Symplast Terms of Service

Please read these Terms of Service (“Terms”) carefully before using any of Symplast’s Services.

1. Binding Agreement. These Terms constitute a binding agreement between Symplast Acquisition Inc. (“Symplast”) and each customer who signs a Customer Agreement with Symplast (“Customer”). Customer accepts these Terms by clicking on the “I agree” checkbox when its representative downloads or installs any Hosted Programs or obtains any other Services from Symplast, and each time he or she uses any Hosted Programs or obtains any other Services thereafter. If Customer does not accept these Terms, none of its representatives may use any of the Hosted Programs or obtain any other Services from Symplast.

2. Definitions.

2.1 “Customer Agreement” means the Customer Agreement entered into by Customer and Symplast.

2.2 “Customer Data” means information entered into the Hosted Programs by Customer in the course of its authorized use of the Hosted Programs and stored on the Host Server for access by the Hosted Programs and retrieval by Customer.

2.3 “Electronic Services” means the Electronic Services specifically identified in Exhibit A to the Customer Agreement.

2.4 “Host Server” means the server or servers provided by Symplast or its agent through which Customer accesses the Hosted Programs.

2.5 “Hosted Programs” means the computer software in object code form owned or provided by Symplast as described in Exhibit A to the Customer Agreement; updates, upgrades and other modifications to the software described in Exhibit A to the Customer Agreement; and online documentation.

2.6 “Services” means Hosting Services, Electronic Services, Support Services or other services specifically identified in Exhibit A to the Customer Agreement.

3. Services.

3.1 Data Security. Customer agrees to access the Hosted Programs and to store and retrieve data using only software and hardware authorized by Symplast. Symplast agrees to maintain the security of Customer Data using industry-standard data security protocols, and other methods

reasonably deemed to be adequate for secure business data and to notify Customer in the event of a breach of security involving Customer Data. Symplast agrees to retain Customer data on a secure server and to maintain data recovery and data backup facilities in accordance with accepted industry practices.

3.2 Ownership of Data and Subscription. Customer will retain ownership of all Customer Data stored or retrieved in connection with use of the Hosted Programs, which data will be subject to the confidentiality provisions set forth below. Customer agrees that storage or caching of Customer Data is not an infringement of any intellectual property rights of Customer. Customer agrees that it will not store data on the Host Server that is subject to the rights of any third parties without first obtaining all required authorizations and rights in writing from such third parties. Provided that Symplast implements appropriate de-identification criteria in accordance with the Standards for Privacy of Individually Identifiable Health Information set forth in 45 C.F.R. § 164.514(b), Customer acknowledges and agrees that de-identified information is not Protected Health Information as defined in the applicable regulations and that Symplast may use such de-identified information for any lawful purpose.

3.3 Support Services. Symplast will provide Customer with telephone support for the Hosted Programs and Services during business hours, which are 9:00 a.m. to 8:00 p.m. Eastern Standard Time, Monday through Friday, excluding holidays (the “Business Hours”) subject to: (a) timely payment of Symplast invoices and support fees, and (b) Customer’s compliance with its obligations under these Terms.

3.4 Data Import Limitations. Customer is responsible to provide data exactly in the format specified by Symplast’s documentation. The Symplast database resulting from import of Customer’s data will be a reflection of the quality of data provided by Customer. Symplast is not responsible for inability to perform services due to improperly formatted or corrupt files, viruses on media provided, or incompatible backup media or software. Customer acknowledges that transferring data is subject to the possibility of human and machine errors, omissions, and losses, including inadvertent loss of data or damage to media that may give rise to loss or damage. Symplast will not be liable for any such errors, omissions, or losses. It is the responsibility of Customer to adopt reasonable measures to limit the impact of such problems, including backup of original data. Customer is also responsible for complying with all local, state, and federal laws pertaining to the use and disclosure of any data.

3.5 Data Import Acceptance. Following a data import, Symplast warrants the integrity of the supplied production database for a period of 5 business days from the importation date, or until the database is altered in any way by Customer, whichever comes first. During the warranty period, Customer may report any discrepancies or errors, and upon verification of the error, Symplast may at its option correct the database or refund the amount paid for the data import service.

3.6 Data Migration. Customer agrees that prior to contacting or allowing Symplast to perform clinical or billing data migration from any previous systems and/or databases or to perform other services on Customer’s computers or computer systems, it is Customer’s

responsibility to back-up the data, software, information or other files stored on Customer’s computers or computer systems. Symplast will not be held responsible for any problems arising from third party software installed on Customer’s computers or computer systems by Symplast’s technicians, Customer or other third party. Symplast will not be held liable for lost data due to hardware failure, virus, spyware, corruption or any other situation. If any problems with third party software or hardware arise, it is Customer’s responsibility to obtain support from the manufacturer of the product at fault. Customer acknowledges and agrees that a migration from Customer’s previous systems and/or databases will be at Customer’s sole and exclusive risk. Customer also acknowledges and agrees that Symplast assumes no liability or responsibility for any loss or damage of any kind whatsoever arising from or related to this migration including without limitation to incorrect, missing, lost or corrupted data.

3.7 Onsite Training. Onsite training is billed at a day rate. A ‘day’ is defined as a standard business day of at most 8 hours (excluding a meal break). Hours beyond that definition will be billed additionally at current after-hours consulting rates. Airfare or equivalent travel for Onsite training is billed separately, as incurred by Symplast. Customer is responsible for non- refundable airfare fees and one day of services fees for all services cancelled or rescheduled less than 7 days prior to the start of the services.

3.8 Deadlines. Symplast’s ability to deliver the requested Services, at the scope and scale described, depend on Customer providing all necessary information and assistance in a timely manner. In the event that all necessary information and assistance is delayed by Customer, Symplast’s delivery of requested Services may be delayed.

3.9 Consulting Limitations. Symplast warrants that all consulting services are performed by qualified personnel, and that services will be provided for the scope and time period indicated. However, Symplast does not guarantee any specific results from training or other consulting services. As with all consulting services, effectiveness depends largely upon Customer’s ability and willingness to use and implement ideas, concepts, and practices presented by Symplast consultants.

3.10 Limitation of Symplast Interface Use. The “Symplast Interface” makes available to Customer Symplast’s standard external data interface functions (“APIs”) for the purpose of enabling Customer to share specific data between Symplast’s Hosted Programs and other software and/or data sources owned or licensed by Customer unrelated to Symplast (the “External System”). Customer’s use of the Symplast Interface and all Symplast APIs is expressly limited to the registered interfaced External Systems described in Exhibit A to the Customer Agreement. Access to or use of the Symplast Interface service by External Systems not disclosed therein is strictly prohibited. Support is limited to verification of performance of the APIs as interfaced to the External System. Additional Customer support may be available at Symplast’s then-current rates for custom technical services.

3.11 Limitation of Symplast Interface Liability. Notwithstanding any other provision of these Terms, Symplast has no liability under these Terms, including the HIPAA Business Associate Addendum, for any disclosure of Protected Health Information (“PHI”) made by means of access to the APIs by or on behalf of Customer, or by means of access by any third party to the extent

such third party obtained access to the APIs as a result of intentional disclosure by Customer or any breach of these Terms or any negligence by Customer, its personnel, agents or third-party contractors. In addition, Symplast has no liability under these Terms for any modification of Customer’s hosted application data, or for any consequences that may arise from such modifications (including, but not limited to, incorrectly modified or lost data) made by means of access to the APIs by or on behalf of Customer, or by means of access by any third party to the extent such third party obtained access to the APIs as a result of intentional disclosure by Customer or any breach of these Terms or any negligence by Customer, its personnel, agents or third-party contractors. By agreeing to these Terms, Customer also agrees to Symplast’s Business Associate Agreement and incorporated by reference into these Terms, unless Customer has agreed to a different Business Associate Agreement with Symplast that applies to its use of the Services.

4. Termination.

4.1 Early Termination. Without prejudice to any other remedies, either party will have the right at any time by giving notice to the other to terminate these Terms in any of the following events: (a) if the other party commits a material breach of any of the terms or conditions of these Terms and fails to cure such breach within thirty (30) calendar days after delivery of notice thereof, including but not limited to the failure to pay in full any outstanding fees due within ten (10) days written notice of such non-payment; (b) at a party’s option, if the other party becomes insolvent, makes a general assignment for the benefit of creditors, suffers or permits an appointment of a receiver for its business or assets, becomes subject to any proceedings under any bankruptcy or insolvency law, whether domestic or foreign, or is liquidated, voluntarily or otherwise; or (c) if any substantial change takes place in the management, ownership or control of the other party resulting in the management, ownership or control of the other party by a competitor of the first party or by a company or other entity with a division or subsidiary that is a competitor of the first party.

4.2 Effect of Termination. Termination of these Terms will not limit either party from pursuing other remedies available to it, including injunctive relief, nor will such termination relieve Customer’s obligation to pay all fees that have accrued or are otherwise owed by Customer under these Terms. Upon termination of these Terms, Customer’s access to the Hosted Programs and all Services will be terminated. Upon termination, other than for breach on the part of Symplast under Section 4.1(a) above, all unpaid fees owed by Customer to Symplast will be due and payable in full immediately.

4.3 Return of Customer Data. If these Terms is terminated, upon Customer’s request and at Customer’s expense, Symplast will make available to Customer a copy of the Customer Data. Unless Customer requests return of Customer Data, including patient records, within three (3) months of termination or expiration of these Terms by paying the then applicable data transfer fees to Symplast, Symplast will not be liable to maintain such data on its own and will destroy the data in accordance with the provisions of HIPAA, and the sole liability and responsibility as to the Customer Data, including patient records, will rest with Customer.

4.4 Survival of Terms. Upon termination or expiration of these Terms, and in addition to any provisions that expressly provide to survive any termination of these Terms, the provisions of these Terms providing for payment of fees to Symplast, protection of Symplast’s proprietary rights, warranties, the limitation of liability, compliance with laws, indemnities, arbitration and other provisions of these Terms concerning the ongoing interests of Symplast, including, but not limited to, Sections 4.2, 4.3, 4.4, 5, 6, 7, 8, 9 and 10, will continue and survive in full force and effect.

5. Indemnity.

5.1 Symplast Indemnification. Symplast will, except as otherwise provided below, indemnify, defend and hold Customer and Customer’s officers, directors, shareholders, and managers, harmless against any damages, costs, fees (including attorneys fees), claims whether in law or in equity), obligations, actions, lawsuits, debts, judgments, losses, fines, penalties, expenses, or liabilities resulting from any third party claims that the Hosted Programs or the use thereof in accordance with its related documentation violates or infringes any copyright, patent, trade secret, or other valid proprietary right of any other person or entity, provided that: (a) Customer provides Symplast with prompt written notice of the initial claim and filing of the lawsuit relating thereto; (b) Symplast has sole control of the defense and all related settlement negotiations; and (c) Customer provides Symplast with all available information, assistance, authority, and cooperation to enable Symplast to defend, compromise, or settle the lawsuit as provided herein. In the event the Hosted Programs are held or are believed by Symplast to infringe, Symplast will have the option, at its expense, to (i) replace or modify the Hosted Programs to be non-infringing, or (ii) procure the right for Customer to continue to use the Hosted Programs. Symplast will have no liability for any infringement or misappropriation of any copyright, trade secrets, or other proprietary rights resulting from (A) modifications of the Hosted Programs made at the request of Customer or made by anyone other than by Symplast, (B) use other than as specified under these Terms and the related documentation, or (C) the use of the Hosted Programs with products not specifically approved in writing by Symplast for use with the Software. This Section 5.1 states Symplast’s entire liability and Customer’s exclusive remedy for infringement.

5.2 Customer Indemnification. In addition to any other Customer obligations of indemnity provided in these Terms, Customer agrees to indemnify, defend and hold harmless Symplast, its affiliates, and their directors, officers, shareholders, employees and agents from and against any liabilities, losses, damages, causes of action or injuries, together with costs and expenses, including reasonable attorneys’ fees, resulting from (a) any third party claims against Symplast asserting that Customer Data or Customer’s use of the Hosted Programs in violation of these Terms violates that third party’s patent, trade secret or copyright rights, otherwise harms the third party, or (b) any failure on the part of Customer to pay any taxes, duties or assessments Customer is obligated to pay hereunder or as set forth in Section 8. The right of indemnification as set forth herein will be subject to the following: (i) Symplast provides Customer with prompt written notice of the initial claim and filing of the lawsuit relating thereto; (ii) Customer has sole control of the defense and all related settlement negotiations; and (iii) Symplast provides Customer with all available information, assistance, authority, and cooperation to enable Customer to defend, compromise, or settle the lawsuit as provided herein.

6. Warranties; Disclaimers; Remedies.

6.1 Hosted Program Warranty. Symplast warrants that the Hosted Programs will materially perform in accordance with the documentation so long as: (a) Customer has a current, paid-up right to use the Hosted Programs; and (b) Customer’s access to the Host Server meets minimum criteria communicated by Symplast from time to time.

6.2 Services Warranty. Symplast warrants that its Hosted Program Services, Support Services, Electronic Services, and other Services described in Exhibit A to the Customer Agreement will be performed consistent with generally accepted industry standards.

6.3 Disclaimers. THE WARRANTIES ABOVE ARE EXCLUSIVE AND IN LIEU OF ALL OTHER WARRANTIES, WHETHER EXPRESS OR IMPLIED, INCLUDING THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. Symplast does not warrant that the Hosted Programs will operate in the combinations that Customer may select for use, that the operation of the Hosted Programs will be uninterrupted or error-free, or that all Hosted Program errors will be corrected.

6.4 Exclusive Remedies. For any breach of the warranties contained in this Section 6, Customer’s exclusive remedy, and Symplast’s entire liability, will be:

6.4.1 For Hosted Program Services and Electronic Services: The correction of Hosted Program errors that cause breach of the warranty. Any error not reported to Symplast by Customer within thirty (30) days of its discovery will be deemed waived and accepted by Customer.

6.4.2 For all other Services: The re-performance of the Services, provided that Customer notifies Symplast in writing of any defects in the Services within thirty (30) days of their performance.

7. LIMITATION OF LIABILITY.

7.1 IN NO EVENT WILL EITHER PARTY BE LIABLE TO THE OTHER PARTY FOR SPECIAL, CONSEQUENTIAL, EXEMPLARY, INCIDENTAL, INDIRECT OR PUNITIVE DAMAGES OR COSTS (INCLUDING LEGAL FEES AND EXPENSES) OR LOSS OF GOODWILL OR PROFIT IN CONNECTION WITH THE SUPPLY, USE OR PERFORMANCE OF OR INABILITY TO USE THE PRODUCTS, ANY SERVICES PROVIDED HEREUNDER, OR IN CONNECTION WITH ANY CLAIM ARISING FROM THESE TERMS, EVEN IF A PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES OR COSTS.

7.2 IN NO EVENT WILL SYMPLAST BE LIABLE TO CUSTOMER UNDER THESE TERMS, REGARDLESS OF THE FORM OF CLAIM OR ACTION, IN AN AMOUNT THAT EXCEEDS THE TOTAL FEES PAID TO SYMPLAST UNDER THESE TERMS FOR THE MOST RECENT SIX MONTH PERIOD. THIS LIMITATION OF LIABILITY IS THE TOTAL AGGREGATE FOR A PARTY, AND IS NOT PER INCIDENT.

7.3 The provisions of these Terms allocate the risks between Symplast and Customer. The parties agree that Symplast’s pricing and other terms and conditions of these Terms reflect the allocation of risk and the limitation of liability specified herein.

7.4 Except for actions for nonpayment or breach of Symplast’s proprietary rights in the Hosted Programs, no action, regardless of form, arising out of these Terms may be brought by either party more than one year after the cause of action has accrued.

8. Taxes. The fees listed in these Terms do not include taxes. If Symplast is required to pay sales, use, property, value-added, withholding, excise or other taxes, duties, or governmental charges based on the License Granted or Services provided under these Terms or on Customer’s use of Hosted Programs or Services, then such taxes, duties, or governmental charges will be billed to and paid by Customer. If Symplast is found to be responsible for the withholding and payment of taxes on behalf of Customer, Customer agrees to indemnify Symplast with respect to the full amount of taxes due together with applicable interest and penalties. If Customer is required to withhold any tax from any payment, then the amount of the payment will be automatically increased to totally offset such tax so that the amount remitted to Symplast, net of all taxes, equals the amount invoiced or otherwise due. This Section will not apply to taxes based on Symplast’s net income.

9. General Terms.

9.1 Nondisclosure. Each party to these Terms may, from time to time, furnish the other party to these Terms with confidential information, which includes, but is not limited to, the Hosted Programs and the terms and conditions under these Terms, and other information and materials that contain confidential and proprietary information or trade secrets relating to their respective businesses (“Confidential Information”). The party hereto receiving such information (“Recipient”) will use the same degree of care to avoid disclosure, publication or dissemination of the Confidential Information of the other party (“Owner”) as it uses with its own similar confidential information which it does not wish to disclose, publish or disseminate but such standard of care will in no event be less than a reasonable standard of care. During the term of the Customer Agreement and for a period of two years after termination of the Customer Agreement, Confidential Information is not to be disclosed to any person other than the employees of Recipient, and consultants, contractors or agents of Recipient, if any, who have a need to know and who have executed a nondisclosure agreement containing substantially similar confidentiality obligations to those contained in these Terms prior to such disclosure. In the event that either party is requested or required for the purposes of legal, administrative, or arbitration to disclose any Confidential Information, the party receiving such disclosure request will provide the other party with immediate written notice of any such request or requirement so that such party may seek an appropriate protective order or other relief. A party’s Confidential Information will not include information that: (a) is or becomes a part of the public domain through no act or omission of the other party; (b) was in the other party’s lawful possession prior to the disclosure and had not been obtained by the other party either directly or indirectly from the disclosing party; (c) is lawfully disclosed to the other party by a third party without restriction on disclosure; or (d) is independently developed by the other party.

9.2 Trademarks. Except for linking to Symplast web sites, Customer may not use any Symplast logo or trademark, whether or not such mark(s) are registered, without prior written approval from Symplast. This includes use on printed materials of any kind as well as electronic mediums such as Internet web pages or email. Furthermore, the use of the Symplast name (or any derivative thereof) in Customer’s URL, business name, or the names of any add-on products or services Customer may be offering independent of Symplast is strictly prohibited. Additionally, using the Symplast name in paid targeted keyword advertising campaigns on search engines is also prohibited.

9.3 Compliance with Laws. Each party will comply with all applicable federal and state laws and regulations relating in any way to its performance under these Terms. Each party will defend, indemnify, and hold the other party, its subsidiaries and affiliated companies, and their respective officers, directors and agents, harmless from and against any and all damages and expenses, including legal fees, claimed by third parties directly or indirectly as a consequence of a party’s’ failure to comply with any applicable laws or regulations. This obligation will survive termination of these Terms.

9.4 Governing Law and Dispute Resolution. These Terms, and all matters arising out of or relating to these Terms or the Customer Agreement, will be governed by the laws of the State of Florida, without giving effect to principles regarding conflicts of laws. Any controversy or claim arising out of or relating to these Terms, or breach thereof, will be submitted to the following procedure: (a) direct negotiation in a settlement conference to be scheduled as soon as possible after the dispute arises; (b) if no resolution is reached within sixty (60) days of the settlement conference, the parties will submit the dispute to non-binding mediation in Fort Lauderdale, Florida under the mediation rules of the American Arbitration Association; (c) if no settlement is reached within sixty (60) days of the start of mediation, either party may seek legal redress in a forum of competent jurisdiction.

9.5 Notice. All notices which are required or permitted hereunder will be sufficient, if in writing, and delivered personally or by registered or certified mail, first class postage pre-paid as follows (or to such other address as will be set forth in a notice given in the same manner):

• (a)  if to Symplast:
• Symplast Acquisition Inc.
• 205 SW 84th Avenue, Plantation, FL 33324
• Attn: Symplast Accounting
• (b)  if to Customer:

Contact information per the executed Customer Agreement

9.6 U.S. Government and HIPAA. The Hosted Programs and accompanying documentation are commercial computer software and documentation developed exclusively at private expense and in all respects are proprietary data belonging to Symplast. If the Hosted Programs and accompanying documentation are used under the terms of a Department of Defense or civilian agency contract, such use, reproduction and disclosure of such software and documentation by the Government is subject to the restrictions set forth in these Terms in accordance with 48 C.F.R. 227.7202 or 48 C.F.R. 12.212, respectively. Symplast’s HIPAA Business Associate Agreement is incorporated into these Terms by this reference.

9.7 Force Majeure. Neither party will be liable in damages or have the right to terminate these Terms or the Customer Agreement for any delay or default in performing hereunder if such delay or default is caused by conditions beyond its control including, but not limited to Acts of God, Government restrictions (including the denial or cancellation of any export or other necessary license), wars, insurrections and/or any other cause beyond the reasonable control of the party whose performance is affected.

9.8 Assignment. Customer may not assign these Terms or the Customer Agreement or any rights or obligations hereunder or thereunder without prior written consent of Symplast, which consent will not be unreasonably withheld or delayed. Any such assignment without prior consent will be void. Symplast, at its sole election, may assign any and all of its rights and obligations under these Terms or the Customer Agreement.

9.9 Entire Agreement; Amendments. These Terms, together with the Customer Agreement and the Exhibits thereto, constitutes the complete agreement between the parties and supersedes all prior agreements or representations, written or oral, concerning the subject matter of hereof and thereof. Symplast may modify the terms of the agreement between the parties by sending written notice, by e-mail or otherwise, to Customer. Customer may notify Symplast in writing within 30 days of its receipt of a modification notification that Customer does not wish to accept the new terms. In the absence of such written non-acceptance notification with the 30-day period, Customer confirms acceptance of the new terms by continuing to use the Hosted Programs and/or Services. If Customer does not accept the new terms by notifying Symplast within the 30-day period, then Customer may continue to use the Hosted Programs and Services under Customer’s existing terms until the end of the then current term of these Terms and the Customer Agreement, at which time the Customer Agreement will not automatically renew, but will instead terminate. It is expressly agreed that these Terms will supersede the terms in any Customer purchase order or other ordering document.

9.10 Severability; Waiver. In the event any provision of these Terms is held to be invalid or unenforceable, the remaining provisions of these Terms will remain in full force. The waiver by either party of any default or breach of these Terms will not constitute a waiver of any other or subsequent default or breach.

9.11 Relationship of Parties. Nothing in these Terms will constitute or be deemed to constitute a partnership between the parties hereto or constitute or be deemed to constitute Customer as the agent of Symplast or its affiliates, for any purpose whatever, and neither party will have authority or power to bind the other party or its affiliates, or to contract in the name of or create a liability against the other party or its affiliates, in any way or for any purpose.

This HIPAA BUSINESS ASSOCIATE AGREEMENT ADDENDUM (the “Addendum”), by and between Symplast and the above-referenced Customer, is hereby incorporated into the above Master SaaS Agreement and is effective as of the Effective Date of the Agreement.

RECITALS

A. Customer and Symplast are parties to one or more agreements (each such agreement, a “Covered Contract,” and collectively, the “Agreement”) pursuant to which Symplast provides certain services to Customer, and, in connection with those services, Customer discloses to Symplast certain health information (the “Protected Health Information” as defined in 45 C.F.R. § 164.504) that is subject to protection under the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”), and certain regulations promulgated by the U.S. Department of Health and Human Services to implement certain provisions of HIPAA (herein “HIPAA Regulations” found at 45 C.F.R. Parts 160-164).

B. Symplast, as a recipient of Protected Health Information from Customer, is a “Business Associate” as that term is defined in the HIPAA Regulations.

C. Pursuant to the HIPAA Regulations, all Business Associates of entities such as Customer must, as a condition of receiving Protected Health Information in the course of doing business with Customer, agree in writing to certain mandatory provisions regarding, among other things, the use and disclosure of Protected Health Information.

D. The purpose of this Addendum is to satisfy the requirements of the HIPAA Regulations, including, but not limited to, 45 C.F.R. § 164.504(e), as the same may be amended from time to time.

OBLIGATIONS OF THE PARTIES

1. Scope of Use of Protected Health Information. Symplast may not: (a) use or disclose Protected Health Information it receives from Customer for any purpose other than the purposes contemplated by the Agreement, as required or allowed under the HIPAA Regulations, or as otherwise required by law; or (b) use or disclose Protected Health Information in a manner that violates or would violate the HIPAA Regulations if such activity were engaged in by Customer. Customer hereby represents and warrants (i) that the execution and performance of this Addendum will not conflict with or violate any provision of any law having applicability to Customer; (ii) that Customer has the right to provide the Protected Health Information provided to Symplast under this Addendum; and (iii) that the use, provision of access and/or disclosure by Symplast of any Protected Health Information as authorized or contemplated by this Agreement will not conflict with or violate any provision of any law having applicability to either of the Parties, including, without limitation, HIPAA and the HIPAA Regulations, nor constitute a tort against any third party, nor constitute a breach of contractual obligations between any third party and Customer.

2. Safeguards for the Protection of Protected Health Information. Symplast will use reasonable efforts to implement and maintain such business and technological safeguards as are necessary to ensure that the Protected Health Information disclosed between Customer and Symplast is not used or disclosed by Symplast except as is provided in the Agreement.

3. Reporting of Unauthorized Use or Disclosure. Symplast shall promptly report to Customer any use or disclosure of Protected Health Information of which Symplast becomes aware that is not provided for or permitted in the Agreement or the HIPAA Regulations. Symplast shall permit Customer to investigate any such report in accordance with Section 9 of this Addendum.

4. Use of Subcontractors. To the extent that Symplast uses one or more subcontractors or agents to provide services under the Agreement, and such subcontractors or agents receive or have access to the Protected Health Information, Symplast shall either sign a Business Associate Agreement with such subcontractor or agent containing substantially the same restrictions and conditions related to the Protected Health Information as those that apply to Symplast under this addendum, or ensure that such subcontractor or agent agrees to implement reasonable and appropriate safeguards to protect such information consistent with the requirements of 45 C.F.R. 164.314(a)(1)(i).

5. Data Transfer Security. Symplast will take reasonable measures to protect the security and integrity of the Protected Health Information when electronically transferring such information.

6. Access Security. Symplast will take reasonable security measures to protect the Protected Health Information from unauthorized access. Access to Symplast’s computer networks and systems and the Protected Health Information will be controlled via a user ID and password. Symplast IS NOT RESPONSIBLE FOR ANY UNAUTHORIZED USE OR DISCLOSURE OF A USER ID OR PASSWORD, OR FOR ANY BREACH OF THIS ADDENDUM ARISING AS A RESULT OF ANY SUCH UNAUTHORIZED USE OR DISCLOSURE BY OR ON BEHALF OF CUSTOMER.

7. Authorized Access to and Alteration of Protected Health Information. In order to help ensure the accuracy of the Protected Health Information, Symplast, on an ongoing basis, will provide Customer access for inspection to any such Protected Health Information then retained in Symplast’s possession. If any of the Protected Health Information is found to be inaccurate or incomplete, Customer may submit amendments or corrections to the Protected Health Information and Symplast shall promptly incorporate all such amendments or corrections. Symplast shall cooperate promptly with Customer in responding to any request made by any subject of such information to Customer to inspect and/or copy such information. Symplast may not deny Customer access to any Protected Health Information if such information is requested by the subject seeking access to it.

8. De-identified Information. Provided that Symplast implements appropriate de- identification criteria in accordance with the Standards for Privacy of Individually Identifiable Health Information set forth in 45 C.F.R. § 164.514(b), Customer acknowledges and agrees that de-identified information is not Protected Health Information as defined in the applicable regulations and that Symplast may use such de-identified information for any lawful purpose.

9. Accounting, Audits, and Inspection.

a. Symplast will keep an accounting of all disclosures, outside its normal course of business, of the Protected Health Information (the “Disclosure Accounting”) on an ongoing basis and maintain the Disclosure Accounting for a period of at least six (6) years. At a minimum, the Disclosure Accounting will contain (i) the date of the disclosure; (ii) the name of the entity or person who received the Protected Health Information and, if known, the address of such entity or person; (iii) a brief description of the Protected Health Information disclosed; and (iv) a brief statement of the purpose of the disclosure that reasonably informs the individual of the basis for the disclosure; or in lieu of such statement a copy of the subject’s written authorization or request for disclosure pursuant to the HIPAA Regulations. Symplast will provide the Disclosure Accounting to Customer or a subject individual within sixty (60) days of receiving a written request from Customer or such subject individual.

b. Subject to compliance with Symplast’s security requirements, the Secretary of Health and Human Services and/or Customer, or their respective authorized agents or contractors, may, at their expense, examine Symplast’s facilities, systems, procedures and records related to the Protected Health Information, as may be required to determine that Symplast is in compliance with the HIPAA Regulations, the Agreement or this Addendum. If it is determined that Symplast is in violation of the HIPAA Regulations, the Agreement or this Addendum, Symplast shall promptly remedy any such violation and shall certify the same in writing. The fact that Customer inspects, or fails to inspect, or has the right to inspect, Symplast’s facilities, systems and procedures does not relieve Symplast of its responsibility to comply with this Addendum, nor does Customer’s failure to detect, or to detect but fail to call Symplast’s attention to or require remediation of any unsatisfactory practice, constitute acceptance of such practice or a waiver of Customer’s enforcement rights.

10. Right of Termination. In the event that Symplast breaches a material term of this Addendum and fails to cure such breach within thirty (30) days after receipt of written notice thereof, Customer will have the right to terminate the relevant Covered Contract under which Customer disclosed the Protected Health Information that is the subject of the relevant breach.

11. Effect of Termination. Upon the termination or expiration of a Covered Contract for any reason, Symplast, at its option, will either (i) return, delete, purge or destroy, all Protected Health Information received from Customer under such Covered Contract that Symplast maintains in any form, or (ii) if Symplast determines that such return or destruction is not feasible, Symplast will continue to restrict such Protected Health Information in compliance with this Addendum.

12. Incorporation; Effect on Agreement. This Addendum is incorporated into and made part of each Covered Contract and in each case is subject to the terms and conditions set forth therein, provided that, in the event that a conflict arises between this Addendum and any Covered Contract (exclusive of this Addendum), the terms and conditions of this Addendum shall govern. Except as specifically required to implement the purposes of this Addendum, and otherwise except to the extent inconsistent with this Addendum, all other terms of the Agreement shall remain in full force and effect, and the Parties hereby ratify and affirm the Agreement except as superseded or modified by this Addendum.

13. Construction. This Addendum shall be construed only as broadly as necessary to implement and comply with the HIPAA Regulations. The parties agree that any ambiguity in this Addendum shall be resolved in favor of a meaning that complies and is consistent with the HIPAA Regulations.