Master Service Terms

These Service Terms (“Terms”) govern the Services provided by Compliance Holdings LLC d/b/a Lumelight (“Lumelight”) and are incorporated into any order form, proposal, statement of work, quote, renewal document, purchase document, online acceptance flow, or other ordering mechanism referencing this document (collectively, an “Order Form”) between Lumelight and the applicable contracting party (“Client”) (together, the “Parties”).

Capitalized terms used but not otherwise defined herein have the meanings set forth below.

a. “Authorized User” means Client’s employees, agents, consultants, contractors, and service providers authorized by Client to access or use the Services.

b. “Client Information” means any information, data, materials, or content provided by or on behalf of Client to Lumelight, including information uploaded, input, or otherwise transmitted through the Services.

c. “Intellectual Property Rights” means all intellectual property rights throughout the world, including patents, copyrights, trademarks, trade secrets, inventions, proprietary software, documentation, and similar rights.

d. “Lumelight IP” means the Services, Software, deliverables, work product, Aggregated Data, and all related technology and Intellectual Property Rights.

e. “Services” means the services performed by Lumelight under an applicable Order Form, including compliance services, reporting services, implementation services, consulting services, training services, and Software services.

f. “Software” means Lumelight’s software platforms, applications, tools, AI systems, algorithms, and related technology made available in connection with the Services.

g. “Vendor Information” means any information, data, materials, or other content, in any form or medium, that (i) is created, used, or maintained by any agent, consultant, vendor, or other third-party service provider of Client (“Client Service Providers”); (ii) relates to Client, Client’s current and former employees, or any of Client’s benefit plans; and (iii) is provided to Lumelight, including uploaded, input, or otherwise transmitted into Lumelight’s Software, by Client or an Authorized User.

These Terms establish the master legal terms governing all Services provided by Lumelight pursuant to any applicable Order Form. If there is a conflict between these Terms and an Order Form, the Order Form shall control solely with respect to the Services described therein. If there is a conflict between these Terms and the HIPAA Addendum, the HIPAA Addendum shall control solely with respect to HIPAA-related matters. It is understood that unless the Parties agree otherwise in writing, Lumelight shall have no responsibility to update any of its work or re-perform any of the Services after their completion. Lumelight reserves the right, in whole or in part, to decline to perform Services if Lumelight believes its performance of such Services could cause Lumelight to be in violation of applicable law, regulations, or standards or cause a conflict of interest.

To the extent that the Services include access to and use of the Software, then the following shall apply:

a. Provision of Access. Subject to, and conditioned on, Client’s compliance with the terms of these Terms, Lumelight grants Client and its Authorized Users a limited, non-exclusive, non-sublicensable, non-transferable right to access and use the Software in connection with the permitted uses set forth in an applicable Order Form, and solely for its internal business purposes. Lumelight shall provide the Client with the necessary passwords and network links or connections to allow Client to access the Software.

b. Use Restrictions. Client shall not use the Software for any purposes beyond the scope of the access granted in these Terms and the applicable Order Form. Client shall not at any time, directly or indirectly: (i) copy, modify, or create derivative works of the Software, in whole or in part; (ii) rent, lease, lend, sell, license, sublicense, assign, distribute, publish, transfer, or otherwise make the Software available to third-parties; (iii) reverse engineer, disassemble, decompile, decode, adapt, or otherwise attempt to derive or gain unauthorized access to the Software, in whole or in part; (iv) remove any proprietary notices from the Software; (v) use the Software in any manner or for any purpose that infringes, misappropriates, or otherwise violates any intellectual property right or other right of any person, or that violates any applicable law; (vi) interfere with or disrupt the integrity or performance of the Software or third-party data contained therein; (vii) breach the security or authentication measures of the Software without proper authorization or willfully render any part of the Software unusable; (viii) use or access the Software to develop a product or service that is competitive with the Services or otherwise engage in competitive analysis or benchmarking of the Services relative to competing platforms; or (ix) use the Software to store or transmit viruses or other harmful or malicious code, files, scripts, agents, or programs. Lumelight may, but is not required to, monitor Client’s use of the Software.

c. Suspension. Notwithstanding anything to the contrary, Lumelight may suspend Client’s access to any portion or all of the Software if: (i) Lumelight reasonably determines that (A) there is a threat or attack on the Software or the hosting facility(ies) from which the Software is hosted, (B) Client’s use of the Software disrupts or poses a security risk to the Software or to any other client or vendor of Lumelight, (C) Client is using the Software or Lumelight IP for fraudulent or illegal activities or in any manner not in compliance with these Terms, or (D) Lumelight’s provision of the Software is prohibited by applicable law; or (ii) any vendor of Lumelight has suspended or terminated Lumelight’s access to or use of any third-party services or products required to enable Client to access the Software (any such suspension described in subclause (i) or (ii) a “Service Suspension”).

Except where immediate suspension is reasonably necessary to address a security risk, a threat or attack, suspected fraud or illegal activity, or to comply with applicable law, Lumelight will use commercially reasonable efforts to provide Client prior notice of the basis for the Service Suspension and a reasonable opportunity to cure (if curable) before suspending access.

Lumelight shall use commercially reasonable efforts to provide notice of any Service Suspension to Client and to provide updates. Lumelight shall use commercially reasonable efforts to resume providing access to the Software after the event giving rise to the Service Suspension is resolved. Lumelight will have no liability for any damage, liabilities, losses (including any loss of data or profits), or any other consequences that Client may incur as a result of a Service Suspension.

All amounts payable under these Terms and any Order Form must be paid by Client by the 30th calendar day following Client’s receipt of an invoice from Lumelight. If any payments are not received from Client by the due date, then such charges will accrue interest at the rate of the lesser of (a) 1.5% of the outstanding balance per month, or (b) the maximum rate permitted by law, from the date such payment was due until the date Lumelight receives such payment. Lumelight shall be entitled to all costs and expenses incurred in seeking collection of amounts owed by Client. If any payments are not received from Client by the due date, then in addition to any other remedies available to Lumelight under these Terms, Lumelight may suspend any further provision of Services until all past due payments are received from Client. All fees are nonrefundable. Client shall make all payments in accordance with these Terms and applicable Order Form(s). Lumelight’s preferred payment method is ACH. Certain payment methods may be subject to processing or administrative fees, as specified on Lumelight’s invoice or otherwise communicated to Client. Client remains responsible for ensuring timely payment regardless of payment method

Pricing applicable to any renewal term may be updated by Lumelight upon at least forty-five (45) days’ prior written notice to Client before the expiration of the then-current Service Term.

All fees are exclusive of taxes. Client is responsible for all taxes imposed by any federal, state, or local governmental or regulatory authority on any amounts payable by Client hereunder, other than any taxes imposed on Lumelight’s income.

Client acknowledges and agrees that Lumelight is not a licensed attorney or accountant. The Services provided by Lumelight do not constitute legal, accounting, or tax advice and Lumelight’s work product shall not be considered a substitute for legal, accounting or tax advice from qualified professionals. Furthermore, Client acknowledges and agrees that Lumelight is not responsible for any (i) failure by Client to inform a plan sponsor of this disclaimer or (ii) misrepresentation by Client of Lumelight and/or the Services.

a. Client is responsible and liable for all uses of the Services resulting from access provided by Lumelight, directly or indirectly, whether such access or use is permitted by or in violation of these Terms. Without limiting the generality of the foregoing, Client is responsible for all acts and omissions of Authorized Users.

b. Client will also use reasonable efforts to prevent unauthorized access to or use of the Services and notify Lumelight promptly of any such unauthorized access or use. Client will abide, and ensure that its Authorized Users abide, by all of Lumelight’s applicable policies as well as all applicable laws and regulations with respect to the use of the Services.

c. Client is solely responsible for the accuracy, completeness, quality, and legality of all information, content, or data, including Client Information or other Confidential Information, supplied to Lumelight or otherwise input into the Software by or on behalf of Client. Lumelight shall have no responsibility to investigate the accuracy of any such information or locate any information that may be missing.

d. Timely completion of the Services may depend on Client’s timely provision of information, approvals, access, and other cooperation. Lumelight shall not be responsible for delays or missed regulatory or compliance deadlines resulting from Client’s failure to provide such cooperation in a timely manner.

e. To the extent Client or its Authorized Users provide to Lumelight or otherwise input into the Software any Client Information, or any personally identifiable information, personal health information, or otherwise sensitive or Confidential Information, Client is solely responsible for providing any notices to and/or obtaining any consents necessary for Lumelight to access, maintain, process, or use any such Client Information as permitted under these Terms.

f. “Output” means information, data, materials, text, images, code, works, or other content generated by or otherwise output from the Software (“Output”). Client acknowledges and agrees that (i) Client is solely responsible for the use of any Output and for applying independent business judgment with respect to any decisions or actions taken based on or after reviewing the Output; and (ii) Lumelight will have no liability with respect to any claims arising out of the content of, or reliance on, any Output.

g. Client is solely responsible for selecting, purchasing, installing, and maintaining the equipment, software, and telecommunications needed to access any part of the Services.

a. Lumelight Intellectual Property. Except as provided in an applicable Order Form, as between Client and Lumelight, subject to any licenses or use rights granted to Client herein, all Intellectual Property rights in the Lumelight IP are and will remain solely and exclusively the property of Lumelight.

b. Client Information. Lumelight acknowledges that, as between Lumelight and Client, Client owns all right, title, and interest, including all intellectual property rights, in and to any Client Information provided to Lumelight or input into the Software. Client hereby grants to Lumelight a non-exclusive, non-transferable, royalty-free, worldwide license to host, store, process, transmit, copy, modify, display, and otherwise use Client Information solely as necessary to: (i) provide the Services to Client; (ii) exercise Lumelight’s rights and perform its obligations under these Terms; (iii) troubleshoot and resolve any issues or errors with the Services and/or the Software; and (iv) monitor and measure the performance, availability, security, abuse, and compliance of the Services, including Client’s compliance with these Terms. Lumelight may disclose Client Information only (A) to its employees, affiliates, and subcontractors/service providers who need to know such Client Information to provide the Services and who are bound by confidentiality obligations at least as protective as those set forth in these Terms, or (B) as required to comply with applicable law or a valid legal process. For the avoidance of doubt, Lumelight may use Aggregated Data (as defined in Section 8(d)) to maintain, improve, expand, or enhance the Services and/or Software, and such use will not include Client Information in identifiable form. The foregoing does not grant Lumelight any ownership interest in Client Information, and all rights not expressly granted by Client to Lumelight are reserved by Client.

c. Feedback. If Client suggests any new features, functionality or performance for the Service that Lumelight subsequently incorporates into the Service (or any other software or service), Client hereby acknowledges that (i) Lumelight shall own, and has all rights to use, such suggestions and the Service (or any other service) incorporating such new features, functionality, or performance shall be the sole and exclusive property of Lumelight; and (ii) all such suggestions shall be free from any confidentiality restrictions that might otherwise be imposed upon Lumelight. Client hereby irrevocably assigns to Lumelight any and all such suggestions. Client hereby irrevocably assigns to Lumelight any and all rights that Client has to any such feedback and suggestions.

d. Aggregated Data. Notwithstanding anything to the contrary in these Terms, Client agrees that Lumelight may monitor Client’s use of the Services and collect and compile data in summary or other form such that the data cannot be identified (“Aggregated Data”) pertaining to the use and performance of the Services, provided that Lumelight will anonymize or otherwise de-identify such data. Client acknowledges that Lumelight may compile Aggregated Data based on Client Information (however received by Lumelight). The Parties agree that Lumelight owns all rights in and to any Aggregated Data it develops or creates in connection with these Terms, including all Intellectual Property Rights. Client agrees that Lumelight may use, compile, and transfer Aggregated Data for all legally permissible uses.

a. Confidential Information. During the Term, either Party (the “Discloser”) may disclose or make available to the other Party (the “Recipient”) sensitive or proprietary information, whether orally or in written, electronic, or other form or media, and whether or not marked, designated, or otherwise identified as “confidential” (collectively, “Confidential Information”). Lumelight’s Confidential Information includes the Lumelight IP. Confidential Information does not include information that, at the time of disclosure is (a) in the public domain, (b) known to the Recipient, (c) rightfully obtained by the Recipient on a non-confidential basis from a third party, or (d) independently developed by the Recipient.

b. Obligations. The Recipient shall not, without prior written consent of the Discloser, disclose the Discloser’s Confidential Information to any person or entity, except to the Recipient’s employees, officers, directors, attorneys, auditors, financial advisors, and other representatives or service providers who have a need to know the Confidential Information and are legally bound to keep such information confidential by obligations consistent with these Terms. Upon expiration or termination of these Terms, the Recipient shall promptly return to the Discloser or destroy all copies of the Discloser’s Confidential Information in its possession or control, whether in written, electronic, or other form or media, upon the Discloser’s written request. Notwithstanding the foregoing, the Recipient may retain Confidential Information to the extent required by applicable law, regulatory obligations, bona fide internal record retention policies, backup systems, or routine archival processes, provided that any retained Confidential Information shall remain subject to the confidentiality obligations set forth in these Terms. Each Party’s obligations of non-disclosure of Confidential Information will survive the termination or expiration of these Terms.

c. Equitable Relief. Each Party acknowledges and agrees that a breach or threatened breach by such Party of any of its obligations under this Section 9 would cause the other Party irreparable harm for which monetary damages would not be an adequate remedy and agrees that, in the event of such breach or threatened breach, the other Party will be entitled to equitable relief. Such remedies are not exclusive and are in addition to all other remedies that may be available at law, in equity, or otherwise.

If Services involve Protected Health Information (“PHI”) subject to HIPAA, the applicable Lumelight HIPAA Addendum referenced in the applicable Order Form shall apply and is incorporated into these Terms by reference.

a. Term. These Terms remain effective for so long as any Order Form remains active.

b. Termination. Either Party may terminate an applicable Order Form, or these Terms if no active Order Forms remain, upon written notice to the other Party if: (i) a material breach of these Terms or any Order Form by the other Party is not remedied within thirty (30) days after the breaching Party’s receipt of written notice of the breach; (ii) the other Party admits in writing its inability to pay its debts generally as they become due, files a petition for bankruptcy or executes an assignment for the benefit of creditors or similar document; or (iii) a receiver, trustee in bankruptcy or similar officer is appointed for the other Party’s property. Client’s failure to timely pay any fees and/or expenses when due shall be considered a material breach of these Terms.

a. Lumelight shall indemnify, hold harmless, and defend Client from and against third-party claims that the Services used by Client in accordance with these Terms infringes or misappropriates the third-party’s intellectual property rights in the United States. Lumelight shall have no liability, and this Section 12(a) will not apply, for any claim of infringement resulting from: (i) Client’s alteration or modifications of the Services or Software without Lumelight’s prior written approval; (ii) Client Information; or (iii) the combination or use of the Services with software, data, or material not furnished by Lumelight (each an “Indemnification Exception”). This paragraph states Lumelight’s entire liability and exclusive remedy for infringement of third-party intellectual property rights.

b. Client shall indemnify, hold harmless, and defend Lumelight, its affiliates and Lumelight’s and the affiliates’ respective officers, directors, shareholders, and (current and former) employees, from and against any and all liability, loss, damage, claim, causes of action, and expenses (including reasonable attorneys’ fees) (collectively “Damages”) whether or not covered by insurance, directly or indirectly resulting from or based upon (i) Client’s (including its Authorized Users) responsibilities under Section 7 of these Terms; (ii) a decision by Client (including its Authorized Users) regarding Client’s employee-benefit plans, including administration of the plans and individual eligibility determinations; (iii) a decision made or action taken by Client or any Authorized User in reliance upon any Output; and (iv) an Indemnification Exception.

c. An indemnified Party shall (i) promptly provide the indemnifying Party with written notice of any claim (provided that delay or failure to so notify the indemnifying Party shall only relieve the indemnifying Party of its obligations to the extent, if at all, that it is prejudiced by reasons of such delay or failure); (ii) allow the indemnifying Party to have sole control of the defense or settlement of the claim, provided, however, the indemnifying Party shall not settle any claim which may have a material adverse impact on the indemnified Party without the prior written consent of the indemnified Party; and (iii) provide the indemnifying Party with reasonable cooperation, assistance, information, and authority necessary to defend the claim at the indemnifying Party’s expense.

LUMELIGHT MAKES NO WARRANTIES, REPRESENTATIONS, OR AGREEMENTS OF ANY KIND, WHETHER EXPRESS, IMPLIED, STATUTORY OR OTHERWISE, WITH RESPECT TO THE SERVICES, AND LUMELIGHT SPECIFICALLY DISCLAIMS AND EXCLUDES, TO THE FULLEST EXTENT PERMITTED BY APPLICABLE LAW, ANY AND ALL IMPLIED WARRANTIES, INCLUDING WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.

a. Limitation of Liability. EXCEPT FOR LIABILITY ARISING FROM A BREACH OF SECTION 9 (CONFIDENTIALITY), A SECURITY INCIDENT, AS DEFINED IN THE HIPAA ADDENDUM, OR A BREACH OF THE HIPAA ADDENDUM, IF APPLICABLE, THE CUMULATIVE, AGGREGATE LIABILITY OF EACH PARTY FOR ALL CLAIMS ARISING OUT OF OR RELATING TO THESE TERMS, ANY ORDER FORM, ANY APPLICABLE HIPAA ADDENDUM, OR THE PROVISION OF THE SERVICES SHALL NOT IN ANY EVENT EXCEED THREE (3) TIMES THE AMOUNT PAID IN FEES BY CLIENT DURING THE TWELVE (12) MONTHS IMMEDIATELY PRECEDING THE EVENT GIVING RISE TO THE LIABILITY CLAIM AT ISSUE. FOR CLAIMS ARISING OUT OF OR RELATED TO A BREACH OF SECTION 9 OR THE HIPAA ADDENDUM, IF APPLICABLE, THE CUMULATIVE AGGREGATE LIABILITY OF EACH PARTY SHALL NOT EXCEED FIVE (5) TIMES THE AMOUNT PAID IN FEES BY CLIENT DURING THE TWELVE (12) MONTHS IMMEDIATELY PRECEDING THE EVENT GIVING RISE TO THE LIABILITY CLAIM AT ISSUE OR $500,000, WHICHEVER IS GREATER.

b. Exclusion of Certain Damages. IN NO EVENT WILL EITHER PARTY BE LIABLE TO THE OTHER FOR ANY INCIDENTAL, INDIRECT, SPECIAL, CONSEQUENTIAL, OR PUNITIVE DAMAGES, LOSSES, COSTS OR EXPENSES OF ANY KIND, HOWEVER CAUSED AND WHETHER BASED IN CONTRACT, TORT (INCLUDING NEGLIGENCE), STRICT LIABILITY OR OTHER LEGAL OR EQUITABLE THEORY, AND INCLUDING DAMAGES FOR INTERRUPTION OF BUSINESS, PROCUREMENT OF SUBSTITUTE GOODS, LOST PROFITS, OR THE LIKE, EVEN IF A PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES, LOSSES, COSTS, OR EXPENSES.

c. THE FOREGOING DISCLAIMERS AND LIMITATIONS DO NOT LIMIT A PARTY’S LIABILITY FOR WILLFUL MISCONDUCT, FRAUD, GROSS NEGLIGENCE, OR A BREACH OF SECTIONS 7(c)-(f).

15. MISCELLANEOUS

a. Notice. All notices under these Terms or any Order Form must be made in writing and properly addressed to a Party at the address set forth on the signature pages appended hereto, and will be deemed effective: (a) when sent by confirmed electronic mail, if sent during the normal business hours of the recipient, or if not so confirmed during normal business hours, on the next business day, (b) on the next business day after delivery to a nationally-recognized overnight courier service, or (c) on the third business day after deposit with the U.S. Mail, postage prepaid, registered mail or certified mail, return receipt requested. Either Party may change its address for notice by giving notice to the other Party in the manner provided herein. A copy of all notices to Lumelight shall be sent to legal@lumelight.com.

b. Relationship of the Parties. Client authorizes and directs Lumelight to perform the Services specified in any applicable Order Form. Lumelight shall not be deemed a fiduciary, plan administrator, or agent of any plan for which it provides Services hereunder nor shall Lumelight be deemed to be the employer or co-employer of Client’s employees for purposes of providing the Services. Lumelight does not, by virtue of these Terms, the HIPAA Addendum, or any Order Form, assume any responsibility or liability for any obligations which by law belong to Client. For the avoidance of doubt, Lumelight will not be responsible for any claims, payments, costs, or expenses under Client’s benefits plans.

c. Assignability. These Terms shall be binding upon and inure to the benefit of the Parties and their respective successors and assigns. Either Party may assign these Terms, without the consent of the other, to any successor entity in connection with a merger, consolidation, reorganization, stock sale, asset sale, or similar transaction involving all or substantially all of such party’s business or assets.

d. No Implied Waiver. No failure or delay by either Party in exercising any right, remedy, power, or privilege under these Terms shall operate as a waiver thereof. No waiver of any provision of these Terms shall be effective unless set forth in writing and signed by an authorized representative of the Party granting the waiver. Any waiver shall apply only to the specific circumstance for which it is given and shall not constitute a waiver of any future rights or remedies.

e. Authority. Each Party represents and warrants that it has full power and authority to enter into these Terms, to perform the duties and obligations of such Party set forth herein and to grant the rights set forth herein.

f. Severability. If any term in these Terms is held by a court of competent jurisdiction to be invalid or unenforceable, then the Terms, including all of the remaining terms, will remain in full force and effect as if such invalid or unenforceable provision had never been included.

g. Governing Law. These Terms shall be governed by the laws of the State of Delaware without regard to its conflicts of laws rules.

h. Arbitration. Any controversy or claim arising out of or relating to these Terms, any Order Form, or any applicable HIPAA Addendum, or the breach thereof that cannot be informally resolved between the parties, shall be settled by arbitration administered by the American Arbitration Association in accordance with its Commercial Arbitration Rules and judgment on the award rendered by the arbitrator(s) may be entered in any court having jurisdiction thereof.

i. No Jury Trial. THE PARTIES HEREBY KNOWINGLY, VOLUNTARILY, AND INTENTIONALLY WAIVE THE RIGHT ANY OF THEM MAY HAVE TO A TRIAL BY JURY IN RESPECT OF ANY LITIGATION OR OTHER ACTION BASED HEREON OR ARISING OUT OF OR RELATING TO THESE TERMS OR ANY ORDER FORM.

j. Publicity. Client acknowledges that Lumelight may use Client’s name, logo, and other identifying marks in Lumelight’s general marketing activities, including in any sales and marketing materials, customer lists, and on Lumelight’s website. Upon Lumelight’s request, Client will also work with Lumelight to issue a press release within ninety (90) days after the Effective Date, announcing the relationship between the Parties. Any press releases by Lumelight that reference Client shall be subject, in all instances, to Client’s prior written approval, which shall not be unreasonably withheld.

k. Force Majeure. If by reason of labor disputes, strikes, lockouts, riots, war, inability to obtain labor or materials, earthquake, fire or other action of the elements, accidents, Internet service provider failures or delays, governmental restrictions, appropriations or other causes beyond the reasonable control of a Party (each, a “Force Majeure Event”), either Party is unable to perform in whole or in part its obligations as set forth in these Terms or any Order Form, excluding any obligations to make payments hereunder, then such Party will be relieved of those obligations to the extent it is so unable to perform, and such inability to perform will not make such Party liable to the other Party. Neither Party will be liable for any losses, injury, delay or damages suffered or incurred by the other Party due to a Force Majeure Event. Client acknowledges that the performance of certain Lumelight obligations may require the cooperation of third parties and outside the control of Lumelight. In the event such third parties fail to cooperate with Lumelight in a manner that reasonably permits Lumelight to perform its obligations, such failures shall be considered as causes beyond the control of Lumelight for the purposes of this Section and shall not be the basis for a determination that Lumelight is in breach of any of its obligations under these Terms or is otherwise liable.

l. Counterparts. These Terms may be executed in one or more counterparts, each of which shall be deemed an original but all of which together will constitute one and the same instrument. Such executions may be transmitted to the parties by electronic transmission and such digital execution shall have the full force and effect of an original signature.

m. Entire Agreement. These Terms, together with any applicable Order Form and HIPAA Addendum, as applicable, constitute the entire agreement between Lumelight and Client with respect to all the subject matter hereof and supersede all prior and contemporaneous understandings and agreements, whether written or oral, regarding such subject matter.

n. Electronic Acceptance. Order Forms and acceptance of these Terms may be executed electronically and shall have the same legal effect as physical signatures.