Contract analysis

I. Executive Summary The purpose of this memorandum is to summarize the findings of our intellectual property ("IP") and data privacy due diligence review of MedVance Health Systems, Inc. ("MedVance" or the "Company"), conducted in connection with the proposed acquisition of the Company (the "Transaction") by Ardent Healthcare Holdings Inc. (the "Purchaser"), a newly formed acquisition vehicle of Ardent Capital Partn

II. Scope and Methodology Documents and Materials Reviewed Our diligence review encompassed materials made available in the Company's virtual data room (hosted on Thackeray Solutions, Project "Pinnacle Investors"), organized under the following data room categories: • IP Registrations and Prosecution Files: Trademark registration certificates, renewal filings, prosecution history, and trademark search reports. • Lice

III. Intellectual Property — Registered Rights A. Patents. MedVance owns no issued U.S. patents. Our search of the USPTO PatFT database returned no results for MedVance Health Systems, Inc. as an assignee or applicant. The Company has no pending patent applications with the USPTO or with any foreign patent office. We also reviewed the data room for any patent assignment agreements from founders, executives, or employ

1. MedVance® • Registration No.: 4,892,317 • International Class: Class 44 (Medical services; healthcare services; medical clinic services) • Filing Date: March 14, 2014 • Registration Date: November 3, 2015 • Status: Active; Section 8 Declaration of Continued Use and Section 9 Application for Renewal filed and accepted (renewal effective November 3, 2025) • Next Renewal Deadline: November 3, 2035

2. MedVance Wellness® • Registration No.: 5,214,608 • International Class: Class 44 (Preventive healthcare services; wellness programs; health screening services) • Filing Date: June 22, 2016 • Registration Date: May 16, 2017 • Status: Active; Section 8 Declaration of Continued Use filed and accepted • Next Renewal Deadline: May 16, 2027

3. QuickCare by MedVance® • Registration No.: 5,987,412 • International Classes: Class 44 (Urgent care medical services; walk-in clinic services) and Class 35 (Online scheduling of medical appointments) • Filing Date: September 8, 2019 • Registration Date: August 25, 2020 • Status: Active; Section 8 Declaration of Continued Use due between August 25, 2025, and August 25, 2026 (with six-month grace period) • Next Rene

IV. Intellectual Property — Licenses and Third-Party Agreements A. Vertex Health Technologies Inc. — Master Services Agreement Key Agreement. The single most significant IP-related contract in the Company's portfolio is the Master Services Agreement ("MSA") between MedVance Health Systems, Inc. and Vertex Health Technologies Inc. ("Vertex Health Tech"), originally dated March 1, 2018, as amended by the First Amendmen

V. IT Infrastructure and Systems MedVance operates a primarily cloud-based IT environment, with the Vertex Health Tech platform serving as the backbone of both clinical and administrative operations. All EHR, practice management, patient scheduling, and revenue cycle management functions are hosted by Vertex Health Tech in its SOC 2 Type II-certified data centers. This cloud-centric architecture reduces the Company's

VI. Data Privacy and Security — HIPAA Compliance A. HIPAA Compliance Program Overview MedVance maintains a formal HIPAA compliance program that addresses the requirements of the HIPAA Privacy Rule (45 C.F.R. Part 160 and Subparts A and E of Part 164), the HIPAA Security Rule (45 C.F.R. Part 160 and Subparts A and C of Part 164), and the HIPAA Breach Notification Rule (45 C.F.R. Part 160 and Subpart D of Part 164), as

1. March 2022: A misdirected fax containing PHI for 3 patients was sent to an incorrect recipient. The recipient confirmed destruction of the fax. Risk assessment determined low probability of compromise; individual notification provided as a precautionary measure.

2. August 2022: A laptop belonging to a traveling nurse practitioner was stolen from a vehicle. The laptop was encrypted (full-disk encryption via BitLocker), and the risk assessment determined that the encryption rendered the PHI unsecured, meaning no breach notification was required under the safe harbor provision of 45 C.F.R. § 164.402(2). The incident was documented internally.

3. May 2023: A mailing vendor error resulted in 12 patients receiving explanation of benefits summaries intended for other patients. Individual notification was provided to all 12 affected patients. The incident was documented, and the mailing vendor's processes were reviewed and corrective actions implemented.

4. November 2024: A phishing email was received by an employee who briefly clicked the link before recognizing it as suspicious and reporting it to IT. The Company's endpoint protection system blocked the malicious payload. Investigation determined that no ePHI was accessed or exfiltrated. The incident was documented as a near-miss and additional phishing awareness training was conducted. All four incidents were mana

VII. Payor Data and Contractual Privacy Obligations MedVance's major payor agreements contain data handling and confidentiality obligations that supplement the Company's HIPAA compliance obligations. We reviewed the data privacy provisions in the following agreements: • BlueLine Health Plan of Tennessee (Participating Provider Agreement, effective January 1, 2023): Section 9.4 of the BlueLine agreement contains data

VIII. Employee and Contractor IP and Confidentiality Provisions We reviewed the Company's standard form employment agreement, offer letter template, employee handbook, and a sample of executed agreements from the data room to assess the adequacy of IP assignment and confidentiality provisions. Standard Provisions. The Company's standard form employment agreement includes the following provisions: • IP Assignment (Wor

IX. Pending or Threatened IP and Privacy Disputes Based on our review of the data room materials, management interviews, and public searches, we have identified no pending litigation, threatened claims, or outstanding disputes relating to: • Trademark infringement, patent infringement, trade secret misappropriation, or IP ownership disputes involving MedVance as either plaintiff or defendant. • Data privacy violation

X. Risk Items and Recommendations A. Items for Pre-Closing Resolution Based on our diligence review, we identify the following items that should be resolved prior to the closing of the Transaction:

1. Vertex Health Tech Change-of-Control Consent. The Vertex MSA requires the prior written consent of Vertex Health Tech in connection with any Change of Control of MedVance. Because the proposed Transaction constitutes a Change of Control as defined in the agreement, formal written consent must be obtained from Vertex Health Tech prior to closing. We recommend that this consent be delivered as a closing condition, c

2. Trademark Registration Ownership Continuity. The Purchaser should confirm that the three USPTO trademark registrations (Reg. Nos. 4,892,317; 5,214,608; and 5,987,412) will be properly maintained following the closing. Under a stock purchase structure, the registrations should remain in the name of MedVance Health Systems, Inc. as the surviving entity. The SPA should include representations confirming the validity

3. Cyber Insurance Policy — Change of Control. The Northbridge cyber liability insurance policy (Policy No. NSI-CYBER-2024-07732) contains a change-of-control provision that could result in termination of coverage upon consummation of the Transaction. The Purchaser should either (i) provide notice to Northbridge and obtain written confirmation that the policy will continue in effect post-closing, or (ii) ensure that

1. Trade Secret Identification and Protection Program. The Company does not currently maintain a formal trade secret registry or structured protection program. We recommend that the Purchaser implement a trade secret identification and protection program that includes: (i) cataloging key items of proprietary and confidential business information; (ii) implementing appropriate access restrictions, marking protocols, a

2. Employee IP Assignment Agreement Gaps. The Purchaser should close the identified gaps in employee IP assignment agreement coverage. Specifically, updated IP assignment agreements should be obtained from (i) three IT department employees, (ii) seven senior clinical staff members operating under older agreements, and (iii) two independent contractors operating under agreements lacking IP assignment provisions. We re

3. BAA Inventory Update. The Purchaser should update and re-execute the following BAAs: (i) the BAA with Harborline Technologies (now Penrose Holdings), which has not been updated since March 2020 and should be re-executed to reflect the current entity structure and any revised security commitments following the February 2024 data breach incident; and (ii) two BAAs with minor vendors (medical courier service and answ

4. Post-Closing HIPAA Security Risk Assessment. We recommend that the Purchaser conduct a fresh HIPAA Security Risk Assessment within 90 days post-closing. This assessment should account for any changes to the Company's IT environment, organizational structure, or data flows resulting from the Transaction and any post-closing integration activities. The assessment should also confirm the status and completion of the