1010-00006 · Hargrove, Delacroix & Stein LLP · Diligence

ip-ownership-derived-works-memo.docx DOCUMENT Funds

6 / 12 ← → ✕

PRIVILEGED AND CONFIDENTIAL — ATTORNEY-CLIENT PRIVILEGE / ATTORNEY WORK PRODUCT

MEMORANDUM

From: Omar Siddiqui, Lead Associate, intellectual Property, Calderwood & Harkness LLP

To: Nathaniel Bower, Responsible Partner, Calderwood & Harkness LLP Marcus Ellison, Chief Data Officer, Arbor Health Technologies Inc.

Date: July 1, 2024

Re: IP Ownership & Derived-Works Analysis — Data License Agreement (AHT-PCA-DLA-2024-001) between Arbor Health Technologies Inc. and Pinnacle Claims Analytics LLC

Matter No.: 1010-00006

cc: Helen Tsao, General Counsel, Arbor Health Technologies Inc. Colette Whitman, Billing Partner, Calderwood & Harkness LLP Christy Bauer, Working Associate, Calderwood & Harkness LLP

Right-click to update Table of Contents

I. Executive Summary

This memorandum analyzes the intellectual property ownership framework established under the executed Data License Agreement, referenced as AHT-PCA-DLA-2024-001, with an Effective Date of July 1, 2024 (the "Agreement"), between Pinnacle Claims Analytics LLC ("PCA"), as Licensor, and Arbor Health Technologies Inc. ("AHT"), as Licensee. The purpose of this analysis is to provide AHT's executive leadership and in-house legal team with a comprehensive assessment of the IP rights allocated under the Agreement, the scope and boundaries of permissible derivative works, and the practical implications of the contractual framework for AHT's ongoing commercial operations.

Transaction Overview. AHT has licensed from PCA a longitudinal dataset comprising approximately 85 million de-identified patient records and approximately 3.4 billion individual claim lines. The total license fee is $9,000,000. The Agreement carries an initial term of five (5) years, running from July 1, 2024 through June 30, 2029, with two successive two-year renewal options exercisable at AHT's election upon 180 days' prior written notice. The data spans eight full calendar years of healthcare claims across multiple lines of business and represents a foundational asset for AHT's predictive-analytics platform and SaaS product offerings.

Core IP Conclusions. Based on our review of the executed Agreement and the complete negotiation record, we reach the following principal conclusions:

(a) PCA retains all right, title, and interest in and to the licensed data, including all intellectual property rights therein. The license is non-exclusive, and PCA remains free to license the same or substantially similar data to third parties, including AHT's competitors. The $9,000,000 license fee is consideration for the right to access and use the data; it does not constitute a purchase or assignment of the underlying data or any IP therein.

(b) AHT owns all analytics, algorithms, models, and derivative insights produced by AHT using the licensed data, subject to a non-reconstruction restriction at the individual-claim-line level. This ownership right is sole and exclusive — PCA holds no license-back, co-ownership interest, or reversionary right in AHT's derivative works. This ownership survives termination or expiration of the Agreement.

(c) The residual-knowledge clause permits AHT personnel to retain in unaided memory general knowledge, experience, ideas, concepts, know-how, and techniques gained through authorized use of the licensed data in the ordinary course of their work. This right is expressly subordinated to AHT's non-re-identification covenant, which is absolute and gives rise to uncapped indemnification liability in the event of breach.

Negotiation Outcomes. This memorandum also identifies the key negotiation points achieved by Calderwood & Harkness LLP ("C&H") relative to PCA's initial positions, as reflected in the PCA markup returned on June 12, 2024, by Hargrove, Delacroix & Stein LLP ("HD&S"). All five critical IP negotiation points — elimination of the license-back provision, retention of the broad derivative-works definition, rejection of joint ownership, preservation of the residual-knowledge clause, and narrowing of the non-reconstruction standard — were resolved favorably for AHT. The detailed negotiation history is set forth in Section V below.

This memorandum is organized as follows: Section II provides background on the parties and the transaction; Section III analyzes the IP ownership framework; Section IV addresses the residual-knowledge clause and its interplay with the non-re-identification covenant; Section V recounts the negotiation history; Section VI examines the interaction of the IP provisions with other key terms of the Agreement; Section VII sets forth practical recommendations for AHT's internal governance, employee protocols, commercialization activities, and audit preparedness; and Section VIII provides our conclusions.

II. Background and Transaction Context

A. Parties and Their Roles

Arbor Health Technologies Inc. ("AHT"). AHT is a corporation organized under the laws of the State of Delaware, with its principal executive offices located in Boston, Massachusetts. AHT is a healthcare analytics and software-as-a-service ("SaaS") company focused on predictive analytics, population health management, risk stratification, and clinical-outcomes benchmarking for health systems, commercial and government payers, and employer-sponsored health plans. AHT's annualized recurring revenue is approximately $62 million. In 2021, AHT was acquired by Cedarpoint Capital Partners Fund IV, L.P., a growth-equity fund, for approximately $185 million. AHT's Chief Executive Officer is Dr. Priya Narayanan. The internal deal lead for the PCA transaction is Marcus Ellison, AHT's Chief Data Officer, who is responsible for AHT's data strategy, data partnerships, and data-science operations. AHT's General Counsel is Helen Tsao, who oversees all legal matters for the company, including regulatory compliance, commercial contracting, and M&A-related legal work.

Pinnacle Claims Analytics LLC ("PCA"). PCA is a limited liability company organized under the laws of the State of Delaware, with its principal place of business in Nashville, Tennessee. PCA is a specialty health-data aggregator that sources, curates, de-identifies, and licenses healthcare claims data. PCA's annual revenue is approximately $47 million. PCA is privately held by its founders and Ridgeview Health Ventures LLC, a healthcare-focused venture capital fund. PCA's Chief Executive Officer is Jonathan Kessler. PCA's Chief Privacy Officer is Dr. Anita Mehta, who oversees PCA's HIPAA compliance program and data de-identification processes. PCA sources its claims data through downstream data-contribution agreements with regional health plans, third-party administrators, and pharmacy benefit managers across the United States.

Counsel. PCA is represented in this transaction by Hargrove, Delacroix & Stein LLP ("HD&S"), a Nashville-based law firm. The HD&S deal team is led by Elaine Prescott, Partner, and Ryan Kobayashi, Senior Associate. AHT is represented by Calderwood & Harkness LLP ("C&H"), with Nathaniel Bower serving as Responsible Partner, Colette Whitman as Billing Partner, Omar Siddiqui (the author of this memorandum) as Lead Associate, and Christy Bauer as Working Associate. In addition, AHT's regular outside privacy counsel, Whitfield & Ames, P.C. (David Whitfield, Partner), provided a preliminary privacy-risk assessment in connection with the transaction, which informed the parties' approach to the de-identification, non-re-identification, and HIPAA-related provisions of the Agreement.

B. Licensed Data Overview

The licensed dataset is a longitudinal repository of de-identified healthcare claims data covering the period from January 1, 2016 through December 31, 2023 — eight full calendar years of claims history. The dataset encompasses multiple claim types: professional claims (analogous to Medicare Part B), facility claims (analogous to Medicare Part A), pharmacy claims (analogous to Medicare Part D), and ancillary claims (including laboratory, durable medical equipment, and home health). The data spans multiple lines of business, including commercial insurance, Medicare Advantage, and Medicaid managed-care plans.

The dataset contains records for no fewer than 85 million unique de-identified patient tokens and approximately 3.4 billion individual claim lines. Each claim line is characterized by up to 247 standardized data fields, which are defined and described in detail in Exhibit B to the Agreement (the "Data Dictionary"). These fields include, among other things, diagnosis codes (ICD-10-CM), procedure codes (CPT, HCPCS), revenue codes, place-of-service codes, provider specialty and taxonomy codes, billed amounts, allowed amounts, paid amounts, patient cost-sharing amounts, dates of service, and claim-processing dates. The data also includes patient demographic fields (age band, gender, geographic region at the three-digit ZIP code level) and longitudinal patient-linkage tokens that enable tracking of individual patients across multiple claims and encounters over time.

De-Identification. The licensed data has been de-identified in accordance with the Safe Harbor method set forth in 45 C.F.R. § 164.514(b)(2) of the HIPAA Privacy Rule. All eighteen categories of identifiers specified in the Safe Harbor standard have been removed or generalized. In addition, PCA has obtained an Expert Determination certification under 45 C.F.R. § 164.514(b)(1) from Ridgeline Statistical Sciences LLC, an independent statistical consulting firm, confirming that the risk of re-identification of any individual from the licensed dataset is very small. PCA represents in the Agreement that it maintains the de-identification methodology and supporting documentation required by the HIPAA Privacy Rule.

Delivery. PCA will deliver the initial dataset to AHT in Apache Parquet file format via encrypted SFTP transfer using AES-256 encryption. The initial delivery is required within thirty (30) calendar days of the Effective Date, establishing a deadline of July 31, 2024. In addition, PCA will provide quarterly data refreshes — incorporating newly available claims data and corrections to previously delivered records — for a period of thirty-six (36) months from the Effective Date (i.e., through June 30, 2027), at no additional cost to AHT. Each quarterly refresh will be delivered in the same format and via the same encrypted channel. After the thirty-six-month refresh period, AHT may elect to purchase additional data refreshes at rates to be negotiated in good faith by the parties.

C. AHT's Intended Uses

AHT's intended uses for the licensed data fall into three principal categories, all of which are authorized as "Permitted Uses" under the Agreement:

Internal Analytics and Model Training. AHT's data-science and engineering teams will use the licensed data to conduct internal research and analysis, including the development, training, validation, and refinement of predictive-analytics algorithms, machine-learning models, actuarial models, and statistical indices. These activities will take place within AHT's secure cloud computing environment (currently hosted on Ridgeway Industries, U.S. East region) and on-premises analytical workstations.

Product Development and SaaS Integration. The insights, models, and analytics generated from the licensed data will be integrated into AHT's commercial SaaS platform, which serves health systems, commercial and government payers, and employer-sponsored health plans. AHT's product offerings include predictive risk-scoring modules, population health management dashboards, clinical-outcomes benchmarking tools, and actuarial cost-projection engines. The derivative analytics and trained models are the commercial outputs of AHT's business — they are the products that AHT sells to its customers.

No Re-Sale or Sub-Licensing of Raw Data. AHT is not permitted to re-sell, sub-license, or otherwise distribute the raw licensed data or any subset, extract, or copy thereof that preserves individual-level claim-line detail. This restriction is fundamental to the Agreement's IP ownership framework: PCA retains ownership of the data, and AHT's license extends only to the right to use the data for the Permitted Uses specified in the Agreement.

Critical Business Importance. It bears emphasis that the derivative analytics and models that AHT builds on top of the licensed data are the core commercial outputs of AHT's business. AHT does not sell data; it sells insights, predictions, and analytical tools. For this reason, clarity of AHT's ownership of its derivative works — free from any license-back, co-ownership, or reversionary interest held by PCA — was the single most important commercial objective in the negotiation of the Agreement's IP provisions. As discussed in Sections III and V below, this objective was fully achieved.

III. IP Ownership Framework Under the Agreement

A. PCA's Retained Ownership of Licensed Data

The Agreement establishes a clear demarcation between the licensed data — which is and remains PCA's property — and the derivative works that AHT creates using the licensed data — which are and become AHT's property. We address PCA's retained ownership first.

Section 4.1 of the Agreement (Ownership of Licensed Data) provides, in relevant part:

"Licensor retains all right, title, and interest in and to the Licensed Data, including without limitation all intellectual property rights therein. Nothing in this Agreement shall be construed as a sale, assignment, or transfer of ownership of the Licensed Data or any portion thereof to Licensee. The License Fee is consideration for the rights and licenses granted herein and does not constitute a purchase price for the Licensed Data."

This provision is unambiguous. The $9,000,000 license fee buys AHT a right to use the data; it does not buy the data itself. PCA retains full ownership and may continue to exploit the data as it sees fit, including by licensing the same or substantially similar data to third parties. The license granted to AHT is expressly non-exclusive.

PCA's upstream Rights. Section 5.2 of the Agreement (Representations and Warranties of Licensor) contains PCA's representation that it holds all necessary rights under its downstream data-contribution agreements with regional health plans, third-party administrators, and other data sources to grant the license to AHT. PCA further represents that no contributing source has revoked, restricted, or materially limited PCA's right to sublicense the data to entities such as AHT. This representation is important because PCA's ability to grant the license depends on the integrity of its upstream supply chain. If a contributing source were to revoke its consent, PCA's ability to fulfill its obligations under the Agreement could be impaired. AHT has the benefit of PCA's indemnification for breach of this representation.

Practical Implications. From AHT's perspective, PCA's retained ownership of the licensed data means that AHT must treat the data as a licensed asset, not an owned asset, at all times. AHT must comply with the use restrictions set forth in the Agreement, must implement the security safeguards specified in Exhibit C, and must return or destroy all copies of the raw data upon termination or expiration of the Agreement (subject to the derivative-works and residual-knowledge exceptions discussed below). AHT should ensure that its internal data-governance documentation correctly categorizes the licensed data as third-party-licensed data subject to contractual restrictions, and that AHT personnel understand they are working with data that AHT does not own.

B. AHT's Ownership of Derivative Works

The commercially critical counterpart to PCA's retained ownership of the licensed data is AHT's ownership of derivative works. Section 4.2 of the Agreement (Ownership of Derivative Works) provides:

"Licensee shall own all right, title, and interest in and to all Derivative Works created by or on behalf of Licensee using the Licensed Data, in whole or in part, during the Term. Licensor shall have no right, title, interest, license, or other claim in or to any Derivative Work. Licensee's ownership of Derivative Works shall survive the termination or expiration of this Agreement."

This provision was the central objective of C&H's negotiation effort, and the final language represents a complete and unqualified vesting of derivative-works ownership in AHT. Several aspects of this provision warrant detailed analysis:

Sole and Exclusive Ownership. AHT's ownership is sole and exclusive. The Agreement contains no license-back, co-ownership, or reversionary interest in favor of PCA. PCA has no right to access, use, copy, distribute, or benefit from AHT's derivative works in any manner. This was a hard-fought negotiation outcome, as PCA initially sought a broad, perpetual, royalty-free license-back (see Section V.A.1 below).

Survival of Ownership. AHT's ownership of derivative works expressly survives the termination or expiration of the Agreement. This means that even after the license term ends — whether at the end of the initial five-year term, at the end of any renewal term, or upon early termination — AHT retains full ownership of every model, algorithm, analytical output, and derivative insight it created during the term. AHT will be required to return or destroy the raw licensed data, but the derivative works remain AHT's permanent property. This is an essential protection for AHT's business continuity and the long-term value of its investment.

Critical Qualification — Non-Reconstruction Restriction. AHT's ownership of derivative works is subject to one important qualification: derivative works must not permit reconstruction of the underlying licensed data at the individual-claim-line level. Section 4.2(b) provides:

"Notwithstanding Licensee's ownership of Derivative Works, Licensee shall ensure that no Derivative Work permits reconstruction of the underlying Licensed Data at the individual-claim-line level."

This means that AHT's models and outputs may incorporate aggregated patterns, statistical relationships, and population-level insights drawn from the licensed data, but may not function as a mechanism to reverse-engineer or reproduce specific claim-line records. The non-reconstruction restriction is analyzed in detail in Section III.D below.

Practical Implications for AHT's SaaS Platform. AHT's commercial SaaS offerings — including predictive-analytics risk scores, population health management dashboards, clinical-outcomes benchmarking reports, actuarial cost-projection indices, and model-generated reports — are comfortably within the scope of permitted derivative works. These products convey analytical insights derived from the licensed data; they do not convey the underlying data itself or enable reconstruction of individual claim lines. AHT can sell these products to its customers — health systems, payers, and employer-sponsored plans — without restriction, and without any obligation to notify PCA or obtain PCA's consent.

No PCA License-Back. As noted above, the Agreement does not grant PCA any license to AHT's derivative works. This is a significant commercial outcome that C&H negotiated on AHT's behalf. The absence of a license-back means that PCA cannot use AHT's models, algorithms, or analytics to enhance PCA's own data products or to provide competitive intelligence to PCA's other licensees (including potential AHT competitors). The negotiation history on this point is set forth in Section V below.

C. Definition of "Derivative Works" — Scope and Boundaries

The scope of AHT's derivative-works ownership turns on the contractual definition of "Derivative Works." Section 1.12 of the Agreement provides:

"'Derivative Works' means any and all analytics, algorithms, statistical models, machine-learning models, indices, benchmarks, reports, visualizations, and other insights or outputs created by or on behalf of Licensee using the Licensed Data, in whole or in part, including without limitation: (a) trained model weights, parameters, and architectures; (b) aggregated or anonymized statistical outputs; (c) risk scores, actuarial tables, and population health indices; and (d) software code, dashboards, and user interfaces that incorporate or display the foregoing."

This definition is intentionally broad, and its breadth was a deliberate negotiation objective for C&H. Several categories of derivative works merit specific discussion:

Trained Model Weights and Parameters. A machine-learning model trained on the licensed data is a derivative work owned by AHT, even though the model's internal parameters (weights, biases, embeddings) were shaped by exposure to the data during the training process. This is commercially critical because AHT's predictive-analytics models — including gradient-boosted trees, neural networks, and ensemble models used for risk stratification and cost prediction — are trained on the licensed data. The inclusion of trained model weights and parameters in the derivative-works definition was contested by PCA, which initially argued that models trained on PCA data were effectively "extensions" of the data itself and should be treated as PCA property or, at minimum, jointly owned. C&H rejected this characterization, arguing that trained models are original works of authorship created by AHT's engineering efforts, reflecting AHT's proprietary model architectures, feature-engineering decisions, hyperparameter selections, and training methodologies. The final definition reflects AHT's position.

Aggregated or Anonymized Statistical Outputs. Population-level benchmarks, risk scores, actuarial tables, and other statistical outputs derived from analysis of the licensed data are AHT-owned derivative works. For example, if AHT computes average total cost of care per member per month across a regional cohort, or develops a disease-prevalence index based on diagnostic patterns in the data, those outputs are AHT's property. The aggregation inherent in these outputs means they do not preserve individual-claim-line detail and therefore satisfy the non-reconstruction restriction.

Software Code, Dashboards, and User Interfaces. Software code that AHT develops to process, analyze, or visualize the licensed data — including code for its SaaS platform's dashboards, reporting modules, and user interfaces — is encompassed within the derivative-works definition to the extent it incorporates or displays derivative insights from the licensed data.

Exclusions — What is NOT a Derivative Work. The definition of Derivative Works expressly excludes the licensed data itself and any subset, extract, or copy thereof that preserves individual-level claim-line detail. Such materials remain PCA property and are subject to all use restrictions, security requirements, and return/destruction obligations under the Agreement. In practical terms, this means that a filtered extract of the licensed data (e.g., all claim lines for patients in a particular age band and geographic region) is not a "Derivative Work" owned by AHT — it is a portion of the licensed data owned by PCA. AHT may create and use such extracts for analytical purposes during the term, but they must be returned or destroyed upon termination, and they may not be distributed to AHT's customers.

D. Non-Reconstruction Standard — Analysis

The non-reconstruction restriction is the principal boundary on AHT's derivative-works ownership. Section 4.2(b) provides that derivative works must "not permit reconstruction of the underlying Licensed Data at the individual-claim-line level." A proper understanding of this standard — its scope, its limits, and its practical application — is essential for AHT's data-science and engineering teams.

Interpretation of the Standard. The prohibition targets outputs that could be reverse-engineered to reproduce specific claim-line records. A claim-line record, in context, is a specific row in the licensed dataset reflecting a particular de-identified patient token's specific diagnosis code, procedure code, billed amount, allowed amount, date of service, and associated data fields in combination. The non-reconstruction standard prohibits AHT from creating a derivative work that functions as a mechanism to reverse-engineer or reproduce those specific records. For example, a model or output that, given a patient token, could generate the complete set of that patient's claim lines — or a substantial portion thereof — would violate the standard.

Critically, however, the standard does not prohibit derivative works from reflecting aggregate patterns, statistical properties, or distributional characteristics of the licensed data. A predictive model that has "learned" from the data that patients with a particular combination of chronic conditions tend to incur higher costs in the following twelve months is not "reconstructing" individual claim lines — it is applying a generalized statistical relationship. Similarly, a benchmark report showing average costs by diagnosis category and geography reflects population-level patterns, not individual-level records.

The distinction between the agreed-upon formulation and PCA's initial proposal (discussed in Section V.A.5 below) is important. PCA initially proposed that derivative works must not "reflect or be derived from" the licensed data "in a manner that permits any inference about individual claim-line-level detail." This broader formulation would have been problematic because virtually any model trained on the data could be said to permit some inference about individual-level detail — that is what statistical models do. The final formulation — "permit reconstruction" at the "individual-claim-line level" — sets a higher, more concrete threshold that is administrable and consistent with standard data-science practices.

Practical Guidance for AHT's Engineering and Data-Science Teams. To ensure compliance with the non-reconstruction standard, we recommend the following practices for AHT's technical teams:

1. Model Memorization Testing. Models should be tested to ensure they do not memorize or regurgitate individual claim-line records. Standard techniques include membership inference testing (assessing whether a model can distinguish between records that were and were not in the training set with unreasonable accuracy) and output inspection (verifying that model predictions do not reproduce specific claim-line field combinations).

2. Regularization and Generalization. Standard model-training practices — including L1/L2 regularization, dropout, early stopping, and other generalization-promoting techniques — should be employed to prevent overfitting that could lead to memorization of individual records.

3. Differential Privacy Techniques. Where feasible and appropriate, AHT should consider incorporating differential privacy mechanisms into its model-training pipelines. Differential privacy provides formal mathematical guarantees that the output of an analysis does not reveal information about any individual record in the dataset. While the Agreement does not require differential privacy, its use would provide an additional layer of compliance assurance.

4. Aggregation Thresholds. For statistical outputs, benchmarks, and reports, AHT should implement minimum cell-size thresholds (e.g., no output cell based on fewer than eleven individuals) to prevent small-cell outputs that could, in combination with external information, enable identification of individual records.

5. Derivative-Works Review. AHT's Chief Data Officer, Marcus Ellison, should implement internal policies requiring a derivative-works compliance review before any new model, analytical output, or product feature incorporating derivative works from the licensed data is distributed externally to AHT's customers or otherwise made available outside AHT's internal analytical environment.

Relationship to De-Identification. The non-reconstruction standard operates as a separate contractual obligation layered on top of the HIPAA de-identification framework. The licensed data is already de-identified under both the Safe Harbor method and the Expert Determination method. The non-reconstruction restriction adds a further contractual safeguard: even though the data does not contain direct identifiers, AHT must ensure that its derivative works do not enable reconstruction of the underlying data in a manner that effectively "re-creates" the dataset at the claim-line level. This layered approach reflects the parties' shared interest in ensuring that the data cannot be reconstituted, whether for privacy reasons or for the commercial reason that PCA does not want AHT to be able to generate a functional equivalent of PCA's proprietary dataset from AHT's derivative works.

IV. Residual-Knowledge Clause

A. Scope of the Clause

Section 6.4 of the Agreement (Residual Knowledge) provides:

"Notwithstanding any other provision of this Agreement, Licensee's personnel may retain in unaided memory general knowledge, experience, ideas, concepts, know-how, and techniques gained through the authorized use of the Licensed Data in the ordinary course of their work for Licensee. For the avoidance of doubt, this Section does not permit Licensee's personnel to make copies, extracts, or written notes of specific data elements from the Licensed Data for the purpose of retaining such information outside the Licensed Data Environment."

The residual-knowledge clause is a standard provision in data-licensing agreements that addresses the practical reality that individuals who work intensively with a dataset inevitably absorb general knowledge and develop expertise through that experience. The clause recognizes that it is neither practicable nor desirable to require AHT's data scientists and analysts to "unlearn" what they know when they rotate to different projects or leave AHT's employment.

"Unaided Memory" Standard. The clause is bounded by the "unaided memory" qualifier. It covers only knowledge that a person organically retains in their mind through the normal course of working with the data. It does not authorize personnel to intentionally memorize specific data elements, make written or electronic notes of specific records, or extract data from the licensed data environment for the purpose of creating a personal reference. The distinction is between general expertise ("I know from working with this data that post-acute care costs for joint-replacement patients tend to vary significantly by geographic region") and specific data extraction ("I recall that patient token X had claims totaling $Y in 2019 for procedures A, B, and C"). The former is permitted; the latter, even if technically retained in a person's mind, should not be deliberately cultivated or recorded.

Commercial Significance for AHT. The residual-knowledge clause has substantial commercial significance for AHT. AHT's data scientists and analysts will develop deep domain expertise and methodological insights through working with the licensed dataset — insights into healthcare cost drivers, utilization patterns, disease progression, and analytical techniques. This expertise becomes part of AHT's human capital and informs AHT's product development, customer engagements, and competitive differentiation. Without a residual-knowledge clause, any time AHT personnel moved to different roles within the company or departed the company entirely, AHT would face the risk that PCA could argue those individuals were "carrying" PCA confidential information in their heads, creating potential breach-of-contract exposure. The clause eliminates this risk by expressly permitting retention of general knowledge, subject to the non-re-identification covenant.

B. Interplay with the Non-Re-Identification Covenant

The residual-knowledge clause does not operate in isolation. It is expressly subordinated to AHT's non-re-identification covenant, which is set forth in Section 6.3 of the Agreement:

"Licensee covenants and agrees that it shall not, and shall not permit any of its personnel, agents, or contractors to, attempt to re-identify any individual whose data is included in the Licensed Data, whether through the use of the Licensed Data alone or in combination with any other data, information, or resource."

This covenant is absolute. It is not qualified by a reasonableness standard, a materiality threshold, or a knowledge qualifier. AHT must not attempt to re-identify any individual, period. Any effort by any AHT employee, contractor, or agent to link a de-identified patient token in the licensed data to an actual identified individual — whether using the licensed data alone, or in combination with external data sources — constitutes a breach.

Harmonization with Residual Knowledge. Section 6.4(b) of the Agreement provides the explicit harmonization:

"The retention of residual knowledge under this Section 6.4 is expressly subject to and limited by the non-re-identification covenant set forth in Section 6.3. No personnel of Licensee may use any general knowledge, experience, ideas, concepts, know-how, or techniques retained under this Section in any manner that constitutes or facilitates an attempt to re-identify any individual whose data is included in the Licensed Data."

The practical effect is clear: AHT's data scientists may carry with them general expertise gained from working with the licensed data, but they may never deploy that expertise in any effort, direct or indirect, to identify an individual in the dataset. This is a bright-line rule, and it must be communicated clearly to all AHT personnel who have access to the licensed data.

Uncapped Liability. Any breach of the non-re-identification covenant gives rise to uncapped indemnification liability under Section 8.2(c) of the Agreement. The general indemnification cap of $9,000,000 per party does not apply to claims arising from willful misconduct or breach of the non-re-identification covenant. This means that if AHT or any AHT employee attempts to re-identify an individual in the dataset, AHT's potential liability to PCA is unlimited. This is a significant risk allocation point and underscores the critical importance of AHT's internal training and compliance programs.

C. Recommended Internal Policies

In light of the residual-knowledge clause and the non-re-identification covenant, we recommend that AHT implement the following internal policies:

1. Written Policy Statement. AHT should adopt a written policy, approved by the Chief Data Officer and General Counsel, that specifically addresses the residual-knowledge clause and the non-re-identification covenant. The policy should explain in plain language what residual knowledge AHT personnel are permitted to retain, what they are prohibited from doing, and the consequences of non-compliance (including the uncapped liability exposure).

2. Mandatory Training. All AHT personnel who are granted access to the licensed data — including data scientists, data engineers, analysts, product managers, and any contractors or consultants — must complete mandatory training on the terms of the data-license agreement, with particular emphasis on the non-re-identification covenant. Training should be completed before initial access is granted and should be refreshed annually.

3. Exit-Interview Protocols. When an employee or contractor who had access to the licensed data departs AHT (whether voluntarily or involuntarily), AHT should conduct an exit interview that includes a reminder of the residual-knowledge clause's scope, the continuing obligation not to attempt re-identification, and the continuing confidentiality obligations under the Agreement. The departing individual should be asked to confirm in writing that they have not retained any copies, extracts, or written notes of specific data elements from the licensed data and that they understand the scope of permissible residual knowledge.

4. Access Termination. Upon departure, all access to the licensed data environment must be immediately revoked, and any devices or media containing copies of the licensed data must be returned or securely wiped, with certification provided to AHT's IT security team.

V. Negotiation History and Key Points Achieved

A. PCA's Initial Position (June 12, 2024 Markup by Hargrove, Delacroix & Stein LLP)

C&H circulated its initial draft of the Data License Agreement to HD&S on June 4, 2024. PCA's markup was returned by HD&S on June 12, 2024. The PCA markup contained several IP provisions that, if accepted, would have materially diminished AHT's rights in its derivative works and impaired AHT's ability to commercialize its analytics platform. The five most significant proposals in PCA's markup were as follows:

1. License-Back of Derivative Works. PCA initially proposed a broad, perpetual, irrevocable, worldwide, royalty-free, fully paid-up license-back to PCA for all derivative works created by AHT using the licensed data. Under PCA's proposed Section 4.2(c), PCA would have received the right to use, copy, modify, distribute, and create further derivative works from AHT's derivative works for any purpose, including PCA's own product development and data-quality improvement. PCA justified this proposal by arguing that derivative works built on PCA data should "feed back" into PCA's ecosystem, improving the quality and utility of PCA's dataset for all of its licensees. This proposal was unacceptable to AHT because it would have given PCA — and, through PCA's other licensees, potentially AHT's competitors — access to AHT's proprietary analytics and models.

2. Narrow Definition of Derivative Works. PCA sought to exclude trained machine-learning model weights and parameters from the definition of AHT-owned derivative works. PCA's proposed definition limited "Derivative Works" to "reports, visualizations, and aggregated statistical outputs" and expressly excluded "trained model weights, parameters, embeddings, or any other component of a machine-learning system that reflects or incorporates patterns from the Licensed Data." PCA characterized trained models as "extensions" of the data itself, arguing that models trained on PCA data are fundamentally different from reports that merely summarize the data. If accepted, this proposal would have left AHT without clear ownership of its most valuable technical assets — its trained predictive models.

3. Joint Ownership of Aggregated Outputs. PCA proposed that any aggregated statistical output — including benchmarks, indices, population health metrics, and actuarial tables — that was "based predominantly on the Licensed Data" would be jointly owned by PCA and AHT. The "based predominantly" qualifier was undefined, and PCA did not propose any mechanism for determining which outputs met the threshold. Under applicable law, joint ownership would have given each co-owner the right to exploit the output independently and without an accounting to the other co-owner, which would have allowed PCA to use AHT's analytical insights in competition with AHT.

4. Elimination of the Residual-Knowledge Clause. PCA's markup deleted the residual-knowledge clause in its entirety. PCA proposed instead that "all knowledge, experience, concepts, and techniques gained by Licensee's personnel through use of the Licensed Data shall constitute Confidential Information of Licensor and shall be subject to the confidentiality obligations set forth in Section 7 of this Agreement for the duration of such obligations." Under this approach, AHT personnel would have been prohibited from using or disclosing any knowledge gained from the licensed data, potentially indefinitely, creating untenable restrictions on AHT's workforce.

5. Broader Non-Reconstruction Standard. PCA proposed a substantially broader non-reconstruction standard. PCA's proposed Section 4.2(b) provided that derivative works must not "reflect or be derived from the Licensed Data in a manner that permits any inference about individual claim-line-level detail." This formulation was problematic for two reasons. First, the phrase "any inference" set an impossibly low threshold: virtually any model trained on data permits some degree of inference about individual-level patterns — that is the fundamental nature of statistical learning. Second, the phrase "reflect or be derived from" was broader than "permit reconstruction of," encompassing outputs that merely reflect patterns in the data rather than outputs that would enable actual reconstruction of specific records.

B. C&H's Counter-Positions and Final Negotiated Outcomes

C&H responded to PCA's markup on June 17, 2024, with a detailed counter-markup accompanied by a separate issues memorandum setting forth AHT's positions on each of the five IP provisions. The parties conducted three negotiation sessions (June 19, June 22, and June 26, 2024) and exchanged two additional rounds of drafts before reaching agreement on the final IP language on June 28, 2024. The final negotiated outcomes on each of the five issues are as follows:

1. License-Back Eliminated. C&H successfully rejected the license-back provision in its entirety. AHT retains sole and exclusive ownership of all derivative works, with no obligation to share, license, or provide access to them to PCA for any purpose. The final Agreement contains no license-back clause of any kind. C&H's principal argument was that AHT's derivative works are the core commercial output of AHT's business, that AHT is paying $9,000,000 for the right to use the data precisely in order to create these proprietary analytics, and that a license-back would fundamentally undermine the value proposition of the transaction for AHT. C&H also argued that a license-back would create competitive-harm risks, as PCA's other licensees could indirectly benefit from AHT's analytical innovations. PCA ultimately conceded this point after extensive negotiation, recognizing that the license-back proposal was a significant impediment to closing the transaction.

2. Broad Derivative-Works Definition Retained. The final definition of "Derivative Works" includes trained model weights and parameters, algorithms, analytics, and all forms of derivative insights. C&H argued that trained models are original works of authorship created by AHT's engineering efforts — reflecting AHT's proprietary model architectures, feature engineering, hyperparameter tuning, and training methodologies — and do not constitute copies or "extensions" of the underlying data. C&H cited the well-established principle in intellectual property law that a work of authorship may be informed by underlying factual material without the author relinquishing ownership of the resulting expression. PCA's position that models are "extensions" of the data was, in C&H's view, analytically unsound: a model transforms raw data into a new form — learned parameters, latent representations, decision boundaries — that is qualitatively different from the input data. PCA accepted C&H's position and agreed to the broad definition.

3. Joint Ownership Rejected. The Agreement confirms AHT's sole ownership of all aggregated statistical outputs, including benchmarks, indices, population health metrics, and actuarial tables. C&H argued that joint ownership would create intractable co-exploitation issues, as each co-owner would independently have the right to use, license, and distribute the jointly owned outputs without accounting to the other. This would have enabled PCA to distribute AHT's aggregated analytics to its other licensees, including potential competitors of AHT, without compensation. C&H also argued that the "based predominantly on" threshold proposed by PCA was undefined and unworkable, creating perpetual uncertainty about which outputs were jointly owned and which were solely owned by AHT. PCA conceded this point during the June 22 negotiation session.

4. Residual-Knowledge Clause Preserved. C&H reinstated the residual-knowledge clause with the "unaided memory" standard. To address PCA's concerns about the potential for residual knowledge to be used to re-constitute elements of the licensed data, C&H proposed the express subordination of the residual-knowledge clause to the non-re-identification covenant — language providing that residual knowledge may be retained but may never be used in any manner that constitutes or facilitates an attempt to re-identify any individual. This subordination language provided PCA with a meaningful safeguard while preserving AHT's ability to benefit from its personnel's expertise. PCA accepted the clause with the subordination language during the June 26 negotiation session.

5. Non-Reconstruction Standard Narrowed to Claim-Line Level. C&H negotiated the non-reconstruction standard down from PCA's proposed "any inference about individual claim-line-level detail" to the final formulation: derivative works must not "permit reconstruction of the underlying Licensed Data at the individual-claim-line level." This is a meaningfully narrower standard. The change from "any inference" to "reconstruction" raises the threshold from a near-impossible standard (which would have prohibited any model trained on the data) to a concrete and administrable standard (which prohibits outputs that would enable actual reverse-engineering of specific claim-line records). The change from "reflect or be derived from" to "permit reconstruction" similarly narrows the focus from the relationship between the output and the input data to the functional capability of the output. C&H argued that PCA's broader formulation would have rendered the derivative-works ownership provision meaningless, as virtually any analytical output "reflects" or "is derived from" the underlying data and permits "some inference" about individual-level patterns. PCA accepted the narrower formulation after C&H demonstrated, through examples, that the broader standard would have prohibited routine analytical outputs that both parties agreed should be permissible.

C. Summary of Negotiation Wins

The following table summarizes the five critical IP negotiation points, PCA's initial position on each, AHT's counter-position, and the final negotiated outcome:

All five critical IP negotiation points were resolved in AHT's favor. The final Agreement reflects an IP ownership framework that fully protects AHT's commercial interests while providing PCA with commercially reasonable protections against misuse of its proprietary data.

VI. Interaction with Other Agreement Provisions

The IP ownership framework set forth in Sections III through V above does not operate in isolation. It interacts with several other key provisions of the Agreement that affect how AHT may use the licensed data, the risk profile of AHT's derivative-works activities, and AHT's obligations upon termination. We address these interactions below.

A. Permitted Uses and Use Restrictions

Permitted Uses. Section 3.1 of the Agreement authorizes AHT to use the licensed data for the following purposes: (i) internal analytics, research, and statistical analysis; (ii) development, training, validation, and refinement of machine-learning models, predictive-analytics algorithms, and other analytical tools; (iii) product development and integration into AHT's commercial SaaS platform; and (iv) creation of derivative works for commercial distribution to AHT's customers, subject to the non-reconstruction restriction. These permitted uses are consistent with, and supportive of, the derivative-works ownership framework. They confirm that AHT's core business activities — building and selling analytics — are authorized under the Agreement.

Use Restrictions. Section 3.2 of the Agreement imposes the following restrictions on AHT's use of the licensed data:

(a) AHT may not re-sell, sub-license, or otherwise distribute the raw licensed data or any subset, extract, or copy thereof that preserves individual-level claim-line detail.

(b) Derivative works that constitute or contain individual-claim-line-level data remain subject to PCA's ownership and all use restrictions applicable to the licensed data. (This reinforces the principle that filtered extracts of the data are not "Derivative Works" owned by AHT; they are portions of the licensed data owned by PCA.)

(c) AHT must implement administrative, technical, and physical safeguards consistent with NIST SP 800-171 (Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations), as further specified in Exhibit C to the Agreement. These safeguards include access controls, encryption, audit logging, incident-response procedures, and personnel-screening requirements.

Practical Note. AHT's engineering and data-science teams should be trained on the distinction between (i) creating a derivative work (which AHT owns) and (ii) creating a subset or extract of the licensed data (which PCA owns). The test is whether the output preserves individual-level claim-line detail: if it does, it is PCA-owned data subject to all use restrictions; if it does not, it is an AHT-owned derivative work. When in doubt, the team should escalate the question to the Chief Data Officer or General Counsel for review.

B. Indemnification Framework

The Agreement contains a mutual indemnification framework with a general cap and a super-cap exception that directly implicates derivative-works creation.

General Indemnification Cap. Each party's indemnification liability is capped at $9,000,000, which equals the total license fee paid by AHT. Section 8.1 provides that, except as set forth in Section 8.2, neither party's aggregate liability under the indemnification provisions shall exceed $9,000,000.

Indemnification Basket. Section 8.1(b) establishes a basket of $90,000 (equal to 1% of the $9,000,000 cap). The indemnifying party is not liable for indemnifiable losses until aggregate losses exceed the basket amount, at which point the indemnifying party is liable for all losses from the first dollar (i.e., this is a first-dollar-after-basket structure, not a deductible).

Super-Cap Exception — Uncapped Liability. Section 8.2(c) provides that the $9,000,000 indemnification cap does not apply to losses arising from (i) willful misconduct by either party, or (ii) breach of the non-re-identification covenant by AHT. Liability for these categories of breach is uncapped. This exception has direct implications for AHT's derivative-works creation activities. If AHT creates a derivative work that constitutes or facilitates re-identification of any individual in the licensed dataset, AHT's indemnification liability to PCA is unlimited. This risk is not theoretical: machine-learning models, particularly those trained on granular individual-level data, can in some circumstances inadvertently enable re-identification through memorization effects, linkage attacks, or insufficient anonymization of outputs. The uncapped-liability provision provides powerful motivation for AHT to implement the internal controls, training, and review procedures recommended in Section VII below.

C. Term and Survival of IP Provisions

Initial Term and Renewal Options. The Agreement has an initial term of five (5) years, commencing on the Effective Date (July 1, 2024) and expiring on June 30, 2029. AHT has the option to renew the Agreement for two successive two-year periods (through June 30, 2031 and June 30, 2033, respectively), exercisable by AHT upon not less than 180 days' prior written notice to PCA before the expiration of the then-current term. The renewal fee for each renewal term will be determined in accordance with the pricing methodology set forth in Section 2.3 of the Agreement.

Survival of IP Provisions. The following IP-related provisions survive termination or expiration of the Agreement:

(a) Derivative-Works Ownership. AHT's ownership of all derivative works created during the term survives termination or expiration indefinitely. This is the most commercially significant survival provision: it ensures that AHT's models, algorithms, and analytics remain AHT's permanent property even after AHT no longer has access to the raw licensed data.

(b) Non-Reconstruction Restriction. The obligation to ensure that derivative works do not permit reconstruction of the licensed data at the individual-claim-line level survives termination indefinitely.

(d) Residual-Knowledge Clause. The right of AHT personnel to retain general knowledge in unaided memory survives termination, subject to the surviving non-re-identification covenant.

The indefinite survival of the non-reconstruction restriction and non-re-identification covenant means that AHT's compliance obligations extend beyond the term of the Agreement. AHT must maintain its internal controls and training programs for as long as AHT continues to use, distribute, or commercialize derivative works created from the licensed data.

D. Audit Rights

Section 9.3 of the Agreement grants PCA the right to audit AHT's compliance with the data-use restrictions set forth in the Agreement, including the non-reconstruction standard. Key terms of the audit provision include:

(a) Frequency. PCA may exercise the audit right no more than once per calendar year.

(b) Notice. PCA must provide AHT with at least thirty (30) days' prior written notice of its intent to conduct an audit, specifying the scope and nature of the audit.

(c) Conduct. Audits are to be conducted by an independent third-party auditor mutually agreed upon by the parties. The default auditor specified in the Agreement is Crestfield Advisory Group LLP, located at 1345 Avenue of the Americas, 22nd Floor, New York, NY 10105. Either party may propose an alternative auditor, subject to the other party's consent (not to be unreasonably withheld).

(d) Scope. The audit may cover AHT's compliance with all data-use restrictions in the Agreement, including the non-reconstruction restriction, the non-re-identification covenant, the data-security requirements under Exhibit C, and the use restrictions under Section 3.2.

(e) Cost. The costs of the audit are borne by PCA, unless the audit reveals a material breach of the Agreement, in which case AHT shall reimburse PCA for the reasonable costs of the audit.

Potential Audit Focus on Derivative Works. Of particular relevance to this memorandum, PCA could use the audit right to verify that AHT's models and outputs do not violate the non-reconstruction restriction. An auditor could, for example, examine the architecture and outputs of AHT's trained models to assess whether they are capable of reconstructing individual claim-line records. AHT should anticipate this possibility and maintain documentation sufficient to demonstrate that its derivative works were designed, tested, and validated to comply with the non-reconstruction standard. Specific documentation recommendations are set forth in Section VII.D below.

E. Data Return and Destruction Obligations

Section 10.3 of the Agreement addresses AHT's obligations upon termination or expiration:

(a) Return or Destruction of Licensed Data. Within sixty (60) days following termination or expiration, AHT must return to PCA or, at PCA's election, destroy all copies of the licensed data, including all raw data files, filtered extracts, subsets, and copies containing individual-level claim-line records. AHT must provide PCA with a written certification, signed by an authorized officer of AHT, confirming the completion of the return or destruction.

(b) Derivative-Works Exemption. AHT's derivative works — which by contractual definition do not permit reconstruction of individual claim-line data — are exempt from the return/destruction obligation. They are AHT-owned property and remain with AHT after termination. This exemption is the practical corollary of AHT's derivative-works ownership right: without it, the survival of AHT's ownership would be meaningless, as AHT would be required to destroy its own property upon termination.

(c) Residual-Knowledge Exemption. The general knowledge, experience, ideas, concepts, know-how, and techniques retained by AHT personnel in unaided memory are also exempt from the return/destruction obligation. This exemption flows from the residual-knowledge clause discussed in Section IV above.

Practical Consideration. The interplay between the return/destruction obligation and the derivative-works exemption underscores the importance of the non-reconstruction standard. The exemption applies only to outputs that qualify as "Derivative Works" under the Agreement's definition — i.e., outputs that do not permit reconstruction of individual claim-line data. If AHT has created outputs that contain or preserve individual-level claim-line detail (e.g., filtered extracts of the raw data used for ad hoc analytical purposes), those outputs are not derivative works and must be returned or destroyed upon termination. AHT should implement data-management practices that clearly distinguish between PCA-owned data (and extracts thereof) and AHT-owned derivative works, to ensure a clean and defensible compliance process upon termination.

VII. Practical Recommendations

Based on our analysis of the Agreement's IP ownership framework, we recommend that AHT implement the following practical measures to ensure ongoing compliance and audit readiness. These recommendations are directed to Marcus Ellison, as Chief Data Officer, and to Helen Tsao, as General Counsel, for implementation within AHT's data-governance and legal-compliance programs.

A. Internal Governance

Derivative-Works Registry. Marcus Ellison should establish and maintain a derivative-works registry — a centralized catalog of all models, algorithms, analytics, and other derivative works created by AHT using the licensed data. For each derivative work, the registry should include:

• A unique identifier and descriptive name for the derivative work.

• The date of creation and the names of the team members responsible.

• A description of the derivative work's purpose and the manner in which it uses or incorporates the licensed data.

• Documentation of the measures taken to ensure compliance with the non-reconstruction standard (e.g., regularization techniques employed, aggregation thresholds applied, memorization tests conducted).

• The current status of the derivative work (e.g., in development, in production, deprecated).

• Whether the derivative work is distributed externally to AHT's customers and, if so, through which products or services.

The registry should be reviewed and updated on at least a quarterly basis. It will serve as the primary compliance record in the event of a PCA audit and will provide AHT's management with visibility into the full inventory of derivative works subject to the Agreement's restrictions.

Technical Controls. AHT's engineering and data-science teams should implement technical controls to prevent derivative works from violating the non-reconstruction restriction. Recommended controls include:

• Output Review Procedures. Before any derivative work is distributed externally or integrated into AHT's SaaS platform, it should undergo a compliance review to confirm that it does not permit reconstruction of individual claim-line data. The review should be documented and the documentation retained for audit purposes.

• Differential Privacy Techniques. Where feasible and appropriate, AHT should incorporate differential privacy mechanisms into its model-training pipelines. These mechanisms add calibrated noise to model outputs or training gradients, providing formal guarantees that the output does not reveal information about any individual record.

• Minimum Cell-Size Thresholds. For aggregated statistical outputs — benchmarks, indices, tables, and reports — AHT should implement mini

PRIVILEGED AND CONFIDENTIAL — ATTORNEY-CLIENT PRIVILEGE / ATTORNEY WORK PRODUCT
MEMORANDUM
From: Omar Siddiqui, Lead Associate, intellectual Property, Calderwood & Harkness LLP
To: Nathaniel Bower, Responsible Partner, Calderwood & Harkness LLP Marcus Ellison, Chief Data Officer, Arbor Health Technologies Inc.
Date: July 1, 2024
Re: IP Ownership & Derived-Works Analysis — Data License Agreement (AHT-PCA-DLA-2024-001) between Arbor Health Technologies Inc. and Pinnacle Claims Analytics LLC
Matter No.: 1010-00006
cc: Helen Tsao, General Counsel, Arbor Health Technologies Inc. Colette Whitman, Billing Partner, Calderwood & Harkness LLP Christy Bauer, Working Associate, Calderwood & Harkness LLP
Right-click to update Table of Contents
I. Executive Summary
This memorandum analyzes the intellectual property ownership framework established under the executed Data License Agreement, referenced as AHT-PCA-DLA-2024-001, with an Effective Date of July 1, 2024 (the "Agreement"), between Pinnacle Claims Analytics LLC ("PCA"), as Licensor, and Arbor Health Technologies Inc. ("AHT"), as Licensee. The purpose of this analysis is to provide AHT's executive leadership and in-house legal team with a comprehensive assessment of the IP rights allocated under the Agreement, the scope and boundaries of permissible derivative works, and the practical implications of the contractual framework for AHT's ongoing commercial operations.
Transaction Overview. AHT has licensed from PCA a longitudinal dataset comprising approximately 85 million de-identified patient records and approximately 3.4 billion individual claim lines. The total license fee is $9,000,000. The Agreement carries an initial term of five (5) years, running from July 1, 2024 through June 30, 2029, with two successive two-year renewal options exercisable at AHT's election upon 180 days' prior written notice. The data spans eight full calendar years of healthcare claims across multiple lines of business and represents a foundational asset for AHT's predictive-analytics platform and SaaS product offerings.
Core IP Conclusions. Based on our review of the executed Agreement and the complete negotiation record, we reach the following principal conclusions:
(a) PCA retains all right, title, and interest in and to the licensed data, including all intellectual property rights therein. The license is non-exclusive, and PCA remains free to license the same or substantially similar data to third parties, including AHT's competitors. The $9,000,000 license fee is consideration for the right to access and use the data; it does not constitute a purchase or assignment of the underlying data or any IP therein.
(b) AHT owns all analytics, algorithms, models, and derivative insights produced by AHT using the licensed data, subject to a non-reconstruction restriction at the individual-claim-line level. This ownership right is sole and exclusive — PCA holds no license-back, co-ownership interest, or reversionary right in AHT's derivative works. This ownership survives termination or expiration of the Agreement.
(c) The residual-knowledge clause permits AHT personnel to retain in unaided memory general knowledge, experience, ideas, concepts, know-how, and techniques gained through authorized use of the licensed data in the ordinary course of their work. This right is expressly subordinated to AHT's non-re-identification covenant, which is absolute and gives rise to uncapped indemnification liability in the event of breach.
Negotiation Outcomes. This memorandum also identifies the key negotiation points achieved by Calderwood & Harkness LLP ("C&H") relative to PCA's initial positions, as reflected in the PCA markup returned on June 12, 2024, by Hargrove, Delacroix & Stein LLP ("HD&S"). All five critical IP negotiation points — elimination of the license-back provision, retention of the broad derivative-works definition, rejection of joint ownership, preservation of the residual-knowledge clause, and narrowing of the non-reconstruction standard — were resolved favorably for AHT. The detailed negotiation history is set forth in Section V below.
This memorandum is organized as follows: Section II provides background on the parties and the transaction; Section III analyzes the IP ownership framework; Section IV addresses the residual-knowledge clause and its interplay with the non-re-identification covenant; Section V recounts the negotiation history; Section VI examines the interaction of the IP provisions with other key terms of the Agreement; Section VII sets forth practical recommendations for AHT's internal governance, employee protocols, commercialization activities, and audit preparedness; and Section VIII provides our conclusions.
II. Background and Transaction Context
A. Parties and Their Roles
Arbor Health Technologies Inc. ("AHT"). AHT is a corporation organized under the laws of the State of Delaware, with its principal executive offices located in Boston, Massachusetts. AHT is a healthcare analytics and software-as-a-service ("SaaS") company focused on predictive analytics, population health management, risk stratification, and clinical-outcomes benchmarking for health systems, commercial and government payers, and employer-sponsored health plans. AHT's annualized recurring revenue is approximately $62 million. In 2021, AHT was acquired by Cedarpoint Capital Partners Fund IV, L.P., a growth-equity fund, for approximately $185 million. AHT's Chief Executive Officer is Dr. Priya Narayanan. The internal deal lead for the PCA transaction is Marcus Ellison, AHT's Chief Data Officer, who is responsible for AHT's data strategy, data partnerships, and data-science operations. AHT's General Counsel is Helen Tsao, who oversees all legal matters for the company, including regulatory compliance, commercial contracting, and M&A-related legal work.
Pinnacle Claims Analytics LLC ("PCA"). PCA is a limited liability company organized under the laws of the State of Delaware, with its principal place of business in Nashville, Tennessee. PCA is a specialty health-data aggregator that sources, curates, de-identifies, and licenses healthcare claims data. PCA's annual revenue is approximately $47 million. PCA is privately held by its founders and Ridgeview Health Ventures LLC, a healthcare-focused venture capital fund. PCA's Chief Executive Officer is Jonathan Kessler. PCA's Chief Privacy Officer is Dr. Anita Mehta, who oversees PCA's HIPAA compliance program and data de-identification processes. PCA sources its claims data through downstream data-contribution agreements with regional health plans, third-party administrators, and pharmacy benefit managers across the United States.
Counsel. PCA is represented in this transaction by Hargrove, Delacroix & Stein LLP ("HD&S"), a Nashville-based law firm. The HD&S deal team is led by Elaine Prescott, Partner, and Ryan Kobayashi, Senior Associate. AHT is represented by Calderwood & Harkness LLP ("C&H"), with Nathaniel Bower serving as Responsible Partner, Colette Whitman as Billing Partner, Omar Siddiqui (the author of this memorandum) as Lead Associate, and Christy Bauer as Working Associate. In addition, AHT's regular outside privacy counsel, Whitfield & Ames, P.C. (David Whitfield, Partner), provided a preliminary privacy-risk assessment in connection with the transaction, which informed the parties' approach to the de-identification, non-re-identification, and HIPAA-related provisions of the Agreement.
B. Licensed Data Overview
The licensed dataset is a longitudinal repository of de-identified healthcare claims data covering the period from January 1, 2016 through December 31, 2023 — eight full calendar years of claims history. The dataset encompasses multiple claim types: professional claims (analogous to Medicare Part B), facility claims (analogous to Medicare Part A), pharmacy claims (analogous to Medicare Part D), and ancillary claims (including laboratory, durable medical equipment, and home health). The data spans multiple lines of business, including commercial insurance, Medicare Advantage, and Medicaid managed-care plans.
The dataset contains records for no fewer than 85 million unique de-identified patient tokens and approximately 3.4 billion individual claim lines. Each claim line is characterized by up to 247 standardized data fields, which are defined and described in detail in Exhibit B to the Agreement (the "Data Dictionary"). These fields include, among other things, diagnosis codes (ICD-10-CM), procedure codes (CPT, HCPCS), revenue codes, place-of-service codes, provider specialty and taxonomy codes, billed amounts, allowed amounts, paid amounts, patient cost-sharing amounts, dates of service, and claim-processing dates. The data also includes patient demographic fields (age band, gender, geographic region at the three-digit ZIP code level) and longitudinal patient-linkage tokens that enable tracking of individual patients across multiple claims and encounters over time.
De-Identification. The licensed data has been de-identified in accordance with the Safe Harbor method set forth in 45 C.F.R. § 164.514(b)(2) of the HIPAA Privacy Rule. All eighteen categories of identifiers specified in the Safe Harbor standard have been removed or generalized. In addition, PCA has obtained an Expert Determination certification under 45 C.F.R. § 164.514(b)(1) from Ridgeline Statistical Sciences LLC, an independent statistical consulting firm, confirming that the risk of re-identification of any individual from the licensed dataset is very small. PCA represents in the Agreement that it maintains the de-identification methodology and supporting documentation required by the HIPAA Privacy Rule.
Delivery. PCA will deliver the initial dataset to AHT in Apache Parquet file format via encrypted SFTP transfer using AES-256 encryption. The initial delivery is required within thirty (30) calendar days of the Effective Date, establishing a deadline of July 31, 2024. In addition, PCA will provide quarterly data refreshes — incorporating newly available claims data and corrections to previously delivered records — for a period of thirty-six (36) months from the Effective Date (i.e., through June 30, 2027), at no additional cost to AHT. Each quarterly refresh will be delivered in the same format and via the same encrypted channel. After the thirty-six-month refresh period, AHT may elect to purchase additional data refreshes at rates to be negotiated in good faith by the parties.
C. AHT's Intended Uses
AHT's intended uses for the licensed data fall into three principal categories, all of which are authorized as "Permitted Uses" under the Agreement:
Internal Analytics and Model Training. AHT's data-science and engineering teams will use the licensed data to conduct internal research and analysis, including the development, training, validation, and refinement of predictive-analytics algorithms, machine-learning models, actuarial models, and statistical indices. These activities will take place within AHT's secure cloud computing environment (currently hosted on Ridgeway Industries, U.S. East region) and on-premises analytical workstations.
Product Development and SaaS Integration. The insights, models, and analytics generated from the licensed data will be integrated into AHT's commercial SaaS platform, which serves health systems, commercial and government payers, and employer-sponsored health plans. AHT's product offerings include predictive risk-scoring modules, population health management dashboards, clinical-outcomes benchmarking tools, and actuarial cost-projection engines. The derivative analytics and trained models are the commercial outputs of AHT's business — they are the products that AHT sells to its customers.
No Re-Sale or Sub-Licensing of Raw Data. AHT is not permitted to re-sell, sub-license, or otherwise distribute the raw licensed data or any subset, extract, or copy thereof that preserves individual-level claim-line detail. This restriction is fundamental to the Agreement's IP ownership framework: PCA retains ownership of the data, and AHT's license extends only to the right to use the data for the Permitted Uses specified in the Agreement.
Critical Business Importance. It bears emphasis that the derivative analytics and models that AHT builds on top of the licensed data are the core commercial outputs of AHT's business. AHT does not sell data; it sells insights, predictions, and analytical tools. For this reason, clarity of AHT's ownership of its derivative works — free from any license-back, co-ownership, or reversionary interest held by PCA — was the single most important commercial objective in the negotiation of the Agreement's IP provisions. As discussed in Sections III and V below, this objective was fully achieved.
III. IP Ownership Framework Under the Agreement
A. PCA's Retained Ownership of Licensed Data
The Agreement establishes a clear demarcation between the licensed data — which is and remains PCA's property — and the derivative works that AHT creates using the licensed data — which are and become AHT's property. We address PCA's retained ownership first.
Section 4.1 of the Agreement (Ownership of Licensed Data) provides, in relevant part:
"Licensor retains all right, title, and interest in and to the Licensed Data, including without limitation all intellectual property rights therein. Nothing in this Agreement shall be construed as a sale, assignment, or transfer of ownership of the Licensed Data or any portion thereof to Licensee. The License Fee is consideration for the rights and licenses granted herein and does not constitute a purchase price for the Licensed Data."
This provision is unambiguous. The $9,000,000 license fee buys AHT a right to use the data; it does not buy the data itself. PCA retains full ownership and may continue to exploit the data as it sees fit, including by licensing the same or substantially similar data to third parties. The license granted to AHT is expressly non-exclusive.
PCA's upstream Rights. Section 5.2 of the Agreement (Representations and Warranties of Licensor) contains PCA's representation that it holds all necessary rights under its downstream data-contribution agreements with regional health plans, third-party administrators, and other data sources to grant the license to AHT. PCA further represents that no contributing source has revoked, restricted, or materially limited PCA's right to sublicense the data to entities such as AHT. This representation is important because PCA's ability to grant the license depends on the integrity of its upstream supply chain. If a contributing source were to revoke its consent, PCA's ability to fulfill its obligations under the Agreement could be impaired. AHT has the benefit of PCA's indemnification for breach of this representation.
Practical Implications. From AHT's perspective, PCA's retained ownership of the licensed data means that AHT must treat the data as a licensed asset, not an owned asset, at all times. AHT must comply with the use restrictions set forth in the Agreement, must implement the security safeguards specified in Exhibit C, and must return or destroy all copies of the raw data upon termination or expiration of the Agreement (subject to the derivative-works and residual-knowledge exceptions discussed below). AHT should ensure that its internal data-governance documentation correctly categorizes the licensed data as third-party-licensed data subject to contractual restrictions, and that AHT personnel understand they are working with data that AHT does not own.
B. AHT's Ownership of Derivative Works
The commercially critical counterpart to PCA's retained ownership of the licensed data is AHT's ownership of derivative works. Section 4.2 of the Agreement (Ownership of Derivative Works) provides:
"Licensee shall own all right, title, and interest in and to all Derivative Works created by or on behalf of Licensee using the Licensed Data, in whole or in part, during the Term. Licensor shall have no right, title, interest, license, or other claim in or to any Derivative Work. Licensee's ownership of Derivative Works shall survive the termination or expiration of this Agreement."
This provision was the central objective of C&H's negotiation effort, and the final language represents a complete and unqualified vesting of derivative-works ownership in AHT. Several aspects of this provision warrant detailed analysis:
Sole and Exclusive Ownership. AHT's ownership is sole and exclusive. The Agreement contains no license-back, co-ownership, or reversionary interest in favor of PCA. PCA has no right to access, use, copy, distribute, or benefit from AHT's derivative works in any manner. This was a hard-fought negotiation outcome, as PCA initially sought a broad, perpetual, royalty-free license-back (see Section V.A.1 below).
Survival of Ownership. AHT's ownership of derivative works expressly survives the termination or expiration of the Agreement. This means that even after the license term ends — whether at the end of the initial five-year term, at the end of any renewal term, or upon early termination — AHT retains full ownership of every model, algorithm, analytical output, and derivative insight it created during the term. AHT will be required to return or destroy the raw licensed data, but the derivative works remain AHT's permanent property. This is an essential protection for AHT's business continuity and the long-term value of its investment.
Critical Qualification — Non-Reconstruction Restriction. AHT's ownership of derivative works is subject to one important qualification: derivative works must not permit reconstruction of the underlying licensed data at the individual-claim-line level. Section 4.2(b) provides:
"Notwithstanding Licensee's ownership of Derivative Works, Licensee shall ensure that no Derivative Work permits reconstruction of the underlying Licensed Data at the individual-claim-line level."
This means that AHT's models and outputs may incorporate aggregated patterns, statistical relationships, and population-level insights drawn from the licensed data, but may not function as a mechanism to reverse-engineer or reproduce specific claim-line records. The non-reconstruction restriction is analyzed in detail in Section III.D below.
Practical Implications for AHT's SaaS Platform. AHT's commercial SaaS offerings — including predictive-analytics risk scores, population health management dashboards, clinical-outcomes benchmarking reports, actuarial cost-projection indices, and model-generated reports — are comfortably within the scope of permitted derivative works. These products convey analytical insights derived from the licensed data; they do not convey the underlying data itself or enable reconstruction of individual claim lines. AHT can sell these products to its customers — health systems, payers, and employer-sponsored plans — without restriction, and without any obligation to notify PCA or obtain PCA's consent.
No PCA License-Back. As noted above, the Agreement does not grant PCA any license to AHT's derivative works. This is a significant commercial outcome that C&H negotiated on AHT's behalf. The absence of a license-back means that PCA cannot use AHT's models, algorithms, or analytics to enhance PCA's own data products or to provide competitive intelligence to PCA's other licensees (including potential AHT competitors). The negotiation history on this point is set forth in Section V below.
C. Definition of "Derivative Works" — Scope and Boundaries
The scope of AHT's derivative-works ownership turns on the contractual definition of "Derivative Works." Section 1.12 of the Agreement provides:
"'Derivative Works' means any and all analytics, algorithms, statistical models, machine-learning models, indices, benchmarks, reports, visualizations, and other insights or outputs created by or on behalf of Licensee using the Licensed Data, in whole or in part, including without limitation: (a) trained model weights, parameters, and architectures; (b) aggregated or anonymized statistical outputs; (c) risk scores, actuarial tables, and population health indices; and (d) software code, dashboards, and user interfaces that incorporate or display the foregoing."
This definition is intentionally broad, and its breadth was a deliberate negotiation objective for C&H. Several categories of derivative works merit specific discussion:
Trained Model Weights and Parameters. A machine-learning model trained on the licensed data is a derivative work owned by AHT, even though the model's internal parameters (weights, biases, embeddings) were shaped by exposure to the data during the training process. This is commercially critical because AHT's predictive-analytics models — including gradient-boosted trees, neural networks, and ensemble models used for risk stratification and cost prediction — are trained on the licensed data. The inclusion of trained model weights and parameters in the derivative-works definition was contested by PCA, which initially argued that models trained on PCA data were effectively "extensions" of the data itself and should be treated as PCA property or, at minimum, jointly owned. C&H rejected this characterization, arguing that trained models are original works of authorship created by AHT's engineering efforts, reflecting AHT's proprietary model architectures, feature-engineering decisions, hyperparameter selections, and training methodologies. The final definition reflects AHT's position.
Aggregated or Anonymized Statistical Outputs. Population-level benchmarks, risk scores, actuarial tables, and other statistical outputs derived from analysis of the licensed data are AHT-owned derivative works. For example, if AHT computes average total cost of care per member per month across a regional cohort, or develops a disease-prevalence index based on diagnostic patterns in the data, those outputs are AHT's property. The aggregation inherent in these outputs means they do not preserve individual-claim-line detail and therefore satisfy the non-reconstruction restriction.
Software Code, Dashboards, and User Interfaces. Software code that AHT develops to process, analyze, or visualize the licensed data — including code for its SaaS platform's dashboards, reporting modules, and user interfaces — is encompassed within the derivative-works definition to the extent it incorporates or displays derivative insights from the licensed data.
Exclusions — What is NOT a Derivative Work. The definition of Derivative Works expressly excludes the licensed data itself and any subset, extract, or copy thereof that preserves individual-level claim-line detail. Such materials remain PCA property and are subject to all use restrictions, security requirements, and return/destruction obligations under the Agreement. In practical terms, this means that a filtered extract of the licensed data (e.g., all claim lines for patients in a particular age band and geographic region) is not a "Derivative Work" owned by AHT — it is a portion of the licensed data owned by PCA. AHT may create and use such extracts for analytical purposes during the term, but they must be returned or destroyed upon termination, and they may not be distributed to AHT's customers.
D. Non-Reconstruction Standard — Analysis
The non-reconstruction restriction is the principal boundary on AHT's derivative-works ownership. Section 4.2(b) provides that derivative works must "not permit reconstruction of the underlying Licensed Data at the individual-claim-line level." A proper understanding of this standard — its scope, its limits, and its practical application — is essential for AHT's data-science and engineering teams.
Interpretation of the Standard. The prohibition targets outputs that could be reverse-engineered to reproduce specific claim-line records. A claim-line record, in context, is a specific row in the licensed dataset reflecting a particular de-identified patient token's specific diagnosis code, procedure code, billed amount, allowed amount, date of service, and associated data fields in combination. The non-reconstruction standard prohibits AHT from creating a derivative work that functions as a mechanism to reverse-engineer or reproduce those specific records. For example, a model or output that, given a patient token, could generate the complete set of that patient's claim lines — or a substantial portion thereof — would violate the standard.
Critically, however, the standard does not prohibit derivative works from reflecting aggregate patterns, statistical properties, or distributional characteristics of the licensed data. A predictive model that has "learned" from the data that patients with a particular combination of chronic conditions tend to incur higher costs in the following twelve months is not "reconstructing" individual claim lines — it is applying a generalized statistical relationship. Similarly, a benchmark report showing average costs by diagnosis category and geography reflects population-level patterns, not individual-level records.
The distinction between the agreed-upon formulation and PCA's initial proposal (discussed in Section V.A.5 below) is important. PCA initially proposed that derivative works must not "reflect or be derived from" the licensed data "in a manner that permits any inference about individual claim-line-level detail." This broader formulation would have been problematic because virtually any model trained on the data could be said to permit some inference about individual-level detail — that is what statistical models do. The final formulation — "permit reconstruction" at the "individual-claim-line level" — sets a higher, more concrete threshold that is administrable and consistent with standard data-science practices.
Practical Guidance for AHT's Engineering and Data-Science Teams. To ensure compliance with the non-reconstruction standard, we recommend the following practices for AHT's technical teams:
1.  Model Memorization Testing. Models should be tested to ensure they do not memorize or regurgitate individual claim-line records. Standard techniques include membership inference testing (assessing whether a model can distinguish between records that were and were not in the training set with unreasonable accuracy) and output inspection (verifying that model predictions do not reproduce specific claim-line field combinations).
2.  Regularization and Generalization. Standard model-training practices — including L1/L2 regularization, dropout, early stopping, and other generalization-promoting techniques — should be employed to prevent overfitting that could lead to memorization of individual records.
3.  Differential Privacy Techniques. Where feasible and appropriate, AHT should consider incorporating differential privacy mechanisms into its model-training pipelines. Differential privacy provides formal mathematical guarantees that the output of an analysis does not reveal information about any individual record in the dataset. While the Agreement does not require differential privacy, its use would provide an additional layer of compliance assurance.
4.  Aggregation Thresholds. For statistical outputs, benchmarks, and reports, AHT should implement minimum cell-size thresholds (e.g., no output cell based on fewer than eleven individuals) to prevent small-cell outputs that could, in combination with external information, enable identification of individual records.
5.  Derivative-Works Review. AHT's Chief Data Officer, Marcus Ellison, should implement internal policies requiring a derivative-works compliance review before any new model, analytical output, or product feature incorporating derivative works from the licensed data is distributed externally to AHT's customers or otherwise made available outside AHT's internal analytical environment.
Relationship to De-Identification. The non-reconstruction standard operates as a separate contractual obligation layered on top of the HIPAA de-identification framework. The licensed data is already de-identified under both the Safe Harbor method and the Expert Determination method. The non-reconstruction restriction adds a further contractual safeguard: even though the data does not contain direct identifiers, AHT must ensure that its derivative works do not enable reconstruction of the underlying data in a manner that effectively "re-creates" the dataset at the claim-line level. This layered approach reflects the parties' shared interest in ensuring that the data cannot be reconstituted, whether for privacy reasons or for the commercial reason that PCA does not want AHT to be able to generate a functional equivalent of PCA's proprietary dataset from AHT's derivative works.
IV. Residual-Knowledge Clause
A. Scope of the Clause
Section 6.4 of the Agreement (Residual Knowledge) provides:
"Notwithstanding any other provision of this Agreement, Licensee's personnel may retain in unaided memory general knowledge, experience, ideas, concepts, know-how, and techniques gained through the authorized use of the Licensed Data in the ordinary course of their work for Licensee. For the avoidance of doubt, this Section does not permit Licensee's personnel to make copies, extracts, or written notes of specific data elements from the Licensed Data for the purpose of retaining such information outside the Licensed Data Environment."
The residual-knowledge clause is a standard provision in data-licensing agreements that addresses the practical reality that individuals who work intensively with a dataset inevitably absorb general knowledge and develop expertise through that experience. The clause recognizes that it is neither practicable nor desirable to require AHT's data scientists and analysts to "unlearn" what they know when they rotate to different projects or leave AHT's employment.
"Unaided Memory" Standard. The clause is bounded by the "unaided memory" qualifier. It covers only knowledge that a person organically retains in their mind through the normal course of working with the data. It does not authorize personnel to intentionally memorize specific data elements, make written or electronic notes of specific records, or extract data from the licensed data environment for the purpose of creating a personal reference. The distinction is between general expertise ("I know from working with this data that post-acute care costs for joint-replacement patients tend to vary significantly by geographic region") and specific data extraction ("I recall that patient token X had claims totaling $Y in 2019 for procedures A, B, and C"). The former is permitted; the latter, even if technically retained in a person's mind, should not be deliberately cultivated or recorded.
Commercial Significance for AHT. The residual-knowledge clause has substantial commercial significance for AHT. AHT's data scientists and analysts will develop deep domain expertise and methodological insights through working with the licensed dataset — insights into healthcare cost drivers, utilization patterns, disease progression, and analytical techniques. This expertise becomes part of AHT's human capital and informs AHT's product development, customer engagements, and competitive differentiation. Without a residual-knowledge clause, any time AHT personnel moved to different roles within the company or departed the company entirely, AHT would face the risk that PCA could argue those individuals were "carrying" PCA confidential information in their heads, creating potential breach-of-contract exposure. The clause eliminates this risk by expressly permitting retention of general knowledge, subject to the non-re-identification covenant.
B. Interplay with the Non-Re-Identification Covenant
The residual-knowledge clause does not operate in isolation. It is expressly subordinated to AHT's non-re-identification covenant, which is set forth in Section 6.3 of the Agreement:
"Licensee covenants and agrees that it shall not, and shall not permit any of its personnel, agents, or contractors to, attempt to re-identify any individual whose data is included in the Licensed Data, whether through the use of the Licensed Data alone or in combination with any other data, information, or resource."
This covenant is absolute. It is not qualified by a reasonableness standard, a materiality threshold, or a knowledge qualifier. AHT must not attempt to re-identify any individual, period. Any effort by any AHT employee, contractor, or agent to link a de-identified patient token in the licensed data to an actual identified individual — whether using the licensed data alone, or in combination with external data sources — constitutes a breach.
Harmonization with Residual Knowledge. Section 6.4(b) of the Agreement provides the explicit harmonization:
"The retention of residual knowledge under this Section 6.4 is expressly subject to and limited by the non-re-identification covenant set forth in Section 6.3. No personnel of Licensee may use any general knowledge, experience, ideas, concepts, know-how, or techniques retained under this Section in any manner that constitutes or facilitates an attempt to re-identify any individual whose data is included in the Licensed Data."
The practical effect is clear: AHT's data scientists may carry with them general expertise gained from working with the licensed data, but they may never deploy that expertise in any effort, direct or indirect, to identify an individual in the dataset. This is a bright-line rule, and it must be communicated clearly to all AHT personnel who have access to the licensed data.
Uncapped Liability. Any breach of the non-re-identification covenant gives rise to uncapped indemnification liability under Section 8.2(c) of the Agreement. The general indemnification cap of $9,000,000 per party does not apply to claims arising from willful misconduct or breach of the non-re-identification covenant. This means that if AHT or any AHT employee attempts to re-identify an individual in the dataset, AHT's potential liability to PCA is unlimited. This is a significant risk allocation point and underscores the critical importance of AHT's internal training and compliance programs.
C. Recommended Internal Policies
In light of the residual-knowledge clause and the non-re-identification covenant, we recommend that AHT implement the following internal policies:
1.  Written Policy Statement. AHT should adopt a written policy, approved by the Chief Data Officer and General Counsel, that specifically addresses the residual-knowledge clause and the non-re-identification covenant. The policy should explain in plain language what residual knowledge AHT personnel are permitted to retain, what they are prohibited from doing, and the consequences of non-compliance (including the uncapped liability exposure).
2.  Mandatory Training. All AHT personnel who are granted access to the licensed data — including data scientists, data engineers, analysts, product managers, and any contractors or consultants — must complete mandatory training on the terms of the data-license agreement, with particular emphasis on the non-re-identification covenant. Training should be completed before initial access is granted and should be refreshed annually.
3.  Exit-Interview Protocols. When an employee or contractor who had access to the licensed data departs AHT (whether voluntarily or involuntarily), AHT should conduct an exit interview that includes a reminder of the residual-knowledge clause's scope, the continuing obligation not to attempt re-identification, and the continuing confidentiality obligations under the Agreement. The departing individual should be asked to confirm in writing that they have not retained any copies, extracts, or written notes of specific data elements from the licensed data and that they understand the scope of permissible residual knowledge.
4.  Access Termination. Upon departure, all access to the licensed data environment must be immediately revoked, and any devices or media containing copies of the licensed data must be returned or securely wiped, with certification provided to AHT's IT security team.
V. Negotiation History and Key Points Achieved
A. PCA's Initial Position (June 12, 2024 Markup by Hargrove, Delacroix & Stein LLP)
C&H circulated its initial draft of the Data License Agreement to HD&S on June 4, 2024. PCA's markup was returned by HD&S on June 12, 2024. The PCA markup contained several IP provisions that, if accepted, would have materially diminished AHT's rights in its derivative works and impaired AHT's ability to commercialize its analytics platform. The five most significant proposals in PCA's markup were as follows:
1. License-Back of Derivative Works. PCA initially proposed a broad, perpetual, irrevocable, worldwide, royalty-free, fully paid-up license-back to PCA for all derivative works created by AHT using the licensed data. Under PCA's proposed Section 4.2(c), PCA would have received the right to use, copy, modify, distribute, and create further derivative works from AHT's derivative works for any purpose, including PCA's own product development and data-quality improvement. PCA justified this proposal by arguing that derivative works built on PCA data should "feed back" into PCA's ecosystem, improving the quality and utility of PCA's dataset for all of its licensees. This proposal was unacceptable to AHT because it would have given PCA — and, through PCA's other licensees, potentially AHT's competitors — access to AHT's proprietary analytics and models.
2. Narrow Definition of Derivative Works. PCA sought to exclude trained machine-learning model weights and parameters from the definition of AHT-owned derivative works. PCA's proposed definition limited "Derivative Works" to "reports, visualizations, and aggregated statistical outputs" and expressly excluded "trained model weights, parameters, embeddings, or any other component of a machine-learning system that reflects or incorporates patterns from the Licensed Data." PCA characterized trained models as "extensions" of the data itself, arguing that models trained on PCA data are fundamentally different from reports that merely summarize the data. If accepted, this proposal would have left AHT without clear ownership of its most valuable technical assets — its trained predictive models.
3. Joint Ownership of Aggregated Outputs. PCA proposed that any aggregated statistical output — including benchmarks, indices, population health metrics, and actuarial tables — that was "based predominantly on the Licensed Data" would be jointly owned by PCA and AHT. The "based predominantly" qualifier was undefined, and PCA did not propose any mechanism for determining which outputs met the threshold. Under applicable law, joint ownership would have given each co-owner the right to exploit the output independently and without an accounting to the other co-owner, which would have allowed PCA to use AHT's analytical insights in competition with AHT.
4. Elimination of the Residual-Knowledge Clause. PCA's markup deleted the residual-knowledge clause in its entirety. PCA proposed instead that "all knowledge, experience, concepts, and techniques gained by Licensee's personnel through use of the Licensed Data shall constitute Confidential Information of Licensor and shall be subject to the confidentiality obligations set forth in Section 7 of this Agreement for the duration of such obligations." Under this approach, AHT personnel would have been prohibited from using or disclosing any knowledge gained from the licensed data, potentially indefinitely, creating untenable restrictions on AHT's workforce.
5. Broader Non-Reconstruction Standard. PCA proposed a substantially broader non-reconstruction standard. PCA's proposed Section 4.2(b) provided that derivative works must not "reflect or be derived from the Licensed Data in a manner that permits any inference about individual claim-line-level detail." This formulation was problematic for two reasons. First, the phrase "any inference" set an impossibly low threshold: virtually any model trained on data permits some degree of inference about individual-level patterns — that is the fundamental nature of statistical learning. Second, the phrase "reflect or be derived from" was broader than "permit reconstruction of," encompassing outputs that merely reflect patterns in the data rather than outputs that would enable actual reconstruction of specific records.
B. C&H's Counter-Positions and Final Negotiated Outcomes
C&H responded to PCA's markup on June 17, 2024, with a detailed counter-markup accompanied by a separate issues memorandum setting forth AHT's positions on each of the five IP provisions. The parties conducted three negotiation sessions (June 19, June 22, and June 26, 2024) and exchanged two additional rounds of drafts before reaching agreement on the final IP language on June 28, 2024. The final negotiated outcomes on each of the five issues are as follows:
1. License-Back Eliminated. C&H successfully rejected the license-back provision in its entirety. AHT retains sole and exclusive ownership of all derivative works, with no obligation to share, license, or provide access to them to PCA for any purpose. The final Agreement contains no license-back clause of any kind. C&H's principal argument was that AHT's derivative works are the core commercial output of AHT's business, that AHT is paying $9,000,000 for the right to use the data precisely in order to create these proprietary analytics, and that a license-back would fundamentally undermine the value proposition of the transaction for AHT. C&H also argued that a license-back would create competitive-harm risks, as PCA's other licensees could indirectly benefit from AHT's analytical innovations. PCA ultimately conceded this point after extensive negotiation, recognizing that the license-back proposal was a significant impediment to closing the transaction.
2. Broad Derivative-Works Definition Retained. The final definition of "Derivative Works" includes trained model weights and parameters, algorithms, analytics, and all forms of derivative insights. C&H argued that trained models are original works of authorship created by AHT's engineering efforts — reflecting AHT's proprietary model architectures, feature engineering, hyperparameter tuning, and training methodologies — and do not constitute copies or "extensions" of the underlying data. C&H cited the well-established principle in intellectual property law that a work of authorship may be informed by underlying factual material without the author relinquishing ownership of the resulting expression. PCA's position that models are "extensions" of the data was, in C&H's view, analytically unsound: a model transforms raw data into a new form — learned parameters, latent representations, decision boundaries — that is qualitatively different from the input data. PCA accepted C&H's position and agreed to the broad definition.
3. Joint Ownership Rejected. The Agreement confirms AHT's sole ownership of all aggregated statistical outputs, including benchmarks, indices, population health metrics, and actuarial tables. C&H argued that joint ownership would create intractable co-exploitation issues, as each co-owner would independently have the right to use, license, and distribute the jointly owned outputs without accounting to the other. This would have enabled PCA to distribute AHT's aggregated analytics to its other licensees, including potential competitors of AHT, without compensation. C&H also argued that the "based predominantly on" threshold proposed by PCA was undefined and unworkable, creating perpetual uncertainty about which outputs were jointly owned and which were solely owned by AHT. PCA conceded this point during the June 22 negotiation session.
4. Residual-Knowledge Clause Preserved. C&H reinstated the residual-knowledge clause with the "unaided memory" standard. To address PCA's concerns about the potential for residual knowledge to be used to re-constitute elements of the licensed data, C&H proposed the express subordination of the residual-knowledge clause to the non-re-identification covenant — language providing that residual knowledge may be retained but may never be used in any manner that constitutes or facilitates an attempt to re-identify any individual. This subordination language provided PCA with a meaningful safeguard while preserving AHT's ability to benefit from its personnel's expertise. PCA accepted the clause with the subordination language during the June 26 negotiation session.
5. Non-Reconstruction Standard Narrowed to Claim-Line Level. C&H negotiated the non-reconstruction standard down from PCA's proposed "any inference about individual claim-line-level detail" to the final formulation: derivative works must not "permit reconstruction of the underlying Licensed Data at the individual-claim-line level." This is a meaningfully narrower standard. The change from "any inference" to "reconstruction" raises the threshold from a near-impossible standard (which would have prohibited any model trained on the data) to a concrete and administrable standard (which prohibits outputs that would enable actual reverse-engineering of specific claim-line records). The change from "reflect or be derived from" to "permit reconstruction" similarly narrows the focus from the relationship between the output and the input data to the functional capability of the output. C&H argued that PCA's broader formulation would have rendered the derivative-works ownership provision meaningless, as virtually any analytical output "reflects" or "is derived from" the underlying data and permits "some inference" about individual-level patterns. PCA accepted the narrower formulation after C&H demonstrated, through examples, that the broader standard would have prohibited routine analytical outputs that both parties agreed should be permissible.
C. Summary of Negotiation Wins
The following table summarizes the five critical IP negotiation points, PCA's initial position on each, AHT's counter-position, and the final negotiated outcome:
All five critical IP negotiation points were resolved in AHT's favor. The final Agreement reflects an IP ownership framework that fully protects AHT's commercial interests while providing PCA with commercially reasonable protections against misuse of its proprietary data.
VI. Interaction with Other Agreement Provisions
The IP ownership framework set forth in Sections III through V above does not operate in isolation. It interacts with several other key provisions of the Agreement that affect how AHT may use the licensed data, the risk profile of AHT's derivative-works activities, and AHT's obligations upon termination. We address these interactions below.
A. Permitted Uses and Use Restrictions
Permitted Uses. Section 3.1 of the Agreement authorizes AHT to use the licensed data for the following purposes: (i) internal analytics, research, and statistical analysis; (ii) development, training, validation, and refinement of machine-learning models, predictive-analytics algorithms, and other analytical tools; (iii) product development and integration into AHT's commercial SaaS platform; and (iv) creation of derivative works for commercial distribution to AHT's customers, subject to the non-reconstruction restriction. These permitted uses are consistent with, and supportive of, the derivative-works ownership framework. They confirm that AHT's core business activities — building and selling analytics — are authorized under the Agreement.
Use Restrictions. Section 3.2 of the Agreement imposes the following restrictions on AHT's use of the licensed data:
(a) AHT may not re-sell, sub-license, or otherwise distribute the raw licensed data or any subset, extract, or copy thereof that preserves individual-level claim-line detail.
(b) Derivative works that constitute or contain individual-claim-line-level data remain subject to PCA's ownership and all use restrictions applicable to the licensed data. (This reinforces the principle that filtered extracts of the data are not "Derivative Works" owned by AHT; they are portions of the licensed data owned by PCA.)
(c) AHT must implement administrative, technical, and physical safeguards consistent with NIST SP 800-171 (Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations), as further specified in Exhibit C to the Agreement. These safeguards include access controls, encryption, audit logging, incident-response procedures, and personnel-screening requirements.
Practical Note. AHT's engineering and data-science teams should be trained on the distinction between (i) creating a derivative work (which AHT owns) and (ii) creating a subset or extract of the licensed data (which PCA owns). The test is whether the output preserves individual-level claim-line detail: if it does, it is PCA-owned data subject to all use restrictions; if it does not, it is an AHT-owned derivative work. When in doubt, the team should escalate the question to the Chief Data Officer or General Counsel for review.
B. Indemnification Framework
The Agreement contains a mutual indemnification framework with a general cap and a super-cap exception that directly implicates derivative-works creation.
General Indemnification Cap. Each party's indemnification liability is capped at $9,000,000, which equals the total license fee paid by AHT. Section 8.1 provides that, except as set forth in Section 8.2, neither party's aggregate liability under the indemnification provisions shall exceed $9,000,000.
Indemnification Basket. Section 8.1(b) establishes a basket of $90,000 (equal to 1% of the $9,000,000 cap). The indemnifying party is not liable for indemnifiable losses until aggregate losses exceed the basket amount, at which point the indemnifying party is liable for all losses from the first dollar (i.e., this is a first-dollar-after-basket structure, not a deductible).
Super-Cap Exception — Uncapped Liability. Section 8.2(c) provides that the $9,000,000 indemnification cap does not apply to losses arising from (i) willful misconduct by either party, or (ii) breach of the non-re-identification covenant by AHT. Liability for these categories of breach is uncapped. This exception has direct implications for AHT's derivative-works creation activities. If AHT creates a derivative work that constitutes or facilitates re-identification of any individual in the licensed dataset, AHT's indemnification liability to PCA is unlimited. This risk is not theoretical: machine-learning models, particularly those trained on granular individual-level data, can in some circumstances inadvertently enable re-identification through memorization effects, linkage attacks, or insufficient anonymization of outputs. The uncapped-liability provision provides powerful motivation for AHT to implement the internal controls, training, and review procedures recommended in Section VII below.
C. Term and Survival of IP Provisions
Initial Term and Renewal Options. The Agreement has an initial term of five (5) years, commencing on the Effective Date (July 1, 2024) and expiring on June 30, 2029. AHT has the option to renew the Agreement for two successive two-year periods (through June 30, 2031 and June 30, 2033, respectively), exercisable by AHT upon not less than 180 days' prior written notice to PCA before the expiration of the then-current term. The renewal fee for each renewal term will be determined in accordance with the pricing methodology set forth in Section 2.3 of the Agreement.
Survival of IP Provisions. The following IP-related provisions survive termination or expiration of the Agreement:
(a) Derivative-Works Ownership. AHT's ownership of all derivative works created during the term survives termination or expiration indefinitely. This is the most commercially significant survival provision: it ensures that AHT's models, algorithms, and analytics remain AHT's permanent property even after AHT no longer has access to the raw licensed data.
(b) Non-Reconstruction Restriction. The obligation to ensure that derivative works do not permit reconstruction of the licensed data at the individual-claim-line level survives termination indefinitely.
(c) Non-Re-Identification Covenant. AHT's covenant not to attempt re-identification survives termination indefinitely.
(d) Residual-Knowledge Clause. The right of AHT personnel to retain general knowledge in unaided memory survives termination, subject to the surviving non-re-identification covenant.
The indefinite survival of the non-reconstruction restriction and non-re-identification covenant means that AHT's compliance obligations extend beyond the term of the Agreement. AHT must maintain its internal controls and training programs for as long as AHT continues to use, distribute, or commercialize derivative works created from the licensed data.
D. Audit Rights
Section 9.3 of the Agreement grants PCA the right to audit AHT's compliance with the data-use restrictions set forth in the Agreement, including the non-reconstruction standard. Key terms of the audit provision include:
(a) Frequency. PCA may exercise the audit right no more than once per calendar year.
(b) Notice. PCA must provide AHT with at least thirty (30) days' prior written notice of its intent to conduct an audit, specifying the scope and nature of the audit.
(c) Conduct. Audits are to be conducted by an independent third-party auditor mutually agreed upon by the parties. The default auditor specified in the Agreement is Crestfield Advisory Group LLP, located at 1345 Avenue of the Americas, 22nd Floor, New York, NY 10105. Either party may propose an alternative auditor, subject to the other party's consent (not to be unreasonably withheld).
(d) Scope. The audit may cover AHT's compliance with all data-use restrictions in the Agreement, including the non-reconstruction restriction, the non-re-identification covenant, the data-security requirements under Exhibit C, and the use restrictions under Section 3.2.
(e) Cost. The costs of the audit are borne by PCA, unless the audit reveals a material breach of the Agreement, in which case AHT shall reimburse PCA for the reasonable costs of the audit.
Potential Audit Focus on Derivative Works. Of particular relevance to this memorandum, PCA could use the audit right to verify that AHT's models and outputs do not violate the non-reconstruction restriction. An auditor could, for example, examine the architecture and outputs of AHT's trained models to assess whether they are capable of reconstructing individual claim-line records. AHT should anticipate this possibility and maintain documentation sufficient to demonstrate that its derivative works were designed, tested, and validated to comply with the non-reconstruction standard. Specific documentation recommendations are set forth in Section VII.D below.
E. Data Return and Destruction Obligations
Section 10.3 of the Agreement addresses AHT's obligations upon termination or expiration:
(a) Return or Destruction of Licensed Data. Within sixty (60) days following termination or expiration, AHT must return to PCA or, at PCA's election, destroy all copies of the licensed data, including all raw data files, filtered extracts, subsets, and copies containing individual-level claim-line records. AHT must provide PCA with a written certification, signed by an authorized officer of AHT, confirming the completion of the return or destruction.
(b) Derivative-Works Exemption. AHT's derivative works — which by contractual definition do not permit reconstruction of individual claim-line data — are exempt from the return/destruction obligation. They are AHT-owned property and remain with AHT after termination. This exemption is the practical corollary of AHT's derivative-works ownership right: without it, the survival of AHT's ownership would be meaningless, as AHT would be required to destroy its own property upon termination.
(c) Residual-Knowledge Exemption. The general knowledge, experience, ideas, concepts, know-how, and techniques retained by AHT personnel in unaided memory are also exempt from the return/destruction obligation. This exemption flows from the residual-knowledge clause discussed in Section IV above.
Practical Consideration. The interplay between the return/destruction obligation and the derivative-works exemption underscores the importance of the non-reconstruction standard. The exemption applies only to outputs that qualify as "Derivative Works" under the Agreement's definition — i.e., outputs that do not permit reconstruction of individual claim-line data. If AHT has created outputs that contain or preserve individual-level claim-line detail (e.g., filtered extracts of the raw data used for ad hoc analytical purposes), those outputs are not derivative works and must be returned or destroyed upon termination. AHT should implement data-management practices that clearly distinguish between PCA-owned data (and extracts thereof) and AHT-owned derivative works, to ensure a clean and defensible compliance process upon termination.
VII. Practical Recommendations
Based on our analysis of the Agreement's IP ownership framework, we recommend that AHT implement the following practical measures to ensure ongoing compliance and audit readiness. These recommendations are directed to Marcus Ellison, as Chief Data Officer, and to Helen Tsao, as General Counsel, for implementation within AHT's data-governance and legal-compliance programs.
A. Internal Governance
Derivative-Works Registry. Marcus Ellison should establish and maintain a derivative-works registry — a centralized catalog of all models, algorithms, analytics, and other derivative works created by AHT using the licensed data. For each derivative work, the registry should include:
•  A unique identifier and descriptive name for the derivative work.
•  The date of creation and the names of the team members responsible.
•  A description of the derivative work's purpose and the manner in which it uses or incorporates the licensed data.
•  Documentation of the measures taken to ensure compliance with the non-reconstruction standard (e.g., regularization techniques employed, aggregation thresholds applied, memorization tests conducted).
•  The current status of the derivative work (e.g., in development, in production, deprecated).
•  Whether the derivative work is distributed externally to AHT's customers and, if so, through which products or services.
The registry should be reviewed and updated on at least a quarterly basis. It will serve as the primary compliance record in the event of a PCA audit and will provide AHT's management with visibility into the full inventory of derivative works subject to the Agreement's restrictions.
Technical Controls. AHT's engineering and data-science teams should implement technical controls to prevent derivative works from violating the non-reconstruction restriction. Recommended controls include:
•  Output Review Procedures. Before any derivative work is distributed externally or integrated into AHT's SaaS platform, it should undergo a compliance review to confirm that it does not permit reconstruction of individual claim-line data. The review should be documented and the documentation retained for audit purposes.
•  Differential Privacy Techniques. Where feasible and appropriate, AHT should incorporate differential privacy mechanisms into its model-training pipelines. These mechanisms add calibrated noise to model outputs or training gradients, providing formal guarantees that the output does not reveal information about any individual record.
•  Minimum Cell-Size Thresholds. For aggregated statistical outputs — benchmarks, indices, tables, and reports — AHT should implement mini

PRIVILEGED AND CONFIDENTIAL — ATTORNEY-CLIENT PRIVILEGE / ATTORNEY WORK PRODUCT

MEMORANDUM

Record

Parties

Dates

Amounts