DATA LICENSE AGREEMENT
Reference No. AHT-PCA-DLA-2024-001
Execution Version
Effective Date: July 1, 2024
This DATA LICENSE AGREEMENT (this "Agreement") is entered into as of July 1, 2024 (the "Effective Date"), by and between:
PINNACLE CLAIMS ANALYTICS LLC, a Delaware limited liability company ("Licensor" or "PCA"), with its principal office at 3100 West End Avenue, Suite 800, Nashville, TN 37203;
and
ARBOR HEALTH TECHNOLOGIES INC., a Delaware corporation ("Licensee" or "AHT"), with its principal office at 400 Seaport Boulevard, Suite 1200, Boston, MA 02210.
Licensor and Licensee are each referred to herein as a "Party" and collectively as the "Parties."
RECITALS
WHEREAS, Licensor is in the business of aggregating, de-identifying, and licensing healthcare claims data sourced under downstream data-contribution agreements with regional health plans and third-party administrators throughout the United States;
WHEREAS, Licensor maintains a longitudinal dataset comprising approximately eighty-five million (85,000,000) unique de-identified patient records spanning professional, facility, pharmacy, and ancillary claims across commercial, Medicare Advantage, and Medicaid managed-care lines of business, covering dates of service from January 1, 2016 through December 31, 2023;
WHEREAS, Licensee is a healthcare analytics and software-as-a-service company that develops predictive-analytics tools, risk-stratification engines, and population-health management solutions for health systems, payers, and employer-sponsored plans;
WHEREAS, Licensee desires to obtain a license to access and use Licensor's de-identified healthcare claims data for the purpose of integrating such data into Licensee's predictive-analytics platform and related software products;
WHEREAS, the Parties entered into that certain Mutual Non-Disclosure Agreement dated May 13, 2024 (Reference No. AHT-PCA-NDA-2024-001) (the "NDA") governing confidential information exchanged in connection with the evaluation of this transaction, and the NDA shall remain in full force and effect in accordance with its terms;
WHEREAS, the Parties desire to set forth the terms and conditions governing Licensor's grant of a license to Licensee to use such de-identified data as more fully described herein; and
NOW, THEREFORE, in consideration of the mutual covenants and agreements hereinafter set forth and for other good and valuable consideration, the receipt and sufficiency of which are hereby acknowledged, the Parties agree as follows:
Right-click to update Table of Contents
ARTICLE I — DEFINITIONS
Section 1.1 — Definitions
As used in this Agreement, the following terms shall have the meanings set forth below:
"Acceptance Period" means the fourteen (14) calendar day period following Licensee's receipt of any Data Delivery during which Licensee may inspect the delivered data and reject any non-conforming data in accordance with Section 3.2.
"Affiliate" means, with respect to any Party, any entity that directly or indirectly controls, is controlled by, or is under common control with such Party. For purposes of this definition, "control" means the direct or indirect ownership of fifty percent (50%) or more of the outstanding voting securities of an entity, or the right to receive fifty percent (50%) or more of the profits or earnings of an entity, or the right to direct or cause the direction of the management and policies of an entity, whether through the ownership of voting securities, by contract, or otherwise.
"Applicable Law" means all applicable federal, state, and local laws, statutes, regulations, rules, orders, ordinances, judgments, decrees, and governmental requirements, including, without limitation, the Health Insurance Portability and Accountability Act of 1996, as amended (including the HITECH Act), and the regulations promulgated thereunder (collectively, "HIPAA"); the Massachusetts data-privacy laws set forth in M.G.L. c. 93H and the regulations promulgated thereunder (201 CMR 17.00 et seq.); the California Confidentiality of Medical Information Act (Cal. Civ. Code § 56 et seq.) (the "CMIA"), to the extent applicable to California-sourced claims included in the Licensed Data; and Section 5 of the Federal Trade Commission Act (15 U.S.C. § 45) (the "FTC Act § 5").
"Claim Line" means a single line item within a healthcare claim record, representing a discrete service, procedure, supply, or pharmaceutical product billed by a healthcare provider, pharmacy, or other covered entity to a health plan.
"Confidential Information" has the meaning ascribed to such term in the NDA (Reference No. AHT-PCA-NDA-2024-001, dated May 13, 2024), and shall additionally include the terms, conditions, and existence of this Agreement and all Exhibits hereto.
"Data Delivery" means each transmission of Licensed Data (including the Initial Data Delivery and each Quarterly Refresh) by Licensor to Licensee via the Delivery Method in accordance with the terms of Article III.
"Data Dictionary" means the field-level specification of the two hundred forty-seven (247) standardized data elements included in the Licensed Data, as set forth in Exhibit B attached hereto and incorporated herein by reference.
"Data Security Requirements" means the technical and organizational security measures set forth in Exhibit C attached hereto and incorporated herein by reference, which are aligned with NIST SP 800-171.
"De-Identification Standards" means, collectively, the HIPAA Safe Harbor method of de-identification set forth in 45 C.F.R. § 164.514(b)(2) and the Expert Determination method of de-identification set forth in 45 C.F.R. § 164.514(b)(1).
"Delivery Method" means encrypted Secure File Transfer Protocol (SFTP) using Advanced Encryption Standard 256-bit (AES-256) encryption, as further described in Section 3.1 and the specifications set forth in Exhibit A.
"Derived Works" means all analytics, algorithms, models, indices, scores, reports, visualizations, dashboards, risk-stratification outputs, and derivative insights produced by or on behalf of Licensee (including by Licensee's Affiliates and authorized personnel) using or incorporating the Licensed Data, provided that such works do not permit reconstruction of the underlying Licensed Data at the individual-Claim-Line level. For the avoidance of doubt, Derived Works include trained machine-learning models and model weights, statistical summaries, benchmarking outputs, and aggregated cohort analyses, but do not include any copy, extract, or subset of the raw Licensed Data itself.
"Effective Date" means July 1, 2024.
"Expert Determination" means the certification obtained by Licensor under 45 C.F.R. § 164.514(b)(1) through Ridgeline Statistical Sciences LLC, an independent statistical consultancy, confirming that the risk of re-identification of any individual whose information is included in the Licensed Data is very small, as required under the HIPAA Expert Determination method.
"HIPAA" means the Health Insurance Portability and Accountability Act of 1996, Pub. L. 104-191, as amended by the Health Information Technology for Economic and Clinical Health Act (the "HITECH Act"), Title XIII of the American Recovery and Reinvestment Act of 2009, Pub. L. 111-5, and the regulations promulgated thereunder, including the Standards for Privacy of Individually Identifiable Health Information (the "Privacy Rule," 45 C.F.R. Parts 160 and 164, Subparts A and E) and the Security Standards for the Protection of Electronic Protected Health Information (the "Security Rule," 45 C.F.R. Parts 160 and 164, Subparts A and C), each as amended from time to time.
"Initial Data Delivery" means the first Data Delivery of the full Licensed Data set, which shall be delivered by Licensor to Licensee within thirty (30) calendar days of the Effective Date (i.e., no later than July 31, 2024) in accordance with Section 3.1.
"Initial Term" means the period commencing on the Effective Date and ending on June 30, 2029, a period of five (5) years, unless this Agreement is earlier terminated in accordance with Article VIII.
"License Fee" means Nine Million Dollars ($9,000,000), payable in accordance with the schedule set forth in Section 4.2.
"Licensed Data" means the de-identified healthcare claims data described in Exhibit A attached hereto and incorporated herein by reference, including all data elements specified in the Data Dictionary (Exhibit B), as delivered to Licensee in the Initial Data Delivery and any subsequent Quarterly Refreshes.
"NDA" means the Mutual Non-Disclosure Agreement between the Parties dated May 13, 2024 (Reference No. AHT-PCA-NDA-2024-001), as may be amended from time to time by mutual written agreement of the Parties.
"NIST SP 800-171" means the National Institute of Standards and Technology Special Publication 800-171, "Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations," Revision 2 (or any successor revision), as published by the U.S. Department of Commerce.
"Non-Re-Identification Covenant" means the covenant set forth in Section 2.3(b) of this Agreement, pursuant to which Licensee agrees not to attempt to re-identify, directly or indirectly, any individual whose data is included in the Licensed Data.
"PHI" or "Protected Health Information" has the meaning ascribed to such term under HIPAA (45 C.F.R. § 160.103), and includes individually identifiable health information, whether oral, written, or electronic.
"Permitted Uses" means the uses set forth in Section 2.2.
"Quarterly Refresh" means updated Licensed Data delivered by Licensor to Licensee on a quarterly basis in accordance with Section 3.3, including updated claims data for the most recently completed calendar quarter and any corrections to previously delivered data.
"Quarterly Refresh Period" means the thirty-six (36) month period commencing on the Effective Date (July 1, 2024) and ending on June 30, 2027.
"Renewal Refresh Fee" means Three Hundred Seventy-Five Thousand Dollars ($375,000) per calendar quarter (annualized: One Million Five Hundred Thousand Dollars ($1,500,000) per year), payable by Licensee to Licensor for Quarterly Refreshes delivered during any Renewal Term in accordance with Section 3.4.
"Renewal Term" means each successive two (2) year renewal term following the Initial Term, as described in Section 8.2.
"Residual Knowledge" means general knowledge, experience, ideas, concepts, know-how, and techniques that are retained in the unaided memory of Licensee's personnel who have accessed the Licensed Data in the course of performing Permitted Uses. Residual Knowledge does not include any verbatim or substantially verbatim reproduction or reconstruction of any portion of the Licensed Data, nor does it include any information that would permit the re-identification of any individual.
"Security Incident" means any actual or reasonably suspected unauthorized access to, acquisition of, use of, disclosure of, loss of, or destruction of the Licensed Data, or any portion thereof, or any breach of the Data Security Requirements.
"Term" means, collectively, the Initial Term and any Renewal Terms, as applicable.
Section 1.2 — Rules of Construction
The following rules of construction shall apply to this Agreement:
(a) The headings and captions used in this Agreement are for convenience of reference only and shall not affect the construction or interpretation of any provision hereof.
(b) Unless the context otherwise requires, words importing the singular number shall include the plural and vice versa, and words importing the masculine gender shall include the feminine and neuter genders and vice versa.
(c) The word "including" (and its grammatical variations, such as "include" and "includes") means "including without limitation" and shall not be construed to limit any general statement that it follows to the specific or similar items or matters immediately following it.
(d) References to any statute, rule, or regulation shall be deemed to include references to such statute, rule, or regulation as amended, modified, supplemented, or replaced from time to time, and to all rules, regulations, and guidance promulgated thereunder.
(e) References to "Sections," "Articles," and "Exhibits" are to sections, articles, and exhibits of this Agreement, unless otherwise specified.
(f) All Exhibits attached hereto are incorporated herein by this reference and shall be deemed a part of this Agreement for all purposes.
(g) References to "days" mean calendar days unless expressly stated as "business days." "Business days" means days other than Saturdays, Sundays, and federal holidays observed in the United States.
(h) The words "herein," "hereof," "hereunder," and words of similar import refer to this Agreement as a whole (including all Exhibits) and not to any particular provision of this Agreement.
(i) This Agreement shall be construed without regard to any presumption or rule requiring construction or interpretation against the Party drafting or causing any instrument to be drafted.
ARTICLE II — GRANT OF LICENSE
Section 2.1 — License Grant
Subject to the terms and conditions of this Agreement, including Licensee's timely payment of the License Fee in accordance with Article IV, Licensor hereby grants to Licensee a non-exclusive, non-transferable (except as permitted in Section 14.5), limited license to access, use, copy, store, process, and create Derived Works from the Licensed Data during the Term solely for the Permitted Uses set forth in Section 2.2. The license granted hereunder extends to Licensee and its Affiliates; provided, however, that Licensee shall remain fully responsible for the acts and omissions of its Affiliates with respect to the Licensed Data as though such acts and omissions were Licensee's own. No sublicensing rights are granted except as expressly provided in this Agreement. For the avoidance of doubt, Licensee's right to make Derived Works accessible to its end-user customers through its SaaS platform, as described in Section 2.2(d), shall not constitute a sublicense of the Licensed Data.
Section 2.2 — Permitted Uses
Licensee may use the Licensed Data solely for the following purposes (collectively, the "Permitted Uses"):
(a) Internal Analytics and Research. Internal analytics, research, benchmarking, and statistical analysis conducted by or on behalf of Licensee and its Affiliates for the purpose of understanding healthcare utilization patterns, cost trends, outcomes, and related phenomena.
(b) Model Training, Validation, and Testing. Training, validation, testing, calibration, and refinement of predictive-analytics models, machine-learning algorithms, artificial-intelligence systems, and statistical methods developed or used by Licensee and its Affiliates.
(c) Product Development and Enhancement. Development, enhancement, improvement, debugging, and maintenance of Licensee's proprietary software products, platforms, applications, and services, including Licensee's SaaS platform.
(d) Integration into Licensee's SaaS Platform. Integration of Licensed Data and Derived Works into Licensee's software-as-a-service platform for use by Licensee's end-user customers (including health systems, payers, and employer-sponsored plans), provided that only Derived Works (and not raw Licensed Data) may be made accessible to such end-user customers. Licensee shall ensure that its end-user agreements contain restrictions on re-identification, further distribution, and use that are no less protective of Licensor's interests than the restrictions set forth in this Agreement.
(e) Internal Business Planning and Strategic Analysis. Internal business planning, strategic analysis, market assessment, competitive analysis, investor reporting, and other internal corporate purposes of Licensee and its Affiliates.
Section 2.3 — Use Restrictions
Licensee acknowledges and agrees that the license granted hereunder is subject to the following restrictions (collectively, the "Use Restrictions"):
(a) No Transfer of Raw Data. Licensee shall not re-sell, distribute, disclose, sublicense, publish, display, or otherwise transfer the raw Licensed Data (as distinct from Derived Works) to any third party, whether for compensation or otherwise, except as expressly permitted in this Agreement.
(b) Non-Re-Identification Covenant. Licensee shall not attempt to re-identify, directly or indirectly, any individual whose data is included in the Licensed Data, whether by linking the Licensed Data with other datasets, using inference techniques, employing reverse-engineering methods, or otherwise (the "Non-Re-Identification Covenant"). This covenant shall apply to Licensee, its Affiliates, and all personnel, contractors, and agents of Licensee and its Affiliates who have access to the Licensed Data.
(c) No Individual Contact or Marketing. Licensee shall not use the Licensed Data to contact, solicit, target, or market to any individual whose data may be included in the Licensed Data.
(d) No Re-Identification Through Combination. Licensee shall not combine, link, or match the Licensed Data with other data (including data obtained from third parties, publicly available data, or Licensee's own data) in any manner that would constitute or facilitate re-identification of any individual whose data is included in the Licensed Data.
(e) No Individual-Level Decision-Making. Licensee shall not use the Licensed Data for underwriting, insurance eligibility determination, coverage determination, claims adjudication, or treatment decisions regarding any specific individual.
(f) Compliance with Applicable Law. Licensee shall comply with all Applicable Law in its receipt, access, use, storage, processing, and destruction of the Licensed Data. In the event of any conflict between the terms of this Agreement and Applicable Law, Applicable Law shall control.
Section 2.4 — Reservation of Rights
All rights not expressly granted to Licensee under this Agreement are hereby reserved by Licensor. Nothing in this Agreement shall be construed as granting to Licensee, by implication, estoppel, or otherwise, any ownership interest in the Licensed Data or any license or right in or to the Licensed Data except as expressly set forth herein. Licensor retains the unrestricted right to license the Licensed Data to other parties, to use the Licensed Data for its own purposes, and to modify, update, or discontinue the Licensed Data at any time, subject to Licensor's delivery obligations set forth in Article III.
ARTICLE III — DATA DELIVERY
Section 3.1 — Initial Data Delivery
Licensor shall deliver the Initial Data Delivery to Licensee via the Delivery Method within thirty (30) calendar days of the Effective Date (i.e., no later than July 31, 2024). The Initial Data Delivery shall comprise the full Licensed Data set as described in Exhibit A, including all data elements specified in the Data Dictionary (Exhibit B). The Licensed Data shall be delivered in Apache Parquet file format (compressed with Snappy or GZIP codec, as mutually agreed), organized in a directory structure consistent with the specifications set forth in Exhibit A. Delivery shall be made via encrypted SFTP using AES-256 encryption to a secure endpoint designated by Licensee in writing prior to the scheduled delivery date. Licensor shall provide Licensee with a manifest file accompanying each Data Delivery, specifying file names, record counts, file sizes, and cryptographic hash values (SHA-256) for integrity verification purposes.
Section 3.2 — Data Acceptance
(a) Licensee shall have fourteen (14) calendar days following receipt of each Data Delivery (the "Acceptance Period") to inspect the delivered data for material conformity with the Data Description set forth in Exhibit A and the Data Dictionary set forth in Exhibit B. For the Initial Data Delivery, assuming delivery occurs on or before July 31, 2024, the Acceptance Period shall expire on August 14, 2024.
(b) If Licensee identifies any material non-conformity during the Acceptance Period, Licensee shall provide written notice to Licensor specifying the nature and scope of the deficiency in reasonable detail (a "Non-Conformity Notice"). Upon receipt of a Non-Conformity Notice, Licensor shall use commercially reasonable efforts to investigate and cure the identified deficiency within fifteen (15) business days after receipt of such notice. If Licensor is unable to cure the deficiency within such period, the Parties shall confer in good faith to determine an appropriate resolution, which may include an extension of the cure period, an adjustment to the data specifications, or such other remedy as the Parties may mutually agree.
(c) If Licensee does not deliver a Non-Conformity Notice within the Acceptance Period, the applicable Data Delivery shall be deemed accepted by Licensee for all purposes under this Agreement.
(d) Deemed acceptance under this Section 3.2 shall not waive or limit Licensee's rights under Article VI (Representations and Warranties) or Article IX (Indemnification) with respect to any latent defects, inaccuracies, or non-conformities that Licensee could not have reasonably discovered during the Acceptance Period.
Section 3.3 — Quarterly Refreshes
(a) During the Quarterly Refresh Period (the thirty-six (36) month period commencing on the Effective Date and ending on June 30, 2027), Licensor shall deliver Quarterly Refreshes to Licensee within fifteen (15) business days after the end of each calendar quarter (i.e., within fifteen (15) business days after September 30, December 31, March 31, and June 30 of each applicable year). The first Quarterly Refresh shall be delivered within fifteen (15) business days after September 30, 2024.
(b) Quarterly Refreshes delivered during the Quarterly Refresh Period are included in the License Fee at no additional cost to Licensee.
(c) Each Quarterly Refresh shall include: (i) updated claims data for the most recently completed calendar quarter, incorporating new claims, adjusted claims, and voided claims; (ii) any corrections, amendments, or retroactive adjustments to previously delivered data; and (iii) an updated manifest file. Each Quarterly Refresh shall conform to the format and specifications set forth in Exhibit A and Exhibit B.
(d) The acceptance procedures set forth in Section 3.2 shall apply to each Quarterly Refresh, mutatis mutandis.
Section 3.4 — Post-Term Quarterly Refreshes
Following the expiration of the Quarterly Refresh Period on June 30, 2027, Licensee may elect to continue receiving Quarterly Refreshes during the remainder of the Initial Term and during any Renewal Term by providing Licensor with written notice of such election no fewer than sixty (60) days prior to the commencement of the first calendar quarter for which such Quarterly Refreshes are desired. If Licensee elects to continue receiving Quarterly Refreshes, Licensee shall pay the Renewal Refresh Fee of Three Hundred Seventy-Five Thousand Dollars ($375,000) per calendar quarter (annualized: One Million Five Hundred Thousand Dollars ($1,500,000) per year), payable within thirty (30) days after the end of each calendar quarter in which a Quarterly Refresh is delivered. The acceptance and delivery procedures set forth in Sections 3.2 and 3.3 shall apply to all post-Quarterly Refresh Period deliveries.
Section 3.5 — Data Format and Specifications
All Data Deliveries, whether the Initial Data Delivery, Quarterly Refreshes, or post-Quarterly Refresh Period deliveries, shall conform to the specifications set forth in Exhibit A (Data Description & Specifications) and Exhibit B (Data Dictionary). The Licensed Data shall include the two hundred forty-seven (247) standardized fields specified in the Data Dictionary. Any material changes to the data format, field definitions, or delivery specifications shall require the prior written consent of both Parties.
ARTICLE IV — LICENSE FEE AND PAYMENT
Section 4.1 — License Fee
In consideration of the license granted by Licensor to Licensee hereunder, and subject to the terms and conditions of this Agreement, Licensee shall pay to Licensor a total license fee of Nine Million Dollars ($9,000,000) (the "License Fee"), payable in accordance with the schedule set forth in Section 4.2.
Section 4.2 — Payment Schedule
The License Fee shall be paid by Licensee to Licensor in three (3) installments as follows:
(a) Signing Payment. Three Million Six Hundred Thousand Dollars ($3,600,000), representing forty percent (40%) of the License Fee, shall be due and payable on the Effective Date (July 1, 2024).
(b) Second Installment. Two Million Seven Hundred Thousand Dollars ($2,700,000), representing thirty percent (30%) of the License Fee, shall be due and payable on January 1, 2025.
(c) Final Installment. Two Million Seven Hundred Thousand Dollars ($2,700,000), representing thirty percent (30%) of the License Fee, shall be due and payable on July 1, 2025.
The aggregate of all installments set forth in this Section 4.2 equals the total License Fee of Nine Million Dollars ($9,000,000).
Section 4.3 — Payment Method
All payments due under this Agreement shall be made by wire transfer of immediately available funds in United States Dollars to a bank account designated by Licensor in a written notice delivered to Licensee at least ten (10) business days prior to the applicable payment due date. Licensor's initial wire transfer instructions shall be provided to Licensee in a separate writing delivered concurrently with the execution of this Agreement.
Section 4.4 — Late Payments
Any amount not paid when due under this Agreement shall accrue interest at a rate of one and one-half percent (1.5%) per month (eighteen percent (18%) per annum), or the maximum rate permitted by Applicable Law, whichever is less, from the date such payment was due until the date such payment is received in full by Licensor. The accrual of interest under this Section 4.4 shall not limit or waive any other rights or remedies available to Licensor under this Agreement or at law or in equity with respect to Licensee's failure to make timely payment.
Section 4.5 — Taxes
The License Fee and all other amounts payable under this Agreement are exclusive of all sales, use, value-added, goods and services, withholding, and similar taxes, duties, levies, and governmental charges (collectively, "Taxes"). Licensee shall be solely responsible for the payment of all Taxes arising in connection with this Agreement, excluding any taxes imposed on Licensor's net income, capital, or franchise. If Licensee is required by Applicable Law to withhold or deduct any Taxes from payments due to Licensor, Licensee shall gross up such payments so that Licensor receives the full amount of the payment that it would have received had no such withholding or deduction been required.
Section 4.6 — No Refunds
Except as expressly provided in Section 8.5(f) (pro rata refund upon termination for cause by Licensee), all fees paid by Licensee under this Agreement are non-refundable and non-creditable. Licensee acknowledges that Licensor's pricing reflects the certainty of the payment obligations set forth herein and that the non-refundable nature of the License Fee was a material inducement for Licensor to enter into this Agreement.
ARTICLE V — INTELLECTUAL PROPERTY OWNERSHIP
Section 5.1 — Licensor Ownership of Licensed Data
As between the Parties, Licensor retains all right, title, and interest in and to the Licensed Data, including all intellectual property rights therein (including any copyrights, database rights, trade secrets, and other proprietary rights). Nothing in this Agreement shall be construed as transferring, conveying, or assigning any ownership interest in or to the Licensed Data to Licensee. Licensee acknowledges that the Licensed Data constitutes valuable proprietary assets of Licensor and that the license granted hereunder does not confer any ownership rights upon Licensee.
Section 5.2 — Licensee Ownership of Derived Works
As between the Parties, Licensee shall own all right, title, and interest in and to all Derived Works created by or on behalf of Licensee (or its Affiliates) using or incorporating the Licensed Data, including all intellectual property rights therein, provided that such Derived Works do not permit reconstruction of the underlying Licensed Data at the individual-Claim-Line level. Licensor shall have no rights in or to any Derived Works, except to the extent necessary for Licensor to enforce the Use Restrictions, the Non-Re-Identification Covenant, and other restrictions set forth in this Agreement. For the avoidance of doubt, Licensee's ownership of Derived Works does not diminish or limit Licensor's ownership of the underlying Licensed Data, and Licensor retains all rights in and to the Licensed Data notwithstanding Licensee's creation of Derived Works.
Section 5.3 — Residual Knowledge
Notwithstanding any other provision of this Agreement, Licensee's personnel (including employees and individual consultants who have executed confidentiality agreements with Licensee containing protections no less restrictive than those set forth herein) who have accessed the Licensed Data in the course of performing Permitted Uses may retain and use Residual Knowledge (i.e., general knowledge, experience, ideas, concepts, know-how, and techniques retained in the unaided memory of such personnel without intentional memorization or reference to tangible or electronic copies of the Licensed Data), provided that such retention and use:
(a) does not violate the Non-Re-Identification Covenant set forth in Section 2.3(b);
(b) does not include the reproduction, reconstruction, or recreation of any portion of the Licensed Data in tangible or electronic form;
(c) does not constitute a misappropriation of Licensor's trade secrets under the Defend Trade Secrets Act (18 U.S.C. § 1836 et seq.) or applicable state trade-secret law; and
(d) is used solely in connection with such personnel's ordinary professional activities.
The Parties acknowledge that this Section 5.3 is not intended to serve as a license to intentionally memorize or systematically extract information from the Licensed Data for the purpose of circumventing the terms of this Agreement.
Section 5.4 — No Implied Licenses
No licenses or rights, whether by implication, estoppel, exhaustion, or otherwise, are granted under this Agreement except as expressly set forth herein. Any rights not specifically and expressly granted herein are reserved to the granting Party.
ARTICLE VI — REPRESENTATIONS AND WARRANTIES
Section 6.1 — Mutual Representations and Warranties
Each Party represents and warrants to the other Party, as of the Effective Date, as follows:
(a) Organization and Good Standing. Such Party is duly organized, validly existing, and in good standing under the laws of the jurisdiction of its formation (Delaware for both Parties) and has all requisite power and authority to own its properties and assets and to conduct its business as presently conducted.
(b) Power and Authority. Such Party has full power and authority to enter into this Agreement and to perform its obligations hereunder, and all corporate, limited liability company, or other actions or proceedings necessary for the due authorization, execution, delivery, and performance of this Agreement have been duly and validly taken.
(c) Due Authorization. The execution, delivery, and performance of this Agreement by such Party have been duly authorized by all necessary corporate or limited liability company action, including any required approval by its board of directors, members, managers, or stockholders, as applicable.
(d) Binding Obligation. This Agreement constitutes a legal, valid, and binding obligation of such Party, enforceable against such Party in accordance with its terms, subject to applicable bankruptcy, insolvency, reorganization, moratorium, or similar laws affecting creditors' rights generally and subject to general principles of equity (regardless of whether enforcement is sought in a proceeding at law or in equity).
(e) No Conflict. The execution, delivery, and performance of this Agreement by such Party do not and will not (i) violate or conflict with the organizational documents of such Party, (ii) violate or conflict with any Applicable Law binding upon such Party, or (iii) result in a breach of, constitute a default under, or require any consent under any material contract, agreement, or instrument to which such Party is a party or by which such Party is bound, except for such consents as have been duly obtained prior to the Effective Date.
Section 6.2 — Licensor's Representations and Warranties
Licensor represents and warrants to Licensee, as of the Effective Date and as of the date of each Data Delivery, as follows:
(a) De-Identification Compliance. All Licensed Data has been de-identified in compliance with the HIPAA Safe Harbor method set forth in 45 C.F.R. § 164.514(b)(2), including the removal or generalization of all eighteen (18) categories of identifiers specified therein. In addition, Licensor has obtained an Expert Determination certification under 45 C.F.R. § 164.514(b)(1) from Ridgeline Statistical Sciences LLC, an independent statistical consultancy with recognized expertise in health data de-identification methodologies, confirming that the risk of re-identification of any individual whose data is included in the Licensed Data is very small, as required under the Expert Determination method.
(b) No PHI. The Licensed Data does not contain any Protected Health Information as defined under HIPAA (45 C.F.R. § 160.103). The Licensed Data is not subject to the requirements of the HIPAA Privacy Rule or Security Rule applicable to covered entities or business associates with respect to PHI.
(c) Rights to License. Licensor has all necessary rights, licenses, consents, and authorizations under its downstream data-contribution agreements with regional health plans and third-party administrators to grant the license contemplated by this Agreement, and the grant of such license does not violate, conflict with, or constitute a breach of any such data-contribution agreement.
(d) No Revocations. As of the Effective Date, no data-contribution source has revoked, terminated, or materially restricted Licensor's right to sublicense or otherwise make available the Licensed Data covered by this Agreement, and Licensor has no knowledge of any pending or threatened revocation, termination, or material restriction of any such right.
(e) Data Specifications. The Licensed Data shall materially conform to the descriptions, specifications, data elements, format requirements, and quality standards set forth in Exhibit A (Data Description & Specifications) and Exhibit B (Data Dictionary).
(f) Record Count. The Licensed Data includes no fewer than eighty-five million (85,000,000) unique de-identified patient tokens (records) and approximately three billion four hundred million (3,400,000,000) individual Claim Lines, in each case as of the date of the Initial Data Delivery.
(g) Non-Infringement. To Licensor's knowledge, the Licensed Data and Licensee's use thereof in accordance with this Agreement will not infringe, misappropriate, or otherwise violate any intellectual property rights, proprietary rights, contractual rights, or other rights of any third party.
(h) Compliance with Law. Licensor has complied in all material respects with all Applicable Law in connection with its collection, aggregation, de-identification, processing, storage, and licensing of the Licensed Data, including all applicable provisions of HIPAA, state health-information privacy laws, and the FTC Act § 5.
Section 6.3 — Licensee's Representations and Warranties
Licensee represents and warrants to Licensor, as of the Effective Date and on a continuing basis throughout the Term, as follows:
(a) Non-Re-Identification. Licensee shall not attempt to re-identify, directly or indirectly, any individual whose data is included in the Licensed Data, whether by linking, matching, combining, inferring, reverse-engineering, or any other method, and Licensee shall contractually bind all personnel, contractors, and Affiliates with access to the Licensed Data to comply with this obligation.
(b) Security Safeguards. Licensee shall implement and maintain administrative, technical, and physical safeguards that are consistent with NIST SP 800-171 and that comply with the Data Security Requirements set forth in Exhibit C, throughout the Term and for so long as Licensee retains any copies of the Licensed Data.
(c) No Unauthorized Transfer. Licensee shall not sublicense, sell, rent, lease, distribute, disclose, publish, or otherwise transfer the raw Licensed Data (as distinct from Derived Works) to any third party without the prior written consent of Licensor.
(d) Compliance with Law. Licensee shall comply in all material respects with all Applicable Law in connection with its receipt, access, use, processing, storage, and destruction of the Licensed Data.
Section 6.4 — Disclaimer
EXCEPT AS EXPRESSLY SET FORTH IN THIS ARTICLE VI, NEITHER PARTY MAKES ANY REPRESENTATION OR WARRANTY OF ANY KIND, WHETHER EXPRESS, IMPLIED, STATUTORY, OR OTHERWISE, INCLUDING ANY IMPLIED WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, TITLE, NON-INFRINGEMENT, ACCURACY, COMPLETENESS, OR QUALITY. LICENSOR DOES NOT WARRANT THAT THE LICENSED DATA WILL BE ERROR-FREE, UNINTERRUPTED, OR FREE FROM DEFECTS, OR THAT THE LICENSED DATA WILL MEET LICENSEE'S SPECIFIC REQUIREMENTS OR EXPECTATIONS. LICENSEE ACKNOWLEDGES THAT IT HAS CONDUCTED ITS OWN DUE DILIGENCE WITH RESPECT TO THE LICENSED DATA AND IS NOT RELYING ON ANY REPRESENTATION OR WARRANTY OF LICENSOR EXCEPT AS EXPRESSLY SET FORTH IN THIS AGREEMENT.
ARTICLE VII — DATA SECURITY AND COMPLIANCE
Section 7.1 — Data Security Requirements
Licensee shall comply with the Data Security Requirements set forth in Exhibit C, which are aligned with NIST SP 800-171, throughout the Term and for so long as Licensee retains any copies of the Licensed Data. Without limiting the generality of the foregoing or the specific requirements of Exhibit C, Licensee shall implement and maintain the following security measures with respect to the Licensed Data:
(a) Encryption. AES-256 encryption for all Licensed Data at rest (including on servers, workstations, portable storage devices, and backup media) and in transit (including during Data Deliveries and any internal data transfers).
(b) Access Controls. Role-based access controls limiting access to the Licensed Data to authorized personnel on a need-to-know basis, with unique user identifiers and strong password requirements.
(c) Multi-Factor Authentication. Multi-factor authentication for all personnel accessing systems that store or process the Licensed Data.
(d) Logging and Audit Trails. Comprehensive logging and audit-trail mechanisms that record all access to, and modifications of, the Licensed Data, with logs retained for a minimum period of twelve (12) months.
(e) Incident-Response Procedures. Documented incident-response procedures for identifying, containing, investigating, and remediating Security Incidents.
(f) Data Retention and Destruction. Data-retention and destruction protocols ensuring the secure deletion or destruction of Licensed Data upon expiration or termination of this Agreement, in accordance with Section 8.5(b), using methods consistent with NIST SP 800-88, Guidelines for Media Sanitization.
(g) Employee Training. Regular training for all personnel with access to the Licensed Data regarding data-security best practices, the Use Restrictions, and the Non-Re-Identification Covenant.
(h) Subcontractor Management. Licensee shall ensure that any subcontractor or service provider that accesses, processes, or stores the Licensed Data on Licensee's behalf has implemented security measures that are no less protective than those required under this Agreement and Exhibit C, and that such subcontractor or service provider has entered into a written agreement with Licensee containing data-protection obligations substantially similar to those set forth herein.
Section 7.2 — Incident Notification
In the event of any actual or reasonably suspected Security Incident involving the Licensed Data, Licensee shall:
(a) Notify Licensor in writing within seventy-two (72) hours of becoming aware of such Security Incident, providing a description of the nature and scope of the incident, the categories and approximate number of records affected, the likely consequences of the incident, and the steps taken or proposed to be taken to investigate and mitigate the incident.
(b) Designate a knowledgeable contact person who shall be available to Licensor to answer questions and provide updates regarding the Security Incident.
(c) Take all commercially reasonable steps to contain, investigate, and remediate the Security Incident, and to prevent any recurrence thereof.
(d) Cooperate with Licensor in connection with any investigation, notification, or remediation activities related to the Security Incident, including providing Licensor with regular written updates on the status of the investigation and remediation efforts.
(e) Not make any public statement or regulatory filing regarding the Security Incident that references Licensor or the Licensed Data without Licensor's prior written consent (not to be unreasonably withheld, conditioned, or delayed), except to the extent required by Applicable Law.
Section 7.3 — Audit Rights
(a) Licensor shall have the right to audit Licensee's compliance with the data-use restrictions set forth in Article II, the Data Security Requirements set forth in Exhibit C, and the other data-protection obligations set forth in this Agreement.
(b) Audits shall be limited to no more than one (1) audit per calendar year, unless a prior audit has revealed a material breach or a Security Incident has occurred, in which case Licensor may conduct one (1) additional audit within the same calendar year.
(c) Licensor shall provide at least thirty (30) days' prior written notice before conducting an audit, specifying the scope of the audit and the anticipated duration.
(d) Audits shall be conducted by an independent third-party auditor mutually agreed upon by the Parties. In the event the Parties are unable to agree on an auditor within fifteen (15) business days of Licensor's audit notice, the default auditor shall be Crestfield Advisory Group LLP, or its successor firm.
(e) Licensee shall cooperate fully with the auditor and provide reasonable access to relevant records, systems, facilities, and personnel during normal business hours, subject to reasonable confidentiality protections for Licensee's proprietary information and systems.
(f) The costs and expenses of each audit shall be borne by Licensor; provided, however, that if any audit reveals a material breach by Licensee of its obligations under this Agreement (including the Use Restrictions, the Non-Re-Identification Covenant, or the Data Security Requirements), Licensee shall reimburse Licensor for the reasonable costs and expenses of such audit within thirty (30) days after receipt of an invoice therefor.
(g) Following each audit, the auditor shall provide a written report of its findings to both Parties. If the audit identifies any deficiency or non-compliance, Licensee shall develop and implement a remediation plan within thirty (30) days after receipt of the audit report, and Licensor shall have the right to verify the implementation of such remediation plan.
Section 7.4 — Regulatory Compliance
(a) Each Party shall comply with all Applicable Law in connection with its performance of its obligations under this Agreement, including HIPAA, Massachusetts data-privacy laws (M.G.L. c. 93H and 201 CMR 17.00 et seq.), the California Confidentiality of Medical Information Act (Cal. Civ. Code § 56 et seq.) (to the extent the Licensed Data includes California-sourced claims), and FTC Act § 5.
(b) To the extent any Applicable Law enacted or promulgated after the Effective Date imposes obligations on the handling, processing, or use of de-identified data that are more restrictive than the terms of this Agreement, the Parties shall cooperate in good faith to implement necessary modifications to this Agreement or to the Parties' respective practices in order to ensure compliance with such Applicable Law. Any such modifications to this Agreement shall be documented in a written amendment executed by both Parties in accordance with Section 14.4.
(c) Each Party shall promptly notify the other Party in writing upon becoming aware of any regulatory inquiry, investigation, enforcement action, or litigation by any governmental authority relating to the Licensed Data or the transactions contemplated by this Agreement.
ARTICLE VIII — TERM AND TERMINATION
Section 8.1 — Initial Term
This Agreement shall commence on the Effective Date (July 1, 2024) and shall continue in full force and effect for an initial period of five (5) years, expiring on June 30, 2029 (the "Initial Term"), unless earlier terminated in accordance with the provisions of this Article VIII.
Section 8.2 — Renewal Terms
(a) Licensee shall have the option to renew this Agreement for up to two (2) successive renewal terms of two (2) years each (each, a "Renewal Term"; the first Renewal Term, if exercised, running from July 1, 2029 through June 30, 2031, and the second Renewal Term, if exercised, running from July 1, 2031 through June 30, 2033).
(b) To exercise a Renewal Term, Licensee must provide Licensor with written notice of its intention to renew no fewer than one hundred eighty (180) days prior to the expiration of the then-current Term (i.e., no later than January 2, 2029 for the first Renewal Term, and no later than January 2, 2031 for the second Renewal Term).
(c) Each Renewal Term shall be on the same terms and conditions as the Initial Term, except that: (i) Quarterly Refreshes during any Renewal Term shall be subject to the payment of the Renewal Refresh Fee in accordance with Section 3.4; and (ii) the license fee for the Renewal Term, if any, shall be as mutually agreed by the Parties in writing no fewer than ninety (90) days prior to the commencement of such Renewal Term. In the absence of mutual agreement on a separate license fee for the Renewal Term, the Parties' rights and obligations with respect to the Licensed Data previously delivered shall continue under the existing terms, and the Renewal Refresh Fee structure set forth in Section 3.4 shall apply to any Quarterly Refreshes delivered during such Renewal Term.
Section 8.3 — Termination for Convenience by Licensee
After the first anniversary of the Effective Date (i.e., after July 1, 2025), Licensee may terminate this Agreement for convenience upon ninety (90) days' prior written notice to Licensor. No refund of any fees previously paid by Licensee shall be due upon termination for convenience under this Section 8.3, and Licensee shall remain obligated to pay any installments of the License Fee that became due prior to the effective date of such termination.
Section 8.4 — Termination for Cause
Either Party may terminate this Agreement upon written notice to the other Party if:
(a) Material Breach. The other Party commits a material breach of any provision of this Agreement and fails to cure such breach within thirty (30) days after receipt of written notice from the non-breaching Party specifying the breach in reasonable detail. If the nature of the breach is such that it cannot reasonably be cured within thirty (30) days, the breaching Party shall not be in default if it commences cure within such thirty (30) day period and thereafter diligently prosecutes the cure to completion, provided that the total cure period shall not exceed ninety (90) days without the prior written consent of the non-breaching Party.
(b) Insolvency. The other Party (i) becomes insolvent or is generally unable to pay its debts as they become due, (ii) files, or has filed against it, a petition in bankruptcy or a petition for reorganization under any bankruptcy or insolvency law that is not dismissed within sixty (60) days of filing, (iii) makes a general assignment for the benefit of creditors, (iv) has a receiver, trustee, or liquidator appointed for substantially all of its property or assets, or (v) ceases to conduct business in the ordinary course.
Section 8.5 — Effect of Termination