Contract analysis

I. Executive Summary This memorandum summarizes the findings and recommendations arising from the data privacy impact assessment ("DPIA") of Clearpoint Analytics, Inc.'s ClaimsIQ™ platform, which was completed on April 8, 2024, by Dravello Data Compliance Advisors LLC ("Fenwick DCA"). The purpose of this memorandum is to present the key conclusions of the DPIA in a form suitable for review by Quorum Insurance Holding

II. Scope of the Assessment The DPIA conducted by Fenwick DCA was scoped in coordination with Calderwood & Harkness, Quorum's internal privacy and compliance teams, and Clearpoint's legal and information security personnel. The scope was designed to evaluate the data-privacy implications of Quorum's proposed use of the ClaimsIQ™ platform across all three in-scope subsidiaries, with attention to the specific categorie

1. Personally Identifiable Information (PII). The assessment encompassed PII of policyholders, claimants, and third-party beneficiaries that is processed through the ClaimsIQ™ platform's claims triage, fraud detection, and analytics modules. This PII includes, but is not limited to, names, addresses, dates of birth, Social Security numbers, policy numbers, claim numbers, contact information, financial account informa

2. Protected Health Information (PHI). The assessment specifically addressed PHI arising from Quorum's workers' compensation lines of business. Workers' compensation claims routinely involve the processing of medical records, treatment histories, physician reports, disability assessments, and related health-related data that constitutes PHI within the meaning of the Health Insurance Portability and Accountability Act

3. Adjuster Notes, Internal Claims Narratives, and Investigative Materials. The assessment evaluated the privacy and confidentiality implications of processing unstructured textual data generated by Quorum's claims adjusters and investigators. These materials frequently contain sensitive personal information, legal assessments, and privileged communications, and their ingestion into a third-party platform raises dist

4. Customer Data Outputs and Reports. Fenwick DCA also assessed the data-privacy implications of the outputs and reports generated by the ClaimsIQ™ platform from Quorum's proprietary claims data. These outputs include analytics dashboards, fraud-detection scoring, triage recommendations, and trend analyses that are derived from Quorum's Customer Data and may contain or reflect PII and PHI. Ownership, use restrictions

1. Connecticut Data Privacy Act ("CTDPA"). Effective July 1, 2023, the CTDPA imposes obligations on controllers and processors of Connecticut consumers' personal data, including requirements regarding data processing agreements, consumer rights facilitation, data protection assessments, and processor accountability. As Quorum Property & Casualty Insurance Company is domiciled in Connecticut and processes personal dat

2. Health Insurance Portability and Accountability Act ("HIPAA"). HIPAA is applicable to Quorum's workers' compensation lines of business where PHI is processed through the ClaimsIQ™ platform. Under HIPAA's Privacy Rule and Security Rule, covered entities such as Quorum must ensure that business associates (including SaaS providers that process PHI on behalf of the covered entity) enter into Business Associate Agreem

3. NAIC Insurance Data Security Model Law (Connecticut Adoption). Connecticut has adopted the NAIC Insurance Data Security Model Law, which imposes specific cybersecurity program requirements on insurance licensees and, by extension, requires licensees to exercise due diligence in the oversight of third-party service providers that have access to nonpublic information. The Model Law's requirements regarding risk asse

4. General Insurance Regulatory Data-Handling Requirements. In addition to the foregoing frameworks, Fenwick DCA considered general insurance regulatory requirements applicable to Quorum Property & Casualty Insurance Company as a Connecticut-domiciled insurer and to Quorum Specialty Underwriters, Inc. as a Delaware-domiciled entity, including data-handling and confidentiality obligations arising under applicable insu

III. Summary of Fenwick DCA Findings The following sections summarize the principal findings from the Fenwick DCA assessment report. For a complete discussion of methodologies, evidence reviewed, and detailed recommendations, reference should be made to the full Fenwick DCA assessment report enclosed under separate cover. A. Data Flow Mapping and Classification Fenwick DCA conducted a comprehensive data-mapping exerc

IV. Subprocessor Risk Assessment A critical component of the DPIA was the assessment of risks associated with Clearpoint's use of subprocessors in connection with the ClaimsIQ™ platform. As noted above, Fenwick DCA confirmed that Customer Data flows through two subprocessors: Cobalt Cloud Infrastructure, Inc. (IaaS hosting and storage) and Redline Document AI, LLC (OCR and document processing). Fenwick DCA assessed t

1. Cobalt Cloud Infrastructure, Inc. — Infrastructure-as-a-service (hosting and storage)

2. Redline Document AI, LLC — OCR and document processing No additional subprocessors are currently authorized to process Customer Data under the SaaS Subscription Agreement.

V. Residual Risks Identified Notwithstanding the generally favorable compliance posture of the ClaimsIQ™ platform, Fenwick DCA identified the following residual risks that warranted specific attention and contractual mitigation. Each risk is described below along with the corresponding recommendation and its current status. A. Aggregated Data Use Clearpoint's initial form agreement permitted the unrestricted creation

VI. Recommended Contractual Mitigants Based on the findings and recommendations of the Fenwick DCA assessment, Calderwood & Harkness negotiated comprehensive contractual mitigants to address the identified risks. These mitigants have been incorporated into the following documents: A. Mitigants Incorporated into Exhibit C (Data Processing Addendum) The Data Processing Addendum (Exhibit C to the SaaS Subscription Agree

1. Controller-Processor Designation. Explicit designation of Quorum as data controller and Clearpoint as data processor with respect to all Customer Data processed through the ClaimsIQ™ platform.

2. Customer Data Ownership. Sole and exclusive ownership of all Customer Data is retained by Quorum at all times. Clearpoint acquires no ownership interest in Customer Data by reason of its processing activities under the Agreement.

3. Aggregated Data Restrictions. Aggregated Data derived from Customer Data may be used only for product-improvement purposes; any other use requires Quorum's prior written consent (not to be unreasonably withheld); re-identification is prohibited; and sale of Aggregated Data to third parties is prohibited.

4. Data Portability. Quorum is entitled to a full export of all Customer Data in ACORD XML and CSV formats within sixty (60) days of the expiration or termination of the Agreement, at no additional charge to Quorum.

5. Data Destruction Certification. Clearpoint is required to certify the complete destruction of all Customer Data — including data held by subprocessors — within thirty (30) days of the completion of the data-export period.

6. HIPAA BAA-Equivalent Provisions. The DPA includes provisions satisfying the requirements of the HIPAA Privacy Rule and Security Rule for Business Associate Agreements, addressing the processing of PHI in connection with Quorum's workers' compensation claims. These provisions cover required administrative, physical, and technical safeguards; restrictions on use and disclosure of PHI; breach notification obligations

7. Subprocessor Management Framework. The DPA establishes a subprocessor management framework providing Quorum with thirty (30) day advance written notice of proposed new subprocessors and a corresponding thirty (30) day objection right. If Quorum's objection is not resolved, Quorum may terminate the affected services without penalty.

8. Flow-Down Obligations. Clearpoint is obligated to flow down data-protection requirements to its subprocessors — currently Cobalt Cloud Infrastructure, Inc. and Redline Document AI, LLC — at a level at least as protective as the obligations imposed on Clearpoint under the DPA. Clearpoint remains fully liable for the acts and omissions of its subprocessors.

9. Consumer Rights Support. Clearpoint is obligated to provide reasonable cooperation and technical assistance to support Quorum in responding to CTDPA consumer data-access, deletion, and opt-out requests within applicable statutory timeframes.

10. Restriction on International Data Transfers. Customer Data may not be transferred, processed, or stored outside the continental United States without Quorum's prior written consent.

11. Regulatory Compliance. Clearpoint is required to comply with the CTDPA, HIPAA (with respect to PHI processing), and the NAIC Insurance Data Security Model Law as adopted in Connecticut, to the extent applicable to Clearpoint's data-processing activities under the Agreement. B. Mitigants Incorporated into Exhibit D (Security Requirements) The Security Requirements (Exhibit D to the SaaS Subscription Agreement) inc

1. Annual SOC 2 Type II Audit Report. Clearpoint is required to maintain and deliver an annual SOC 2 Type II audit report, conducted by an independent third-party audit firm (current auditor: Hawthorne & Ellers, CPAs LLP). The report must be delivered to Quorum within ninety (90) days of the close of the applicable audit period. The current report covers the period from April 1, 2023, through March 31, 2024.

2. Annual Penetration Testing. Clearpoint is required to engage an independent third-party firm (current vendor: Sentinel Cyber Solutions LLC) to conduct annual penetration testing of the ClaimsIQ™ platform and its supporting infrastructure. An executive summary of the penetration test results must be shared with Quorum within thirty (30) days of the completion of each test.

3. Breach Notification. Clearpoint is required to provide notification to Quorum within twenty-four (24) hours of confirming a security incident involving Customer Data, consistent with NAIC Model Law expectations and Quorum's internal incident response requirements.

4. Encryption Standards. Clearpoint is required to maintain encryption standards of AES-256 for data at rest and TLS 1.2 or higher for data in transit.

5. Access Controls. Clearpoint is required to implement and maintain role-based access controls and least-privilege principles for all personnel and systems with access to Customer Data.

6. Insurance Requirements. Clearpoint is required to maintain the following insurance coverages, all carried with Northern Ridge Mutual Insurance Company or another carrier reasonably acceptable to Quorum:

7. Written Information Security Program. Clearpoint is required to maintain a written information security program and to make such program available to Quorum upon reasonable request, including in connection with regulatory examinations and compliance assessments.

8. AI Model Documentation. Clearpoint is required to provide documentation of the logic, inputs, and outputs of its AI models used in claims triage and fraud detection, and to cooperate with Quorum's regulatory examinations regarding automated decision-making. C. Mitigants Addressed in Other Agreement Provisions In addition to the mitigants incorporated into the DPA and Security Requirements, the following protection

1. Uncapped Data-Breach Indemnification. Clearpoint's indemnification obligation for data breaches caused by Clearpoint's failure to comply with its data-protection obligations is uncapped, ensuring that Quorum is not limited in its recovery for losses arising from a data-breach event. This is addressed in the indemnification section of the SaaS Subscription Agreement.

2. Liability Caps for Other Claims. For intellectual property and general indemnification claims, the liability cap is set at two times (2×) the total contract value, or Fourteen Million Dollars ($14,000,000). The general liability cap for all other claims is set at one times (1×) the total contract value, or Seven Million Dollars ($7,000,000).

3. Source Code Escrow. As described in Section V.B above, the Technology Escrow Agreement with Granite Trust Company, N.A. provides for the release of the ClaimsIQ™ source code upon the occurrence of specified release conditions, including bankruptcy, cessation of business, or uncured material breach following a sixty (60) day cure period.

4. Change-of-Control Assignment Restrictions. The SaaS Subscription Agreement includes assignment restrictions that specifically address change-of-control scenarios involving Ridgeway Capital Partners, LP and other ownership-change events. Clearpoint may not assign the Agreement or undergo a change of control that would result in a change in the identity of the majority equity holder without Quorum's prior written co

VII. Open Items and Recommendations for Ongoing Monitoring While the contractual mitigants described herein address the residual risks identified in the DPIA, data privacy is an evolving field and the risk environment will continue to change over the term of the SaaS Subscription Agreement. Accordingly, Calderwood & Harkness recommends that Quorum implement the following ongoing monitoring practices:

1. Annual SOC 2 Review. Quorum should conduct annual reviews of Clearpoint's SOC 2 Type II reports and penetration test executive summaries upon receipt, with review to be coordinated between the General Counsel's office, the Chief Information Officer's office, and Quorum's internal audit function. Any qualifications, exceptions, or findings noted in the SOC 2 reports should be escalated for assessment and, where app

2. Subprocessor Monitoring. Quorum should actively monitor subprocessor changes and exercise its objection rights within the thirty (30) day notice period provided in the DPA. Any proposed new subprocessor should be evaluated against Quorum's data-localization, security, and compliance requirements before Quorum provides consent or elects to exercise its objection right.

3. Regulatory Tracking. Quorum's privacy and compliance teams should track evolving CTDPA regulations, HIPAA guidance, and NAIC Model Law amendments for potential contract-update triggers. The CTDPA is a relatively new statute and is likely to be supplemented by implementing regulations, enforcement guidance, and judicial interpretations that may affect the obligations of Quorum and Clearpoint under the DPA. Similarl

4. AI Regulatory Monitoring. Quorum should monitor regulatory developments regarding AI-driven claims processing and algorithmic fairness in insurance, including guidance from the Connecticut Insurance Department, the National Association of Insurance Commissioners, and other relevant regulatory bodies. As noted in Section III.E above, regulatory attention to the use of AI in insurance is increasing, and Quorum shoul

5. Periodic Reassessment. Dravello Data Compliance Advisors LLC remains available for periodic reassessments of the ClaimsIQ™ platform as requested by Quorum. Miriam Tanaka, Principal Consultant, has indicated her willingness to perform annual follow-up reviews to assess changes to the platform architecture, subprocessor landscape, or regulatory environment, and to confirm the continued adequacy of the contractual mi

VIII. Conclusion The Data Privacy Impact Assessment performed by Dravello Data Compliance Advisors LLC confirms that the ClaimsIQ™ platform, as contractually documented in the SaaS Subscription Agreement and its exhibits, presents an acceptable data-privacy risk profile for Quorum's enterprise-wide deployment across its property and casualty and specialty lines subsidiaries. The key residual risks identified in the D