Contract analysis

From: Kevin Ostrowski <kostrowski@calderwoodharkness.com> To: Catherine Langford <clangford@mercerhaight.com> Cc: Alan Burke <aburke@calderwoodharkness.com> Date: Fri, 27 Oct 2023 04:47:00 -0000 Subject: Executed Counterparts — Settlement Agreement and Mutual Release; MSA Amendment No. 3

Attached please find Quorum Insurance Holdings Corp.'s fully executed counterparts of the following:

1. Settlement Agreement and Mutual Release between Quorum Insurance Holdings Corp. and Palomar Data Solutions, Inc., dated October 27, 2023; and

2. Amendment No. 3 to the Master Services Agreement dated November 12, 2019 (as amended by Amendment No. 1 dated March 3, 2021, and Amendment No. 2 dated September 15, 2022), dated October 27, 2023.

I would appreciate it if you could transmit Palomar's executed counterparts at your earliest convenience so that both parties hold fully executed originals.

For the record, the principal terms reflected in the executed documents are as follows:

(a) **Cash Payment.** Palomar to pay Quorum $4,200,000 within thirty (30) days of execution (i.e., on or before November 26, 2023). Wire transfer instructions were provided under separate cover to Derek Copeland.

(b) **Fee Reduction.** An eighteen (18)-month fee reduction of 8% applied to the current annual contract value of $16,300,000, effective November 1, 2023, representing $1,956,000 in aggregate fee savings over the eighteen-month period.

(c) **Independent Security Assessment.** Palomar to engage an independent third-party security assessor, at Palomar's sole expense, to conduct enhanced annual security audits, with the first assessment to be completed within 120 days of execution.

(d) **Enhanced Patch Management and Endpoint Detection.** Palomar to implement enhanced patch management protocols (critical patches deployed within 14 days of availability) and deploy endpoint detection and response capabilities within 90 days of execution.

(e) **Enhanced Incident Notification.** Notification window reduced from 48 hours to 24 hours under the amended MSA.

(f) **Mutual Release.** Mutual release of all claims arising from or related to the data security incident, as defined in the Settlement Agreement.

As you will note, Amendment No. 3 incorporates the enhanced data security, audit, and fee reduction provisions referenced above into the operative MSA. The amended terms will govern the remaining term of the MSA through its expiration on November 11, 2024, and any renewal period thereafter.

On the administrative side, please confirm receipt of the attached executed documents at your convenience. Quorum's accounts payable team (copying Thomas Whitfield here) will coordinate directly with Palomar's finance department regarding invoicing adjustments to reflect the 8% fee reduction beginning with the November billing cycle.

I want to express my appreciation for the constructive engagement throughout this negotiation process. Both sides worked diligently toward a resolution that addresses the underlying concerns while preserving the ongoing commercial relationship, and I believe the executed documents reflect that shared objective.

Please do not hesitate to reach out if you have any questions. I remain available to discuss.

**Kevin Ostrowski** Partner, Privacy & Data Security Calderwood & Harkness LLP 1700 K Street NW, Suite 900 Washington, D.C. 20006 T: (202) 555-4180 E: kostrowski@calderwoodharkness.com

*CONFIDENTIALITY NOTICE: This email message, including any attachments, is for the sole use of the intended recipient(s) and may contain information that is privileged, confidential, and exempt from disclosure under applicable law, including attorney-client privilege and attorney work product. If you are not the intended recipient, you are hereby notified that any dissemination, distribution, copying, or other use of