT PERMITTED BY LAW, NEITHER PARTY NOR ITS LICENSORS WILL BE LIABLE FOR INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, PUNITIVE, OR CONSEQUENTIAL DAMAGES; LOSS OF PROFITS, REVENUE, SAVINGS, GOODWILL, OR BUSINESS; OR LOSS OR CORRUPTION OF DATA, EVEN IF ADVISED OF THE POSSIBILITY. EXCEPT AS PROVIDED BELOW, EACH PARTY'S TOTAL LIABILITY ARISING OUT OF OR RELATED TO THE AGREEMENT WILL NOT EXCEED THE FEES PAID OR PAYABLE BY CUSTOMER FOR THE AFFECTED SERVICE DURING THE 12 MONTHS BEFORE THE EVENT GIVING RISE TO LIABILITY; IF NO FEES WERE PAID, THE CAP IS US$1,000 (THE "GENERAL CAP").

FOR CLAIMS ARISING FROM (a) A PARTY'S BREACH OF SECTION 11 WITH RESPECT TO CUSTOMER DATA; (b) PHARMACORE'S BREACH OF SECTION 6, SCHEDULE 2, OR THE BAA; OR (c) A PARTY'S DEFENSE AND INDEMNIFICATION OBLIGATIONS UNDER SECTION 16, EACH PARTY'S TOTAL LIABILITY WILL NOT EXCEED THE GREATER OF THREE (3) TIMES THE FEES PAID OR PAYABLE BY CUSTOMER DURING THE 12 MONTHS BEFORE THE EVENT GIVING RISE TO LIABILITY OR US$100,000 (THE "ENHANCED CAP"). AN ORDER MAY EXPRESSLY SPECIFY A DIFFERENT ENHANCED CAP. FOR EACH PARTY, AMOUNTS PAID UNDER THE GENERAL CAP COUNT TOWARDS ITS ENHANCED CAP. THE CAPS ARE NOT CUMULATIVE, AND THE GENERAL CAP CONTINUES TO APPLY TO CLAIMS SUBJECT TO IT. FOR CLAIMS SUBJECT TO THE ENHANCED CAP, THE FOLLOWING ARE DIRECT DAMAGES THAT ARE RECOVERABLE NOTWITHSTANDING THE EXCLUSIONS ABOVE, TO THE EXTENT REASONABLE, DOCUMENTED, AND CAUSED BY THE BREACH: COSTS OF LEGALLY REQUIRED NOTIFICATIONS TO INDIVIDUALS AND REGULATORS, CALL-CENTER SUPPORT, CREDIT OR IDENTITY MONITORING WHERE CUSTOMARY OR REQUIRED, AND FORENSIC INVESTIGATION. AMOUNTS PAYABLE TO A THIRD PARTY UNDER SECTION 16 (INCLUDING DAMAGES, SETTLEMENTS, AND DEFENSE COSTS) ARE DIRECT DAMAGES NOT SUBJECT TO THE EXCLUSIONS ABOVE, BUT ARE SUBJECT TO THE ENHANCED CAP.

The exclusions and caps do not limit: (a) Customer's payment obligations; (b) a party's fraud, willful misconduct, or gross negligence; (c) Customer's breach of the license or acceptable-use restrictions in Sections 3 and 5, or its infringement or misappropriation of Pharmacore's intellectual property; or (d) liability that cannot lawfully be excluded or limited. If a claim falls within both the Enhanced Cap and this paragraph, this paragraph controls. The limitations apply in the aggregate and regardless of the form of action.

18. Term, termination, and effect

These Terms begin when Customer first accepts them and continue while any Order is active. Each Order continues for its stated term. Either party may terminate an Order or the Agreement for a material breach not cured within 30 days after written notice, or within 10 days after written notice for undisputed nonpayment; immediately if a breach is not curable; or as permitted by applicable insolvency law. Pharmacore may terminate or suspend if required by law or if continued use creates a material security, privacy, legal, or patient-safety risk, after giving notice and, where practicable, a reasonable opportunity to address the risk. Customer's rights under the next three paragraphs apply however the Agreement ends.

Transition Period. On expiration or termination, Customer's right to use the Service to create new work ends, but Customer's Authorized Users retain read-only access to view and export Customer Data, including PHI, Output, and Completed Reports, for ninety (90) days after the effective date (the "Transition Period"). During the term and the Transition Period, Pharmacore will make Customer Data available for export in PDF and a commonly used structured format (such as CSV or JSON) at no additional charge and will reasonably assist with a bulk export on request. If an Order includes an extended records-retention option, Pharmacore will continue to host Customer Data for the period stated in that Order as part of the Service and under the BAA, and the Transition Period ends when that period ends.

Deletion. Within thirty (30) days after the Transition Period ends, or earlier on Customer's written request, Pharmacore will delete or destroy Customer Data, including PHI, from its production systems and will require its subcontractors to do the same. Copies in encrypted backups will be overwritten or destroyed through ordinary backup rotation within thirty (30) days after deletion from production systems. Pharmacore may retain Customer Data only (a) to the extent required by law; (b) in audit logs that Pharmacore retains for six (6) years as HIPAA compliance documentation, limited to the information needed for that purpose; or (c) where return or destruction is infeasible as provided in the BAA. Sections 6, 7, and 11 and Schedule 2 continue to apply to Customer Data for as long as Pharmacore or any subcontractor retains it, and retained Customer Data is used only for the purpose that prevents its destruction and is destroyed when that purpose ends. On request, Pharmacore will certify deletion in writing. Deletion under this paragraph is mandatory, not discretionary.

No payment condition on PHI. Pharmacore will not condition Customer's access to, or the export, return, or availability of, PHI or Completed Reports on payment of fees or resolution of a billing dispute, whether during the term, a suspension, or the Transition Period. This does not waive Pharmacore's right to collect amounts owed by other lawful means.

Fees on termination. On expiration or termination, only fees accrued through the effective date of termination become due; termination does not accelerate fees for the remainder of a subscription term, except that if Pharmacore terminates for Customer's uncured material breach, unpaid fees for the remainder of the then-current committed term become due. If Customer terminates for Pharmacore's uncured material breach or under Section 14, Schedule 2, or Schedule 3, or if Pharmacore terminates under Section 16.1 or for a legal or risk reason under this Section 18 that Customer did not cause, Pharmacore will refund prepaid fees covering the period after the effective termination date within thirty (30) days.

Sections intended by their nature to survive will survive, including accrued payment, the Transition Period and deletion obligations, confidentiality, Sections 12.2 and 12.3, intellectual property, disclaimers, indemnification, liability, the BAA to the extent it so provides, and miscellaneous terms.

19. Suspension

Pharmacore may suspend affected access (a) for undisputed fees that remain unpaid at least 7 days after Pharmacore gives written notice of non-payment; or (b) on reasonable notice for a material breach, an attack or threat, suspected unauthorized access, use that may harm a patient or third party, or a legal requirement. Where practicable, Pharmacore will limit the suspension to the affected users, functions, or accounts, provide notice, and work with Customer to restore access after the condition is resolved. Emergency action may occur without advance notice where necessary to address an imminent security, privacy, or patient-safety risk, with notice given promptly afterward.

Suspension for non-payment restricts the Service to read-only access: Authorized Users may continue to view, export, and obtain PHI, Completed Reports, and other Customer Data, but may not create new reviews or reports. If a suspension under clause (b) prevents Customer from accessing PHI it needs, Pharmacore will provide that PHI by a secure alternative means as required by the BAA. Pharmacore will restore access within one (1) business day after the condition is resolved or payment is received. Suspension does not shorten Customer's notice and cure periods under Section 18 and is not available for amounts disputed in good faith under Section 10.

20. Compliance with law

Each party will comply with laws applicable to its own performance. Customer is responsible for laws and professional obligations applicable to its healthcare operations, facilities, pharmacists, patients, records, and use of Outputs. Customer will not export, re-export, or provide the Service to a prohibited person, territory, or use in violation of U.S. sanctions or export-control laws. The Service is intended for use in the United States unless an Order expressly states otherwise.

21. Governing law; venue; jury-trial waiver

The Agreement is governed by Delaware law, without regard to conflict-of-laws rules. The state and federal courts located in Delaware will have exclusive jurisdiction, and each party consents to personal jurisdiction and venue there. EACH PARTY KNOWINGLY AND VOLUNTARILY WAIVES ANY RIGHT TO A JURY TRIAL TO THE EXTENT PERMITTED BY LAW. The United Nations Convention on Contracts for the International Sale of Goods does not apply. Either party may seek injunctive or other equitable relief for unauthorized access, misuse of data, Confidential Information, or intellectual property in any court of competent jurisdiction.

22. General

Neither party may assign the Agreement without the other's prior written consent, except to an affiliate or in connection with a merger, reorganization, financing, or sale of substantially all relevant assets, provided the assignee is not a direct competitor and assumes the Agreement. Customer may not assign to a competitor of Pharmacore without consent. The Agreement binds permitted successors and assigns.

Neither party is liable for delay caused by circumstances beyond its reasonable control, excluding payment obligations. The parties are independent contractors; the Agreement creates no partnership, fiduciary, employment, agency, or exclusivity relationship. There are no third-party beneficiaries. If a provision is unenforceable, it will be modified to the minimum extent necessary and the remainder remains effective. A waiver must be written and is not continuing. Headings are for convenience. "Including" means "including without limitation."

The Agreement is the entire agreement on its subject and supersedes prior proposals and understandings. Amendments must be in writing signed by authorized representatives, except Pharmacore may update online Terms for a renewal term or to address law, security, safety, or new features by providing at least 30 days' notice. Material changes will not retroactively reduce Customer's rights during a paid committed term unless required by law or agreed by Customer. No update to these Terms, the End User Terms, the Documentation, or the Privacy Policy, and no Authorized User's acceptance of updated End User Terms or continued use of the Service, will impose new fees or material new obligations on Customer, shorten Customer's notice or cure periods, or reduce Pharmacore's obligations under the BAA, Schedule 2, or Schedule 3 during a committed term, unless Customer agrees in a signed writing or the change is required by law. Electronic signatures and counterparts are effective.

23. Notices and contact

Legal notices must be in writing and sent by personal delivery, nationally recognized overnight courier, or email with confirmation of receipt to the addresses in the Order. Notices to Pharmacore must also be sent to legal@pharmacore.ai and: Pharmacore Inc., 101 Electra, Irvine, CA 92618. Operational notices may be provided in the Service or by email to an account administrator.

Schedule 1 - Service Description and Responsibility Matrix

This Schedule describes the Service and allocates responsibility for the clinical and operational functions that surround it. It forms part of the Terms. Capitalized terms have the meanings given in the Terms.

1. What the Service does

24. Document intake. Authorized Users upload medication administration records (MARs) and other resident records that Customer chooses to provide. The Service parses them into structured medication, diagnosis, and resident information and displays the source document so the user can verify the result.

25. Clinical decision support. The Service generates Output, such as potential medication-related issues, monitoring needs, and draft recommendations, together with the basis and source information for each, for a Reviewing Pharmacist to accept, modify, or reject.

26. Documentation and reporting. The Service drafts medication regimen review documentation, irregularity reports, and summaries, which a Reviewing Pharmacist must review and finalize before they become Completed Reports.

27. Workflow, supervision, and export. Depending on Customer's plan and the Documentation, the Service supports facility and resident assignments, review scheduling, co-signature and supervision workflows, recommendation tracking, audit logging, and export or delivery of Completed Reports to recipients described in Section 12.3.

2. What Pharmacore and the Service do not do

Pharmacore does not perform, and the Service does not automatically perform, any of the following:

28. medication regimen reviews, drug regimen reviews, or reviews of a resident's medical chart;

29. physical medication counts, controlled-substance counts, or inspections of medication carts, storage areas, or emergency kits;

30. reconciliation of medication administration records against orders, dispensing records, or physical inventory (the Service may flag apparent discrepancies within uploaded records for a Reviewing Pharmacist to investigate, but it does not reconcile them);

31. clinical dosage determinations, prescribing, dispensing, e-prescribing, or transmitting orders; or

32. notifying attending physicians, medical directors, directors of nursing, residents, or regulators, or confirming that a report was received or acted upon, except through a delivery feature that Customer uses and controls.

3. Three different review activities

4. Responsibility matrix

5. Order details

Each Order will state, as applicable: the plan; the number and type of Authorized Users; the Covered Facilities or the maximum number of facilities or beds; any implementation or training services; any extended records-retention option; and any data-use authorization under Section 6.2 or 6.3.

Schedule 2 - Security Addendum

This Schedule states the safeguards Pharmacore maintains for Customer Data. It forms part of the Terms. If it conflicts with the BAA regarding PHI, the BAA controls.

1. Security program

Pharmacore maintains a written information security program under the HIPAA Security Rule (45 C.F.R. Part 164, Subpart C), with a designated security official, a documented risk analysis reviewed at least annually and whenever systems, subcontractors, or data flows change materially, and documented tracking of identified risks to remediation.

2. Hosting and data location

Customer Data is hosted with a cloud infrastructure provider that has signed a business associate agreement with Pharmacore and maintains a current SOC 2 Type II report or equivalent attestation. Pharmacore stores Customer Data, including PHI, only in data centers located in the United States and will not store or process PHI outside the United States without Customer's prior written consent.

3. Encryption

Customer Data is encrypted in transit over public networks using TLS 1.2 or higher, including all transmissions to AI subcontractors, and at rest using AES-256 or stronger, including databases, document storage, and backups. Access to encryption keys is restricted to authorized personnel.

4. Access controls and authentication

Role-based access controls limit access to Customer Data by role and by Covered Facility assignment. Multi-factor authentication is required for all Pharmacore administrative, production, and server access; is available to all Authorized Users; and can be required for all of Customer's Authorized Users by Customer's administrator. Sessions end after a configurable period of inactivity (default thirty (30) minutes). Pharmacore personnel receive access on a least-privilege basis, have no standing access to Customer Data for development purposes, and lose access within four (4) hours after a role change or separation; access is reviewed quarterly. Pharmacore support personnel access Customer's account only with Customer's approval, except where needed to respond to a Security Incident or a legal requirement.

5. Audit logging and monitoring

Pharmacore logs access to and actions on PHI, including views, edits, signatures, exports, permission changes, and transmissions of PHI to AI subcontractors. Audit logs are append-only, stored separately from the application, retained for six (6) years, and reviewed at least monthly. Pharmacore monitors for repeated failed logins and anomalous access.

6. Development and patching

Pharmacore does not use real PHI in development, testing, staging, or demonstration environments. Pharmacore applies operating-system and dependency security updates through an automated process and applies critical security patches within 14 days after release where technically feasible.

7. Workforce

Workforce members with access to PHI complete HIPAA security training before receiving access and annually afterward, are bound by written confidentiality obligations, and, other than Pharmacore's founders, undergo a background check appropriate to their role. Workstations with access to PHI use full-disk encryption, automatic screen lock, and endpoint protection.

8. Backups and recovery

Pharmacore takes encrypted backups of Customer Data at least daily, stores them separately from production systems, and retains them for thirty (30) days. Pharmacore maintains a documented disaster recovery plan with a recovery point objective of twenty-four (24) hours and a recovery time objective of twenty-four (24) hours, and tests backup restoration at least annually.

9. Security incidents

"Security Incident" means a security incident, as defined in 45 C.F.R. § 164.304, affecting Customer Data, or any other unauthorized access to, or acquisition, use, or disclosure of, Customer Data. Pharmacore will notify Customer of a Security Incident without unreasonable delay and within the time stated in Section 7 of the BAA, measured from discovery as defined there; the same timeline applies to a Security Incident involving Customer Data that is not PHI. The notice will describe, to the extent known, what happened, the Customer Data involved, and the steps taken, and Pharmacore will supplement it as more information becomes available.

Unsuccessful attempts that do not result in unauthorized access, use, disclosure, modification, or destruction of Customer Data or interference with system operations, such as pings, port scans, blocked denial-of-service attempts, and unsuccessful log-on attempts, are reported by this paragraph and need no further notice. Pharmacore will investigate, contain, and remediate each Security Incident, cooperate reasonably with Customer's investigation and any notifications Customer must make, and bear the cost of remediating its own systems.

10. Subcontractors

Pharmacore lists the subcontractors that store or process Customer Data at https://pharmacore.ai/legal/subcontractors/. Pharmacore will give Customer at least thirty (30) days' notice, by email to Customer's administrator or through the Service, before a new subcontractor begins processing PHI, except where a change is urgently needed to address a security or availability risk, in which case Pharmacore will give notice as soon as practicable. If Customer reasonably objects on data-protection grounds within that period and the parties cannot resolve the objection, Customer may terminate the affected Service and receive a refund of prepaid fees for the period after termination.

Pharmacore will (a) assess each subcontractor's security before it receives PHI; (b) have a business associate agreement in place with each subcontractor that receives PHI, consistent with the BAA, and keep a copy on file; and (c) remain responsible for each subcontractor's performance of Pharmacore's obligations as if they were Pharmacore's own.

11. Security reviews

Once a year, and after any Security Incident affecting Customer Data, Pharmacore will respond to Customer's reasonable written security questionnaire and provide a summary of its most recent risk analysis and any third-party attestations it holds, subject to Section 11 of the Terms. Pharmacore will make its internal practices, books, and records relating to PHI available to the Secretary of Health and Human Services as HIPAA requires.

12. Customer responsibilities

Customer is responsible for the matters described in Section 7 of the Terms, including promptly provisioning and removing Authorized Users, requiring multi-factor authentication for its Authorized Users, and securing its own devices, networks, and exports.

Schedule 3 - Support and Service Levels

1. Support

Pharmacore provides support through the in-product support channel and at support@pharmacore.ai during 9:00 a.m. to 5:00 p.m. Pacific Time, Monday through Friday, excluding U.S. federal holidays ("Support Hours"). Suspected Security Incidents may be reported at any time to security@pharmacore.ai. Support covers troubleshooting, questions about use of the Service, and correction of reproducible defects; it does not include clinical advice. Do not include PHI in a support request except through a channel Pharmacore has identified as approved for PHI.

Suspected Security Incidents may be reported at any time and will be assessed and escalated without unreasonable delay under Pharmacore’s incident-response procedures, including outside Support Hours. Nothing in this Schedule changes the notification obligations under the BAA or Schedule 2.

Pharmacore will work diligently on Severity 1 and Severity 2 issues until they are resolved or a workaround is provided, and will update Customer on Severity 1 issues at least every 4 hours during Support Hours.

2. Availability

Pharmacore will make the Service available at least 99% of the time in each calendar month ("Monthly Availability"), calculated as the total minutes in the month less minutes of Unavailability, divided by the total minutes in the month. "Unavailability" means Authorized Users cannot log in to the Service or access Customer Data because of a failure of the Service, excluding: (a) scheduled maintenance announced at least forty-eight (48) hours in advance, performed where practicable outside 6:00 a.m. to 8:00 p.m. Pacific Time on business days, and not exceeding eight (8) hours per month; (b) emergency maintenance to address a security or integrity risk; (c) events described in Section 22 of the Terms, other than failures of Pharmacore's subcontractors and events that the disaster recovery plan in Schedule 2 is designed to address; (d) Customer's systems, networks, acts, or omissions; (e) third-party services not provided by Pharmacore or its subcontractors; and (f) early-access features.

3. Service credits

If Monthly Availability falls below the commitment, Customer will receive a credit against future fees for the affected Service equal to the following percentage of that month's fees: 5% if Monthly Availability is below the commitment but at least 99.0%; 10% if it is below that level but at least 95.0%; and 25% if it is lower. Customer must request a credit within thirty (30) days after the end of the month. If the Agreement ends, Pharmacore will refund any unused credit.

4. Monthly review continuity

If Unavailability, or a Severity 1 or Severity 2 issue, lasts more than twenty-four (24) consecutive hours and prevents Customer from completing medication regimen reviews scheduled in the Service, Pharmacore will, at Customer's request: (a) within one (1) business day, provide an export of the affected residents' uploaded records, Output, and draft documentation so that Customer can complete its reviews outside the Service; (b) provide a written statement of the cause and duration of the disruption for Customer's records; and (c) issue an additional credit of 10% of that month's fees for the affected Service. Customer remains responsible for maintaining a contingency procedure for completing required reviews if the Service is unavailable.

5. Chronic failure

If Monthly Availability falls below the commitment in any three (3) months during a rolling six-month period, Customer may terminate the affected Order by notice given within thirty (30) days after the third such month and receive a refund of prepaid fees for the period after termination.

6. Remedies

The credits and termination right in this Schedule are Customer's sole remedies for Unavailability, except where the Unavailability results from a Security Incident, a breach of the BAA or Schedule 2, or Pharmacore's gross negligence or willful misconduct. Credits do not reduce Pharmacore's obligations under Section 18 or the BAA to provide access to PHI.

Exhibit A - Business Associate Agreement

A current copy of this Business Associate Agreement is available for download at https://pharmacore.ai/legal/baa/.

This Business Associate Agreement (the "BAA") is between Pharmacore Inc., a Delaware corporation ("Pharmacore"), and the customer identified in the applicable Order ("Customer"). This BAA is incorporated into, and is Exhibit A to, Pharmacore's SaaS Subscription Terms and Conditions (together with each Order, the "Agreement"). This BAA is effective as of the earlier of: (i) execution of an Order incorporating this BAA; or (ii) acceptance of this BAA by Customer's authorized representative in writing or through Pharmacore's account-owner enrollment process, and in either case it must be effective before Customer submits any PHI. Any capitalized terms not defined herein will have the definition used in the Agreement. The terms of this BAA will control to the extent inconsistent with the Agreement regarding PHI.

1. Definitions. (A) "Business Associate" shall have the meaning set forth at 45 CFR 160.103, and between the parties, refers to Pharmacore; (B) "Covered Entity" shall have the meaning set forth at 45 CFR 160.103, and between the parties, refers to Customer, except that where Customer is itself a business associate of a covered entity (for example, a consultant pharmacy serving a nursing facility), Pharmacore is Customer's Subcontractor, and references in this BAA to Customer's obligations under the HIPAA Rules (including 45 CFR 164.524, 164.526, and 164.528) refer to the obligations Customer has as that covered entity's business associate; (C) "HIPAA Rules" means the Privacy, Security, Breach Notification, and Enforcement Rules at 45 CFR Part 160 and Part 164, as amended. The following terms shall have the same meaning as those terms in the HIPAA Rules: Breach, Data Aggregation, Designated Record Set, Disclosure, Health Care Operations, Individual, Minimum Necessary, Notice of Privacy Practices, Protected Health Information (or "PHI"), Required By Law, Secretary, Security Incident, Subcontractor, Unsecured Protected Health Information, and Use.

2. Scope. Pursuant to the Agreement, Pharmacore provides cloud-hosted clinical decision support and workflow software for licensed pharmacists, and related implementation, training, and support services (the "Services"). In its performance of the Services, Pharmacore may create, receive, maintain, or transmit PHI on behalf of Customer. Notwithstanding anything to the contrary herein or in the Agreement, this BAA shall apply, and Pharmacore shall have obligations hereunder, solely to the extent Pharmacore creates, receives, maintains, or transmits PHI in connection with Pharmacore's provision of the Services. Pharmacore is not responsible for a failure to comply with this BAA to the extent caused by Customer's failure to comply with the Agreement, HIPAA, or this BAA, or by Customer's configuration or use of the Services. This BAA shall not apply to Pharmacore's performance of any other services or processing of any other data on behalf of Customer. Except as expressly stated in the Agreement (including Schedule 2 of the Terms), Pharmacore does not represent or warrant that Pharmacore or its other products or services are HIPAA compliant, that it has or will maintain any certifications of any kind, or that Customer will comply with HIPAA merely because Customer uses the Services.

3. Customer obligations. Without limiting Section 2, Customer: (A) will comply with the HIPAA Rules; (B) is solely responsible for understanding the scope and characteristics of the Services provided by Pharmacore, assessing relevant risks to PHI arising from Customer's use of the Services, and ensuring the appropriate mitigation of such risks, including by configuring and using the Services as necessary to maintain compliance with the HIPAA Rules; (C) shall ensure the proper configuration of its own networks, software, and other systems that are used by or on behalf of Customer to process PHI; (D) shall implement and maintain necessary and appropriate administrative procedures regarding access to PHI, limit such access to only authorized personnel, and terminate access where no longer necessary or appropriate; (E) if Customer is a business associate of a covered entity, shall maintain a business associate agreement with that covered entity that permits Customer to engage Pharmacore as its Subcontractor on terms consistent with this BAA, and shall confirm this in writing on request; (F) shall not request that Pharmacore use or disclose PHI in any manner that would not be permissible under the HIPAA Rules if done by Customer; and (G) shall not submit records subject to 42 CFR Part 2 unless the parties have first agreed in writing how those records will be handled. Customer shall not agree to any restriction on the use or disclosure of PHI, or place any limitation in its notice of privacy practices, that would cause Pharmacore to breach the HIPAA Rules or this BAA or would otherwise affect Pharmacore's use or disclosure of PHI under this BAA, without Pharmacore's prior written consent.

4. Pharmacore obligations. Without limiting Section 2, Pharmacore will: (A) not use or disclose PHI other than as permitted or required by this BAA or as Required By Law; (B) use appropriate safeguards, and comply with Subpart C of 45 CFR Part 164 with respect to electronic PHI, to prevent Use or Disclosure of the PHI other than as provided for by this BAA; (C) in accordance with 45 CFR 164.502(e)(1)(ii) and 164.308(b)(2), ensure that any Subcontractors that create, receive, maintain, or transmit PHI on behalf of Pharmacore agree in writing to the same restrictions and conditions that apply to Pharmacore with respect to such information, and keep copies of those agreements on file; (D) within ten (10) business days after Customer's request, make available PHI in a Designated Record Set to Customer as necessary to satisfy Customer's obligations under 45 CFR 164.524, in addition to the export features of the Services, which Customer may use during the term, the Transition Period, and (subject to Section 19 of the Terms) any suspension; (E) within ten (10) business days after Customer's request, make any amendment(s) to PHI in a Designated Record Set as directed or agreed to by Customer pursuant to 45 CFR 164.526, or take other measures as necessary to satisfy Customer's obligations under 45 CFR 164.526; (F) maintain, and within ten (10) business days after Customer's request make available, the information required to provide an accounting of disclosures to Customer as necessary to satisfy Customer's obligations under 45 CFR 164.528; (G) to the extent Pharmacore carries out one or more of Customer's obligations under Subpart E of 45 CFR Part 164, comply with the requirements of Subpart E that apply to Customer in the performance of such obligation(s); (H) limit its uses and disclosures of, and requests for, PHI to the Minimum Necessary; and (I) make its internal practices, books, and records available to the Secretary for purposes of determining compliance with the HIPAA Rules.

5. Permitted uses and disclosures. Pharmacore may: (A) use or disclose PHI as necessary to perform the Services, any of Pharmacore's obligations under the Agreement, or as otherwise agreed in writing between the parties; (B) use PHI for the proper management and administration of Pharmacore and to carry out the legal responsibilities of Pharmacore; (C) disclose PHI for the proper management and administration of Pharmacore or to carry out its legal responsibilities, provided such disclosures are Required By Law, or Pharmacore obtains reasonable assurances from the person to whom the information is disclosed that the information will remain confidential and used or further disclosed only as Required By Law or for the purposes for which it was disclosed to the person, and the person notifies Pharmacore of any instances of which it is aware in which the confidentiality of the information has been breached; (D) use or disclose PHI as Required By Law; and (E) de-identify PHI in accordance with 45 CFR 164.514(a)-(c), to the extent permitted by any business associate agreement under which Customer received the PHI, and use and otherwise process such de-identified information for Pharmacore's own internal use, including without limitation for the purpose of product and service improvement and data analysis, and disclose it only as Section 6.3 of the Terms permits. Pharmacore will not use or disclose PHI in a manner that would violate Subpart E of 45 CFR Part 164 if done by Customer, except for the uses and disclosures permitted by Sections 5(B) and 5(C). Pharmacore will not sell PHI, use or disclose PHI for marketing, or use PHI to train, fine-tune, or evaluate artificial intelligence models except as Section 6.2 of the Terms permits.

6. Individual rights requests. Customer shall notify Pharmacore of any changes in, or revocation of, the permission by an Individual to use or disclose his or her PHI, to the extent that such changes may affect Pharmacore's use or disclosure of PHI. Except for Pharmacore's obligations in Section 4, Customer shall have the sole responsibility for providing any response to an Individual's request for access to PHI or a Designated Record Set, amendments of PHI, or an accounting of disclosures. In the event Pharmacore receives a request from an Individual, Pharmacore shall, without unreasonable delay and within five (5) business days, forward such request to Customer so that Customer may fulfill its obligations under the HIPAA Rules. Pharmacore may charge Customer its reasonable costs, at rates agreed in advance, for assistance under this Section 6 or Section 4(D)-(F) that goes beyond the self-service features of the Services, but will not delay or condition that assistance, or Customer's access to PHI, on payment.

7. Security incidents and breaches. Pharmacore shall, without unreasonable delay (and within 60 days of discovery), report to Customer any Use or Disclosure of PHI not provided for by this BAA, any confirmed Security Incident, and any confirmed Breach of Unsecured Protected Health Information (as required at 45 CFR 164.410) of which it becomes aware. Each of these is treated as discovered on the first day on which it is known to Pharmacore or, by exercising reasonable diligence, would have been known to Pharmacore. If a business associate agreement under which Customer received the PHI requires a shorter reporting period, Customer may notify Pharmacore in writing, and the parties will agree in good faith on a corresponding period. This Section is notice of the ongoing existence of attempted but unsuccessful Security Incidents (such as pings, port scans, blocked denial-of-service attempts, and unsuccessful log-on attempts) that do not result in unauthorized access, Use, Disclosure, modification, or destruction of PHI or interference with system operations, and no further notice of them is required. Pharmacore shall provide Customer with the information described in 45 CFR 164.410(c), to the extent available, and any other relevant information reasonably requested to permit Customer to comply with the notification requirements set forth at 45 C.F.R. §164.400 et seq. Pharmacore shall take corrective action and will use commercially reasonable efforts to mitigate and cure, to the extent reasonably necessary, harmful effects resulting from a Breach that are known to or anticipated by Pharmacore. Customer shall provide all necessary notifications of the Breach to Individuals and/or other persons or entities, at its cost; where the Breach resulted from Pharmacore's breach of this BAA or the Agreement, Customer may recover those costs from Pharmacore as damages, subject to Section 17 of the Terms.

8. Term and termination. Unless terminated sooner for cause as set out in this Section 8, the term of this BAA shall begin on its effective date and shall terminate upon the later of (i) the termination of the Agreement, or (ii) when Pharmacore ceases to have access to or otherwise process any PHI received from, or created, received, maintained or transmitted by or on behalf of, Customer. Customer may terminate this BAA and the affected Services if Pharmacore violates a material term of this BAA, and such violation is not cured within 30 days from the date Customer provides Pharmacore written notice of such violation. Upon expiration or termination of the Agreement or this BAA for any reason, Pharmacore, with respect to PHI received from Customer, or created, maintained, or received by Pharmacore on behalf of Customer, shall: (A) make the PHI available to Customer for export during the Transition Period described in Section 18 of the Terms; (B) thereafter return to Customer or destroy the PHI that Pharmacore and its Subcontractors maintain, within the time stated in Section 18 of the Terms, retaining only PHI that is Required By Law to be retained, that is contained in audit logs Pharmacore retains as HIPAA compliance documentation, or that is otherwise infeasible to return or destroy; (C) continue to use appropriate safeguards and comply with Subpart C of 45 CFR Part 164 with respect to electronic PHI to prevent Use or Disclosure of the PHI, other than as provided for in this Section, for as long as Pharmacore retains the PHI; and (D) not use or disclose the PHI retained by Pharmacore other than for the purposes for which such PHI was retained and subject to the same conditions set out herein that applied prior to termination, and destroy it when those purposes end.

9. Miscellaneous. The provisions of this BAA shall prevail over the provisions of any other prior agreement that exists between the parties that may conflict with, or appear inconsistent with, any provision of this BAA or HIPAA, unless otherwise explicitly set forth in such agreement. A reference in this BAA to a section in the HIPAA Rules means the section as in effect or as amended, and any ambiguity in this BAA shall be interpreted to permit compliance with the HIPAA Rules. The parties will amend this BAA as necessary to comply with changes in the HIPAA Rules. The version of this BAA in effect when Customer accepts it governs until the parties agree otherwise in writing or an amendment is required for compliance with the HIPAA Rules. The relationship between Pharmacore and Customer is an independent contractor relationship. This BAA shall not be construed to create an agency, partnership, employer/employee, master/servant or joint venture relationship between the parties. The invalidity or unenforceability of any particular provision of this BAA shall not affect the other provisions hereof, and this BAA shall be construed in all respects as if such invalid or unenforceable provisions were omitted. Nothing express or implied in this BAA is intended to confer, nor shall anything herein confer, upon any person other than the parties hereto and their respective successors and permitted assigns, any rights, remedies, obligations, or liabilities whatsoever. Except as expressly stated herein, this BAA shall not modify the limitations of liability, indemnification clauses, warranties offered or disclaimed, or other terms and conditions of the Agreement. This BAA is governed by the law that governs the Agreement. The respective rights and obligations of the parties under Section 8(B)-(D) and Section 9 (Miscellaneous) will survive termination of this BAA indefinitely. This BAA may be executed in several counterparts, each of which will be deemed an original but all of which will constitute one and the same agreement. Facsimile signatures and electronic copies of signatures shall have the same force and effect as original signatures.