1010-00006 · Hargrove, Delacroix & Stein LLP · Transaction Documents

exhibit-a-data-description.docx DOCUMENT Funds

10 / 12 ← → ✕

Contract analysis Extract to table

EXHIBIT A

Data Description & Specifications

Exhibit A to the Data License Agreement Reference No. AHT-PCA-DLA-2024-001

Effective Date: July 1, 2024

Parties:

Pinnacle Claims Analytics LLC ("Licensor" or "PCA"), a Delaware limited liability company

Arbor Health Technologies Inc. ("Licensee" or "AHT"), a Delaware corporation

This Exhibit A is attached to and incorporated by reference into the Data License Agreement dated as of July 1, 2024 (the "Agreement"), by and between Pinnacle Claims Analytics LLC, a Delaware limited liability company, and Arbor Health Technologies Inc., a Delaware corporation. Capitalized terms used but not defined herein shall have the meanings ascribed to them in the Agreement. All references to "Sections" in this Exhibit A refer to sections of this Exhibit A unless otherwise indicated.

Section 1: Overview of the Licensed Data

The Licensed Data consists of a longitudinal dataset of de-identified healthcare claims data aggregated, de-identified, and maintained by PCA pursuant to downstream data-contribution agreements with regional health plans and third-party administrators. PCA has compiled the Licensed Data from multiple contributing data sources across the United States, and has applied standardized data-processing, normalization, and de-identification procedures to ensure consistency, interoperability, and compliance with applicable federal and state privacy laws.

The Licensed Data covers eight (8) full calendar years, from January 1, 2016 through December 31, 2023 (the "Data Period"). The longitudinal nature of the Licensed Data enables observation of healthcare utilization patterns, treatment trajectories, disease progression, and cost trends at the individual de-identified patient level across multiple years, subject to enrollment continuity within contributing data sources.

The Licensed Data contains records from the following lines of business: commercial (employer-sponsored and individual market), Medicare Advantage, and Medicaid managed-care. These lines of business collectively represent a broad cross-section of the insured population in the United States and provide AHT with a multi-payer view of healthcare claims activity across diverse demographic and clinical populations.

The Licensed Data includes no Protected Health Information ("PHI") as defined under the Health Insurance Portability and Accountability Act of 1996, as amended ("HIPAA"), and the regulations promulgated thereunder at 45 C.F.R. Parts 160 and 164. The de-identification methodology applied to the Licensed Data is described in detail in Section 5 of this Exhibit A. PCA represents that the Licensed Data, as delivered, constitutes de-identified information within the meaning of 45 C.F.R. § 164.514(a) and is therefore not subject to the use and disclosure restrictions applicable to PHI under the HIPAA Privacy Rule.

Section 2: Record Counts and Data Volume

2.1 Unique De-Identified Patient Tokens

The Licensed Data contains no fewer than eighty-five million (85,000,000) unique de-identified patient tokens (each, a "Patient Token"). This minimum count applies as of the initial delivery date and reflects the cumulative universe of unique de-identified individuals represented across all contributing data sources and all lines of business during the Data Period.

Each Patient Token is a synthetic, non-reversible identifier assigned to a unique de-identified individual in the dataset. Patient Tokens are generated using a one-way cryptographic hashing algorithm that does not permit derivation, reverse engineering, or inference of any direct or indirect patient identifier, including but not limited to name, date of birth, Social Security number, health plan beneficiary number, or medical record number. Patient Tokens are consistent within the Licensed Data across claims categories, lines of business, and calendar years, thereby enabling longitudinal linkage of a given de-identified individual's claims history across time and care settings without compromising patient privacy.

Patient Tokens do not correspond to or permit derivation of any direct or indirect patient identifier, and PCA does not provide AHT with any crosswalk, lookup table, or other mechanism that could be used to re-identify any individual represented by a Patient Token. AHT acknowledges and agrees that any attempt to re-identify individuals represented in the Licensed Data is strictly prohibited under the terms of the Agreement.

2.2 Individual Claim Lines

The Licensed Data contains approximately three billion four hundred million (3,400,000,000) individual claim lines, representing an average of approximately forty (40) claim lines per Patient Token across the Data Period. Individual claim lines include service-level detail for professional, facility, pharmacy, and ancillary claims as further described in Section 3 of this Exhibit A.

Claim-line counts are approximate and may vary across quarterly refreshes as additional claims adjudication and data-quality corrections occur. Factors that may cause claim-line counts to fluctuate include, without limitation: (a) late-arriving claims from contributing data sources; (b) retroactive claim adjustments, voids, and replacements; (c) data-quality corrections applied by PCA during routine quality-assurance processes; and (d) the addition of new contributing data sources during the term of the Agreement. PCA shall provide updated cumulative claim-line counts in the manifest file accompanying each quarterly refresh delivery as described in Section 8.2(d) of this Exhibit A.

Section 3: Claims Categories

The Licensed Data encompasses the following categories of healthcare claims, collectively referred to as the "Claims Categories." Each Claims Category is described below, together with the applicable coding systems, data elements, and scope of coverage.

3.1 Professional Claims (Part B)

The Licensed Data includes physician and other professional services claims, including but not limited to evaluation and management services, surgical procedures, diagnostic testing, therapeutic procedures, consultations, preventive care services, and other outpatient professional services rendered by physicians, nurse practitioners, physician assistants, psychologists, therapists, and other licensed healthcare professionals.

Professional claims are coded using Current Procedural Terminology (CPT®) and Healthcare Common Procedure Coding System (HCPCS) Level II codes. CPT® codes are maintained by the American Medical Association and are the standard code set for reporting medical, surgical, and diagnostic procedures and services performed by physicians and other qualified healthcare professionals. HCPCS Level II codes are maintained by the Centers for Medicare & Medicaid Services and are used to identify products, supplies, and services not included in the CPT® code set.

Professional claims in the Licensed Data include the following associated data elements: diagnosis codes assigned using the International Classification of Diseases, 10th Revision, Clinical Modification (ICD-10-CM); place-of-service codes identifying the setting in which the service was rendered; rendering and referring provider specialty codes; procedure modifier codes; units of service; and allowed and paid amounts that have been de-identified and normalized in accordance with PCA's standard financial normalization methodology. Financial normalization adjusts allowed and paid amounts to remove plan-specific pricing variations while preserving relative cost differentials across services, providers, and geographies.

3.2 Facility Claims (Part A)

The Licensed Data includes institutional claims from the following facility types: acute-care hospitals (inpatient and outpatient), skilled nursing facilities, inpatient rehabilitation facilities, long-term acute-care hospitals, home health agencies, and hospice providers. Facility claims capture both inpatient admissions and outpatient encounters occurring in institutional settings.

Facility claims are coded using ICD-10-CM diagnosis codes and, for inpatient procedures, ICD-10-PCS (Procedure Coding System) procedure codes. Additionally, facility claims include Diagnosis Related Group (DRG) assignments reflecting the classification of inpatient stays for purposes of prospective payment; revenue codes identifying the nature and department of services rendered; and UB-04 (CMS-1450) form fields capturing institutional claim-level information such as type of bill, condition codes, occurrence codes, and value codes.

Facility claims in the Licensed Data include admission and discharge dates that have been shifted per the de-identification protocol described in Section 5.3 of this Exhibit A. Length of stay is preserved as a calculated field (number of days between shifted admission and discharge dates). Facility-level de-identified identifiers are provided as synthetic facility tokens, enabling analysis of utilization patterns and referral networks at the institutional level without disclosing actual facility identity. Provider specialty codes and facility type indicators are retained in their original form.

3.3 Pharmacy Claims (Part D)

The Licensed Data includes outpatient prescription drug claims, encompassing retail pharmacy dispensing events, mail-order pharmacy dispensing events, and specialty pharmacy dispensing events. Pharmacy claims capture the dispensing of prescription medications to de-identified individuals represented in the Licensed Data.

Pharmacy claims are coded using National Drug Code (NDC) identifiers, which are unique 11-digit codes assigned by the U.S. Food and Drug Administration to identify specific drug products, including the labeler, product, and trade package size. Additional pharmacy claim data elements include: days' supply (the number of days the dispensed quantity is intended to last); quantity dispensed (the metric quantity of the drug product dispensed); therapeutic class codes (including both Generic Product Identifier (GPI) and Anatomical Therapeutic Chemical (ATC) classification codes); generic and brand indicators distinguishing between generic, branded, and branded-generic drug products; formulary status indicators where available; dispensing pharmacy type (retail, mail-order, specialty); and allowed and paid amounts that have been de-identified and normalized consistent with the methodology applied to professional and facility claims.

3.4 Ancillary Claims

The Licensed Data includes claims for ancillary services not classified under Sections 3.1 through 3.3. Ancillary claims encompass the following service types: laboratory services (clinical and pathology), radiology and diagnostic imaging services (including X-ray, CT, MRI, PET, and ultrasound), durable medical equipment (DME) and prosthetics/orthotics/supplies, ambulance and medical transport services, and other ancillary services such as hearing and vision services.

Ancillary claims are coded using CPT®, HCPCS Level II codes, and applicable modifier codes that further specify the nature, location, or circumstances of the service rendered. Ancillary claims include associated diagnosis codes (ICD-10-CM), units of service, and allowed and paid amounts (de-identified and normalized). Where applicable, ancillary claims include HCPCS modifier codes that distinguish, for example, between technical and professional components of diagnostic services, or between left and right anatomical sites for bilateral procedures.

Section 4: Lines of Business

The Licensed Data includes claims originating from the following payer lines of business. Each line of business is identified at the claim level through a de-identified synthetic plan token and a plan line-of-business indicator, enabling AHT to segment and analyze the Licensed Data by payer type.

4.1 Commercial. The commercial line of business includes claims originating from employer-sponsored group health plans, encompassing both fully insured plans and self-funded (administrative services only, or "ASO") arrangements, as well as claims originating from individual-market plans, including plans offered through the Health Insurance Marketplace (exchange) and off-exchange individual policies. The commercial line of business represents the largest share of Patient Tokens in the Licensed Data, reflecting the predominance of employer-sponsored coverage in PCA's contributing data-source portfolio. Commercial claims span a broad demographic range, including working-age adults, dependents, and early retirees.

4.2 Medicare Advantage

The Medicare Advantage line of business includes claims originating from Medicare Advantage (Part C) plans, encompassing Health Maintenance Organization (HMO), Preferred Provider Organization (PPO), and Private Fee-for-Service (PFFS) plan types. Medicare Advantage claims in the Licensed Data reflect the healthcare utilization of enrolled beneficiaries aged sixty-five (65) and older, as well as individuals under sixty-five who qualify for Medicare on the basis of disability or end-stage renal disease. The Licensed Data includes associated Part D (pharmacy) claims for Medicare Advantage enrollees where such data is available from contributing data sources. The Medicare Advantage population provides AHT with insight into the healthcare utilization and cost patterns of the elderly and disabled populations.

4.3 Medicaid Managed Care

The Medicaid managed-care line of business includes claims originating from state Medicaid managed-care organization (MCO) plans across multiple states. The Medicaid managed-care population includes low-income adults, children, pregnant women, individuals with disabilities, and other populations eligible for Medicaid coverage under federal and state law. The Licensed Data includes both fee-for-service equivalent claims and capitated encounter data where reported by contributing plans. AHT acknowledges that the completeness and granularity of Medicaid managed-care data may vary by state and by contributing MCO, reflecting differences in state reporting requirements, encounter-data submission standards, and MCO data-management practices. PCA does not warrant uniform coverage across all fifty states for the Medicaid managed-care line of business.

Section 5: De-Identification Methodology

PCA has applied a comprehensive de-identification methodology to all Licensed Data prior to delivery. The de-identification methodology is designed to ensure compliance with applicable federal and state privacy laws, including HIPAA, and to render the Licensed Data unsuitable for the identification of any individual whose claims are represented therein. The de-identification methodology includes the following components:

5.1 HIPAA Safe Harbor Standard

All Licensed Data has been de-identified in compliance with the HIPAA Safe Harbor method as set forth in 45 C.F.R. § 164.514(b)(2). Pursuant to the Safe Harbor method, all eighteen (18) categories of identifiers specified in 45 C.F.R. § 164.514(b)(2)(i)(A)–(R) have been removed or generalized from the Licensed Data. The categories of identifiers that have been removed or generalized include, but are not limited to, the following:

(A) Names;

(B) All geographic subdivisions smaller than a state, including street address, city, county, precinct, ZIP code, and their equivalent geocodes, except for the initial three digits of a ZIP code if, according to the current publicly available data from the Bureau of the Census, the geographic unit formed by combining all ZIP codes with the same three initial digits contains more than 20,000 persons (and the initial three digits of a ZIP code for all such geographic units containing 20,000 or fewer persons is changed to "000");

(C) All elements of dates (except year) for dates directly related to an individual, including birth date, admission date, discharge date, date of death, and all ages over 89 and all elements of dates (including year) indicative of such age (such ages and elements are aggregated into a single category of age 90 or older);

(D) Telephone numbers;

(E) Fax numbers;

(F) Electronic mail addresses;

(G) Social Security numbers;

(H) Medical record numbers;

(I) Health plan beneficiary numbers;

(J) Account numbers;

(K) Certificate/license numbers;

(L) Vehicle identifiers and serial numbers, including license plate numbers;

(M) Device identifiers and serial numbers;

(N) Web Universal Resource Locators (URLs);

(O) Internet Protocol (IP) address numbers;

(P) Biometric identifiers, including finger and voice prints;

(Q) Full face photographic images and any comparable images; and

(R) Any other unique identifying number, characteristic, or code, except as permitted by 45 C.F.R. § 164.514(c) for purposes of re-identification by the covered entity.

PCA has no actual knowledge that the remaining information in the Licensed Data could be used, alone or in combination with other reasonably available information, to identify an individual who is a subject of the Licensed Data. PCA represents that it has implemented and maintains policies and procedures reasonably designed to ensure that the Licensed Data, as delivered and as refreshed, continues to meet the requirements of the Safe Harbor method.

5.2 Expert Determination Certification

In addition to compliance with the Safe Harbor method described in Section 5.1, PCA has obtained an Expert Determination certification pursuant to 45 C.F.R. § 164.514(b)(1). The Expert Determination provides an additional layer of assurance that the Licensed Data does not present a reasonably foreseeable risk of individual re-identification.

The Expert Determination was performed by Ridgeline Statistical Sciences LLC, an independent statistical consultancy located at 1750 Tysons Boulevard, Suite 600, McLean, VA 22102 (the "Expert"). The Expert is qualified by education, training, and experience in the application of generally accepted statistical and scientific principles and methods for rendering information not individually identifiable.

The Expert applied generally accepted statistical and scientific principles and methods, including but not limited to analysis of population uniqueness, assessment of quasi-identifier combinations, evaluation of data linkage risks, and sensitivity testing against external data sources. Based on this analysis, the Expert determined that the risk is very small that the Licensed Data could be used, alone or in combination with other reasonably available information, by an anticipated recipient to identify an individual who is a subject of the information. The Expert documented the methods and results of the analysis supporting this determination.

PCA shall make a copy of the Expert's written certification and methodology report available to AHT upon reasonable request, subject to any confidentiality restrictions imposed by the Expert. AHT acknowledges that the Expert's report may be designated as confidential by the Expert or by PCA and that AHT's access to and use of such report shall be subject to the confidentiality provisions of the Agreement.

5.3 Date Shifting

All date fields in the Licensed Data, including but not limited to service dates, admission dates, discharge dates, claim receipt dates, claim paid dates, and birth year, have been shifted using a consistent per-patient random offset of plus or minus three hundred sixty-five (±365) days. The date-shifting methodology is applied as follows:

(a) A single random integer between negative three hundred sixty-five (-365) and positive three hundred sixty-five (+365) is generated for each Patient Token.

(b) The same offset is applied uniformly to all date fields associated with that Patient Token across all claims categories and all calendar years within the Licensed Data.

(c) This approach preserves the chronological ordering and relative timing of events within each Patient Token's longitudinal record (e.g., the interval between an inpatient admission and a follow-up office visit is preserved), while preventing re-identification through correlation of dates in the Licensed Data with dates in external data sources.

Only the year component of dates of birth is retained in the Licensed Data; month and day of birth are removed entirely. For individuals aged ninety (90) or older at any point during the Data Period, the year of birth is generalized to indicate an age category of "90+" in accordance with the HIPAA Safe Harbor standard.

5.4 Geographic Generalization

Geographic data in the Licensed Data has been generalized to the three-digit ZIP code level. The three-digit ZIP code is the broadest sub-state geographic indicator retained in the Licensed Data and corresponds to the first three digits of the five-digit ZIP code of the individual's residence or the service location, as applicable.

In cases where a three-digit ZIP code area contains fewer than twenty thousand (20,000) persons according to the most recent U.S. Census (currently the 2020 Decennial Census), the geographic indicator is set to "000" in accordance with 45 C.F.R. § 164.514(b)(2)(i)(B). This generalization applies to both patient-residence and service-location geographic fields. PCA maintains a reference table of suppressed three-digit ZIP codes based on the applicable Census population thresholds, and this table is updated when new Census data becomes available.

5.5 Provider and Plan Identifiers

All provider identifiers in the Licensed Data, including National Provider Identifiers (NPIs), Tax Identification Numbers (TINs), and Drug Enforcement Administration (DEA) numbers, have been replaced with de-identified synthetic provider tokens. Each synthetic provider token is a non-reversible identifier that is consistent across the Licensed Data, enabling AHT to analyze provider-level utilization patterns and referral networks without disclosing the actual identity of any healthcare provider.

All health plan identifiers in the Licensed Data have been replaced with de-identified synthetic plan tokens. Each synthetic plan token is a non-reversible identifier that is consistent across the Licensed Data, enabling AHT to analyze plan-level utilization patterns and cost trends without disclosing the actual identity of any contributing health plan.

Notwithstanding the replacement of direct provider and plan identifiers, the following descriptive fields are retained in their original form: provider specialty codes (as reported on the original claim), facility type indicators (e.g., acute-care hospital, skilled nursing facility), and plan line-of-business indicators (e.g., commercial, Medicare Advantage, Medicaid managed care). These descriptive fields do not, individually or in combination, identify a specific provider or health plan.

Section 6: Data Dictionary Reference

The field-level specification of all data elements contained in the Licensed Data is set forth in Exhibit B (Data Dictionary) to the Agreement. The Data Dictionary provides comprehensive technical documentation of the Licensed Data schema and is intended to serve as the primary reference for AHT's data engineering, analytics, and data science teams in connection with the ingestion, validation, and utilization of the Licensed Data.

The Data Dictionary contains two hundred forty-seven (247) standardized fields organized by Claims Category (Professional, Facility, Pharmacy, Ancillary) and data domain (demographics, enrollment, clinical, financial, provider, plan). For each field, the Data Dictionary specifies the following attributes: field name, field description, data type (e.g., string, integer, decimal, date, boolean), field length or precision, format mask or pattern, allowable values or value set reference, null/missing-value conventions, and any applicable business rules or derivation logic.

In the event of any inconsistency between this Exhibit A and the Data Dictionary in Exhibit B, the following hierarchy of control shall apply: the Data Dictionary (Exhibit B) shall control with respect to field-level specifications, including field names, data types, formats, and allowable values; and this Exhibit A shall control with respect to general data descriptions, volume commitments, de-identification methodology, delivery specifications, data quality standards, and all other matters not specifically addressed at the field level in the Data Dictionary.

Section 7: Data Delivery Specifications

7.1 Data Format

All Licensed Data shall be delivered in Apache Parquet columnar storage format. Apache Parquet is an open-source, column-oriented data file format designed for efficient data storage and retrieval, and is widely supported by modern data-processing frameworks including Apache Spark, Apache Hadoop, Amazon Athena, Severin Industries BigQuery, and Snowflake, among others.

Parquet files shall be organized by Claims Category (Professional, Facility, Pharmacy, Ancillary) and calendar year, with one or more partitioned files per category per year. File partitioning shall be performed in a manner that balances file size for efficient parallel ingestion, with individual Parquet files targeted at a size between five hundred megabytes (500 MB) and two gigabytes (2 GB) each, uncompressed. Parquet files shall use Snappy compression as the default compression codec unless otherwise agreed in writing by the parties.

Each delivery (whether initial or quarterly refresh) shall be accompanied by a manifest file in comma-separated values (CSV) format. The manifest file shall list all delivered files and shall include, for each file, the following metadata: (i) file name; (ii) Claims Category; (iii) calendar year; (iv) row count; (v) file size (in bytes); (vi) SHA-256 checksum; and (vii) file creation timestamp (in UTC). The manifest file enables AHT to validate the integrity and completeness of each delivery programmatically.

7.2 Delivery Method

Data shall be transmitted via encrypted Secure File Transfer Protocol (SFTP) using AES-256 encryption for data in transit. All data transmitted between PCA's SFTP endpoint and AHT's designated receiving systems shall be encrypted using Transport Layer Security (TLS) version 1.2 or higher in addition to the underlying SFTP encryption.

PCA shall provision a dedicated SFTP endpoint for AHT's exclusive use and shall provide AHT with access credentials (username, password, and/or SSH key pair) no later than five (5) business days after the Effective Date. The SFTP endpoint shall be available twenty-four (24) hours per day, seven (7) days per week, subject to scheduled maintenance windows of which PCA shall provide AHT not less than forty-eight (48) hours' prior written notice.

AHT shall designate authorized recipients for SFTP access by providing PCA with the name, title, email address, and IP address (or IP address range) of each authorized individual or system. AHT's designation of authorized recipients shall be subject to the data security requirements set forth in Exhibit C (Data Security Requirements) to the Agreement. AHT may update its list of authorized recipients at any time by providing written notice to PCA, and PCA shall implement such updates within two (2) business days of receipt.

7.3 Initial Data Delivery

PCA shall deliver the complete initial Licensed Data, covering the full Data Period of January 1, 2016 through December 31, 2023, within thirty (30) calendar days of the Effective Date. Based on the Effective Date of July 1, 2024, the initial delivery deadline is July 31, 2024.

The initial delivery shall include all Patient Tokens, all claim lines across all Claims Categories (Professional, Facility, Pharmacy, Ancillary), all lines of business (Commercial, Medicare Advantage, Medicaid Managed Care), and all fields specified in the Data Dictionary (Exhibit B). The initial delivery shall be accompanied by the manifest file described in Section 7.1 and shall conform to the data format specifications set forth therein.

PCA shall provide AHT with written notice (via email to AHT's designated data-operations contact) upon completion of the initial data delivery, confirming that all files have been uploaded to the SFTP endpoint and are available for download.

7.4 Data Acceptance

AHT shall have fourteen (14) calendar days following receipt of the initial data delivery (the "Acceptance Period") to review the Licensed Data for completeness, format compliance, and material conformity with the specifications set forth in this Exhibit A and in the Data Dictionary (Exhibit B). During the Acceptance Period, AHT may perform automated and manual validation procedures, including but not limited to: verification of file counts and row counts against the manifest file; SHA-256 checksum validation; schema validation against the Data Dictionary; spot-check validation of data-element values and distributions; and confirmation of minimum Patient Token counts and approximate claim-line volumes.

The Acceptance Period for the initial delivery expires on August 14, 2024, assuming delivery on July 31, 2024. If the initial delivery is made prior to July 31, 2024, the Acceptance Period shall run from the actual date of delivery (as confirmed by PCA's delivery notice) and shall expire fourteen (14) calendar days thereafter.

If AHT identifies material non-conformities during the Acceptance Period, AHT shall deliver a written deficiency notice to PCA specifying the nature of each non-conformity in reasonable detail, including, where practicable, the affected files, fields, or records and the manner in which the delivered data deviates from the applicable specifications. PCA shall use commercially reasonable efforts to cure any such deficiency within fifteen (15) business days of receipt of the deficiency notice. Upon cure and re-delivery of the corrected data, a new fourteen (14) calendar-day Acceptance Period shall commence, during which AHT may review the corrected data for conformity with the specifications and for resolution of the previously identified deficiencies.

If AHT does not deliver a deficiency notice within the Acceptance Period, the Licensed Data shall be deemed accepted ("Accepted") as of the expiration of the Acceptance Period. Acceptance of the Licensed Data shall not constitute a waiver of any warranty, representation, or indemnification obligation of PCA under the Agreement.

Section 8: Quarterly Data Refreshes

8.1 Refresh Schedule

For a period of thirty-six (36) months following the Effective Date (i.e., from July 1, 2024 through June 30, 2027), PCA shall deliver quarterly data refreshes to AHT (each, a "Quarterly Refresh"). The Quarterly Refresh cycle shall align with standard calendar quarters.

Each Quarterly Refresh shall be delivered within fifteen (15) business days after the end of each calendar quarter. Accordingly, the applicable delivery deadlines are as follows:

• Q3 2024 Refresh (covering July 1, 2024 – September 30, 2024): delivery by approximately October 22, 2024;

• Q4 2024 Refresh (covering October 1, 2024 – December 31, 2024): delivery by approximately January 22, 2025;

• Subsequent Quarterly Refreshes following the same cadence through and including the Q2 2027 Refresh (covering April 1, 2027 – June 30, 2027): delivery by approximately July 22, 2027.

Exact delivery deadlines will depend on the number of business days in each applicable period, accounting for weekends and federal holidays observed by PCA.

8.2 Refresh Content

Each Quarterly Refresh shall include the following components:

(a) New Claim Lines. All new claim lines adjudicated during the preceding calendar quarter across all Claims Categories (Professional, Facility, Pharmacy, Ancillary) and all lines of business (Commercial, Medicare Advantage, Medicaid Managed Care). New claim lines include claims with dates of service falling within or prior to the preceding calendar quarter that were adjudicated (i.e., processed to a final paid, denied, or adjusted status) by the contributing data source during the preceding calendar quarter.

(b) Corrections and Adjustments. Corrections, adjustments, and retroactive claim amendments applied during the preceding calendar quarter to previously delivered claim lines. Such corrections and adjustments shall be identified via adjustment reason codes and shall include sufficient information to enable AHT to match the corrected record to the corresponding previously delivered claim line (e.g., original claim identifier, adjustment type indicator).

(c) New Patient Tokens. New Patient Tokens, if any, resulting from newly enrolled or newly contributing members during the preceding quarter. New Patient Tokens may arise from the enrollment of new members in contributing health plans or from the onboarding of new contributing data sources by PCA during the term of the Agreement.

(d) Updated Manifest File. An updated manifest file reflecting cumulative record counts and claim-line counts as of the end of the preceding calendar quarter, inclusive of all data previously delivered and the current Quarterly Refresh. The manifest file shall conform to the format described in Section 7.1.

8.3 Refresh Fee

During the initial thirty-six (36) month quarterly-refresh period (Effective Date through June 30, 2027), Quarterly Refreshes are included in the License Fee set forth in the Agreement at no additional cost to AHT. PCA shall bear all costs associated with the preparation, quality assurance, and delivery of Quarterly Refreshes during this period.

Following the expiration of the initial quarterly-refresh period (i.e., after June 30, 2027), AHT may elect to continue receiving Quarterly Refreshes at a fee of three hundred seventy-five thousand dollars ($375,000) per quarter, representing an annualized cost of one million five hundred thousand dollars ($1,500,000) per year. AHT's election to continue receiving Quarterly Refreshes beyond the initial period shall be subject to the terms of any applicable renewal term under the Agreement and shall be documented in a written amendment or order form executed by both parties. PCA reserves the right to adjust the Quarterly Refresh fee for renewal terms commencing after June 30, 2028, subject to the fee-adjustment provisions of the Agreement.

8.4 Refresh Acceptance

AHT shall have fourteen (14) calendar days following receipt of each Quarterly Refresh to review and accept or reject the refresh data in accordance with the acceptance procedures set forth in Section 7.4 of this Exhibit A, applied mutatis mutandis to each Quarterly Refresh. For the avoidance of doubt, references in Section 7.4 to the "initial data delivery" shall be deemed to refer to the applicable Quarterly Refresh delivery, and references to the "Acceptance Period" shall be deemed to refer to the fourteen (14) calendar-day period following AHT's receipt of such Quarterly Refresh.

Section 9: Data Quality Standards

PCA commits to the following data quality standards with respect to the Licensed Data, including both the initial delivery and all Quarterly Refreshes.

9.1 Completeness. PCA warrants that the Licensed Data shall contain no fewer than eighty-five million (85,000,000) unique de-identified Patient Tokens as of the initial delivery date. This minimum threshold reflects the cumulative universe of unique de-identified individuals across all contributing data sources and all lines of business during the Data Period. PCA does not warrant that the Patient Token count will remain static; the count may increase over time as additional claims data is contributed and new Patient Tokens are generated through Quarterly Refreshes.

PCA further warrants that the Licensed Data, as of the initial delivery, shall contain substantially complete claims histories for each Patient Token for each calendar year during which the underlying individual was continuously enrolled with a contributing data source. "Substantially complete" means that the claims history includes all material claim lines processed by the contributing data source for the applicable Patient Token during the applicable enrollment period, subject to standard claims-adjudication lags (typically not exceeding ninety (90) days from the date of service), retroactive adjustments, and data-quality limitations inherent in administrative claims data.

9.2 Accuracy. PCA warrants that the Licensed Data accurately reflects the claims data contributed to PCA by its downstream data sources, subject to the following qualifications and limitations:

(a) Standard claims-adjudication lags may result in incomplete or provisional claim records for services rendered near the end of a reporting period. Such records will be updated through Quarterly Refreshes as additional adjudication data becomes available.

(b) Retroactive adjustments, including claim voids, replacements, and corrections, are a normal feature of administrative claims data and may alter previously delivered claim records. PCA delivers such adjustments through the Quarterly Refresh process described in Section 8.2(b).

(c) Data-quality limitations inherent in administrative claims data, including coding errors, missing or incomplete data elements, and inconsistencies across contributing data sources, may affect individual records. PCA applies standardized data-quality checks and normalization procedures but does not independently verify the clinical accuracy of individual claims.

PCA does not warrant the clinical accuracy of diagnosis or procedure coding performed by the original rendering or billing provider. Diagnosis and procedure codes in the Licensed Data reflect the codes submitted on the original claim as adjudicated by the contributing health plan, and PCA has no independent basis upon which to verify whether such codes accurately describe the clinical services rendered or the patient's clinical condition.

9.3 Conformity to Data Dictionary

Each data element in the Licensed Data shall conform to the field name, data type, format, allowable values, and null/missing-value conventions specified in the Data Dictionary (Exhibit B). PCA represents that it has implemented automated data-validation procedures that check each delivery (including Quarterly Refreshes) against the Data Dictionary schema prior to transmission to AHT. In the event PCA identifies a need to modify the Data Dictionary schema (e.g., to add new fields, change data types, or update allowable value sets), PCA shall provide AHT with not less than thirty (30) days' prior written notice describing the proposed changes, and such changes shall not be implemented without AHT's prior written consent (not to be unreasonably withheld, conditioned, or delayed).

9.4 Remedy for Non-Conformity

In the event the Licensed Data materially fails to meet the data quality standards set forth in this Section 9, AHT's sole and exclusive remedy during the applicable Acceptance Period shall be to require PCA to cure such non-conformity as provided in Section 7.4 of this Exhibit A. A material failure to meet data quality standards includes, without limitation: (i) the Licensed Data containing fewer than eighty-five million (85,000,000) unique Patient Tokens at initial delivery; (ii) a systemic failure to conform to the Data Dictionary schema affecting more than one percent (1%) of records in any Claims Category; or (iii) the inclusion of any PHI or directly identifiable information in the Licensed Data.

Remedies for data quality non-conformities identified after the expiration of the applicable Acceptance Period shall be governed by the representations, warranties, and indemnification provisions set forth in the Agreement, including without limitation Section [●] (Representations and Warranties) and Section [●] (Indemnification) thereof.

Section 10: Data Retention and Return/Destruction

Upon expiration or termination of the Agreement for any reason, AHT shall, at PCA's election (to be communicated in writing to AHT within fifteen (15) days of expiration or termination), either return or destroy all copies of the Licensed Data in AHT's possession or control. For the avoidance of doubt, this return or destruction obligation applies to the Licensed Data as delivered by PCA and does not extend to Derivative Works (as defined in the Agreement) that are owned by AHT, provided that such Derivative Works do not contain any individual-level Licensed Data or any data from which the Licensed Data could be reconstructed.

AHT shall carry out the return or destruction of Licensed Data in accordance with the data-retention and destruction protocols set forth in Exhibit C (Data Security Requirements) to the Agreement. Destruction methods shall include, at a minimum, cryptographic erasure or physical destruction of storage media in accordance with NIST Special Publication 800-88, Revision 1 (Guidelines for Media Sanitization), or any successor guidance.

AHT shall certify in writing to PCA within thirty (30) calendar days of expiration or termination that all Licensed Data has been returned or destroyed, as applicable. Such certification shall be executed by an authorized officer of AHT and shall specify the method of return or destruction employed, the categories and approximate volume of data returned or destroyed, and the date on which return or destruction was completed.

Notwithstanding the foregoing, AHT may retain copies of Licensed Data in the following limited circumstances:

(a) As required by applicable law, regulation, or order of a court or governmental authority, including without limitation data-retention requirements imposed by federal or state regulators;

(b) As automatically stored in disaster-recovery or backup systems that are not reasonably practicable to selectively purge, provided that AHT shall not actively access, use, or process such retained copies for any purpose other than disaster recovery; and

(c) As embedded in audit logs or system metadata in a form that does not permit extraction or reconstruction of the Licensed Data.

Any copies of Licensed Data retained pursuant to this Section 10 shall remain subject to all use restrictions, confidentiality obligations, and data security requirements of the Agreement until such copies are destroyed in the ordinary course of backup rotation or are no longer required to be retained under applicable law.

Section 11: Definitions Specific to This Exhibit

The following terms, as used in this Exhibit A, shall have the meanings set forth below. These definitions supplement and do not supersede the definitions set forth in the Agreement.

"Acceptance Period" means the fourteen (14) calendar-day period following AHT's receipt of a data delivery during which AHT may review the Licensed Data (or a Quarterly Refresh, as applicable) for completeness, format compliance, and material conformity with the specifications set forth in this Exhibit A and in Exhibit B, as further described in Section 7.4 of this Exhibit A.

"Claims Category" means any of the four categories of healthcare claims included in the Licensed Data: Professional (Part B), Facility (Part A), Pharmacy (Part D), or Ancillary, each as described in Section 3 of this Exhibit A.

"Data Period" means the period from January 1, 2016 through December 31, 2023, representing the eight (8) full calendar years of claims data included in the initial Licensed Data delivery, as described in Section 1 of this Exhibit A.

"Expert" means Ridgeline Statistical Sciences LLC, the independent statistical consultancy that performed the Expert Determination certification described in Section 5.2 of this Exhibit A.

"Licensed Data" has the meaning set forth in the Agreement and is further described and specified in this Exhibit A, including without limitation the claims data, Patient Tokens, and associated data elements delivered to AHT by PCA pursuant to the Agreement.

"Patient Token" means a synthetic, non-reversible identifier assigned to a unique de-identified individual in the Licensed Data, as described in Section 2.1 of this Exhibit A.

"Quarterly Refresh" means each quarterly update to the Licensed Data delivered by PCA to AHT in accordance with the schedule, content requirements, and acceptance procedures described in Section 8 of this Exhibit A.

CROSS-REFERENCE AND INCORPORATION

This Exhibit A is incorporated into and forms part of the Data License Agreement (Reference No. AHT-PCA-DLA-2024-001) dated as of July 1, 2024, between Pinnacle Claims Analytics LLC and Arbor Health Technologies Inc. This Exhibit A does not require a separate signature and is effective as of the date of execution of the Agreement by both parties.

No separate signature block is required for this Exhibit A. This Exhibit A is incorporated by reference into the Agreement and is effective upon execution of the Agreement by the authorized representatives of both parties.

[End of Exhibit A]

EXHIBIT A
Data Description & Specifications
Exhibit A to the Data License Agreement Reference No. AHT-PCA-DLA-2024-001
Effective Date: July 1, 2024
Parties:
Pinnacle Claims Analytics LLC ("Licensor" or "PCA"), a Delaware limited liability company
Arbor Health Technologies Inc. ("Licensee" or "AHT"), a Delaware corporation
This Exhibit A is attached to and incorporated by reference into the Data License Agreement dated as of July 1, 2024 (the "Agreement"), by and between Pinnacle Claims Analytics LLC, a Delaware limited liability company, and Arbor Health Technologies Inc., a Delaware corporation. Capitalized terms used but not defined herein shall have the meanings ascribed to them in the Agreement. All references to "Sections" in this Exhibit A refer to sections of this Exhibit A unless otherwise indicated.
Section 1: Overview of the Licensed Data
The Licensed Data consists of a longitudinal dataset of de-identified healthcare claims data aggregated, de-identified, and maintained by PCA pursuant to downstream data-contribution agreements with regional health plans and third-party administrators. PCA has compiled the Licensed Data from multiple contributing data sources across the United States, and has applied standardized data-processing, normalization, and de-identification procedures to ensure consistency, interoperability, and compliance with applicable federal and state privacy laws.
The Licensed Data covers eight (8) full calendar years, from January 1, 2016 through December 31, 2023 (the "Data Period"). The longitudinal nature of the Licensed Data enables observation of healthcare utilization patterns, treatment trajectories, disease progression, and cost trends at the individual de-identified patient level across multiple years, subject to enrollment continuity within contributing data sources.
The Licensed Data contains records from the following lines of business: commercial (employer-sponsored and individual market), Medicare Advantage, and Medicaid managed-care. These lines of business collectively represent a broad cross-section of the insured population in the United States and provide AHT with a multi-payer view of healthcare claims activity across diverse demographic and clinical populations.
The Licensed Data includes no Protected Health Information ("PHI") as defined under the Health Insurance Portability and Accountability Act of 1996, as amended ("HIPAA"), and the regulations promulgated thereunder at 45 C.F.R. Parts 160 and 164. The de-identification methodology applied to the Licensed Data is described in detail in Section 5 of this Exhibit A. PCA represents that the Licensed Data, as delivered, constitutes de-identified information within the meaning of 45 C.F.R. § 164.514(a) and is therefore not subject to the use and disclosure restrictions applicable to PHI under the HIPAA Privacy Rule.
Section 2: Record Counts and Data Volume
2.1 Unique De-Identified Patient Tokens
The Licensed Data contains no fewer than eighty-five million (85,000,000) unique de-identified patient tokens (each, a "Patient Token"). This minimum count applies as of the initial delivery date and reflects the cumulative universe of unique de-identified individuals represented across all contributing data sources and all lines of business during the Data Period.
Each Patient Token is a synthetic, non-reversible identifier assigned to a unique de-identified individual in the dataset. Patient Tokens are generated using a one-way cryptographic hashing algorithm that does not permit derivation, reverse engineering, or inference of any direct or indirect patient identifier, including but not limited to name, date of birth, Social Security number, health plan beneficiary number, or medical record number. Patient Tokens are consistent within the Licensed Data across claims categories, lines of business, and calendar years, thereby enabling longitudinal linkage of a given de-identified individual's claims history across time and care settings without compromising patient privacy.
Patient Tokens do not correspond to or permit derivation of any direct or indirect patient identifier, and PCA does not provide AHT with any crosswalk, lookup table, or other mechanism that could be used to re-identify any individual represented by a Patient Token. AHT acknowledges and agrees that any attempt to re-identify individuals represented in the Licensed Data is strictly prohibited under the terms of the Agreement.
2.2 Individual Claim Lines
The Licensed Data contains approximately three billion four hundred million (3,400,000,000) individual claim lines, representing an average of approximately forty (40) claim lines per Patient Token across the Data Period. Individual claim lines include service-level detail for professional, facility, pharmacy, and ancillary claims as further described in Section 3 of this Exhibit A.
Claim-line counts are approximate and may vary across quarterly refreshes as additional claims adjudication and data-quality corrections occur. Factors that may cause claim-line counts to fluctuate include, without limitation: (a) late-arriving claims from contributing data sources; (b) retroactive claim adjustments, voids, and replacements; (c) data-quality corrections applied by PCA during routine quality-assurance processes; and (d) the addition of new contributing data sources during the term of the Agreement. PCA shall provide updated cumulative claim-line counts in the manifest file accompanying each quarterly refresh delivery as described in Section 8.2(d) of this Exhibit A.
Section 3: Claims Categories
The Licensed Data encompasses the following categories of healthcare claims, collectively referred to as the "Claims Categories." Each Claims Category is described below, together with the applicable coding systems, data elements, and scope of coverage.
3.1 Professional Claims (Part B)
The Licensed Data includes physician and other professional services claims, including but not limited to evaluation and management services, surgical procedures, diagnostic testing, therapeutic procedures, consultations, preventive care services, and other outpatient professional services rendered by physicians, nurse practitioners, physician assistants, psychologists, therapists, and other licensed healthcare professionals.
Professional claims are coded using Current Procedural Terminology (CPT®) and Healthcare Common Procedure Coding System (HCPCS) Level II codes. CPT® codes are maintained by the American Medical Association and are the standard code set for reporting medical, surgical, and diagnostic procedures and services performed by physicians and other qualified healthcare professionals. HCPCS Level II codes are maintained by the Centers for Medicare & Medicaid Services and are used to identify products, supplies, and services not included in the CPT® code set.
Professional claims in the Licensed Data include the following associated data elements: diagnosis codes assigned using the International Classification of Diseases, 10th Revision, Clinical Modification (ICD-10-CM); place-of-service codes identifying the setting in which the service was rendered; rendering and referring provider specialty codes; procedure modifier codes; units of service; and allowed and paid amounts that have been de-identified and normalized in accordance with PCA's standard financial normalization methodology. Financial normalization adjusts allowed and paid amounts to remove plan-specific pricing variations while preserving relative cost differentials across services, providers, and geographies.
3.2 Facility Claims (Part A)
The Licensed Data includes institutional claims from the following facility types: acute-care hospitals (inpatient and outpatient), skilled nursing facilities, inpatient rehabilitation facilities, long-term acute-care hospitals, home health agencies, and hospice providers. Facility claims capture both inpatient admissions and outpatient encounters occurring in institutional settings.
Facility claims are coded using ICD-10-CM diagnosis codes and, for inpatient procedures, ICD-10-PCS (Procedure Coding System) procedure codes. Additionally, facility claims include Diagnosis Related Group (DRG) assignments reflecting the classification of inpatient stays for purposes of prospective payment; revenue codes identifying the nature and department of services rendered; and UB-04 (CMS-1450) form fields capturing institutional claim-level information such as type of bill, condition codes, occurrence codes, and value codes.
Facility claims in the Licensed Data include admission and discharge dates that have been shifted per the de-identification protocol described in Section 5.3 of this Exhibit A. Length of stay is preserved as a calculated field (number of days between shifted admission and discharge dates). Facility-level de-identified identifiers are provided as synthetic facility tokens, enabling analysis of utilization patterns and referral networks at the institutional level without disclosing actual facility identity. Provider specialty codes and facility type indicators are retained in their original form.
3.3 Pharmacy Claims (Part D)
The Licensed Data includes outpatient prescription drug claims, encompassing retail pharmacy dispensing events, mail-order pharmacy dispensing events, and specialty pharmacy dispensing events. Pharmacy claims capture the dispensing of prescription medications to de-identified individuals represented in the Licensed Data.
Pharmacy claims are coded using National Drug Code (NDC) identifiers, which are unique 11-digit codes assigned by the U.S. Food and Drug Administration to identify specific drug products, including the labeler, product, and trade package size. Additional pharmacy claim data elements include: days' supply (the number of days the dispensed quantity is intended to last); quantity dispensed (the metric quantity of the drug product dispensed); therapeutic class codes (including both Generic Product Identifier (GPI) and Anatomical Therapeutic Chemical (ATC) classification codes); generic and brand indicators distinguishing between generic, branded, and branded-generic drug products; formulary status indicators where available; dispensing pharmacy type (retail, mail-order, specialty); and allowed and paid amounts that have been de-identified and normalized consistent with the methodology applied to professional and facility claims.
3.4 Ancillary Claims
The Licensed Data includes claims for ancillary services not classified under Sections 3.1 through 3.3. Ancillary claims encompass the following service types: laboratory services (clinical and pathology), radiology and diagnostic imaging services (including X-ray, CT, MRI, PET, and ultrasound), durable medical equipment (DME) and prosthetics/orthotics/supplies, ambulance and medical transport services, and other ancillary services such as hearing and vision services.
Ancillary claims are coded using CPT®, HCPCS Level II codes, and applicable modifier codes that further specify the nature, location, or circumstances of the service rendered. Ancillary claims include associated diagnosis codes (ICD-10-CM), units of service, and allowed and paid amounts (de-identified and normalized). Where applicable, ancillary claims include HCPCS modifier codes that distinguish, for example, between technical and professional components of diagnostic services, or between left and right anatomical sites for bilateral procedures.
Section 4: Lines of Business
The Licensed Data includes claims originating from the following payer lines of business. Each line of business is identified at the claim level through a de-identified synthetic plan token and a plan line-of-business indicator, enabling AHT to segment and analyze the Licensed Data by payer type.
4.1 Commercial.  The commercial line of business includes claims originating from employer-sponsored group health plans, encompassing both fully insured plans and self-funded (administrative services only, or "ASO") arrangements, as well as claims originating from individual-market plans, including plans offered through the Health Insurance Marketplace (exchange) and off-exchange individual policies. The commercial line of business represents the largest share of Patient Tokens in the Licensed Data, reflecting the predominance of employer-sponsored coverage in PCA's contributing data-source portfolio. Commercial claims span a broad demographic range, including working-age adults, dependents, and early retirees.
4.2 Medicare Advantage
The Medicare Advantage line of business includes claims originating from Medicare Advantage (Part C) plans, encompassing Health Maintenance Organization (HMO), Preferred Provider Organization (PPO), and Private Fee-for-Service (PFFS) plan types. Medicare Advantage claims in the Licensed Data reflect the healthcare utilization of enrolled beneficiaries aged sixty-five (65) and older, as well as individuals under sixty-five who qualify for Medicare on the basis of disability or end-stage renal disease. The Licensed Data includes associated Part D (pharmacy) claims for Medicare Advantage enrollees where such data is available from contributing data sources. The Medicare Advantage population provides AHT with insight into the healthcare utilization and cost patterns of the elderly and disabled populations.
4.3 Medicaid Managed Care
The Medicaid managed-care line of business includes claims originating from state Medicaid managed-care organization (MCO) plans across multiple states. The Medicaid managed-care population includes low-income adults, children, pregnant women, individuals with disabilities, and other populations eligible for Medicaid coverage under federal and state law. The Licensed Data includes both fee-for-service equivalent claims and capitated encounter data where reported by contributing plans. AHT acknowledges that the completeness and granularity of Medicaid managed-care data may vary by state and by contributing MCO, reflecting differences in state reporting requirements, encounter-data submission standards, and MCO data-management practices. PCA does not warrant uniform coverage across all fifty states for the Medicaid managed-care line of business.
Section 5: De-Identification Methodology
PCA has applied a comprehensive de-identification methodology to all Licensed Data prior to delivery. The de-identification methodology is designed to ensure compliance with applicable federal and state privacy laws, including HIPAA, and to render the Licensed Data unsuitable for the identification of any individual whose claims are represented therein. The de-identification methodology includes the following components:
5.1 HIPAA Safe Harbor Standard
All Licensed Data has been de-identified in compliance with the HIPAA Safe Harbor method as set forth in 45 C.F.R. § 164.514(b)(2). Pursuant to the Safe Harbor method, all eighteen (18) categories of identifiers specified in 45 C.F.R. § 164.514(b)(2)(i)(A)–(R) have been removed or generalized from the Licensed Data. The categories of identifiers that have been removed or generalized include, but are not limited to, the following:
(A) Names;
(B) All geographic subdivisions smaller than a state, including street address, city, county, precinct, ZIP code, and their equivalent geocodes, except for the initial three digits of a ZIP code if, according to the current publicly available data from the Bureau of the Census, the geographic unit formed by combining all ZIP codes with the same three initial digits contains more than 20,000 persons (and the initial three digits of a ZIP code for all such geographic units containing 20,000 or fewer persons is changed to "000");
(C) All elements of dates (except year) for dates directly related to an individual, including birth date, admission date, discharge date, date of death, and all ages over 89 and all elements of dates (including year) indicative of such age (such ages and elements are aggregated into a single category of age 90 or older);
(D) Telephone numbers;
(E) Fax numbers;
(F) Electronic mail addresses;
(G) Social Security numbers;
(H) Medical record numbers;
(I) Health plan beneficiary numbers;
(J) Account numbers;
(K) Certificate/license numbers;
(L) Vehicle identifiers and serial numbers, including license plate numbers;
(M) Device identifiers and serial numbers;
(N) Web Universal Resource Locators (URLs);
(O) Internet Protocol (IP) address numbers;
(P) Biometric identifiers, including finger and voice prints;
(Q) Full face photographic images and any comparable images; and
(R) Any other unique identifying number, characteristic, or code, except as permitted by 45 C.F.R. § 164.514(c) for purposes of re-identification by the covered entity.
PCA has no actual knowledge that the remaining information in the Licensed Data could be used, alone or in combination with other reasonably available information, to identify an individual who is a subject of the Licensed Data. PCA represents that it has implemented and maintains policies and procedures reasonably designed to ensure that the Licensed Data, as delivered and as refreshed, continues to meet the requirements of the Safe Harbor method.
5.2 Expert Determination Certification
In addition to compliance with the Safe Harbor method described in Section 5.1, PCA has obtained an Expert Determination certification pursuant to 45 C.F.R. § 164.514(b)(1). The Expert Determination provides an additional layer of assurance that the Licensed Data does not present a reasonably foreseeable risk of individual re-identification.
The Expert Determination was performed by Ridgeline Statistical Sciences LLC, an independent statistical consultancy located at 1750 Tysons Boulevard, Suite 600, McLean, VA 22102 (the "Expert"). The Expert is qualified by education, training, and experience in the application of generally accepted statistical and scientific principles and methods for rendering information not individually identifiable.
The Expert applied generally accepted statistical and scientific principles and methods, including but not limited to analysis of population uniqueness, assessment of quasi-identifier combinations, evaluation of data linkage risks, and sensitivity testing against external data sources. Based on this analysis, the Expert determined that the risk is very small that the Licensed Data could be used, alone or in combination with other reasonably available information, by an anticipated recipient to identify an individual who is a subject of the information. The Expert documented the methods and results of the analysis supporting this determination.
PCA shall make a copy of the Expert's written certification and methodology report available to AHT upon reasonable request, subject to any confidentiality restrictions imposed by the Expert. AHT acknowledges that the Expert's report may be designated as confidential by the Expert or by PCA and that AHT's access to and use of such report shall be subject to the confidentiality provisions of the Agreement.
5.3 Date Shifting
All date fields in the Licensed Data, including but not limited to service dates, admission dates, discharge dates, claim receipt dates, claim paid dates, and birth year, have been shifted using a consistent per-patient random offset of plus or minus three hundred sixty-five (±365) days. The date-shifting methodology is applied as follows:
(a) A single random integer between negative three hundred sixty-five (-365) and positive three hundred sixty-five (+365) is generated for each Patient Token.
(b) The same offset is applied uniformly to all date fields associated with that Patient Token across all claims categories and all calendar years within the Licensed Data.
(c) This approach preserves the chronological ordering and relative timing of events within each Patient Token's longitudinal record (e.g., the interval between an inpatient admission and a follow-up office visit is preserved), while preventing re-identification through correlation of dates in the Licensed Data with dates in external data sources.
Only the year component of dates of birth is retained in the Licensed Data; month and day of birth are removed entirely. For individuals aged ninety (90) or older at any point during the Data Period, the year of birth is generalized to indicate an age category of "90+" in accordance with the HIPAA Safe Harbor standard.
5.4 Geographic Generalization
Geographic data in the Licensed Data has been generalized to the three-digit ZIP code level. The three-digit ZIP code is the broadest sub-state geographic indicator retained in the Licensed Data and corresponds to the first three digits of the five-digit ZIP code of the individual's residence or the service location, as applicable.
In cases where a three-digit ZIP code area contains fewer than twenty thousand (20,000) persons according to the most recent U.S. Census (currently the 2020 Decennial Census), the geographic indicator is set to "000" in accordance with 45 C.F.R. § 164.514(b)(2)(i)(B). This generalization applies to both patient-residence and service-location geographic fields. PCA maintains a reference table of suppressed three-digit ZIP codes based on the applicable Census population thresholds, and this table is updated when new Census data becomes available.
5.5 Provider and Plan Identifiers
All provider identifiers in the Licensed Data, including National Provider Identifiers (NPIs), Tax Identification Numbers (TINs), and Drug Enforcement Administration (DEA) numbers, have been replaced with de-identified synthetic provider tokens. Each synthetic provider token is a non-reversible identifier that is consistent across the Licensed Data, enabling AHT to analyze provider-level utilization patterns and referral networks without disclosing the actual identity of any healthcare provider.
All health plan identifiers in the Licensed Data have been replaced with de-identified synthetic plan tokens. Each synthetic plan token is a non-reversible identifier that is consistent across the Licensed Data, enabling AHT to analyze plan-level utilization patterns and cost trends without disclosing the actual identity of any contributing health plan.
Notwithstanding the replacement of direct provider and plan identifiers, the following descriptive fields are retained in their original form: provider specialty codes (as reported on the original claim), facility type indicators (e.g., acute-care hospital, skilled nursing facility), and plan line-of-business indicators (e.g., commercial, Medicare Advantage, Medicaid managed care). These descriptive fields do not, individually or in combination, identify a specific provider or health plan.
Section 6: Data Dictionary Reference
The field-level specification of all data elements contained in the Licensed Data is set forth in Exhibit B (Data Dictionary) to the Agreement. The Data Dictionary provides comprehensive technical documentation of the Licensed Data schema and is intended to serve as the primary reference for AHT's data engineering, analytics, and data science teams in connection with the ingestion, validation, and utilization of the Licensed Data.
The Data Dictionary contains two hundred forty-seven (247) standardized fields organized by Claims Category (Professional, Facility, Pharmacy, Ancillary) and data domain (demographics, enrollment, clinical, financial, provider, plan). For each field, the Data Dictionary specifies the following attributes: field name, field description, data type (e.g., string, integer, decimal, date, boolean), field length or precision, format mask or pattern, allowable values or value set reference, null/missing-value conventions, and any applicable business rules or derivation logic.
In the event of any inconsistency between this Exhibit A and the Data Dictionary in Exhibit B, the following hierarchy of control shall apply: the Data Dictionary (Exhibit B) shall control with respect to field-level specifications, including field names, data types, formats, and allowable values; and this Exhibit A shall control with respect to general data descriptions, volume commitments, de-identification methodology, delivery specifications, data quality standards, and all other matters not specifically addressed at the field level in the Data Dictionary.
Section 7: Data Delivery Specifications
7.1 Data Format
All Licensed Data shall be delivered in Apache Parquet columnar storage format. Apache Parquet is an open-source, column-oriented data file format designed for efficient data storage and retrieval, and is widely supported by modern data-processing frameworks including Apache Spark, Apache Hadoop, Amazon Athena, Severin Industries BigQuery, and Snowflake, among others.
Parquet files shall be organized by Claims Category (Professional, Facility, Pharmacy, Ancillary) and calendar year, with one or more partitioned files per category per year. File partitioning shall be performed in a manner that balances file size for efficient parallel ingestion, with individual Parquet files targeted at a size between five hundred megabytes (500 MB) and two gigabytes (2 GB) each, uncompressed. Parquet files shall use Snappy compression as the default compression codec unless otherwise agreed in writing by the parties.
Each delivery (whether initial or quarterly refresh) shall be accompanied by a manifest file in comma-separated values (CSV) format. The manifest file shall list all delivered files and shall include, for each file, the following metadata: (i) file name; (ii) Claims Category; (iii) calendar year; (iv) row count; (v) file size (in bytes); (vi) SHA-256 checksum; and (vii) file creation timestamp (in UTC). The manifest file enables AHT to validate the integrity and completeness of each delivery programmatically.
7.2 Delivery Method
Data shall be transmitted via encrypted Secure File Transfer Protocol (SFTP) using AES-256 encryption for data in transit. All data transmitted between PCA's SFTP endpoint and AHT's designated receiving systems shall be encrypted using Transport Layer Security (TLS) version 1.2 or higher in addition to the underlying SFTP encryption.
PCA shall provision a dedicated SFTP endpoint for AHT's exclusive use and shall provide AHT with access credentials (username, password, and/or SSH key pair) no later than five (5) business days after the Effective Date. The SFTP endpoint shall be available twenty-four (24) hours per day, seven (7) days per week, subject to scheduled maintenance windows of which PCA shall provide AHT not less than forty-eight (48) hours' prior written notice.
AHT shall designate authorized recipients for SFTP access by providing PCA with the name, title, email address, and IP address (or IP address range) of each authorized individual or system. AHT's designation of authorized recipients shall be subject to the data security requirements set forth in Exhibit C (Data Security Requirements) to the Agreement. AHT may update its list of authorized recipients at any time by providing written notice to PCA, and PCA shall implement such updates within two (2) business days of receipt.
7.3 Initial Data Delivery
PCA shall deliver the complete initial Licensed Data, covering the full Data Period of January 1, 2016 through December 31, 2023, within thirty (30) calendar days of the Effective Date. Based on the Effective Date of July 1, 2024, the initial delivery deadline is July 31, 2024.
The initial delivery shall include all Patient Tokens, all claim lines across all Claims Categories (Professional, Facility, Pharmacy, Ancillary), all lines of business (Commercial, Medicare Advantage, Medicaid Managed Care), and all fields specified in the Data Dictionary (Exhibit B). The initial delivery shall be accompanied by the manifest file described in Section 7.1 and shall conform to the data format specifications set forth therein.
PCA shall provide AHT with written notice (via email to AHT's designated data-operations contact) upon completion of the initial data delivery, confirming that all files have been uploaded to the SFTP endpoint and are available for download.
7.4 Data Acceptance
AHT shall have fourteen (14) calendar days following receipt of the initial data delivery (the "Acceptance Period") to review the Licensed Data for completeness, format compliance, and material conformity with the specifications set forth in this Exhibit A and in the Data Dictionary (Exhibit B). During the Acceptance Period, AHT may perform automated and manual validation procedures, including but not limited to: verification of file counts and row counts against the manifest file; SHA-256 checksum validation; schema validation against the Data Dictionary; spot-check validation of data-element values and distributions; and confirmation of minimum Patient Token counts and approximate claim-line volumes.
The Acceptance Period for the initial delivery expires on August 14, 2024, assuming delivery on July 31, 2024. If the initial delivery is made prior to July 31, 2024, the Acceptance Period shall run from the actual date of delivery (as confirmed by PCA's delivery notice) and shall expire fourteen (14) calendar days thereafter.
If AHT identifies material non-conformities during the Acceptance Period, AHT shall deliver a written deficiency notice to PCA specifying the nature of each non-conformity in reasonable detail, including, where practicable, the affected files, fields, or records and the manner in which the delivered data deviates from the applicable specifications. PCA shall use commercially reasonable efforts to cure any such deficiency within fifteen (15) business days of receipt of the deficiency notice. Upon cure and re-delivery of the corrected data, a new fourteen (14) calendar-day Acceptance Period shall commence, during which AHT may review the corrected data for conformity with the specifications and for resolution of the previously identified deficiencies.
If AHT does not deliver a deficiency notice within the Acceptance Period, the Licensed Data shall be deemed accepted ("Accepted") as of the expiration of the Acceptance Period. Acceptance of the Licensed Data shall not constitute a waiver of any warranty, representation, or indemnification obligation of PCA under the Agreement.
Section 8: Quarterly Data Refreshes
8.1 Refresh Schedule
For a period of thirty-six (36) months following the Effective Date (i.e., from July 1, 2024 through June 30, 2027), PCA shall deliver quarterly data refreshes to AHT (each, a "Quarterly Refresh"). The Quarterly Refresh cycle shall align with standard calendar quarters.
Each Quarterly Refresh shall be delivered within fifteen (15) business days after the end of each calendar quarter. Accordingly, the applicable delivery deadlines are as follows:
•  Q3 2024 Refresh (covering July 1, 2024 – September 30, 2024): delivery by approximately October 22, 2024;
•  Q4 2024 Refresh (covering October 1, 2024 – December 31, 2024): delivery by approximately January 22, 2025;
•  Subsequent Quarterly Refreshes following the same cadence through and including the Q2 2027 Refresh (covering April 1, 2027 – June 30, 2027): delivery by approximately July 22, 2027.
Exact delivery deadlines will depend on the number of business days in each applicable period, accounting for weekends and federal holidays observed by PCA.
8.2 Refresh Content
Each Quarterly Refresh shall include the following components:
(a) New Claim Lines. All new claim lines adjudicated during the preceding calendar quarter across all Claims Categories (Professional, Facility, Pharmacy, Ancillary) and all lines of business (Commercial, Medicare Advantage, Medicaid Managed Care). New claim lines include claims with dates of service falling within or prior to the preceding calendar quarter that were adjudicated (i.e., processed to a final paid, denied, or adjusted status) by the contributing data source during the preceding calendar quarter.
(b) Corrections and Adjustments. Corrections, adjustments, and retroactive claim amendments applied during the preceding calendar quarter to previously delivered claim lines. Such corrections and adjustments shall be identified via adjustment reason codes and shall include sufficient information to enable AHT to match the corrected record to the corresponding previously delivered claim line (e.g., original claim identifier, adjustment type indicator).
(c) New Patient Tokens. New Patient Tokens, if any, resulting from newly enrolled or newly contributing members during the preceding quarter. New Patient Tokens may arise from the enrollment of new members in contributing health plans or from the onboarding of new contributing data sources by PCA during the term of the Agreement.
(d) Updated Manifest File. An updated manifest file reflecting cumulative record counts and claim-line counts as of the end of the preceding calendar quarter, inclusive of all data previously delivered and the current Quarterly Refresh. The manifest file shall conform to the format described in Section 7.1.
8.3 Refresh Fee
During the initial thirty-six (36) month quarterly-refresh period (Effective Date through June 30, 2027), Quarterly Refreshes are included in the License Fee set forth in the Agreement at no additional cost to AHT. PCA shall bear all costs associated with the preparation, quality assurance, and delivery of Quarterly Refreshes during this period.
Following the expiration of the initial quarterly-refresh period (i.e., after June 30, 2027), AHT may elect to continue receiving Quarterly Refreshes at a fee of three hundred seventy-five thousand dollars ($375,000) per quarter, representing an annualized cost of one million five hundred thousand dollars ($1,500,000) per year. AHT's election to continue receiving Quarterly Refreshes beyond the initial period shall be subject to the terms of any applicable renewal term under the Agreement and shall be documented in a written amendment or order form executed by both parties. PCA reserves the right to adjust the Quarterly Refresh fee for renewal terms commencing after June 30, 2028, subject to the fee-adjustment provisions of the Agreement.
8.4 Refresh Acceptance
AHT shall have fourteen (14) calendar days following receipt of each Quarterly Refresh to review and accept or reject the refresh data in accordance with the acceptance procedures set forth in Section 7.4 of this Exhibit A, applied mutatis mutandis to each Quarterly Refresh. For the avoidance of doubt, references in Section 7.4 to the "initial data delivery" shall be deemed to refer to the applicable Quarterly Refresh delivery, and references to the "Acceptance Period" shall be deemed to refer to the fourteen (14) calendar-day period following AHT's receipt of such Quarterly Refresh.
Section 9: Data Quality Standards
PCA commits to the following data quality standards with respect to the Licensed Data, including both the initial delivery and all Quarterly Refreshes.
9.1 Completeness.  PCA warrants that the Licensed Data shall contain no fewer than eighty-five million (85,000,000) unique de-identified Patient Tokens as of the initial delivery date. This minimum threshold reflects the cumulative universe of unique de-identified individuals across all contributing data sources and all lines of business during the Data Period. PCA does not warrant that the Patient Token count will remain static; the count may increase over time as additional claims data is contributed and new Patient Tokens are generated through Quarterly Refreshes.
PCA further warrants that the Licensed Data, as of the initial delivery, shall contain substantially complete claims histories for each Patient Token for each calendar year during which the underlying individual was continuously enrolled with a contributing data source. "Substantially complete" means that the claims history includes all material claim lines processed by the contributing data source for the applicable Patient Token during the applicable enrollment period, subject to standard claims-adjudication lags (typically not exceeding ninety (90) days from the date of service), retroactive adjustments, and data-quality limitations inherent in administrative claims data.
9.2 Accuracy.  PCA warrants that the Licensed Data accurately reflects the claims data contributed to PCA by its downstream data sources, subject to the following qualifications and limitations:
(a) Standard claims-adjudication lags may result in incomplete or provisional claim records for services rendered near the end of a reporting period. Such records will be updated through Quarterly Refreshes as additional adjudication data becomes available.
(b) Retroactive adjustments, including claim voids, replacements, and corrections, are a normal feature of administrative claims data and may alter previously delivered claim records. PCA delivers such adjustments through the Quarterly Refresh process described in Section 8.2(b).
(c) Data-quality limitations inherent in administrative claims data, including coding errors, missing or incomplete data elements, and inconsistencies across contributing data sources, may affect individual records. PCA applies standardized data-quality checks and normalization procedures but does not independently verify the clinical accuracy of individual claims.
PCA does not warrant the clinical accuracy of diagnosis or procedure coding performed by the original rendering or billing provider. Diagnosis and procedure codes in the Licensed Data reflect the codes submitted on the original claim as adjudicated by the contributing health plan, and PCA has no independent basis upon which to verify whether such codes accurately describe the clinical services rendered or the patient's clinical condition.
9.3 Conformity to Data Dictionary
Each data element in the Licensed Data shall conform to the field name, data type, format, allowable values, and null/missing-value conventions specified in the Data Dictionary (Exhibit B). PCA represents that it has implemented automated data-validation procedures that check each delivery (including Quarterly Refreshes) against the Data Dictionary schema prior to transmission to AHT. In the event PCA identifies a need to modify the Data Dictionary schema (e.g., to add new fields, change data types, or update allowable value sets), PCA shall provide AHT with not less than thirty (30) days' prior written notice describing the proposed changes, and such changes shall not be implemented without AHT's prior written consent (not to be unreasonably withheld, conditioned, or delayed).
9.4 Remedy for Non-Conformity
In the event the Licensed Data materially fails to meet the data quality standards set forth in this Section 9, AHT's sole and exclusive remedy during the applicable Acceptance Period shall be to require PCA to cure such non-conformity as provided in Section 7.4 of this Exhibit A. A material failure to meet data quality standards includes, without limitation: (i) the Licensed Data containing fewer than eighty-five million (85,000,000) unique Patient Tokens at initial delivery; (ii) a systemic failure to conform to the Data Dictionary schema affecting more than one percent (1%) of records in any Claims Category; or (iii) the inclusion of any PHI or directly identifiable information in the Licensed Data.
Remedies for data quality non-conformities identified after the expiration of the applicable Acceptance Period shall be governed by the representations, warranties, and indemnification provisions set forth in the Agreement, including without limitation Section [●] (Representations and Warranties) and Section [●] (Indemnification) thereof.
Section 10: Data Retention and Return/Destruction
Upon expiration or termination of the Agreement for any reason, AHT shall, at PCA's election (to be communicated in writing to AHT within fifteen (15) days of expiration or termination), either return or destroy all copies of the Licensed Data in AHT's possession or control. For the avoidance of doubt, this return or destruction obligation applies to the Licensed Data as delivered by PCA and does not extend to Derivative Works (as defined in the Agreement) that are owned by AHT, provided that such Derivative Works do not contain any individual-level Licensed Data or any data from which the Licensed Data could be reconstructed.
AHT shall carry out the return or destruction of Licensed Data in accordance with the data-retention and destruction protocols set forth in Exhibit C (Data Security Requirements) to the Agreement. Destruction methods shall include, at a minimum, cryptographic erasure or physical destruction of storage media in accordance with NIST Special Publication 800-88, Revision 1 (Guidelines for Media Sanitization), or any successor guidance.
AHT shall certify in writing to PCA within thirty (30) calendar days of expiration or termination that all Licensed Data has been returned or destroyed, as applicable. Such certification shall be executed by an authorized officer of AHT and shall specify the method of return or destruction employed, the categories and approximate volume of data returned or destroyed, and the date on which return or destruction was completed.
Notwithstanding the foregoing, AHT may retain copies of Licensed Data in the following limited circumstances:
(a) As required by applicable law, regulation, or order of a court or governmental authority, including without limitation data-retention requirements imposed by federal or state regulators;
(b) As automatically stored in disaster-recovery or backup systems that are not reasonably practicable to selectively purge, provided that AHT shall not actively access, use, or process such retained copies for any purpose other than disaster recovery; and
(c) As embedded in audit logs or system metadata in a form that does not permit extraction or reconstruction of the Licensed Data.
Any copies of Licensed Data retained pursuant to this Section 10 shall remain subject to all use restrictions, confidentiality obligations, and data security requirements of the Agreement until such copies are destroyed in the ordinary course of backup rotation or are no longer required to be retained under applicable law.
Section 11: Definitions Specific to This Exhibit
The following terms, as used in this Exhibit A, shall have the meanings set forth below. These definitions supplement and do not supersede the definitions set forth in the Agreement.
"Acceptance Period" means the fourteen (14) calendar-day period following AHT's receipt of a data delivery during which AHT may review the Licensed Data (or a Quarterly Refresh, as applicable) for completeness, format compliance, and material conformity with the specifications set forth in this Exhibit A and in Exhibit B, as further described in Section 7.4 of this Exhibit A.
"Claims Category" means any of the four categories of healthcare claims included in the Licensed Data: Professional (Part B), Facility (Part A), Pharmacy (Part D), or Ancillary, each as described in Section 3 of this Exhibit A.
"Data Period" means the period from January 1, 2016 through December 31, 2023, representing the eight (8) full calendar years of claims data included in the initial Licensed Data delivery, as described in Section 1 of this Exhibit A.
"Expert" means Ridgeline Statistical Sciences LLC, the independent statistical consultancy that performed the Expert Determination certification described in Section 5.2 of this Exhibit A.
"Licensed Data" has the meaning set forth in the Agreement and is further described and specified in this Exhibit A, including without limitation the claims data, Patient Tokens, and associated data elements delivered to AHT by PCA pursuant to the Agreement.
"Patient Token" means a synthetic, non-reversible identifier assigned to a unique de-identified individual in the Licensed Data, as described in Section 2.1 of this Exhibit A.
"Quarterly Refresh" means each quarterly update to the Licensed Data delivered by PCA to AHT in accordance with the schedule, content requirements, and acceptance procedures described in Section 8 of this Exhibit A.
CROSS-REFERENCE AND INCORPORATION
This Exhibit A is incorporated into and forms part of the Data License Agreement (Reference No. AHT-PCA-DLA-2024-001) dated as of July 1, 2024, between Pinnacle Claims Analytics LLC and Arbor Health Technologies Inc. This Exhibit A does not require a separate signature and is effective as of the date of execution of the Agreement by both parties.
No separate signature block is required for this Exhibit A. This Exhibit A is incorporated by reference into the Agreement and is effective upon execution of the Agreement by the authorized representatives of both parties.
[End of Exhibit A]

EXHIBIT A

CROSS-REFERENCE AND INCORPORATION

Record

Parties

Dates

Amounts