1025-00009 · Calderwood & Harkness LLP · Transaction Documents

saas-subscription-agreement-execution.docx DOCUMENT M&A / Corporate

11 / 12 ← → ✕

Contract analysis Extract to table

ENTERPRISE SAAS SUBSCRIPTION AGREEMENT

Execution Version

April 26, 2024

by and between

QUORUM INSURANCE HOLDINGS CORP.

and

CLEARPOINT ANALYTICS, INC.

ClaimsIQ™ Platform

ENTERPRISE SAAS SUBSCRIPTION AGREEMENT

Right-click to update Table of Contents

PREAMBLE

This Enterprise SaaS Subscription Agreement (this "Agreement") is entered into as of April 26, 2024 (the "Effective Date"), by and between:

QUORUM INSURANCE HOLDINGS CORP., a corporation duly organized and existing under the laws of the State of Delaware, with its principal offices located at 280 Constitution Plaza, Suite 1400, Hartford, Connecticut 06103 (hereinafter referred to as "Licensee," "Quorum," or "Customer"), a publicly traded company whose common stock is listed on the Nasdaq Stock Market under the ticker symbol "QIHC"; and

CLEARPOINT ANALYTICS, INC., a corporation duly organized and existing under the laws of the State of Delaware, with its principal offices located at 200 South Wacker Drive, Suite 3100, Chicago, Illinois 60606 (hereinafter referred to as "Licensor," "Clearpoint," or "Provider"), a privately held corporation founded in 2017.

Licensee and Licensor are each referred to individually as a "Party" and collectively as the "Parties."

RECITALS

WHEREAS, Clearpoint develops and operates the ClaimsIQ™ platform, a cloud-hosted, artificial-intelligence-driven claims triage, fraud detection, and analytics software-as-a-service ("SaaS") solution designed for the insurance industry;

WHEREAS, Quorum desires to subscribe to the ClaimsIQ™ platform for enterprise-wide deployment across its property and casualty and specialty lines subsidiaries, including Quorum Property & Casualty Insurance Company, Quorum Specialty Underwriters, Inc., and Quorum Digital Solutions LLC, for the purpose of enhancing Quorum's claims administration, triage, fraud detection, and analytics capabilities;

WHEREAS, the Parties desire to set forth the terms and conditions governing Quorum's subscription to and use of the ClaimsIQ™ platform, including matters relating to data ownership, intellectual property, confidentiality, security, indemnification, and related matters; and

WHEREAS, the Parties have negotiated the terms set forth herein and in the Exhibits attached hereto and incorporated herein by reference, and desire to memorialize their agreement in this definitive instrument;

NOW, THEREFORE, in consideration of the mutual covenants, agreements, representations, and warranties set forth herein, and for other good and valuable consideration, the receipt and sufficiency of which are hereby acknowledged, the Parties hereby agree as follows:

ARTICLE 1 — DEFINITIONS

As used in this Agreement, the following terms shall have the meanings set forth below. Capitalized terms used but not defined in this Article 1 shall have the meanings ascribed to them elsewhere in this Agreement or the applicable Exhibit.

1.1 "Affiliate" means, with respect to any Party, any entity that directly or indirectly controls, is controlled by, or is under common control with such Party. For purposes of this definition, "control" means the direct or indirect ownership of more than fifty percent (50%) of the voting securities or equivalent ownership interest of an entity, or the power to direct or cause the direction of the management and policies of such entity, whether through ownership of voting securities, by contract, or otherwise. Without limiting the generality of the foregoing, the Licensee Affiliates shall specifically include: (a) Quorum Property & Casualty Insurance Company, a Connecticut-domiciled insurance company; (b) Quorum Specialty Underwriters, Inc., a Delaware corporation; and (c) Quorum Digital Solutions LLC, a Delaware limited liability company.

1.2 "Aggregated Data" means de-identified, aggregated statistical data derived from Customer Data that has been processed in such a manner that it cannot reasonably be used, either alone or in combination with other data available to Licensor, to identify any individual, policyholder, claimant, or Customer, or to reconstruct any individual record contained in Customer Data.

1.3 "Annual Contract Value" or "ACV" means the annual subscription fee payable by Licensee to Licensor for access to and use of the Platform. The ACV for Year 1 of the Initial Term shall be One Million Four Hundred Thousand Dollars ($1,400,000). The ACV for Years 2 through 5 of the Initial Term shall be subject to adjustment pursuant to the CPI Escalator as set forth in Section 3.2.

1.4 "Authorized Users" means those individual employees, contractors, and agents of Licensee and its Affiliates who are designated by Licensee as named users of the Platform, up to a maximum of one thousand two hundred (1,200) named users at any given time, unless additional users are authorized pursuant to Section 2.2.

1.5 "ClaimsIQ™ Platform" or "Platform" means the proprietary cloud-hosted SaaS platform developed, owned, and operated by Clearpoint, as more fully described in Exhibit A (Statement of Work / Service Description), including all updates, upgrades, patches, and enhancements thereto made generally available by Clearpoint to its customers during the Subscription Term.

1.6 "Confidential Information" means all non-public information disclosed by or on behalf of one Party (the "Disclosing Party") to the other Party (the "Receiving Party"), whether in written, oral, electronic, visual, or other form, that is designated as confidential, proprietary, or by its nature would reasonably be understood to be confidential. Confidential Information includes, without limitation: (a) all technical information, including software code, algorithms, models, architectures, system designs, specifications, and documentation; (b) all business information, including financial data, projections, business plans, marketing strategies, customer lists, pricing information, and operational information; (c) Customer Data; and (d) the terms and conditions of this Agreement, including all pricing, payment terms, and commercial terms. Confidential Information shall not include information that falls within the exceptions set forth in Section 6.2.

1.7 "CPI Escalator" means the annual adjustment to the ACV for Years 2 through 5 of the Initial Term, calculated based on the percentage change in the Consumer Price Index for All Urban Consumers (CPI-U), U.S. City Average, All Items, Not Seasonally Adjusted, as published by the Bureau of Labor Statistics of the United States Department of Labor, for the twelve (12)-month period ending on the last day of the calendar month that is three (3) months prior to the applicable Subscription Anniversary, subject to the cap and floor provisions set forth in Section 3.2.

1.8 "Customer Data" means all data, information, content, records, and materials submitted to, uploaded to, processed by, stored on, or generated through the Platform by or on behalf of Licensee or its Affiliates or their respective Authorized Users, including, without limitation: (a) insurance claims data; (b) policyholder personally identifiable information ("PII"); (c) protected health information ("PHI") as defined under the Health Insurance Portability and Accountability Act of 1996, as amended ("HIPAA"); (d) adjuster notes, assessments, and work product; (e) all outputs, reports, analyses, scores, and recommendations generated by the Platform from the processing of any of the foregoing data; and (f) any metadata associated with any of the foregoing.

1.9 "Data Processing Addendum" or "DPA" means the Data Processing Addendum attached hereto as Exhibit C and incorporated herein by reference.

1.10 "Deliverables" means the services, configurations, integrations, and work products to be provided by Licensor as described in the Statement of Work attached hereto as Exhibit A.

1.11 "Documentation" means the user manuals, technical specifications, administrator guides, online help materials, knowledge base articles, release notes, and other written or electronic materials provided or made available by Licensor that describe the features, functionality, and operation of the Platform.

1.12 "Effective Date" has the meaning set forth in the Preamble of this Agreement: April 26, 2024.

1.13 "Exhibits" means, collectively: (a) Exhibit A (Statement of Work / Service Description); (b) Exhibit B (Service Level Agreement); (c) Exhibit C (Data Processing Addendum); and (d) Exhibit D (Security Requirements), each of which is attached hereto and incorporated herein by reference.

1.14 "Initial Term" has the meaning set forth in Section 10.1.

1.15 "intellectual Property Rights" means all intellectual property rights of any kind, whether registered or unregistered, including: (a) patents, patent applications, and patent rights; (b) copyrights, copyright registrations, and copyright applications; (c) trademarks, service marks, trade names, trade dress, and associated goodwill; (d) trade secrets and other proprietary rights in confidential information; (e) database rights; (f) rights in domain names and URLs; and (g) all other intellectual property rights and equivalent or similar forms of protection existing anywhere in the world.

1.16 "Licensor Technology" means the Platform, the Documentation, and all underlying technology, algorithms, machine-learning models, artificial-intelligence engines, software code (including source code and object code), frameworks, tools, libraries, application programming interfaces ("APIs"), data structures, databases (excluding Customer Data), user interfaces, and other technology owned by or licensed to Licensor that is used in or forms part of the Platform.

1.17 "Monthly Subscription Fee" means the ACV divided by twelve (12). For Year 1 of the Initial Term, the Monthly Subscription Fee shall be One Hundred Sixteen Thousand Six Hundred Sixty-Seven Dollars ($116,667), rounded to the nearest dollar.

1.18 "Scheduled Maintenance" means planned maintenance windows during which the Platform may be unavailable, as more fully defined and described in Exhibit B (Service Level Agreement).

1.19 "Service Credits" means the credits to Licensee's account calculated and applied in accordance with the terms and procedures set forth in Exhibit B (Service Level Agreement).

1.20 "Service Level Agreement" or "SLA" means the service level agreement attached hereto as Exhibit B and incorporated herein by reference.

1.21 "Subprocessor" means any third party engaged by Licensor to process Customer Data on Licensor's behalf in connection with Licensor's performance of its obligations under this Agreement.

1.22 "Subscription Anniversary" means each annual anniversary of the Effective Date during the Subscription Term.

1.23 "Subscription Term" means the Initial Term and any Renewal Terms, collectively.

1.24 "Total Contract Value" or "TCV" means the aggregate subscription fees payable by Licensee over the Initial Term, estimated at Seven Million Dollars ($7,000,000), subject to adjustment based on the CPI Escalator and any applicable overage fees.

ARTICLE 2 — SUBSCRIPTION LICENSE GRANT

2.1 Grant of License. Subject to the terms and conditions of this Agreement and Licensee's timely payment of all applicable fees, Clearpoint hereby grants to Quorum, during the Subscription Term, a non-exclusive, non-transferable (except as expressly provided in Section 14.6), worldwide right and license to access and use the ClaimsIQ™ Platform, including the Documentation, solely for Quorum's and its Affiliates' internal business purposes in connection with the administration, triage, fraud detection, scoring, analysis, and analytics of insurance claims across Quorum's property and casualty, specialty lines, and workers' compensation insurance operations. The license granted herein extends to Quorum Property & Casualty Insurance Company, Quorum Specialty Underwriters, Inc., and Quorum Digital Solutions LLC as Licensee Affiliates, each of which shall be entitled to access and use the Platform on the same terms and conditions as Licensee, provided that Licensee shall remain primarily responsible for its Affiliates' compliance with the terms of this Agreement and the aggregate number of Authorized Users across Licensee and all Affiliates shall not exceed the limits specified in Section 2.2 (unless overage fees are applicable). The license granted under this Section 2.1 includes the right to access and use the Platform via web browser, mobile application, and API integrations as described in Exhibit A.

2.2 Authorized Users.

(a) Licensee is authorized to designate up to one thousand two hundred (1,200) named users as Authorized Users across Licensee and its Affiliates, collectively. Authorized Users may include claims adjusters, claims supervisors, fraud investigators, underwriters, actuaries, IT administrators, data analysts, and other personnel designated by Licensee.

(b) Authorized Users may access the Platform from Licensee's three (3) primary claims-processing locations: (i) Hartford, Connecticut (280 Constitution Plaza, Suite 1400, Hartford, CT 06103); (ii) Dallas, Texas (2300 North Field Street, Suite 700, Dallas, TX 75201); and (iii) Jacksonville, Florida (501 Riverside Avenue, Suite 1100, Jacksonville, FL 32202). In addition, Authorized Users designated as field adjusters or remote-access users may access the Platform remotely from any location within the United States, subject to compliance with all applicable security requirements set forth in Exhibit D.

(c) If the number of named users designated by Licensee or its Affiliates exceeds one thousand two hundred (1,200) at any time during a calendar quarter, Licensee shall pay an overage fee of One Hundred Fifty Dollars ($150.00) per additional user per month for each named user in excess of one thousand two hundred (1,200), as further set forth in Section 3.3.

(d) Licensee shall be responsible for ensuring that each Authorized User complies with the terms of this Agreement, including all restrictions on use set forth in Section 2.3, and shall be liable for any breach of this Agreement caused by an Authorized User's acts or omissions. Licensee shall implement reasonable controls to prevent unauthorized access to the Platform, including the assignment of unique login credentials to each Authorized User and the prompt deactivation of credentials for users who are no longer authorized.

2.3 Restrictions on Use. Except as expressly permitted by this Agreement, Licensee shall not, and shall not permit any Authorized User or third party to:

(a) reverse engineer, decompile, disassemble, or otherwise attempt discover the source code, object code, algorithms, or underlying structure of the Platform, except to the extent expressly permitted by applicable law notwithstanding this restriction;

(b) sublicense, rent, lease, loan, sell, resell, distribute, or otherwise make the Platform available to any third party, except to Affiliates as expressly provided in Section 2.1;

(c) use the Platform for any purpose other than the internal business purposes described in Section 2.1, or for any purpose that is unlawful, fraudulent, or prohibited by this Agreement;

(d) remove, alter, obscure, or deface any proprietary notices, labels, trademarks, logos, or identification marks appearing on or within the Platform or the Documentation;

(e) use the Platform, the Documentation, or any information or data obtained through the Platform to develop, market, sell, or distribute any product, service, or technology that competes with or is substantially similar to the Platform or any component thereof;

(f) use the Platform in any manner that could damage, disable, overburden, or impair the Platform or interfere with any other party's use of the Platform;

(g) introduce any virus, worm, Trojan horse, malware, or other harmful code into the Platform; or

(h) access or use the Platform in a manner that violates any applicable law, regulation, or industry standard.

2.4 Platform Availability and Support. Licensor shall make the Platform available to Licensee and its Authorized Users in accordance with the uptime and availability commitments set forth in the SLA (Exhibit B). Licensor shall provide technical support to Licensee during the standard support hours specified in Exhibit B, in accordance with the support tiers, response times, and escalation procedures described therein. In the event that Platform availability falls below the service levels specified in Exhibit B, Licensee shall be entitled to Service Credits as calculated and applied in accordance with Exhibit B. Scheduled Maintenance windows shall be conducted in accordance with Exhibit B and shall not be counted against uptime calculations except as expressly provided therein.

ARTICLE 3 — FEES AND PAYMENT

3.1 Subscription Fees.

(a) The Annual Contract Value for Year 1 of the Initial Term shall be One Million Four Hundred Thousand Dollars ($1,400,000.00). The estimated Total Contract Value over the five (5)-year Initial Term shall be Seven Million Dollars ($7,000,000.00), subject to adjustment based on the CPI Escalator as set forth in Section 3.2.

(b) Subscription fees shall be payable in annual installments in advance. The Year 1 subscription fee of One Million Four Hundred Thousand Dollars ($1,400,000.00) shall be due and payable upon execution of this Agreement. Subscription fees for each subsequent year of the Initial Term shall be due and payable within thirty (30) days of each Subscription Anniversary.

(c) For the avoidance of doubt, subscription fees are non-refundable except as expressly provided in this Agreement, including, without limitation, refunds payable upon termination pursuant to Sections 10.4 and 14.6.

3.2 CPI Escalator.

(a) The ACV for Years 2 through 5 of the Initial Term shall be subject to an annual adjustment based on the CPI Escalator, calculated as follows: the ACV for the immediately preceding year shall be multiplied by one (1) plus the percentage change in the CPI-U for the applicable measurement period, subject to the cap and floor provisions set forth in this Section 3.2.

(b) The CPI Escalator shall be capped at three and one-half percent (3.5%) per annum. In no event shall the annual increase in the ACV exceed three and one-half percent (3.5%) of the prior year's ACV, regardless of the actual percentage change in the CPI-U. If the published CPI-U increase for the applicable measurement period is less than three and one-half percent (3.5%), the actual CPI-U percentage change shall be applied to determine the ACV for the succeeding year.

(c) By way of illustration and without limitation: (i) the maximum ACV for Year 2 shall be One Million Four Hundred Forty-Nine Thousand Dollars ($1,449,000.00) ($1,400,000.00 × 1.035); (ii) the maximum ACV for Year 3 shall be One Million Four Hundred Ninety-Nine Thousand Seven Hundred Fifteen Dollars ($1,499,715.00) ($1,449,000.00 × 1.035); (iii) the maximum ACV for Year 4 shall be One Million Five Hundred Fifty-Two Thousand Two Hundred Five Dollars ($1,552,205.03) ($1,499,715.00 × 1.035); and (iv) the maximum ACV for Year 5 shall be approximately One Million Six Hundred Seven Thousand Five Hundred Twenty-Three Dollars ($1,607,532.20) ($1,552,205.03 × 1.035).

(d) If the CPI-U for the applicable measurement period reflects a decrease (i.e., the CPI-U is negative), the ACV shall remain unchanged from the prior year's ACV. In no event shall the ACV for any year be less than the ACV for the immediately preceding year.

(e) Licensor shall provide Licensee with written notice of the adjusted ACV for the upcoming year no later than sixty (60) days prior to the applicable Subscription Anniversary, together with supporting documentation reflecting the applicable CPI-U data.

3.3 Overage Fees.

(a) If the number of named users designated by Licensee or its Affiliates exceeds one thousand two hundred (1,200) at any time during a calendar quarter, Licensee shall pay an overage fee of One Hundred Fifty Dollars ($150.00) per additional user per month for each named user in excess of one thousand two hundred (1,200).

(b) Overage fees shall be calculated based on the peak number of named users during the applicable calendar quarter and shall be invoiced quarterly in arrears. Licensor shall provide Licensee with a detailed user-count report accompanying each overage invoice, identifying the peak usage date and the number of users in excess of the authorized limit.

3.4 Invoicing and Payment Terms.

(a) All invoices issued by Licensor under this Agreement shall be payable within thirty (30) days of the date of invoice. Invoices shall be sent electronically to the attention of Licensee's accounts payable department at the address specified in Section 14.1 or to such other address as Licensee may designate in writing.

(b) Any undisputed amounts not paid when due shall accrue interest at the lesser of one and one-half percent (1.5%) per month or the maximum rate permitted by applicable law, calculated from the date such payment was due until the date of actual payment.

(c) Licensee shall have no right of offset or deduction against amounts owed under this Agreement, except for undisputed Service Credits to which Licensee is entitled under Exhibit B (Service Level Agreement). In the event of a good-faith dispute regarding any invoiced amount, Licensee shall pay all undisputed amounts when due and shall provide Licensor with written notice of the disputed amount and the basis for such dispute within thirty (30) days of the invoice date. The Parties shall negotiate in good faith to resolve any billing disputes promptly.

3.5 Taxes.

(a) All fees stated in this Agreement are exclusive of all applicable sales, use, value-added, excise, withholding, and other taxes, levies, duties, and assessments of any kind imposed by any governmental authority (collectively, "Taxes"). Licensee shall be responsible for and shall pay all Taxes arising from or in connection with this Agreement, except for taxes imposed on Licensor's net income, gross receipts (to the extent measured by Licensor's income), franchise taxes, or similar taxes based on Licensor's overall financial performance.

(b) If Licensee is required by applicable law to withhold any Taxes from amounts payable to Licensor, Licensee shall promptly notify Licensor and shall gross up the payment so that Licensor receives the full amount that would have been due absent such withholding, unless Licensor provides a valid exemption certificate or other documentation establishing that no withholding is required.

ARTICLE 4 — CUSTOMER DATA OWNERSHIP AND RIGHTS

4.1 Ownership of Customer Data. As between the Parties, Quorum retains sole and exclusive ownership of all right, title, and interest in and to all Customer Data, including, without limitation, all insurance claims data, policyholder PII, PHI, adjuster notes, work product, and all outputs, reports, analyses, scores, and recommendations generated by the Platform from the processing of Customer Data. Nothing in this Agreement shall be construed to transfer, assign, or convey to Clearpoint any right, title, or interest in or to Customer Data, except for the limited processing rights expressly granted to Clearpoint pursuant to Section 4.2. Clearpoint acknowledges that Customer Data constitutes the Confidential Information of Quorum and is subject to the confidentiality obligations set forth in Article 6.

4.2 License to Process Customer Data. Quorum hereby grants to Clearpoint a limited, non-exclusive, non-transferable, non-sublicensable (except to approved Subprocessors as set forth in Section 12.5) license to access, use, process, transmit, and store Customer Data solely to the extent necessary for Clearpoint to: (a) provide the Platform and perform its obligations under this Agreement; (b) comply with the terms of the DPA (Exhibit C); and (c) comply with applicable law. This license shall terminate automatically upon the expiration or termination of this Agreement, subject to the data export and destruction obligations set forth in Section 4.4. Clearpoint shall not process Customer Data for any purpose other than those expressly authorized by this Section 4.2 without Quorum's prior written consent.

4.3 Aggregated Data.

(a) Clearpoint may create Aggregated Data from Customer Data solely for the purpose of improving the Platform's features, functionality, algorithms, and machine-learning models, and for benchmarking and industry trend analysis. Clearpoint's right to create and use Aggregated Data is subject to compliance with all of the following conditions:

(i) Clearpoint shall comply with all applicable insurance data-privacy laws, regulations, and guidelines in creating and using Aggregated Data, including, without limitation, the Connecticut Data Privacy Act, HIPAA, and any applicable state insurance department regulations and guidance;

(ii) Clearpoint shall obtain Quorum's prior written consent before creating or using Aggregated Data from Customer Data, which consent shall not be unreasonably withheld, conditioned, or delayed; and

(iii) Clearpoint shall not attempt to re-identify any individual, policyholder, claimant, or Customer from Aggregated Data, and shall not sell, license, distribute, or otherwise make Aggregated Data available to any third party in any form that could reasonably be used, either alone or in combination with other available data, to identify Quorum, its policyholders, claimants, or any individual.

(b) Aggregated Data must be processed in a manner that ensures it cannot be attributed to or associated with Quorum, any Licensee Affiliate, or any individual. Clearpoint shall implement reasonable technical and organizational measures to ensure compliance with this requirement.

4.4 Data Portability.

(a) Upon the expiration or termination of this Agreement for any reason, Clearpoint shall, at no additional charge to Licensee, provide Licensee with a complete and accurate export of all Customer Data in Clearpoint's possession or control, in industry-standard, machine-readable formats, specifically including: (i) ACORD XML format; and (ii) comma-separated values (CSV) format. Clearpoint shall make reasonable efforts to accommodate Licensee's preferences regarding data export format, file structure, and delivery method.

(b) The data export described in Section 4.4(a) shall be completed within sixty (60) days of the effective date of expiration or termination of this Agreement. Clearpoint shall cooperate with Licensee and any successor service provider designated by Licensee to facilitate the orderly transition and migration of Customer Data.

(c) Within thirty (30) days following Licensee's written confirmation of receipt and verification of the completeness and accuracy of the exported Customer Data (or, if Licensee does not provide such confirmation, within ninety (90) days following the effective date of expiration or termination), Clearpoint shall: (i) permanently and securely delete or destroy all Customer Data in its possession, custody, or control, including all copies, backups, archives, and derivative datasets (excluding Aggregated Data that has been properly created in accordance with Section 4.3); and (ii) certify in writing, signed by an officer of Clearpoint, the destruction of all such Customer Data. Clearpoint shall cause all Subprocessors to perform the same destruction and certification with respect to Customer Data held by such Subprocessors.

4.5 Data Processing Addendum. The Data Processing Addendum attached hereto as Exhibit C is incorporated herein by reference and governs all processing of Customer Data by Clearpoint and its Subprocessors. In the event of any conflict or inconsistency between the provisions of this Agreement and the provisions of the DPA with respect to data processing, data protection, or data privacy matters, the provisions of the DPA shall prevail and control to the extent of such conflict or inconsistency.

ARTICLE 5 — INTELLECTUAL PROPERTY

5.1 Licensor IP. Clearpoint retains all right, title, and interest in and to the ClaimsIQ™ Platform, all Licensor Technology, the Documentation, and all improvements, modifications, enhancements, updates, upgrades, derivative works, and new versions thereof, whether developed independently by Clearpoint or resulting from Licensee's feedback or suggestions (collectively, "Licensor IP"), excluding Customer Data. Nothing in this Agreement shall be construed as a transfer, assignment, or conveyance of any ownership right in any Licensor IP to Quorum. The ClaimsIQ™ name and logo, and all related trademarks and service marks, are the exclusive property of Clearpoint, and Licensee shall acquire no rights therein except as expressly provided in this Agreement. To the extent that any improvement, modification, or derivative work of the Licensor Technology is created during the performance of this Agreement, all right, title, and interest in and to such improvement, modification, or derivative work shall vest exclusively in Clearpoint.

5.2 Licensee IP. Quorum retains all right, title, and interest in and to Customer Data, Quorum's proprietary systems, networks, databases, software, processes, trade secrets, trademarks, service marks, trade names, patents, copyrights, and all other pre-existing intellectual property of Quorum. Nothing in this Agreement shall be construed as a transfer, assignment, or conveyance of any ownership right in Quorum's pre-existing intellectual property to Clearpoint. Clearpoint acknowledges that it acquires no rights in Quorum's proprietary technology, brand, or intellectual property except the limited right to process Customer Data as expressly set forth in Section 4.2.

5.3 Feedback. If Quorum or any of its Authorized Users provides to Clearpoint any suggestions, enhancement requests, recommendations, corrections, feature requests, or other feedback regarding the Platform or the Documentation (collectively, "Feedback"), Clearpoint shall be free to use, incorporate, modify, distribute, and otherwise exploit such Feedback without restriction, obligation, or compensation of any kind to Quorum; provided, however, that such Feedback does not constitute Customer Data. Quorum hereby assigns to Clearpoint all right, title, and interest in and to any Feedback, and to the extent such assignment is ineffective under applicable law, Quorum hereby grants Clearpoint a perpetual, irrevocable, royalty-free, worldwide, fully sublicensable license to use and exploit such Feedback in any manner. Nothing in this Section 5.3 shall be construed to require Quorum to provide any Feedback.

ARTICLE 6 — CONFIDENTIALITY

6.1 Obligations. Each Party agrees to hold the Confidential Information of the other Party in strict confidence and to protect such Confidential Information using at least the same degree of care that such Party uses to protect its own Confidential Information of similar nature and sensitivity, but in no event less than reasonable care. Each Party shall use the other Party's Confidential Information solely for the purpose of performing its obligations or exercising its rights under this Agreement. Each Party shall restrict access to the other Party's Confidential Information to those of its employees, contractors, agents, Affiliates, advisors, auditors, and legal counsel who have a need to know such information in connection with this Agreement and who are bound by confidentiality obligations no less restrictive than those set forth in this Article 6. Each Party shall be responsible for any breach of this Article 6 by any person to whom it has disclosed the other Party's Confidential Information.

6.2 Exceptions. The obligations set forth in Section 6.1 shall not apply to information that the Receiving Party can demonstrate by competent evidence:

(a) is or becomes publicly available through no fault, act, or omission of the Receiving Party or any person to whom the Receiving Party has disclosed such information;

(b) was known to the Receiving Party prior to its disclosure by the Disclosing Party, without any obligation of confidentiality, as evidenced by the Receiving Party's written records;

(c) is independently developed by the Receiving Party without reference to or use of the Disclosing Party's Confidential Information, as evidenced by the Receiving Party's written records or other competent evidence; or

(d) is rightfully received by the Receiving Party from a third party that is not bound by any obligation of confidentiality with respect to such information.

6.3 Compelled Disclosure. If the Receiving Party is compelled by applicable law, regulation, subpoena, civil investigative demand, judicial or governmental order, or other legal process to disclose any Confidential Information of the Disclosing Party, the Receiving Party shall: (a) provide the Disclosing Party with prompt prior written notice of such compelled disclosure, to the extent legally permitted, so as to afford the Disclosing Party a reasonable opportunity to seek a protective order, injunction, or other appropriate remedy; and (b) cooperate with the Disclosing Party, at the Disclosing Party's expense, in seeking such protective order or remedy. If such protective order or other remedy is not obtained, the Receiving Party shall disclose only that portion of the Confidential Information that is legally required to be disclosed and shall use commercially reasonable efforts to ensure that the disclosed Confidential Information is treated confidentially by the recipient. Notwithstanding the foregoing, disclosures of Confidential Information required by insurance regulators, the U.S. Securities and Exchange Commission ("SEC"), the Nasdaq Stock Market, state insurance departments, or other governmental authorities with regulatory jurisdiction over Licensee or its Affiliates shall be permitted without obtaining a protective order, subject to the Receiving Party providing prompt written notice of such disclosure to the Disclosing Party (to the extent legally permitted).

6.4 Survival. The confidentiality obligations set forth in this Article 6 shall survive the expiration or termination of this Agreement for a period of five (5) years following the effective date of such expiration or termination. Notwithstanding the foregoing, with respect to Confidential Information that constitutes a trade secret under applicable law, the confidentiality obligations set forth herein shall continue for so long as such information remains a trade secret under applicable law, which period may be perpetual.

ARTICLE 7 — REPRESENTATIONS AND WARRANTIES

7.1 Mutual Representations. Each Party represents and warrants to the other Party as of the Effective Date that:

(a) it is duly organized, validly existing, and in good standing under the laws of its jurisdiction of incorporation or organization, and has all necessary corporate power and authority to conduct its business as currently conducted;

(b) it has full corporate power and authority to enter into this Agreement and to perform its obligations hereunder, and the execution, delivery, and performance of this Agreement have been duly authorized by all necessary corporate action;

(c) the execution and delivery of this Agreement and the performance of its obligations hereunder do not and will not conflict with, violate, or result in a breach of any provision of its organizational documents, any agreement to which it is a party or by which it is bound, or any applicable law, regulation, order, judgment, or decree; and

(d) this Agreement constitutes a legal, valid, and binding obligation of such Party, enforceable against such Party in accordance with its terms, subject to applicable bankruptcy, insolvency, reorganization, moratorium, fraudulent conveyance, and similar laws affecting creditors' rights generally, and subject to general principles of equity, whether considered in a proceeding in equity or at law.

7.2 Licensor Representations and Warranties. Clearpoint represents and warrants to Quorum that:

(a) the Platform will perform materially in accordance with the Documentation and the specifications set forth in Exhibit A during the Subscription Term, and any updates, upgrades, or modifications to the Platform made generally available by Clearpoint during the Subscription Term will not materially diminish the overall functionality of the Platform;

(b) the Platform and all services provided under this Agreement will be provided in a professional and workmanlike manner consistent with generally accepted industry standards for enterprise SaaS platforms serving the insurance industry;

(c) Clearpoint has and will maintain throughout the Subscription Term all rights, licenses, permissions, and authorizations necessary to grant the license set forth in Section 2.1 and to perform its obligations under this Agreement, free and clear of all liens, encumbrances, and restrictions;

(d) to Clearpoint's knowledge as of the Effective Date, the Platform does not infringe, misappropriate, or otherwise violate the intellectual Property Rights of any third party;

(e) Clearpoint will comply with all applicable laws, rules, and regulations in performing its obligations under this Agreement, including, without limitation, all applicable insurance regulatory requirements, data-privacy and data-protection laws, and anti-corruption laws;

(f) the Platform incorporates commercially reasonable security measures designed to protect Customer Data against unauthorized access, use, disclosure, alteration, and destruction, as more fully described in Exhibit D (Security Requirements); and

(g) Clearpoint's current SOC 2 Type II audit report, conducted by the independent certified public accounting firm of Hawthorne & Ellers, CPAs LLP, covering the period from April 1, 2023 through March 31, 2024, contains no material qualifications, exceptions, or findings of material deficiency relating to the Platform, its hosting infrastructure, or the security controls applicable to the processing of Customer Data. A copy of the executive summary of such report has been provided to Quorum prior to the Effective Date.

7.3 Licensee Representations and Warranties. Quorum represents and warrants to Clearpoint that:

(a) Quorum has all necessary rights, consents, permissions, and authorizations to provide Customer Data to Clearpoint for processing in accordance with this Agreement and the DPA, including, without limitation, all consents and authorizations required under applicable privacy and data-protection laws;

(b) Quorum's use of the Platform will at all times comply with applicable law and the terms and conditions of this Agreement; and

(c) Customer Data provided by Quorum to Clearpoint will not, to Quorum's knowledge, infringe, misappropriate, or otherwise violate the intellectual Property Rights or other proprietary rights of any third party.

7.4 Disclaimer. EXCEPT AS EXPRESSLY SET FORTH IN THIS ARTICLE 7, EACH PARTY DISCLAIMS ALL WARRANTIES, WHETHER EXPRESS, IMPLIED, STATUTORY, OR OTHERWISE, INCLUDING, WITHOUT LIMITATION, ALL IMPLIED WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, TITLE, AND NON-INFRINGEMENT, AND ALL WARRANTIES ARISING FROM COURSE OF DEALING, USAGE, OR TRADE PRACTICE. WITHOUT LIMITING THE FOREGOING, CLEARPOINT MAKES NO WARRANTY OF ANY KIND THAT THE PLATFORM WILL MEET LICENSEE'S REQUIREMENTS, OPERATE WITHOUT INTERRUPTION, ACHIEVE ANY INTENDED RESULT, BE COMPATIBLE WITH ANY OTHER SOFTWARE OR SYSTEM, OR BE ERROR-FREE. CLEARPOINT DOES NOT WARRANT THAT THE PLATFORM WILL DETECT ALL INSTANCES OF FRAUD OR PRODUCE RESULTS FREE OF FALSE POSITIVES OR FALSE NEGATIVES.

ARTICLE 8 — INDEMNIFICATION

8.1 Indemnification by Licensor. Clearpoint shall defend, indemnify, and hold harmless Quorum, its Affiliates, and their respective officers, directors, employees, agents, successors, and permitted assigns (collectively, the "Quorum Indemnitees") from and against any and all claims, demands, suits, actions, proceedings, investigations, judgments, awards, penalties, fines, damages, losses, liabilities, costs, and expenses (including reasonable attorneys' fees, expert fees, and court costs) (collectively, "Losses") arising out of or relating to any third-party claim:

(a) alleging that Quorum's authorized use of the ClaimsIQ™ Platform in accordance with this Agreement infringes, misappropriates, or otherwise violates any patent, copyright, trademark, trade secret, or other intellectual Property Right of any third party;

(b) arising from Clearpoint's breach of its data-security obligations under this Agreement, the DPA, or Exhibit D, or any unauthorized access to, use of, disclosure of, loss of, or destruction of Customer Data attributable to Clearpoint, its employees, agents, or Subprocessors; or

(c) arising from Clearpoint's violation of applicable law, including, without limitation, insurance regulatory requirements, data-privacy and data-protection laws, or anti-corruption laws, in connection with the performance of its obligations under this Agreement.

8.2 Indemnification by Licensee. Quorum shall defend, indemnify, and hold harmless Clearpoint, its officers, directors, employees, agents, successors, and permitted assigns (collectively, the "Clearpoint Indemnitees") from and against any and all Losses arising out of or relating to any third-party claim:

(a) alleging that Customer Data provided by Quorum to Clearpoint for processing in accordance with this Agreement infringes, misappropriates, or otherwise violates any patent, copyright, trademark, trade secret, or other intellectual Property Right or proprietary right of any third party; or

(b) arising from Quorum's use of the ClaimsIQ™ Platform in a manner that is outside the scope of the license granted under this Agreement or that violates applicable law.

8.3 Indemnification Procedures. The Parties' indemnification obligations under this Article 8 are subject to the following procedures:

(a) Notice. The indemnified party shall provide the indemnifying party with prompt written notice of any claim, demand, suit, or proceeding for which indemnification is sought, in no event later than fifteen (15) business days after the indemnified party becomes aware of such claim. A failure or delay in providing such notice shall not relieve the indemnifying party of its indemnification obligations, except to the extent the indemnifying party is materially prejudiced by such failure or delay.

(b) Control of Defense. The indemnifying party shall have the right, but not the obligation, to assume and control the defense of any such claim, at the indemnifying party's sole cost and expense, with counsel reasonably acceptable to the indemnified party. If the indemnifying party elects to assume the defense, the indemnified party shall cooperate in good faith with the indemnifying party and its counsel in the defense of such claim, at the indemnifying party's expense. If the indemnifying party does not assume the defense of any such claim within thirty (30) days of receiving notice thereof, the indemnified party may defend the claim at the indemnifying party's expense.

(c) Participation. The indemnified party may participate in the defense of any claim at its own expense with counsel of its choosing; provided, however, that the indemnifying party shall retain sole control of the defense and settlement of such claim.

(d) Settlement. The indemnifying party shall not settle, compromise, or consent to the entry of any judgment with respect to any claim for which indemnification is sought without the prior written consent of the indemnified party, which consent shall not be unreasonably withheld, conditioned, or delayed. In no event shall the indemnifying party agree to any settlement that: (i) imposes any obligation, restriction, or liability on the indemnified party (other than the payment of money, which the indemnifying party shall be obligated to pay); (ii) admits fault or wrongdoing by the indemnified party; or (iii) grants injunctive or other equitable relief against the indemnified party, without the indemnified party's prior written consent.

8.4 IP Infringement Remedies. If the Platform or any component thereof is the subject of an injunction or court order, or if Clearpoint reasonably believes that the Platform is likely to become the subject of a claim of infringement or misappropriation, Clearpoint shall, at its sole option and expense, promptly:

(a) procure for Quorum the right to continue using the Platform in accordance with the terms of this Agreement;

(b) modify or replace the infringing component of the Platform with a non-infringing alternative that is functionally equivalent in all material respects, without material degradation of Platform performance or capabilities; or

(c) if neither clause (a) nor clause (b) above is commercially practicable after Clearpoint's diligent and good-faith efforts, terminate the affected portion of this Agreement (or, if the infringement affects the entire Platform, terminate this Agreement in its entirety) and refund to Quorum a pro-rata portion of the subscription fees prepaid by Quorum for the remainder of the then-current subscription year, calculated from the effective date of such termination through the end of such subscription year.

8.5 Indemnification Cap.

(a) Clearpoint's aggregate liability for indemnification obligations under Section 8.1(a) (IP infringement) and Section 8.1(c) (violation of law) shall not exceed two times (2×) the Total Contract Value, which is Fourteen Million Dollars ($14,000,000).

(b) Clearpoint's indemnification obligations under Section 8.1(b) (data-breach indemnification) shall be uncapped.

(c) Quorum's aggregate liability for indemnification obligations under Section 8.2 shall not exceed one times (1×) the Total Contract Value, which is Seven Million Dollars ($7,000,000).

ARTICLE 9 — LIMITATION OF LIABILITY

9.1 General Liability Cap. EXCEPT AS SET FORTH IN SECTION 9.2 BELOW, EACH PARTY'S TOTAL AGGREGATE LIABILITY TO THE OTHER PARTY ARISING OUT OF OR RELATED TO THIS AGREEMENT, WHETHER ARISING IN CONTRACT, TORT (INCLUDING NEGLIGENCE), STRICT LIABILITY, OR ANY OTHER LEGAL OR EQUITABLE THEORY, SHALL NOT EXCEED ONE TIMES (1×) THE TOTAL CONTRACT VALUE, WHICH IS SEVEN MILLION DOLLARS ($7,000,000).

9.2 Exclusions from Cap. The limitation of liability set forth in Section 9.1 shall not apply to and shall not limit:

(a) Clearpoint's indemnification obligations for data-breach claims under Section 8.1(b), which are uncapped;

(b) Clearpoint's indemnification obligations for IP infringement under Section 8.1(a), which are subject to the separate cap of Fourteen Million Dollars ($14,000,000) as set forth in Section 8.5(a);

(d) either Party's liability for breach of its confidentiality obligations under Article 6 with respect to Customer Data; or

(e) Quorum's obligation to pay the subscription fees, overage fees, and other amounts due and payable under Article 3.

9.3 Exclusion of Consequential Damages. EXCEPT WITH RESPECT TO THE MATTERS EXCLUDED FROM THE LIMITATION OF LIABILITY PURSUANT TO SECTION 9.2, IN NO EVENT SHALL EITHER PARTY BE LIABLE TO THE OTHER PARTY OR TO ANY THIRD PARTY FOR ANY INDIRECT, INCIDENTAL, SPECIAL, CONSEQUENTIAL, EXEMPLARY, OR PUNITIVE DAMAGES OF ANY KIND, INCLUDING, WITHOUT LIMITATION, DAMAGES FOR LOSS OF PROFITS, LOSS OF REVENUE, LOSS OF DATA, LOSS OF BUSINESS OPPORTUNITIES, LOSS OF GOODWILL, COST OF PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES, OR INTERRUPTION OF BUSINESS, HOWEVER CAUSED AND REGARDLESS OF THE THEORY OF LIABILITY, WHETHER ARISING IN CONTRACT, TORT (INCLUDING NEGLIGENCE), STRICT LIABILITY, OR OTHERWISE, EVEN IF SUCH PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES OR COULD HAVE REASONABLY FORESEEN SUCH DAMAGES. NOTWITHSTANDING THE FOREGOING, THIS EXCLUSION OF CONSEQUENTIAL DAMAGES SHALL NOT LIMIT CLEARPOINT'S LIABILITY FOR DATA-BREACH INDEMNIFICATION UNDER SECTION 8.1(b).

ARTICLE 10 — TERM AND TERMINATION

10.1 Initial Term. This Agreement shall commence on the Effective Date and shall continue for a period of five (5) years, expiring on April 25, 2029, unless earlier terminated in accordance with the provisions of this Article 10 (the "Initial Term").

10.2 Renewal. Upon the expiration of the Initial Term, this Agreement shall automatically renew for successive one (1)-year periods (each, a "Renewal Term"), unless either Party provides the other Party with written notice of non-renewal at least one hundred eighty (180) days prior to the end of the then-current term (whether the Initial Term or any Renewal Term). The ACV for each Renewal Term shall be determined by application of the CPI Escalator as described in Section 3.2, calculated based on the ACV for the final year of the immediately preceding term. All terms and conditions of this Agreement shall apply during each Renewal Term with the same force and effect as during the Initial Term, unless otherwise agreed in writing by the Parties.

10.3 Termination for Cause. Either Party may terminate this Agreement upon written notice to the other Party if:

(a) the other Party materially breaches any provision of this Agreement and fails to cure such breach within thirty (30) days after receipt of written notice specifying the nature of the breach in reasonable detail; provided, however, that if such breach involves a technical remediation by Clearpoint (including, without limitation, security vulnerabilities, platform defects, or integration failures), the cure period shall be extended to sixty (60) days;

(b) the other Party: (i) becomes subject to a voluntary or involuntary petition in bankruptcy or any proceeding relating to insolvency, receivership, liquidation, reorganization, or composition for the benefit of creditors, and such petition or proceeding is not dismissed within sixty (60) days; (ii) makes a general assignment for the benefit of creditors; (iii) has a receiver, trustee, or similar officer appointed over all or a substantial portion of its assets; or (iv) becomes generally unable to pay its debts as they become due; or

10.4 Termination for Chronic SLA Failure. In addition to Quorum's rights under Section 10.3, Quorum may terminate this Agreement for cause upon written notice to Clearpoint if the Platform's monthly uptime, as measured in accordance with Exhibit B, falls below ninety-nine percent (99.0%) in any three (3) consecutive calendar months during the Subscription Term (a "Chronic SLA Failure"). Upon termination for Chronic SLA Failure, Quorum shall be entitled to receive a pro-rata refund of all prepaid and unused subscription fees, calculated from the effective date of termination through the end of the then-current subscription year.

10.5 Termination for Convenience. Quorum may terminate this Agreement for convenience, without cause, upon one hundred eighty (180) days' prior written notice to Clearpoint; provided, however, that no refund of prepaid subscription fees shall be due to Quorum upon termination for convenience, except as otherwise expressly provided in this Agreement. For the avoidance of doubt, Clearpoint shall not have the right to terminate this Agreement for convenience during the Initial Term.

10.6 Effects of Termination. Upon the expiration or termination of this Agreement for any reason:

(a) all license rights granted to Licensee under Section 2.1 and elsewhere in this Agreement shall immediately terminate, and Licensee shall promptly cease all use of the Platform;

(b) Licensee shall cease all access to the Platform within ten (10) business days of the effective date of expiration or termination, and Licensor shall disable Licensee's access credentials;

(d) all accrued and unpaid obligations of each Party, including, without limitation, Licensee's obligation to pay all fees due and payable for the period up to and including the effective date of expiration or termination, shall survive; and

(e) Clearpoint shall cooperate in good faith with Quorum and any successor service provider designated by Quorum to facilitate an orderly transition, including reasonable data migration assistance, knowledge transfer, and access to Clearpoint personnel for transition-related questions, for a period of up to ninety (90) days following the effective date of expiration or termination, at Clearpoint's then-current professional services rates.

10.7 Survival. The following provisions of this Agreement shall survive the expiration or termination of this Agreement for any reason and shall continue in full force and effect in accordance with their terms: Article 1 (Definitions), Article 4 (Customer Data Ownership and Rights), Article 5 (Intellectual Property), Article 6 (Confidentiality), Article 8 (Indemnification), Article 9 (Limitation of Liability), Article 13 (Governing Law and Dispute Resolution), Article 14 (General Provisions), and any other provision of this Agreement that by its nature or express terms is intended to survive expiration or termination. The expiration or termination of this Agreement shall not relieve either Party of any obligation or liability that accrued prior to such expiration or termination.

ARTICLE 11 — INSURANCE

11.1 Licensor Insurance Requirements. Clearpoint shall obtain and maintain in full force and effect during the Subscription Term and for a period of two (2) years following the expiration or termination of this Agreement the following insurance coverages, at Clearpoint's sole cost and expense:

(a) Commercial General Liability Insurance: with limits of not less than Five Million Dollars ($5,000,000) per occurrence and Ten Million Dollars ($10,000,000) in the annual aggregate, covering bodily injury, property damage, personal injury, and advertising injury;

(b) Technology Errors and Omissions / Cyber Liability Insurance: with limits of not less than Ten Million Dollars ($10,000,000) per claim and Twenty Million Dollars ($20,000,000) in the annual aggregate, covering claims arising out of technology errors, omissions, and failures, unauthorized access to or disclosure of confidential or personal information, network security breaches, and data-breach notification and response costs; and

(c) Workers' Compensation Insurance: with limits not less than the statutory minimums required by applicable law in each jurisdiction where Clearpoint's employees perform services under this Agreement.

All insurance policies required under this Section 11.1 shall be issued by Northern Ridge Mutual Insurance Company or by insurance carriers with an A.M. Best financial strength rating of "A-" (Excellent) or better and a financial size category of "VIII" or higher, or equivalent ratings from another nationally recognized insurance rating agency. Clearpoint shall provide Quorum with certificates of insurance evidencing the coverages required under this Section 11.1 upon request and promptly upon each annual policy renewal. Such certificates shall provide that the insurer will endeavor to provide Quorum with at least thirty (30) days' prior written notice of any material change in, cancellation of, or non-renewal of such policies.

11.2 Quorum as Additional Insured. Quorum Insurance Holdings Corp. and its Affiliates shall be named as additional insureds on Clearpoint's commercial general liability insurance policy and technology errors and omissions / cyber liability insurance policy to the extent of Clearpoint's indemnification obligations and other liabilities under this Agreement. Such additional insured coverage shall be primary and non-contributory with respect to any other insurance maintained by Quorum. Clearpoint shall cause its insurers to issue endorsements reflecting Quorum's additional insured status and shall provide copies of such endorsements to Quorum upon request.

ARTICLE 12 — SECURITY AND COMPLIANCE

12.1 Security Requirements. Clearpoint shall comply at all times during the Subscription Term with the security requirements set forth in Exhibit D (Security Requirements), which are incorporated herein by reference. Without limiting the generality of the foregoing, Clearpoint's security obligations shall include, but not be limited to: (a) encryption of Customer Data in transit and at rest using industry-standard encryption algorithms and protocols (currently AES-256 for data at rest and TLS 1.2 or higher for data in transit); (b) implementation and maintenance of role-based access controls, multi-factor authentication, and least-privilege access policies; (c) regular vulnerability scanning and prompt remediation of identified vulnerabilities; (d) maintenance of a comprehensive information security program consistent with industry standards, including ISO 27001 and NIST Cybersecurity Framework; and (e) notification to Quorum of any confirmed security breach affecting Customer Data within twenty-four (24) hours of Clearpoint's confirmation of such breach, with a detailed written incident report to follow within seventy-two (72) hours. Clearpoint shall designate a senior information security officer as the primary point of contact for all security-related matters under this Agreement.

12.2 SOC 2 Type II Audit. Clearpoint shall obtain and maintain, at its sole cost and expense, an annual SOC 2 Type II audit report prepared in accordance with the American Institute of Certified Public Accountants (AICPA) Trust Services Criteria, conducted by an independent certified public accounting firm (currently Hawthorne & Ellers, CPAs LLP, or such other firm as Clearpoint may engage from time to time, subject to Quorum's reasonable approval). The SOC 2 Type II audit shall cover the Trust Services Criteria relevant to the Platform, including security, availability, processing integrity, and confidentiality. Clearpoint shall deliver a complete copy of each annual SOC 2 Type II audit report to Quorum within ninety (90) days of the close of the applicable audit period. The current SOC 2 Type II audit report covers the period from April 1, 2023 through March 31, 2024. In the event any SOC 2 Type II audit report contains material qualifications, exceptions, or findings, Clearpoint shall promptly develop and implement a remediation plan and shall provide Quorum with regular updates on the status of such remediation efforts.

12.3 Penetration Testing. Clearpoint shall conduct, at its sole cost and expense, annual penetration testing of the Platform and its hosting infrastructure, performed by an independent third-party security firm (currently Sentinel Cyber Solutions LLC, or such other firm as Clearpoint may engage from time to time, subject to Quorum's reasonable approval). Penetration testing shall include, at a minimum, external network penetration testing, application-level penetration testing, and social engineering testing. Clearpoint shall provide Quorum with an executive summary of the results of each annual penetration test within thirty (30) days of completion of such testing. In the event that penetration testing reveals any critical or high-severity vulnerabilities, Clearpoint shall promptly remediate such vulnerabilities and shall provide Quorum with written confirmation of remediation within the time periods specified in Exhibit D.

12.4 Regulatory Compliance. Clearpoint shall perform its obligations under this Agreement in compliance with all applicable federal, state, and local laws, rules, and regulations, including, without limitation:

(a) the Connecticut Data Privacy Act ("CTDPA"), Conn. Gen. Stat. § 42-515 et seq., and all regulations promulgated thereunder;

(b) the Health Insurance Portability and Accountability Act of 1996 ("HIPAA"), as amended by the Health Information Technology for Economic an

ENTERPRISE SAAS SUBSCRIPTION AGREEMENT
Execution Version
April 26, 2024
by and between
QUORUM INSURANCE HOLDINGS CORP.
and
CLEARPOINT ANALYTICS, INC.
ClaimsIQ™ Platform
ENTERPRISE SAAS SUBSCRIPTION AGREEMENT
Right-click to update Table of Contents
PREAMBLE
This Enterprise SaaS Subscription Agreement (this "Agreement") is entered into as of April 26, 2024 (the "Effective Date"), by and between:
QUORUM INSURANCE HOLDINGS CORP., a corporation duly organized and existing under the laws of the State of Delaware, with its principal offices located at 280 Constitution Plaza, Suite 1400, Hartford, Connecticut 06103 (hereinafter referred to as "Licensee," "Quorum," or "Customer"), a publicly traded company whose common stock is listed on the Nasdaq Stock Market under the ticker symbol "QIHC"; and
CLEARPOINT ANALYTICS, INC., a corporation duly organized and existing under the laws of the State of Delaware, with its principal offices located at 200 South Wacker Drive, Suite 3100, Chicago, Illinois 60606 (hereinafter referred to as "Licensor," "Clearpoint," or "Provider"), a privately held corporation founded in 2017.
Licensee and Licensor are each referred to individually as a "Party" and collectively as the "Parties."
RECITALS
WHEREAS, Clearpoint develops and operates the ClaimsIQ™ platform, a cloud-hosted, artificial-intelligence-driven claims triage, fraud detection, and analytics software-as-a-service ("SaaS") solution designed for the insurance industry;
WHEREAS, Quorum desires to subscribe to the ClaimsIQ™ platform for enterprise-wide deployment across its property and casualty and specialty lines subsidiaries, including Quorum Property & Casualty Insurance Company, Quorum Specialty Underwriters, Inc., and Quorum Digital Solutions LLC, for the purpose of enhancing Quorum's claims administration, triage, fraud detection, and analytics capabilities;
WHEREAS, the Parties desire to set forth the terms and conditions governing Quorum's subscription to and use of the ClaimsIQ™ platform, including matters relating to data ownership, intellectual property, confidentiality, security, indemnification, and related matters; and
WHEREAS, the Parties have negotiated the terms set forth herein and in the Exhibits attached hereto and incorporated herein by reference, and desire to memorialize their agreement in this definitive instrument;
NOW, THEREFORE, in consideration of the mutual covenants, agreements, representations, and warranties set forth herein, and for other good and valuable consideration, the receipt and sufficiency of which are hereby acknowledged, the Parties hereby agree as follows:
ARTICLE 1 — DEFINITIONS
As used in this Agreement, the following terms shall have the meanings set forth below. Capitalized terms used but not defined in this Article 1 shall have the meanings ascribed to them elsewhere in this Agreement or the applicable Exhibit.
1.1 "Affiliate" means, with respect to any Party, any entity that directly or indirectly controls, is controlled by, or is under common control with such Party. For purposes of this definition, "control" means the direct or indirect ownership of more than fifty percent (50%) of the voting securities or equivalent ownership interest of an entity, or the power to direct or cause the direction of the management and policies of such entity, whether through ownership of voting securities, by contract, or otherwise. Without limiting the generality of the foregoing, the Licensee Affiliates shall specifically include: (a) Quorum Property & Casualty Insurance Company, a Connecticut-domiciled insurance company; (b) Quorum Specialty Underwriters, Inc., a Delaware corporation; and (c) Quorum Digital Solutions LLC, a Delaware limited liability company.
1.2 "Aggregated Data" means de-identified, aggregated statistical data derived from Customer Data that has been processed in such a manner that it cannot reasonably be used, either alone or in combination with other data available to Licensor, to identify any individual, policyholder, claimant, or Customer, or to reconstruct any individual record contained in Customer Data.
1.3 "Annual Contract Value" or "ACV" means the annual subscription fee payable by Licensee to Licensor for access to and use of the Platform. The ACV for Year 1 of the Initial Term shall be One Million Four Hundred Thousand Dollars ($1,400,000). The ACV for Years 2 through 5 of the Initial Term shall be subject to adjustment pursuant to the CPI Escalator as set forth in Section 3.2.
1.4 "Authorized Users" means those individual employees, contractors, and agents of Licensee and its Affiliates who are designated by Licensee as named users of the Platform, up to a maximum of one thousand two hundred (1,200) named users at any given time, unless additional users are authorized pursuant to Section 2.2.
1.5 "ClaimsIQ™ Platform" or "Platform" means the proprietary cloud-hosted SaaS platform developed, owned, and operated by Clearpoint, as more fully described in Exhibit A (Statement of Work / Service Description), including all updates, upgrades, patches, and enhancements thereto made generally available by Clearpoint to its customers during the Subscription Term.
1.6 "Confidential Information" means all non-public information disclosed by or on behalf of one Party (the "Disclosing Party") to the other Party (the "Receiving Party"), whether in written, oral, electronic, visual, or other form, that is designated as confidential, proprietary, or by its nature would reasonably be understood to be confidential. Confidential Information includes, without limitation: (a) all technical information, including software code, algorithms, models, architectures, system designs, specifications, and documentation; (b) all business information, including financial data, projections, business plans, marketing strategies, customer lists, pricing information, and operational information; (c) Customer Data; and (d) the terms and conditions of this Agreement, including all pricing, payment terms, and commercial terms. Confidential Information shall not include information that falls within the exceptions set forth in Section 6.2.
1.7 "CPI Escalator" means the annual adjustment to the ACV for Years 2 through 5 of the Initial Term, calculated based on the percentage change in the Consumer Price Index for All Urban Consumers (CPI-U), U.S. City Average, All Items, Not Seasonally Adjusted, as published by the Bureau of Labor Statistics of the United States Department of Labor, for the twelve (12)-month period ending on the last day of the calendar month that is three (3) months prior to the applicable Subscription Anniversary, subject to the cap and floor provisions set forth in Section 3.2.
1.8 "Customer Data" means all data, information, content, records, and materials submitted to, uploaded to, processed by, stored on, or generated through the Platform by or on behalf of Licensee or its Affiliates or their respective Authorized Users, including, without limitation: (a) insurance claims data; (b) policyholder personally identifiable information ("PII"); (c) protected health information ("PHI") as defined under the Health Insurance Portability and Accountability Act of 1996, as amended ("HIPAA"); (d) adjuster notes, assessments, and work product; (e) all outputs, reports, analyses, scores, and recommendations generated by the Platform from the processing of any of the foregoing data; and (f) any metadata associated with any of the foregoing.
1.9 "Data Processing Addendum" or "DPA" means the Data Processing Addendum attached hereto as Exhibit C and incorporated herein by reference.
1.10 "Deliverables" means the services, configurations, integrations, and work products to be provided by Licensor as described in the Statement of Work attached hereto as Exhibit A.
1.11 "Documentation" means the user manuals, technical specifications, administrator guides, online help materials, knowledge base articles, release notes, and other written or electronic materials provided or made available by Licensor that describe the features, functionality, and operation of the Platform.
1.12 "Effective Date" has the meaning set forth in the Preamble of this Agreement: April 26, 2024.
1.13 "Exhibits" means, collectively: (a) Exhibit A (Statement of Work / Service Description); (b) Exhibit B (Service Level Agreement); (c) Exhibit C (Data Processing Addendum); and (d) Exhibit D (Security Requirements), each of which is attached hereto and incorporated herein by reference.
1.14 "Initial Term" has the meaning set forth in Section 10.1.
1.15 "intellectual Property Rights" means all intellectual property rights of any kind, whether registered or unregistered, including: (a) patents, patent applications, and patent rights; (b) copyrights, copyright registrations, and copyright applications; (c) trademarks, service marks, trade names, trade dress, and associated goodwill; (d) trade secrets and other proprietary rights in confidential information; (e) database rights; (f) rights in domain names and URLs; and (g) all other intellectual property rights and equivalent or similar forms of protection existing anywhere in the world.
1.16 "Licensor Technology" means the Platform, the Documentation, and all underlying technology, algorithms, machine-learning models, artificial-intelligence engines, software code (including source code and object code), frameworks, tools, libraries, application programming interfaces ("APIs"), data structures, databases (excluding Customer Data), user interfaces, and other technology owned by or licensed to Licensor that is used in or forms part of the Platform.
1.17 "Monthly Subscription Fee" means the ACV divided by twelve (12). For Year 1 of the Initial Term, the Monthly Subscription Fee shall be One Hundred Sixteen Thousand Six Hundred Sixty-Seven Dollars ($116,667), rounded to the nearest dollar.
1.18 "Scheduled Maintenance" means planned maintenance windows during which the Platform may be unavailable, as more fully defined and described in Exhibit B (Service Level Agreement).
1.19 "Service Credits" means the credits to Licensee's account calculated and applied in accordance with the terms and procedures set forth in Exhibit B (Service Level Agreement).
1.20 "Service Level Agreement" or "SLA" means the service level agreement attached hereto as Exhibit B and incorporated herein by reference.
1.21 "Subprocessor" means any third party engaged by Licensor to process Customer Data on Licensor's behalf in connection with Licensor's performance of its obligations under this Agreement.
1.22 "Subscription Anniversary" means each annual anniversary of the Effective Date during the Subscription Term.
1.23 "Subscription Term" means the Initial Term and any Renewal Terms, collectively.
1.24 "Total Contract Value" or "TCV" means the aggregate subscription fees payable by Licensee over the Initial Term, estimated at Seven Million Dollars ($7,000,000), subject to adjustment based on the CPI Escalator and any applicable overage fees.
ARTICLE 2 — SUBSCRIPTION LICENSE GRANT
2.1 Grant of License. Subject to the terms and conditions of this Agreement and Licensee's timely payment of all applicable fees, Clearpoint hereby grants to Quorum, during the Subscription Term, a non-exclusive, non-transferable (except as expressly provided in Section 14.6), worldwide right and license to access and use the ClaimsIQ™ Platform, including the Documentation, solely for Quorum's and its Affiliates' internal business purposes in connection with the administration, triage, fraud detection, scoring, analysis, and analytics of insurance claims across Quorum's property and casualty, specialty lines, and workers' compensation insurance operations. The license granted herein extends to Quorum Property & Casualty Insurance Company, Quorum Specialty Underwriters, Inc., and Quorum Digital Solutions LLC as Licensee Affiliates, each of which shall be entitled to access and use the Platform on the same terms and conditions as Licensee, provided that Licensee shall remain primarily responsible for its Affiliates' compliance with the terms of this Agreement and the aggregate number of Authorized Users across Licensee and all Affiliates shall not exceed the limits specified in Section 2.2 (unless overage fees are applicable). The license granted under this Section 2.1 includes the right to access and use the Platform via web browser, mobile application, and API integrations as described in Exhibit A.
2.2 Authorized Users.
(a) Licensee is authorized to designate up to one thousand two hundred (1,200) named users as Authorized Users across Licensee and its Affiliates, collectively. Authorized Users may include claims adjusters, claims supervisors, fraud investigators, underwriters, actuaries, IT administrators, data analysts, and other personnel designated by Licensee.
(b) Authorized Users may access the Platform from Licensee's three (3) primary claims-processing locations: (i) Hartford, Connecticut (280 Constitution Plaza, Suite 1400, Hartford, CT 06103); (ii) Dallas, Texas (2300 North Field Street, Suite 700, Dallas, TX 75201); and (iii) Jacksonville, Florida (501 Riverside Avenue, Suite 1100, Jacksonville, FL 32202). In addition, Authorized Users designated as field adjusters or remote-access users may access the Platform remotely from any location within the United States, subject to compliance with all applicable security requirements set forth in Exhibit D.
(c) If the number of named users designated by Licensee or its Affiliates exceeds one thousand two hundred (1,200) at any time during a calendar quarter, Licensee shall pay an overage fee of One Hundred Fifty Dollars ($150.00) per additional user per month for each named user in excess of one thousand two hundred (1,200), as further set forth in Section 3.3.
(d) Licensee shall be responsible for ensuring that each Authorized User complies with the terms of this Agreement, including all restrictions on use set forth in Section 2.3, and shall be liable for any breach of this Agreement caused by an Authorized User's acts or omissions. Licensee shall implement reasonable controls to prevent unauthorized access to the Platform, including the assignment of unique login credentials to each Authorized User and the prompt deactivation of credentials for users who are no longer authorized.
2.3 Restrictions on Use. Except as expressly permitted by this Agreement, Licensee shall not, and shall not permit any Authorized User or third party to:
(a) reverse engineer, decompile, disassemble, or otherwise attempt discover the source code, object code, algorithms, or underlying structure of the Platform, except to the extent expressly permitted by applicable law notwithstanding this restriction;
(b) sublicense, rent, lease, loan, sell, resell, distribute, or otherwise make the Platform available to any third party, except to Affiliates as expressly provided in Section 2.1;
(c) use the Platform for any purpose other than the internal business purposes described in Section 2.1, or for any purpose that is unlawful, fraudulent, or prohibited by this Agreement;
(d) remove, alter, obscure, or deface any proprietary notices, labels, trademarks, logos, or identification marks appearing on or within the Platform or the Documentation;
(e) use the Platform, the Documentation, or any information or data obtained through the Platform to develop, market, sell, or distribute any product, service, or technology that competes with or is substantially similar to the Platform or any component thereof;
(f) use the Platform in any manner that could damage, disable, overburden, or impair the Platform or interfere with any other party's use of the Platform;
(g) introduce any virus, worm, Trojan horse, malware, or other harmful code into the Platform; or
(h) access or use the Platform in a manner that violates any applicable law, regulation, or industry standard.
2.4 Platform Availability and Support. Licensor shall make the Platform available to Licensee and its Authorized Users in accordance with the uptime and availability commitments set forth in the SLA (Exhibit B). Licensor shall provide technical support to Licensee during the standard support hours specified in Exhibit B, in accordance with the support tiers, response times, and escalation procedures described therein. In the event that Platform availability falls below the service levels specified in Exhibit B, Licensee shall be entitled to Service Credits as calculated and applied in accordance with Exhibit B. Scheduled Maintenance windows shall be conducted in accordance with Exhibit B and shall not be counted against uptime calculations except as expressly provided therein.
ARTICLE 3 — FEES AND PAYMENT
3.1 Subscription Fees.
(a) The Annual Contract Value for Year 1 of the Initial Term shall be One Million Four Hundred Thousand Dollars ($1,400,000.00). The estimated Total Contract Value over the five (5)-year Initial Term shall be Seven Million Dollars ($7,000,000.00), subject to adjustment based on the CPI Escalator as set forth in Section 3.2.
(b) Subscription fees shall be payable in annual installments in advance. The Year 1 subscription fee of One Million Four Hundred Thousand Dollars ($1,400,000.00) shall be due and payable upon execution of this Agreement. Subscription fees for each subsequent year of the Initial Term shall be due and payable within thirty (30) days of each Subscription Anniversary.
(c) For the avoidance of doubt, subscription fees are non-refundable except as expressly provided in this Agreement, including, without limitation, refunds payable upon termination pursuant to Sections 10.4 and 14.6.
3.2 CPI Escalator.
(a) The ACV for Years 2 through 5 of the Initial Term shall be subject to an annual adjustment based on the CPI Escalator, calculated as follows: the ACV for the immediately preceding year shall be multiplied by one (1) plus the percentage change in the CPI-U for the applicable measurement period, subject to the cap and floor provisions set forth in this Section 3.2.
(b) The CPI Escalator shall be capped at three and one-half percent (3.5%) per annum. In no event shall the annual increase in the ACV exceed three and one-half percent (3.5%) of the prior year's ACV, regardless of the actual percentage change in the CPI-U. If the published CPI-U increase for the applicable measurement period is less than three and one-half percent (3.5%), the actual CPI-U percentage change shall be applied to determine the ACV for the succeeding year.
(c) By way of illustration and without limitation: (i) the maximum ACV for Year 2 shall be One Million Four Hundred Forty-Nine Thousand Dollars ($1,449,000.00) ($1,400,000.00 × 1.035); (ii) the maximum ACV for Year 3 shall be One Million Four Hundred Ninety-Nine Thousand Seven Hundred Fifteen Dollars ($1,499,715.00) ($1,449,000.00 × 1.035); (iii) the maximum ACV for Year 4 shall be One Million Five Hundred Fifty-Two Thousand Two Hundred Five Dollars ($1,552,205.03) ($1,499,715.00 × 1.035); and (iv) the maximum ACV for Year 5 shall be approximately One Million Six Hundred Seven Thousand Five Hundred Twenty-Three Dollars ($1,607,532.20) ($1,552,205.03 × 1.035).
(d) If the CPI-U for the applicable measurement period reflects a decrease (i.e., the CPI-U is negative), the ACV shall remain unchanged from the prior year's ACV. In no event shall the ACV for any year be less than the ACV for the immediately preceding year.
(e) Licensor shall provide Licensee with written notice of the adjusted ACV for the upcoming year no later than sixty (60) days prior to the applicable Subscription Anniversary, together with supporting documentation reflecting the applicable CPI-U data.
3.3 Overage Fees.
(a) If the number of named users designated by Licensee or its Affiliates exceeds one thousand two hundred (1,200) at any time during a calendar quarter, Licensee shall pay an overage fee of One Hundred Fifty Dollars ($150.00) per additional user per month for each named user in excess of one thousand two hundred (1,200).
(b) Overage fees shall be calculated based on the peak number of named users during the applicable calendar quarter and shall be invoiced quarterly in arrears. Licensor shall provide Licensee with a detailed user-count report accompanying each overage invoice, identifying the peak usage date and the number of users in excess of the authorized limit.
3.4 Invoicing and Payment Terms.
(a) All invoices issued by Licensor under this Agreement shall be payable within thirty (30) days of the date of invoice. Invoices shall be sent electronically to the attention of Licensee's accounts payable department at the address specified in Section 14.1 or to such other address as Licensee may designate in writing.
(b) Any undisputed amounts not paid when due shall accrue interest at the lesser of one and one-half percent (1.5%) per month or the maximum rate permitted by applicable law, calculated from the date such payment was due until the date of actual payment.
(c) Licensee shall have no right of offset or deduction against amounts owed under this Agreement, except for undisputed Service Credits to which Licensee is entitled under Exhibit B (Service Level Agreement). In the event of a good-faith dispute regarding any invoiced amount, Licensee shall pay all undisputed amounts when due and shall provide Licensor with written notice of the disputed amount and the basis for such dispute within thirty (30) days of the invoice date. The Parties shall negotiate in good faith to resolve any billing disputes promptly.
3.5 Taxes.
(a) All fees stated in this Agreement are exclusive of all applicable sales, use, value-added, excise, withholding, and other taxes, levies, duties, and assessments of any kind imposed by any governmental authority (collectively, "Taxes"). Licensee shall be responsible for and shall pay all Taxes arising from or in connection with this Agreement, except for taxes imposed on Licensor's net income, gross receipts (to the extent measured by Licensor's income), franchise taxes, or similar taxes based on Licensor's overall financial performance.
(b) If Licensee is required by applicable law to withhold any Taxes from amounts payable to Licensor, Licensee shall promptly notify Licensor and shall gross up the payment so that Licensor receives the full amount that would have been due absent such withholding, unless Licensor provides a valid exemption certificate or other documentation establishing that no withholding is required.
ARTICLE 4 — CUSTOMER DATA OWNERSHIP AND RIGHTS
4.1 Ownership of Customer Data. As between the Parties, Quorum retains sole and exclusive ownership of all right, title, and interest in and to all Customer Data, including, without limitation, all insurance claims data, policyholder PII, PHI, adjuster notes, work product, and all outputs, reports, analyses, scores, and recommendations generated by the Platform from the processing of Customer Data. Nothing in this Agreement shall be construed to transfer, assign, or convey to Clearpoint any right, title, or interest in or to Customer Data, except for the limited processing rights expressly granted to Clearpoint pursuant to Section 4.2. Clearpoint acknowledges that Customer Data constitutes the Confidential Information of Quorum and is subject to the confidentiality obligations set forth in Article 6.
4.2 License to Process Customer Data. Quorum hereby grants to Clearpoint a limited, non-exclusive, non-transferable, non-sublicensable (except to approved Subprocessors as set forth in Section 12.5) license to access, use, process, transmit, and store Customer Data solely to the extent necessary for Clearpoint to: (a) provide the Platform and perform its obligations under this Agreement; (b) comply with the terms of the DPA (Exhibit C); and (c) comply with applicable law. This license shall terminate automatically upon the expiration or termination of this Agreement, subject to the data export and destruction obligations set forth in Section 4.4. Clearpoint shall not process Customer Data for any purpose other than those expressly authorized by this Section 4.2 without Quorum's prior written consent.
4.3 Aggregated Data.
(a) Clearpoint may create Aggregated Data from Customer Data solely for the purpose of improving the Platform's features, functionality, algorithms, and machine-learning models, and for benchmarking and industry trend analysis. Clearpoint's right to create and use Aggregated Data is subject to compliance with all of the following conditions:
(i) Clearpoint shall comply with all applicable insurance data-privacy laws, regulations, and guidelines in creating and using Aggregated Data, including, without limitation, the Connecticut Data Privacy Act, HIPAA, and any applicable state insurance department regulations and guidance;
(ii) Clearpoint shall obtain Quorum's prior written consent before creating or using Aggregated Data from Customer Data, which consent shall not be unreasonably withheld, conditioned, or delayed; and
(iii) Clearpoint shall not attempt to re-identify any individual, policyholder, claimant, or Customer from Aggregated Data, and shall not sell, license, distribute, or otherwise make Aggregated Data available to any third party in any form that could reasonably be used, either alone or in combination with other available data, to identify Quorum, its policyholders, claimants, or any individual.
(b) Aggregated Data must be processed in a manner that ensures it cannot be attributed to or associated with Quorum, any Licensee Affiliate, or any individual. Clearpoint shall implement reasonable technical and organizational measures to ensure compliance with this requirement.
4.4 Data Portability.
(a) Upon the expiration or termination of this Agreement for any reason, Clearpoint shall, at no additional charge to Licensee, provide Licensee with a complete and accurate export of all Customer Data in Clearpoint's possession or control, in industry-standard, machine-readable formats, specifically including: (i) ACORD XML format; and (ii) comma-separated values (CSV) format. Clearpoint shall make reasonable efforts to accommodate Licensee's preferences regarding data export format, file structure, and delivery method.
(b) The data export described in Section 4.4(a) shall be completed within sixty (60) days of the effective date of expiration or termination of this Agreement. Clearpoint shall cooperate with Licensee and any successor service provider designated by Licensee to facilitate the orderly transition and migration of Customer Data.
(c) Within thirty (30) days following Licensee's written confirmation of receipt and verification of the completeness and accuracy of the exported Customer Data (or, if Licensee does not provide such confirmation, within ninety (90) days following the effective date of expiration or termination), Clearpoint shall: (i) permanently and securely delete or destroy all Customer Data in its possession, custody, or control, including all copies, backups, archives, and derivative datasets (excluding Aggregated Data that has been properly created in accordance with Section 4.3); and (ii) certify in writing, signed by an officer of Clearpoint, the destruction of all such Customer Data. Clearpoint shall cause all Subprocessors to perform the same destruction and certification with respect to Customer Data held by such Subprocessors.
4.5 Data Processing Addendum. The Data Processing Addendum attached hereto as Exhibit C is incorporated herein by reference and governs all processing of Customer Data by Clearpoint and its Subprocessors. In the event of any conflict or inconsistency between the provisions of this Agreement and the provisions of the DPA with respect to data processing, data protection, or data privacy matters, the provisions of the DPA shall prevail and control to the extent of such conflict or inconsistency.
ARTICLE 5 — INTELLECTUAL PROPERTY
5.1 Licensor IP. Clearpoint retains all right, title, and interest in and to the ClaimsIQ™ Platform, all Licensor Technology, the Documentation, and all improvements, modifications, enhancements, updates, upgrades, derivative works, and new versions thereof, whether developed independently by Clearpoint or resulting from Licensee's feedback or suggestions (collectively, "Licensor IP"), excluding Customer Data. Nothing in this Agreement shall be construed as a transfer, assignment, or conveyance of any ownership right in any Licensor IP to Quorum. The ClaimsIQ™ name and logo, and all related trademarks and service marks, are the exclusive property of Clearpoint, and Licensee shall acquire no rights therein except as expressly provided in this Agreement. To the extent that any improvement, modification, or derivative work of the Licensor Technology is created during the performance of this Agreement, all right, title, and interest in and to such improvement, modification, or derivative work shall vest exclusively in Clearpoint.
5.2 Licensee IP. Quorum retains all right, title, and interest in and to Customer Data, Quorum's proprietary systems, networks, databases, software, processes, trade secrets, trademarks, service marks, trade names, patents, copyrights, and all other pre-existing intellectual property of Quorum. Nothing in this Agreement shall be construed as a transfer, assignment, or conveyance of any ownership right in Quorum's pre-existing intellectual property to Clearpoint. Clearpoint acknowledges that it acquires no rights in Quorum's proprietary technology, brand, or intellectual property except the limited right to process Customer Data as expressly set forth in Section 4.2.
5.3 Feedback. If Quorum or any of its Authorized Users provides to Clearpoint any suggestions, enhancement requests, recommendations, corrections, feature requests, or other feedback regarding the Platform or the Documentation (collectively, "Feedback"), Clearpoint shall be free to use, incorporate, modify, distribute, and otherwise exploit such Feedback without restriction, obligation, or compensation of any kind to Quorum; provided, however, that such Feedback does not constitute Customer Data. Quorum hereby assigns to Clearpoint all right, title, and interest in and to any Feedback, and to the extent such assignment is ineffective under applicable law, Quorum hereby grants Clearpoint a perpetual, irrevocable, royalty-free, worldwide, fully sublicensable license to use and exploit such Feedback in any manner. Nothing in this Section 5.3 shall be construed to require Quorum to provide any Feedback.
ARTICLE 6 — CONFIDENTIALITY
6.1 Obligations. Each Party agrees to hold the Confidential Information of the other Party in strict confidence and to protect such Confidential Information using at least the same degree of care that such Party uses to protect its own Confidential Information of similar nature and sensitivity, but in no event less than reasonable care. Each Party shall use the other Party's Confidential Information solely for the purpose of performing its obligations or exercising its rights under this Agreement. Each Party shall restrict access to the other Party's Confidential Information to those of its employees, contractors, agents, Affiliates, advisors, auditors, and legal counsel who have a need to know such information in connection with this Agreement and who are bound by confidentiality obligations no less restrictive than those set forth in this Article 6. Each Party shall be responsible for any breach of this Article 6 by any person to whom it has disclosed the other Party's Confidential Information.
6.2 Exceptions. The obligations set forth in Section 6.1 shall not apply to information that the Receiving Party can demonstrate by competent evidence:
(a) is or becomes publicly available through no fault, act, or omission of the Receiving Party or any person to whom the Receiving Party has disclosed such information;
(b) was known to the Receiving Party prior to its disclosure by the Disclosing Party, without any obligation of confidentiality, as evidenced by the Receiving Party's written records;
(c) is independently developed by the Receiving Party without reference to or use of the Disclosing Party's Confidential Information, as evidenced by the Receiving Party's written records or other competent evidence; or
(d) is rightfully received by the Receiving Party from a third party that is not bound by any obligation of confidentiality with respect to such information.
6.3 Compelled Disclosure. If the Receiving Party is compelled by applicable law, regulation, subpoena, civil investigative demand, judicial or governmental order, or other legal process to disclose any Confidential Information of the Disclosing Party, the Receiving Party shall: (a) provide the Disclosing Party with prompt prior written notice of such compelled disclosure, to the extent legally permitted, so as to afford the Disclosing Party a reasonable opportunity to seek a protective order, injunction, or other appropriate remedy; and (b) cooperate with the Disclosing Party, at the Disclosing Party's expense, in seeking such protective order or remedy. If such protective order or other remedy is not obtained, the Receiving Party shall disclose only that portion of the Confidential Information that is legally required to be disclosed and shall use commercially reasonable efforts to ensure that the disclosed Confidential Information is treated confidentially by the recipient. Notwithstanding the foregoing, disclosures of Confidential Information required by insurance regulators, the U.S. Securities and Exchange Commission ("SEC"), the Nasdaq Stock Market, state insurance departments, or other governmental authorities with regulatory jurisdiction over Licensee or its Affiliates shall be permitted without obtaining a protective order, subject to the Receiving Party providing prompt written notice of such disclosure to the Disclosing Party (to the extent legally permitted).
6.4 Survival. The confidentiality obligations set forth in this Article 6 shall survive the expiration or termination of this Agreement for a period of five (5) years following the effective date of such expiration or termination. Notwithstanding the foregoing, with respect to Confidential Information that constitutes a trade secret under applicable law, the confidentiality obligations set forth herein shall continue for so long as such information remains a trade secret under applicable law, which period may be perpetual.
ARTICLE 7 — REPRESENTATIONS AND WARRANTIES
7.1 Mutual Representations. Each Party represents and warrants to the other Party as of the Effective Date that:
(a) it is duly organized, validly existing, and in good standing under the laws of its jurisdiction of incorporation or organization, and has all necessary corporate power and authority to conduct its business as currently conducted;
(b) it has full corporate power and authority to enter into this Agreement and to perform its obligations hereunder, and the execution, delivery, and performance of this Agreement have been duly authorized by all necessary corporate action;
(c) the execution and delivery of this Agreement and the performance of its obligations hereunder do not and will not conflict with, violate, or result in a breach of any provision of its organizational documents, any agreement to which it is a party or by which it is bound, or any applicable law, regulation, order, judgment, or decree; and
(d) this Agreement constitutes a legal, valid, and binding obligation of such Party, enforceable against such Party in accordance with its terms, subject to applicable bankruptcy, insolvency, reorganization, moratorium, fraudulent conveyance, and similar laws affecting creditors' rights generally, and subject to general principles of equity, whether considered in a proceeding in equity or at law.
7.2 Licensor Representations and Warranties. Clearpoint represents and warrants to Quorum that:
(a) the Platform will perform materially in accordance with the Documentation and the specifications set forth in Exhibit A during the Subscription Term, and any updates, upgrades, or modifications to the Platform made generally available by Clearpoint during the Subscription Term will not materially diminish the overall functionality of the Platform;
(b) the Platform and all services provided under this Agreement will be provided in a professional and workmanlike manner consistent with generally accepted industry standards for enterprise SaaS platforms serving the insurance industry;
(c) Clearpoint has and will maintain throughout the Subscription Term all rights, licenses, permissions, and authorizations necessary to grant the license set forth in Section 2.1 and to perform its obligations under this Agreement, free and clear of all liens, encumbrances, and restrictions;
(d) to Clearpoint's knowledge as of the Effective Date, the Platform does not infringe, misappropriate, or otherwise violate the intellectual Property Rights of any third party;
(e) Clearpoint will comply with all applicable laws, rules, and regulations in performing its obligations under this Agreement, including, without limitation, all applicable insurance regulatory requirements, data-privacy and data-protection laws, and anti-corruption laws;
(f) the Platform incorporates commercially reasonable security measures designed to protect Customer Data against unauthorized access, use, disclosure, alteration, and destruction, as more fully described in Exhibit D (Security Requirements); and
(g) Clearpoint's current SOC 2 Type II audit report, conducted by the independent certified public accounting firm of Hawthorne & Ellers, CPAs LLP, covering the period from April 1, 2023 through March 31, 2024, contains no material qualifications, exceptions, or findings of material deficiency relating to the Platform, its hosting infrastructure, or the security controls applicable to the processing of Customer Data. A copy of the executive summary of such report has been provided to Quorum prior to the Effective Date.
7.3 Licensee Representations and Warranties. Quorum represents and warrants to Clearpoint that:
(a) Quorum has all necessary rights, consents, permissions, and authorizations to provide Customer Data to Clearpoint for processing in accordance with this Agreement and the DPA, including, without limitation, all consents and authorizations required under applicable privacy and data-protection laws;
(b) Quorum's use of the Platform will at all times comply with applicable law and the terms and conditions of this Agreement; and
(c) Customer Data provided by Quorum to Clearpoint will not, to Quorum's knowledge, infringe, misappropriate, or otherwise violate the intellectual Property Rights or other proprietary rights of any third party.
7.4 Disclaimer. EXCEPT AS EXPRESSLY SET FORTH IN THIS ARTICLE 7, EACH PARTY DISCLAIMS ALL WARRANTIES, WHETHER EXPRESS, IMPLIED, STATUTORY, OR OTHERWISE, INCLUDING, WITHOUT LIMITATION, ALL IMPLIED WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, TITLE, AND NON-INFRINGEMENT, AND ALL WARRANTIES ARISING FROM COURSE OF DEALING, USAGE, OR TRADE PRACTICE. WITHOUT LIMITING THE FOREGOING, CLEARPOINT MAKES NO WARRANTY OF ANY KIND THAT THE PLATFORM WILL MEET LICENSEE'S REQUIREMENTS, OPERATE WITHOUT INTERRUPTION, ACHIEVE ANY INTENDED RESULT, BE COMPATIBLE WITH ANY OTHER SOFTWARE OR SYSTEM, OR BE ERROR-FREE. CLEARPOINT DOES NOT WARRANT THAT THE PLATFORM WILL DETECT ALL INSTANCES OF FRAUD OR PRODUCE RESULTS FREE OF FALSE POSITIVES OR FALSE NEGATIVES.
ARTICLE 8 — INDEMNIFICATION
8.1 Indemnification by Licensor. Clearpoint shall defend, indemnify, and hold harmless Quorum, its Affiliates, and their respective officers, directors, employees, agents, successors, and permitted assigns (collectively, the "Quorum Indemnitees") from and against any and all claims, demands, suits, actions, proceedings, investigations, judgments, awards, penalties, fines, damages, losses, liabilities, costs, and expenses (including reasonable attorneys' fees, expert fees, and court costs) (collectively, "Losses") arising out of or relating to any third-party claim:
(a) alleging that Quorum's authorized use of the ClaimsIQ™ Platform in accordance with this Agreement infringes, misappropriates, or otherwise violates any patent, copyright, trademark, trade secret, or other intellectual Property Right of any third party;
(b) arising from Clearpoint's breach of its data-security obligations under this Agreement, the DPA, or Exhibit D, or any unauthorized access to, use of, disclosure of, loss of, or destruction of Customer Data attributable to Clearpoint, its employees, agents, or Subprocessors; or
(c) arising from Clearpoint's violation of applicable law, including, without limitation, insurance regulatory requirements, data-privacy and data-protection laws, or anti-corruption laws, in connection with the performance of its obligations under this Agreement.
8.2 Indemnification by Licensee. Quorum shall defend, indemnify, and hold harmless Clearpoint, its officers, directors, employees, agents, successors, and permitted assigns (collectively, the "Clearpoint Indemnitees") from and against any and all Losses arising out of or relating to any third-party claim:
(a) alleging that Customer Data provided by Quorum to Clearpoint for processing in accordance with this Agreement infringes, misappropriates, or otherwise violates any patent, copyright, trademark, trade secret, or other intellectual Property Right or proprietary right of any third party; or
(b) arising from Quorum's use of the ClaimsIQ™ Platform in a manner that is outside the scope of the license granted under this Agreement or that violates applicable law.
8.3 Indemnification Procedures. The Parties' indemnification obligations under this Article 8 are subject to the following procedures:
(a) Notice. The indemnified party shall provide the indemnifying party with prompt written notice of any claim, demand, suit, or proceeding for which indemnification is sought, in no event later than fifteen (15) business days after the indemnified party becomes aware of such claim. A failure or delay in providing such notice shall not relieve the indemnifying party of its indemnification obligations, except to the extent the indemnifying party is materially prejudiced by such failure or delay.
(b) Control of Defense. The indemnifying party shall have the right, but not the obligation, to assume and control the defense of any such claim, at the indemnifying party's sole cost and expense, with counsel reasonably acceptable to the indemnified party. If the indemnifying party elects to assume the defense, the indemnified party shall cooperate in good faith with the indemnifying party and its counsel in the defense of such claim, at the indemnifying party's expense. If the indemnifying party does not assume the defense of any such claim within thirty (30) days of receiving notice thereof, the indemnified party may defend the claim at the indemnifying party's expense.
(c) Participation. The indemnified party may participate in the defense of any claim at its own expense with counsel of its choosing; provided, however, that the indemnifying party shall retain sole control of the defense and settlement of such claim.
(d) Settlement. The indemnifying party shall not settle, compromise, or consent to the entry of any judgment with respect to any claim for which indemnification is sought without the prior written consent of the indemnified party, which consent shall not be unreasonably withheld, conditioned, or delayed. In no event shall the indemnifying party agree to any settlement that: (i) imposes any obligation, restriction, or liability on the indemnified party (other than the payment of money, which the indemnifying party shall be obligated to pay); (ii) admits fault or wrongdoing by the indemnified party; or (iii) grants injunctive or other equitable relief against the indemnified party, without the indemnified party's prior written consent.
8.4 IP Infringement Remedies. If the Platform or any component thereof is the subject of an injunction or court order, or if Clearpoint reasonably believes that the Platform is likely to become the subject of a claim of infringement or misappropriation, Clearpoint shall, at its sole option and expense, promptly:
(a) procure for Quorum the right to continue using the Platform in accordance with the terms of this Agreement;
(b) modify or replace the infringing component of the Platform with a non-infringing alternative that is functionally equivalent in all material respects, without material degradation of Platform performance or capabilities; or
(c) if neither clause (a) nor clause (b) above is commercially practicable after Clearpoint's diligent and good-faith efforts, terminate the affected portion of this Agreement (or, if the infringement affects the entire Platform, terminate this Agreement in its entirety) and refund to Quorum a pro-rata portion of the subscription fees prepaid by Quorum for the remainder of the then-current subscription year, calculated from the effective date of such termination through the end of such subscription year.
8.5 Indemnification Cap.
(a) Clearpoint's aggregate liability for indemnification obligations under Section 8.1(a) (IP infringement) and Section 8.1(c) (violation of law) shall not exceed two times (2×) the Total Contract Value, which is Fourteen Million Dollars ($14,000,000).
(b) Clearpoint's indemnification obligations under Section 8.1(b) (data-breach indemnification) shall be uncapped.
(c) Quorum's aggregate liability for indemnification obligations under Section 8.2 shall not exceed one times (1×) the Total Contract Value, which is Seven Million Dollars ($7,000,000).
ARTICLE 9 — LIMITATION OF LIABILITY
9.1 General Liability Cap. EXCEPT AS SET FORTH IN SECTION 9.2 BELOW, EACH PARTY'S TOTAL AGGREGATE LIABILITY TO THE OTHER PARTY ARISING OUT OF OR RELATED TO THIS AGREEMENT, WHETHER ARISING IN CONTRACT, TORT (INCLUDING NEGLIGENCE), STRICT LIABILITY, OR ANY OTHER LEGAL OR EQUITABLE THEORY, SHALL NOT EXCEED ONE TIMES (1×) THE TOTAL CONTRACT VALUE, WHICH IS SEVEN MILLION DOLLARS ($7,000,000).
9.2 Exclusions from Cap. The limitation of liability set forth in Section 9.1 shall not apply to and shall not limit:
(a) Clearpoint's indemnification obligations for data-breach claims under Section 8.1(b), which are uncapped;
(b) Clearpoint's indemnification obligations for IP infringement under Section 8.1(a), which are subject to the separate cap of Fourteen Million Dollars ($14,000,000) as set forth in Section 8.5(a);
(c) either Party's liability for willful misconduct, gross negligence, or fraud;
(d) either Party's liability for breach of its confidentiality obligations under Article 6 with respect to Customer Data; or
(e) Quorum's obligation to pay the subscription fees, overage fees, and other amounts due and payable under Article 3.
9.3 Exclusion of Consequential Damages. EXCEPT WITH RESPECT TO THE MATTERS EXCLUDED FROM THE LIMITATION OF LIABILITY PURSUANT TO SECTION 9.2, IN NO EVENT SHALL EITHER PARTY BE LIABLE TO THE OTHER PARTY OR TO ANY THIRD PARTY FOR ANY INDIRECT, INCIDENTAL, SPECIAL, CONSEQUENTIAL, EXEMPLARY, OR PUNITIVE DAMAGES OF ANY KIND, INCLUDING, WITHOUT LIMITATION, DAMAGES FOR LOSS OF PROFITS, LOSS OF REVENUE, LOSS OF DATA, LOSS OF BUSINESS OPPORTUNITIES, LOSS OF GOODWILL, COST OF PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES, OR INTERRUPTION OF BUSINESS, HOWEVER CAUSED AND REGARDLESS OF THE THEORY OF LIABILITY, WHETHER ARISING IN CONTRACT, TORT (INCLUDING NEGLIGENCE), STRICT LIABILITY, OR OTHERWISE, EVEN IF SUCH PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES OR COULD HAVE REASONABLY FORESEEN SUCH DAMAGES. NOTWITHSTANDING THE FOREGOING, THIS EXCLUSION OF CONSEQUENTIAL DAMAGES SHALL NOT LIMIT CLEARPOINT'S LIABILITY FOR DATA-BREACH INDEMNIFICATION UNDER SECTION 8.1(b).
ARTICLE 10 — TERM AND TERMINATION
10.1 Initial Term. This Agreement shall commence on the Effective Date and shall continue for a period of five (5) years, expiring on April 25, 2029, unless earlier terminated in accordance with the provisions of this Article 10 (the "Initial Term").
10.2 Renewal. Upon the expiration of the Initial Term, this Agreement shall automatically renew for successive one (1)-year periods (each, a "Renewal Term"), unless either Party provides the other Party with written notice of non-renewal at least one hundred eighty (180) days prior to the end of the then-current term (whether the Initial Term or any Renewal Term). The ACV for each Renewal Term shall be determined by application of the CPI Escalator as described in Section 3.2, calculated based on the ACV for the final year of the immediately preceding term. All terms and conditions of this Agreement shall apply during each Renewal Term with the same force and effect as during the Initial Term, unless otherwise agreed in writing by the Parties.
10.3 Termination for Cause. Either Party may terminate this Agreement upon written notice to the other Party if:
(a) the other Party materially breaches any provision of this Agreement and fails to cure such breach within thirty (30) days after receipt of written notice specifying the nature of the breach in reasonable detail; provided, however, that if such breach involves a technical remediation by Clearpoint (including, without limitation, security vulnerabilities, platform defects, or integration failures), the cure period shall be extended to sixty (60) days;
(b) the other Party: (i) becomes subject to a voluntary or involuntary petition in bankruptcy or any proceeding relating to insolvency, receivership, liquidation, reorganization, or composition for the benefit of creditors, and such petition or proceeding is not dismissed within sixty (60) days; (ii) makes a general assignment for the benefit of creditors; (iii) has a receiver, trustee, or similar officer appointed over all or a substantial portion of its assets; or (iv) becomes generally unable to pay its debts as they become due; or
(c) the other Party ceases to conduct business in the ordinary course or dissolves or liquidates its business.
10.4 Termination for Chronic SLA Failure. In addition to Quorum's rights under Section 10.3, Quorum may terminate this Agreement for cause upon written notice to Clearpoint if the Platform's monthly uptime, as measured in accordance with Exhibit B, falls below ninety-nine percent (99.0%) in any three (3) consecutive calendar months during the Subscription Term (a "Chronic SLA Failure"). Upon termination for Chronic SLA Failure, Quorum shall be entitled to receive a pro-rata refund of all prepaid and unused subscription fees, calculated from the effective date of termination through the end of the then-current subscription year.
10.5 Termination for Convenience. Quorum may terminate this Agreement for convenience, without cause, upon one hundred eighty (180) days' prior written notice to Clearpoint; provided, however, that no refund of prepaid subscription fees shall be due to Quorum upon termination for convenience, except as otherwise expressly provided in this Agreement. For the avoidance of doubt, Clearpoint shall not have the right to terminate this Agreement for convenience during the Initial Term.
10.6 Effects of Termination. Upon the expiration or termination of this Agreement for any reason:
(a) all license rights granted to Licensee under Section 2.1 and elsewhere in this Agreement shall immediately terminate, and Licensee shall promptly cease all use of the Platform;
(b) Licensee shall cease all access to the Platform within ten (10) business days of the effective date of expiration or termination, and Licensor shall disable Licensee's access credentials;
(c) the Customer Data export and destruction obligations set forth in Section 4.4 shall apply;
(d) all accrued and unpaid obligations of each Party, including, without limitation, Licensee's obligation to pay all fees due and payable for the period up to and including the effective date of expiration or termination, shall survive; and
(e) Clearpoint shall cooperate in good faith with Quorum and any successor service provider designated by Quorum to facilitate an orderly transition, including reasonable data migration assistance, knowledge transfer, and access to Clearpoint personnel for transition-related questions, for a period of up to ninety (90) days following the effective date of expiration or termination, at Clearpoint's then-current professional services rates.
10.7 Survival. The following provisions of this Agreement shall survive the expiration or termination of this Agreement for any reason and shall continue in full force and effect in accordance with their terms: Article 1 (Definitions), Article 4 (Customer Data Ownership and Rights), Article 5 (Intellectual Property), Article 6 (Confidentiality), Article 8 (Indemnification), Article 9 (Limitation of Liability), Article 13 (Governing Law and Dispute Resolution), Article 14 (General Provisions), and any other provision of this Agreement that by its nature or express terms is intended to survive expiration or termination. The expiration or termination of this Agreement shall not relieve either Party of any obligation or liability that accrued prior to such expiration or termination.
ARTICLE 11 — INSURANCE
11.1 Licensor Insurance Requirements. Clearpoint shall obtain and maintain in full force and effect during the Subscription Term and for a period of two (2) years following the expiration or termination of this Agreement the following insurance coverages, at Clearpoint's sole cost and expense:
(a) Commercial General Liability Insurance: with limits of not less than Five Million Dollars ($5,000,000) per occurrence and Ten Million Dollars ($10,000,000) in the annual aggregate, covering bodily injury, property damage, personal injury, and advertising injury;
(b) Technology Errors and Omissions / Cyber Liability Insurance: with limits of not less than Ten Million Dollars ($10,000,000) per claim and Twenty Million Dollars ($20,000,000) in the annual aggregate, covering claims arising out of technology errors, omissions, and failures, unauthorized access to or disclosure of confidential or personal information, network security breaches, and data-breach notification and response costs; and
(c) Workers' Compensation Insurance: with limits not less than the statutory minimums required by applicable law in each jurisdiction where Clearpoint's employees perform services under this Agreement.
All insurance policies required under this Section 11.1 shall be issued by Northern Ridge Mutual Insurance Company or by insurance carriers with an A.M. Best financial strength rating of "A-" (Excellent) or better and a financial size category of "VIII" or higher, or equivalent ratings from another nationally recognized insurance rating agency. Clearpoint shall provide Quorum with certificates of insurance evidencing the coverages required under this Section 11.1 upon request and promptly upon each annual policy renewal. Such certificates shall provide that the insurer will endeavor to provide Quorum with at least thirty (30) days' prior written notice of any material change in, cancellation of, or non-renewal of such policies.
11.2 Quorum as Additional Insured. Quorum Insurance Holdings Corp. and its Affiliates shall be named as additional insureds on Clearpoint's commercial general liability insurance policy and technology errors and omissions / cyber liability insurance policy to the extent of Clearpoint's indemnification obligations and other liabilities under this Agreement. Such additional insured coverage shall be primary and non-contributory with respect to any other insurance maintained by Quorum. Clearpoint shall cause its insurers to issue endorsements reflecting Quorum's additional insured status and shall provide copies of such endorsements to Quorum upon request.
ARTICLE 12 — SECURITY AND COMPLIANCE
12.1 Security Requirements. Clearpoint shall comply at all times during the Subscription Term with the security requirements set forth in Exhibit D (Security Requirements), which are incorporated herein by reference. Without limiting the generality of the foregoing, Clearpoint's security obligations shall include, but not be limited to: (a) encryption of Customer Data in transit and at rest using industry-standard encryption algorithms and protocols (currently AES-256 for data at rest and TLS 1.2 or higher for data in transit); (b) implementation and maintenance of role-based access controls, multi-factor authentication, and least-privilege access policies; (c) regular vulnerability scanning and prompt remediation of identified vulnerabilities; (d) maintenance of a comprehensive information security program consistent with industry standards, including ISO 27001 and NIST Cybersecurity Framework; and (e) notification to Quorum of any confirmed security breach affecting Customer Data within twenty-four (24) hours of Clearpoint's confirmation of such breach, with a detailed written incident report to follow within seventy-two (72) hours. Clearpoint shall designate a senior information security officer as the primary point of contact for all security-related matters under this Agreement.
12.2 SOC 2 Type II Audit. Clearpoint shall obtain and maintain, at its sole cost and expense, an annual SOC 2 Type II audit report prepared in accordance with the American Institute of Certified Public Accountants (AICPA) Trust Services Criteria, conducted by an independent certified public accounting firm (currently Hawthorne & Ellers, CPAs LLP, or such other firm as Clearpoint may engage from time to time, subject to Quorum's reasonable approval). The SOC 2 Type II audit shall cover the Trust Services Criteria relevant to the Platform, including security, availability, processing integrity, and confidentiality. Clearpoint shall deliver a complete copy of each annual SOC 2 Type II audit report to Quorum within ninety (90) days of the close of the applicable audit period. The current SOC 2 Type II audit report covers the period from April 1, 2023 through March 31, 2024. In the event any SOC 2 Type II audit report contains material qualifications, exceptions, or findings, Clearpoint shall promptly develop and implement a remediation plan and shall provide Quorum with regular updates on the status of such remediation efforts.
12.3 Penetration Testing. Clearpoint shall conduct, at its sole cost and expense, annual penetration testing of the Platform and its hosting infrastructure, performed by an independent third-party security firm (currently Sentinel Cyber Solutions LLC, or such other firm as Clearpoint may engage from time to time, subject to Quorum's reasonable approval). Penetration testing shall include, at a minimum, external network penetration testing, application-level penetration testing, and social engineering testing. Clearpoint shall provide Quorum with an executive summary of the results of each annual penetration test within thirty (30) days of completion of such testing. In the event that penetration testing reveals any critical or high-severity vulnerabilities, Clearpoint shall promptly remediate such vulnerabilities and shall provide Quorum with written confirmation of remediation within the time periods specified in Exhibit D.
12.4 Regulatory Compliance. Clearpoint shall perform its obligations under this Agreement in compliance with all applicable federal, state, and local laws, rules, and regulations, including, without limitation:
(a) the Connecticut Data Privacy Act ("CTDPA"), Conn. Gen. Stat. § 42-515 et seq., and all regulations promulgated thereunder;
(b) the Health Insurance Portability and Accountability Act of 1996 ("HIPAA"), as amended by the Health Information Technology for Economic an

ENTERPRISE SAAS SUBSCRIPTION AGREEMENT

QUORUM INSURANCE HOLDINGS CORP.

CLEARPOINT ANALYTICS, INC.

ENTERPRISE SAAS SUBSCRIPTION AGREEMENT

PREAMBLE

RECITALS

Record

Parties

Dates

Amounts