1010-00006 · Hargrove, Delacroix & Stein LLP · Transaction Documents

exhibit-c-data-security-requirements.docx DOCUMENT Funds

11 / 12 ← → ✕

Contract analysis Extract to table

EXHIBIT C

DATA SECURITY REQUIREMENTS

Exhibit C to the Data License Agreement Reference No. AHT-PCA-DLA-2024-001

by and between

PINNACLE CLAIMS ANALYTICS LLC ("Licensor" or "PCA")

and

ARBOR HEALTH TECHNOLOGIES INC. ("Licensee" or "AHT")

Effective Date: July 1, 2024

This Exhibit C is attached to and incorporated by reference into the Data License Agreement dated as of July 1, 2024 (the "Agreement"), by and between Pinnacle Claims Analytics LLC, a Delaware limited liability company with principal offices at 3100 West End Avenue, Suite 800, Nashville, TN 37203 ("Licensor"), and Arbor Health Technologies Inc., a Delaware corporation with principal offices at 400 Seaport Boulevard, Suite 1200, Boston, MA 02210 ("Licensee"). Capitalized terms used but not defined herein shall have the meanings ascribed to them in the Agreement. These Data Security Requirements set forth the minimum technical and organizational security measures that Licensee shall implement and maintain throughout the term of the Agreement with respect to the Licensed Data, aligned with the National Institute of Standards and Technology Special Publication 800-171 ("NIST SP 800-171"). In the event of any conflict between the provisions of this Exhibit C and the body of the Agreement, the provision that imposes the more protective or more stringent security obligation with respect to the Licensed Data shall control.

1. GENERAL OBLIGATIONS AND STANDARDS

1.1 Security Program. AHT shall establish, implement, and maintain a comprehensive written information security program (the "Security Program") that includes administrative, technical, and physical safeguards designed to protect the confidentiality, integrity, and availability of the Licensed Data. The Security Program shall be aligned with and meet or exceed the requirements of NIST SP 800-171, Revision 2 (or any successor version published during the term of the Agreement). The Security Program shall be reasonably designed to address the specific nature of the Licensed Data, including the volume, sensitivity, and de-identified healthcare claims character of such data. AHT shall maintain current documentation describing its Security Program and shall make such documentation available to Licensor upon request in connection with any audit conducted pursuant to Section 9 of this Exhibit C.

1.2 Responsible Personnel. AHT shall designate a qualified individual (the "Security Officer") responsible for the overall management, implementation, and enforcement of the Security Program. The Security Officer shall possess qualifications commensurate with the scope and complexity of AHT's data security obligations under the Agreement, including relevant professional certifications (e.g., CISSP, CISM, or equivalent) or equivalent experience. AHT shall provide Licensor with the name and contact information of the Security Officer within ten (10) business days of the Effective Date, and shall promptly notify Licensor of any change in such designation. In the event of a vacancy in the Security Officer position, AHT shall designate an interim Security Officer within five (5) business days and shall appoint a permanent replacement within forty-five (45) calendar days.

1.3 Compliance with Applicable Law. AHT's security measures shall comply with all applicable federal, state, and local laws and regulations, including without limitation the Health Insurance Portability and Accountability Act of 1996 ("HIPAA") as applicable to de-identified data, the Massachusetts data-privacy laws under M.G.L. c. 93H and the accompanying regulations at 201 CMR 17.00, and the California Confidentiality of Medical Information Act ("CMIA") to the extent any Licensed Data includes California-sourced claims. AHT shall monitor changes in applicable law and regulation and shall update its Security Program as necessary to maintain compliance. Nothing in this Exhibit C shall be construed to limit AHT's obligations under any applicable law or regulation that imposes requirements more stringent than those set forth herein.

1.4 Risk Assessments. AHT shall conduct a documented risk assessment of its Security Program no less frequently than annually, and shall promptly implement remedial measures to address any identified deficiencies. Each risk assessment shall evaluate, at a minimum: (a) the current threat landscape relevant to healthcare claims data; (b) the adequacy of existing administrative, technical, and physical controls; (c) the effectiveness of access controls and encryption measures; (d) the security of third-party integrations and subcontractor arrangements; and (e) any changes in AHT's technology infrastructure, business operations, or regulatory environment that may affect the security of the Licensed Data. Upon request, AHT shall provide Licensor with a summary of the findings and remediation actions from each annual risk assessment, subject to reasonable redaction of information not related to the Licensed Data.

2. ENCRYPTION STANDARDS

2.1 Encryption at Rest. All Licensed Data stored on AHT's systems, including primary databases, backup media, removable storage devices, and cloud storage environments, shall be encrypted using the Advanced Encryption Standard (AES) with a minimum key length of 256 bits (AES-256). Encryption shall be applied at the storage volume level, at the database level, or at the file level, as appropriate, to ensure that Licensed Data is rendered unintelligible to any person who does not possess the applicable decryption key. AHT shall ensure that encryption at rest is enabled and verified across all storage tiers, including hot, warm, and cold storage, and across all environments in which Licensed Data resides, including production, staging, development, testing, quality assurance, and disaster recovery environments.

2.2 Encryption in Transit. All Licensed Data transmitted between AHT systems or between AHT and any authorized third party shall be encrypted using AES-256 or equivalent encryption protocols. For network transmissions, AHT shall employ Transport Layer Security (TLS) version 1.2 or higher, configured with cipher suites that provide forward secrecy (e.g., ECDHE key exchange). For file transfers, AHT shall employ SFTP with AES-256 encryption. The initial data delivery and all quarterly data refreshes under the Agreement shall be transmitted via encrypted SFTP using AES-256 encryption, as specified in Exhibit A to the Agreement. Deprecated or weak encryption protocols, including but not limited to SSL 2.0, SSL 3.0, TLS 1.0, and TLS 1.1, shall not be used in connection with the transmission of Licensed Data. AHT shall validate encryption configurations on a quarterly basis to ensure ongoing compliance with this Section 2.2.

2.3 Key Management. AHT shall implement and maintain a formal cryptographic key management program that includes secure key generation, distribution, storage, rotation, and destruction procedures. Key generation shall utilize cryptographically secure random number generators approved under FIPS 140-2 (or its successor, FIPS 140-3). Encryption keys shall be rotated no less frequently than annually, or more frequently if warranted by a Security Incident or change in risk posture. Key material shall not be stored alongside encrypted Licensed Data, and shall be protected by access controls at least as stringent as those applied to the Licensed Data itself. AHT shall maintain a current inventory of all encryption keys used to protect Licensed Data, including the date of generation, the associated data or system, the custodian, and the scheduled rotation date. Upon key retirement or destruction, AHT shall employ secure destruction methods that render the key material irrecoverable.

2.4 Prohibition on Unencrypted Storage. At no time shall Licensed Data be stored or transmitted in unencrypted form, except during active processing in volatile memory (RAM) within secured computing environments that are protected by the access controls, network segmentation, and monitoring measures described in this Exhibit C. AHT shall implement technical controls to prevent the inadvertent or unauthorized storage of Licensed Data in unencrypted form, including data loss prevention (DLP) tools configured to detect and block unencrypted exports or transfers of Licensed Data.

3. ACCESS CONTROLS

3.1 Role-Based Access Control (RBAC). AHT shall implement role-based access controls that limit access to Licensed Data to only those AHT personnel whose job functions require such access for the Permitted Uses set forth in the Agreement, namely internal analytics, model training, product development, and integration into AHT's SaaS platform. Access rights shall be assigned based on the principle of least privilege, such that each user is granted only the minimum level of access necessary to perform their assigned duties. AHT shall define and document discrete access roles, specifying for each role the scope of access to Licensed Data (e.g., read-only, read-write, administrative), and shall review and update role definitions no less frequently than annually. Segregation of duties shall be enforced for sensitive functions, including but not limited to key management, access provisioning, and audit log administration.

3.2 Multi-Factor Authentication (MFA). All AHT personnel and authorized contractors accessing systems that store, process, or transmit Licensed Data shall authenticate using multi-factor authentication, which shall consist of at least two of the following independent factors:

(a) something the user knows (e.g., a password, passphrase, or personal identification number);

(b) something the user has (e.g., a hardware security token, smart card, or registered mobile device capable of receiving or generating time-based one-time passwords); and

MFA shall be required for all access methods, including local console access, remote access via VPN, web-based application access, and access to cloud management consoles. AHT shall not permit MFA bypass or exception without the documented, time-limited approval of the Security Officer.

3.3 Unique User Identification. Each individual with access to Licensed Data shall be assigned a unique user identifier that is traceable to a specific natural person. Shared or generic accounts shall be prohibited for access to Licensed Data. Service accounts used by automated systems to access Licensed Data shall be individually named, documented, assigned to a responsible human custodian, and subject to the same access controls and monitoring requirements as individual user accounts.

3.4 Access Provisioning and De-Provisioning. AHT shall implement formal procedures for granting, modifying, and revoking access to Licensed Data, including:

(a) documented approval by the Security Officer or a designated delegate prior to initial access provisioning, which approval shall specify the access role, the business justification, and the expected duration of access;

(b) prompt de-provisioning of access upon termination or reassignment of personnel, with access revoked within twenty-four (24) hours of termination of employment or contract, and within five (5) business days of reassignment to a role that does not require access to Licensed Data; and

(c) quarterly reviews of all access privileges associated with Licensed Data to confirm that each access right remains appropriate and necessary. The results of quarterly access reviews shall be documented and retained for a period of no less than three (3) years.

3.5 Password Requirements. Passwords used to access systems containing Licensed Data shall meet the following minimum complexity and management requirements:

(a) a minimum length of twelve (12) characters;

(b) inclusion of at least one character from each of the following categories: uppercase letters, lowercase letters, numeric digits, and special characters;

(d) passwords shall not be reused within a twelve (12)-cycle history;

(e) account lockout shall be enforced after no more than five (5) consecutive failed login attempts, with lockout duration of no less than fifteen (15) minutes or until reset by an authorized administrator; and

(f) passwords shall be stored using salted, one-way cryptographic hashing algorithms (e.g., bcrypt, scrypt, or Argon2) and shall not be stored in plaintext or reversibly encrypted form.

3.6 Remote Access. Remote access to systems containing Licensed Data shall be permitted only through AHT-managed virtual private network (VPN) connections employing AES-256 encryption, subject to MFA as described in Section 3.2 of this Exhibit C. Split tunneling shall be disabled on VPN connections used to access systems containing Licensed Data. AHT shall maintain logs of all remote access sessions, including the identity of the user, the date and time of connection and disconnection, and the network address from which the connection originated. Personal or unmanaged devices shall not be used to access Licensed Data unless expressly approved in writing by the Security Officer and subject to endpoint security requirements equivalent to those applied to AHT-managed devices.

4. NETWORK SECURITY AND SYSTEM HARDENING

4.1 Network Segmentation. AHT shall logically segregate systems and network segments that store or process Licensed Data from general-purpose corporate networks, development environments that do not require access to Licensed Data, and guest or public-facing network segments. Firewalls, intrusion detection/prevention systems (IDS/IPS), and network access control lists shall be deployed at all network boundaries separating Licensed Data environments from other network segments. Firewall rules and access control lists shall be reviewed and validated no less frequently than quarterly, and shall follow a default-deny posture, permitting only traffic that is expressly authorized and documented. AHT shall maintain current network architecture diagrams that clearly identify the location of Licensed Data within the network topology, and shall make such diagrams available to Licensor or its designated auditor upon request in connection with any audit conducted pursuant to Section 9.

4.2 System Hardening. All systems that store, process, or transmit Licensed Data shall be hardened in accordance with industry-standard configuration baselines, such as those published by the Center for Internet Security (CIS Benchmarks), the Defense Information Systems Agency (DISA STIGs), or equivalent. At a minimum, system hardening shall include: (a) removal or disabling of unnecessary services, ports, protocols, and default accounts; (b) disabling or restricting the use of administrative tools and utilities to authorized personnel; (c) configuration of operating system and application settings in accordance with vendor security guidance; and (d) documentation and periodic review of any deviations from baseline configurations. AHT shall validate system configurations against the applicable baseline no less frequently than quarterly and shall remediate deviations within thirty (30) days of identification.

4.3 Vulnerability Management. AHT shall implement a vulnerability management program that includes:

(a) automated vulnerability scanning of all systems containing Licensed Data no less frequently than monthly, using commercially available vulnerability scanning tools with current vulnerability signature databases;

(b) prioritized remediation of identified vulnerabilities, with critical vulnerabilities (CVSS score 9.0 or higher) remediated within fifteen (15) calendar days of identification, high vulnerabilities (CVSS score 7.0–8.9) remediated within thirty (30) calendar days, and medium vulnerabilities (CVSS score 4.0–6.9) remediated within sixty (60) calendar days; and

(c) application of security patches within timelines consistent with the foregoing remediation schedule, with emergency out-of-band patches for actively exploited zero-day vulnerabilities applied as soon as reasonably practicable, but in no event later than seventy-two (72) hours after patch availability.

AHT shall maintain records of vulnerability scan results and remediation actions for a period of no less than three (3) years.

4.4 Malware Protection. AHT shall deploy and maintain up-to-date anti-malware software on all endpoints and servers that access or store Licensed Data, with real-time scanning enabled and malware definitions updated at least daily. AHT shall configure anti-malware software to perform scheduled full-system scans no less frequently than weekly. AHT shall additionally employ endpoint detection and response (EDR) capabilities on systems that store or process Licensed Data to detect advanced persistent threats and fileless malware. Any malware detection involving a system that stores or processes Licensed Data shall be investigated to determine whether Licensed Data was accessed or exfiltrated, and if such determination cannot be ruled out, the event shall be treated as a Security Incident under Section 8.

5. LOGGING AND AUDIT TRAIL REQUIREMENTS

5.1 Audit Logging. AHT shall enable and maintain comprehensive audit logs for all systems that store, process, or transmit Licensed Data. Logs shall capture, at a minimum, the following information for each logged event:

(a) user identity (unique user identifier);

(b) type of event (e.g., access, modification, deletion, export, query, login, logout, privilege change);

(c) date and time of the event, synchronized to a reliable time source (e.g., NTP-synchronized clock with accuracy to within one second);

(d) success or failure indication of the event;

(e) source and destination identifiers, including but not limited to IP address, hostname, and system name; and

(f) identification of the affected data objects or records, to the extent technically feasible without capturing the substantive content of the Licensed Data itself.

Audit logging shall be enabled on all components of the Licensed Data environment, including databases, application servers, file servers, network devices, authentication systems, and cloud management consoles.

5.2 Log Retention. Audit logs shall be retained for a minimum period of three (3) years from the date of creation, or such longer period as required by applicable law or as necessary in connection with the investigation or resolution of a Security Incident. During the retention period, logs shall be stored in a manner that preserves their integrity, availability, and accessibility for review, investigation, or audit purposes.

5.3 Log Integrity. AHT shall implement measures to protect audit logs from unauthorized modification, deletion, or tampering, including one or more of the following: (a) write-once storage (WORM); (b) cryptographic hashing of log entries with hash values stored separately from the log data; (c) forwarding of log data to a centralized, access-restricted log management system (e.g., a Security Information and Event Management (SIEM) platform); or (d) equivalent tamper-evident controls that provide an auditable chain of custody for log data. Administrative access to log management systems shall be restricted to a limited number of authorized personnel and shall be logged separately.

5.4 Log Monitoring and Alerting. AHT shall implement automated monitoring of audit logs for anomalous or unauthorized activity related to Licensed Data, including but not limited to:

(a) failed login attempts exceeding defined thresholds (e.g., five or more consecutive failures within a ten-minute window);

(b) access to Licensed Data systems outside of normal business hours (as defined by AHT's standard operating schedule) by users not specifically authorized for off-hours access;

(c) bulk data exports, downloads, or queries that retrieve an unusually large volume of Licensed Data records relative to the user's normal activity patterns; and

(d) privilege escalation events, including attempts to obtain administrative or elevated access to Licensed Data systems.

Alerts generated by the automated monitoring system shall be reviewed and investigated by qualified security personnel within twenty-four (24) hours of generation. AHT shall maintain records of alert investigations, including the nature of the alert, the investigative steps taken, and the resolution, for a period of no less than three (3) years.

5.5 Availability for Audit. Audit logs relating to the Licensed Data shall be made available to Licensor or its designated auditor upon reasonable request in connection with any compliance audit conducted under the Agreement or Section 9 of this Exhibit C. AHT shall provide such logs in a reasonably accessible electronic format within ten (10) business days of receiving a request, or such shorter period as may be necessary in connection with the investigation of a Security Incident. AHT shall cooperate with Licensor and its auditor in interpreting and analyzing audit log data.

6. PHYSICAL SECURITY

6.1 Facility Controls. Any AHT facility (including co-located data centers and cloud provider facilities) where Licensed Data is stored or processed shall employ physical access controls including, at a minimum:

(a) controlled entry points with electronic access badges, proximity cards, biometric readers, or equivalent authentication mechanisms, with access rights assigned based on job function and reviewed no less frequently than quarterly;

(b) visitor registration and escort requirements, requiring all visitors to sign in, display identification, and be escorted by authorized AHT personnel at all times while within areas where Licensed Data is stored or processed;

(c) video surveillance at entry and exit points, with recordings retained for at least ninety (90) days and made available for review in connection with the investigation of a Security Incident or a compliance audit; and

(d) environmental controls, including fire detection and suppression systems, climate control (temperature and humidity), and uninterruptible power supply (UPS) with backup generator capability sufficient to ensure orderly system shutdown or sustained operation during power outages.

AHT shall maintain records of physical access to areas where Licensed Data is stored or processed, including the identity of the individual, the date and time of entry and exit, and the purpose of access, and shall retain such records for a period of no less than one (1) year.

6.2 Cloud Hosting. To the extent AHT stores or processes Licensed Data in a cloud computing environment, AHT shall ensure that the cloud service provider maintains a current SOC 2 Type II report (or equivalent, such as ISO 27001 certification) covering the trust service criteria relevant to security, availability, and confidentiality. AHT shall review the cloud provider's SOC 2 Type II report (or equivalent) no less frequently than annually and shall promptly notify Licensor of any material deficiencies or qualifications identified in such reports. AHT's cloud configuration shall comply with all requirements of this Exhibit C, including without limitation the encryption, access control, logging, and network segmentation requirements set forth herein. AHT shall remain fully responsible for the security of Licensed Data regardless of the hosting environment, and the use of a cloud service provider shall not diminish or limit AHT's obligations under this Exhibit C or the Agreement. Upon request, AHT shall identify to Licensor the cloud service provider(s) and the geographic region(s) in which Licensed Data is hosted.

6.3 Removable Media. Licensed Data shall not be stored on removable media (including but not limited to USB flash drives, portable hard drives, external solid-state drives, optical media such as CDs and DVDs, and magnetic tape cartridges) unless expressly approved in writing by the Security Officer on a case-by-case basis. Any removable media approved for storage of Licensed Data shall be encrypted in accordance with Section 2.1 of this Exhibit C, labeled as containing confidential information, tracked in an inventory maintained by the Security Officer, and stored in a physically secure location when not in active use. Removable media containing Licensed Data shall be securely destroyed in accordance with Section 10.2 when no longer needed.

7. PERSONNEL SECURITY

7.1 Background Checks. AHT shall conduct background checks on all personnel with access to Licensed Data, to the extent permitted by applicable law, prior to granting such access. Background checks shall include, at a minimum, verification of identity, criminal history review, and verification of employment history. AHT shall maintain records confirming that background checks have been completed for all personnel with access to Licensed Data, and shall make such records available to Licensor or its designated auditor upon request in connection with a compliance audit, subject to applicable privacy restrictions.

7.2 Security Awareness Training. All AHT personnel with access to Licensed Data shall complete security awareness training upon initial access provisioning and no less frequently than annually thereafter. Training shall cover, at a minimum:

(a) AHT's Security Program and applicable policies, including acceptable use, data handling, and incident reporting policies;

(b) data-handling and classification procedures applicable to the Licensed Data, including the requirements of this Exhibit C;

(c) phishing awareness, social engineering techniques, and best practices for recognizing and reporting suspicious communications;

(d) the non-re-identification covenant under the Agreement, including the definition, scope, and consequences of re-identification; and

(e) incident-reporting procedures, including how to recognize and report a potential Security Incident and the identity and contact information of the Security Officer or incident response team.

AHT shall maintain records of training completion, including the date of training, the topics covered, and the identity of each individual who completed the training. Personnel who fail to complete required training within thirty (30) days of the scheduled date shall have their access to Licensed Data suspended until training is completed.

7.3 Confidentiality Obligations. All AHT personnel with access to Licensed Data shall be bound by written confidentiality obligations at least as protective as those set forth in the Agreement and the Mutual Non-Disclosure Agreement between the parties (Reference No. AHT-PCA-NDA-2024-001, dated May 13, 2024). AHT shall ensure that all such personnel have executed appropriate confidentiality agreements prior to being granted access to Licensed Data. Contractors and temporary personnel shall execute confidentiality agreements that specifically reference their obligations with respect to the Licensed Data before any access is provisioned.

8. INCIDENT RESPONSE PROCEDURES

8.1 Incident Response Plan. AHT shall maintain a written incident response plan (the "IRP") that addresses the identification, containment, eradication, recovery, and post-incident review of Security Incidents. A "Security Incident" means any actual or reasonably suspected unauthorized access, acquisition, use, disclosure, modification, or destruction of Licensed Data, or any breach of the security, confidentiality, or integrity of systems containing Licensed Data. The IRP shall identify the members of AHT's incident response team, define escalation procedures, establish communication protocols (both internal and external), and include procedures for evidence preservation. AHT shall test the IRP through tabletop exercises or simulations no less frequently than annually, and shall update the IRP as necessary based on lessons learned from exercises and actual incidents.

8.2 Notification to Licensor. AHT shall notify Licensor of any Security Incident involving Licensed Data within seventy-two (72) hours of AHT's becoming aware of such incident. Notification shall be provided to Licensor's Chief Privacy Officer, Dr. Anita Mehta, at the contact information specified in the Agreement (or such other contact as Licensor may designate in writing), and shall include:

(a) a description of the nature and scope of the Security Incident, including the date and time of discovery and the estimated date and time of occurrence;

(b) the categories and approximate volume of Licensed Data affected;

(d) the identity and contact information of AHT's designated incident coordinator; and

(e) a preliminary assessment of whether any re-identification of individuals may have occurred or could reasonably be expected to occur as a result of the Security Incident.

AHT acknowledges that the seventy-two (72)-hour notification period is a maximum timeframe and that earlier notification is expected where feasible, particularly in cases involving suspected re-identification or large-scale unauthorized access to Licensed Data.

8.3 Cooperation. AHT shall cooperate fully with Licensor in investigating and remediating any Security Incident, including providing supplemental information, access to relevant systems and personnel, and updates as reasonably requested by Licensor. AHT shall provide written follow-up reports at intervals of no greater than five (5) business days until the Security Incident is fully resolved. AHT shall preserve all evidence related to the Security Incident in accordance with applicable law and best practices for digital forensics, and shall not destroy or alter any such evidence without the prior written consent of Licensor.

8.4 Regulatory Notifications. AHT shall coordinate with Licensor prior to making any notification to governmental authorities, regulators, law enforcement agencies, or affected individuals (if applicable) regarding a Security Incident involving Licensed Data, except where delay in making such notification would violate applicable law. Where applicable law requires immediate or expedited notification that does not permit prior coordination, AHT shall notify Licensor concurrently with or as soon as reasonably practicable following the regulatory notification, and shall provide Licensor with a copy of the notification made.

8.5 Root Cause Analysis. Within thirty (30) calendar days following the resolution of a Security Incident, AHT shall complete and provide to Licensor a written root cause analysis, which shall include: (a) a detailed description of the events leading to the Security Incident; (b) an identification of the root cause(s); (c) a description of the immediate and long-term remediation steps implemented or planned; (d) lessons learned; and (e) updates to the IRP or Security Program, if any, resulting from the analysis. Licensor shall have the right to review and comment on the root cause analysis and to request additional remediation measures if reasonably warranted.

9. COMPLIANCE AUDITS

9.1 Annual Audit Right. Licensor may audit AHT's compliance with these Data Security Requirements once per calendar year upon no less than thirty (30) days' prior written notice. Such notice shall specify the proposed scope and approximate duration of the audit. Audits shall be conducted by an independent third party mutually agreed upon by the parties. The default auditor, absent mutual agreement to the contrary, shall be Crestfield Advisory Group LLP, with offices at 1345 Avenue of the Americas, 22nd Floor, New York, NY 10105. The auditor shall execute a non-disclosure agreement reasonably acceptable to AHT prior to commencing any audit. In addition to the annual audit right, Licensor may conduct one additional audit per year in the event of a Security Incident involving Licensed Data, without regard to whether the annual audit has already been exercised for such calendar year.

9.2 Scope of Audit. The audit may include, without limitation:

(a) review of AHT's Security Program documentation, including policies, procedures, risk assessments, and training records;

(b) inspection of technical controls, including encryption configurations, access control mechanisms, logging infrastructure, and network security architecture;

(d) interviews with AHT security personnel, including the Security Officer and members of the incident response team; and

(e) penetration testing of systems storing or processing Licensed Data, subject to reasonable scheduling and scope limitations to minimize disruption to AHT's business operations. Penetration testing shall be conducted during mutually agreed timeframes and shall be limited to systems within the Licensed Data environment.

AHT shall provide the auditor with reasonable access to facilities, systems, personnel, and documentation necessary to conduct the audit. AHT shall designate a point of contact to coordinate audit logistics and facilitate the auditor's work.

9.3 Audit Costs. The costs of any audit conducted pursuant to this Section 9 shall be borne by Licensor, unless the audit reveals a material non-compliance with these Data Security Requirements, in which case the costs of such audit (and any necessary re-audit conducted to verify remediation) shall be borne by AHT. For purposes of this Section 9.3, "material non-compliance" means any deficiency that, individually or in the aggregate, creates a reasonably foreseeable risk of unauthorized access to, disclosure of, or loss of Licensed Data, or that constitutes a failure to implement any control required by Sections 2, 3, 4, 5, or 8 of this Exhibit C.

9.4 Remediation. If an audit identifies any non-compliance with these Data Security Requirements, AHT shall develop and submit to Licensor a written remediation plan within fifteen (15) business days of receiving the audit findings. The remediation plan shall describe: (a) each finding of non-compliance; (b) the root cause of each finding; (c) the specific corrective actions to be taken; (d) the responsible individual for each corrective action; and (e) the timeline for completion. AHT shall implement the remediation plan within the timeframe specified therein, which shall not exceed sixty (60) calendar days from the date of the remediation plan, unless otherwise agreed in writing by Licensor. Licensor shall have the right to conduct a follow-up audit to verify completion of remediation, at AHT's cost in the case of material non-compliance as defined in Section 9.3.

9.5 Certifications. In lieu of (but not as a substitute for) the annual audit right described in Section 9.1, AHT may provide to Licensor, upon request, copies of SOC 2 Type II reports, ISO 27001 certifications, or equivalent third-party security assessments covering the systems and environments used to store and process Licensed Data. Such reports or certifications shall have been issued within the twelve (12) months preceding the date of Licensor's request. The provision of such reports or certifications shall not limit or waive Licensor's right to conduct an audit under Section 9.1, but Licensor agrees to consider the scope and findings of such reports or certifications when determining the scope and extent of any audit.

10. DATA RETENTION AND DESTRUCTION

10.1 Retention During Term. AHT may retain Licensed Data throughout the term of the Agreement (initial term of five (5) years from the Effective Date, July 1, 2024, through June 30, 2029, plus any renewal terms) solely for the Permitted Uses specified in the Agreement. AHT shall not retain Licensed Data beyond the term of the Agreement except as expressly permitted under Section 10.4 of this Exhibit C. During the term, AHT shall maintain an inventory of all systems, databases, and storage media containing Licensed Data, and shall ensure that all such systems remain subject to the security requirements of this Exhibit C.

10.2 Data Destruction Upon Termination or Expiration. Within thirty (30) calendar days following the expiration or termination of the Agreement for any reason, AHT shall securely destroy or return to Licensor (at Licensor's election) all copies of the Licensed Data in AHT's possession or control, including copies stored in primary databases, backups, development and test environments, staging environments, disaster recovery systems, and any other storage medium. Destruction shall be accomplished using methods consistent with NIST SP 800-88, Revision 1 (Guidelines for Media Sanitization), including:

(a) cryptographic erasure for encrypted data, achieved by securely destroying all copies of the encryption key(s) used to protect the Licensed Data, rendering the encrypted data permanently irrecoverable;

(b) secure overwrite (minimum three-pass overwrite using DoD 5220.22-M methodology, or equivalent) for magnetic media; and

(c) physical destruction (shredding, degaussing, or incineration) for physical media that cannot be effectively sanitized through logical methods.

AHT shall select the destruction method appropriate to the type of media and the sensitivity of the Licensed Data, in accordance with the guidance provided in NIST SP 800-88.

10.3 Destruction Certificate. Within ten (10) business days following completion of data destruction, AHT shall provide Licensor with a written certificate, signed by the Security Officer, confirming:

(a) the date(s) on which destruction was completed;

(b) the methods of destruction employed for each category of media or system;

(c) a description of the media and systems from which Licensed Data was destroyed, including system identifiers, media types, and storage locations; and

(d) confirmation that no copies of Licensed Data remain in AHT's possession or control, except as expressly permitted under Section 10.4 of this Exhibit C.

The destruction certificate shall be in the form of a sworn declaration or officer's certificate, and shall be retained by both parties for a period of no less than five (5) years following the date of destruction.

10.4 Exceptions. Notwithstanding Section 10.2:

(a) AHT shall not be required to destroy copies of Licensed Data contained in routine backup archives that are not reasonably accessible (i.e., offline or near-line backup tapes maintained solely for disaster recovery purposes), provided that (i) such archived copies remain subject to all use restrictions, confidentiality obligations, and security requirements of the Agreement and this Exhibit C for so long as they are retained, (ii) AHT shall not access or restore such archived copies for any purpose other than disaster recovery verification or compliance with legal obligations, and (iii) such archived copies are destroyed in accordance with AHT's standard backup rotation schedule, which shall not exceed one hundred eighty (180) days following the effective date of termination or expiration of the Agreement;

(b) AHT shall retain ownership of and the right to continue using all analytics, algorithms, models, insights, and derivative works produced using the Licensed Data that do not, individually or in combination, permit reconstruction of the underlying Licensed Data at the individual-claim-line level, as provided in the Agreement. For avoidance of doubt, aggregated statistical outputs, model parameters, feature weights, and performance metrics that are derived from the Licensed Data but do not contain or reveal individual claim-line data are not considered Licensed Data and are not subject to the destruction requirements of this Section 10; and

(c) AHT personnel may retain residual knowledge as provided in the residual-knowledge clause of the Agreement (Section 7.4 thereof), subject to the non-re-identification covenant set forth in the Agreement and Section 13.1 of this Exhibit C.

11. SUBCONTRACTORS AND THIRD-PARTY ACCESS

11.1 Restrictions. AHT shall not provide access to Licensed Data to any subcontractor, contractor, consultant, or other third party without the prior written consent of Licensor. Any request for such consent shall be submitted to Licensor in writing and shall identify the proposed third party, the scope and purpose of the access, the duration of the access, and the security measures that the third party will implement to protect the Licensed Data. Licensor shall have the right to approve or deny any such request in its sole discretion, and any approval may be subject to conditions specified by Licensor. Licensor's consent to one third party shall not constitute consent to any other third party or to any expansion of the approved scope of access.

11.2 Flow-Down Requirements. Any third party approved by Licensor to access Licensed Data shall be bound by a written agreement containing obligations at least as protective as the requirements of this Exhibit C, including without limitation the encryption, access control, logging, incident response, and data destruction requirements set forth herein. Such third party shall also be subject to the same use restrictions, confidentiality obligations, and non-re-identification covenant as AHT under the Agreement. AHT shall provide Licensor with a copy of the relevant security provisions of any agreement with an approved third party upon request.

11.3 Responsibility. AHT shall remain fully responsible for the acts and omissions of any approved third party with respect to Licensed Data as if such acts and omissions were those of AHT. Any breach of this Exhibit C or the Agreement by an approved third party shall be deemed a breach by AHT. AHT shall monitor the security practices of approved third parties through periodic assessments and shall promptly notify Licensor of any actual or suspected non-compliance by a third party with the requirements of this Exhibit C.

12. BUSINESS CONTINUITY AND DISASTER RECOVERY

12.1 BCP/DR Plans. AHT shall maintain business continuity and disaster recovery plans ("BCP/DR Plans") that address the protection and recovery of Licensed Data in the event of a natural disaster, system failure, cyberattack, pandemic, or other disruptive event. The BCP/DR Plans shall identify critical systems and data, establish recovery priorities, define roles and responsibilities, and specify communication protocols. AHT shall review and update the BCP/DR Plans no less frequently than annually and shall test the plans through exercises or simulations no less frequently than annually. Upon request, AHT shall provide Licensor with a summary of the BCP/DR Plans as they relate to the Licensed Data.

12.2 Backup Requirements. Licensed Data backups shall be encrypted in accordance with Section 2.1 of this Exhibit C, stored in geographically separate locations from primary systems (with a minimum separation sufficient to mitigate regional disaster risks), and tested for recoverability no less frequently than annually. Backup testing shall include verification that backed-up Licensed Data can be restored to a functional state within the recovery time specified in Section 12.3. AHT shall maintain backup schedules and retention policies that ensure the availability of current and recoverable copies of Licensed Data at all times during the term of the Agreement.

12.3 Recovery Time. AHT shall use commercially reasonable efforts to restore access to Licensed Data within seventy-two (72) hours following a disruptive event. AHT shall notify Licensor promptly of any disruptive event that materially affects the availability or integrity of Licensed Data, and shall provide periodic updates regarding recovery progress until normal operations are restored.

13. SPECIFIC PROHIBITIONS

13.1 Re-Identification. Consistent with AHT's covenant in the Agreement, AHT shall not, and shall not permit any personnel, contractor, or third party to, use the Licensed Data, alone or in combination with any other information, data set, or technique, to identify, contact, or re-identify any individual whose data is included in the Licensed Data. This prohibition extends to any attempt, whether successful or unsuccessful, to link Licensed Data records to specific individuals or to associate Licensed Data with directly identifying information (e.g., name, address, Social Security number, or other government-issued identifier). Any actual or suspected re-identification event shall be treated as a Security Incident under Section 8 of this Exhibit C and shall be reported to Licensor in accordance with Section 8.2. Re-identification of individuals shall be subject to the uncapped liability provision set forth in the Agreement for re-identification breach, and may constitute grounds for immediate termination of the Agreement by Licensor.

13.2 Prohibited Transfers. AHT shall not sub-license, sell, transfer, or otherwise make available the raw Licensed Data to any third party. This prohibition applies regardless of the form or medium of the Licensed Data, including but not limited to electronic files, database extracts, printed reports, or any other tangible or intangible form. For avoidance of doubt, this prohibition does not restrict AHT from integrating aggregated, non-reversible analytics, model outputs, or derivative insights into AHT's SaaS platform for use by AHT's end customers, as expressly permitted under the Agreement, provided that such outputs do not permit reconstruction of the underlying Licensed Data at the individual-claim-line level.

13.3 Geographic Restrictions. Licensed Data shall be stored and processed exclusively within the United States, including its territories and possessions. AHT shall not transfer, transmit, or store Licensed Data outside the United States, or permit any third party to do so, without the prior written consent of Licensor. AHT shall implement technical and organizational controls to prevent the inadvertent transfer of Licensed Data to systems or storage locations outside the United States, including configuration of cloud hosting environments to restrict data residency to United States regions. AHT shall promptly notify Licensor if AHT becomes aware of any unauthorized transfer of Licensed Data outside the United States.

14. INSURANCE

14.1 AHT Coverage. AHT shall maintain cyber liability insurance coverage with limits of not less than Ten Million Dollars ($10,000,000) per occurrence and in the aggregate throughout the term of the Agreement, including coverage for data breach response costs, regulatory fines and penalties (to the extent insurable), business interruption, and third-party liability arising from unauthorized access to or disclosure of data in AHT's possession or control. AHT's current cyber liability carrier is Commonwealth Mutual Assurance Corp. AHT shall provide Licensor with a certificate of insurance evidencing such coverage upon request, and in any event within thirty (30) days of the Effective Date and within thirty (30) days of each policy renewal. The certificate shall name Pinnacle Claims Analytics LLC as an additional insured to the extent permitted by the applicable policy.

14.2 Notice of Changes. AHT shall provide Licensor with at least thirty (30) days' prior written notice of any material reduction in, cancellation of, or non-renewal of such cyber liability insurance coverage. A material reduction includes any decrease in the per-occurrence or aggregate limit below Ten Million Dollars ($10,000,000), any exclusion of coverage for data breach or cyber incidents, or any change in the policy terms that would materially affect the scope of coverage applicable to AHT's obligations under the Agreement. In the event of a material reduction, cancellation, or non-renewal, AHT shall use commercially reasonable efforts to obtain replacement coverage on substantially similar terms and shall notify Licensor when such replacement coverage has been obtained.

15. UPDATES AND MODIFICATIONS

15.1 Evolving Standards. AHT acknowledges that security threats and industry standards evolve over time, and that the security measures described in this Exhibit C represent minimum requirements as of the Effective Date. AHT shall update its Security Program as necessary to maintain alignment with the then-current version of NIST SP 800-171 and industry best practices for the protection of de-identified healthcare data. AHT shall monitor publications and guidance from NIST, the Department of Health and Human Services, and other relevant authorities, and shall incorporate changes to applicable standards into its Security Program within a reasonable period following publication (not to exceed twelve (12) months following the effective date of any updated standard). AHT shall notify Licensor of any material updates to its Security Program that affect the protection of Licensed Data.

15.2 Amendment. These Data Security Requirements may be amended only by a written instrument signed by authorized representatives of both Licensor and Licensee. Either party may propose updates to these Data Security Requirements to reflect changes in applicable law, regulatory guidance, industry standards, or the threat landscape. The parties shall negotiate any such proposed updates in good faith and shall endeavor to reach agreement within sixty (60) days of receipt of a proposal. Pending agreement on any proposed amendment, the existing requirements of this Exhibit C shall remain in full force and effect.

16. DEFINITIONS

For purposes of this Exhibit C, the following terms shall have the meanings set forth below:

"Licensed Data" means the data licensed to AHT under the Agreement, as defined therein and further described in Exhibit A to the Agreement, consisting of de-identified healthcare claims data sourced from Licensor's proprietary databases.

"Permitted Uses" means the uses of Licensed Data authorized under the Agreement, specifically: internal analytics, model training, product development, and integration into AHT's SaaS platform. Permitted Uses expressly exclude the re-sale, sub-licensing, or transfer of raw Licensed Data to any third party.

"Security Incident" has the meaning set forth in Section 8.1 of this Exhibit C.

"Security Officer" has the meaning set forth in Section 1.2 of this Exhibit C.

"Security Program" has the meaning set forth in Section 1.1 of this Exhibit C.

All other capitalized terms used but not defined in this Exhibit C shall have the meanings ascribed to them in the Agreement (Reference No. AHT-PCA-DLA-2024-001).

[Remainder of this page intentionally left blank. Signature page follows.]

EXHIBIT C — DATA SECURITY REQUIREMENTS

SIGNATURE PAGE

IN WITNESS WHEREOF, the undersigned authorized representatives of the parties have executed this Exhibit C as of the Effective Date set forth above, acknowledging that these Data Security Requirements are incorporated into and form a part of the Agreement.

PINNACLE CLAIMS ANALYTICS LLC

By: ________

Name: Dr. Anita Mehta

Title: Chief Privacy Officer

Date: ________

ARBOR HEALTH TECHNOLOGIES INC.

By: ________

Name: ________

Title: ________

Date: ________

Exhibit C — Data Security Requirements

EXHIBIT C
DATA SECURITY REQUIREMENTS
Exhibit C to the Data License Agreement Reference No. AHT-PCA-DLA-2024-001
by and between
PINNACLE CLAIMS ANALYTICS LLC ("Licensor" or "PCA")
and
ARBOR HEALTH TECHNOLOGIES INC. ("Licensee" or "AHT")
Effective Date: July 1, 2024
This Exhibit C is attached to and incorporated by reference into the Data License Agreement dated as of July 1, 2024 (the "Agreement"), by and between Pinnacle Claims Analytics LLC, a Delaware limited liability company with principal offices at 3100 West End Avenue, Suite 800, Nashville, TN 37203 ("Licensor"), and Arbor Health Technologies Inc., a Delaware corporation with principal offices at 400 Seaport Boulevard, Suite 1200, Boston, MA 02210 ("Licensee"). Capitalized terms used but not defined herein shall have the meanings ascribed to them in the Agreement. These Data Security Requirements set forth the minimum technical and organizational security measures that Licensee shall implement and maintain throughout the term of the Agreement with respect to the Licensed Data, aligned with the National Institute of Standards and Technology Special Publication 800-171 ("NIST SP 800-171"). In the event of any conflict between the provisions of this Exhibit C and the body of the Agreement, the provision that imposes the more protective or more stringent security obligation with respect to the Licensed Data shall control.
1. GENERAL OBLIGATIONS AND STANDARDS
1.1 Security Program. AHT shall establish, implement, and maintain a comprehensive written information security program (the "Security Program") that includes administrative, technical, and physical safeguards designed to protect the confidentiality, integrity, and availability of the Licensed Data. The Security Program shall be aligned with and meet or exceed the requirements of NIST SP 800-171, Revision 2 (or any successor version published during the term of the Agreement). The Security Program shall be reasonably designed to address the specific nature of the Licensed Data, including the volume, sensitivity, and de-identified healthcare claims character of such data. AHT shall maintain current documentation describing its Security Program and shall make such documentation available to Licensor upon request in connection with any audit conducted pursuant to Section 9 of this Exhibit C.
1.2 Responsible Personnel. AHT shall designate a qualified individual (the "Security Officer") responsible for the overall management, implementation, and enforcement of the Security Program. The Security Officer shall possess qualifications commensurate with the scope and complexity of AHT's data security obligations under the Agreement, including relevant professional certifications (e.g., CISSP, CISM, or equivalent) or equivalent experience. AHT shall provide Licensor with the name and contact information of the Security Officer within ten (10) business days of the Effective Date, and shall promptly notify Licensor of any change in such designation. In the event of a vacancy in the Security Officer position, AHT shall designate an interim Security Officer within five (5) business days and shall appoint a permanent replacement within forty-five (45) calendar days.
1.3 Compliance with Applicable Law. AHT's security measures shall comply with all applicable federal, state, and local laws and regulations, including without limitation the Health Insurance Portability and Accountability Act of 1996 ("HIPAA") as applicable to de-identified data, the Massachusetts data-privacy laws under M.G.L. c. 93H and the accompanying regulations at 201 CMR 17.00, and the California Confidentiality of Medical Information Act ("CMIA") to the extent any Licensed Data includes California-sourced claims. AHT shall monitor changes in applicable law and regulation and shall update its Security Program as necessary to maintain compliance. Nothing in this Exhibit C shall be construed to limit AHT's obligations under any applicable law or regulation that imposes requirements more stringent than those set forth herein.
1.4 Risk Assessments. AHT shall conduct a documented risk assessment of its Security Program no less frequently than annually, and shall promptly implement remedial measures to address any identified deficiencies. Each risk assessment shall evaluate, at a minimum: (a) the current threat landscape relevant to healthcare claims data; (b) the adequacy of existing administrative, technical, and physical controls; (c) the effectiveness of access controls and encryption measures; (d) the security of third-party integrations and subcontractor arrangements; and (e) any changes in AHT's technology infrastructure, business operations, or regulatory environment that may affect the security of the Licensed Data. Upon request, AHT shall provide Licensor with a summary of the findings and remediation actions from each annual risk assessment, subject to reasonable redaction of information not related to the Licensed Data.
2. ENCRYPTION STANDARDS
2.1 Encryption at Rest. All Licensed Data stored on AHT's systems, including primary databases, backup media, removable storage devices, and cloud storage environments, shall be encrypted using the Advanced Encryption Standard (AES) with a minimum key length of 256 bits (AES-256). Encryption shall be applied at the storage volume level, at the database level, or at the file level, as appropriate, to ensure that Licensed Data is rendered unintelligible to any person who does not possess the applicable decryption key. AHT shall ensure that encryption at rest is enabled and verified across all storage tiers, including hot, warm, and cold storage, and across all environments in which Licensed Data resides, including production, staging, development, testing, quality assurance, and disaster recovery environments.
2.2 Encryption in Transit. All Licensed Data transmitted between AHT systems or between AHT and any authorized third party shall be encrypted using AES-256 or equivalent encryption protocols. For network transmissions, AHT shall employ Transport Layer Security (TLS) version 1.2 or higher, configured with cipher suites that provide forward secrecy (e.g., ECDHE key exchange). For file transfers, AHT shall employ SFTP with AES-256 encryption. The initial data delivery and all quarterly data refreshes under the Agreement shall be transmitted via encrypted SFTP using AES-256 encryption, as specified in Exhibit A to the Agreement. Deprecated or weak encryption protocols, including but not limited to SSL 2.0, SSL 3.0, TLS 1.0, and TLS 1.1, shall not be used in connection with the transmission of Licensed Data. AHT shall validate encryption configurations on a quarterly basis to ensure ongoing compliance with this Section 2.2.
2.3 Key Management. AHT shall implement and maintain a formal cryptographic key management program that includes secure key generation, distribution, storage, rotation, and destruction procedures. Key generation shall utilize cryptographically secure random number generators approved under FIPS 140-2 (or its successor, FIPS 140-3). Encryption keys shall be rotated no less frequently than annually, or more frequently if warranted by a Security Incident or change in risk posture. Key material shall not be stored alongside encrypted Licensed Data, and shall be protected by access controls at least as stringent as those applied to the Licensed Data itself. AHT shall maintain a current inventory of all encryption keys used to protect Licensed Data, including the date of generation, the associated data or system, the custodian, and the scheduled rotation date. Upon key retirement or destruction, AHT shall employ secure destruction methods that render the key material irrecoverable.
2.4 Prohibition on Unencrypted Storage. At no time shall Licensed Data be stored or transmitted in unencrypted form, except during active processing in volatile memory (RAM) within secured computing environments that are protected by the access controls, network segmentation, and monitoring measures described in this Exhibit C. AHT shall implement technical controls to prevent the inadvertent or unauthorized storage of Licensed Data in unencrypted form, including data loss prevention (DLP) tools configured to detect and block unencrypted exports or transfers of Licensed Data.
3. ACCESS CONTROLS
3.1 Role-Based Access Control (RBAC). AHT shall implement role-based access controls that limit access to Licensed Data to only those AHT personnel whose job functions require such access for the Permitted Uses set forth in the Agreement, namely internal analytics, model training, product development, and integration into AHT's SaaS platform. Access rights shall be assigned based on the principle of least privilege, such that each user is granted only the minimum level of access necessary to perform their assigned duties. AHT shall define and document discrete access roles, specifying for each role the scope of access to Licensed Data (e.g., read-only, read-write, administrative), and shall review and update role definitions no less frequently than annually. Segregation of duties shall be enforced for sensitive functions, including but not limited to key management, access provisioning, and audit log administration.
3.2 Multi-Factor Authentication (MFA). All AHT personnel and authorized contractors accessing systems that store, process, or transmit Licensed Data shall authenticate using multi-factor authentication, which shall consist of at least two of the following independent factors:
(a) something the user knows (e.g., a password, passphrase, or personal identification number);
(b) something the user has (e.g., a hardware security token, smart card, or registered mobile device capable of receiving or generating time-based one-time passwords); and
(c) something the user is (e.g., a biometric identifier such as a fingerprint, facial recognition, or retinal scan).
MFA shall be required for all access methods, including local console access, remote access via VPN, web-based application access, and access to cloud management consoles. AHT shall not permit MFA bypass or exception without the documented, time-limited approval of the Security Officer.
3.3 Unique User Identification. Each individual with access to Licensed Data shall be assigned a unique user identifier that is traceable to a specific natural person. Shared or generic accounts shall be prohibited for access to Licensed Data. Service accounts used by automated systems to access Licensed Data shall be individually named, documented, assigned to a responsible human custodian, and subject to the same access controls and monitoring requirements as individual user accounts.
3.4 Access Provisioning and De-Provisioning. AHT shall implement formal procedures for granting, modifying, and revoking access to Licensed Data, including:
(a) documented approval by the Security Officer or a designated delegate prior to initial access provisioning, which approval shall specify the access role, the business justification, and the expected duration of access;
(b) prompt de-provisioning of access upon termination or reassignment of personnel, with access revoked within twenty-four (24) hours of termination of employment or contract, and within five (5) business days of reassignment to a role that does not require access to Licensed Data; and
(c) quarterly reviews of all access privileges associated with Licensed Data to confirm that each access right remains appropriate and necessary. The results of quarterly access reviews shall be documented and retained for a period of no less than three (3) years.
3.5 Password Requirements. Passwords used to access systems containing Licensed Data shall meet the following minimum complexity and management requirements:
(a) a minimum length of twelve (12) characters;
(b) inclusion of at least one character from each of the following categories: uppercase letters, lowercase letters, numeric digits, and special characters;
(c) passwords shall be changed no less frequently than every ninety (90) days;
(d) passwords shall not be reused within a twelve (12)-cycle history;
(e) account lockout shall be enforced after no more than five (5) consecutive failed login attempts, with lockout duration of no less than fifteen (15) minutes or until reset by an authorized administrator; and
(f) passwords shall be stored using salted, one-way cryptographic hashing algorithms (e.g., bcrypt, scrypt, or Argon2) and shall not be stored in plaintext or reversibly encrypted form.
3.6 Remote Access. Remote access to systems containing Licensed Data shall be permitted only through AHT-managed virtual private network (VPN) connections employing AES-256 encryption, subject to MFA as described in Section 3.2 of this Exhibit C. Split tunneling shall be disabled on VPN connections used to access systems containing Licensed Data. AHT shall maintain logs of all remote access sessions, including the identity of the user, the date and time of connection and disconnection, and the network address from which the connection originated. Personal or unmanaged devices shall not be used to access Licensed Data unless expressly approved in writing by the Security Officer and subject to endpoint security requirements equivalent to those applied to AHT-managed devices.
4. NETWORK SECURITY AND SYSTEM HARDENING
4.1 Network Segmentation. AHT shall logically segregate systems and network segments that store or process Licensed Data from general-purpose corporate networks, development environments that do not require access to Licensed Data, and guest or public-facing network segments. Firewalls, intrusion detection/prevention systems (IDS/IPS), and network access control lists shall be deployed at all network boundaries separating Licensed Data environments from other network segments. Firewall rules and access control lists shall be reviewed and validated no less frequently than quarterly, and shall follow a default-deny posture, permitting only traffic that is expressly authorized and documented. AHT shall maintain current network architecture diagrams that clearly identify the location of Licensed Data within the network topology, and shall make such diagrams available to Licensor or its designated auditor upon request in connection with any audit conducted pursuant to Section 9.
4.2 System Hardening. All systems that store, process, or transmit Licensed Data shall be hardened in accordance with industry-standard configuration baselines, such as those published by the Center for Internet Security (CIS Benchmarks), the Defense Information Systems Agency (DISA STIGs), or equivalent. At a minimum, system hardening shall include: (a) removal or disabling of unnecessary services, ports, protocols, and default accounts; (b) disabling or restricting the use of administrative tools and utilities to authorized personnel; (c) configuration of operating system and application settings in accordance with vendor security guidance; and (d) documentation and periodic review of any deviations from baseline configurations. AHT shall validate system configurations against the applicable baseline no less frequently than quarterly and shall remediate deviations within thirty (30) days of identification.
4.3 Vulnerability Management. AHT shall implement a vulnerability management program that includes:
(a) automated vulnerability scanning of all systems containing Licensed Data no less frequently than monthly, using commercially available vulnerability scanning tools with current vulnerability signature databases;
(b) prioritized remediation of identified vulnerabilities, with critical vulnerabilities (CVSS score 9.0 or higher) remediated within fifteen (15) calendar days of identification, high vulnerabilities (CVSS score 7.0–8.9) remediated within thirty (30) calendar days, and medium vulnerabilities (CVSS score 4.0–6.9) remediated within sixty (60) calendar days; and
(c) application of security patches within timelines consistent with the foregoing remediation schedule, with emergency out-of-band patches for actively exploited zero-day vulnerabilities applied as soon as reasonably practicable, but in no event later than seventy-two (72) hours after patch availability.
AHT shall maintain records of vulnerability scan results and remediation actions for a period of no less than three (3) years.
4.4 Malware Protection. AHT shall deploy and maintain up-to-date anti-malware software on all endpoints and servers that access or store Licensed Data, with real-time scanning enabled and malware definitions updated at least daily. AHT shall configure anti-malware software to perform scheduled full-system scans no less frequently than weekly. AHT shall additionally employ endpoint detection and response (EDR) capabilities on systems that store or process Licensed Data to detect advanced persistent threats and fileless malware. Any malware detection involving a system that stores or processes Licensed Data shall be investigated to determine whether Licensed Data was accessed or exfiltrated, and if such determination cannot be ruled out, the event shall be treated as a Security Incident under Section 8.
5. LOGGING AND AUDIT TRAIL REQUIREMENTS
5.1 Audit Logging. AHT shall enable and maintain comprehensive audit logs for all systems that store, process, or transmit Licensed Data. Logs shall capture, at a minimum, the following information for each logged event:
(a) user identity (unique user identifier);
(b) type of event (e.g., access, modification, deletion, export, query, login, logout, privilege change);
(c) date and time of the event, synchronized to a reliable time source (e.g., NTP-synchronized clock with accuracy to within one second);
(d) success or failure indication of the event;
(e) source and destination identifiers, including but not limited to IP address, hostname, and system name; and
(f) identification of the affected data objects or records, to the extent technically feasible without capturing the substantive content of the Licensed Data itself.
Audit logging shall be enabled on all components of the Licensed Data environment, including databases, application servers, file servers, network devices, authentication systems, and cloud management consoles.
5.2 Log Retention. Audit logs shall be retained for a minimum period of three (3) years from the date of creation, or such longer period as required by applicable law or as necessary in connection with the investigation or resolution of a Security Incident. During the retention period, logs shall be stored in a manner that preserves their integrity, availability, and accessibility for review, investigation, or audit purposes.
5.3 Log Integrity. AHT shall implement measures to protect audit logs from unauthorized modification, deletion, or tampering, including one or more of the following: (a) write-once storage (WORM); (b) cryptographic hashing of log entries with hash values stored separately from the log data; (c) forwarding of log data to a centralized, access-restricted log management system (e.g., a Security Information and Event Management (SIEM) platform); or (d) equivalent tamper-evident controls that provide an auditable chain of custody for log data. Administrative access to log management systems shall be restricted to a limited number of authorized personnel and shall be logged separately.
5.4 Log Monitoring and Alerting. AHT shall implement automated monitoring of audit logs for anomalous or unauthorized activity related to Licensed Data, including but not limited to:
(a) failed login attempts exceeding defined thresholds (e.g., five or more consecutive failures within a ten-minute window);
(b) access to Licensed Data systems outside of normal business hours (as defined by AHT's standard operating schedule) by users not specifically authorized for off-hours access;
(c) bulk data exports, downloads, or queries that retrieve an unusually large volume of Licensed Data records relative to the user's normal activity patterns; and
(d) privilege escalation events, including attempts to obtain administrative or elevated access to Licensed Data systems.
Alerts generated by the automated monitoring system shall be reviewed and investigated by qualified security personnel within twenty-four (24) hours of generation. AHT shall maintain records of alert investigations, including the nature of the alert, the investigative steps taken, and the resolution, for a period of no less than three (3) years.
5.5 Availability for Audit. Audit logs relating to the Licensed Data shall be made available to Licensor or its designated auditor upon reasonable request in connection with any compliance audit conducted under the Agreement or Section 9 of this Exhibit C. AHT shall provide such logs in a reasonably accessible electronic format within ten (10) business days of receiving a request, or such shorter period as may be necessary in connection with the investigation of a Security Incident. AHT shall cooperate with Licensor and its auditor in interpreting and analyzing audit log data.
6. PHYSICAL SECURITY
6.1 Facility Controls. Any AHT facility (including co-located data centers and cloud provider facilities) where Licensed Data is stored or processed shall employ physical access controls including, at a minimum:
(a) controlled entry points with electronic access badges, proximity cards, biometric readers, or equivalent authentication mechanisms, with access rights assigned based on job function and reviewed no less frequently than quarterly;
(b) visitor registration and escort requirements, requiring all visitors to sign in, display identification, and be escorted by authorized AHT personnel at all times while within areas where Licensed Data is stored or processed;
(c) video surveillance at entry and exit points, with recordings retained for at least ninety (90) days and made available for review in connection with the investigation of a Security Incident or a compliance audit; and
(d) environmental controls, including fire detection and suppression systems, climate control (temperature and humidity), and uninterruptible power supply (UPS) with backup generator capability sufficient to ensure orderly system shutdown or sustained operation during power outages.
AHT shall maintain records of physical access to areas where Licensed Data is stored or processed, including the identity of the individual, the date and time of entry and exit, and the purpose of access, and shall retain such records for a period of no less than one (1) year.
6.2 Cloud Hosting. To the extent AHT stores or processes Licensed Data in a cloud computing environment, AHT shall ensure that the cloud service provider maintains a current SOC 2 Type II report (or equivalent, such as ISO 27001 certification) covering the trust service criteria relevant to security, availability, and confidentiality. AHT shall review the cloud provider's SOC 2 Type II report (or equivalent) no less frequently than annually and shall promptly notify Licensor of any material deficiencies or qualifications identified in such reports. AHT's cloud configuration shall comply with all requirements of this Exhibit C, including without limitation the encryption, access control, logging, and network segmentation requirements set forth herein. AHT shall remain fully responsible for the security of Licensed Data regardless of the hosting environment, and the use of a cloud service provider shall not diminish or limit AHT's obligations under this Exhibit C or the Agreement. Upon request, AHT shall identify to Licensor the cloud service provider(s) and the geographic region(s) in which Licensed Data is hosted.
6.3 Removable Media. Licensed Data shall not be stored on removable media (including but not limited to USB flash drives, portable hard drives, external solid-state drives, optical media such as CDs and DVDs, and magnetic tape cartridges) unless expressly approved in writing by the Security Officer on a case-by-case basis. Any removable media approved for storage of Licensed Data shall be encrypted in accordance with Section 2.1 of this Exhibit C, labeled as containing confidential information, tracked in an inventory maintained by the Security Officer, and stored in a physically secure location when not in active use. Removable media containing Licensed Data shall be securely destroyed in accordance with Section 10.2 when no longer needed.
7. PERSONNEL SECURITY
7.1 Background Checks. AHT shall conduct background checks on all personnel with access to Licensed Data, to the extent permitted by applicable law, prior to granting such access. Background checks shall include, at a minimum, verification of identity, criminal history review, and verification of employment history. AHT shall maintain records confirming that background checks have been completed for all personnel with access to Licensed Data, and shall make such records available to Licensor or its designated auditor upon request in connection with a compliance audit, subject to applicable privacy restrictions.
7.2 Security Awareness Training. All AHT personnel with access to Licensed Data shall complete security awareness training upon initial access provisioning and no less frequently than annually thereafter. Training shall cover, at a minimum:
(a) AHT's Security Program and applicable policies, including acceptable use, data handling, and incident reporting policies;
(b) data-handling and classification procedures applicable to the Licensed Data, including the requirements of this Exhibit C;
(c) phishing awareness, social engineering techniques, and best practices for recognizing and reporting suspicious communications;
(d) the non-re-identification covenant under the Agreement, including the definition, scope, and consequences of re-identification; and
(e) incident-reporting procedures, including how to recognize and report a potential Security Incident and the identity and contact information of the Security Officer or incident response team.
AHT shall maintain records of training completion, including the date of training, the topics covered, and the identity of each individual who completed the training. Personnel who fail to complete required training within thirty (30) days of the scheduled date shall have their access to Licensed Data suspended until training is completed.
7.3 Confidentiality Obligations. All AHT personnel with access to Licensed Data shall be bound by written confidentiality obligations at least as protective as those set forth in the Agreement and the Mutual Non-Disclosure Agreement between the parties (Reference No. AHT-PCA-NDA-2024-001, dated May 13, 2024). AHT shall ensure that all such personnel have executed appropriate confidentiality agreements prior to being granted access to Licensed Data. Contractors and temporary personnel shall execute confidentiality agreements that specifically reference their obligations with respect to the Licensed Data before any access is provisioned.
8. INCIDENT RESPONSE PROCEDURES
8.1 Incident Response Plan. AHT shall maintain a written incident response plan (the "IRP") that addresses the identification, containment, eradication, recovery, and post-incident review of Security Incidents. A "Security Incident" means any actual or reasonably suspected unauthorized access, acquisition, use, disclosure, modification, or destruction of Licensed Data, or any breach of the security, confidentiality, or integrity of systems containing Licensed Data. The IRP shall identify the members of AHT's incident response team, define escalation procedures, establish communication protocols (both internal and external), and include procedures for evidence preservation. AHT shall test the IRP through tabletop exercises or simulations no less frequently than annually, and shall update the IRP as necessary based on lessons learned from exercises and actual incidents.
8.2 Notification to Licensor. AHT shall notify Licensor of any Security Incident involving Licensed Data within seventy-two (72) hours of AHT's becoming aware of such incident. Notification shall be provided to Licensor's Chief Privacy Officer, Dr. Anita Mehta, at the contact information specified in the Agreement (or such other contact as Licensor may designate in writing), and shall include:
(a) a description of the nature and scope of the Security Incident, including the date and time of discovery and the estimated date and time of occurrence;
(b) the categories and approximate volume of Licensed Data affected;
(c) the measures taken or proposed to contain and remediate the incident;
(d) the identity and contact information of AHT's designated incident coordinator; and
(e) a preliminary assessment of whether any re-identification of individuals may have occurred or could reasonably be expected to occur as a result of the Security Incident.
AHT acknowledges that the seventy-two (72)-hour notification period is a maximum timeframe and that earlier notification is expected where feasible, particularly in cases involving suspected re-identification or large-scale unauthorized access to Licensed Data.
8.3 Cooperation. AHT shall cooperate fully with Licensor in investigating and remediating any Security Incident, including providing supplemental information, access to relevant systems and personnel, and updates as reasonably requested by Licensor. AHT shall provide written follow-up reports at intervals of no greater than five (5) business days until the Security Incident is fully resolved. AHT shall preserve all evidence related to the Security Incident in accordance with applicable law and best practices for digital forensics, and shall not destroy or alter any such evidence without the prior written consent of Licensor.
8.4 Regulatory Notifications. AHT shall coordinate with Licensor prior to making any notification to governmental authorities, regulators, law enforcement agencies, or affected individuals (if applicable) regarding a Security Incident involving Licensed Data, except where delay in making such notification would violate applicable law. Where applicable law requires immediate or expedited notification that does not permit prior coordination, AHT shall notify Licensor concurrently with or as soon as reasonably practicable following the regulatory notification, and shall provide Licensor with a copy of the notification made.
8.5 Root Cause Analysis. Within thirty (30) calendar days following the resolution of a Security Incident, AHT shall complete and provide to Licensor a written root cause analysis, which shall include: (a) a detailed description of the events leading to the Security Incident; (b) an identification of the root cause(s); (c) a description of the immediate and long-term remediation steps implemented or planned; (d) lessons learned; and (e) updates to the IRP or Security Program, if any, resulting from the analysis. Licensor shall have the right to review and comment on the root cause analysis and to request additional remediation measures if reasonably warranted.
9. COMPLIANCE AUDITS
9.1 Annual Audit Right. Licensor may audit AHT's compliance with these Data Security Requirements once per calendar year upon no less than thirty (30) days' prior written notice. Such notice shall specify the proposed scope and approximate duration of the audit. Audits shall be conducted by an independent third party mutually agreed upon by the parties. The default auditor, absent mutual agreement to the contrary, shall be Crestfield Advisory Group LLP, with offices at 1345 Avenue of the Americas, 22nd Floor, New York, NY 10105. The auditor shall execute a non-disclosure agreement reasonably acceptable to AHT prior to commencing any audit. In addition to the annual audit right, Licensor may conduct one additional audit per year in the event of a Security Incident involving Licensed Data, without regard to whether the annual audit has already been exercised for such calendar year.
9.2 Scope of Audit. The audit may include, without limitation:
(a) review of AHT's Security Program documentation, including policies, procedures, risk assessments, and training records;
(b) inspection of technical controls, including encryption configurations, access control mechanisms, logging infrastructure, and network security architecture;
(c) review of audit logs and access records related to Licensed Data;
(d) interviews with AHT security personnel, including the Security Officer and members of the incident response team; and
(e) penetration testing of systems storing or processing Licensed Data, subject to reasonable scheduling and scope limitations to minimize disruption to AHT's business operations. Penetration testing shall be conducted during mutually agreed timeframes and shall be limited to systems within the Licensed Data environment.
AHT shall provide the auditor with reasonable access to facilities, systems, personnel, and documentation necessary to conduct the audit. AHT shall designate a point of contact to coordinate audit logistics and facilitate the auditor's work.
9.3 Audit Costs. The costs of any audit conducted pursuant to this Section 9 shall be borne by Licensor, unless the audit reveals a material non-compliance with these Data Security Requirements, in which case the costs of such audit (and any necessary re-audit conducted to verify remediation) shall be borne by AHT. For purposes of this Section 9.3, "material non-compliance" means any deficiency that, individually or in the aggregate, creates a reasonably foreseeable risk of unauthorized access to, disclosure of, or loss of Licensed Data, or that constitutes a failure to implement any control required by Sections 2, 3, 4, 5, or 8 of this Exhibit C.
9.4 Remediation. If an audit identifies any non-compliance with these Data Security Requirements, AHT shall develop and submit to Licensor a written remediation plan within fifteen (15) business days of receiving the audit findings. The remediation plan shall describe: (a) each finding of non-compliance; (b) the root cause of each finding; (c) the specific corrective actions to be taken; (d) the responsible individual for each corrective action; and (e) the timeline for completion. AHT shall implement the remediation plan within the timeframe specified therein, which shall not exceed sixty (60) calendar days from the date of the remediation plan, unless otherwise agreed in writing by Licensor. Licensor shall have the right to conduct a follow-up audit to verify completion of remediation, at AHT's cost in the case of material non-compliance as defined in Section 9.3.
9.5 Certifications. In lieu of (but not as a substitute for) the annual audit right described in Section 9.1, AHT may provide to Licensor, upon request, copies of SOC 2 Type II reports, ISO 27001 certifications, or equivalent third-party security assessments covering the systems and environments used to store and process Licensed Data. Such reports or certifications shall have been issued within the twelve (12) months preceding the date of Licensor's request. The provision of such reports or certifications shall not limit or waive Licensor's right to conduct an audit under Section 9.1, but Licensor agrees to consider the scope and findings of such reports or certifications when determining the scope and extent of any audit.
10. DATA RETENTION AND DESTRUCTION
10.1 Retention During Term. AHT may retain Licensed Data throughout the term of the Agreement (initial term of five (5) years from the Effective Date, July 1, 2024, through June 30, 2029, plus any renewal terms) solely for the Permitted Uses specified in the Agreement. AHT shall not retain Licensed Data beyond the term of the Agreement except as expressly permitted under Section 10.4 of this Exhibit C. During the term, AHT shall maintain an inventory of all systems, databases, and storage media containing Licensed Data, and shall ensure that all such systems remain subject to the security requirements of this Exhibit C.
10.2 Data Destruction Upon Termination or Expiration. Within thirty (30) calendar days following the expiration or termination of the Agreement for any reason, AHT shall securely destroy or return to Licensor (at Licensor's election) all copies of the Licensed Data in AHT's possession or control, including copies stored in primary databases, backups, development and test environments, staging environments, disaster recovery systems, and any other storage medium. Destruction shall be accomplished using methods consistent with NIST SP 800-88, Revision 1 (Guidelines for Media Sanitization), including:
(a) cryptographic erasure for encrypted data, achieved by securely destroying all copies of the encryption key(s) used to protect the Licensed Data, rendering the encrypted data permanently irrecoverable;
(b) secure overwrite (minimum three-pass overwrite using DoD 5220.22-M methodology, or equivalent) for magnetic media; and
(c) physical destruction (shredding, degaussing, or incineration) for physical media that cannot be effectively sanitized through logical methods.
AHT shall select the destruction method appropriate to the type of media and the sensitivity of the Licensed Data, in accordance with the guidance provided in NIST SP 800-88.
10.3 Destruction Certificate. Within ten (10) business days following completion of data destruction, AHT shall provide Licensor with a written certificate, signed by the Security Officer, confirming:
(a) the date(s) on which destruction was completed;
(b) the methods of destruction employed for each category of media or system;
(c) a description of the media and systems from which Licensed Data was destroyed, including system identifiers, media types, and storage locations; and
(d) confirmation that no copies of Licensed Data remain in AHT's possession or control, except as expressly permitted under Section 10.4 of this Exhibit C.
The destruction certificate shall be in the form of a sworn declaration or officer's certificate, and shall be retained by both parties for a period of no less than five (5) years following the date of destruction.
10.4 Exceptions. Notwithstanding Section 10.2:
(a) AHT shall not be required to destroy copies of Licensed Data contained in routine backup archives that are not reasonably accessible (i.e., offline or near-line backup tapes maintained solely for disaster recovery purposes), provided that (i) such archived copies remain subject to all use restrictions, confidentiality obligations, and security requirements of the Agreement and this Exhibit C for so long as they are retained, (ii) AHT shall not access or restore such archived copies for any purpose other than disaster recovery verification or compliance with legal obligations, and (iii) such archived copies are destroyed in accordance with AHT's standard backup rotation schedule, which shall not exceed one hundred eighty (180) days following the effective date of termination or expiration of the Agreement;
(b) AHT shall retain ownership of and the right to continue using all analytics, algorithms, models, insights, and derivative works produced using the Licensed Data that do not, individually or in combination, permit reconstruction of the underlying Licensed Data at the individual-claim-line level, as provided in the Agreement. For avoidance of doubt, aggregated statistical outputs, model parameters, feature weights, and performance metrics that are derived from the Licensed Data but do not contain or reveal individual claim-line data are not considered Licensed Data and are not subject to the destruction requirements of this Section 10; and
(c) AHT personnel may retain residual knowledge as provided in the residual-knowledge clause of the Agreement (Section 7.4 thereof), subject to the non-re-identification covenant set forth in the Agreement and Section 13.1 of this Exhibit C.
11. SUBCONTRACTORS AND THIRD-PARTY ACCESS
11.1 Restrictions. AHT shall not provide access to Licensed Data to any subcontractor, contractor, consultant, or other third party without the prior written consent of Licensor. Any request for such consent shall be submitted to Licensor in writing and shall identify the proposed third party, the scope and purpose of the access, the duration of the access, and the security measures that the third party will implement to protect the Licensed Data. Licensor shall have the right to approve or deny any such request in its sole discretion, and any approval may be subject to conditions specified by Licensor. Licensor's consent to one third party shall not constitute consent to any other third party or to any expansion of the approved scope of access.
11.2 Flow-Down Requirements. Any third party approved by Licensor to access Licensed Data shall be bound by a written agreement containing obligations at least as protective as the requirements of this Exhibit C, including without limitation the encryption, access control, logging, incident response, and data destruction requirements set forth herein. Such third party shall also be subject to the same use restrictions, confidentiality obligations, and non-re-identification covenant as AHT under the Agreement. AHT shall provide Licensor with a copy of the relevant security provisions of any agreement with an approved third party upon request.
11.3 Responsibility. AHT shall remain fully responsible for the acts and omissions of any approved third party with respect to Licensed Data as if such acts and omissions were those of AHT. Any breach of this Exhibit C or the Agreement by an approved third party shall be deemed a breach by AHT. AHT shall monitor the security practices of approved third parties through periodic assessments and shall promptly notify Licensor of any actual or suspected non-compliance by a third party with the requirements of this Exhibit C.
12. BUSINESS CONTINUITY AND DISASTER RECOVERY
12.1 BCP/DR Plans. AHT shall maintain business continuity and disaster recovery plans ("BCP/DR Plans") that address the protection and recovery of Licensed Data in the event of a natural disaster, system failure, cyberattack, pandemic, or other disruptive event. The BCP/DR Plans shall identify critical systems and data, establish recovery priorities, define roles and responsibilities, and specify communication protocols. AHT shall review and update the BCP/DR Plans no less frequently than annually and shall test the plans through exercises or simulations no less frequently than annually. Upon request, AHT shall provide Licensor with a summary of the BCP/DR Plans as they relate to the Licensed Data.
12.2 Backup Requirements. Licensed Data backups shall be encrypted in accordance with Section 2.1 of this Exhibit C, stored in geographically separate locations from primary systems (with a minimum separation sufficient to mitigate regional disaster risks), and tested for recoverability no less frequently than annually. Backup testing shall include verification that backed-up Licensed Data can be restored to a functional state within the recovery time specified in Section 12.3. AHT shall maintain backup schedules and retention policies that ensure the availability of current and recoverable copies of Licensed Data at all times during the term of the Agreement.
12.3 Recovery Time. AHT shall use commercially reasonable efforts to restore access to Licensed Data within seventy-two (72) hours following a disruptive event. AHT shall notify Licensor promptly of any disruptive event that materially affects the availability or integrity of Licensed Data, and shall provide periodic updates regarding recovery progress until normal operations are restored.
13. SPECIFIC PROHIBITIONS
13.1 Re-Identification. Consistent with AHT's covenant in the Agreement, AHT shall not, and shall not permit any personnel, contractor, or third party to, use the Licensed Data, alone or in combination with any other information, data set, or technique, to identify, contact, or re-identify any individual whose data is included in the Licensed Data. This prohibition extends to any attempt, whether successful or unsuccessful, to link Licensed Data records to specific individuals or to associate Licensed Data with directly identifying information (e.g., name, address, Social Security number, or other government-issued identifier). Any actual or suspected re-identification event shall be treated as a Security Incident under Section 8 of this Exhibit C and shall be reported to Licensor in accordance with Section 8.2. Re-identification of individuals shall be subject to the uncapped liability provision set forth in the Agreement for re-identification breach, and may constitute grounds for immediate termination of the Agreement by Licensor.
13.2 Prohibited Transfers. AHT shall not sub-license, sell, transfer, or otherwise make available the raw Licensed Data to any third party. This prohibition applies regardless of the form or medium of the Licensed Data, including but not limited to electronic files, database extracts, printed reports, or any other tangible or intangible form. For avoidance of doubt, this prohibition does not restrict AHT from integrating aggregated, non-reversible analytics, model outputs, or derivative insights into AHT's SaaS platform for use by AHT's end customers, as expressly permitted under the Agreement, provided that such outputs do not permit reconstruction of the underlying Licensed Data at the individual-claim-line level.
13.3 Geographic Restrictions. Licensed Data shall be stored and processed exclusively within the United States, including its territories and possessions. AHT shall not transfer, transmit, or store Licensed Data outside the United States, or permit any third party to do so, without the prior written consent of Licensor. AHT shall implement technical and organizational controls to prevent the inadvertent transfer of Licensed Data to systems or storage locations outside the United States, including configuration of cloud hosting environments to restrict data residency to United States regions. AHT shall promptly notify Licensor if AHT becomes aware of any unauthorized transfer of Licensed Data outside the United States.
14. INSURANCE
14.1 AHT Coverage. AHT shall maintain cyber liability insurance coverage with limits of not less than Ten Million Dollars ($10,000,000) per occurrence and in the aggregate throughout the term of the Agreement, including coverage for data breach response costs, regulatory fines and penalties (to the extent insurable), business interruption, and third-party liability arising from unauthorized access to or disclosure of data in AHT's possession or control. AHT's current cyber liability carrier is Commonwealth Mutual Assurance Corp. AHT shall provide Licensor with a certificate of insurance evidencing such coverage upon request, and in any event within thirty (30) days of the Effective Date and within thirty (30) days of each policy renewal. The certificate shall name Pinnacle Claims Analytics LLC as an additional insured to the extent permitted by the applicable policy.
14.2 Notice of Changes. AHT shall provide Licensor with at least thirty (30) days' prior written notice of any material reduction in, cancellation of, or non-renewal of such cyber liability insurance coverage. A material reduction includes any decrease in the per-occurrence or aggregate limit below Ten Million Dollars ($10,000,000), any exclusion of coverage for data breach or cyber incidents, or any change in the policy terms that would materially affect the scope of coverage applicable to AHT's obligations under the Agreement. In the event of a material reduction, cancellation, or non-renewal, AHT shall use commercially reasonable efforts to obtain replacement coverage on substantially similar terms and shall notify Licensor when such replacement coverage has been obtained.
15. UPDATES AND MODIFICATIONS
15.1 Evolving Standards. AHT acknowledges that security threats and industry standards evolve over time, and that the security measures described in this Exhibit C represent minimum requirements as of the Effective Date. AHT shall update its Security Program as necessary to maintain alignment with the then-current version of NIST SP 800-171 and industry best practices for the protection of de-identified healthcare data. AHT shall monitor publications and guidance from NIST, the Department of Health and Human Services, and other relevant authorities, and shall incorporate changes to applicable standards into its Security Program within a reasonable period following publication (not to exceed twelve (12) months following the effective date of any updated standard). AHT shall notify Licensor of any material updates to its Security Program that affect the protection of Licensed Data.
15.2 Amendment. These Data Security Requirements may be amended only by a written instrument signed by authorized representatives of both Licensor and Licensee. Either party may propose updates to these Data Security Requirements to reflect changes in applicable law, regulatory guidance, industry standards, or the threat landscape. The parties shall negotiate any such proposed updates in good faith and shall endeavor to reach agreement within sixty (60) days of receipt of a proposal. Pending agreement on any proposed amendment, the existing requirements of this Exhibit C shall remain in full force and effect.
16. DEFINITIONS
For purposes of this Exhibit C, the following terms shall have the meanings set forth below:
"Licensed Data" means the data licensed to AHT under the Agreement, as defined therein and further described in Exhibit A to the Agreement, consisting of de-identified healthcare claims data sourced from Licensor's proprietary databases.
"Permitted Uses" means the uses of Licensed Data authorized under the Agreement, specifically: internal analytics, model training, product development, and integration into AHT's SaaS platform. Permitted Uses expressly exclude the re-sale, sub-licensing, or transfer of raw Licensed Data to any third party.
"Security Incident" has the meaning set forth in Section 8.1 of this Exhibit C.
"Security Officer" has the meaning set forth in Section 1.2 of this Exhibit C.
"Security Program" has the meaning set forth in Section 1.1 of this Exhibit C.
All other capitalized terms used but not defined in this Exhibit C shall have the meanings ascribed to them in the Agreement (Reference No. AHT-PCA-DLA-2024-001).
[Remainder of this page intentionally left blank. Signature page follows.]
EXHIBIT C — DATA SECURITY REQUIREMENTS
SIGNATURE PAGE
IN WITNESS WHEREOF, the undersigned authorized representatives of the parties have executed this Exhibit C as of the Effective Date set forth above, acknowledging that these Data Security Requirements are incorporated into and form a part of the Agreement.
PINNACLE CLAIMS ANALYTICS LLC
By: ________
Name: Dr. Anita Mehta
Title: Chief Privacy Officer
Date: ________
ARBOR HEALTH TECHNOLOGIES INC.
By: ________
Name: ________
Title: ________
Date: ________
Exhibit C — Data Security Requirements | Reference No. AHT-PCA-DLA-2024-001 | Confidential

EXHIBIT C

DATA SECURITY REQUIREMENTS

SIGNATURE PAGE

PINNACLE CLAIMS ANALYTICS LLC

ARBOR HEALTH TECHNOLOGIES INC.

Record

Parties

Dates

Amounts