1025-00009 · Calderwood & Harkness LLP · Memos & Analysis

deal-points-memo.docx DOCUMENT M&A / Corporate

5 / 12 ← → ✕

PRIVILEGED & CONFIDENTIAL — ATTORNEY-CLIENT COMMUNICATION

This memorandum is a privileged and confidential attorney-client communication prepared by Calderwood & Harkness LLP at the direction of and for the sole benefit of Quorum Insurance Holdings Corp. This memorandum is protected by the attorney-client privilege and the work-product doctrine. Any disclosure, copying, distribution, or use of the contents of this memorandum by any person other than the intended recipients is strictly prohibited. If you have received this memorandum in error, please notify Calderwood & Harkness LLP immediately.

MEMORANDUM

From: Gabrielle Moss, Working Associate, and Nathan Ikeda, Lead Associate, Calderwood & Harkness LLP

To: Patricia Okonkwo, General Counsel, Quorum Insurance Holdings Corp.; Derek Langston, Chief Information Officer, Quorum Insurance Holdings Corp.

Date: April 23, 2024

Re: Summary of Material Changes — Enterprise SaaS Subscription Agreement between Quorum Insurance Holdings Corp. and Clearpoint Analytics, Inc. (ClaimsIQ™ Platform)

Matter No.: 1025-00009

I. Purpose and Executive Summary

The purpose of this memorandum is to summarize, for the benefit of Quorum Insurance Holdings Corp. ("Quorum") management, the material changes negotiated by Calderwood & Harkness LLP ("C&H") on behalf of Quorum from Clearpoint Analytics, Inc.'s ("Clearpoint") initial form Enterprise SaaS Subscription Agreement (the "Agreement") received on March 11, 2024, to the final execution version circulated to the parties on April 23, 2024 (the "Execution Version"). This memorandum is intended to serve as a comprehensive reference for Quorum's internal review and approval process in advance of the anticipated signing date.

Transaction Context. The Agreement governs the enterprise-wide deployment of Clearpoint's ClaimsIQ™ cloud-based claims analytics platform (the "Platform") across Quorum's property and casualty insurance and specialty lines subsidiaries, including Quorum Property & Casualty Insurance Company, Quorum Specialty Underwriters, Inc., and Quorum Workers' Compensation Insurance Company (collectively, the "Quorum Subsidiaries"). The Platform will be deployed across approximately 1,200 named users operating from Quorum's three principal operational locations in Hartford, Connecticut; Charlotte, North Carolina; and Dallas, Texas. The total contract value of the Agreement over its five-year initial subscription term is $7,000,000 (the "TCV"), representing an annual contract value of $1,400,000 (the "ACV"), subject to CPI-based escalation as described in Section III below.

Counterparty Counsel. Clearpoint was represented throughout the negotiation by Whitfield Greer & Associates LLP, with Damian Cho serving as lead partner and Leona Burris as the primary associate on the matter. Whitfield Greer demonstrated familiarity with enterprise SaaS transactions in the insurance sector, and negotiations proceeded in a professional and constructive manner throughout.

Negotiation Timeline. The negotiation proceeded over approximately six weeks according to the following timeline:

• March 11, 2024: Clearpoint's form Enterprise SaaS Subscription Agreement and associated exhibits received by Quorum.

• March 13, 2024: C&H engagement initiated; initial review of form agreement commenced.

• March 22, 2024: C&H first redline delivered to Whitfield Greer, incorporating Quorum's material and structural comments.

• April 2, 2024: Whitfield Greer counter-redline received, reflecting Clearpoint's responses and counter-proposals.

• April 8, 2024: Data-privacy impact assessment completed by Dravello Data Compliance Advisors LLC.

• April 10, 2024: C&H revised redline delivered to Whitfield Greer, incorporating Fenwick DCA findings and Quorum's remaining open-issue positions.

• April 15, 2024: Whitfield Greer revised counter-redline received; five remaining open issues identified.

• April 18, 2024: Final negotiation call held among all parties, including Patricia Okonkwo, Derek Langston, Renata Vasquez (C&H), Nathan Ikeda (C&H), Damian Cho (Whitfield Greer), Leona Burris (Whitfield Greer), and Anita Rajan (CEO, Clearpoint). All remaining open issues resolved on the call.

• April 23, 2024: Final Execution Version circulated for review and signature.

High-Level Summary of Negotiation Outcomes. Ten categories of material changes were negotiated from the form agreement, covering the following subject areas: (i) customer data ownership; (ii) aggregated data use restrictions; (iii) indemnification structure and caps; (iv) general liability cap; (v) SLA uptime thresholds; (vi) chronic failure termination rights; (vii) data portability timelines; (viii) subprocessor management; (ix) change-of-control assignment restrictions; and (x) governing law and dispute resolution. All material revisions proposed by C&H on behalf of Quorum were accepted by Clearpoint in the Execution Version, in each case either as originally proposed or as refined through the negotiation process. In our assessment, the Execution Version reflects a commercially balanced agreement that appropriately protects Quorum's interests as a regulated insurance enterprise and data controller, while providing Clearpoint with reasonable commercial terms consistent with its position as a SaaS platform provider.

Each of the ten categories of material change is discussed in detail in Section II below.

II. Summary of Material Changes

The following subsections describe each category of material change in sequence, organized to correspond with the relevant provisions of the Agreement and its exhibits. For each category, we describe: (a) Clearpoint's original form position; (b) the negotiated change reflected in the Execution Version; and (c) the practical and legal significance of the change for Quorum. A side-by-side comparison table summarizing all ten categories is provided in the Appendix (Section VI) for ease of reference.

A. Customer Data Ownership (Section 7.1 of Agreement; Exhibit C — Data Processing Addendum)

Clearpoint's Form Position. The form agreement included a provision in Section 7.1 stating that "Customer retains ownership of Customer Data uploaded to or processed through the Platform." While facially protective, this language contained two significant deficiencies from Quorum's perspective. First, the ownership language lacked exclusivity qualifiers, leaving open the possibility that Clearpoint could assert co-ownership or residual license rights in Customer Data, particularly with respect to derivative works, analytical outputs, or reports generated by the Platform using Customer Data as inputs. Second, the definition of "Customer Data" in the form agreement was limited to "data uploaded by Customer to the Platform," which did not clearly encompass outputs, reports, analytics, adjuster notes, or other data generated through Customer's use of the Platform that incorporated or derived from Customer's proprietary information. This ambiguity was compounded by a separate provision in Section 7.2 of the form agreement granting Clearpoint a "non-exclusive, worldwide, royalty-free license to use Customer Data as necessary to provide the Services," which, when read in conjunction with the weak ownership language, could be interpreted as granting Clearpoint broader rights than Quorum intended to convey.

Negotiated Change. The Execution Version strengthens the Customer Data ownership language in two respects. First, Section 7.1 now provides that Quorum retains "sole and exclusive" ownership of all Customer Data, and expressly states that nothing in the Agreement shall be construed to transfer, assign, or convey any ownership interest in Customer Data to Clearpoint. Second, the definition of "Customer Data" has been expanded to explicitly include the following categories of information:

(a) claims data, including first-notice-of-loss records, loss-run data, reserve data, and claims adjudication records;

(b) policyholder personally identifiable information ("PII"), including names, addresses, Social Security numbers, policy numbers, and financial account information;

(c) protected health information ("PHI") as defined under HIPAA, arising from Quorum's workers' compensation lines of business;

(d) adjuster notes, investigation reports, and case-management records;

(e) all outputs, reports, analytics, dashboards, visualizations, and other materials generated by the Platform using Customer Data as inputs or incorporating Customer Data in any manner; and

(f) any copies, extracts, or derivatives of the foregoing.

The license granted to Clearpoint under Section 7.2 has been narrowed to a "non-exclusive, non-transferable, non-sublicensable license to use Customer Data solely to the extent necessary to provide the Services under this Agreement," with an express prohibition on Clearpoint's use of Customer Data for any other purpose.

Corresponding revisions have been incorporated into Section 3 of Exhibit C (Data Processing Addendum) to ensure consistency between the body of the Agreement and the DPA.

Significance. The revised ownership language eliminates any argument that Clearpoint holds co-ownership, residual license rights, or other proprietary interests in Quorum's data. This is a critical protection for Quorum for several reasons. First, Quorum's claims data constitutes among its most competitively sensitive proprietary assets, and any ambiguity regarding ownership could undermine Quorum's ability to protect and enforce its rights in that data. Second, the expanded definition of Customer Data ensures that all categories of information processed through the Platform — including PHI, adjuster work product, and Platform-generated outputs — are unambiguously owned by Quorum. Third, clear and exclusive ownership is essential to Quorum's compliance with its regulatory obligations under the Connecticut Data Privacy Act ("CTDPA"), the Health Insurance Portability and Accountability Act ("HIPAA") with respect to its workers' compensation lines, and the NAIC Insurance Data Security Model Law as adopted in Connecticut (Conn. Gen. Stat. § 38a-38, et seq.). Regulatory agencies expect that regulated insurance entities maintain clear ownership of and control over policyholder data processed by third-party service providers.

B. Aggregated Data Use Restrictions (Section 7.3 of Agreement; Exhibit C — Data Processing Addendum)

Clearpoint's Form Position. Section 7.3 of the form agreement granted Clearpoint a broad, unilateral right to "create and use de-identified, aggregated statistical data derived from Customer Data" (defined as "Aggregated Data") for "any internal business purpose." The form agreement further specified that such internal business purposes included, without limitation, "product development and improvement, benchmarking, industry research, and marketing of Clearpoint's products and services." Notably, the form agreement did not impose any obligation on Clearpoint to obtain Quorum's consent before creating or using Aggregated Data, did not restrict Clearpoint's ability to share Aggregated Data with third parties, and contained no prohibition on re-identification. The only limitation was a representation that Aggregated Data would be "de-identified in accordance with industry-standard practices," without reference to any specific de-identification standard or methodology.

Negotiated Change. The Execution Version substantially restricts Clearpoint's Aggregated Data rights. Section 7.3 now provides that Clearpoint's right to create and use Aggregated Data derived from Customer Data is limited to product-improvement purposes only, and is subject to the following three conditions:

(i) Clearpoint's creation and use of Aggregated Data must comply with all applicable insurance data-privacy laws, including the CTDPA, HIPAA (to the extent applicable), the NAIC Insurance Data Security Model Law, and any other data-protection laws applicable to Quorum's insurance operations;

(ii) Clearpoint must obtain Quorum's prior written consent (not to be unreasonably withheld, conditioned, or delayed) before creating or using any Aggregated Data for product-improvement purposes, with such consent request to include a reasonable description of the intended use, the de-identification methodology to be applied, and the categories of data to be aggregated; and

(iii) Clearpoint is expressly prohibited from (a) re-identifying or attempting to re-identify any Aggregated Data, (b) combining Aggregated Data with other data in a manner that could facilitate re-identification, or (c) selling, licensing, distributing, or otherwise making Aggregated Data available to any third party for any purpose.

Additionally, the de-identification standard has been specified: Clearpoint must apply de-identification methodologies consistent with NIST Special Publication 800-188 and, to the extent PHI is involved, the HIPAA Safe Harbor de-identification standard (45 C.F.R. § 164.514(b)).

Significance. The restrictions on Aggregated Data use represent one of the most commercially significant changes negotiated in this transaction. Clearpoint's form position would have permitted Clearpoint to derive substantial commercial value from Quorum's proprietary claims data — including by creating benchmarking products that could be sold to Quorum's competitors — without Quorum's consent and without any compensation to Quorum. The consent mechanism negotiated in the Execution Version provides Quorum with ongoing control over how its data is used, even in aggregated form, and the prohibition on third-party sales ensures that Quorum's data does not become a revenue source for Clearpoint at Quorum's expense. Given the increasing regulatory scrutiny of data aggregation practices in the insurance sector, these restrictions also position Quorum favorably from a compliance standpoint.

C. Indemnification Structure and Caps (Section 10 of Agreement)

Clearpoint's Form Position. The form agreement contained mutual indemnification provisions in Section 10, with a single aggregate indemnification cap of 1× ACV ($1,400,000) applicable to all indemnification obligations of both parties, without distinction between categories of indemnifiable claims. The form agreement did not contain a separate carve-out or sub-limit for data-breach liability, meaning that a catastrophic data breach affecting Quorum's policyholder data would be subject to the same $1,400,000 cap as a routine intellectual property claim. The indemnification obligations themselves were drafted in general terms, without clearly delineating the categories of third-party claims for which each party would be responsible.

Negotiated Change — Indemnification Obligations. The Execution Version establishes a comprehensive, mutual indemnification framework with clearly defined obligations for each party:

Clearpoint's Indemnification Obligations. Clearpoint shall indemnify, defend, and hold harmless Quorum and its affiliates, and their respective officers, directors, employees, and agents (collectively, the "Quorum Indemnitees"), from and against any and all third-party claims, actions, suits, proceedings, losses, damages, liabilities, costs, and expenses (including reasonable attorneys' fees and costs of investigation) arising out of or relating to:

(a) any claim that Quorum's authorized use of the ClaimsIQ™ Platform, or any component thereof, infringes, misappropriates, or otherwise violates any third party's intellectual property rights, including patents, copyrights, trademarks, and trade secrets;

(b) any claim arising from Clearpoint's breach of its data-security obligations under the Agreement or the DPA (Exhibit C), or any unauthorized access to, disclosure of, or loss of Customer Data resulting from Clearpoint's acts or omissions, including the acts or omissions of Clearpoint's subprocessors; and

(c) any claim arising from Clearpoint's violation of applicable law, including federal, state, and local laws and regulations applicable to the insurance industry, data privacy, and information security.

Quorum's Indemnification Obligations. Quorum shall indemnify, defend, and hold harmless Clearpoint and its affiliates, and their respective officers, directors, employees, and agents (collectively, the "Clearpoint Indemnitees"), from and against any and all third-party claims, actions, suits, proceedings, losses, damages, liabilities, costs, and expenses (including reasonable attorneys' fees and costs of investigation) arising out of or relating to:

(a) any claim that Customer Data provided by Quorum to Clearpoint for processing through the Platform infringes, misappropriates, or otherwise violates any third party's intellectual property rights or other proprietary rights; and

(b) any claim arising from Quorum's use of the ClaimsIQ™ Platform outside the scope of the Agreement, including any use that exceeds the license grant set forth in Section 2.1 of the Agreement or violates the use restrictions set forth in Section 2.3.

Indemnification Procedures. Section 10.3 of the Execution Version establishes the following procedural requirements for indemnification claims:

(i) The indemnified party must provide written notice to the indemnifying party of any indemnifiable claim within fifteen (15) business days of becoming aware of such claim, provided that failure to provide timely notice shall not relieve the indemnifying party of its indemnification obligations except to the extent the indemnifying party is materially prejudiced by such delay;

(ii) The indemnifying party shall have the right to assume and control the defense of any indemnifiable claim, including the selection of counsel, subject to the indemnified party's right to approve counsel (such approval not to be unreasonably withheld);

(iii) The indemnified party shall have the right to participate in the defense of any indemnifiable claim at its own expense, with counsel of its own choosing; and

(iv) Neither party may settle, compromise, or consent to the entry of any judgment with respect to any indemnifiable claim without the prior written consent of the other party, such consent not to be unreasonably withheld, conditioned, or delayed.

Negotiated Change — Indemnification Caps. The Execution Version establishes a tiered cap structure for indemnification obligations, replacing the form agreement's single, undifferentiated cap:

• IP and General Indemnification Cap: The aggregate cap for Clearpoint's indemnification obligations arising under Section 10.1(a) (IP infringement) and Section 10.1(c) (violation of law) has been increased from 1× ACV ($1,400,000) to 2× TCV ($7,000,000 × 2 = $14,000,000).

• Data-Breach Indemnification — Uncapped: Clearpoint's indemnification obligations arising under Section 10.1(b) (data-security breach and unauthorized disclosure of Customer Data) are not subject to any aggregate cap. This carve-out reflects the catastrophic financial exposure that a data breach involving policyholder PII and PHI would create for Quorum and its regulated insurance subsidiaries, including regulatory fines, class-action litigation, remediation costs, credit-monitoring obligations, and reputational harm.

Significance. The restructured indemnification framework represents the single most significant risk-allocation change negotiated in this transaction, and its importance cannot be overstated. The increase in the IP and general indemnification cap from $1.4 million to $14 million dramatically enhances Quorum's recovery potential in an IP infringement scenario, which is particularly important given the complexity of the ClaimsIQ™ Platform and the inherent risk of third-party IP claims in the enterprise software sector. The decision to carve out data-breach indemnification obligations and make them uncapped is consistent with industry-standard practice for enterprise insurance clients, reflects the volume and sensitivity of the policyholder PII and PHI that will be processed through the Platform, and appropriately allocates the risk of a data breach to the party best positioned to prevent it — namely, Clearpoint, as the platform operator and data processor. The indemnification framework as negotiated aligns with Quorum's risk profile as a publicly traded insurance holding company and is consistent with the indemnification structures Quorum has negotiated in comparable enterprise technology agreements.

D. General Liability Cap (Section 11.2 of Agreement)

Clearpoint's Form Position. Section 11.2 of the form agreement established a single aggregate liability cap for all claims arising under or in connection with the Agreement, without distinction between types of liability. The cap was set at 1× ACV ($1,400,000), meaning that Clearpoint's total financial exposure under the Agreement, regardless of the nature or severity of the claim, would not exceed the equivalent of a single year's subscription fees. No carve-outs were provided for any category of liability, including data breach, willful misconduct, fraud, or intellectual property infringement.

Negotiated Change. The Execution Version restructures the liability cap framework as follows:

• General Liability Cap: The aggregate liability cap for all claims under the Agreement (other than the categories carved out below) is set at 1× TCV = $7,000,000. This general cap applies to contract claims, warranty claims, negligence claims, and all other claims not subject to a specific carve-out.

• Carve-Outs from the General Liability Cap: The following categories of liability are carved out from the $7,000,000 general cap and are subject to their own respective limits (or no limit):

(a) Data-Breach Liability (Uncapped): Claims arising from Clearpoint's breach of data-security obligations, unauthorized disclosure of Customer Data, or breach of the DPA (Exhibit C) are uncapped, consistent with the data-breach indemnification carve-out described in Section II.C above.

(b) Willful Misconduct (Uncapped): Claims arising from a party's willful misconduct, fraud, or intentional misrepresentation are uncapped.

(c) IP Infringement Indemnification (Capped at $14,000,000): Claims arising under Clearpoint's IP infringement indemnification obligations (Section 10.1(a)) are subject to the 2× TCV cap of $14,000,000 as described in Section II.C above.

Significance. The increase of the general liability cap from $1.4 million (one year's fees) to $7 million (full contract value over the five-year term) provides substantially greater financial protection for Quorum across the life of the Agreement. Under the form agreement, Clearpoint's maximum exposure for a catastrophic platform failure or material breach in Year 4 of the Agreement would have been limited to $1.4 million — a figure that bears no reasonable relationship to the potential damages Quorum could incur from such an event, particularly given the mission-critical nature of the ClaimsIQ™ Platform and its role in Quorum's claims-processing operations. The carve-outs for data breach (uncapped), willful misconduct (uncapped), and IP infringement ($14 million) ensure that the most serious risk categories — those with the greatest potential financial exposure for Quorum — are not artificially constrained by the general liability cap. This tiered structure is consistent with market practice in enterprise SaaS transactions involving regulated financial institutions and reflects an appropriate allocation of risk between the parties.

E. SLA Uptime Threshold (Exhibit B — Service Level Agreement)

Clearpoint's Form Position. Exhibit B to the form agreement established a platform availability service level of 99.5% monthly uptime, measured on a calendar-month basis. Scheduled maintenance was excluded from the uptime calculation, but the form agreement did not specify the timing, frequency, or maximum duration of scheduled maintenance windows. No chronic-failure termination right was included; service credits (as described below) constituted the sole and exclusive remedy for SLA shortfalls.

Negotiated Change. The Execution Version modifies the SLA framework in the following respects:

• Uptime Threshold: The monthly uptime commitment has been increased from 99.5% to 99.7%, measured on a calendar-month basis.

• Scheduled Maintenance Windows: Scheduled maintenance windows have been defined and limited to a maximum of four (4) hours per month, to occur only on Sundays between 2:00 AM and 6:00 AM Eastern Time. Time during scheduled maintenance windows is excluded from the uptime calculation, provided that Clearpoint provides at least forty-eight (48) hours' advance written notice to Quorum's designated technical contact prior to any scheduled maintenance event.

• Service Credit Methodology: For each 0.1 percentage point by which actual monthly uptime falls below the 99.7% threshold, Quorum shall receive a service credit equal to 2% of the applicable monthly subscription fee. The applicable monthly subscription fee is calculated as the ACV divided by twelve ($1,400,000 ÷ 12 = $116,667 per month), yielding a credit of approximately $2,333 per 0.1% shortfall. The maximum aggregate service credit for any single calendar month is capped at 15% of the monthly subscription fee ($116,667 × 15% = $17,500).

• Service Credit Application: Service credits are applied against the next invoice following the month in which the SLA shortfall occurred, or, at Quorum's option, refunded in cash within thirty (30) days of written request.

Significance. While the 0.2 percentage-point increase in the uptime threshold from 99.5% to 99.7% may appear modest in absolute terms, the practical impact is material. On a monthly basis, 99.5% uptime permits approximately 219 minutes (3 hours and 39 minutes) of unscheduled downtime, whereas 99.7% uptime permits approximately 132 minutes (2 hours and 12 minutes) of unscheduled downtime — a reduction of approximately 87 minutes of permitted downtime per month. For a mission-critical claims-processing platform deployed across three operational locations with approximately 1,200 named users, 87 minutes of additional downtime per month represents a significant operational disruption, with potential impacts on claims-processing timelines, policyholder service levels, and regulatory reporting obligations. The structured maintenance window (Sundays, 2:00–6:00 AM ET) ensures that scheduled maintenance occurs during the period of lowest operational activity, minimizing disruption to Quorum's claims-processing operations. The service-credit methodology provides a meaningful financial remedy for SLA shortfalls and creates appropriate economic incentives for Clearpoint to maintain platform availability.

F. Chronic Failure Termination Right (Exhibit B — Service Level Agreement)

Clearpoint's Form Position. The form agreement did not include any termination right linked to sustained or chronic SLA shortfalls. Under the form agreement, service credits constituted the sole and exclusive remedy for any failure by Clearpoint to meet the platform availability SLA, regardless of the severity, duration, or frequency of such failure. Accordingly, even in a scenario where the Platform experienced catastrophic and persistent availability failures over an extended period, Quorum's only remedy would have been to accumulate service credits (capped at 15% of the monthly fee per month), with no right to terminate the Agreement or seek a refund of prepaid fees.

Negotiated Change. The Execution Version adds a new Section 4.3 to Exhibit B (Service Level Agreement) establishing a chronic-failure termination right. Specifically, if actual monthly uptime falls below 99.0% in any three (3) consecutive calendar months, Quorum shall have the right, upon written notice to Clearpoint delivered within thirty (30) days following the end of the third consecutive month of SLA failure, to terminate the Agreement for cause. Upon such termination, Clearpoint shall provide Quorum with a pro-rata refund of all prepaid and unearned subscription fees, calculated from the effective date of termination through the end of the then-current subscription term.

Significance. The chronic-failure termination right provides Quorum with a meaningful and proportionate exit right in the event that the ClaimsIQ™ Platform experiences systemic and sustained reliability issues. Without this provision, Quorum would be contractually bound to a five-year agreement with a platform that might be persistently underperforming, with no remedy beyond modest service credits. The 99.0% threshold for the chronic-failure trigger is set deliberately below the 99.7% SLA target to ensure that the termination right is reserved for genuinely chronic and severe availability failures — not isolated or minor shortfalls. Three consecutive months of sub-99.0% uptime (i.e., more than approximately 438 minutes or 7.3 hours of unscheduled downtime per month for three straight months) would represent a fundamental failure to deliver the Platform as warranted and would be wholly unacceptable for a mission-critical enterprise application. The pro-rata refund provision protects Quorum's financial exposure in the event of termination, ensuring that Quorum does not bear the cost of subscription fees for a period during which it is no longer receiving the contracted services.

G. Data Portability Timeline (Section 7.5 of Agreement; Exhibit C — Data Processing Addendum)

Clearpoint's Form Position. Section 7.5 of the form agreement provided that, upon expiration or termination of the Agreement, Clearpoint would provide Customer Data to Quorum in an export within 120 days following the effective date of expiration or termination. The format of the data export was to be "mutually agreed by the parties," with no specification of particular file formats, data structures, or standards. The form agreement did not impose any obligation on Clearpoint to certify destruction of Customer Data following completion of the export, nor did it specify a deadline by which Clearpoint was required to delete or destroy retained copies of Customer Data.

Negotiated Change. The Execution Version substantially revises the data portability framework as follows:

(i) Export Timeline: Clearpoint must provide a complete export of all Customer Data to Quorum within sixty (60) days of the effective date of expiration or termination of the Agreement (reduced from 120 days in the form agreement).

(ii) Export Formats: The data export must be provided in industry-standard formats, specifically ACORD XML and CSV, at Quorum's election. ACORD XML is the prevailing data-interchange standard in the property and casualty insurance industry, and CSV provides a universally accessible flat-file format for data portability.

(iii) Cost: The data export shall be provided at no additional charge to Quorum, and Clearpoint may not impose any fees, surcharges, or conditions on the data-export process.

(iv) Destruction Certification: Within thirty (30) days following completion of the data export, Clearpoint must certify in writing (executed by an officer of Clearpoint) that all Customer Data, including all copies, backups, archives, and derivatives, has been permanently and irreversibly destroyed in accordance with NIST SP 800-88 guidelines for media sanitization, and that no Customer Data is retained by Clearpoint or any subprocessor in any form.

Corresponding revisions have been incorporated into Section 8 of Exhibit C (Data Processing Addendum) to ensure consistency with the body of the Agreement.

Significance. The revised data portability framework reduces the total wind-down data-handling period from an indeterminate timeline under the form agreement (120 days for export, with no deadline for destruction) to a maximum of 90 days (60 days for export plus 30 days for certified destruction). This compressed timeline is critical for several reasons. First, in the event of termination, Quorum will need to migrate its claims data to an alternative platform or in-house system as quickly as possible to minimize operational disruption. A 120-day export timeline would create an unacceptable gap in Quorum's data-processing capabilities. Second, specifying ACORD XML and CSV as the required export formats ensures compatibility with Quorum's existing core systems and eliminates the risk that Clearpoint could deliver data in a proprietary or non-standard format that would require costly conversion. Third, the destruction certification with officer attestation provides documentary evidence of data destruction that Quorum can present to regulators in the event of an audit or examination, supporting Quorum's compliance with its obligations under the CTDPA, HIPAA, and the NAIC Insurance Data Security Model Law.

H. Subprocessor Objection Right (Exhibit C — Data Processing Addendum, Section 4)

Clearpoint's Form Position. Section 4 of the form DPA (Exhibit C) required Clearpoint to maintain a current list of subprocessors engaged in the processing of Customer Data and to provide Quorum with written notice of any proposed new subprocessor. Quorum was granted a window of fifteen (15) calendar days following receipt of such notice to object in writing to the proposed subprocessor. If Quorum objected, the parties were required to "discuss the objection in good faith," but the form agreement did not specify any consequence if the objection could not be resolved, nor did it grant Quorum any right to terminate or restrict processing in response to an unresolved subprocessor objection.

Negotiated Change. The Execution Version substantially strengthens Quorum's subprocessor management rights as follows:

(i) Objection Period: The subprocessor objection period has been expanded from fifteen (15) calendar days to thirty (30) calendar days following Clearpoint's written notice of a proposed new subprocessor.

(ii) Notice Content: Clearpoint's written notice of a proposed new subprocessor must include: the subprocessor's name, principal place of business, and jurisdiction of incorporation; a description of the processing activities to be performed by the subprocessor; the categories of Customer Data to be processed; the subprocessor's relevant security certifications (e.g., SOC 2 Type II, ISO 27001); and the subprocessor's data-processing agreement with Clearpoint (or a summary thereof).

(iii) Current Approved Subprocessors: The Execution Version confirms the following as Clearpoint's currently approved subprocessors:

(a) Cobalt Cloud Infrastructure, Inc. — hosting and infrastructure-as-a-service (IaaS); principal place of business: San Jose, California; and

(b) Redline Document AI, LLC — optical character recognition (OCR) processing of claims documents; principal place of business: Austin, Texas.

(iv) Objection Rights: Quorum retains the right to object to any proposed new subprocessor on data-security or regulatory-compliance grounds, with such objection to be delivered in writing and to include a reasonably detailed explanation of the basis for the objection.

(v) Resolution and Termination Right: If a subprocessor objection cannot be resolved through good-faith discussions within thirty (30) days following Quorum's objection notice, Quorum may terminate the affected processing activities (i.e., the processing activities that would have been performed by the objected-to subprocessor) without penalty, and Clearpoint shall continue to perform such processing activities directly or through an alternative subprocessor acceptable to Quorum.

Significance. The expanded subprocessor objection right provides Quorum with adequate time and information to conduct meaningful internal security and compliance review of proposed subprocessors before they are permitted to process Quorum's Customer Data. The fifteen-day objection period in the form agreement was insufficient for a regulated insurance enterprise to complete the necessary due diligence, which typically involves review by Quorum's information-security team, privacy office, and regulatory-compliance function. Doubling the objection period to thirty days reflects standard enterprise practice for regulated financial institutions and is consistent with the subprocessor management frameworks Quorum has negotiated in comparable technology agreements. The termination right for unresolved objections — which was entirely absent from the form agreement — provides Quorum with meaningful leverage and a credible enforcement mechanism, ensuring that the objection right is not merely an empty procedural formality.

I. Change-of-Control Assignment Restriction (Section 14.3 of Agreement)

Clearpoint's Form Position. The form agreement contained a standard anti-assignment clause in Section 14.2 providing that neither party may assign the Agreement without the other party's prior written consent. However, the form agreement included a carve-out permitting either party to assign the Agreement without the other party's consent "in connection with a merger, acquisition, reorganization, or sale of all or substantially all of such party's assets." The form agreement was entirely silent on change-of-control provisions and did not separately address scenarios in which Clearpoint's ownership or control might change through an equity transaction (as opposed to a direct assignment of the Agreement itself).

Negotiated Change. The Execution Version adds a new Section 14.3 establishing a specific assignment restriction applicable to change-of-control scenarios. The key elements of this provision are as follows:

(i) Consent Requirement: Clearpoint may not assign, transfer, delegate, or otherwise convey the Agreement (by operation of law or otherwise) in connection with a Change of Control (as defined below) without Quorum's prior written consent, which consent shall not be unreasonably withheld, conditioned, or delayed.

(ii) Definition of Change of Control: "Change of Control" is defined to include any of the following events:

(a) The acquisition, directly or indirectly, by any person or group (as such terms are used in Sections 13(d) and 14(d) of the Securities Exchange Act of 1934, as amended), other than Ridgeway Capital Partners, LP (which currently holds approximately 62% of Clearpoint's outstanding voting equity), of more than 50% of the combined voting power of Clearpoint's then-outstanding voting securities;

(b) A merger, consolidation, statutory share exchange, or similar business-combination transaction involving Clearpoint, in which Clearpoint's pre-transaction equity holders hold less than 50% of the combined voting power of the surviving or resulting entity immediately following such transaction; or

(c) The sale, transfer, or disposition of all or substantially all of Clearpoint's assets, whether in a single transaction or a series of related transactions.

(iii) Carve-Out for Existing Holdings: The definition of Change of Control expressly excludes transactions involving Ridgeway Capital Partners, LP's existing equity position in Clearpoint, including any transfer of Ridgeway's interest to Ridgeway's limited partners, affiliates, or successor funds, provided that such transfer does not result in a single third party (other than Ridgeway or its affiliates) acquiring majority voting control of Clearpoint.

Significance. The change-of-control provision is of particular importance in this transaction given Clearpoint's ownership structure. Clearpoint is a privately held company, with Ridgeway Capital Partners, LP (managing partner Fiona Galbraith) currently holding an approximately 62% equity stake. Private-equity-backed SaaS companies are frequently subject to secondary sales, platform acquisitions, or strategic transactions in which the company's ownership and control changes hands — often multiple times during the life of a multi-year enterprise contract. Without a change-of-control consent right, Quorum could find itself in a contractual relationship with a successor entity that is a competitor to Quorum, that lacks adequate financial or technical resources to maintain the ClaimsIQ™ Platform at required service levels, that is domiciled in or subject to the jurisdiction of a country with data-privacy laws inconsistent with Quorum's regulatory obligations, or that is otherwise a party with whom Quorum would not have chosen to enter into a long-term technology relationship. The carve-out for Ridgeway Capital Partners, LP's existing holdings acknowledges the current ownership structure and avoids inadvertently restricting routine fund-administration or portfolio-management activities by Ridgeway or its affiliates.

J. Governing Law and Dispute Resolution (Section 15 of Agreement)

Clearpoint's Form Position. Section 15 of the form agreement specified the State of Illinois as the governing law jurisdiction (Clearpoint's headquarters state, with offices in Chicago, Illinois). The form agreement further provided for exclusive jurisdiction and venue in the state and federal courts located in Cook County, Illinois, for the resolution of any disputes arising under or in connection with the Agreement.

Negotiated Change. The Execution Version modifies the governing law and dispute resolution provisions as follows:

Governing Law. The Agreement is governed by and construed in accordance with the laws of the State of Connecticut, without regard to its conflicts-of-law principles that would result in the application of the laws of any other jurisdiction. Connecticut is the state of domicile of Quorum's corporate headquarters (Hartford, Connecticut) and the state of domicile and principal regulatory jurisdiction of Quorum's principal insurance subsidiary, Quorum Property & Casualty Insurance Company. Connecticut's insurance regulatory framework, including the Connecticut Insurance Code (Title 38a of the Connecticut General Statutes), the CTDPA, and the Connecticut adoption of the NAIC Insurance Data Security Model Law, is the regulatory framework most directly applicable to the subject matter of the Agreement.

Dispute Resolution. The Execution Version replaces the form agreement's litigation-based dispute resolution mechanism with a two-step alternative dispute resolution framework:

Step 1 — Mandatory Mediation. Any dispute arising under or in connection with the Agreement shall first be submitted to mandatory mediation, administered by Pinnacle Dispute Resolution Services (Hartford, Connecticut), in accordance with Pinnacle's then-current mediation rules and procedures. The mediation shall be conducted by a single mediator with experience in technology transactions and insurance industry matters, selected by mutual agreement of the parties (or, failing agreement within ten (10) business days, appointed by Pinnacle). The mediation shall take place in Hartford, Connecticut, and each party shall be represented by at least one individual with authority to negotiate and settle the dispute on such party's behalf. The costs of the mediation (including the mediator's fees) shall be shared equally by the parties.

Step 2 — Binding Arbitration. If the dispute is not resolved through mediation within sixty (60) days of the commencement of mediation (or such longer period as the parties may agree in writing), either party may submit the dispute to binding arbitration under the Commercial Arbitration Rules of the American Arbitration Association ("AAA"). The arbitration shall be conducted by a panel of three (3) arbitrators, with each party selecting one arbitrator and the two party-appointed arbitrators selecting the third (who shall serve as chair). The seat of arbitration shall be Hartford, Connecticut. The arbitrators shall have the authority to award any remedy or relief that a court of competent jurisdiction could award, including injunctive relief, specific performance, and monetary damages. The arbitrators' award shall be final and binding on the parties and may be entered as a judgment in any court of competent jurisdiction. Each party shall bear its own attorneys' fees and costs, unless the arbitrators determine that a party's claims or defenses were frivolous or brought in bad faith, in which case the arbitrators may award reasonable attorneys' fees and costs to the prevailing party.

Injunctive Relief Carve-Out. Notwithstanding the foregoing mediation and arbitration provisions, either party shall have the right to seek temporary, preliminary, or permanent injunctive relief (or other equitable relief) in the state or federal courts of competent jurisdiction located in Hartford, Connecticut, without first submitting the matter to mediation or arbitration, in circumstances where such relief is necessary to prevent irreparable harm, including (without limitation) to prevent unauthorized access to, disclosure of, or destruction of Customer Data, or to enforce the confidentiality, data-security, or intellectual property provisions of the Agreement.

Significance. The change of governing law from Illinois to Connecticut aligns the Agreement with Quorum's principal regulatory jurisdiction, ensuring that any disputes under the Agreement are resolved under the substantive law of the state whose insurance regulatory framework is most directly applicable to the relationship. This is particularly important for provisions relating to data privacy, data security, and insurance regulatory compliance, where Connecticut-specific requirements (including the CTDPA and the Connecticut adoption of the NAIC Model Law) may differ from Illinois law. The mediation-then-arbitration framework provides a confidential, efficient, and structured dispute resolution process that is well-suited to a commercial SaaS relationship involving proprietary and confidential claims data — avoiding the delay, expense, and public disclosure risks associated with traditional litigation. The injunctive-relief carve-out is a critical protection that preserves Quorum's ability to seek emergency judicial relief on an expedited basis in scenarios involving threatened or actual data breaches, unauthorized data disclosure, or other circumstances requiring immediate court intervention.

III. Additional Negotiated Refinements

In addition to the ten categories of material changes described in Section II above, the negotiation process resulted in a number of additional refinements to the Agreement and its exhibits. While these refinements are, in our assessment, not individually material to the overall risk-allocation framework of the Agreement, they are nevertheless noteworthy and are summarized below for completeness.

Renewal Provisions. The Agreement provides for an initial subscription term of five (5) years commencing on the Effective Date. Following expiration of the initial term, the Agreement automatically renews for successive one-year renewal terms unless either party provides written notice of non-renewal at least one hundred eighty (180) days prior to the expiration of the then-current term. The 180-day non-renewal notice period (extended from 90 days in the form agreement) provides adequate lead time for Quorum to evaluate alternative platforms and plan a potential migration in the event of non-renewal.

Payment Terms. Subscription fees are payable in advance on an annual basis, with each annual payment due within thirty (30) days of each subscription anniversary date. The Year 1 subscription payment of $1,400,000 is due upon execution of the Agreement. Subscription fees for Years 2 through 5 are subject to a CPI-based annual escalator, calculated based on the percentage change in the Consumer Price Index for All Urban Consumers (CPI-U), U.S. City Average, as published by the U.S. Bureau of Labor Statistics, for the twelve-month period ending on the last day of the month that is three months prior to the applicable subscription anniversary date. The CPI escalator is capped at 3.5% per annum, ensuring predictability of costs over the five-year term. Based on the 3.5% maximum escalation rate, the maximum annual subscription fees for each year of the initial term would be as follows:

User Overage Rates. The Agreement provides for up to 1,200 named users. For each additional named user seat above the 1,200 named-user allocation, Quorum will be charged an overage rate of $150 per user per month, billed quarterly in arrears. This rate was confirmed during negotiation and is consistent with the per-user economics of the base subscription.

Insurance Requirements. Section 13.4 of the Execution Version sets forth refined minimum insurance coverage requirements for Clearpoint, as follows:

• Commercial General Liability: $5,000,000 per occurrence / $10,000,000 aggregate;

• Technology Errors & Omissions / Cyber Liability: $10,000,000 per claim / $20,000,000 aggregate;

• Workers' Compensation: Statutory limits as required by applicable law;

• All policies to be carried with Northern Ridge Mutual Insurance Company (or another carrier with an A.M. Best rating of A- (Excellent) VII or better), with Quorum named as an additional insured on CGL and Tech E&O/Cyber policies.

These coverage levels were increased from the form agreement minimums of $2 million CGL and $5 million Tech E&O/Cyber to levels appropriate for an enterprise SaaS provider processing sensitive insurance data.

SOC 2 Type II Audit Report Delivery. Clearpoint is required to deliver its SOC 2 Type II audit report to Quorum annually, within ninety (90) days of the close of the applicable audit period. Clearpoint's current SOC 2 Type II report, issued by Hawthorne & Ellers, CPAs LLP, covers the audit period of April 1, 2023 through March 31, 2024, and was reviewed by C&H and Quorum's information-security team during the negotiation process. Clearpoint is required to promptly notify Quorum of any material exceptions, qualifications, or adverse findings in any future SOC 2 Type II report.

Penetration Testing. Clearpoint is required to conduct annual penetration testing of the ClaimsIQ™ Platform by an independent, qualified third-party security firm. Clearpoint's current penetration-testing provider is Sentinel Cyber Solutions LLC. An executive summary of the penetration-test results must be shared with Quorum within thirty (30) days of completion of each annual test. In the event that critical or high-severity vulnerabilities are identified, Clearpoint is required to remediate such vulnerabilities within thirty (30) days of identification and to provide Quorum with written confirmation of remediation.

Source Code Escrow. The parties have agreed to establish a technology escrow arrangement pursuant to a separate Technology Escrow Agreement with Granite Trust Company, N.A. as escrow agent. The deposited materials include the ClaimsIQ™ Platform source code, build scripts, compilation instructions, technical documentation, database schemas, and all other materials necessary to compile, deploy, and operate the Platform. Clearpoint is required to update the escrowed materials on a quarterly basis. The release conditions under the escrow agreement include: (i) Clearpoint's bankruptcy, insolvency, or assignment for the benefit of creditors; (ii) Clearpoint's cessation of business operations or discontinuation of the ClaimsIQ™ Platform; or (iii) Clearpoint's material breach of the Agreement that remains uncured for a period of sixty (60) days following written notice of such breach from Quorum. The annual escrow-agent fee of $4,500 is to be shared equally between the parties ($2,250 per party).

IV. Dravello Data Compliance Advisors Assessment

We note that the data-privacy impact assessment completed on April 8, 2024 by Dravello Data Compliance Advisors LLC (principal consultant Miriam Tanaka) informed several of the negotiated changes described in this memorandum. Specifically, the Fenwick DCA assessment addressed the privacy and data-security implications of Clearpoint's processing of Quorum's Customer Data through the ClaimsIQ™ Platform, with particular focus on:

• compliance with the Connecticut Data Privacy Act (CTDPA), effective July 1, 2023;

• HIPAA requirements applicable to Quorum's workers' compensation lines of business;

• the NAIC Insurance Data Security Model Law as adopted in Connecticut;

• the adequacy of the data-processing provisions in the DPA (Exhibit C);

• the security requirements set forth in Exhibit D (Security Requirements); and

• the risks associated with Clearpoint's proposed Aggregated Data rights under the form agreement.

The Fenwick DCA assessment's findings and recommendations were instrumental in shaping several of the negotiated changes described in this memorandum, including the strengthened Customer Data ownership language (Section II.A), the Aggregated Data use restrictions (Section II.B), the data portability timeline and destruction certification requirements (Section II.G), and the subprocessor objection framework (Section II.H).

The Fenwick DCA assessment and its findings are discussed in detail in a separate cover memorandum from Nathan Ikeda to Patricia Okonkwo and Derek Langston dated April 10, 2024 (Matter No. 1025-00009-DPA), which has been provided under separate cover and should be reviewed in conjunction with this memorandum.

V. Recommendation and Next Steps

Based on our review of the Execution Version and the negotiation outcomes summarized in this memorandum, we recommend approval of the Execution Version for signing by Patricia Okonkwo, General Counsel, on behalf of Quorum Insurance Holdings Corp. The Execution Version reflects a commercially balanced agreement that appropriately protects Quorum's interests as a regulated insurance enterprise, and all material revisions proposed by C&H on behalf of Quorum have been accepted by Clearpoint.

Execution. The Execution Version is to be signed by:

• Quorum Insurance Holdings Corp.: Patricia Okonkwo, General Counsel

• Clearpoint Analytics, Inc.: Anita Rajan, Chief Executive Officer

The target signing date is April 26, 2024. The Execution Version will be circulated in counterpart signature pages, with each party retaining an original fully executed copy. C&H will coordinate the signature process with Whitfield Greer & Associates LLP.

Post-Execution Items. The following items require attention promptly following execution of the Agreement:

1. Year 1 Subscription Payment. The Year 1 subscription payment of $1,400,000 is due upon execution. Quorum's finance team should be prepared to remit payment within thirty (30) days of the Effective Date, in accordance with the payment instructions set forth in Schedule 1 to the Agreement.

2. Technology Escrow Agreement. The Technology Escrow Agreement with Granite Trust Company, N.A. must be finalized and executed as a post-closing deliverable. C&H is currently reviewing the form escrow agreement provided by Granite Trust and anticipates circulating a final version within two weeks of the Agreement's Effective Date. Clearpoint's initial deposit of escrowed materials is required within thirty (30) days of execution of the escrow agreement.

3. Implementation Planning. Following execution, Quorum and Clearpoint should schedule a formal implementation kickoff meeting to establish the project timeline, identify key stakeholders, and confirm the technical requirements for Platform deployment across Quorum's three operational locations.

C&H Engagement Team. The Calderwood & Harkness LLP engagement team for this matter is available for any questions, clarifications, or further guidance regarding the Execution Version, the negotiation process, or any of the matters discussed in this memorandum:

• Renata Vasquez — Responsible Partner

• Bernard Crawford — Billing Partner

• Nathan Ikeda — Lead Associate

• Gabrielle Moss — Working Associate

Please do not hesitate to contact Nathan Ikeda (nikeda@calderwoodharkness.com; 860-555-4712) or Gabrielle Moss (gmoss@calderwoodharkness.com; 860-555-4738) with any questions.

VI. Appendix — Comparison Table of Key Terms

The following table provides a side-by-side comparison of the ten categories of material changes negotiated from the form agreement to the Execution Version. This table is intended as a summary reference and should be read in conjunction with the detailed discussion in Section II above.

This memorandum has been prepared solely for the use of the addressees identified above and is subject to the attorney-client privilege and work-product doctrine. This memorandum does not constitute legal advice to any party other than Quorum Insurance Holdings Corp. and should not be relied upon by any other party for any purpose.

Subscription Year	Maximum Annual Fee
Year 1	$1,400,000
Year 2	$1,449,000
Year 3	$1,499,715
Year 4	$1,552,205
Year 5	$1,607,523 (approx.)
Provision	Clearpoint Form Position	Final Execution Version
A. Customer Data Ownership (§ 7.1; Ex. C)	Quorum retains "ownership" of Customer Data; no exclusivity qualifier; narrow definition limited to uploaded data; ambiguity re: residual Clearpoint rights.	Quorum retains "sole and exclusive" ownership of all Customer Data; definition expanded to include claims data, PII, PHI, adjuster notes, all outputs/reports, and derivatives. Clearpoint license narrowed to non-exclusive, non-transferable, non-sublicensable, solely to provide Services.
B. Aggregated Data Use (§ 7.3; Ex. C)	Broad, unilateral right to create and use Aggregated Data for any internal business purpose, including benchmarking and marketing; no consent required; no prohibition on third-party sale or re-identification.	Right limited to product-improvement purposes only; subject to (i) compliance with applicable insurance data-privacy laws, (ii) Quorum's prior written consent (not to be unreasonably withheld), and (iii) express prohibition on re-identification and third-party sale. De-identification must comply with NIST SP 800-188 / HIPAA Safe Harbor.
C. Indemnification Structure & Caps (§ 10)	Mutual indemnification with single aggregate cap of 1× ACV ($1.4M) for all obligations; no data-breach carve-out; general indemnification categories.	Clear mutual obligations defined. IP/general indemnification cap increased to 2× TCV ($14M). Data-breach indemnification uncapped. Procedures: 15 business days' notice; indemnifying party controls defense; no settlement without consent.
D. General Liability Cap (§ 11.2)	Single aggregate cap of 1× ACV ($1.4M) for all claims; no carve-outs.	General cap increased to 1× TCV ($7M). Carve-outs: data breach (uncapped), willful misconduct (uncapped), IP infringement ($14M).
E. SLA Uptime Threshold (Ex. B)	99.5% monthly uptime; no specified maintenance window; service credits as sole remedy.	99.7% monthly uptime; scheduled maintenance limited to 4 hrs/month, Sundays 2:00–6:00 AM ET. Service credits: 2% of monthly fee per 0.1% shortfall (~$2,333); max 15% of monthly fee ($17,500).
F. Chronic Failure Termination (Ex. B)	No chronic-failure termination right; service credits sole remedy.	If uptime < 99.0% for 3 consecutive months, Quorum may terminate for cause with pro-rata refund of prepaid fees.
G. Data Portability (§ 7.5; Ex. C)	Export within 120 days; format "mutually agreed"; no destruction certification obligation.	Export within 60 days in ACORD XML and CSV at no charge; certified destruction within 30 days of export completion (total: 90 days max). Officer attestation required; NIST SP 800-88 standards.
H. Subprocessor Objection (Ex. C, § 4)	15-day objection window; notification only; no consequence for unresolved objection.	30-day objection window; detailed notice requirements; approved subprocessors confirmed (Cobalt Cloud; Redline Document AI). If objection unresolved within 30 days, Quorum may terminate affected processing without penalty.
I. Change of Control (§ 14.3)	Silent on change of control; standard anti-assignment clause with merger/acquisition carve-out permitting assignment without consent.	Assignment in c

PRIVILEGED & CONFIDENTIAL — ATTORNEY-CLIENT COMMUNICATION
This memorandum is a privileged and confidential attorney-client communication prepared by Calderwood & Harkness LLP at the direction of and for the sole benefit of Quorum Insurance Holdings Corp. This memorandum is protected by the attorney-client privilege and the work-product doctrine. Any disclosure, copying, distribution, or use of the contents of this memorandum by any person other than the intended recipients is strictly prohibited. If you have received this memorandum in error, please notify Calderwood & Harkness LLP immediately.
MEMORANDUM
From: Gabrielle Moss, Working Associate, and Nathan Ikeda, Lead Associate, Calderwood & Harkness LLP
To: Patricia Okonkwo, General Counsel, Quorum Insurance Holdings Corp.; Derek Langston, Chief Information Officer, Quorum Insurance Holdings Corp.
Date: April 23, 2024
Re: Summary of Material Changes — Enterprise SaaS Subscription Agreement between Quorum Insurance Holdings Corp. and Clearpoint Analytics, Inc. (ClaimsIQ™ Platform)
Matter No.: 1025-00009
I. Purpose and Executive Summary
The purpose of this memorandum is to summarize, for the benefit of Quorum Insurance Holdings Corp. ("Quorum") management, the material changes negotiated by Calderwood & Harkness LLP ("C&H") on behalf of Quorum from Clearpoint Analytics, Inc.'s ("Clearpoint") initial form Enterprise SaaS Subscription Agreement (the "Agreement") received on March 11, 2024, to the final execution version circulated to the parties on April 23, 2024 (the "Execution Version"). This memorandum is intended to serve as a comprehensive reference for Quorum's internal review and approval process in advance of the anticipated signing date.
Transaction Context. The Agreement governs the enterprise-wide deployment of Clearpoint's ClaimsIQ™ cloud-based claims analytics platform (the "Platform") across Quorum's property and casualty insurance and specialty lines subsidiaries, including Quorum Property & Casualty Insurance Company, Quorum Specialty Underwriters, Inc., and Quorum Workers' Compensation Insurance Company (collectively, the "Quorum Subsidiaries"). The Platform will be deployed across approximately 1,200 named users operating from Quorum's three principal operational locations in Hartford, Connecticut; Charlotte, North Carolina; and Dallas, Texas. The total contract value of the Agreement over its five-year initial subscription term is $7,000,000 (the "TCV"), representing an annual contract value of $1,400,000 (the "ACV"), subject to CPI-based escalation as described in Section III below.
Counterparty Counsel. Clearpoint was represented throughout the negotiation by Whitfield Greer & Associates LLP, with Damian Cho serving as lead partner and Leona Burris as the primary associate on the matter. Whitfield Greer demonstrated familiarity with enterprise SaaS transactions in the insurance sector, and negotiations proceeded in a professional and constructive manner throughout.
Negotiation Timeline. The negotiation proceeded over approximately six weeks according to the following timeline:
•  March 11, 2024: Clearpoint's form Enterprise SaaS Subscription Agreement and associated exhibits received by Quorum.
•  March 13, 2024: C&H engagement initiated; initial review of form agreement commenced.
•  March 22, 2024: C&H first redline delivered to Whitfield Greer, incorporating Quorum's material and structural comments.
•  April 2, 2024: Whitfield Greer counter-redline received, reflecting Clearpoint's responses and counter-proposals.
•  April 8, 2024: Data-privacy impact assessment completed by Dravello Data Compliance Advisors LLC.
•  April 10, 2024: C&H revised redline delivered to Whitfield Greer, incorporating Fenwick DCA findings and Quorum's remaining open-issue positions.
•  April 15, 2024: Whitfield Greer revised counter-redline received; five remaining open issues identified.
•  April 18, 2024: Final negotiation call held among all parties, including Patricia Okonkwo, Derek Langston, Renata Vasquez (C&H), Nathan Ikeda (C&H), Damian Cho (Whitfield Greer), Leona Burris (Whitfield Greer), and Anita Rajan (CEO, Clearpoint). All remaining open issues resolved on the call.
•  April 23, 2024: Final Execution Version circulated for review and signature.
High-Level Summary of Negotiation Outcomes. Ten categories of material changes were negotiated from the form agreement, covering the following subject areas: (i) customer data ownership; (ii) aggregated data use restrictions; (iii) indemnification structure and caps; (iv) general liability cap; (v) SLA uptime thresholds; (vi) chronic failure termination rights; (vii) data portability timelines; (viii) subprocessor management; (ix) change-of-control assignment restrictions; and (x) governing law and dispute resolution. All material revisions proposed by C&H on behalf of Quorum were accepted by Clearpoint in the Execution Version, in each case either as originally proposed or as refined through the negotiation process. In our assessment, the Execution Version reflects a commercially balanced agreement that appropriately protects Quorum's interests as a regulated insurance enterprise and data controller, while providing Clearpoint with reasonable commercial terms consistent with its position as a SaaS platform provider.
Each of the ten categories of material change is discussed in detail in Section II below.
II. Summary of Material Changes
The following subsections describe each category of material change in sequence, organized to correspond with the relevant provisions of the Agreement and its exhibits. For each category, we describe: (a) Clearpoint's original form position; (b) the negotiated change reflected in the Execution Version; and (c) the practical and legal significance of the change for Quorum. A side-by-side comparison table summarizing all ten categories is provided in the Appendix (Section VI) for ease of reference.
A. Customer Data Ownership (Section 7.1 of Agreement; Exhibit C — Data Processing Addendum)
Clearpoint's Form Position. The form agreement included a provision in Section 7.1 stating that "Customer retains ownership of Customer Data uploaded to or processed through the Platform." While facially protective, this language contained two significant deficiencies from Quorum's perspective. First, the ownership language lacked exclusivity qualifiers, leaving open the possibility that Clearpoint could assert co-ownership or residual license rights in Customer Data, particularly with respect to derivative works, analytical outputs, or reports generated by the Platform using Customer Data as inputs. Second, the definition of "Customer Data" in the form agreement was limited to "data uploaded by Customer to the Platform," which did not clearly encompass outputs, reports, analytics, adjuster notes, or other data generated through Customer's use of the Platform that incorporated or derived from Customer's proprietary information. This ambiguity was compounded by a separate provision in Section 7.2 of the form agreement granting Clearpoint a "non-exclusive, worldwide, royalty-free license to use Customer Data as necessary to provide the Services," which, when read in conjunction with the weak ownership language, could be interpreted as granting Clearpoint broader rights than Quorum intended to convey.
Negotiated Change. The Execution Version strengthens the Customer Data ownership language in two respects. First, Section 7.1 now provides that Quorum retains "sole and exclusive" ownership of all Customer Data, and expressly states that nothing in the Agreement shall be construed to transfer, assign, or convey any ownership interest in Customer Data to Clearpoint. Second, the definition of "Customer Data" has been expanded to explicitly include the following categories of information:
(a) claims data, including first-notice-of-loss records, loss-run data, reserve data, and claims adjudication records;
(b) policyholder personally identifiable information ("PII"), including names, addresses, Social Security numbers, policy numbers, and financial account information;
(c) protected health information ("PHI") as defined under HIPAA, arising from Quorum's workers' compensation lines of business;
(d) adjuster notes, investigation reports, and case-management records;
(e) all outputs, reports, analytics, dashboards, visualizations, and other materials generated by the Platform using Customer Data as inputs or incorporating Customer Data in any manner; and
(f) any copies, extracts, or derivatives of the foregoing.
The license granted to Clearpoint under Section 7.2 has been narrowed to a "non-exclusive, non-transferable, non-sublicensable license to use Customer Data solely to the extent necessary to provide the Services under this Agreement," with an express prohibition on Clearpoint's use of Customer Data for any other purpose.
Corresponding revisions have been incorporated into Section 3 of Exhibit C (Data Processing Addendum) to ensure consistency between the body of the Agreement and the DPA.
Significance. The revised ownership language eliminates any argument that Clearpoint holds co-ownership, residual license rights, or other proprietary interests in Quorum's data. This is a critical protection for Quorum for several reasons. First, Quorum's claims data constitutes among its most competitively sensitive proprietary assets, and any ambiguity regarding ownership could undermine Quorum's ability to protect and enforce its rights in that data. Second, the expanded definition of Customer Data ensures that all categories of information processed through the Platform — including PHI, adjuster work product, and Platform-generated outputs — are unambiguously owned by Quorum. Third, clear and exclusive ownership is essential to Quorum's compliance with its regulatory obligations under the Connecticut Data Privacy Act ("CTDPA"), the Health Insurance Portability and Accountability Act ("HIPAA") with respect to its workers' compensation lines, and the NAIC Insurance Data Security Model Law as adopted in Connecticut (Conn. Gen. Stat. § 38a-38, et seq.). Regulatory agencies expect that regulated insurance entities maintain clear ownership of and control over policyholder data processed by third-party service providers.
B. Aggregated Data Use Restrictions (Section 7.3 of Agreement; Exhibit C — Data Processing Addendum)
Clearpoint's Form Position. Section 7.3 of the form agreement granted Clearpoint a broad, unilateral right to "create and use de-identified, aggregated statistical data derived from Customer Data" (defined as "Aggregated Data") for "any internal business purpose." The form agreement further specified that such internal business purposes included, without limitation, "product development and improvement, benchmarking, industry research, and marketing of Clearpoint's products and services." Notably, the form agreement did not impose any obligation on Clearpoint to obtain Quorum's consent before creating or using Aggregated Data, did not restrict Clearpoint's ability to share Aggregated Data with third parties, and contained no prohibition on re-identification. The only limitation was a representation that Aggregated Data would be "de-identified in accordance with industry-standard practices," without reference to any specific de-identification standard or methodology.
Negotiated Change. The Execution Version substantially restricts Clearpoint's Aggregated Data rights. Section 7.3 now provides that Clearpoint's right to create and use Aggregated Data derived from Customer Data is limited to product-improvement purposes only, and is subject to the following three conditions:
(i) Clearpoint's creation and use of Aggregated Data must comply with all applicable insurance data-privacy laws, including the CTDPA, HIPAA (to the extent applicable), the NAIC Insurance Data Security Model Law, and any other data-protection laws applicable to Quorum's insurance operations;
(ii) Clearpoint must obtain Quorum's prior written consent (not to be unreasonably withheld, conditioned, or delayed) before creating or using any Aggregated Data for product-improvement purposes, with such consent request to include a reasonable description of the intended use, the de-identification methodology to be applied, and the categories of data to be aggregated; and
(iii) Clearpoint is expressly prohibited from (a) re-identifying or attempting to re-identify any Aggregated Data, (b) combining Aggregated Data with other data in a manner that could facilitate re-identification, or (c) selling, licensing, distributing, or otherwise making Aggregated Data available to any third party for any purpose.
Additionally, the de-identification standard has been specified: Clearpoint must apply de-identification methodologies consistent with NIST Special Publication 800-188 and, to the extent PHI is involved, the HIPAA Safe Harbor de-identification standard (45 C.F.R. § 164.514(b)).
Significance. The restrictions on Aggregated Data use represent one of the most commercially significant changes negotiated in this transaction. Clearpoint's form position would have permitted Clearpoint to derive substantial commercial value from Quorum's proprietary claims data — including by creating benchmarking products that could be sold to Quorum's competitors — without Quorum's consent and without any compensation to Quorum. The consent mechanism negotiated in the Execution Version provides Quorum with ongoing control over how its data is used, even in aggregated form, and the prohibition on third-party sales ensures that Quorum's data does not become a revenue source for Clearpoint at Quorum's expense. Given the increasing regulatory scrutiny of data aggregation practices in the insurance sector, these restrictions also position Quorum favorably from a compliance standpoint.
C. Indemnification Structure and Caps (Section 10 of Agreement)
Clearpoint's Form Position. The form agreement contained mutual indemnification provisions in Section 10, with a single aggregate indemnification cap of 1× ACV ($1,400,000) applicable to all indemnification obligations of both parties, without distinction between categories of indemnifiable claims. The form agreement did not contain a separate carve-out or sub-limit for data-breach liability, meaning that a catastrophic data breach affecting Quorum's policyholder data would be subject to the same $1,400,000 cap as a routine intellectual property claim. The indemnification obligations themselves were drafted in general terms, without clearly delineating the categories of third-party claims for which each party would be responsible.
Negotiated Change — Indemnification Obligations. The Execution Version establishes a comprehensive, mutual indemnification framework with clearly defined obligations for each party:
Clearpoint's Indemnification Obligations. Clearpoint shall indemnify, defend, and hold harmless Quorum and its affiliates, and their respective officers, directors, employees, and agents (collectively, the "Quorum Indemnitees"), from and against any and all third-party claims, actions, suits, proceedings, losses, damages, liabilities, costs, and expenses (including reasonable attorneys' fees and costs of investigation) arising out of or relating to:
(a) any claim that Quorum's authorized use of the ClaimsIQ™ Platform, or any component thereof, infringes, misappropriates, or otherwise violates any third party's intellectual property rights, including patents, copyrights, trademarks, and trade secrets;
(b) any claim arising from Clearpoint's breach of its data-security obligations under the Agreement or the DPA (Exhibit C), or any unauthorized access to, disclosure of, or loss of Customer Data resulting from Clearpoint's acts or omissions, including the acts or omissions of Clearpoint's subprocessors; and
(c) any claim arising from Clearpoint's violation of applicable law, including federal, state, and local laws and regulations applicable to the insurance industry, data privacy, and information security.
Quorum's Indemnification Obligations. Quorum shall indemnify, defend, and hold harmless Clearpoint and its affiliates, and their respective officers, directors, employees, and agents (collectively, the "Clearpoint Indemnitees"), from and against any and all third-party claims, actions, suits, proceedings, losses, damages, liabilities, costs, and expenses (including reasonable attorneys' fees and costs of investigation) arising out of or relating to:
(a) any claim that Customer Data provided by Quorum to Clearpoint for processing through the Platform infringes, misappropriates, or otherwise violates any third party's intellectual property rights or other proprietary rights; and
(b) any claim arising from Quorum's use of the ClaimsIQ™ Platform outside the scope of the Agreement, including any use that exceeds the license grant set forth in Section 2.1 of the Agreement or violates the use restrictions set forth in Section 2.3.
Indemnification Procedures. Section 10.3 of the Execution Version establishes the following procedural requirements for indemnification claims:
(i) The indemnified party must provide written notice to the indemnifying party of any indemnifiable claim within fifteen (15) business days of becoming aware of such claim, provided that failure to provide timely notice shall not relieve the indemnifying party of its indemnification obligations except to the extent the indemnifying party is materially prejudiced by such delay;
(ii) The indemnifying party shall have the right to assume and control the defense of any indemnifiable claim, including the selection of counsel, subject to the indemnified party's right to approve counsel (such approval not to be unreasonably withheld);
(iii) The indemnified party shall have the right to participate in the defense of any indemnifiable claim at its own expense, with counsel of its own choosing; and
(iv) Neither party may settle, compromise, or consent to the entry of any judgment with respect to any indemnifiable claim without the prior written consent of the other party, such consent not to be unreasonably withheld, conditioned, or delayed.
Negotiated Change — Indemnification Caps. The Execution Version establishes a tiered cap structure for indemnification obligations, replacing the form agreement's single, undifferentiated cap:
•  IP and General Indemnification Cap: The aggregate cap for Clearpoint's indemnification obligations arising under Section 10.1(a) (IP infringement) and Section 10.1(c) (violation of law) has been increased from 1× ACV ($1,400,000) to 2× TCV ($7,000,000 × 2 = $14,000,000).
•  Data-Breach Indemnification — Uncapped: Clearpoint's indemnification obligations arising under Section 10.1(b) (data-security breach and unauthorized disclosure of Customer Data) are not subject to any aggregate cap. This carve-out reflects the catastrophic financial exposure that a data breach involving policyholder PII and PHI would create for Quorum and its regulated insurance subsidiaries, including regulatory fines, class-action litigation, remediation costs, credit-monitoring obligations, and reputational harm.
Significance. The restructured indemnification framework represents the single most significant risk-allocation change negotiated in this transaction, and its importance cannot be overstated. The increase in the IP and general indemnification cap from $1.4 million to $14 million dramatically enhances Quorum's recovery potential in an IP infringement scenario, which is particularly important given the complexity of the ClaimsIQ™ Platform and the inherent risk of third-party IP claims in the enterprise software sector. The decision to carve out data-breach indemnification obligations and make them uncapped is consistent with industry-standard practice for enterprise insurance clients, reflects the volume and sensitivity of the policyholder PII and PHI that will be processed through the Platform, and appropriately allocates the risk of a data breach to the party best positioned to prevent it — namely, Clearpoint, as the platform operator and data processor. The indemnification framework as negotiated aligns with Quorum's risk profile as a publicly traded insurance holding company and is consistent with the indemnification structures Quorum has negotiated in comparable enterprise technology agreements.
D. General Liability Cap (Section 11.2 of Agreement)
Clearpoint's Form Position. Section 11.2 of the form agreement established a single aggregate liability cap for all claims arising under or in connection with the Agreement, without distinction between types of liability. The cap was set at 1× ACV ($1,400,000), meaning that Clearpoint's total financial exposure under the Agreement, regardless of the nature or severity of the claim, would not exceed the equivalent of a single year's subscription fees. No carve-outs were provided for any category of liability, including data breach, willful misconduct, fraud, or intellectual property infringement.
Negotiated Change. The Execution Version restructures the liability cap framework as follows:
•  General Liability Cap: The aggregate liability cap for all claims under the Agreement (other than the categories carved out below) is set at 1× TCV = $7,000,000. This general cap applies to contract claims, warranty claims, negligence claims, and all other claims not subject to a specific carve-out.
•  Carve-Outs from the General Liability Cap: The following categories of liability are carved out from the $7,000,000 general cap and are subject to their own respective limits (or no limit):
(a) Data-Breach Liability (Uncapped): Claims arising from Clearpoint's breach of data-security obligations, unauthorized disclosure of Customer Data, or breach of the DPA (Exhibit C) are uncapped, consistent with the data-breach indemnification carve-out described in Section II.C above.
(b) Willful Misconduct (Uncapped): Claims arising from a party's willful misconduct, fraud, or intentional misrepresentation are uncapped.
(c) IP Infringement Indemnification (Capped at $14,000,000): Claims arising under Clearpoint's IP infringement indemnification obligations (Section 10.1(a)) are subject to the 2× TCV cap of $14,000,000 as described in Section II.C above.
Significance. The increase of the general liability cap from $1.4 million (one year's fees) to $7 million (full contract value over the five-year term) provides substantially greater financial protection for Quorum across the life of the Agreement. Under the form agreement, Clearpoint's maximum exposure for a catastrophic platform failure or material breach in Year 4 of the Agreement would have been limited to $1.4 million — a figure that bears no reasonable relationship to the potential damages Quorum could incur from such an event, particularly given the mission-critical nature of the ClaimsIQ™ Platform and its role in Quorum's claims-processing operations. The carve-outs for data breach (uncapped), willful misconduct (uncapped), and IP infringement ($14 million) ensure that the most serious risk categories — those with the greatest potential financial exposure for Quorum — are not artificially constrained by the general liability cap. This tiered structure is consistent with market practice in enterprise SaaS transactions involving regulated financial institutions and reflects an appropriate allocation of risk between the parties.
E. SLA Uptime Threshold (Exhibit B — Service Level Agreement)
Clearpoint's Form Position. Exhibit B to the form agreement established a platform availability service level of 99.5% monthly uptime, measured on a calendar-month basis. Scheduled maintenance was excluded from the uptime calculation, but the form agreement did not specify the timing, frequency, or maximum duration of scheduled maintenance windows. No chronic-failure termination right was included; service credits (as described below) constituted the sole and exclusive remedy for SLA shortfalls.
Negotiated Change. The Execution Version modifies the SLA framework in the following respects:
•  Uptime Threshold: The monthly uptime commitment has been increased from 99.5% to 99.7%, measured on a calendar-month basis.
•  Scheduled Maintenance Windows: Scheduled maintenance windows have been defined and limited to a maximum of four (4) hours per month, to occur only on Sundays between 2:00 AM and 6:00 AM Eastern Time. Time during scheduled maintenance windows is excluded from the uptime calculation, provided that Clearpoint provides at least forty-eight (48) hours' advance written notice to Quorum's designated technical contact prior to any scheduled maintenance event.
•  Service Credit Methodology: For each 0.1 percentage point by which actual monthly uptime falls below the 99.7% threshold, Quorum shall receive a service credit equal to 2% of the applicable monthly subscription fee. The applicable monthly subscription fee is calculated as the ACV divided by twelve ($1,400,000 ÷ 12 = $116,667 per month), yielding a credit of approximately $2,333 per 0.1% shortfall. The maximum aggregate service credit for any single calendar month is capped at 15% of the monthly subscription fee ($116,667 × 15% = $17,500).
•  Service Credit Application: Service credits are applied against the next invoice following the month in which the SLA shortfall occurred, or, at Quorum's option, refunded in cash within thirty (30) days of written request.
Significance. While the 0.2 percentage-point increase in the uptime threshold from 99.5% to 99.7% may appear modest in absolute terms, the practical impact is material. On a monthly basis, 99.5% uptime permits approximately 219 minutes (3 hours and 39 minutes) of unscheduled downtime, whereas 99.7% uptime permits approximately 132 minutes (2 hours and 12 minutes) of unscheduled downtime — a reduction of approximately 87 minutes of permitted downtime per month. For a mission-critical claims-processing platform deployed across three operational locations with approximately 1,200 named users, 87 minutes of additional downtime per month represents a significant operational disruption, with potential impacts on claims-processing timelines, policyholder service levels, and regulatory reporting obligations. The structured maintenance window (Sundays, 2:00–6:00 AM ET) ensures that scheduled maintenance occurs during the period of lowest operational activity, minimizing disruption to Quorum's claims-processing operations. The service-credit methodology provides a meaningful financial remedy for SLA shortfalls and creates appropriate economic incentives for Clearpoint to maintain platform availability.
F. Chronic Failure Termination Right (Exhibit B — Service Level Agreement)
Clearpoint's Form Position. The form agreement did not include any termination right linked to sustained or chronic SLA shortfalls. Under the form agreement, service credits constituted the sole and exclusive remedy for any failure by Clearpoint to meet the platform availability SLA, regardless of the severity, duration, or frequency of such failure. Accordingly, even in a scenario where the Platform experienced catastrophic and persistent availability failures over an extended period, Quorum's only remedy would have been to accumulate service credits (capped at 15% of the monthly fee per month), with no right to terminate the Agreement or seek a refund of prepaid fees.
Negotiated Change. The Execution Version adds a new Section 4.3 to Exhibit B (Service Level Agreement) establishing a chronic-failure termination right. Specifically, if actual monthly uptime falls below 99.0% in any three (3) consecutive calendar months, Quorum shall have the right, upon written notice to Clearpoint delivered within thirty (30) days following the end of the third consecutive month of SLA failure, to terminate the Agreement for cause. Upon such termination, Clearpoint shall provide Quorum with a pro-rata refund of all prepaid and unearned subscription fees, calculated from the effective date of termination through the end of the then-current subscription term.
Significance. The chronic-failure termination right provides Quorum with a meaningful and proportionate exit right in the event that the ClaimsIQ™ Platform experiences systemic and sustained reliability issues. Without this provision, Quorum would be contractually bound to a five-year agreement with a platform that might be persistently underperforming, with no remedy beyond modest service credits. The 99.0% threshold for the chronic-failure trigger is set deliberately below the 99.7% SLA target to ensure that the termination right is reserved for genuinely chronic and severe availability failures — not isolated or minor shortfalls. Three consecutive months of sub-99.0% uptime (i.e., more than approximately 438 minutes or 7.3 hours of unscheduled downtime per month for three straight months) would represent a fundamental failure to deliver the Platform as warranted and would be wholly unacceptable for a mission-critical enterprise application. The pro-rata refund provision protects Quorum's financial exposure in the event of termination, ensuring that Quorum does not bear the cost of subscription fees for a period during which it is no longer receiving the contracted services.
G. Data Portability Timeline (Section 7.5 of Agreement; Exhibit C — Data Processing Addendum)
Clearpoint's Form Position. Section 7.5 of the form agreement provided that, upon expiration or termination of the Agreement, Clearpoint would provide Customer Data to Quorum in an export within 120 days following the effective date of expiration or termination. The format of the data export was to be "mutually agreed by the parties," with no specification of particular file formats, data structures, or standards. The form agreement did not impose any obligation on Clearpoint to certify destruction of Customer Data following completion of the export, nor did it specify a deadline by which Clearpoint was required to delete or destroy retained copies of Customer Data.
Negotiated Change. The Execution Version substantially revises the data portability framework as follows:
(i) Export Timeline: Clearpoint must provide a complete export of all Customer Data to Quorum within sixty (60) days of the effective date of expiration or termination of the Agreement (reduced from 120 days in the form agreement).
(ii) Export Formats: The data export must be provided in industry-standard formats, specifically ACORD XML and CSV, at Quorum's election. ACORD XML is the prevailing data-interchange standard in the property and casualty insurance industry, and CSV provides a universally accessible flat-file format for data portability.
(iii) Cost: The data export shall be provided at no additional charge to Quorum, and Clearpoint may not impose any fees, surcharges, or conditions on the data-export process.
(iv) Destruction Certification: Within thirty (30) days following completion of the data export, Clearpoint must certify in writing (executed by an officer of Clearpoint) that all Customer Data, including all copies, backups, archives, and derivatives, has been permanently and irreversibly destroyed in accordance with NIST SP 800-88 guidelines for media sanitization, and that no Customer Data is retained by Clearpoint or any subprocessor in any form.
Corresponding revisions have been incorporated into Section 8 of Exhibit C (Data Processing Addendum) to ensure consistency with the body of the Agreement.
Significance. The revised data portability framework reduces the total wind-down data-handling period from an indeterminate timeline under the form agreement (120 days for export, with no deadline for destruction) to a maximum of 90 days (60 days for export plus 30 days for certified destruction). This compressed timeline is critical for several reasons. First, in the event of termination, Quorum will need to migrate its claims data to an alternative platform or in-house system as quickly as possible to minimize operational disruption. A 120-day export timeline would create an unacceptable gap in Quorum's data-processing capabilities. Second, specifying ACORD XML and CSV as the required export formats ensures compatibility with Quorum's existing core systems and eliminates the risk that Clearpoint could deliver data in a proprietary or non-standard format that would require costly conversion. Third, the destruction certification with officer attestation provides documentary evidence of data destruction that Quorum can present to regulators in the event of an audit or examination, supporting Quorum's compliance with its obligations under the CTDPA, HIPAA, and the NAIC Insurance Data Security Model Law.
H. Subprocessor Objection Right (Exhibit C — Data Processing Addendum, Section 4)
Clearpoint's Form Position. Section 4 of the form DPA (Exhibit C) required Clearpoint to maintain a current list of subprocessors engaged in the processing of Customer Data and to provide Quorum with written notice of any proposed new subprocessor. Quorum was granted a window of fifteen (15) calendar days following receipt of such notice to object in writing to the proposed subprocessor. If Quorum objected, the parties were required to "discuss the objection in good faith," but the form agreement did not specify any consequence if the objection could not be resolved, nor did it grant Quorum any right to terminate or restrict processing in response to an unresolved subprocessor objection.
Negotiated Change. The Execution Version substantially strengthens Quorum's subprocessor management rights as follows:
(i) Objection Period: The subprocessor objection period has been expanded from fifteen (15) calendar days to thirty (30) calendar days following Clearpoint's written notice of a proposed new subprocessor.
(ii) Notice Content: Clearpoint's written notice of a proposed new subprocessor must include: the subprocessor's name, principal place of business, and jurisdiction of incorporation; a description of the processing activities to be performed by the subprocessor; the categories of Customer Data to be processed; the subprocessor's relevant security certifications (e.g., SOC 2 Type II, ISO 27001); and the subprocessor's data-processing agreement with Clearpoint (or a summary thereof).
(iii) Current Approved Subprocessors: The Execution Version confirms the following as Clearpoint's currently approved subprocessors:
(a) Cobalt Cloud Infrastructure, Inc. — hosting and infrastructure-as-a-service (IaaS); principal place of business: San Jose, California; and
(b) Redline Document AI, LLC — optical character recognition (OCR) processing of claims documents; principal place of business: Austin, Texas.
(iv) Objection Rights: Quorum retains the right to object to any proposed new subprocessor on data-security or regulatory-compliance grounds, with such objection to be delivered in writing and to include a reasonably detailed explanation of the basis for the objection.
(v) Resolution and Termination Right: If a subprocessor objection cannot be resolved through good-faith discussions within thirty (30) days following Quorum's objection notice, Quorum may terminate the affected processing activities (i.e., the processing activities that would have been performed by the objected-to subprocessor) without penalty, and Clearpoint shall continue to perform such processing activities directly or through an alternative subprocessor acceptable to Quorum.
Significance. The expanded subprocessor objection right provides Quorum with adequate time and information to conduct meaningful internal security and compliance review of proposed subprocessors before they are permitted to process Quorum's Customer Data. The fifteen-day objection period in the form agreement was insufficient for a regulated insurance enterprise to complete the necessary due diligence, which typically involves review by Quorum's information-security team, privacy office, and regulatory-compliance function. Doubling the objection period to thirty days reflects standard enterprise practice for regulated financial institutions and is consistent with the subprocessor management frameworks Quorum has negotiated in comparable technology agreements. The termination right for unresolved objections — which was entirely absent from the form agreement — provides Quorum with meaningful leverage and a credible enforcement mechanism, ensuring that the objection right is not merely an empty procedural formality.
I. Change-of-Control Assignment Restriction (Section 14.3 of Agreement)
Clearpoint's Form Position. The form agreement contained a standard anti-assignment clause in Section 14.2 providing that neither party may assign the Agreement without the other party's prior written consent. However, the form agreement included a carve-out permitting either party to assign the Agreement without the other party's consent "in connection with a merger, acquisition, reorganization, or sale of all or substantially all of such party's assets." The form agreement was entirely silent on change-of-control provisions and did not separately address scenarios in which Clearpoint's ownership or control might change through an equity transaction (as opposed to a direct assignment of the Agreement itself).
Negotiated Change. The Execution Version adds a new Section 14.3 establishing a specific assignment restriction applicable to change-of-control scenarios. The key elements of this provision are as follows:
(i) Consent Requirement: Clearpoint may not assign, transfer, delegate, or otherwise convey the Agreement (by operation of law or otherwise) in connection with a Change of Control (as defined below) without Quorum's prior written consent, which consent shall not be unreasonably withheld, conditioned, or delayed.
(ii) Definition of Change of Control: "Change of Control" is defined to include any of the following events:
(a) The acquisition, directly or indirectly, by any person or group (as such terms are used in Sections 13(d) and 14(d) of the Securities Exchange Act of 1934, as amended), other than Ridgeway Capital Partners, LP (which currently holds approximately 62% of Clearpoint's outstanding voting equity), of more than 50% of the combined voting power of Clearpoint's then-outstanding voting securities;
(b) A merger, consolidation, statutory share exchange, or similar business-combination transaction involving Clearpoint, in which Clearpoint's pre-transaction equity holders hold less than 50% of the combined voting power of the surviving or resulting entity immediately following such transaction; or
(c) The sale, transfer, or disposition of all or substantially all of Clearpoint's assets, whether in a single transaction or a series of related transactions.
(iii) Carve-Out for Existing Holdings: The definition of Change of Control expressly excludes transactions involving Ridgeway Capital Partners, LP's existing equity position in Clearpoint, including any transfer of Ridgeway's interest to Ridgeway's limited partners, affiliates, or successor funds, provided that such transfer does not result in a single third party (other than Ridgeway or its affiliates) acquiring majority voting control of Clearpoint.
Significance. The change-of-control provision is of particular importance in this transaction given Clearpoint's ownership structure. Clearpoint is a privately held company, with Ridgeway Capital Partners, LP (managing partner Fiona Galbraith) currently holding an approximately 62% equity stake. Private-equity-backed SaaS companies are frequently subject to secondary sales, platform acquisitions, or strategic transactions in which the company's ownership and control changes hands — often multiple times during the life of a multi-year enterprise contract. Without a change-of-control consent right, Quorum could find itself in a contractual relationship with a successor entity that is a competitor to Quorum, that lacks adequate financial or technical resources to maintain the ClaimsIQ™ Platform at required service levels, that is domiciled in or subject to the jurisdiction of a country with data-privacy laws inconsistent with Quorum's regulatory obligations, or that is otherwise a party with whom Quorum would not have chosen to enter into a long-term technology relationship. The carve-out for Ridgeway Capital Partners, LP's existing holdings acknowledges the current ownership structure and avoids inadvertently restricting routine fund-administration or portfolio-management activities by Ridgeway or its affiliates.
J. Governing Law and Dispute Resolution (Section 15 of Agreement)
Clearpoint's Form Position. Section 15 of the form agreement specified the State of Illinois as the governing law jurisdiction (Clearpoint's headquarters state, with offices in Chicago, Illinois). The form agreement further provided for exclusive jurisdiction and venue in the state and federal courts located in Cook County, Illinois, for the resolution of any disputes arising under or in connection with the Agreement.
Negotiated Change. The Execution Version modifies the governing law and dispute resolution provisions as follows:
Governing Law. The Agreement is governed by and construed in accordance with the laws of the State of Connecticut, without regard to its conflicts-of-law principles that would result in the application of the laws of any other jurisdiction. Connecticut is the state of domicile of Quorum's corporate headquarters (Hartford, Connecticut) and the state of domicile and principal regulatory jurisdiction of Quorum's principal insurance subsidiary, Quorum Property & Casualty Insurance Company. Connecticut's insurance regulatory framework, including the Connecticut Insurance Code (Title 38a of the Connecticut General Statutes), the CTDPA, and the Connecticut adoption of the NAIC Insurance Data Security Model Law, is the regulatory framework most directly applicable to the subject matter of the Agreement.
Dispute Resolution. The Execution Version replaces the form agreement's litigation-based dispute resolution mechanism with a two-step alternative dispute resolution framework:
Step 1 — Mandatory Mediation. Any dispute arising under or in connection with the Agreement shall first be submitted to mandatory mediation, administered by Pinnacle Dispute Resolution Services (Hartford, Connecticut), in accordance with Pinnacle's then-current mediation rules and procedures. The mediation shall be conducted by a single mediator with experience in technology transactions and insurance industry matters, selected by mutual agreement of the parties (or, failing agreement within ten (10) business days, appointed by Pinnacle). The mediation shall take place in Hartford, Connecticut, and each party shall be represented by at least one individual with authority to negotiate and settle the dispute on such party's behalf. The costs of the mediation (including the mediator's fees) shall be shared equally by the parties.
Step 2 — Binding Arbitration. If the dispute is not resolved through mediation within sixty (60) days of the commencement of mediation (or such longer period as the parties may agree in writing), either party may submit the dispute to binding arbitration under the Commercial Arbitration Rules of the American Arbitration Association ("AAA"). The arbitration shall be conducted by a panel of three (3) arbitrators, with each party selecting one arbitrator and the two party-appointed arbitrators selecting the third (who shall serve as chair). The seat of arbitration shall be Hartford, Connecticut. The arbitrators shall have the authority to award any remedy or relief that a court of competent jurisdiction could award, including injunctive relief, specific performance, and monetary damages. The arbitrators' award shall be final and binding on the parties and may be entered as a judgment in any court of competent jurisdiction. Each party shall bear its own attorneys' fees and costs, unless the arbitrators determine that a party's claims or defenses were frivolous or brought in bad faith, in which case the arbitrators may award reasonable attorneys' fees and costs to the prevailing party.
Injunctive Relief Carve-Out. Notwithstanding the foregoing mediation and arbitration provisions, either party shall have the right to seek temporary, preliminary, or permanent injunctive relief (or other equitable relief) in the state or federal courts of competent jurisdiction located in Hartford, Connecticut, without first submitting the matter to mediation or arbitration, in circumstances where such relief is necessary to prevent irreparable harm, including (without limitation) to prevent unauthorized access to, disclosure of, or destruction of Customer Data, or to enforce the confidentiality, data-security, or intellectual property provisions of the Agreement.
Significance. The change of governing law from Illinois to Connecticut aligns the Agreement with Quorum's principal regulatory jurisdiction, ensuring that any disputes under the Agreement are resolved under the substantive law of the state whose insurance regulatory framework is most directly applicable to the relationship. This is particularly important for provisions relating to data privacy, data security, and insurance regulatory compliance, where Connecticut-specific requirements (including the CTDPA and the Connecticut adoption of the NAIC Model Law) may differ from Illinois law. The mediation-then-arbitration framework provides a confidential, efficient, and structured dispute resolution process that is well-suited to a commercial SaaS relationship involving proprietary and confidential claims data — avoiding the delay, expense, and public disclosure risks associated with traditional litigation. The injunctive-relief carve-out is a critical protection that preserves Quorum's ability to seek emergency judicial relief on an expedited basis in scenarios involving threatened or actual data breaches, unauthorized data disclosure, or other circumstances requiring immediate court intervention.
III. Additional Negotiated Refinements
In addition to the ten categories of material changes described in Section II above, the negotiation process resulted in a number of additional refinements to the Agreement and its exhibits. While these refinements are, in our assessment, not individually material to the overall risk-allocation framework of the Agreement, they are nevertheless noteworthy and are summarized below for completeness.
Renewal Provisions. The Agreement provides for an initial subscription term of five (5) years commencing on the Effective Date. Following expiration of the initial term, the Agreement automatically renews for successive one-year renewal terms unless either party provides written notice of non-renewal at least one hundred eighty (180) days prior to the expiration of the then-current term. The 180-day non-renewal notice period (extended from 90 days in the form agreement) provides adequate lead time for Quorum to evaluate alternative platforms and plan a potential migration in the event of non-renewal.
Payment Terms. Subscription fees are payable in advance on an annual basis, with each annual payment due within thirty (30) days of each subscription anniversary date. The Year 1 subscription payment of $1,400,000 is due upon execution of the Agreement. Subscription fees for Years 2 through 5 are subject to a CPI-based annual escalator, calculated based on the percentage change in the Consumer Price Index for All Urban Consumers (CPI-U), U.S. City Average, as published by the U.S. Bureau of Labor Statistics, for the twelve-month period ending on the last day of the month that is three months prior to the applicable subscription anniversary date. The CPI escalator is capped at 3.5% per annum, ensuring predictability of costs over the five-year term. Based on the 3.5% maximum escalation rate, the maximum annual subscription fees for each year of the initial term would be as follows:
User Overage Rates. The Agreement provides for up to 1,200 named users. For each additional named user seat above the 1,200 named-user allocation, Quorum will be charged an overage rate of $150 per user per month, billed quarterly in arrears. This rate was confirmed during negotiation and is consistent with the per-user economics of the base subscription.
Insurance Requirements. Section 13.4 of the Execution Version sets forth refined minimum insurance coverage requirements for Clearpoint, as follows:
•  Commercial General Liability: $5,000,000 per occurrence / $10,000,000 aggregate;
•  Technology Errors & Omissions / Cyber Liability: $10,000,000 per claim / $20,000,000 aggregate;
•  Workers' Compensation: Statutory limits as required by applicable law;
•  All policies to be carried with Northern Ridge Mutual Insurance Company (or another carrier with an A.M. Best rating of A- (Excellent) VII or better), with Quorum named as an additional insured on CGL and Tech E&O/Cyber policies.
These coverage levels were increased from the form agreement minimums of $2 million CGL and $5 million Tech E&O/Cyber to levels appropriate for an enterprise SaaS provider processing sensitive insurance data.
SOC 2 Type II Audit Report Delivery. Clearpoint is required to deliver its SOC 2 Type II audit report to Quorum annually, within ninety (90) days of the close of the applicable audit period. Clearpoint's current SOC 2 Type II report, issued by Hawthorne & Ellers, CPAs LLP, covers the audit period of April 1, 2023 through March 31, 2024, and was reviewed by C&H and Quorum's information-security team during the negotiation process. Clearpoint is required to promptly notify Quorum of any material exceptions, qualifications, or adverse findings in any future SOC 2 Type II report.
Penetration Testing. Clearpoint is required to conduct annual penetration testing of the ClaimsIQ™ Platform by an independent, qualified third-party security firm. Clearpoint's current penetration-testing provider is Sentinel Cyber Solutions LLC. An executive summary of the penetration-test results must be shared with Quorum within thirty (30) days of completion of each annual test. In the event that critical or high-severity vulnerabilities are identified, Clearpoint is required to remediate such vulnerabilities within thirty (30) days of identification and to provide Quorum with written confirmation of remediation.
Source Code Escrow. The parties have agreed to establish a technology escrow arrangement pursuant to a separate Technology Escrow Agreement with Granite Trust Company, N.A. as escrow agent. The deposited materials include the ClaimsIQ™ Platform source code, build scripts, compilation instructions, technical documentation, database schemas, and all other materials necessary to compile, deploy, and operate the Platform. Clearpoint is required to update the escrowed materials on a quarterly basis. The release conditions under the escrow agreement include: (i) Clearpoint's bankruptcy, insolvency, or assignment for the benefit of creditors; (ii) Clearpoint's cessation of business operations or discontinuation of the ClaimsIQ™ Platform; or (iii) Clearpoint's material breach of the Agreement that remains uncured for a period of sixty (60) days following written notice of such breach from Quorum. The annual escrow-agent fee of $4,500 is to be shared equally between the parties ($2,250 per party).
IV. Dravello Data Compliance Advisors Assessment
We note that the data-privacy impact assessment completed on April 8, 2024 by Dravello Data Compliance Advisors LLC (principal consultant Miriam Tanaka) informed several of the negotiated changes described in this memorandum. Specifically, the Fenwick DCA assessment addressed the privacy and data-security implications of Clearpoint's processing of Quorum's Customer Data through the ClaimsIQ™ Platform, with particular focus on:
•  compliance with the Connecticut Data Privacy Act (CTDPA), effective July 1, 2023;
•  HIPAA requirements applicable to Quorum's workers' compensation lines of business;
•  the NAIC Insurance Data Security Model Law as adopted in Connecticut;
•  the adequacy of the data-processing provisions in the DPA (Exhibit C);
•  the security requirements set forth in Exhibit D (Security Requirements); and
•  the risks associated with Clearpoint's proposed Aggregated Data rights under the form agreement.
The Fenwick DCA assessment's findings and recommendations were instrumental in shaping several of the negotiated changes described in this memorandum, including the strengthened Customer Data ownership language (Section II.A), the Aggregated Data use restrictions (Section II.B), the data portability timeline and destruction certification requirements (Section II.G), and the subprocessor objection framework (Section II.H).
The Fenwick DCA assessment and its findings are discussed in detail in a separate cover memorandum from Nathan Ikeda to Patricia Okonkwo and Derek Langston dated April 10, 2024 (Matter No. 1025-00009-DPA), which has been provided under separate cover and should be reviewed in conjunction with this memorandum.
V. Recommendation and Next Steps
Based on our review of the Execution Version and the negotiation outcomes summarized in this memorandum, we recommend approval of the Execution Version for signing by Patricia Okonkwo, General Counsel, on behalf of Quorum Insurance Holdings Corp. The Execution Version reflects a commercially balanced agreement that appropriately protects Quorum's interests as a regulated insurance enterprise, and all material revisions proposed by C&H on behalf of Quorum have been accepted by Clearpoint.
Execution. The Execution Version is to be signed by:
•  Quorum Insurance Holdings Corp.: Patricia Okonkwo, General Counsel
•  Clearpoint Analytics, Inc.: Anita Rajan, Chief Executive Officer
The target signing date is April 26, 2024. The Execution Version will be circulated in counterpart signature pages, with each party retaining an original fully executed copy. C&H will coordinate the signature process with Whitfield Greer & Associates LLP.
Post-Execution Items. The following items require attention promptly following execution of the Agreement:
1.  Year 1 Subscription Payment. The Year 1 subscription payment of $1,400,000 is due upon execution. Quorum's finance team should be prepared to remit payment within thirty (30) days of the Effective Date, in accordance with the payment instructions set forth in Schedule 1 to the Agreement.
2.  Technology Escrow Agreement. The Technology Escrow Agreement with Granite Trust Company, N.A. must be finalized and executed as a post-closing deliverable. C&H is currently reviewing the form escrow agreement provided by Granite Trust and anticipates circulating a final version within two weeks of the Agreement's Effective Date. Clearpoint's initial deposit of escrowed materials is required within thirty (30) days of execution of the escrow agreement.
3.  Implementation Planning. Following execution, Quorum and Clearpoint should schedule a formal implementation kickoff meeting to establish the project timeline, identify key stakeholders, and confirm the technical requirements for Platform deployment across Quorum's three operational locations.
C&H Engagement Team. The Calderwood & Harkness LLP engagement team for this matter is available for any questions, clarifications, or further guidance regarding the Execution Version, the negotiation process, or any of the matters discussed in this memorandum:
•  Renata Vasquez — Responsible Partner
•  Bernard Crawford — Billing Partner
•  Nathan Ikeda — Lead Associate
•  Gabrielle Moss — Working Associate
Please do not hesitate to contact Nathan Ikeda (nikeda@calderwoodharkness.com; 860-555-4712) or Gabrielle Moss (gmoss@calderwoodharkness.com; 860-555-4738) with any questions.
VI. Appendix — Comparison Table of Key Terms
The following table provides a side-by-side comparison of the ten categories of material changes negotiated from the form agreement to the Execution Version. This table is intended as a summary reference and should be read in conjunction with the detailed discussion in Section II above.
This memorandum has been prepared solely for the use of the addressees identified above and is subject to the attorney-client privilege and work-product doctrine. This memorandum does not constitute legal advice to any party other than Quorum Insurance Holdings Corp. and should not be relied upon by any other party for any purpose.
Subscription Year | Maximum Annual Fee
Year 1 | $1,400,000
Year 2 | $1,449,000
Year 3 | $1,499,715
Year 4 | $1,552,205
Year 5 | $1,607,523 (approx.)
Provision | Clearpoint Form Position | Final Execution Version
A. Customer Data Ownership (§ 7.1; Ex. C) | Quorum retains "ownership" of Customer Data; no exclusivity qualifier; narrow definition limited to uploaded data; ambiguity re: residual Clearpoint rights. | Quorum retains "sole and exclusive" ownership of all Customer Data; definition expanded to include claims data, PII, PHI, adjuster notes, all outputs/reports, and derivatives. Clearpoint license narrowed to non-exclusive, non-transferable, non-sublicensable, solely to provide Services.
B. Aggregated Data Use (§ 7.3; Ex. C) | Broad, unilateral right to create and use Aggregated Data for any internal business purpose, including benchmarking and marketing; no consent required; no prohibition on third-party sale or re-identification. | Right limited to product-improvement purposes only; subject to (i) compliance with applicable insurance data-privacy laws, (ii) Quorum's prior written consent (not to be unreasonably withheld), and (iii) express prohibition on re-identification and third-party sale. De-identification must comply with NIST SP 800-188 / HIPAA Safe Harbor.
C. Indemnification Structure & Caps (§ 10) | Mutual indemnification with single aggregate cap of 1× ACV ($1.4M) for all obligations; no data-breach carve-out; general indemnification categories. | Clear mutual obligations defined. IP/general indemnification cap increased to 2× TCV ($14M). Data-breach indemnification uncapped. Procedures: 15 business days' notice; indemnifying party controls defense; no settlement without consent.
D. General Liability Cap (§ 11.2) | Single aggregate cap of 1× ACV ($1.4M) for all claims; no carve-outs. | General cap increased to 1× TCV ($7M). Carve-outs: data breach (uncapped), willful misconduct (uncapped), IP infringement ($14M).
E. SLA Uptime Threshold (Ex. B) | 99.5% monthly uptime; no specified maintenance window; service credits as sole remedy. | 99.7% monthly uptime; scheduled maintenance limited to 4 hrs/month, Sundays 2:00–6:00 AM ET. Service credits: 2% of monthly fee per 0.1% shortfall (~$2,333); max 15% of monthly fee ($17,500).
F. Chronic Failure Termination (Ex. B) | No chronic-failure termination right; service credits sole remedy. | If uptime < 99.0% for 3 consecutive months, Quorum may terminate for cause with pro-rata refund of prepaid fees.
G. Data Portability (§ 7.5; Ex. C) | Export within 120 days; format "mutually agreed"; no destruction certification obligation. | Export within 60 days in ACORD XML and CSV at no charge; certified destruction within 30 days of export completion (total: 90 days max). Officer attestation required; NIST SP 800-88 standards.
H. Subprocessor Objection (Ex. C, § 4) | 15-day objection window; notification only; no consequence for unresolved objection. | 30-day objection window; detailed notice requirements; approved subprocessors confirmed (Cobalt Cloud; Redline Document AI). If objection unresolved within 30 days, Quorum may terminate affected processing without penalty.
I. Change of Control (§ 14.3) | Silent on change of control; standard anti-assignment clause with merger/acquisition carve-out permitting assignment without consent. | Assignment in c

PRIVILEGED & CONFIDENTIAL — ATTORNEY-CLIENT COMMUNICATION

MEMORANDUM

Record

Parties

Dates

Amounts