Contract analysis

ARTICLE 1: DEFINITIONS For purposes of this Addendum, the following terms shall have the meanings set forth below. Capitalized terms used but not otherwise defined in this Addendum shall have the meanings ascribed to them in the Engagement Letter or the WET OGG, as applicable. 1.1 "Authorized Personnel" means those C&H attorneys, paralegals, and professional staff who have been assigned to Matter No. 1040-00001 and w

ARTICLE 2: PURPOSE AND SCOPE 2.1 Purpose. This Addendum establishes the obligations, standards, and procedures governing C&H's handling of Protected Data received from or on behalf of WET during the course of the engagement under the Engagement Letter. The purpose of this Addendum is to ensure that all Protected Data is handled, stored, transmitted, and ultimately returned or destroyed in compliance with FERPA, appli

ARTICLE 3: FERPA COMPLIANCE OBLIGATIONS 3.1 Designated Representative Status. For purposes of FERPA compliance in connection with the legal services described in the Engagement Letter, C&H shall be deemed a "school official" with a "legitimate educational interest" in the Education Records disclosed to it by WET, or, in the alternative, an authorized representative of WET designated to receive Education Records under

ARTICLE 4: ACCESS CONTROLS 4.1 Principle of Least Privilege. Access to Protected Data shall be limited to Authorized Personnel on a strict need-to-know basis. C&H shall grant access to Protected Data only to those individuals who require such access in order to perform their assigned responsibilities in connection with the Matter, and only to the extent necessary for the performance of such responsibilities. C&H shal

ARTICLE 5: ENCRYPTION AND TECHNICAL SECURITY REQUIREMENTS 5.1 Encryption at Rest. All Protected Data stored electronically on C&H systems, including on file servers, databases, document management systems, backup media, and portable storage devices, shall be encrypted using the Advanced Encryption Standard with a key length of 256 bits (AES-256), or an equivalent or stronger encryption standard as may be approved by

ARTICLE 6: PERSONNEL TRAINING AND AWARENESS 6.1 Data Protection Training. All Authorized Personnel shall complete C&H's data protection and FERPA awareness training program prior to accessing any Protected Data in connection with the Matter, and shall complete refresher training on an annual basis thereafter for the duration of the engagement. The training program shall address, at a minimum: (a) the obligations of C

ARTICLE 7: SUBCONTRACTORS AND THIRD-PARTY SERVICE PROVIDERS 7.1 Prior Approval. C&H shall not engage, retain, or permit any subcontractor or third-party service provider to access, receive, process, store, or transmit Protected Data without the prior written consent of WET's General Counsel, Priya Anand-Desai. The foregoing requirement applies to all categories of third-party service providers, including without limi

ARTICLE 8: SECURITY INCIDENT AND BREACH NOTIFICATION 8.1 Detection and Investigation. C&H shall implement and maintain processes, technologies, and personnel resources sufficient to detect, investigate, and respond to Security Incidents involving Protected Data in a timely and effective manner. C&H's incident response capabilities shall include, at a minimum, continuous monitoring of Receiving Systems for indicators

ARTICLE 9: DATA RETURN AND DESTRUCTION 9.1 Upon Conclusion of Matter. Within sixty (60) days of the conclusion or termination of the engagement under the Engagement Letter (including any post-engagement wind-down period agreed upon by the Parties), C&H shall, at WET's sole election as communicated in writing by WET's General Counsel: (a) Return all Protected Data to WET in a format and on a medium designated by WET,

ARTICLE 10: AUDIT AND INSPECTION RIGHTS 10.1 WET Audit Right. WET, or its designated third-party auditor (currently Hargrove & Linden CPAs LLP), shall have the right, upon not less than fifteen (15) business days' prior written notice to C&H, to conduct an audit of C&H's compliance with the terms and conditions of this Addendum. Such audit may include the inspection and review of relevant policies, procedures, system

ARTICLE 11: REPRESENTATIONS AND WARRANTIES 11.1 C&H Representations and Warranties. C&H represents and warrants to WET as follows: (a) C&H has implemented and maintains a comprehensive information security program that is consistent with industry best practices for law firms of similar size and scope, and that complies with all applicable legal and regulatory requirements for the protection of sensitive data, as conf

ARTICLE 12: LIMITATION OF LIABILITY 12.1 Liability Cap. Except in cases of gross negligence or willful misconduct by C&H, C&H's aggregate liability under this Addendum for any and all claims arising from data protection failures, Security Incidents, or Breaches shall not exceed the lesser of: (a) Two Million Dollars ($2,000,000); or (b) The total fees actually paid by WET to C&H under the Engagement Letter during the

ARTICLE 13: INDEMNIFICATION 13.1 C&H Indemnification. C&H shall indemnify, defend, and hold harmless WET, its officers, directors, trustees, employees, agents, and representatives from and against any and all third-party claims, demands, actions, suits, losses, liabilities, damages, costs, and expenses (including reasonable attorneys' fees and costs of litigation) arising from or related to: (a) C&H's breach of any p

ARTICLE 14: INSURANCE 14.1 Cyber Liability Insurance. C&H shall maintain, at its own cost and expense, cyber liability insurance (including network security and privacy liability coverage) and professional liability (errors and omissions) insurance in amounts reasonably sufficient to cover C&H's obligations under this Addendum and the Engagement Letter, throughout the term of the engagement and for a period of two (2

ARTICLE 15: TERM AND TERMINATION 15.1 Term. This Addendum shall be effective as of February 10, 2026 (the Effective Date) and shall remain in effect for the duration of the engagement under the Engagement Letter, including any extensions or renewals thereof, and thereafter as to any surviving obligations specified herein. 15.2 Termination. This Addendum shall terminate upon the later of: (a) the termination, expirati

ARTICLE 16: GENERAL PROVISIONS 16.1 Governing Law. This Addendum shall be governed by and construed in accordance with the laws of the State of Delaware, without regard to its conflict-of-laws principles, consistent with the governing law provision of the Engagement Letter. Any dispute arising under or in connection with this Addendum that is not resolved by mutual agreement of the Parties shall be submitted to the e

1. Encryption Standards • At Rest: All sensitive data, including Protected Data, stored on C&H systems is encrypted using AES-256 encryption. Full-disk encryption is deployed on all endpoints (laptops, workstations, and portable devices) using FIPS 140-2 validated encryption modules. • In Transit: All data transmissions utilize TLS 1.2 or higher. C&H's encrypted email platform (Ashford Health IT) is used for the tran

2. Multi-Factor Authentication MFA is required for all C&H personnel accessing firm systems, including email, document management, VPN, and cloud applications. C&H utilizes hardware and software token-based authentication (currently Beaumont Software) for all remote access and