Contract analysis

Section 1.1 — Defined Terms As used in this Agreement, the following terms shall have the meanings set forth below: "Affiliate" means, with respect to any Person, any other Person that directly or indirectly controls, is controlled by, or is under common control with such Person. For purposes of this definition, "control" (including the terms "controlled by" and "under common control with") means the direct or indire

Section 1.2 — Rules of Construction In this Agreement, unless the context otherwise requires: (a) The headings and captions of Articles, Sections, and sub-Sections are inserted for convenience of reference only and shall not affect the meaning, interpretation, or construction of this Agreement. (b) Words importing the singular shall include the plural and vice versa, and words importing a specific gender shall includ

Section 2.1 — License Grant Subject to the terms and conditions of this Agreement, including Quorum's timely payment of all fees due hereunder and compliance with all restrictions and obligations set forth herein, Meridian hereby grants to Quorum a non-exclusive, non-transferable (except as expressly provided in Section 15.4), limited license during the Term to access, receive, store, and use the Licensed Data solely

Section 2.2 — Reserved Rights Meridian expressly reserves all rights in and to the Licensed Data, the Licensed Data Products, and the Licensor IP not expressly granted to Quorum in this Agreement. No implied licenses are granted by Meridian under this Agreement, whether by estoppel, implication, exhaustion, or otherwise. Without limiting the generality of the foregoing, nothing in this Agreement shall be construed to

Section 2.3 — Authorized Purpose As used in this Agreement, "Authorized Purpose" means the internal use of Licensed Data by Quorum and its Affiliates solely for the following purposes: (a) automated underwriting and risk assessment in connection with the issuance, renewal, modification, and pricing of insurance policies; (b) claims-fraud detection, investigation, and prevention in connection with insurance claims sub

Section 2.4 — Restrictions on Use Without limiting the generality of the Authorized Purpose or any other restriction set forth in this Agreement, Quorum shall not, and shall ensure that its Affiliates and Authorized Users do not: (a) reverse-engineer, decompile, disassemble, or otherwise attempt to derive the source code, algorithms, data structures, or proprietary methodologies underlying the Licensed Data Products

Section 2.6 — Affiliate Access Quorum may permit its Affiliates to access and use Licensed Data solely for the Authorized Purpose; provided, however, that: (a) Quorum shall remain fully responsible and liable for each Affiliate's compliance with all terms and conditions of this Agreement, including all restrictions on use, data security obligations, and confidentiality obligations, and any act or omission of an Affil

ARTICLE III — DATA DELIVERY AND INTEGRATION

Section 3.1 — Data Products and Specifications The Licensed Data Products, record volumes, refresh frequencies, and delivery methods are described in detail in Technical Schedule A attached hereto and incorporated herein by reference. A summary of the Licensed Data Products is set forth below: The record volumes set forth in this Section 3.1 and in Technical Schedule A are approximate and are subject to normal fluctu

Section 3.2 — Implementation Period The Implementation Period shall commence on the Effective Date and continue for a period of six (6) months. During the Implementation Period, Meridian shall use commercially reasonable efforts to configure data feeds, provide technical documentation, make available technical support resources, and provide such other technical assistance as is reasonably necessary to enable Quorum t

Section 3.3 — Delivery Methods Licensed Data shall be delivered to Quorum through the following delivery methods, as further specified in Technical Schedule A: (a) Batch Delivery. Meridian shall deliver Licensed Data via SFTP batch delivery in accordance with the file formats, naming conventions, encryption requirements, delivery windows, and retry procedures set forth in Technical Schedule A. All Batch Delivery file

Section 3.4 — Data Quality Meridian shall deliver Licensed Data that meets the accuracy, completeness, timeliness, and data-quality standards set forth in Technical Schedule A. Meridian does not warrant that the Licensed Data is, or will be, error-free, but Meridian warrants that it will use commercially reasonable efforts to maintain the quality and integrity of the Licensed Data consistent with industry-standard cr

Section 3.5 — Changes to Data Products Meridian reserves the right to modify, enhance, update, supplement, or discontinue any Licensed Data Product upon not less than one hundred eighty (180) days' prior written notice to Quorum; provided, however, that any such modification, enhancement, update, or supplement shall not materially diminish the scope, content, or quality of the affected Licensed Data Product below ind

ARTICLE IV — REGULATORY COMPLIANCE

Section 4.1 — FCRA Compliance Quorum acknowledges and agrees that certain Licensed Data, including Consumer Credit Data delivered under the MCI Consumer Credit File™ product, constitutes "consumer reports" or "consumer report information" as defined under the FCRA. Quorum shall access and use such Consumer Credit Data only for permissible purposes under the FCRA and in strict compliance with all requirements of the F

Section 4.2 — GLBA Compliance Each Party shall comply with all applicable provisions of the GLBA, including Regulation P (12 CFR Part 1016) and the FTC Safeguards Rule (16 CFR Part 314), with respect to the nonpublic personal information of consumers received, processed, or maintained under or in connection with this Agreement. Without limiting the foregoing, each Party shall implement and maintain appropriate admini

Section 4.3 — State Privacy Laws (CCPA/CPRA) Each Party shall comply with the California Consumer Privacy Act of 2018, as amended by the California Privacy Rights Act of 2020 (collectively, the "CCPA/CPRA"), and all other applicable state privacy laws, with respect to the personal information of consumers received, processed, or maintained under or in connection with this Agreement. The Data Processing Agreement atta

Section 4.4 — State Insurance Regulations Quorum shall comply with all applicable state insurance data-security regulations governing the receipt, storage, processing, use, and protection of consumer and commercial data by insurance licensees, including without limitation: (a) the Connecticut Insurance Data Security Law (Connecticut General Statutes § 38a-38 et seq.); (b) the New York Department of Financial Services

Section 4.5 — Permissible Purpose Certification Prior to the first delivery of Consumer Credit Data under this Agreement, Quorum shall deliver to Meridian a duly executed FCRA Permissible Purpose Certification in the form of Exhibit A attached hereto, certifying the specific permissible purpose(s) for which Consumer Credit Data will be accessed and used by Quorum. The FCRA Permissible Purpose Certification shall be e

Section 4.6 — Regulatory Cooperation Each Party shall cooperate in good faith with the other Party to respond to regulatory inquiries, examinations, audits, investigations, or enforcement actions by any governmental or regulatory authority that relate to the Licensed Data, the Licensed Data Products, or the Parties' activities under this Agreement. Such cooperation shall include, without limitation, providing reasona

Section 5.1 — License Fees In consideration of the license granted herein and the rights and obligations of the Parties under this Agreement, Quorum shall pay to Meridian the following License Fees during the Term: (a) Year 1 (months 1 through 12 of the Term, commencing on the Effective Date): Ten Million Eight Hundred Thousand Dollars ($10,800,000) per annum (equivalent to Nine Hundred Thousand Dollars ($900,000) pe

Section 5.2 — Volume Tiers and Overage Fees The License Fees set forth in Section 5.1 include a base volume tier (the "Volume Tier") of up to five hundred million (500,000,000) Records per month, measured as the aggregate of consumer and commercial Records across all Licensed Data Products. In the event that Quorum's aggregate monthly Record volume exceeds five hundred million (500,000,000) Records in any calendar mo

Section 5.3 — Implementation Fee In addition to the License Fees set forth in Section 5.1, Quorum shall pay to Meridian a one-time implementation and integration fee of One Million Five Hundred Thousand Dollars ($1,500,000) (the "Implementation Fee"). The Implementation Fee shall be due and payable within thirty (30) days of the Effective Date. The Implementation Fee is separate from, and in addition to, the Sixty Mi

Section 5.4 — Payment Terms License Fees shall be payable quarterly in advance as follows: (a) Year 1 Quarterly Installments: Two Million Seven Hundred Thousand Dollars ($2,700,000) per quarter ($10,800,000 ÷ 4 = $2,700,000) (each, a "Quarterly Installment"). (b) Years 2 through 5 Quarterly Installments: Three Million Seventy-Five Thousand Dollars ($3,075,000) per quarter ($12,300,000 ÷ 4 = $3,075,000) for each quart

Section 5.5 — Late Payment Any amount owed by Quorum under this Agreement that is not paid when due shall bear interest at a rate of , calculated as simple interest on the overdue amount, from the date such amount was originally due until the date such amount is paid in full. The imposition of interest on overdue amounts under this Section 5.5 shall not limit Meridian's rights or remedies with respect to Quorum's fai

Section 5.6 — Taxes All License Fees, Overage Fees, Implementation Fees, and other amounts payable by Quorum under this Agreement are exclusive of any and all applicable sales, use, value-added, goods and services, excise, withholding, or similar taxes, duties, or governmental charges (collectively, "Taxes"). Quorum shall be responsible for, and shall pay, all such Taxes arising in connection with this Agreement, exc

Section 6.1 — Definition of Confidential Information "Confidential Information" means all non-public, confidential, or proprietary information disclosed by either Party (the "Disclosing Party") to the other Party (the "Receiving Party") in connection with this Agreement, whether disclosed in writing, orally, electronically, visually, or by any other means, and whether or not marked or designated as "confidential" or

Section 6.2 — Obligations Each Party, as a Receiving Party, shall: (a) hold the Disclosing Party's Confidential Information in strict confidence; (b) not disclose any Confidential Information of the Disclosing Party to any third party except as expressly permitted under this Article VI; (c) use the Disclosing Party's Confidential Information only for the purposes of exercising its rights or performing its obligations

Section 6.3 — Permitted Disclosures Notwithstanding the restrictions set forth in Section 6.2, the Receiving Party may disclose Confidential Information of the Disclosing Party: (a) to Authorized Users and the Receiving Party's officers, directors, and employees who have a need to know such Confidential Information for the purposes of this Agreement and who are bound by confidentiality obligations no less restrictive

Section 6.4 — Relationship to NDA This Agreement supersedes the Mutual Non-Disclosure Agreement between the Parties dated August 15, 2022 (Reference No. NDA-QIH-MCI-2022-001) (the "Prior NDA") with respect to the subject matter hereof; provided, however, that the Prior NDA shall continue in effect with respect to Confidential Information exchanged between the Parties prior to the Effective Date to the extent such inf

Section 6.5 — Residuals Notwithstanding anything to the contrary in this Article VI, neither Party shall have any obligation under this Article VI with respect to any information that is retained in the unaided memory of its personnel who had rightful access to Confidential Information in the course of performing their duties under or in connection with this Agreement; provided, however, that this Section 6.5 shall n

ARTICLE VII — INTELLECTUAL PROPERTY; DERIVED DATA

Section 7.1 — Licensor IP Ownership As between the Parties, Meridian retains all right, title, and interest in and to the Licensor IP, including without limitation all intellectual Property rights in and to the Licensed Data, the Licensed Data Products, Meridian's databases, data compilation and aggregation systems, data processing platforms, algorithms, scoring models, analytical methodologies, predictive models, tr

Section 7.2 — Derived Data Ownership

Section 7.3 — Restrictions on Derived Data

Section 7.5 — Feedback To the extent Quorum provides Meridian with any suggestions, enhancement requests, recommendations, ideas, concepts, techniques, comments, corrections, or other feedback regarding the Licensed Data, the Licensed Data Products, Meridian's systems, or Meridian's services (collectively, "Feedback"), Quorum hereby irrevocably assigns to Meridian all right, title, and interest in and to such Feedbac

Section 7.6 — Machine-Learning Models

Section 7.7 — No Implied Rights Except as expressly set forth in this Article VII, no rights or licenses in any intellectual Property are granted by either Party to the other, whether by implication, estoppel, exhaustion, or otherwise. All rights not expressly granted herein are reserved by the respective Party.

Section 8.1 — Security Standards Each Party shall implement and maintain a comprehensive information security program that includes administrative, technical, and physical safeguards designed to protect Licensed Data (and all copies, extracts, and derivatives thereof) against unauthorized access, use, disclosure, alteration, destruction, loss, or theft. Each Party's information security program shall be consistent wi

Section 8.2 — Data Security Addendum The Parties' detailed data security obligations, including specific technical requirements, organizational measures, security controls, testing requirements, and incident response procedures, are set forth in the Data Security Addendum attached hereto as Exhibit C, which is incorporated herein by reference as if fully set forth herein. In the event of any conflict between the prov

Section 8.3 — Encryption All Licensed Data shall be encrypted at all times while in Quorum's possession, custody, or control, as follows: (a) In Transit: Licensed Data shall be encrypted in transit using Transport Layer Security (TLS) protocol version 1.2 or higher, or such successor encryption standard as may be mutually agreed upon by the Parties. (b) At Rest: Licensed Data shall be encrypted at rest using Advanced

Section 8.4 — Access Controls Quorum shall implement and maintain role-based access controls (RBAC) limiting access to Licensed Data to Authorized Users on a least-privilege basis. Quorum shall maintain detailed access logs recording all access to, queries of, downloads of, and modifications to Licensed Data, including the identity of the user, the date and time of access, and the nature of the access. Such access lo

Section 8.5 — Data Breach Notification "Data Breach" means any (a) unauthorized access to, acquisition of, use of, or disclosure of Licensed Data, (b) security incident that compromises the confidentiality, integrity, or availability of Licensed Data or any systems on which Licensed Data is stored or processed, or (c) any event or circumstance that constitutes a "breach" or "security incident" requiring notification

Section 8.6 — Audit Rights Meridian shall have the right, upon not less than thirty (30) days' prior written notice to Quorum (and at Meridian's expense, unless the audit reveals a material non-compliance, in which case the cost shall be borne by Quorum), and no more than once per calendar year, to audit Quorum's compliance with the data security requirements of this Agreement and the Data Security Addendum, includin

ARTICLE IX — REPRESENTATIONS AND WARRANTIES

Section 9.1 — Mutual Representations and Warranties Each Party represents and warrants to the other Party as of the Effective Date that: (a) it is duly organized, validly existing, and in good standing under the laws of its jurisdiction of organization, and is duly qualified to do business in each jurisdiction in which the nature of its business or the ownership of its properties requires such qualification; (b) it h

Section 9.2 — Meridian's Representations and Warranties Meridian further represents and warrants to Quorum as of the Effective Date that: (a) Meridian has all necessary rights, licenses, consents, and authorizations to grant the license set forth in Article II and to deliver the Licensed Data to Quorum as contemplated by this Agreement; (b) the Licensed Data has been compiled, maintained, and is delivered in complian

Section 9.3 — Quorum's Representations and Warranties Quorum further represents and warrants to Meridian as of the Effective Date that: (a) Quorum has a permissible purpose under the FCRA for accessing Consumer Credit Data as described in Section 4.1 and the FCRA Permissible Purpose Certification to be executed and delivered in accordance with Section 4.5; (b) Quorum will use the Licensed Data solely for the Authoriz

Section 9.4 — Disclaimer EXCEPT AS EXPRESSLY SET FORTH IN THIS ARTICLE IX, THE LICENSED DATA AND LICENSED DATA PRODUCTS ARE PROVIDED "AS IS" AND "AS AVAILABLE," AND MERIDIAN MAKES NO REPRESENTATIONS OR WARRANTIES OF ANY KIND, WHETHER EXPRESS, IMPLIED, STATUTORY, OR OTHERWISE, INCLUDING WITHOUT LIMITATION ANY WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, ACCURACY, COMPLETENESS, RELIABILITY, TIMELINE

Section 10.1 — Indemnification by Meridian Meridian shall defend, indemnify, and hold harmless Quorum and its Affiliates, and their respective officers, directors, employees, agents, successors, and permitted assigns (collectively, the "Quorum Indemnitees") from and against any and all third-party claims, demands, actions, suits, proceedings, losses, damages, liabilities, costs, and expenses (including reasonable att

Section 10.2 — Indemnification by Quorum Quorum shall defend, indemnify, and hold harmless Meridian and its Affiliates, and their respective officers, directors, employees, agents, successors, and permitted assigns (collectively, the "Meridian Indemnitees") from and against any and all Losses arising from or relating to: (a) any material breach by Quorum of any representation or warranty made by Quorum in this Agreem

Section 10.3 — Indemnification Procedures A Party seeking indemnification under this Article X (the "Indemnified Party") shall: (a) promptly notify the indemnifying Party (the "Indemnifying Party") in writing of any claim, demand, action, or proceeding for which indemnification is sought; provided, however, that the failure to provide prompt notice shall not relieve the Indemnifying Party of its indemnification oblig