Contract analysis

I. Executive Summary Calderwood & Harkness LLP received Clearpoint Analytics, Inc.'s ("Clearpoint") initial form Enterprise SaaS Subscription Agreement (the "Agreement" or "Form Agreement") on March 11, 2024. The Agreement governs Quorum Insurance Holdings Corp.'s ("Quorum") proposed enterprise-wide deployment of Clearpoint's ClaimsIQ™ platform, an AI-driven claims triage, fraud detection, and analytics solution. The

1. Customer Data Ownership and Portability (Critical)

2. Restrictions on Clearpoint's Use of Aggregated Data (Critical)

3. Indemnification Structure and Caps (Critical)

4. General Liability Cap (High)

5. Service Level Commitments and Chronic Failure Termination (High)

6. Source Code Escrow and Vendor Insolvency Protections (High)

7. Change-of-Control and Assignment Provisions (High)

8. Subprocessor Consent Rights (Moderate)

9. Regulatory Compliance Carve-Outs (CTDPA, HIPAA, NAIC) (Critical) We recommend that this memorandum be circulated promptly to Patricia Okonkwo, Derek Langston (CIO), and Malcolm Tsai (VP of Procurement) for review. Calderwood & Harkness intends to deliver a comprehensive first redline of the Agreement to Clearpoint's outside counsel, Whitfield Greer & Associates LLP, by March 22, 2024, incorporating the negotiation

II. Background A. The Parties Quorum Insurance Holdings Corp. ("Quorum" or the "Company") is a Delaware corporation, publicly traded on the Nasdaq Stock Market under the ticker symbol QIHC. Quorum is headquartered at 280 Constitution Plaza, Suite 1400, Hartford, Connecticut 06103. The Company operates through three principal subsidiaries: (i) Quorum Property & Casualty Insurance Company, a Connecticut-domiciled prope

III. Issue-by-Issue Analysis Issue 1: Customer Data Ownership and Portability Priority: CRITICAL A. Current Form Position. Section 5.1 of Clearpoint's Form Agreement addresses data rights and contains language that, while superficially appearing to vest ownership of Customer Data in Quorum, functionally erodes that ownership through the breadth of the license grant. Specifically: • The Form Agreement provides that "a

1. Ownership. The Agreement must be revised to state unambiguously that Quorum retains sole and exclusive ownership of all Customer Data. The defined term "Customer Data" should be expanded to expressly include: (a) all claims data, including but not limited to claims files, adjuster notes, coverage determinations, and loss reports; (b) all policyholder PII; (c) all PHI; (d) all data uploaded to, processed by, or sto

2. Limited License. Clearpoint's license to Customer Data should be revised to be: (a) limited to the sole purpose of providing the services under the Agreement during the subscription term; (b) non-exclusive and non-transferable; (c) revocable upon termination or expiration of the Agreement for any reason; and (d) not sublicensable except to approved subprocessors in accordance with the DPA. The license must not ext

3. Data Portability. The Form Agreement's data return provisions must be replaced with the following: (a) Upon expiration or termination of the Agreement for any reason, Clearpoint shall, at no additional charge to Quorum, export and deliver to Quorum a complete copy of all Customer Data in industry-standard, machine-readable formats, specifically ACORD XML and CSV, within sixty (60) days of the effective date of exp

4. Destruction and Certification. Within thirty (30) days following completion of the data export, Clearpoint shall permanently destroy all copies of Customer Data in its possession or control (including copies held by subprocessors), using methods consistent with NIST SP 800-88 guidelines. Clearpoint shall deliver to Quorum a written certification of destruction, executed by an officer of Clearpoint at the level of

1. Limited Purpose. Clearpoint may create de-identified, aggregated statistical data ("Aggregated Data") from Customer Data solely for the purpose of improving the ClaimsIQ™ platform's functionality and performance (i.e., product improvement). No other use shall be permitted without Quorum's prior written consent.

2. Three Conditions. Any creation or use of Aggregated Data shall be subject to the following conditions: (i) Regulatory Compliance. Clearpoint's creation and use of Aggregated Data must comply with all applicable insurance data-privacy laws, including without limitation the CTDPA, HIPAA (to the extent PHI is involved), and the NAIC Insurance Data Security Model Law. (ii) Prior Written Consent. Before any use of Aggr

3. De-Identification Standard. Where Customer Data includes PHI, the de-identification process must comply with the HIPAA Safe Harbor method (removal of the eighteen specified identifiers under 45 C.F.R. § 164.514(b)(2)) or the Expert Determination method (45 C.F.R. § 164.514(b)(1)). For all other Customer Data, the de-identification methodology must render it impossible, using reasonably available technology, to re-

4. Survival. The restrictions on Aggregated Data use shall survive termination or expiration of the Agreement in perpetuity. C. Risk Assessment. This issue is designated as Critical for several interrelated reasons: First, competitive intelligence leakage is a significant concern. Clearpoint serves multiple commercial insurers, including, to our knowledge, at least two direct competitors of Quorum in the property and

1. Clearpoint Indemnification Obligations. Clearpoint shall indemnify, defend, and hold harmless Quorum, its affiliates, and their respective officers, directors, employees, and agents (collectively, "Quorum Indemnitees") against any third-party claims, damages, losses, costs, and expenses (including reasonable attorneys' fees) arising from or related to: (a) intellectual Property Infringement. Any claim that Quorum'

2. Quorum Indemnification Obligations. Quorum shall indemnify, defend, and hold harmless Clearpoint, its affiliates, and their respective officers, directors, employees, and agents (collectively, "Clearpoint Indemnitees") against any third-party claims, damages, losses, costs, and expenses (including reasonable attorneys' fees) arising from or related to: (a) Customer Data. Any claim that Customer Data provided by Qu

3. Indemnification Caps. The following cap structure shall apply: (a) intellectual Property and General Indemnification: Subject to an aggregate cap of two times (2×) the TCV, or $14,000,000 ($7,000,000 × 2). (b) Data-Breach Indemnification: Uncapped. This is a non-negotiable position. Given the volume and sensitivity of policyholder PII and PHI that will be processed through the ClaimsIQ™ platform, and given Quorum'

4. Indemnification Procedures. The Agreement shall include the following procedural requirements: (a) Notice. The indemnified party shall provide written notice to the indemnifying party within fifteen (15) business days of becoming aware of any claim for which indemnification is sought. Failure to provide timely notice shall not relieve the indemnifying party of its obligations except to the extent the indemnifying

1. General Aggregate Liability Cap. The general aggregate liability cap for each party should be set at one times (1×) the TCV, or $7,000,000. This cap would apply to all claims arising under the Agreement other than those subject to separate caps or carve-outs as described below.

2. Carve-Outs from the General Liability Cap. The following categories of liability should be excluded from the general liability cap (i.e., they should not count against the $7,000,000 cap): (a) Clearpoint's indemnification obligations for data breach (which should be uncapped, as discussed in Issue 3); (b) Clearpoint's indemnification obligations for intellectual property infringement (which should be subject to th

3. Consequential Damages Exclusion — Carve-Outs. The mutual exclusion of consequential damages should be retained as a general matter but must include carve-outs permitting recovery of consequential damages for: (a) Data breach or unauthorized disclosure of Customer Data; (b) Breach of confidentiality obligations; (c) intellectual property infringement; (d) Willful misconduct or fraud. C. Risk Assessment. The Form Ag

1. Uptime Threshold. The monthly uptime SLA should be raised from 99.5% to 99.7%. This equates to a maximum permitted downtime of approximately 2 hours and 11 minutes per month (in a 30-day month), which is consistent with market standards for mission-critical enterprise SaaS platforms. The exclusion for "third-party services and infrastructure" should be deleted; Clearpoint should bear responsibility for the availab

2. Scheduled Maintenance Window. Scheduled maintenance should be limited to a defined window of up to four (4) hours per month, on Sundays between 2:00 AM and 6:00 AM Eastern Time. Clearpoint must provide at least seventy-two (72) hours' advance notice of any scheduled maintenance. Only maintenance performed within this defined window shall be excluded from the uptime calculation.

3. Service Credits. The service credit structure should be revised as follows: (a) Credit amount: 2% of the applicable monthly subscription fee ($116,667/month) per 0.1% shortfall below 99.7%, resulting in a credit of approximately $2,333 per 0.1% shortfall. (b) Maximum monthly credit: 15% of the monthly subscription fee, or approximately $17,500. (c) Service credits should be applied automatically against the next i

4. Chronic Failure Termination Right. If monthly uptime falls below 99.0% in any three (3) consecutive calendar months, Quorum shall have the right to terminate the Agreement for cause upon thirty (30) days' written notice and shall be entitled to receive a pro-rata refund of all prepaid and unused subscription fees.

5. Reporting. Clearpoint must provide automated monthly uptime reporting to Quorum via a customer-accessible dashboard and email notification, no later than the fifth (5th) business day of each calendar month for the preceding month. For any month in which uptime falls below 99.7%, Clearpoint must provide a written root-cause analysis within ten (10) business days, including a remediation plan with specific timelines

1. Escrow Agent. Granite Trust Company, N.A., located at 300 Main Street, Suite 100, Stamford, Connecticut 06901, shall serve as the escrow agent. Granite Trust is a nationally recognized technology escrow agent with which Calderwood & Harkness has prior experience and a standard form escrow agreement that is well-suited to SaaS deployments.

2. Deposited Materials. The following materials shall be deposited into escrow (collectively, the "Deposited Materials"): (a) Complete source code for the ClaimsIQ™ platform, including all modules, components, and libraries necessary to compile, build, and run the platform; (b) Build scripts, configuration files, and deployment instructions; (c) Complete technical documentation, including architecture diagrams, datab

3. Update Frequency. Clearpoint shall make updated deposits of all Deposited Materials on a quarterly basis, no later than thirty (30) days after the end of each calendar quarter. Each deposit shall reflect the then-current production version of the ClaimsIQ™ platform.

4. Verification. Quorum shall have the right to request that Granite Trust conduct a technical verification of the Deposited Materials (at Quorum's expense) no more than once per year to confirm that the deposit is complete and sufficient to compile and operate the platform.

5. Release Conditions. The escrow agent shall release the Deposited Materials to Quorum upon the occurrence of any of the following events (each, a "Release Event"): (a) Clearpoint files a voluntary petition for relief under the United States Bankruptcy Code (Title 11) or any similar proceeding under applicable law; (b) An involuntary petition for relief is filed against Clearpoint under the United States Bankruptcy

6. Post-Release License. Upon a Release Event, Quorum shall automatically receive a non-exclusive, irrevocable, fully paid-up license to use, copy, modify, and create derivative works from the Deposited Materials solely for the purpose of continuing Quorum's internal business operations previously supported by the ClaimsIQ™ platform. This license shall survive any termination or rejection of the SaaS Subscription Agr

7. Escrow Fee. The annual escrow fee of $4,500 shall be split equally between the parties ($2,250 per party per year). C. Risk Assessment. Clearpoint is a privately held, growth-stage technology company. While its financial profile — $78 million ARR, 320 employees, and the backing of a well-regarded growth-equity firm in Ridgeway Capital Partners — suggests reasonable near-term financial stability, the risk of vendor

1. Anti-Assignment. Neither party may assign, delegate, or otherwise transfer the Agreement or any rights or obligations thereunder without the other party's prior written consent, which shall not be unreasonably withheld, conditioned, or delayed; provided, however, that: (a) Quorum may assign the Agreement without Clearpoint's consent to (i) any affiliate of Quorum, (ii) any successor entity in connection with a mer

2. Change-of-Control Trigger. If Clearpoint undergoes a Change of Control (as defined below), Quorum shall have the right, exercisable in its sole discretion, to terminate the Agreement upon ninety (90) days' written notice without penalty, early termination fee, or other liability, and shall be entitled to receive a pro-rata refund of all prepaid and unused subscription fees.

3. Definition of "Change of Control." For purposes of this provision, "Change of Control" means any of the following: (a) Any transaction or series of related transactions resulting in a change of more than fifty percent (50%) of the voting power or equity interests of Clearpoint; (b) A merger, consolidation, or similar business combination in which Clearpoint is not the surviving entity, or in which Clearpoint is th

4. Notice. Clearpoint shall provide Quorum with written notice of any Change of Control no later than thirty (30) days prior to the closing of such transaction. Quorum's termination right shall be exercisable within one hundred twenty (120) days following receipt of such notice or, if no notice is provided, within one hundred twenty (120) days following the date on which Quorum becomes aware of the Change of Control.

1. Subprocessor List. Clearpoint must maintain a current and complete list of all subprocessors, including the name, address, and description of services provided by each subprocessor. This list must be formally disclosed as part of the DPA (Exhibit C) and updated upon any change.

2. Advance Notice. Clearpoint must provide Quorum at least thirty (30) days' advance written notice before engaging any new subprocessor or before materially changing the role, scope of services, or data access of an existing subprocessor. Such notice shall identify the proposed subprocessor, describe the services to be performed, identify the categories of Customer Data to which the subprocessor will have access, an

3. Objection Right. Quorum shall have the right to object to any proposed new subprocessor within the thirty (30)-day notice period on reasonable grounds related to data security, data privacy, regulatory compliance, or the subprocessor's financial stability or reputation. If Quorum objects: (a) The parties shall engage in good-faith discussions for a period of fifteen (15) business days to attempt to resolve the obj

4. Subprocessor Liability. The Agreement shall expressly state that Clearpoint remains fully liable for the acts and omissions of its subprocessors as if such acts and omissions were performed by Clearpoint itself. Clearpoint's engagement of a subprocessor shall not relieve Clearpoint of any of its obligations under the Agreement or the DPA.

5. Flow-Down Obligations. Clearpoint shall ensure that each subprocessor is bound by written agreements imposing data-protection obligations at least as protective as those in the DPA, including obligations related to data security, confidentiality, data minimization, and incident notification. C. Risk Assessment. Quorum's Customer Data — including policyholder PII and PHI — will flow through Clearpoint's subprocesso

1. Connecticut Data Privacy Act (CTDPA). The DPA must be revised to reflect Clearpoint's obligations as a "processor" under the CTDPA (Conn. Gen. Stat. § 42-520 et seq.), including: (a) Data Minimization: Clearpoint shall process Customer Data only as necessary to perform its obligations under the Agreement and shall not process Customer Data for any purpose not expressly authorized by Quorum. (b) Purpose Limitation:

2. HIPAA. To the extent that Clearpoint processes PHI in connection with Quorum's workers' compensation lines (and potentially other lines of business involving health-related claims), a Business Associate Agreement (BAA) must be incorporated into or referenced by the Agreement. The BAA must include, at minimum: (a) A description of the permitted uses and disclosures of PHI by Clearpoint, limited to those necessary t

3. NAIC Insurance Data Security Model Law (as adopted in Connecticut). The Agreement and DPA must address Clearpoint's obligations under Connecticut's version of the NAIC Insurance Data Security Model Law (Conn. Gen. Stat. § 38a-38 et seq.), including: (a) Information Security Program: Clearpoint must maintain a comprehensive written information security program that is consis