1025-00009 · Calderwood & Harkness LLP · Memos & Analysis

negotiation-issues-memo.docx DOCUMENT M&A / Corporate

6 / 12 ← → ✕

PRIVILEGED AND CONFIDENTIAL — ATTORNEY-CLIENT COMMUNICATION ATTORNEY WORK PRODUCT

MEMORANDUM

TO: Renata Vasquez, Partner, Calderwood & Harkness LLP Patricia Okonkwo, General Counsel, Quorum Insurance Holdings Corp.

FROM: Nathan Ikeda, Lead Associate, and Gabrielle Moss, Associate, Calderwood & Harkness LLP

DATE: March 18, 2024

RE: Negotiation Issues Memorandum — Key Terms and Risk Analysis: Clearpoint Analytics, Inc. Form SaaS Subscription Agreement for ClaimsIQ™ Platform

Matter No.: 1025-00009

Right-click to update Table of Contents

I. Executive Summary

Calderwood & Harkness LLP received Clearpoint Analytics, Inc.'s ("Clearpoint") initial form Enterprise SaaS Subscription Agreement (the "Agreement" or "Form Agreement") on March 11, 2024. The Agreement governs Quorum Insurance Holdings Corp.'s ("Quorum") proposed enterprise-wide deployment of Clearpoint's ClaimsIQ™ platform, an AI-driven claims triage, fraud detection, and analytics solution. The proposed arrangement contemplates a five-year initial subscription term with a total contract value ("TCV") of $7,000,000, representing an annual contract value ("ACV") of $1,400,000, subject to CPI-based escalation as described more fully below.

This memorandum identifies and prioritizes nine key negotiation issues where Clearpoint's form departs materially from Quorum's risk tolerance, prevailing market norms for enterprise SaaS agreements, or applicable regulatory requirements. In addition to these primary issues, we address several additional negotiation points that, while of somewhat lesser urgency, remain important to the overall commercial and legal posture of the transaction.

Each issue is ranked according to the following priority framework:

• Critical — Must be resolved prior to execution. These issues represent non-negotiable positions where failure to obtain adequate protections would expose Quorum to unacceptable legal, regulatory, or operational risk.

• High — Strongly recommended changes. These issues represent significant departures from market norms or Quorum's standard vendor management requirements, and failure to address them would leave material gaps in the contractual framework.

• Moderate — Desirable improvements. These issues, while not dealbreakers in isolation, represent commercially suboptimal terms that should be improved through negotiation where possible.

Quorum's position as licensee, its status as a publicly traded insurance holding company listed on the Nasdaq Stock Market (ticker: QIHC) with concomitant regulatory and disclosure obligations, and the acute sensitivity of claims data — which will include policyholder personally identifiable information ("PII") and protected health information ("PHI") — collectively necessitate material revisions to Clearpoint's vendor-favorable form. The Form Agreement, as drafted, is inadequate to address the regulatory framework within which Quorum operates, including the Connecticut Data Privacy Act ("CTDPA"), the Health Insurance Portability and Accountability Act ("HIPAA"), and the National Association of Insurance Commissioners Insurance Data Security Model Law (the "NAIC Model Law") as adopted in Connecticut.

In summary, this memorandum addresses the following issues:

1. Customer Data Ownership and Portability (Critical)

2. Restrictions on Clearpoint's Use of Aggregated Data (Critical)

3. Indemnification Structure and Caps (Critical)

4. General Liability Cap (High)

5. Service Level Commitments and Chronic Failure Termination (High)

6. Source Code Escrow and Vendor Insolvency Protections (High)

7. Change-of-Control and Assignment Provisions (High)

8. Subprocessor Consent Rights (Moderate)

9. Regulatory Compliance Carve-Outs (CTDPA, HIPAA, NAIC) (Critical)

We recommend that this memorandum be circulated promptly to Patricia Okonkwo, Derek Langston (CIO), and Malcolm Tsai (VP of Procurement) for review. Calderwood & Harkness intends to deliver a comprehensive first redline of the Agreement to Clearpoint's outside counsel, Whitfield Greer & Associates LLP, by March 22, 2024, incorporating the negotiation positions described herein, subject to Quorum's input on priorities.

II. Background

A. The Parties

Quorum Insurance Holdings Corp. ("Quorum" or the "Company") is a Delaware corporation, publicly traded on the Nasdaq Stock Market under the ticker symbol QIHC. Quorum is headquartered at 280 Constitution Plaza, Suite 1400, Hartford, Connecticut 06103. The Company operates through three principal subsidiaries: (i) Quorum Property & Casualty Insurance Company, a Connecticut-domiciled property and casualty insurer; (ii) Quorum Specialty Underwriters, Inc., a Delaware corporation engaged in specialty lines underwriting; and (iii) Quorum Digital Solutions LLC, a Delaware limited liability company providing internal technology and digital transformation services to the Quorum family of companies. For the fiscal year ended December 31, 2023, Quorum reported gross written premiums of approximately $4.2 billion. The Company employs approximately 3,800 individuals across its operations, with claims-processing operations concentrated in Hartford, Connecticut; Dallas, Texas; and Jacksonville, Florida.

The internal business sponsor for the ClaimsIQ™ deployment is Derek Langston, Quorum's Chief Information Officer, who has identified the platform as a key component of Quorum's enterprise-wide claims modernization initiative. Commercial negotiations with Clearpoint are being led by Malcolm Tsai, Vice President of Procurement. Patricia Okonkwo serves as General Counsel and has engaged Calderwood & Harkness to handle the legal negotiation and documentation.

Clearpoint Analytics, Inc. ("Clearpoint") is a Delaware corporation headquartered at 200 South Wacker Drive, Suite 3100, Chicago, Illinois 60606. Founded in 2017, Clearpoint provides the ClaimsIQ™ platform — a cloud-hosted, artificial intelligence-driven SaaS solution offering claims triage, fraud detection, and advanced analytics capabilities designed for the property and casualty insurance industry. As of the fourth quarter of 2023, Clearpoint reported approximately $78 million in annual recurring revenue ("ARR") and employs approximately 320 individuals.

Clearpoint is privately held. Following a $95 million Series C financing round that closed in October 2022, the company's majority ownership — approximately 62% of outstanding equity — is held by Ridgeway Capital Partners, LP, a growth-equity fund based in Boston, Massachusetts, managed by Managing Partner Fiona Galbraith. The remaining equity is held by Clearpoint's founders, management team, and earlier-stage investors. Given Ridgeway's majority position and the typical investment horizon for growth-equity funds, the possibility of a liquidity event — whether by way of a strategic sale, initial public offering, or secondary transaction — during the five-year term of the proposed Agreement is a meaningful consideration that informs several of our negotiation positions, particularly with respect to change-of-control provisions.

Clearpoint's leadership team includes Anita Rajan, CEO and co-founder; Theodore Marsh, Chief Revenue Officer, who is leading commercial negotiations on Clearpoint's behalf; and Samuel Otieno, Vice President of Product & Engineering, who has participated in technical discussions with Quorum's IT team. Clearpoint is represented by outside counsel Whitfield Greer & Associates LLP, located at 71 South Dearborn Street, Suite 4400, Chicago, Illinois 60603. The lead attorney is Damian Cho, Partner, supported by Leona Burris, Associate.

B. Transaction Overview

The proposed transaction is an Enterprise SaaS Subscription Agreement pursuant to which Quorum would deploy Clearpoint's ClaimsIQ™ platform on an enterprise-wide basis across all three of Quorum's claims-processing locations (Hartford, CT; Dallas, TX; and Jacksonville, FL), with additional remote access capabilities for field adjusters operating outside of those facilities.

The key commercial terms of the proposed Agreement are as follows:

• Total Contract Value (TCV): $7,000,000 over the five-year initial term.

• Annual Contract Value (ACV): $1,400,000 in Year 1.

• Payment Structure: Annual payments due in advance within thirty (30) days of each subscription anniversary date. The Year 1 payment of $1,400,000 is due upon execution of the Agreement. Annual contract values for Years 2 through 5 are subject to a Consumer Price Index-based escalator, capped at 3.5% per annum. Under this structure, the Year 2 maximum ACV would be $1,449,000, and the Year 5 maximum ACV would be approximately $1,607,523, assuming the full 3.5% escalation is applied in each year.

• Licensed Users: Up to 1,200 named users across Quorum and its subsidiaries. Any usage in excess of 1,200 named users incurs an overage rate of $150 per user per month.

• Initial Term: Five (5) years.

• Renewal: Automatic one-year renewal terms unless either party provides one hundred eighty (180) days' written notice of non-renewal prior to the expiration of the then-current term.

The Form Agreement includes four draft exhibits: (A) Service Description, (B) Service Level Agreement, (C) Data Processing Addendum, and (D) Security Requirements. Each of these exhibits requires negotiation, and the positions described in this memorandum address provisions found in both the body of the Agreement and the draft exhibits.

C. Scope of Review

Calderwood & Harkness has reviewed Clearpoint's initial Form Agreement in its entirety, including all four draft exhibits. Our review has been informed by discussions with Quorum's business team, including Derek Langston and Malcolm Tsai, as well as preliminary technical review of publicly available information regarding the ClaimsIQ™ platform's architecture and data-handling practices.

Calderwood & Harkness intends to deliver a comprehensive first redline of the Agreement to Whitfield Greer & Associates LLP (Damian Cho / Leona Burris) by March 22, 2024. This memorandum is intended to inform Quorum's review and approval of the proposed negotiation positions prior to delivery of that redline.

Separately, Quorum has retained Dravello Data Compliance Advisors LLC (Miriam Tanaka, Principal Consultant) to conduct a data-mapping and privacy-impact assessment of the ClaimsIQ™ platform. That assessment is expected to be completed in early April 2024. The findings of that assessment will be incorporated into the negotiation of the Data Processing Addendum (Exhibit C) and may result in additional or refined requirements not yet reflected in this memorandum. We will coordinate closely with Ms. Tanaka throughout the negotiation process.

III. Issue-by-Issue Analysis

Issue 1: Customer Data Ownership and Portability

Priority: CRITICAL

A. Current Form Position. Section 5.1 of Clearpoint's Form Agreement addresses data rights and contains language that, while superficially appearing to vest ownership of Customer Data in Quorum, functionally erodes that ownership through the breadth of the license grant. Specifically:

• The Form Agreement provides that "as between the parties, Customer retains ownership of Customer Data." However, this qualified language — "as between the parties" — is ambiguous and potentially insufficient to establish Quorum's ownership rights in the face of competing claims or in a regulatory context.

• The Form Agreement simultaneously grants Clearpoint a "broad, irrevocable, worldwide, sublicensable license" to Customer Data for the purposes of "providing the services, improving Clearpoint's products and services, developing new products and services, benchmarking, and any other lawful purpose." The breadth of this license — particularly its irrevocable nature, sublicensability, and extension to product improvement and benchmarking — functionally undermines the ownership clause and creates a perpetual right that survives termination.

• The Form Agreement does not define "Customer Data" with adequate specificity. There is no explicit inclusion of claims data, policyholder PII, PHI, adjuster notes, reports, or outputs generated by ClaimsIQ™ from Customer Data inputs. The absence of a robust definition creates risk that Clearpoint could assert ownership over analytical outputs, reports, or derivative data products generated from Quorum's underlying data.

With respect to data portability, the Form Agreement's provisions are vague and commercially inadequate:

• Section 11.3 provides that, upon termination or expiration, Clearpoint will return Customer Data "in a commercially reasonable format" within ninety (90) days. No specific format is identified, and "commercially reasonable" is undefined. Clearpoint could satisfy this obligation by providing data in a proprietary or non-interoperable format that would render migration to a successor platform impractical.

• There is no cost commitment associated with the data return obligation. The Form Agreement does not address whether Clearpoint may charge for the data export process.

• There is no affirmative obligation to destroy Customer Data following return. There is no certification requirement. This means that, even after termination, Clearpoint could retain copies of Quorum's Customer Data indefinitely under the purported authority of the irrevocable license.

B. Recommended Negotiation Position. We recommend that Quorum take the following positions in the redline:

1. Ownership. The Agreement must be revised to state unambiguously that Quorum retains sole and exclusive ownership of all Customer Data. The defined term "Customer Data" should be expanded to expressly include: (a) all claims data, including but not limited to claims files, adjuster notes, coverage determinations, and loss reports; (b) all policyholder PII; (c) all PHI; (d) all data uploaded to, processed by, or stored within the ClaimsIQ™ platform by or on behalf of Quorum; and (e) all outputs, reports, analytics, visualizations, and other work product generated by the ClaimsIQ™ platform using or derived from the foregoing.

2. Limited License. Clearpoint's license to Customer Data should be revised to be: (a) limited to the sole purpose of providing the services under the Agreement during the subscription term; (b) non-exclusive and non-transferable; (c) revocable upon termination or expiration of the Agreement for any reason; and (d) not sublicensable except to approved subprocessors in accordance with the DPA. The license must not extend to product improvement, benchmarking, or any other secondary purpose (which is addressed separately in Issue 2 below).

3. Data Portability. The Form Agreement's data return provisions must be replaced with the following:

(a) Upon expiration or termination of the Agreement for any reason, Clearpoint shall, at no additional charge to Quorum, export and deliver to Quorum a complete copy of all Customer Data in industry-standard, machine-readable formats, specifically ACORD XML and CSV, within sixty (60) days of the effective date of expiration or termination.

(b) During the sixty (60)-day export period, Clearpoint shall continue to make the ClaimsIQ™ platform available to Quorum on a read-only basis to facilitate data verification and migration planning, at no additional charge.

(c) Clearpoint shall provide reasonable cooperation and technical assistance to Quorum and any successor vendor to facilitate the migration of Customer Data, including documentation of data structures, schemas, and APIs.

4. Destruction and Certification. Within thirty (30) days following completion of the data export, Clearpoint shall permanently destroy all copies of Customer Data in its possession or control (including copies held by subprocessors), using methods consistent with NIST SP 800-88 guidelines. Clearpoint shall deliver to Quorum a written certification of destruction, executed by an officer of Clearpoint at the level of Vice President or above, confirming that all Customer Data has been permanently destroyed and that no copies have been retained.

C. Risk Assessment. The data ownership and portability issue is designated as Critical for the following reasons:

Quorum processes highly sensitive claims data through its operations, including policyholder PII (names, Social Security numbers, dates of birth, financial information) and, in connection with its workers' compensation lines, PHI as defined under HIPAA. This data will be ingested into, processed by, and stored within the ClaimsIQ™ platform. Loss of data control — whether through an overbroad license grant, ambiguous ownership provisions, or inadequate portability mechanisms — creates substantial regulatory risk under the CTDPA, HIPAA, and the NAIC Insurance Data Security Model Law.

The data lock-in risk is particularly acute in the context of a five-year contract. If Quorum is unable to efficiently export its data in a standard format at the end of the term (or upon early termination), it could face significant switching costs, operational disruption, and potential regulatory exposure arising from an inability to respond to policyholder data requests or to comply with data retention and disposition requirements.

For a publicly traded company, the inability to extricate its data from a vendor relationship may also implicate disclosure obligations under SEC rules, particularly if the data lock-in is material to the Company's operations or financial condition.

Issue 2: Restrictions on Clearpoint's Use of Aggregated Data

Priority: CRITICAL

A. Current Form Position. Section 5.3 of the Form Agreement reserves to Clearpoint an unrestricted right to create and use "de-identified, aggregated" data derived from Customer Data for any lawful purpose. The specific language of the form provides that Clearpoint may use such data for "benchmarking, marketing, product development, training machine-learning models, and sale or license to third parties." This right is described as perpetual and irrevocable, surviving termination of the Agreement.

Critically, the Form Agreement:

• Does not require Quorum's consent before Clearpoint creates or uses Aggregated Data.

• Does not impose any prohibition on re-identification of Aggregated Data, whether by Clearpoint or by third parties to whom Aggregated Data is sold or licensed.

• Does not specify the de-identification standard or methodology to be applied.

• Does not restrict Clearpoint from using Aggregated Data in ways that could reveal Quorum's claims patterns, loss experience, or underwriting strategies to competitors.

B. Recommended Negotiation Position. We recommend the following position:

1. Limited Purpose. Clearpoint may create de-identified, aggregated statistical data ("Aggregated Data") from Customer Data solely for the purpose of improving the ClaimsIQ™ platform's functionality and performance (i.e., product improvement). No other use shall be permitted without Quorum's prior written consent.

2. Three Conditions. Any creation or use of Aggregated Data shall be subject to the following conditions:

(i) Regulatory Compliance. Clearpoint's creation and use of Aggregated Data must comply with all applicable insurance data-privacy laws, including without limitation the CTDPA, HIPAA (to the extent PHI is involved), and the NAIC Insurance Data Security Model Law.

(ii) Prior Written Consent. Before any use of Aggregated Data beyond internal product improvement — including any disclosure to third parties, publication, or use in marketing materials — Clearpoint must obtain Quorum's prior written consent, which shall not be unreasonably withheld, conditioned, or delayed. Quorum shall have the right to review and approve any proposed use of Aggregated Data on a case-by-case basis.

(iii) Prohibition on Re-Identification and Third-Party Sale. Clearpoint shall be absolutely prohibited from (a) re-identifying any Aggregated Data or attempting to link Aggregated Data back to any individual policyholder, claimant, or to Quorum; (b) selling, licensing, or otherwise transferring Aggregated Data to any third party; and (c) combining Aggregated Data derived from Quorum's Customer Data with data from other customers in a manner that would permit identification of Quorum's claims patterns, loss experience, or business strategies.

3. De-Identification Standard. Where Customer Data includes PHI, the de-identification process must comply with the HIPAA Safe Harbor method (removal of the eighteen specified identifiers under 45 C.F.R. § 164.514(b)(2)) or the Expert Determination method (45 C.F.R. § 164.514(b)(1)). For all other Customer Data, the de-identification methodology must render it impossible, using reasonably available technology, to re-identify any individual or to identify Quorum as the source of the data.

4. Survival. The restrictions on Aggregated Data use shall survive termination or expiration of the Agreement in perpetuity.

C. Risk Assessment. This issue is designated as Critical for several interrelated reasons:

First, competitive intelligence leakage is a significant concern. Clearpoint serves multiple commercial insurers, including, to our knowledge, at least two direct competitors of Quorum in the property and casualty market. Unrestricted aggregation rights could allow Clearpoint to derive insights from Quorum's claims data — including claims frequency, severity distributions, fraud patterns, and adjuster productivity — and transmit those insights (whether directly through data sales or indirectly through product features informed by aggregated data) to Quorum's competitors. Even if individual data points are de-identified, patterns derived from a large dataset may be sufficient to reveal competitively sensitive information.

Second, regulatory scrutiny of vendor use of policyholder data for secondary purposes is intensifying. The National Association of Insurance Commissioners has repeatedly emphasized, through both model legislation and market conduct examination guidance, that insurers bear responsibility for ensuring that their vendors do not use policyholder data in ways that are inconsistent with policyholders' reasonable expectations or that violate applicable privacy laws. Several state insurance departments have issued bulletins specifically addressing the use of policyholder data by InsurTech vendors for algorithmic training and benchmarking purposes.

Third, if Clearpoint sells or licenses Aggregated Data derived in part from PHI, and the de-identification is later found to be inadequate, Quorum could face HIPAA enforcement actions as the covered entity that permitted a business associate to misuse PHI.

Issue 3: Indemnification Structure and Caps

Priority: CRITICAL

A. Current Form Position. Section 8 of the Form Agreement contains indemnification provisions that are inadequate in both scope and quantum:

• Clearpoint provides unilateral indemnification solely for third-party intellectual property infringement claims arising from Quorum's use of the ClaimsIQ™ platform in accordance with the Agreement. This is the only indemnification obligation in the Form Agreement.

• The IP indemnification is subject to a cap equal to fees paid by Quorum in the twelve (12) months preceding the claim — i.e., approximately $1,400,000 (or less in Year 1, depending on the timing of the claim relative to the payment cycle).

• There is no data-breach indemnification obligation. The Form Agreement is silent on Clearpoint's indemnification responsibility in the event of a security incident, unauthorized disclosure, or data breach involving Customer Data.

• There is no mutual indemnification framework. Quorum provides no indemnification to Clearpoint, and Clearpoint provides no indemnification beyond the narrow IP infringement clause.

B. Recommended Negotiation Position. We recommend establishing a comprehensive, mutual indemnification framework as follows:

1. Clearpoint Indemnification Obligations. Clearpoint shall indemnify, defend, and hold harmless Quorum, its affiliates, and their respective officers, directors, employees, and agents (collectively, "Quorum Indemnitees") against any third-party claims, damages, losses, costs, and expenses (including reasonable attorneys' fees) arising from or related to:

(a) intellectual Property Infringement. Any claim that Quorum's authorized use of the ClaimsIQ™ platform in accordance with the Agreement infringes, misappropriates, or otherwise violates any third party's intellectual property rights, including patents, copyrights, trademarks, or trade secrets.

(b) Data Breach. Any claim arising from Clearpoint's breach of its data-security obligations under the Agreement or the DPA, or from the unauthorized access to, disclosure of, loss of, or destruction of Customer Data while in Clearpoint's possession or control (or in the possession or control of Clearpoint's subprocessors).

(c) Regulatory Violations. Any claim arising from Clearpoint's violation of applicable law in the performance of its obligations under the Agreement, including without limitation violations of the CTDPA, HIPAA, the NAIC Insurance Data Security Model Law, and other applicable insurance regulatory requirements.

2. Quorum Indemnification Obligations. Quorum shall indemnify, defend, and hold harmless Clearpoint, its affiliates, and their respective officers, directors, employees, and agents (collectively, "Clearpoint Indemnitees") against any third-party claims, damages, losses, costs, and expenses (including reasonable attorneys' fees) arising from or related to:

(a) Customer Data. Any claim that Customer Data provided by Quorum to Clearpoint in connection with the Agreement infringes, misappropriates, or otherwise violates any third party's intellectual property rights or privacy rights.

(b) Unauthorized Use. Any claim arising from Quorum's use of the ClaimsIQ™ platform in a manner that materially exceeds the scope of the license granted under the Agreement or that violates the Agreement's acceptable use provisions.

3. Indemnification Caps. The following cap structure shall apply:

(a) intellectual Property and General Indemnification: Subject to an aggregate cap of two times (2×) the TCV, or $14,000,000 ($7,000,000 × 2).

(b) Data-Breach Indemnification: Uncapped. This is a non-negotiable position. Given the volume and sensitivity of policyholder PII and PHI that will be processed through the ClaimsIQ™ platform, and given Quorum's regulatory exposure as a licensed insurer and publicly traded company, Quorum cannot accept any limitation on Clearpoint's indemnification obligation for data breaches. A single data breach involving Quorum's policyholder data could result in regulatory fines from multiple state insurance departments, OCR enforcement actions under HIPAA, state attorney general investigations, class action litigation, credit monitoring and notification costs, and severe reputational damage. The potential magnitude of these losses far exceeds any commercially reasonable cap, and the risk should rest with the party that controls the security of the platform — Clearpoint.

4. Indemnification Procedures. The Agreement shall include the following procedural requirements:

(a) Notice. The indemnified party shall provide written notice to the indemnifying party within fifteen (15) business days of becoming aware of any claim for which indemnification is sought. Failure to provide timely notice shall not relieve the indemnifying party of its obligations except to the extent the indemnifying party is materially prejudiced by such failure.

(b) Control of Defense. The indemnifying party shall have the right to assume and control the defense of any indemnified claim, using counsel reasonably acceptable to the indemnified party.

(c) Participation. The indemnified party may participate in the defense of any claim at its own expense, using counsel of its own choosing.

(d) Settlement. No settlement of any claim may be entered into by the indemnifying party without the indemnified party's prior written consent, which shall not be unreasonably withheld, conditioned, or delayed; provided that consent shall not be required for any settlement that (i) includes a full and unconditional release of the indemnified party, (ii) does not impose any obligation or restriction on the indemnified party, and (iii) does not include any admission of liability or wrongdoing by the indemnified party.

C. Risk Assessment. The Form Agreement's indemnification provisions are inadequate on multiple levels:

Cap Insufficiency. The trailing-twelve-month fee cap on IP indemnification ($1,400,000) bears no reasonable relationship to the $7,000,000 TCV or to the potential magnitude of IP infringement claims. If Clearpoint's platform were found to infringe a third party's patent, Quorum could face an injunction preventing continued use of a mission-critical system — a scenario in which $1,400,000 would be grossly insufficient to compensate for the cost of migrating to an alternative platform, re-processing claims, and addressing any resulting regulatory delays.

Data-Breach Exposure. The complete absence of data-breach indemnification is the single most significant deficiency in the Form Agreement. Quorum's ClaimsIQ™ deployment will involve the processing of claims data for all three of its insurance subsidiaries, encompassing hundreds of thousands of policyholder records. A data breach could trigger notification obligations in all fifty states, HIPAA breach notification requirements (where PHI is involved), regulatory enforcement actions by the Connecticut Insurance Department and other state regulators, and class action litigation. Industry studies estimate the average cost of a data breach in the insurance sector at approximately $5.9 million, with large-scale breaches involving hundreds of thousands of records potentially resulting in losses of $50 million or more. An indemnification cap of any fixed amount would be inadequate to address this exposure.

Market Practice. The recommended cap structure — 2× TCV for general/IP indemnification ($14,000,000) and uncapped data-breach indemnification — is consistent with market practice for enterprise SaaS agreements of this size and sensitivity, particularly where the customer is a regulated financial services entity processing large volumes of consumer PII and PHI. We have reviewed comparable agreements negotiated by Calderwood & Harkness in the past twelve months and confirm that this structure is within the range of terms obtained by similarly situated enterprise customers.

Issue 4: General Liability Cap

Priority: HIGH

A. Current Form Position. Section 9.1 of the Form Agreement imposes a mutual aggregate liability cap equal to the fees paid by Quorum in the twelve (12) months preceding the event giving rise to the claim. At steady state, this cap is approximately $1,400,000. This cap applies to "all claims arising under or in connection with this Agreement, whether in contract, tort, strict liability, or otherwise," and is described as encompassing indemnification obligations. The Form Agreement also includes a broad mutual exclusion of consequential, incidental, special, punitive, and indirect damages, with no carve-outs.

B. Recommended Negotiation Position. We recommend the following revisions:

1. General Aggregate Liability Cap. The general aggregate liability cap for each party should be set at one times (1×) the TCV, or $7,000,000. This cap would apply to all claims arising under the Agreement other than those subject to separate caps or carve-outs as described below.

2. Carve-Outs from the General Liability Cap. The following categories of liability should be excluded from the general liability cap (i.e., they should not count against the $7,000,000 cap):

(a) Clearpoint's indemnification obligations for data breach (which should be uncapped, as discussed in Issue 3);

(b) Clearpoint's indemnification obligations for intellectual property infringement (which should be subject to the separate $14,000,000 cap discussed in Issue 3);

(d) Liability arising from gross negligence by either party;

(e) Liability for breach of confidentiality obligations;

(f) Quorum's obligation to pay fees due under the Agreement.

3. Consequential Damages Exclusion — Carve-Outs. The mutual exclusion of consequential damages should be retained as a general matter but must include carve-outs permitting recovery of consequential damages for:

(a) Data breach or unauthorized disclosure of Customer Data;

(b) Breach of confidentiality obligations;

(d) Willful misconduct or fraud.

C. Risk Assessment. The Form Agreement's trailing-twelve-month liability cap of approximately $1,400,000 is commercially inadequate for a five-year enterprise deployment processing sensitive insurance claims data across three operational locations. This cap would provide Quorum with only twenty cents of recovery for every dollar of total contract value — a ratio that falls well below market norms for enterprise SaaS agreements, where a 1× to 2× TCV general liability cap is standard.

The recommended $7,000,000 general cap (1× TCV) provides meaningful recourse in the event of material breach while remaining commercially reasonable for a vendor of Clearpoint's size and financial profile ($78 million ARR). We note that the carve-outs from the general cap are essential to ensure that the most significant categories of potential loss — data breach, IP infringement, and willful misconduct — are not artificially constrained by a cap that was designed to limit exposure for ordinary contractual disputes.

The consequential damages carve-outs are similarly important. In the context of a data breach involving policyholder PII and PHI, the most significant components of Quorum's loss — regulatory fines, notification costs, credit monitoring expenses, litigation defense costs, and reputational harm — would likely be characterized as consequential damages. A blanket consequential damages exclusion would effectively immunize Clearpoint from liability for these losses, which would be an unacceptable result.

Issue 5: Service Level Commitments and Chronic Failure Termination

Priority: HIGH

A. Current Form Position. The Service Level Agreement attached as Exhibit B to the Form Agreement contains the following provisions:

• Uptime SLA: 99.5% monthly uptime, calculated as the total number of minutes in the calendar month minus downtime minutes, divided by the total number of minutes in the calendar month.

• Service Credits: 1% of the monthly subscription fee per 0.1% shortfall below the 99.5% threshold, capped at 10% of the monthly subscription fee. At a monthly fee of approximately $116,667, this translates to a maximum credit of approximately $11,667 per month.

• Termination: The Form Agreement does not include any termination right tied to chronic underperformance of the SLA. Quorum's sole remedy for SLA shortfalls is service credits.

• Scheduled Maintenance: The Form Agreement reserves Clearpoint's right to schedule maintenance "at times and for durations as Clearpoint deems appropriate." There is no defined maintenance window, and no cap on the frequency or duration of scheduled maintenance. Downtime during scheduled maintenance is excluded from the uptime calculation.

• Exclusions: The uptime calculation excludes scheduled maintenance, force majeure events, downtime caused by Quorum's systems or networks, and — problematically — downtime caused by "third-party services and infrastructure." Given that ClaimsIQ™ is hosted on Cobalt Cloud Infrastructure, this last exclusion could allow Clearpoint to disclaim responsibility for a significant category of platform outages.

B. Recommended Negotiation Position. We recommend the following revisions:

1. Uptime Threshold. The monthly uptime SLA should be raised from 99.5% to 99.7%. This equates to a maximum permitted downtime of approximately 2 hours and 11 minutes per month (in a 30-day month), which is consistent with market standards for mission-critical enterprise SaaS platforms. The exclusion for "third-party services and infrastructure" should be deleted; Clearpoint should bear responsibility for the availability of its platform inclusive of its hosting infrastructure.

2. Scheduled Maintenance Window. Scheduled maintenance should be limited to a defined window of up to four (4) hours per month, on Sundays between 2:00 AM and 6:00 AM Eastern Time. Clearpoint must provide at least seventy-two (72) hours' advance notice of any scheduled maintenance. Only maintenance performed within this defined window shall be excluded from the uptime calculation.

3. Service Credits. The service credit structure should be revised as follows:

(a) Credit amount: 2% of the applicable monthly subscription fee ($116,667/month) per 0.1% shortfall below 99.7%, resulting in a credit of approximately $2,333 per 0.1% shortfall.

(b) Maximum monthly credit: 15% of the monthly subscription fee, or approximately $17,500.

(c) Service credits should be applied automatically against the next invoice, without requiring Quorum to submit a claim or request.

4. Chronic Failure Termination Right. If monthly uptime falls below 99.0% in any three (3) consecutive calendar months, Quorum shall have the right to terminate the Agreement for cause upon thirty (30) days' written notice and shall be entitled to receive a pro-rata refund of all prepaid and unused subscription fees.

5. Reporting. Clearpoint must provide automated monthly uptime reporting to Quorum via a customer-accessible dashboard and email notification, no later than the fifth (5th) business day of each calendar month for the preceding month. For any month in which uptime falls below 99.7%, Clearpoint must provide a written root-cause analysis within ten (10) business days, including a remediation plan with specific timelines.

C. Risk Assessment. The ClaimsIQ™ platform will be integrated into Quorum's claims-processing operations as a core component of the claims adjudication workflow at all three of Quorum's claims-processing locations. Platform downtime directly impacts claims adjudication speed, which in turn affects:

• Regulatory compliance: State insurance regulations impose requirements for timely claims handling and prompt payment. Extended platform outages could impair Quorum's ability to meet these requirements, potentially triggering regulatory action.

• Customer service: Delayed claims processing is the single most significant driver of policyholder dissatisfaction and is a key metric in state market conduct examinations.

• Operational efficiency: With up to 1,200 named users relying on the platform, downtime results in productivity losses across Quorum's claims organization.

The chronic failure termination right is essential as an exit ramp if the platform proves unreliable. Without such a right, Quorum could be contractually bound to a non-performing platform for the remainder of a five-year term, with no recourse beyond modest service credits. The 99.0% threshold for chronic failure — which represents approximately 7 hours and 18 minutes of downtime per month — is deliberately set well below the 99.7% target SLA to ensure that the termination right is triggered only in cases of genuinely chronic, systemic underperformance rather than isolated incidents.

Issue 6: Source Code Escrow and Vendor Insolvency Protections

Priority: HIGH

A. Current Form Position. The Form Agreement does not include any source code escrow provisions. There is no reference to escrow arrangements, no discussion of business continuity protections in the event of vendor insolvency, and no acknowledgment that Quorum's access to the ClaimsIQ™ platform could be disrupted by Clearpoint's financial distress or cessation of business operations.

B. Recommended Negotiation Position. We recommend that the Agreement require the execution of a three-party Technology Escrow Agreement with the following terms:

1. Escrow Agent. Granite Trust Company, N.A., located at 300 Main Street, Suite 100, Stamford, Connecticut 06901, shall serve as the escrow agent. Granite Trust is a nationally recognized technology escrow agent with which Calderwood & Harkness has prior experience and a standard form escrow agreement that is well-suited to SaaS deployments.

2. Deposited Materials. The following materials shall be deposited into escrow (collectively, the "Deposited Materials"):

(a) Complete source code for the ClaimsIQ™ platform, including all modules, components, and libraries necessary to compile, build, and run the platform;

(b) Build scripts, configuration files, and deployment instructions;

(d) Database schemas, data dictionaries, and instructions sufficient to access and export Customer Data from the platform;

(e) Any third-party software licenses or components required to compile or operate the platform, or alternatively, a list of such components with instructions for obtaining them.

3. Update Frequency. Clearpoint shall make updated deposits of all Deposited Materials on a quarterly basis, no later than thirty (30) days after the end of each calendar quarter. Each deposit shall reflect the then-current production version of the ClaimsIQ™ platform.

4. Verification. Quorum shall have the right to request that Granite Trust conduct a technical verification of the Deposited Materials (at Quorum's expense) no more than once per year to confirm that the deposit is complete and sufficient to compile and operate the platform.

5. Release Conditions. The escrow agent shall release the Deposited Materials to Quorum upon the occurrence of any of the following events (each, a "Release Event"):

(a) Clearpoint files a voluntary petition for relief under the United States Bankruptcy Code (Title 11) or any similar proceeding under applicable law;

(b) An involuntary petition for relief is filed against Clearpoint under the United States Bankruptcy Code and is not dismissed within sixty (60) days of filing;

(d) A receiver, trustee, or custodian is appointed for Clearpoint or a substantial portion of its assets;

(e) Clearpoint ceases to conduct business in the ordinary course or liquidates substantially all of its assets;

(f) Clearpoint materially breaches the SaaS Subscription Agreement and fails to cure such breach within sixty (60) days after receipt of written notice from Quorum specifying the breach in reasonable detail.

6. Post-Release License. Upon a Release Event, Quorum shall automatically receive a non-exclusive, irrevocable, fully paid-up license to use, copy, modify, and create derivative works from the Deposited Materials solely for the purpose of continuing Quorum's internal business operations previously supported by the ClaimsIQ™ platform. This license shall survive any termination or rejection of the SaaS Subscription Agreement.

7. Escrow Fee. The annual escrow fee of $4,500 shall be split equally between the parties ($2,250 per party per year).

C. Risk Assessment. Clearpoint is a privately held, growth-stage technology company. While its financial profile — $78 million ARR, 320 employees, and the backing of a well-regarded growth-equity firm in Ridgeway Capital Partners — suggests reasonable near-term financial stability, the risk of vendor insolvency, acquisition, or business cessation over a five-year contract term is material and must be mitigated.

Growth-stage technology companies in the InsurTech sector face competitive pressures, customer concentration risk, and the potential for burn-rate-driven cash crunches, particularly in periods of tighter venture and growth-equity capital markets. While we have not conducted a detailed financial analysis of Clearpoint (and note that Clearpoint, as a private company, is under no obligation to disclose detailed financial information), prudent vendor management requires that Quorum plan for downside scenarios.

Nathan Ikeda's review of this issue from a bankruptcy and restructuring perspective confirms that source code escrow with clearly defined release conditions is the standard mechanism for protecting the operational continuity of customers dependent on a SaaS vendor's proprietary technology. In the event of a Clearpoint bankruptcy, the SaaS Subscription Agreement would be treated as an executory contract subject to assumption or rejection under Section 365 of the Bankruptcy Code. If rejected, Quorum could lose access to the ClaimsIQ™ platform entirely. The escrow release provisions and post-release license must be drafted to survive rejection of the SaaS Agreement as an executory contract and to be enforceable notwithstanding the automatic stay provisions of Section 362 of the Bankruptcy Code. We will work with Granite Trust's counsel to ensure that the escrow agreement addresses these bankruptcy-specific considerations.

The cost of the escrow arrangement ($2,250 per year to Quorum, or $11,250 over the five-year term) is de minimis relative to the $7,000,000 TCV and the value of the business continuity protection it provides.

Issue 7: Change-of-Control and Assignment Provisions

Priority: HIGH

A. Current Form Position. Section 13.4 of the Form Agreement addresses assignment with a permissive approach that is inadequate to protect Quorum's interests:

• Either party may assign the Agreement upon thirty (30) days' prior written notice to the other party, without requiring the other party's consent.

• There are no specific change-of-control provisions. The Agreement does not address the scenario in which Clearpoint is acquired by, merges with, or sells substantially all of its assets to a third party.

B. Recommended Negotiation Position. We recommend the following revisions:

1. Anti-Assignment. Neither party may assign, delegate, or otherwise transfer the Agreement or any rights or obligations thereunder without the other party's prior written consent, which shall not be unreasonably withheld, conditioned, or delayed; provided, however, that:

(a) Quorum may assign the Agreement without Clearpoint's consent to (i) any affiliate of Quorum, (ii) any successor entity in connection with a merger, consolidation, or reorganization involving Quorum, or (iii) any purchaser of all or substantially all of Quorum's assets or the business unit to which the Agreement relates.

(b) Clearpoint may not assign the Agreement without Quorum's prior written consent, including in connection with a merger, acquisition, or sale of substantially all assets.

2. Change-of-Control Trigger. If Clearpoint undergoes a Change of Control (as defined below), Quorum shall have the right, exercisable in its sole discretion, to terminate the Agreement upon ninety (90) days' written notice without penalty, early termination fee, or other liability, and shall be entitled to receive a pro-rata refund of all prepaid and unused subscription fees.

3. Definition of "Change of Control." For purposes of this provision, "Change of Control" means any of the following:

(a) Any transaction or series of related transactions resulting in a change of more than fifty percent (50%) of the voting power or equity interests of Clearpoint;

(b) A merger, consolidation, or similar business combination in which Clearpoint is not the surviving entity, or in which Clearpoint is the surviving entity but the equity holders of Clearpoint immediately prior to such transaction hold less than fifty percent (50%) of the voting power of the surviving entity;

PRIVILEGED AND CONFIDENTIAL — ATTORNEY-CLIENT COMMUNICATION ATTORNEY WORK PRODUCT
MEMORANDUM
TO: Renata Vasquez, Partner, Calderwood & Harkness LLP Patricia Okonkwo, General Counsel, Quorum Insurance Holdings Corp.
FROM: Nathan Ikeda, Lead Associate, and Gabrielle Moss, Associate, Calderwood & Harkness LLP
DATE: March 18, 2024
RE: Negotiation Issues Memorandum — Key Terms and Risk Analysis: Clearpoint Analytics, Inc. Form SaaS Subscription Agreement for ClaimsIQ™ Platform
Matter No.: 1025-00009
Right-click to update Table of Contents
I. Executive Summary
Calderwood & Harkness LLP received Clearpoint Analytics, Inc.'s ("Clearpoint") initial form Enterprise SaaS Subscription Agreement (the "Agreement" or "Form Agreement") on March 11, 2024. The Agreement governs Quorum Insurance Holdings Corp.'s ("Quorum") proposed enterprise-wide deployment of Clearpoint's ClaimsIQ™ platform, an AI-driven claims triage, fraud detection, and analytics solution. The proposed arrangement contemplates a five-year initial subscription term with a total contract value ("TCV") of $7,000,000, representing an annual contract value ("ACV") of $1,400,000, subject to CPI-based escalation as described more fully below.
This memorandum identifies and prioritizes nine key negotiation issues where Clearpoint's form departs materially from Quorum's risk tolerance, prevailing market norms for enterprise SaaS agreements, or applicable regulatory requirements. In addition to these primary issues, we address several additional negotiation points that, while of somewhat lesser urgency, remain important to the overall commercial and legal posture of the transaction.
Each issue is ranked according to the following priority framework:
• Critical — Must be resolved prior to execution. These issues represent non-negotiable positions where failure to obtain adequate protections would expose Quorum to unacceptable legal, regulatory, or operational risk.
• High — Strongly recommended changes. These issues represent significant departures from market norms or Quorum's standard vendor management requirements, and failure to address them would leave material gaps in the contractual framework.
• Moderate — Desirable improvements. These issues, while not dealbreakers in isolation, represent commercially suboptimal terms that should be improved through negotiation where possible.
Quorum's position as licensee, its status as a publicly traded insurance holding company listed on the Nasdaq Stock Market (ticker: QIHC) with concomitant regulatory and disclosure obligations, and the acute sensitivity of claims data — which will include policyholder personally identifiable information ("PII") and protected health information ("PHI") — collectively necessitate material revisions to Clearpoint's vendor-favorable form. The Form Agreement, as drafted, is inadequate to address the regulatory framework within which Quorum operates, including the Connecticut Data Privacy Act ("CTDPA"), the Health Insurance Portability and Accountability Act ("HIPAA"), and the National Association of Insurance Commissioners Insurance Data Security Model Law (the "NAIC Model Law") as adopted in Connecticut.
In summary, this memorandum addresses the following issues:
1. Customer Data Ownership and Portability (Critical)
2. Restrictions on Clearpoint's Use of Aggregated Data (Critical)
3. Indemnification Structure and Caps (Critical)
4. General Liability Cap (High)
5. Service Level Commitments and Chronic Failure Termination (High)
6. Source Code Escrow and Vendor Insolvency Protections (High)
7. Change-of-Control and Assignment Provisions (High)
8. Subprocessor Consent Rights (Moderate)
9. Regulatory Compliance Carve-Outs (CTDPA, HIPAA, NAIC) (Critical)
We recommend that this memorandum be circulated promptly to Patricia Okonkwo, Derek Langston (CIO), and Malcolm Tsai (VP of Procurement) for review. Calderwood & Harkness intends to deliver a comprehensive first redline of the Agreement to Clearpoint's outside counsel, Whitfield Greer & Associates LLP, by March 22, 2024, incorporating the negotiation positions described herein, subject to Quorum's input on priorities.
II. Background
A. The Parties
Quorum Insurance Holdings Corp. ("Quorum" or the "Company") is a Delaware corporation, publicly traded on the Nasdaq Stock Market under the ticker symbol QIHC. Quorum is headquartered at 280 Constitution Plaza, Suite 1400, Hartford, Connecticut 06103. The Company operates through three principal subsidiaries: (i) Quorum Property & Casualty Insurance Company, a Connecticut-domiciled property and casualty insurer; (ii) Quorum Specialty Underwriters, Inc., a Delaware corporation engaged in specialty lines underwriting; and (iii) Quorum Digital Solutions LLC, a Delaware limited liability company providing internal technology and digital transformation services to the Quorum family of companies. For the fiscal year ended December 31, 2023, Quorum reported gross written premiums of approximately $4.2 billion. The Company employs approximately 3,800 individuals across its operations, with claims-processing operations concentrated in Hartford, Connecticut; Dallas, Texas; and Jacksonville, Florida.
The internal business sponsor for the ClaimsIQ™ deployment is Derek Langston, Quorum's Chief Information Officer, who has identified the platform as a key component of Quorum's enterprise-wide claims modernization initiative. Commercial negotiations with Clearpoint are being led by Malcolm Tsai, Vice President of Procurement. Patricia Okonkwo serves as General Counsel and has engaged Calderwood & Harkness to handle the legal negotiation and documentation.
Clearpoint Analytics, Inc. ("Clearpoint") is a Delaware corporation headquartered at 200 South Wacker Drive, Suite 3100, Chicago, Illinois 60606. Founded in 2017, Clearpoint provides the ClaimsIQ™ platform — a cloud-hosted, artificial intelligence-driven SaaS solution offering claims triage, fraud detection, and advanced analytics capabilities designed for the property and casualty insurance industry. As of the fourth quarter of 2023, Clearpoint reported approximately $78 million in annual recurring revenue ("ARR") and employs approximately 320 individuals.
Clearpoint is privately held. Following a $95 million Series C financing round that closed in October 2022, the company's majority ownership — approximately 62% of outstanding equity — is held by Ridgeway Capital Partners, LP, a growth-equity fund based in Boston, Massachusetts, managed by Managing Partner Fiona Galbraith. The remaining equity is held by Clearpoint's founders, management team, and earlier-stage investors. Given Ridgeway's majority position and the typical investment horizon for growth-equity funds, the possibility of a liquidity event — whether by way of a strategic sale, initial public offering, or secondary transaction — during the five-year term of the proposed Agreement is a meaningful consideration that informs several of our negotiation positions, particularly with respect to change-of-control provisions.
Clearpoint's leadership team includes Anita Rajan, CEO and co-founder; Theodore Marsh, Chief Revenue Officer, who is leading commercial negotiations on Clearpoint's behalf; and Samuel Otieno, Vice President of Product & Engineering, who has participated in technical discussions with Quorum's IT team. Clearpoint is represented by outside counsel Whitfield Greer & Associates LLP, located at 71 South Dearborn Street, Suite 4400, Chicago, Illinois 60603. The lead attorney is Damian Cho, Partner, supported by Leona Burris, Associate.
B. Transaction Overview
The proposed transaction is an Enterprise SaaS Subscription Agreement pursuant to which Quorum would deploy Clearpoint's ClaimsIQ™ platform on an enterprise-wide basis across all three of Quorum's claims-processing locations (Hartford, CT; Dallas, TX; and Jacksonville, FL), with additional remote access capabilities for field adjusters operating outside of those facilities.
The key commercial terms of the proposed Agreement are as follows:
• Total Contract Value (TCV): $7,000,000 over the five-year initial term.
• Annual Contract Value (ACV): $1,400,000 in Year 1.
• Payment Structure: Annual payments due in advance within thirty (30) days of each subscription anniversary date. The Year 1 payment of $1,400,000 is due upon execution of the Agreement. Annual contract values for Years 2 through 5 are subject to a Consumer Price Index-based escalator, capped at 3.5% per annum. Under this structure, the Year 2 maximum ACV would be $1,449,000, and the Year 5 maximum ACV would be approximately $1,607,523, assuming the full 3.5% escalation is applied in each year.
• Licensed Users: Up to 1,200 named users across Quorum and its subsidiaries. Any usage in excess of 1,200 named users incurs an overage rate of $150 per user per month.
• Initial Term: Five (5) years.
• Renewal: Automatic one-year renewal terms unless either party provides one hundred eighty (180) days' written notice of non-renewal prior to the expiration of the then-current term.
The Form Agreement includes four draft exhibits: (A) Service Description, (B) Service Level Agreement, (C) Data Processing Addendum, and (D) Security Requirements. Each of these exhibits requires negotiation, and the positions described in this memorandum address provisions found in both the body of the Agreement and the draft exhibits.
C. Scope of Review
Calderwood & Harkness has reviewed Clearpoint's initial Form Agreement in its entirety, including all four draft exhibits. Our review has been informed by discussions with Quorum's business team, including Derek Langston and Malcolm Tsai, as well as preliminary technical review of publicly available information regarding the ClaimsIQ™ platform's architecture and data-handling practices.
Calderwood & Harkness intends to deliver a comprehensive first redline of the Agreement to Whitfield Greer & Associates LLP (Damian Cho / Leona Burris) by March 22, 2024. This memorandum is intended to inform Quorum's review and approval of the proposed negotiation positions prior to delivery of that redline.
Separately, Quorum has retained Dravello Data Compliance Advisors LLC (Miriam Tanaka, Principal Consultant) to conduct a data-mapping and privacy-impact assessment of the ClaimsIQ™ platform. That assessment is expected to be completed in early April 2024. The findings of that assessment will be incorporated into the negotiation of the Data Processing Addendum (Exhibit C) and may result in additional or refined requirements not yet reflected in this memorandum. We will coordinate closely with Ms. Tanaka throughout the negotiation process.
III. Issue-by-Issue Analysis
Issue 1: Customer Data Ownership and Portability
Priority: CRITICAL
A. Current Form Position. Section 5.1 of Clearpoint's Form Agreement addresses data rights and contains language that, while superficially appearing to vest ownership of Customer Data in Quorum, functionally erodes that ownership through the breadth of the license grant. Specifically:
• The Form Agreement provides that "as between the parties, Customer retains ownership of Customer Data." However, this qualified language — "as between the parties" — is ambiguous and potentially insufficient to establish Quorum's ownership rights in the face of competing claims or in a regulatory context.
• The Form Agreement simultaneously grants Clearpoint a "broad, irrevocable, worldwide, sublicensable license" to Customer Data for the purposes of "providing the services, improving Clearpoint's products and services, developing new products and services, benchmarking, and any other lawful purpose." The breadth of this license — particularly its irrevocable nature, sublicensability, and extension to product improvement and benchmarking — functionally undermines the ownership clause and creates a perpetual right that survives termination.
• The Form Agreement does not define "Customer Data" with adequate specificity. There is no explicit inclusion of claims data, policyholder PII, PHI, adjuster notes, reports, or outputs generated by ClaimsIQ™ from Customer Data inputs. The absence of a robust definition creates risk that Clearpoint could assert ownership over analytical outputs, reports, or derivative data products generated from Quorum's underlying data.
With respect to data portability, the Form Agreement's provisions are vague and commercially inadequate:
• Section 11.3 provides that, upon termination or expiration, Clearpoint will return Customer Data "in a commercially reasonable format" within ninety (90) days. No specific format is identified, and "commercially reasonable" is undefined. Clearpoint could satisfy this obligation by providing data in a proprietary or non-interoperable format that would render migration to a successor platform impractical.
• There is no cost commitment associated with the data return obligation. The Form Agreement does not address whether Clearpoint may charge for the data export process.
• There is no affirmative obligation to destroy Customer Data following return. There is no certification requirement. This means that, even after termination, Clearpoint could retain copies of Quorum's Customer Data indefinitely under the purported authority of the irrevocable license.
B. Recommended Negotiation Position. We recommend that Quorum take the following positions in the redline:
1. Ownership. The Agreement must be revised to state unambiguously that Quorum retains sole and exclusive ownership of all Customer Data. The defined term "Customer Data" should be expanded to expressly include: (a) all claims data, including but not limited to claims files, adjuster notes, coverage determinations, and loss reports; (b) all policyholder PII; (c) all PHI; (d) all data uploaded to, processed by, or stored within the ClaimsIQ™ platform by or on behalf of Quorum; and (e) all outputs, reports, analytics, visualizations, and other work product generated by the ClaimsIQ™ platform using or derived from the foregoing.
2. Limited License. Clearpoint's license to Customer Data should be revised to be: (a) limited to the sole purpose of providing the services under the Agreement during the subscription term; (b) non-exclusive and non-transferable; (c) revocable upon termination or expiration of the Agreement for any reason; and (d) not sublicensable except to approved subprocessors in accordance with the DPA. The license must not extend to product improvement, benchmarking, or any other secondary purpose (which is addressed separately in Issue 2 below).
3. Data Portability. The Form Agreement's data return provisions must be replaced with the following:
(a) Upon expiration or termination of the Agreement for any reason, Clearpoint shall, at no additional charge to Quorum, export and deliver to Quorum a complete copy of all Customer Data in industry-standard, machine-readable formats, specifically ACORD XML and CSV, within sixty (60) days of the effective date of expiration or termination.
(b) During the sixty (60)-day export period, Clearpoint shall continue to make the ClaimsIQ™ platform available to Quorum on a read-only basis to facilitate data verification and migration planning, at no additional charge.
(c) Clearpoint shall provide reasonable cooperation and technical assistance to Quorum and any successor vendor to facilitate the migration of Customer Data, including documentation of data structures, schemas, and APIs.
4. Destruction and Certification. Within thirty (30) days following completion of the data export, Clearpoint shall permanently destroy all copies of Customer Data in its possession or control (including copies held by subprocessors), using methods consistent with NIST SP 800-88 guidelines. Clearpoint shall deliver to Quorum a written certification of destruction, executed by an officer of Clearpoint at the level of Vice President or above, confirming that all Customer Data has been permanently destroyed and that no copies have been retained.
C. Risk Assessment. The data ownership and portability issue is designated as Critical for the following reasons:
Quorum processes highly sensitive claims data through its operations, including policyholder PII (names, Social Security numbers, dates of birth, financial information) and, in connection with its workers' compensation lines, PHI as defined under HIPAA. This data will be ingested into, processed by, and stored within the ClaimsIQ™ platform. Loss of data control — whether through an overbroad license grant, ambiguous ownership provisions, or inadequate portability mechanisms — creates substantial regulatory risk under the CTDPA, HIPAA, and the NAIC Insurance Data Security Model Law.
The data lock-in risk is particularly acute in the context of a five-year contract. If Quorum is unable to efficiently export its data in a standard format at the end of the term (or upon early termination), it could face significant switching costs, operational disruption, and potential regulatory exposure arising from an inability to respond to policyholder data requests or to comply with data retention and disposition requirements.
For a publicly traded company, the inability to extricate its data from a vendor relationship may also implicate disclosure obligations under SEC rules, particularly if the data lock-in is material to the Company's operations or financial condition.
Issue 2: Restrictions on Clearpoint's Use of Aggregated Data
Priority: CRITICAL
A. Current Form Position. Section 5.3 of the Form Agreement reserves to Clearpoint an unrestricted right to create and use "de-identified, aggregated" data derived from Customer Data for any lawful purpose. The specific language of the form provides that Clearpoint may use such data for "benchmarking, marketing, product development, training machine-learning models, and sale or license to third parties." This right is described as perpetual and irrevocable, surviving termination of the Agreement.
Critically, the Form Agreement:
• Does not require Quorum's consent before Clearpoint creates or uses Aggregated Data.
• Does not impose any prohibition on re-identification of Aggregated Data, whether by Clearpoint or by third parties to whom Aggregated Data is sold or licensed.
• Does not specify the de-identification standard or methodology to be applied.
• Does not restrict Clearpoint from using Aggregated Data in ways that could reveal Quorum's claims patterns, loss experience, or underwriting strategies to competitors.
B. Recommended Negotiation Position. We recommend the following position:
1. Limited Purpose. Clearpoint may create de-identified, aggregated statistical data ("Aggregated Data") from Customer Data solely for the purpose of improving the ClaimsIQ™ platform's functionality and performance (i.e., product improvement). No other use shall be permitted without Quorum's prior written consent.
2. Three Conditions. Any creation or use of Aggregated Data shall be subject to the following conditions:
(i) Regulatory Compliance. Clearpoint's creation and use of Aggregated Data must comply with all applicable insurance data-privacy laws, including without limitation the CTDPA, HIPAA (to the extent PHI is involved), and the NAIC Insurance Data Security Model Law.
(ii) Prior Written Consent. Before any use of Aggregated Data beyond internal product improvement — including any disclosure to third parties, publication, or use in marketing materials — Clearpoint must obtain Quorum's prior written consent, which shall not be unreasonably withheld, conditioned, or delayed. Quorum shall have the right to review and approve any proposed use of Aggregated Data on a case-by-case basis.
(iii) Prohibition on Re-Identification and Third-Party Sale. Clearpoint shall be absolutely prohibited from (a) re-identifying any Aggregated Data or attempting to link Aggregated Data back to any individual policyholder, claimant, or to Quorum; (b) selling, licensing, or otherwise transferring Aggregated Data to any third party; and (c) combining Aggregated Data derived from Quorum's Customer Data with data from other customers in a manner that would permit identification of Quorum's claims patterns, loss experience, or business strategies.
3. De-Identification Standard. Where Customer Data includes PHI, the de-identification process must comply with the HIPAA Safe Harbor method (removal of the eighteen specified identifiers under 45 C.F.R. § 164.514(b)(2)) or the Expert Determination method (45 C.F.R. § 164.514(b)(1)). For all other Customer Data, the de-identification methodology must render it impossible, using reasonably available technology, to re-identify any individual or to identify Quorum as the source of the data.
4. Survival. The restrictions on Aggregated Data use shall survive termination or expiration of the Agreement in perpetuity.
C. Risk Assessment. This issue is designated as Critical for several interrelated reasons:
First, competitive intelligence leakage is a significant concern. Clearpoint serves multiple commercial insurers, including, to our knowledge, at least two direct competitors of Quorum in the property and casualty market. Unrestricted aggregation rights could allow Clearpoint to derive insights from Quorum's claims data — including claims frequency, severity distributions, fraud patterns, and adjuster productivity — and transmit those insights (whether directly through data sales or indirectly through product features informed by aggregated data) to Quorum's competitors. Even if individual data points are de-identified, patterns derived from a large dataset may be sufficient to reveal competitively sensitive information.
Second, regulatory scrutiny of vendor use of policyholder data for secondary purposes is intensifying. The National Association of Insurance Commissioners has repeatedly emphasized, through both model legislation and market conduct examination guidance, that insurers bear responsibility for ensuring that their vendors do not use policyholder data in ways that are inconsistent with policyholders' reasonable expectations or that violate applicable privacy laws. Several state insurance departments have issued bulletins specifically addressing the use of policyholder data by InsurTech vendors for algorithmic training and benchmarking purposes.
Third, if Clearpoint sells or licenses Aggregated Data derived in part from PHI, and the de-identification is later found to be inadequate, Quorum could face HIPAA enforcement actions as the covered entity that permitted a business associate to misuse PHI.
Issue 3: Indemnification Structure and Caps
Priority: CRITICAL
A. Current Form Position. Section 8 of the Form Agreement contains indemnification provisions that are inadequate in both scope and quantum:
• Clearpoint provides unilateral indemnification solely for third-party intellectual property infringement claims arising from Quorum's use of the ClaimsIQ™ platform in accordance with the Agreement. This is the only indemnification obligation in the Form Agreement.
• The IP indemnification is subject to a cap equal to fees paid by Quorum in the twelve (12) months preceding the claim — i.e., approximately $1,400,000 (or less in Year 1, depending on the timing of the claim relative to the payment cycle).
• There is no data-breach indemnification obligation. The Form Agreement is silent on Clearpoint's indemnification responsibility in the event of a security incident, unauthorized disclosure, or data breach involving Customer Data.
• There is no mutual indemnification framework. Quorum provides no indemnification to Clearpoint, and Clearpoint provides no indemnification beyond the narrow IP infringement clause.
B. Recommended Negotiation Position. We recommend establishing a comprehensive, mutual indemnification framework as follows:
1. Clearpoint Indemnification Obligations. Clearpoint shall indemnify, defend, and hold harmless Quorum, its affiliates, and their respective officers, directors, employees, and agents (collectively, "Quorum Indemnitees") against any third-party claims, damages, losses, costs, and expenses (including reasonable attorneys' fees) arising from or related to:
(a) intellectual Property Infringement. Any claim that Quorum's authorized use of the ClaimsIQ™ platform in accordance with the Agreement infringes, misappropriates, or otherwise violates any third party's intellectual property rights, including patents, copyrights, trademarks, or trade secrets.
(b) Data Breach. Any claim arising from Clearpoint's breach of its data-security obligations under the Agreement or the DPA, or from the unauthorized access to, disclosure of, loss of, or destruction of Customer Data while in Clearpoint's possession or control (or in the possession or control of Clearpoint's subprocessors).
(c) Regulatory Violations. Any claim arising from Clearpoint's violation of applicable law in the performance of its obligations under the Agreement, including without limitation violations of the CTDPA, HIPAA, the NAIC Insurance Data Security Model Law, and other applicable insurance regulatory requirements.
2. Quorum Indemnification Obligations. Quorum shall indemnify, defend, and hold harmless Clearpoint, its affiliates, and their respective officers, directors, employees, and agents (collectively, "Clearpoint Indemnitees") against any third-party claims, damages, losses, costs, and expenses (including reasonable attorneys' fees) arising from or related to:
(a) Customer Data. Any claim that Customer Data provided by Quorum to Clearpoint in connection with the Agreement infringes, misappropriates, or otherwise violates any third party's intellectual property rights or privacy rights.
(b) Unauthorized Use. Any claim arising from Quorum's use of the ClaimsIQ™ platform in a manner that materially exceeds the scope of the license granted under the Agreement or that violates the Agreement's acceptable use provisions.
3. Indemnification Caps. The following cap structure shall apply:
(a) intellectual Property and General Indemnification: Subject to an aggregate cap of two times (2×) the TCV, or $14,000,000 ($7,000,000 × 2).
(b) Data-Breach Indemnification: Uncapped. This is a non-negotiable position. Given the volume and sensitivity of policyholder PII and PHI that will be processed through the ClaimsIQ™ platform, and given Quorum's regulatory exposure as a licensed insurer and publicly traded company, Quorum cannot accept any limitation on Clearpoint's indemnification obligation for data breaches. A single data breach involving Quorum's policyholder data could result in regulatory fines from multiple state insurance departments, OCR enforcement actions under HIPAA, state attorney general investigations, class action litigation, credit monitoring and notification costs, and severe reputational damage. The potential magnitude of these losses far exceeds any commercially reasonable cap, and the risk should rest with the party that controls the security of the platform — Clearpoint.
4. Indemnification Procedures. The Agreement shall include the following procedural requirements:
(a) Notice. The indemnified party shall provide written notice to the indemnifying party within fifteen (15) business days of becoming aware of any claim for which indemnification is sought. Failure to provide timely notice shall not relieve the indemnifying party of its obligations except to the extent the indemnifying party is materially prejudiced by such failure.
(b) Control of Defense. The indemnifying party shall have the right to assume and control the defense of any indemnified claim, using counsel reasonably acceptable to the indemnified party.
(c) Participation. The indemnified party may participate in the defense of any claim at its own expense, using counsel of its own choosing.
(d) Settlement. No settlement of any claim may be entered into by the indemnifying party without the indemnified party's prior written consent, which shall not be unreasonably withheld, conditioned, or delayed; provided that consent shall not be required for any settlement that (i) includes a full and unconditional release of the indemnified party, (ii) does not impose any obligation or restriction on the indemnified party, and (iii) does not include any admission of liability or wrongdoing by the indemnified party.
C. Risk Assessment. The Form Agreement's indemnification provisions are inadequate on multiple levels:
Cap Insufficiency. The trailing-twelve-month fee cap on IP indemnification ($1,400,000) bears no reasonable relationship to the $7,000,000 TCV or to the potential magnitude of IP infringement claims. If Clearpoint's platform were found to infringe a third party's patent, Quorum could face an injunction preventing continued use of a mission-critical system — a scenario in which $1,400,000 would be grossly insufficient to compensate for the cost of migrating to an alternative platform, re-processing claims, and addressing any resulting regulatory delays.
Data-Breach Exposure. The complete absence of data-breach indemnification is the single most significant deficiency in the Form Agreement. Quorum's ClaimsIQ™ deployment will involve the processing of claims data for all three of its insurance subsidiaries, encompassing hundreds of thousands of policyholder records. A data breach could trigger notification obligations in all fifty states, HIPAA breach notification requirements (where PHI is involved), regulatory enforcement actions by the Connecticut Insurance Department and other state regulators, and class action litigation. Industry studies estimate the average cost of a data breach in the insurance sector at approximately $5.9 million, with large-scale breaches involving hundreds of thousands of records potentially resulting in losses of $50 million or more. An indemnification cap of any fixed amount would be inadequate to address this exposure.
Market Practice. The recommended cap structure — 2× TCV for general/IP indemnification ($14,000,000) and uncapped data-breach indemnification — is consistent with market practice for enterprise SaaS agreements of this size and sensitivity, particularly where the customer is a regulated financial services entity processing large volumes of consumer PII and PHI. We have reviewed comparable agreements negotiated by Calderwood & Harkness in the past twelve months and confirm that this structure is within the range of terms obtained by similarly situated enterprise customers.
Issue 4: General Liability Cap
Priority: HIGH
A. Current Form Position. Section 9.1 of the Form Agreement imposes a mutual aggregate liability cap equal to the fees paid by Quorum in the twelve (12) months preceding the event giving rise to the claim. At steady state, this cap is approximately $1,400,000. This cap applies to "all claims arising under or in connection with this Agreement, whether in contract, tort, strict liability, or otherwise," and is described as encompassing indemnification obligations. The Form Agreement also includes a broad mutual exclusion of consequential, incidental, special, punitive, and indirect damages, with no carve-outs.
B. Recommended Negotiation Position. We recommend the following revisions:
1. General Aggregate Liability Cap. The general aggregate liability cap for each party should be set at one times (1×) the TCV, or $7,000,000. This cap would apply to all claims arising under the Agreement other than those subject to separate caps or carve-outs as described below.
2. Carve-Outs from the General Liability Cap. The following categories of liability should be excluded from the general liability cap (i.e., they should not count against the $7,000,000 cap):
(a) Clearpoint's indemnification obligations for data breach (which should be uncapped, as discussed in Issue 3);
(b) Clearpoint's indemnification obligations for intellectual property infringement (which should be subject to the separate $14,000,000 cap discussed in Issue 3);
(c) Liability arising from willful misconduct or fraud by either party;
(d) Liability arising from gross negligence by either party;
(e) Liability for breach of confidentiality obligations;
(f) Quorum's obligation to pay fees due under the Agreement.
3. Consequential Damages Exclusion — Carve-Outs. The mutual exclusion of consequential damages should be retained as a general matter but must include carve-outs permitting recovery of consequential damages for:
(a) Data breach or unauthorized disclosure of Customer Data;
(b) Breach of confidentiality obligations;
(c) intellectual property infringement;
(d) Willful misconduct or fraud.
C. Risk Assessment. The Form Agreement's trailing-twelve-month liability cap of approximately $1,400,000 is commercially inadequate for a five-year enterprise deployment processing sensitive insurance claims data across three operational locations. This cap would provide Quorum with only twenty cents of recovery for every dollar of total contract value — a ratio that falls well below market norms for enterprise SaaS agreements, where a 1× to 2× TCV general liability cap is standard.
The recommended $7,000,000 general cap (1× TCV) provides meaningful recourse in the event of material breach while remaining commercially reasonable for a vendor of Clearpoint's size and financial profile ($78 million ARR). We note that the carve-outs from the general cap are essential to ensure that the most significant categories of potential loss — data breach, IP infringement, and willful misconduct — are not artificially constrained by a cap that was designed to limit exposure for ordinary contractual disputes.
The consequential damages carve-outs are similarly important. In the context of a data breach involving policyholder PII and PHI, the most significant components of Quorum's loss — regulatory fines, notification costs, credit monitoring expenses, litigation defense costs, and reputational harm — would likely be characterized as consequential damages. A blanket consequential damages exclusion would effectively immunize Clearpoint from liability for these losses, which would be an unacceptable result.
Issue 5: Service Level Commitments and Chronic Failure Termination
Priority: HIGH
A. Current Form Position. The Service Level Agreement attached as Exhibit B to the Form Agreement contains the following provisions:
• Uptime SLA: 99.5% monthly uptime, calculated as the total number of minutes in the calendar month minus downtime minutes, divided by the total number of minutes in the calendar month.
• Service Credits: 1% of the monthly subscription fee per 0.1% shortfall below the 99.5% threshold, capped at 10% of the monthly subscription fee. At a monthly fee of approximately $116,667, this translates to a maximum credit of approximately $11,667 per month.
• Termination: The Form Agreement does not include any termination right tied to chronic underperformance of the SLA. Quorum's sole remedy for SLA shortfalls is service credits.
• Scheduled Maintenance: The Form Agreement reserves Clearpoint's right to schedule maintenance "at times and for durations as Clearpoint deems appropriate." There is no defined maintenance window, and no cap on the frequency or duration of scheduled maintenance. Downtime during scheduled maintenance is excluded from the uptime calculation.
• Exclusions: The uptime calculation excludes scheduled maintenance, force majeure events, downtime caused by Quorum's systems or networks, and — problematically — downtime caused by "third-party services and infrastructure." Given that ClaimsIQ™ is hosted on Cobalt Cloud Infrastructure, this last exclusion could allow Clearpoint to disclaim responsibility for a significant category of platform outages.
B. Recommended Negotiation Position. We recommend the following revisions:
1. Uptime Threshold. The monthly uptime SLA should be raised from 99.5% to 99.7%. This equates to a maximum permitted downtime of approximately 2 hours and 11 minutes per month (in a 30-day month), which is consistent with market standards for mission-critical enterprise SaaS platforms. The exclusion for "third-party services and infrastructure" should be deleted; Clearpoint should bear responsibility for the availability of its platform inclusive of its hosting infrastructure.
2. Scheduled Maintenance Window. Scheduled maintenance should be limited to a defined window of up to four (4) hours per month, on Sundays between 2:00 AM and 6:00 AM Eastern Time. Clearpoint must provide at least seventy-two (72) hours' advance notice of any scheduled maintenance. Only maintenance performed within this defined window shall be excluded from the uptime calculation.
3. Service Credits. The service credit structure should be revised as follows:
(a) Credit amount: 2% of the applicable monthly subscription fee ($116,667/month) per 0.1% shortfall below 99.7%, resulting in a credit of approximately $2,333 per 0.1% shortfall.
(b) Maximum monthly credit: 15% of the monthly subscription fee, or approximately $17,500.
(c) Service credits should be applied automatically against the next invoice, without requiring Quorum to submit a claim or request.
4. Chronic Failure Termination Right. If monthly uptime falls below 99.0% in any three (3) consecutive calendar months, Quorum shall have the right to terminate the Agreement for cause upon thirty (30) days' written notice and shall be entitled to receive a pro-rata refund of all prepaid and unused subscription fees.
5. Reporting. Clearpoint must provide automated monthly uptime reporting to Quorum via a customer-accessible dashboard and email notification, no later than the fifth (5th) business day of each calendar month for the preceding month. For any month in which uptime falls below 99.7%, Clearpoint must provide a written root-cause analysis within ten (10) business days, including a remediation plan with specific timelines.
C. Risk Assessment. The ClaimsIQ™ platform will be integrated into Quorum's claims-processing operations as a core component of the claims adjudication workflow at all three of Quorum's claims-processing locations. Platform downtime directly impacts claims adjudication speed, which in turn affects:
• Regulatory compliance: State insurance regulations impose requirements for timely claims handling and prompt payment. Extended platform outages could impair Quorum's ability to meet these requirements, potentially triggering regulatory action.
• Customer service: Delayed claims processing is the single most significant driver of policyholder dissatisfaction and is a key metric in state market conduct examinations.
• Operational efficiency: With up to 1,200 named users relying on the platform, downtime results in productivity losses across Quorum's claims organization.
The chronic failure termination right is essential as an exit ramp if the platform proves unreliable. Without such a right, Quorum could be contractually bound to a non-performing platform for the remainder of a five-year term, with no recourse beyond modest service credits. The 99.0% threshold for chronic failure — which represents approximately 7 hours and 18 minutes of downtime per month — is deliberately set well below the 99.7% target SLA to ensure that the termination right is triggered only in cases of genuinely chronic, systemic underperformance rather than isolated incidents.
Issue 6: Source Code Escrow and Vendor Insolvency Protections
Priority: HIGH
A. Current Form Position. The Form Agreement does not include any source code escrow provisions. There is no reference to escrow arrangements, no discussion of business continuity protections in the event of vendor insolvency, and no acknowledgment that Quorum's access to the ClaimsIQ™ platform could be disrupted by Clearpoint's financial distress or cessation of business operations.
B. Recommended Negotiation Position. We recommend that the Agreement require the execution of a three-party Technology Escrow Agreement with the following terms:
1. Escrow Agent. Granite Trust Company, N.A., located at 300 Main Street, Suite 100, Stamford, Connecticut 06901, shall serve as the escrow agent. Granite Trust is a nationally recognized technology escrow agent with which Calderwood & Harkness has prior experience and a standard form escrow agreement that is well-suited to SaaS deployments.
2. Deposited Materials. The following materials shall be deposited into escrow (collectively, the "Deposited Materials"):
(a) Complete source code for the ClaimsIQ™ platform, including all modules, components, and libraries necessary to compile, build, and run the platform;
(b) Build scripts, configuration files, and deployment instructions;
(c) Complete technical documentation, including architecture diagrams, database schemas, and API documentation;
(d) Database schemas, data dictionaries, and instructions sufficient to access and export Customer Data from the platform;
(e) Any third-party software licenses or components required to compile or operate the platform, or alternatively, a list of such components with instructions for obtaining them.
3. Update Frequency. Clearpoint shall make updated deposits of all Deposited Materials on a quarterly basis, no later than thirty (30) days after the end of each calendar quarter. Each deposit shall reflect the then-current production version of the ClaimsIQ™ platform.
4. Verification. Quorum shall have the right to request that Granite Trust conduct a technical verification of the Deposited Materials (at Quorum's expense) no more than once per year to confirm that the deposit is complete and sufficient to compile and operate the platform.
5. Release Conditions. The escrow agent shall release the Deposited Materials to Quorum upon the occurrence of any of the following events (each, a "Release Event"):
(a) Clearpoint files a voluntary petition for relief under the United States Bankruptcy Code (Title 11) or any similar proceeding under applicable law;
(b) An involuntary petition for relief is filed against Clearpoint under the United States Bankruptcy Code and is not dismissed within sixty (60) days of filing;
(c) Clearpoint makes a general assignment for the benefit of creditors;
(d) A receiver, trustee, or custodian is appointed for Clearpoint or a substantial portion of its assets;
(e) Clearpoint ceases to conduct business in the ordinary course or liquidates substantially all of its assets;
(f) Clearpoint materially breaches the SaaS Subscription Agreement and fails to cure such breach within sixty (60) days after receipt of written notice from Quorum specifying the breach in reasonable detail.
6. Post-Release License. Upon a Release Event, Quorum shall automatically receive a non-exclusive, irrevocable, fully paid-up license to use, copy, modify, and create derivative works from the Deposited Materials solely for the purpose of continuing Quorum's internal business operations previously supported by the ClaimsIQ™ platform. This license shall survive any termination or rejection of the SaaS Subscription Agreement.
7. Escrow Fee. The annual escrow fee of $4,500 shall be split equally between the parties ($2,250 per party per year).
C. Risk Assessment. Clearpoint is a privately held, growth-stage technology company. While its financial profile — $78 million ARR, 320 employees, and the backing of a well-regarded growth-equity firm in Ridgeway Capital Partners — suggests reasonable near-term financial stability, the risk of vendor insolvency, acquisition, or business cessation over a five-year contract term is material and must be mitigated.
Growth-stage technology companies in the InsurTech sector face competitive pressures, customer concentration risk, and the potential for burn-rate-driven cash crunches, particularly in periods of tighter venture and growth-equity capital markets. While we have not conducted a detailed financial analysis of Clearpoint (and note that Clearpoint, as a private company, is under no obligation to disclose detailed financial information), prudent vendor management requires that Quorum plan for downside scenarios.
Nathan Ikeda's review of this issue from a bankruptcy and restructuring perspective confirms that source code escrow with clearly defined release conditions is the standard mechanism for protecting the operational continuity of customers dependent on a SaaS vendor's proprietary technology. In the event of a Clearpoint bankruptcy, the SaaS Subscription Agreement would be treated as an executory contract subject to assumption or rejection under Section 365 of the Bankruptcy Code. If rejected, Quorum could lose access to the ClaimsIQ™ platform entirely. The escrow release provisions and post-release license must be drafted to survive rejection of the SaaS Agreement as an executory contract and to be enforceable notwithstanding the automatic stay provisions of Section 362 of the Bankruptcy Code. We will work with Granite Trust's counsel to ensure that the escrow agreement addresses these bankruptcy-specific considerations.
The cost of the escrow arrangement ($2,250 per year to Quorum, or $11,250 over the five-year term) is de minimis relative to the $7,000,000 TCV and the value of the business continuity protection it provides.
Issue 7: Change-of-Control and Assignment Provisions
Priority: HIGH
A. Current Form Position. Section 13.4 of the Form Agreement addresses assignment with a permissive approach that is inadequate to protect Quorum's interests:
• Either party may assign the Agreement upon thirty (30) days' prior written notice to the other party, without requiring the other party's consent.
• There are no specific change-of-control provisions. The Agreement does not address the scenario in which Clearpoint is acquired by, merges with, or sells substantially all of its assets to a third party.
B. Recommended Negotiation Position. We recommend the following revisions:
1. Anti-Assignment. Neither party may assign, delegate, or otherwise transfer the Agreement or any rights or obligations thereunder without the other party's prior written consent, which shall not be unreasonably withheld, conditioned, or delayed; provided, however, that:
(a) Quorum may assign the Agreement without Clearpoint's consent to (i) any affiliate of Quorum, (ii) any successor entity in connection with a merger, consolidation, or reorganization involving Quorum, or (iii) any purchaser of all or substantially all of Quorum's assets or the business unit to which the Agreement relates.
(b) Clearpoint may not assign the Agreement without Quorum's prior written consent, including in connection with a merger, acquisition, or sale of substantially all assets.
2. Change-of-Control Trigger. If Clearpoint undergoes a Change of Control (as defined below), Quorum shall have the right, exercisable in its sole discretion, to terminate the Agreement upon ninety (90) days' written notice without penalty, early termination fee, or other liability, and shall be entitled to receive a pro-rata refund of all prepaid and unused subscription fees.
3. Definition of "Change of Control." For purposes of this provision, "Change of Control" means any of the following:
(a) Any transaction or series of related transactions resulting in a change of more than fifty percent (50%) of the voting power or equity interests of Clearpoint;
(b) A merger, consolidation, or similar business combination in which Clearpoint is not the surviving entity, or in which Clearpoint is the surviving entity but the equity holders of Clearpoint immediately prior to such transaction hold less than fifty percent (50%) of the voting power of the surviving entity;
(c) A sale, lease, exclusive license, or other transfer of all or substantially all of the assets of Clearpoint.
4. Notice. Clearpoint shall provide Quorum with written notice of any Change of Control no later than thirty (30) days prior to the closing of such transaction. Quorum's termination right shall be exercisable within one hundred twenty (120) days following receipt of such notice or, if no notice is provided, within one hundred twenty (120) days following the date on which Quorum becomes aware of the Change of Control.
C. Risk Assessment. This provision is particularly relevant given the ownership structure of Clearpoint. Ridgeway Capital Partners, LP holds approximately 62% of Clearpoint's equity following the October 2022 Series C financing. Ridgeway is a growth-equity fund, and such funds typically seek a return on investment through a liquidity event — most commonly a sale to a strategic acquirer or a secondary sale — within a three-to-seven-year time horizon. Given that the Series C closed less than eighteen months ago, it is reasonable to anticipate that Ridgeway may pursue a liquidity event at some point during the five-year term of the proposed Agreement.
A sale of Clearpoint to a competitor of Quorum — for example, another P&C insurer or an InsurTech company that competes with Quorum — could create an untenable situation in which Quorum's competitively sensitive claims data is controlled by an adverse party. Similarly, a sale to an acquirer with inferior data-security practices or to a foreign entity that may not be subject to the same regulatory framework could create unacceptable data-security and regulatory risk.
Without a change-of-control termination right, Quorum would be contractually bound to the platform for the remainder of the five-year term regardless of the identity of the new owner. This is a risk that Quorum should not accept.
The asymmetry in the assignment provision — permitting Quorum to assign freely in connection with a corporate transaction while requiring Clearpoint to obtain consent — reflects the reality that Quorum, as the customer and the party entrusting sensitive data to Clearpoint, has a legitimate and heightened interest in controlling the identity of its service provider. This asymmetry is common and commercially accepted in enterprise SaaS agreements involving regulated customers.
Issue 8: Subprocessor Consent Rights
Priority: MODERATE
A. Current Form Position. Section 3.4 of the Form Agreement and the draft Data Processing Addendum (Exhibit C) address subprocessors as follows:
• Clearpoint may engage subprocessors at its sole discretion, without requiring Quorum's consent.
• Clearpoint is obligated to provide notice to Quorum of new subprocessors within a "reasonable time" — a vague and undefined standard that could permit after-the-fact notification or notification that does not allow meaningful review.
• The current subprocessor list (disclosed informally during pre-contract discussions, but not formally attached to the Agreement) includes two identified subprocessors:
(a) Cobalt Cloud Infrastructure, Inc., located at 500 Terry Francine Street, San Jose, California 95128 — providing Infrastructure-as-a-Service (IaaS) hosting for the ClaimsIQ™ platform; and
(b) Redline Document AI, LLC — providing optical character recognition (OCR) processing services for claims documents ingested into the platform.
• The Form Agreement does not provide Quorum with any right to object to or approve new subprocessors.
• There is no explicit statement that Clearpoint remains liable for the acts and omissions of its subprocessors.
B. Recommended Negotiation Position. We recommend the following revisions:
1. Subprocessor List. Clearpoint must maintain a current and complete list of all subprocessors, including the name, address, and description of services provided by each subprocessor. This list must be formally disclosed as part of the DPA (Exhibit C) and updated upon any change.
2. Advance Notice. Clearpoint must provide Quorum at least thirty (30) days' advance written notice before engaging any new subprocessor or before materially changing the role, scope of services, or data access of an existing subprocessor. Such notice shall identify the proposed subprocessor, describe the services to be performed, identify the categories of Customer Data to which the subprocessor will have access, and confirm that the subprocessor has agreed to data-protection obligations at least as protective as those in the DPA.
3. Objection Right. Quorum shall have the right to object to any proposed new subprocessor within the thirty (30)-day notice period on reasonable grounds related to data security, data privacy, regulatory compliance, or the subprocessor's financial stability or reputation. If Quorum objects:
(a) The parties shall engage in good-faith discussions for a period of fifteen (15) business days to attempt to resolve the objection, which may include Clearpoint's proposal of an alternative subprocessor or the imposition of additional contractual safeguards.
(b) If the objection is not resolved within the fifteen (15)-business-day period, Quorum may terminate the affected services (i.e., the services that would involve the proposed subprocessor) without penalty and receive a pro-rata refund of prepaid fees for the terminated services.
4. Subprocessor Liability. The Agreement shall expressly state that Clearpoint remains fully liable for the acts and omissions of its subprocessors as if such acts and omissions were performed by Clearpoint itself. Clearpoint's engagement of a subprocessor shall not relieve Clearpoint of any of its obligations under the Agreement or the DPA.
5. Flow-Down Obligations. Clearpoint shall ensure that each subprocessor is bound by written agreements imposing data-protection obligations at least as protective as those in the DPA, including obligations related to data security, confidentiality, data minimization, and incident notification.
C. Risk Assessment. Quorum's Customer Data — including policyholder PII and PHI — will flow through Clearpoint's subprocessors as part of the ClaimsIQ™ platform's normal operations. Under the CTDPA, HIPAA, and the NAIC Insurance Data Security Model Law, Quorum remains accountable for the security and privacy of data handled by downstream processors and subprocessors. This accountability cannot be delegated by contract; it is imposed by law.
Cobalt Cloud Infrastructure hosts the ClaimsIQ™ platform and therefore has access to all Customer Data at rest and in transit. Redline Document AI processes claims documents via OCR, which involves direct handling of sensitive claims data, including potentially PHI in workers' compensation claims. Both subprocessors must be subject to robust contractual flow-down obligations, and Quorum must retain the ability to conduct due diligence on any new subprocessors before its data is entrusted to them.
The thirty (30)-day objection period — replacing the Form Agreement's vague "reasonable time" notice provision — provides Quorum with a meaningful opportunity to evaluate proposed subprocessors' security practices, financial stability, and regulatory compliance posture. This is particularly important given the rapidly evolving landscape of AI and data-processing services, where new subprocessors may present novel risks not contemplated at the time of contract execution.
Issue 9: Regulatory Compliance Carve-Outs (CTDPA, HIPAA, NAIC)
Priority: CRITICAL
A. Current Form Position. The Form Agreement's approach to regulatory compliance is generic and wholly inadequate for a customer operating in the regulated insurance industry:
• Section 10.2 contains a general representation that each party will comply with "all applicable laws" in the performance of its obligations under the Agreement. This boilerplate representation contains no specific reference to insurance regulatory requirements, data-privacy laws, or health information regulations.
• The Form Agreement does not include or reference a HIPAA Business Associate Agreement (BAA). Given that Quorum's workers' compensation lines involve PHI that will be processed through ClaimsIQ™, the absence of a BAA is a significant compliance gap.
• There is no reference to the Connecticut Data Privacy Act (CTDPA), which became effective on July 1, 2023, and which imposes specific obligations on data processors that process the personal data of Connecticut residents.
• There is no reference to the NAIC Insurance Data Security Model Law, which has been adopted in Connecticut and which imposes affirmative obligations on licensed insurers to oversee the information security practices of their third-party service providers.
• The Form Agreement does not acknowledge that Quorum is a regulated insurance entity subject to examination by the Connecticut Insurance Department and other state insurance regulators, and that Quorum's vendor relationships are subject to regulatory scrutiny.
B. Recommended Negotiation Position. We recommend that the DPA (Exhibit C) and the body of the Agreement be revised to specifically and comprehensively address the following regulatory frameworks:
1. Connecticut Data Privacy Act (CTDPA). The DPA must be revised to reflect Clearpoint's obligations as a "processor" under the CTDPA (Conn. Gen. Stat. § 42-520 et seq.), including:
(a) Data Minimization: Clearpoint shall process Customer Data only as necessary to perform its obligations under the Agreement and shall not process Customer Data for any purpose not expressly authorized by Quorum.
(b) Purpose Limitation: Clearpoint shall not process Customer Data for purposes beyond those specified in the Agreement without Quorum's prior written instruction.
(c) Data Protection Assessments: Clearpoint shall cooperate with and provide all information reasonably necessary for Quorum to conduct data protection assessments as required by the CTDPA.
(d) Consumer Rights Facilitation: Clearpoint shall provide commercially reasonable assistance to Quorum in responding to consumer requests to exercise their rights under the CTDPA, including rights of access, deletion, correction, and data portability.
(e) Data Processing Instructions: Clearpoint shall process Customer Data only in accordance with Quorum's documented instructions. If Clearpoint believes that any instruction from Quorum would violate the CTDPA or other applicable law, Clearpoint shall promptly notify Quorum.
2. HIPAA. To the extent that Clearpoint processes PHI in connection with Quorum's workers' compensation lines (and potentially other lines of business involving health-related claims), a Business Associate Agreement (BAA) must be incorporated into or referenced by the Agreement. The BAA must include, at minimum:
(a) A description of the permitted uses and disclosures of PHI by Clearpoint, limited to those necessary to perform its obligations under the Agreement.
(b) Clearpoint's agreement to implement administrative, physical, and technical safeguards in accordance with the HIPAA Security Rule (45 C.F.R. Part 160 and Subparts A and C of Part 164).
(c) Clearpoint's obligation to report any use or disclosure of PHI not permitted by the BAA, including any security incident or breach of unsecured PHI, within the timeframes specified in the Agreement's incident notification provisions (which we recommend be set at 24 hours, as discussed in Section IV.D below).
(d) Clearpoint's agreement to make its internal practices, books, and records relating to the use and disclosure of PHI available to the Secretary of the U.S. Department of Health and Human Services for purposes of determining Quorum's compliance with HIPAA.
(e) At termination, Clearpoint's obligation to return or destroy all PHI in its possession and to certify such return or destruction.
3. NAIC Insurance Data Security Model Law (as adopted in Connecticut). The Agreement and DPA must address Clearpoint's obligations under Connecticut's version of the NAIC Insurance Data Security Model Law (Conn. Gen. Stat. § 38a-38 et seq.), including:
(a) Information Security Program: Clearpoint must maintain a comprehensive written information security program that is consis

PRIVILEGED AND CONFIDENTIAL — ATTORNEY-CLIENT COMMUNICATION ATTORNEY WORK PRODUCT

MEMORANDUM

Record

Parties

Dates

Amounts