4359.2d1cfc8387b2ff68.js

js smoreshealth.com collected 2026-10-09 23:01:58 UTC 263,342 bytes, 23 lines download raw bytes

1"use strict";(self.webpackChunk_N_E=self.webpackChunk_N_E||[]).push([[4359],{14045:(e,t,n)=>{n.d(t,{Cq:()=>v,Fv:()=>r,Ge:()=>l,Jh:()=>o,ML:()=>s,PA:()=>d,UA:()=>y,_Q:()=>x,cb:()=>E,ff:()=>C,gY:()=>P,hG:()=>m,lA:()=>S,mp:()=>c,vk:()=>i.vk,wH:()=>b,xK:()=>A});var i=n(49484),a=n(47870);let r={community:"Community spaces and engagement",intake:"Participant intake and profiles",documentation:"Service documentation",scheduling:"Scheduling",messaging:"Messaging",assessments:"Assessments and outcomes",reporting:"Reporting and exports",telehealth:"Video visits (telehealth)",claims:"Claims submission and billing workflows"},s={workspace:"Workspace setup",roles:"Staff roles and permissions",workflows:"Workflow configuration",onboarding:"Onboarding guidance and launch questions",admin_materials:"Administrator training materials",peer_materials:"Peer staff training materials",recordings:"Recorded video training"},o=["intake","documentation","scheduling","messaging"],l={community:"Community",standard:"Standard",growth:"Growth"},d="99",c="1";function m(e=!1,t="standard"){let n="standard"===t||"growth"===t;return{version:1,...e?{scope:(0,a.rN)(),rampToRate:!0,implementationPaymentMode:"custom"}:{},plan:t,community:(0,i.H7)(),rampToRate:"growth"===t,implementationPaymentMode:"upfront",features:n?[...o,"telehealth","claims"]:[...o,"telehealth"],customFeatures:"",implementationFee:!0,implementationAmount:"community"===t?"200":"",implementationStart:"signed",implementationStartCustom:"",implementationItems:["workspace","roles","workflows","onboarding","recordings"],implementationDelivery:"remote",implementationCustom:"",trainings:[],installments:[],seatRows:[{role:"Staff",count:""}],billingModel:"per_seat",rate:"community"===t?i.zU:n?d:"",billingCadence:"monthly",pricePeriod:"monthly",ramp:"growth"===t,phases:"growth"===t?i.vk.map(e=>({...e})):[],additionalSeats:"community"===t?"same_rate":"approval",additionalSeatRate:"",proration:"calendar_days",seatChangeTerms:"",minimumSeatsCommitted:!0,paymentTiming:"advance",invoiceDays:"0",subscriptionDue:"cycle",subscriptionDueDate:"",subscriptionDueCustom:"",fixedFeeIndependent:!1,billingStart:"launch",termMonths:"12",lateStart:"shift",launchWindowDays:"",launchDefinition:"",claimsPerClaim:n?c:"",claimsMonthly:"0",renewal:"signed",renewalRate:"",renewalMonths:"12",renewalNoticeDays:"",renewalCustom:"",support:"standard",supportCustom:"",customPricing:"",additionalTerms:"",approvalBy:"",approvalReference:""}}let u={implementationStart:["signed_paid","signed","launch","custom"],implementationDelivery:["remote","onsite","hybrid"],billingModel:["per_seat","fixed","custom"],billingCadence:["monthly","annual"],additionalSeats:["same_rate","custom_rate","approval"],pricePeriod:["monthly","annual"],proration:["calendar_days","billing_days","none","custom"],paymentTiming:["advance","arrears"],subscriptionDue:["cycle","signing","launch","date","custom","two_installments"],billingStart:["date","launch"],lateStart:["shift","fixed_end"],renewal:["signed","automatic","custom"],support:["standard","priority","custom"]};function h(e){if(!e||"object"!=typeof e||Array.isArray(e))throw Error("Invalid deal details.");return e}function p(e,t,n=6e3){if("string"!=typeof e||e.length>n||/[\u0000-\u0008\u000b\u000c\u000e-\u001f]/.test(e))throw Error(`Invalid ${t}.`);return e.replace(/\r\n?/g,"\n")}function g(e,t,n){if(!Array.isArray(e)||e.length>t)throw Error("Too many or invalid deal rows.");return e.map(e=>n(h(e)))}function f(e,t,n){if(!t.includes(e))throw Error(`Invalid ${n}.`);return e}function y(e){let t=h(e);if(1!==t.version)throw Error("Unsupported deal format.");let n=m(!1,void 0===t.plan||"team"===t.plan?"standard":f(t.plan,["community","standard","growth"],"plan"));if(void 0!==t.community?n.community=(0,i.I9)(t.community):delete n.community,void 0!==t.evvConfigurationAmount&&(n.evvConfigurationAmount=p(t.evvConfigurationAmount,"EVV configuration fee",20)),void 0!==t.rampToRate){if("boolean"!=typeof t.rampToRate)throw Error("Invalid ramp target setting.");n.rampToRate=t.rampToRate}for(let e of(void 0!==t.implementationPaymentMode&&(n.implementationPaymentMode=f(t.implementationPaymentMode,["upfront","split","schedule","custom"],"implementation payment schedule")),Object.keys(n))){if("plan"===e||"community"===e||"rampToRate"===e||"implementationPaymentMode"===e||"evvConfigurationAmount"===e)continue;let i=n[e];if("string"==typeof i){let i=u[e];Object.assign(n,{[e]:i?f(t[e],i,e):p(t[e],e)})}else if("boolean"==typeof i){if("boolean"!=typeof t[e])throw Error(`Invalid ${e}.`);Object.assign(n,{[e]:t[e]})}}for(let e of["seatDiscountPercent","seatDiscountMonths"])void 0!==t[e]&&(n[e]=p(t[e],e,20).trim());void 0!==t.subscriptionTerm&&(n.subscriptionTerm=f(t.subscriptionTerm,["annual","month_to_month"],"subscription term"));let o=(e,t,n)=>{if(!Array.isArray(e)||e.length>t.length||new Set(e).size!==e.length)throw Error(`Invalid ${n}.`);return e.map(e=>f(e,t,n))};if(n.features=o(t.features,Object.keys(r),"features"),n.implementationItems=o(t.implementationItems,Object.keys(s),"implementation items"),n.seatRows=g(t.seatRows,20,e=>({role:p(e.role,"seat role",160),count:p(e.count,"seat count",8)})),n.phases=g(t.phases,24,e=>({from:p(e.from,"first month",4),to:p(e.to,"last month",4),rate:p(e.rate,"phase rate",20)})),n.trainings=g(t.trainings,20,e=>({mode:f(e.mode,["remote","in_person"],"training format"),audience:p(e.audience,"audience",200),sessions:p(e.sessions,"sessions",4),hours:p(e.hours,"hours",8),details:p(e.details,"training details",2e3),...void 0!==e.topics?{topics:o(e.topics,Object.keys(a.ei),"training topics")}:{}})),n.installments=g(t.installments,24,e=>({amount:p(e.amount,"installment amount",20),due:f(e.due,["signing","launch","date","custom","schedule"],"installment due"),date:p(e.date,"installment date",10),details:p(e.details,"installment details",2e3)})),n.implementationPaymentMode&&"custom"!==n.implementationPaymentMode&&(n.installments=w(n.implementationAmount,n.implementationPaymentMode)),void 0!==t.scope){let e=h(t.scope);if(1!==e.version||e.serviceCatalogVersion!==a.O_)throw Error("Unsupported service catalog version.");n.scope={onSiteVisits:p(e.onSiteVisits,"on-site visits",8),onSiteHours:p(e.onSiteHours,"on-site hours",8),version:1,serviceCatalogVersion:a.O_,exceptions:g(e.exceptions,20,e=>({category:f(e.category,Object.keys(a.HE),"exception category"),description:p(e.description,"exception description",6e3)}))}}return n}let b=e=>{if(!/^\d{1,9}(?:\.\d{1,2})?$/.test(e.trim()))return null;let[t,n=""]=e.trim().split(".");return 100*Number(t)+Number(n.padEnd(2,"0"))},v=e=>/^[1-9]\d{0,5}$/.test(e);function w(e,t){let n=b(e);if(null===n)return[];if("schedule"===t)return[{amount:(n/100).toFixed(2),due:"schedule",date:"",details:""}];let i="split"===t?Math.ceil(n/2):n,a=(e,t)=>({amount:(e/100).toFixed(2),due:t,date:"",details:""});return"split"===t?[a(i,"signing"),a(n-i,"launch")]:[a(n,"signing")]}function S(e,t){let n=Number(t);if(!v(t)||n>120)return[];if(n<3)return[{from:"1",to:t,rate:e}];let i=Math.min(3,Math.floor(n/3)),a=Math.min(6,2*i);return[{from:"1",to:String(i),rate:""},{from:String(i+1),to:String(a),rate:""},{from:String(a+1),to:t,rate:e}]}function C(e){return/^\d{4}-\d{2}-\d{2}$/.test(e)&&Number.isFinite(Date.parse(`${e}T12:00:00Z`))&&new Date(`${e}T12:00:00Z`).toISOString().slice(0,10)===e}function A(e,t){if(!C(e)||!v(t)||Number(t)>120)return null;let n=new Date(`${e}T12:00:00Z`),i=n.getUTCDate();n.setUTCDate(1),n.setUTCMonth(n.getUTCMonth()+Number(t));let a=new Date(Date.UTC(n.getUTCFullYear(),n.getUTCMonth()+1,0)).getUTCDate();return n.setUTCDate(Math.min(i,a)-1),n.toISOString().slice(0,10)}function P(e,t){if(e.community)return t?(0,i.aE)(t):[];let n=[];"month_to_month"===e.subscriptionTerm&&n.push("Month-to-month terms require the current agreement wizard. Prepare a new packet."),(e.seatDiscountPercent||e.seatDiscountMonths)&&n.push("Seat discounts require the current agreement wizard. Prepare a new packet to add a discount.");let r=(e,t)=>{e||n.push(t)};if(r(e.features.length>0||!!e.customFeatures.trim(),"Select the included features or describe the custom scope."),r(e.seatRows.length>0&&e.seatRows.every(e=>!!e.role.trim()&&v(e.count)),"Enter a role and a positive whole number for each seat group."),r(v(e.termMonths)&&120>=Number(e.termMonths),"Enter a term of 1 to 120 months."),r(v(e.invoiceDays),"Enter the invoice payment period in days."),"launch"===e.billingStart&&r(!!e.launchDefinition.trim(),"Define the launch that starts subscription billing."),("launch"===e.implementationStart||"launch"===e.subscriptionDue||"two_installments"===e.subscriptionDue||e.implementationFee&&e.installments.some(e=>"launch"===e.due))&&r(!!e.launchDefinition.trim(),"Define the launch used for payment or implementation milestones."),e.launchWindowDays&&r(v(e.launchWindowDays),"Enter a valid signing-to-launch window."),"custom"===e.implementationStart&&r(!!e.implementationStartCustom.trim(),"Describe when implementation starts."),e.implementationFee&&(r((b(e.implementationAmount)??0)>0,"Enter a positive implementation fee."),r(e.installments.length>0&&e.installments.every(e=>(b(e.amount)??0)>0),"Enter the implementation payment installments."),r(e.installments.reduce((e,t)=>

1e+(b(t.amount)??0),0)===b(e.implementationAmount),"Implementation installments must equal the total implementation fee."),r(e.installments.every(e=>"date"!==e.due||C(e.date)),"Enter a valid date for each dated implementation payment."),r(e.installments.every(e=>"custom"!==e.due||!!e.details.trim()),"Describe each custom implementation payment milestone."),"signed_paid"===e.implementationStart&&r(e.installments.some(e=>"signing"===e.due),"Implementation starts after signing payment, so include a payment at signing.")),e.implementationFee||r("signed_paid"!==e.implementationStart,"Choose an implementation start that does not require an uncharged fee."),r(e.trainings.every(e=>v(e.sessions)&&!!e.audience.trim()&&(!e.hours||(b(e.hours)??0)>0)),"Enter the audience, session count, and valid optional hours for each live training."),"custom"===e.billingModel)r(!!e.customPricing.trim(),"Describe the custom subscription pricing.");else if(e.ramp&&"per_seat"===e.billingModel){let t=1,n=e.phases.length>0;for(let i of e.phases)n=n&&v(i.from)&&v(i.to)&&Number(i.from)===t&&Number(i.to)>=Number(i.from)&&null!==b(i.rate),t=Number(i.to)+1;if(r(n&&t===Number(e.termMonths)+1,"Ramp months must cover the entire term, in order, without gaps or overlaps, with a valid monthly rate."),e.rampToRate){let t=b(e.rate);r(null!==t&&b(e.phases.at(-1)?.rate||"")===t,"The ramp must end at the standard monthly seat price."),r(e.phases.every((t,n)=>0===n||(b(t.rate)??-1)>=(b(e.phases[n-1].rate)??0)),"Ramp rates must increase or stay the same between phases.")}}else r(null!==b(e.rate),"Enter a valid subscription price.");return"fixed"===e.billingModel&&r("cycle"!==e.subscriptionDue,"A fixed total needs a single payment or a custom installment schedule."),"per_seat"===e.billingModel&&e.ramp&&r("cycle"===e.subscriptionDue&&"monthly"===e.billingCadence&&"monthly"===e.pricePeriod,"Ramp pricing requires recurring monthly subscription invoices."),"same_rate"===e.additionalSeats&&r("per_seat"===e.billingModel,"A matching added-seat rate requires per-seat subscription pricing."),"custom_rate"===e.additionalSeats&&r(null!==b(e.additionalSeatRate),"Enter a valid monthly added-seat price."),"custom"===e.proration&&r(!!e.seatChangeTerms.trim(),"Describe custom seat changes and proration."),"date"===e.subscriptionDue&&r(C(e.subscriptionDueDate),"Enter a valid subscription payment due date."),"two_installments"===e.subscriptionDue&&r("custom"!==e.billingModel&&"launch"===e.billingStart,"Two installments need a per-seat or fixed price and a launch-based term."),e.installments.some(e=>"schedule"===e.due)&&r("two_installments"===e.subscriptionDue,"An implementation payment on the subscription schedule needs the two-installment option."),e.evvConfigurationAmount&&r(null!==b(e.evvConfigurationAmount),"Enter a valid Minnesota EVV configuration fee."),"custom"===e.subscriptionDue&&r(!!e.subscriptionDueCustom.trim(),"Describe the subscription payment schedule."),e.features.includes("claims")&&r(null!==b(e.claimsPerClaim)&&null!==b(e.claimsMonthly),"Enter valid per-claim and monthly claims fees."),"custom"===e.support&&r(!!e.supportCustom.trim(),"Describe the included support."),"custom"!==e.renewal&&(e.renewalRate&&r(null!==b(e.renewalRate),"Enter a valid renewal price."),e.renewalNoticeDays&&r(v(e.renewalNoticeDays),"Enter a valid renewal notice period.")),"automatic"===e.renewal&&r(v(e.renewalMonths)&&v(e.renewalNoticeDays)&&null!==b(e.renewalRate),"Automatic renewal needs a term, a rate, and a notice period."),"custom"===e.renewal&&r(!!e.renewalCustom.trim(),"Describe the renewal terms."),r(!!e.approvalBy.trim()&&!!e.approvalReference.trim(),"Record the Smores Health approver and approval reference."),e.scope&&(e.implementationFee&&r(e.implementationItems.length>0||e.trainings.length>0||!!e.implementationCustom.trim()||e.scope.exceptions.some(e=>["implementation","training"].includes(e.category)&&!!e.description.trim()),"Select the implementation services or training covered by the implementation fee."),"remote"!==e.implementationDelivery&&r(v(e.scope.onSiteVisits)&&(b(e.scope.onSiteHours)??0)>0,"Set the included on-site visit count and maximum hours per visit."),r(e.trainings.every(e=>(b(e.hours)??0)>0&&(e.topics?.length||0)>0),"Choose a duration and at least one topic for each included training."),r(e.trainings.every(t=>(t.topics||[]).every(t=>e.features.includes(a.ei[t].feature))),"Training topics must match the included features."),r(e.scope.exceptions.every(e=>!!e.description.trim()),"Describe every negotiated exception or remove the empty exception."),r(!e.launchDefinition.includes("first agreed live training")||e.trainings.length>0,"A launch tied to training requires an included live training session.")),n}let D=e=>null===b(e)?"[TO COMPLETE: amount]":`$${((b(e)||0)/100).toLocaleStr

1ing("en-US",{minimumFractionDigits:2,maximumFractionDigits:2})}`,H=e=>C(e)?new Date(`${e}T12:00:00Z`).toLocaleDateString("en-US",{year:"numeric",month:"long",day:"numeric",timeZone:"UTC"}):"[TO COMPLETE: date]",T=(e,t)=>e.trim()||`[TO COMPLETE: ${t}]`,$=e=>e.length<3?e.join(" and "):`${e.slice(0,-1).join(", ")}, and ${e[e.length-1]}`;function E(e){let t=e.deal;if(t.community)return(0,i.BD)(e);let n=t.features.includes("claims"),o=e.minnesotaEvv&&/(?:^|[,;\n])\s*(?:MN|Minnesota)\s*(?:$|[,;\n])/i.test(e.operatingStates),l=$(t.features.map(e=>r[e].toLowerCase())),d=[l?`The purchased services include ${l}.`:"",t.customFeatures,(0,a.vU)(t,"features"),"Only the services expressly included in this Order Form are purchased. Additional features or services require written agreement."].filter(Boolean).join(" "),c="signed_paid"===t.implementationStart?"the first business day after Smores Health has received the fully executed signing packet and the implementation payment due at signing in cleared funds":"signed"===t.implementationStart?"the first business day after Smores Health has received the fully executed signing packet":"launch"===t.implementationStart?"the agreed launch date":T(t.implementationStartCustom,"implementation start"),m=`Implementation begins on ${c} (the **Implementation Start Date**).`,u=o&&t.evvConfigurationAmount&&null!==b(t.evvConfigurationAmount)?t.evvConfigurationAmount:"",h=u?` The ${D(u)} Minnesota EVV configuration fee is due ${"two_installments"===t.subscriptionDue?"under the payment schedule in Section 4.1":"with the first implementation payment"}.`:"",p=t.implementationFee?`Customer will pay ${D(t.implementationAmount)} for the implementation services in Exhibit A${o?u?` and ${D(u)} for the Minnesota EVV configuration in Exhibit B`:" and the configuration in Exhibit B":""}. ${t.installments.map(e=>`${D(e.amount)} is due ${"signing"===e.due?"at signing":"launch"===e.due?"at launch":"date"===e.due?`on ${H(e.date)}`:"schedule"===e.due?"under the payment schedule in Section 4.1":T(e.details,"payment milestone")}${"custom"!==e.due&&e.details?` (${e.details})`:""}.`).join(" ")} This fee is earned on the Implementation Start Date.${h}`:`No implementation fee is charged. The included implementation services are described in Exhibit A.${h}`,g=["workspace","roles","workflows"].filter(e=>t.implementationItems.includes(e)),f=[g.length?`Beginning on the Implementation Start Date, Smores Health will configure Customer's ${$(g)}${n?", including claims settings under the Claims Addendum":""}${o?`${n?" and":", including"} Minnesota EVV settings under Exhibit B`:""}${t.implementationItems.includes("onboarding")?"; provide initial onboarding guidance; and answer reasonable implementation questions during launch":""}.`:t.implementationItems.includes("onboarding")?"Smores Health will provide initial onboarding guidance and answer reasonable implementation questions during launch.":"",`Implementation is performed ${"remote"===t.implementationDelivery?"remotely":"onsite"===t.implementationDelivery?"on site as mutually scheduled":"remotely and on site as mutually scheduled"}.`,"Customer will provide timely access to the people, decisions, documents, identifiers, and system access needed, and Smores Health may reschedule implementation activities where Customer's inputs are delayed.",t.implementationCustom,(0,a.vU)(t,"implementation")].filter(Boolean).join(" "),y=["admin_materials","peer_materials","recordings"].filter(e=>t.implementationItems.includes(e)).map(e=>s[e].toLowerCase()),w=t.trainings.length>0&&t.trainings.every(e=>"remote"===e.mode&&!e.hours&&!e.details),S=e=>{let t,n="administrators"===e.audience?"administrator":e.audience,i=`${["zero","one","two","three","four","five"][Number(t=e.sessions)]||T(t,"session count")} live`,a=`training session${"1"===e.sessions?"":"s"}`;return["administrator","peer staff"].includes(n)?`${i} ${n} ${a}`:`${i} ${a} for ${T(n,"training audience")}`},C=w?`Smores Health will provide ${$([...y,...t.trainings.map(S)])}, each delivered remotely by the Smores Health team and scheduled by mutual agreement during the Implementation Period. Customer may record live sessions for its internal use. Staff who join later are supported through the training materials and the support channel below.`:[y.length?`Smores Health will provide ${$(y)}.`:"",...t.trainings.map(e=>`Smores Health will provide ${S(e)}, delivered ${"remote"===e.mode?"remotely":"in person"}${e.hours?`, ${e.hours} hours per session`:""}, scheduled by mutual agreement during the Implementation Period.${e.details?` ${e.details}`:""}`),t.trainings.length?"Customer may record live sessions for its internal use. Staff who join later are supported through the training materials and the support channel below.":"Live training sessions are not included unless agreed in writing."].join(" "),P=t.scope?[...(0,a.Jt)(t).map(e=>`- **${e.label}.** ${e.description}`),`Delivery: ${"remote"===t.implementationDelivery?"remote":"onsite"===t.implementationDelivery?"on site as mutually scheduled":"remote and on site as mutually scheduled"}.`,"remote"!==t.implementationDelivery?`On-site setup is limited to ${T(t.scope.onSiteVisits,"on-site visit count")} visit(s), up to ${T(t.scope.onSiteHours,"on-site visit duration")} hours per visit. Live training is separately limited below.`:"","Customer will provide timely access to the people, decisions, documents, identifiers, and system access needed. Activities may be rescheduled where Customer's input

1s are delayed.",a.aZ,t.implementationCustom,(0,a.vU)(t,"implementation")].filter(Boolean).join("\n\n"):f,E=t.scope?[...t.trainings.map(e=>`- ${S(e)}, delivered ${"remote"===e.mode?"remotely":"in person"}, up to ${T(e.hours,"session duration")} hours per session. Topics: ${(e.topics||[]).map(e=>a.ei[e].label).join(", ")||"[TO COMPLETE: training topics]"}. ${e.details}`.trim()),t.trainings.length?"These session counts and durations are the included training allowance. Sessions are scheduled by mutual agreement during the Implementation Period. Additional sessions, extended time, and training on other topics require a separate written agreement.":(0,a.vU)(t,"training")?"Live training sessions are not included except as expressly stated in the negotiated training exception below.":"Live training sessions are not included.",(0,a.vU)(t,"training")].filter(Boolean).join("\n\n"):C,x=t.seatRows.map(e=>`${T(e.count,"seat count")} ${T(e.role,"seat role")} seat${"1"===e.count?"":"s"}`).join(" and "),k="launch"===t.billingStart?`${T(t.termMonths,"term length")} months beginning on the actual launch date agreed in writing by both Parties. Launch means ${T(t.launchDefinition,"launch definition")}. The subscription fee does not accrue before that launch. The end date is the day before the corresponding anniversary after ${T(t.termMonths,"term length")} months.`:`${H(e.startDate)} through ${H(e.endDate)}${"fixed_end"===t.lateStart?", beginning on the Effective Date if later, without extending the end date or reducing the fees":". If the agreed launch is delayed, the start and end dates move together by written agreement so the full subscription term is preserved"}.`,I=t.launchWindowDays?` The planned launch is within ${t.launchWindowDays} days after signing unless Smores Health approves a different date in writing.`:"",B="per_seat"===t.billingModel?`per seat per ${"monthly"===t.pricePeriod?"month":"year"}`:"for all Included Seats for the full Initial Term",R="custom"===t.billingModel?T(t.customPricing,"subscription pricing"):"per_seat"===t.billingModel&&t.ramp?`Customer will pay the following monthly rate per seat, measured from the subscription start date:
2
3${t.phases.map(e=>`- Months ${T(e.from,"first month")} to ${T(e.to,"last month")}: ${D(e.rate)} per seat per month.`).join("\n")}
4
5The rate changes for all seats at each phase boundary; an added seat does not restart the ramp.`:`Customer will pay ${D(t.rate)} ${B}, including unlimited participant accounts.`,O="signing"===t.subscriptionDue?"invoiced upon execution and due at signing":"date"===t.subscriptionDue?`invoiced upon execution and due no later than ${H(t.subscriptionDueDate)}`:"launch"===t.subscriptionDue?"invoiced and due at launch":"custom"===t.subscriptionDue?T(t.subscriptionDueCustom,"subscription payment schedule"):"two_installments"===t.subscriptionDue?"not invoiced monthly; the Initial Term is paid in the two installments stated below":`invoiced ${"monthly"===t.billingCadence?"monthly":"annually"} in ${t.paymentTiming}, due within ${T(t.invoiceDays,"invoice days")} days after the invoice date`,q="";if("two_installments"===t.subscriptionDue){let e=t.seatRows.reduce((e,t)=>e+(v(t.count)?Number(t.count):0),0),i=v(t.termMonths)?Number(t.termMonths):0,a="fixed"===t.billingModel?b(t.rate)??0:t.ramp?t.phases.reduce((t,n)=>t+e*(b(n.rate)??0)*(v(n.from)&&v(n.to)?Number(n.to)-Number(n.from)+1:0),0):e*(b(t.rate)??0)*("annual"===t.pricePeriod?Math.ceil(i/12):i),r=t.implementationFee?b(t.implementationAmount)??0:0,s=u?b(u)??0:0,o=a+r+s,l=Math.ceil(o/2),d=e=>D((e/100).toFixed(2)),c=[r?`the ${d(r)} implementation fee`:"",s?`the ${d(s)} Minnesota EVV configuration fee`:""].filter(Boolean),m=n?0!==b(t.claimsPerClaim)?"Added seats and Submitted Claim fees are":0!==b(t.claimsMonthly)?"Added seats and the monthly claims fee are":"Added seats are":"Added seats are";q=`
6
7The Initial Term subscription total is ${d(a)}${"per_seat"===t.billingModel&&!t.ramp?` (${e} seats at ${D(t.rate)} per seat per month for ${i} months)`:""}.${c.length?` Together with ${$(c)}, the first-year total is ${d(o)}.`:""} That total is payable in two installments: ${d(l)} due at launch and ${d(o-l)} due 30 days after launch. ${m} invoiced separately as stated in this Order Form.`}let F="fixed"===t.billingModel&&t.fixedFeeIndependent?` This fee is ${("launch"===t.billingStart?"12"===t.termMonths:A(e.startDate,"12")===e.endDate)?"a fixed annual fee":"a fixed fee for the Initial Term"}, is not billed monthly, is not contingent on any implementation, training, claims, or EVV milestone, and is not reduced if Customer uses fewer than the Included Seats.`:"",M="same_rate"===t.additionalSeats?`the same per-seat rate then applicable to the Included Seats${t.ramp?", including the current ramp phase":""}`:`${D(t.additionalSeatRate)} per seat per month`,_="approval"===t.additionalSeats?"Additional seats require Smores Healthâs written approval of the price and activation date before activation.":`Customer may add seats of any role at ${M} by written request from a Customer administrator (email is sufficient).`,N="same_rate"===t.additionalSeats&&"annual"===t.billingCadence,V="calendar_days"===t.proration&&N?"An added seat is prorated by the days remaining in the annual billing period, divided by the total days in that period, using the annualized seat rate.":"calendar_days"===t.proration?"An added seat is prorated by day for the calendar month in which it is activated and billed for each full calendar month thereafter.":"billing_days"===t.proration?"An added seat is prorated by day for the remaining days in the current billing period, using the number of days in that billing period.":"none"===t.proration?"Added seats are charged for a full billing period without proration.":T(t.seatChangeTerms,"proration"),j=`${_} ${"approval"!==t.additionalSeats?`${V} Added-seat charges are invoiced ${N?"annually":"monthly"} in ${t.paymentTiming}. `:""}

7Customer may deactivate an added seat by written notice, effective at the end of the ${N?"annual billing period":"calendar_days"===t.proration?"calendar month":"billing period"} in which Smores Health receives the notice. A seat is a named login for one individual and may not be shared. A seat may be reassigned from an individual who has left Customer to that individual's replacement without charge. ${t.minimumSeatsCommitted?"The Included Seats are committed for the full Initial Term. Unused Included Seats are not credited against other fees.":"The Included Seats may be reduced for future billing periods by written agreement with Smores Health."}${"custom"!==t.proration&&t.seatChangeTerms?` ${t.seatChangeTerms}`:""}`,z="No fee is calculated as a percentage of, or is contingent on, any amount billed, allowed, collected, or paid on any claim",L=`invoiced monthly in arrears, due within ${T(t.invoiceDays,"invoice days")} days after the invoice date`,U=0!==b(t.claimsPerClaim)?`Customer will pay ${D(t.claimsPerClaim)} for each Submitted Claim, as defined and counted in the Claims Addendum, ${L}. ${0===b(t.claimsMonthly)?"No flat monthly claims fee applies.":`A flat monthly claims fee of ${D(t.claimsMonthly)} also applies.`} Clearinghouse costs are included. ${z}, and the fee is payable whether a claim is accepted, paid, denied, or adjusted.`:0!==b(t.claimsMonthly)?`No per-claim fee applies. Customer will pay a flat monthly claims fee of ${D(t.claimsMonthly)}, ${L}. Clearinghouse costs are included. ${z}, and the fee is payable whether a claim is accepted, paid, denied, or adjusted.`:`No per-claim or monthly claims fee applies; claims submission is included in the subscription. Clearinghouse costs are included. ${z}.`,Q=t.renewalRate?` The agreed renewal rate is ${D(t.renewalRate)} ${"per_seat"===t.billingModel?B:"for all Included Seats per renewal term"}.`:"",W="custom"===t.renewal?T(t.renewalCustom,"renewal terms"):"automatic"===t.renewal?`After the Initial Term, this Order Form automatically renews for successive ${t.renewalMonths}-month periods unless either Party gives written notice of non-renewal at least ${t.renewalNoticeDays} days before the end of the then-current term.${Q}`:`This Order Form does not renew automatically. Continued access after the end of the Initial Term requires a renewal signed by both Parties, as stated in Section 15(G) of the MSA.${Q}${t.renewalNoticeDays?` Smores Health will send a renewal reminder at least ${t.renewalNoticeDays} days before the end of the Initial Term.`:" Smores Health may contact Customer before the end of the Initial Term to discuss renewal."}

7`,G="custom"===t.support?T(t.supportCustom,"support terms"):`During the Initial Term, at no separate fee, Smores Health will provide: ${"priority"===t.support?"priority handling of":"handling of"} Customer's support requests during Smores Health's business hours (Monday through Friday, excluding U.S. federal holidays); direct access to the Smores Health team for implementation${n?", claims activation":""}${o?", and EVV":""} issues by email and scheduled calls; reasonable configuration adjustments within the Services' existing capabilities as Customer's team adopts the Services; opportunities to give product feedback; and periodic implementation check-ins at a cadence Smores Health sets. Smores Health determines the order and manner of response. No response-time commitment or service credit applies, and Smores Health has no obligation to implement any feedback or request that would require custom development or would alter a compliance control.
8
9Support does not include on-site services, support for Customer's hardware, networks, or devices, support of third-party systems beyond coordination, or services for individuals who are not Authorized Users.`;return{includedFeatures:d,implementationStartTerms:m,implementationFeeTerms:p,implementationTerms:t.scope?`**Implementation.**
10
11${P}
12
13**Training.**
14
15${E}`:`**Implementation.** ${P}
16
17**Training.** ${E}`,supportTerms:[G,(0,a.vU)(t,"support")].filter(Boolean).join("\n\n"),seats:x,termDescription:`${k}${I}`,pricingTerms:`${R}
18
19Subscription payments are ${O}.${"per_seat"===t.billingModel&&!t.ramp&&"cycle"===t.subscriptionDue&&t.pricePeriod!==t.billingCadence?` Each ${"annual"===t.billingCadence?"annual invoice covers twelve months at the agreed monthly rate":"monthly invoice is one-twelfth of the agreed annual rate"}.`:""}${F}${q} If a payment is not made when due, Sections 7(E) and 7(F) of the MSA apply.`,additionalSeatTerms:j,claimsPricingTerms:U,renewalTerms:W,invoiceTerms:`Invoices are sent by email to Customer's billing contact. Monthly invoices are due within ${T(t.invoiceDays,"invoice days")} days after the invoice date. Payment is by check or bank transfer to the account stated on the invoice. Taxes are handled as stated in the MSA. Smores Health will provide its IRS Form W-9 on request.`,specialTerms:t.additionalTerms.trim()||(0,a.vU)(t,"other")?`**11. Additional negotiated terms.** ${[t.additionalTerms,(0,a.vU)(t,"other")].filter(Boolean).join("\n\n")}`:""}}function x(e){if(e.noticeAddressParts){let t=e.noticeAddressParts;e={...e,noticeAddress:[t.line1,t.line2,[t.city,t.state].filter(Boolean).join(", ")+(t.postalCode?` ${t.postalCode}`:"")].map(e=>e.trim()).filter(Boolean).join(", ")}}if(!e.deal)return e;if(e.deal.scope){let t=e.deal,n=1,i=t.phases.map(e=>{let t=String(n);return n=v(e.to)?Number(e.to)+1:n,{...e,from:t}});e={...e,deal:{...t,phases:i,...t.implementationPaymentMode&&"custom"!==t.implementationPaymentMode?{installments:w(t.implementationAmount,t.implementationPaymentMode)}:{}},..."date"===t.billingStart?{endDate:A(e.startDate,t.termMonths)||""}:{}}}let t=E(e),n=e.deal;return{...e,claims:"community"!==n.plan&&n.features.includes("claims"),telehealth:n.features.includes("telehealth"),seats:t.seats,pricingTerms:t.pricingTerms,implementationTerms:t.implementationTerms,supportTerms:t.supportTerms,renewalTerms:t.renewalTerms,claimsPricingTerms:n.features.includes("claims")?t.claimsPricingTerms:""}}},33840:(e,t,n)=>{n.d(t,{MP:()=>b,NH:()=>r,PA:()=>i.PA,TO:()=>E,Xm:()=>P,YY:()=>w,_N:()=>p,gY:()=>A,iW:()=>v,kJ:()=>h,kK:()=>g,lX:()=>f,mp:()=>i.mp,q3:()=>y,vk:()=>i.vk,w4:()=>C,xP:()=>o,z$:()=>S});var i=n(14045),a=n(49484);let r="standard-2026-10-05.v26",s=["master_services_agreement","team_order_form","subscription_order_form","claims_submission_addendum","baa_qsoa","customer_responsibilities","data_security","signing_page"],o=()=>({line1:"",line2:"",city:"",state:"",postalCode:""}),l=["customerLegalName","customerNpi","entityType","jurisdiction","operatingStates","noticeAddress","noticeEmail","noticePhone","signerName","signerTitle","peerakeetSignerName","peerakeetSignerTitle","startDate","endDate","seats","dataRole","programs","payers","pricingTerms","implementationTerms","supp

19ortTerms","renewalTerms","stateTerms","pilotDescription","claimsPricingTerms","evvStatus","orgType","noticeAttention","noticeContactName","noticeContactFirstName","noticeContactLastName","agencyContract"],d=["claims","healthData","telehealth","priorPilot","minnesotaEvv","pricingComplete","minorsServed","publicEntity","billingUpgradeOffered"],c=new Set(["orgType","noticeAttention","noticeContactName","noticeContactFirstName","noticeContactLastName","programs","minorsServed","publicEntity","agencyContract","billingUpgradeOffered"]),m=new Set(["pricingTerms","implementationTerms","supportTerms","renewalTerms","stateTerms","claimsPricingTerms","pilotDescription","evvStatus"]),u={billingUpgradeSeatRate:12,billingUpgradeClaimRate:12,customerLegalName:240,customerNpi:10,entityType:160,jurisdiction:100,agencyContract:10,noticeContactFirstName:100,noticeContactLastName:100,noticeEmail:254,noticePhone:50,signerName:200,signerTitle:160,peerakeetSignerName:200,peerakeetSignerTitle:160,startDate:10,endDate:10},h=e=>u[e]||(m.has(e)?16e3:2e3);function p(e){let t=e.noticeContactFirstName||"",n=e.noticeContactLastName||"";if(t.trim()||n.trim())return{first:t,last:n};let i=(e.noticeContactName||"").trim(),a=i.lastIndexOf(" ");return a>0?{first:i.slice(0,a),last:i.slice(a+1)}:{first:i,last:""}}let g=(e,t)=>[e.trim(),t.trim()].filter(Boolean).join(" ");function f(e=""){return{...Object.fromEntries(l.map(e=>[e,""])),customerLegalName:e,peerakeetSignerName:"Ishan Shah",peerakeetSignerTitle:"Chief Executive Officer",claims:!1,healthData:!0,telehealth:!1,priorPilot:!1,minnesotaEvv:!1,pricingComplete:!1,minorsServed:!1,publicEntity:!1,agencyContract:"",billingUpgradeOffered:!0}}let y=e=>e.deal?.plan==="community"||e.deal?.plan==="growth"?e.deal.plan:"standard",b=e=>i.Ge[y(e)];function v(e,t){return t.some(t=>RegExp("(?:^|[,;\\n])\\s*"+t+"\\s*(?:$|[,;\\n])","i").test(e.operatingStates))}function w(e){let t=[...l,...d].filter(e=>"noticeContactFirstName"!==e&&"noticeContactLastName"!==e).map(t=>e[t]);return e.deal&&t.push((0,i.UA)(e.deal)),e.noticeAddressParts&&t.push($(e.noticeAddressParts)),e.customerDetailsMode&&t.push(e.customerDetailsMode),(void 0!==e.billingUpgradeSeatRate||void 0!==e.billingUpgradeClaimRate)&&t.push({billingUpgradeSeatRate:e.billingUpgradeSeatRate,billingUpgradeClaimRate:e.billingUpgradeClaimRate}),JSON.stringify(t)}function S(e){return/(?:^|[,;\n])\s*(?:MN|Minnesota)\s*(?:$|[,;\n])/i.test(e.operatingStates)}function C(e){let t="community"===y(e),n=!!e.deal?.community;return s.filter(i=>("team_order_form"!==i||!n)&&("subscription_order_form"!==i||n)&&("claims_submission_addendum"!==i||e.claims&&!t)&&("baa_qsoa"!==i||e.healthData))}function A(e){return Array.from(new Set(e.match(/\{\{[^}]+\}\}|\[TO COMPLETE:[^\]]*\]/g)||[]))}function P(e){let t=(0,i._Q)(e.answers),n=[],r=[["customerLegalName","Organization legal name"],["entityType","Legal entity type"],..."community"===y(t)||t.deal?.community?[]:[["jurisdiction","Formation state"]],["operatingStates","Operating states"],["noticeAddress","Notice address"],["peerakeetSignerName","Smores Health signer"],["peerakeetSignerTitle","Smores Health signer title"],["seats","Included seats"],["pricingTerms","Pricing and payment terms"],["implementationTerms","Implementation and training"],["supportTerms","Support terms"],["renewalTerms","Renewal terms"]];if("signing"===t.customerDetailsMode||"community"===y(t)||t.deal?.community||r.push(["dataRole","Customer data role"]),t.deal||r.push(["noticeEmail","Notice email"],["signerName","Customer signer"],["signerTitle","Customer signer title"]),t.noticeAddressParts){let e=t.noticeAddressParts;e.line1.trim()&&e.city.trim()&&e.state.trim()&&e.postalCode.trim()||n.push("Complete the mailing street, city, state, and ZIP code."),e.postalCode&&!/^\d{5}(?:-\d{4})?$/.test(e.postalCode)&&n.push("Enter a five-digit ZIP code or ZIP+4.")}for(let[e,s]of(t.deal&&"date"!==t.deal.billingStart||r.push(["startDate","Subscription start date"],["endDate","Subscription end date"]),t.deal&&n.push(...(0,i.gY)(t.deal,t)),t.deal?.ramp&&"per_seat"===t.deal.billingModel&&"date"===t.deal.billingStart&&t.startDate&&t.endDate&&(0,i.xK)(t.startDate,t.deal.termMonths)!==t.endDate&&n.push("The fixed subscription dates must cover the same number of months as the ramp."),t.orgType&&!(0,a.Fg)(t.orgType)&&n.push("Choose a listed organization type."),t.claims&&r.push(["claimsPricingTerms","Claims pricing and payment terms"]),!t.deal?.community&&(t.claims&&r.push(["payers","Payers in scope"]),(t.claims||t.minnesotaEvv)&&"signing"!==t.customerDetailsMode&&r.push(["customerNpi","Customer NPI"]),t.priorPilot&&r.push(["pilotDescription","Prior pilot details"]),t.minnesotaEvv&&r.push(["evvStatus","Minnesota EVV enrollment and readiness status"])),r))String(t[e]).trim()||n.push(`${s} is missing.`);t.noticeEmail&&!/^[^\s@]+@[^\s@]+\.[^\s@]+$/.test(t.noticeEmail)&&n.push("Enter a valid notice email."),t.customerNpi&&!/^\d{10}$/.test(t.customerNpi.trim())&&n.push("Customer NPI must contain 10 digits."),(!t.deal||"date"===t.deal.billingStart)&&t.startDate&&t.endDate&&t.endDate<t.startDate&&n.push("End date must be on or after start date."),t.minnesotaEvv&&!S(t)&&n.push("Minnesota EVV requires Minne

19sota in the operating states."),t.claims&&!t.healthData&&n.push("Claims submission requires the health data agreement."),t.minnesotaEvv&&!t.healthData&&n.push("Electronic visit verification requires the health data agreement."),t.pricingComplete||t.deal?.community||n.push("Pricing is still a draft."),e.generatedFromAnswers!==w(e.answers)&&n.push("Update the documents from the latest answers.");let s=new Set(e.documents.map(e=>e.id));for(let e of C(t))s.has(e)||n.push("Prepare all selected agreements.");return e.documents.some(e=>void 0!==e.pendingMarkdown||e.removedByScope)&&n.push("Resolve document changes from the updated answers."),e.documents.some(e=>!e.markdown.trim()||A(e.markdown).length)&&n.push("Complete the highlighted document placeholders."),e.reviewed||n.push("Confirm review of the complete packet."),Array.from(new Set(n))}function D(e){if(!e||"object"!=typeof e||Array.isArray(e))throw Error("Invalid packet object.");return e}function H(e,t,n){if("string"!=typeof e||e.length>n||/[\u0000-\u0008\u000b\u000c\u000e-\u001f]/.test(e))throw Error(`Invalid ${t}.`);return e.replace(/\r\n?/g,"\n")}function T(e,t){if("boolean"!=typeof e)throw Error(`Invalid ${t}.`);return e}function $(e){let t=D(e);return{line1:H(t.line1,"mailing street",240),line2:H(t.line2,"mailing address line 2",240),city:H(t.city,"mailing city",160),state:H(t.state,"mailing state",100),postalCode:H(t.postalCode,"mailing ZIP code",10)}}function E(e){let t=D(e);if(1!==t.schemaVersion)throw Error("Unsupported packet format. Reload the builder.");let n=D(t.answers),a=f();for(let e of l)c.has(e)&&void 0===n[e]||(a[e]=H(n[e],e,h(e)));for(let e of d)c.has(e)&&void 0===n[e]||(a[e]=T(n[e],e));for(let e of["billingUpgradeSeatRate","billingUpgradeClaimRate"])void 0!==n[e]&&(a[e]=H(n[e],e,h(e)));if(void 0===n.minorsServed&&(a.minorsServed="youth"===a.orgType),void 0===n.publicEntity&&(a.publicEntity="government"===a.orgType),void 0===n.agencyContract&&(a.agencyContract="youth"===a.orgType||"government"===a.orgType?"yes":""),!["","yes","no","unsure"].includes(a.agencyContract))throw Error("Invalid agency contract answer.");if(void 0!==n.deal&&(a.deal=(0,i.UA)(n.deal)),void 0!==n.presetSelections){if(!a.deal)throw Error("Presets require a guided packet.");a.presetSelections=JSON.parse(JSON.stringify(D(n.presetSelections)))}if(void 0!==n.noticeAddressParts&&(a.noticeAddressParts=$(n.noticeAddressParts)),void 0!==n.customerDetailsMode){if(!a.deal)throw Error("Customer completion requires a guided packet.");if(!["signing","provided"].includes(String(n.customerDetailsMode)))throw Error("Invalid customer details mode.");a.customerDetailsMode=n.customerDetailsMode}for(let e of(a=(0,i._Q)(a),["startDate","endDate"])){let t=a[e];if(t&&(!/^\d{4}-\d{2}-\d{2}$/.test(t)||!Number.isFinite(Date.parse(`${t}T00:00:00Z`))||new Date(`${t}T00:00:00Z`).toISOString().slice(0,10)!==t))throw Error(`Invalid ${e}.`)}if(!Array.isArray(t.documents)||t.documents.length>s.length)throw Error("Invalid packet documents.");let r=new Set,o=t.documents.map(e=>{let t=D(e);if(!s.includes(t.id)||r.has(String(t.id)))throw Error("Invalid or duplicate agreement.");r.add(String(t.id));let n={id:t.id,title:H(t.title,"document title",240),baseMarkdown:H(t.baseMarkdown,"source document",15e4),markdown:H(t.markdown,"edited document",15e4)};return void 0!==t.pendingMarkdown&&(n.pendingMarkdown=H(t.pendingMarkdown,"updated source",15e4)),void 0!==t.removedByScope&&(n.removedByScope=T(t.removedByScope,"scope change")),void 0!==t.keptByAdmin&&(n.keptByAdmin=T(t.keptByAdmin,"retained document")),n}),m={schemaVersion:1,templateVersion:H(t.templateVersion,"template version",100),title:H(t.title,"packet title",240).trim(),answers:a,documents:o,generatedFromAnswers:H(t.generatedFromAnswers,"source answers",12e4),reviewed:T(t.reviewed,"review confirmation"),...void 0===t.wizardStep?{}:{wizardStep:H(t.wizardStep,"wizard position",80)}};if(!m.title)throw Error("Name the packet.");if(new TextEncoder().encode(JSON.stringify(m)).length>65e4)throw Error("This packet is too large. Shorten the custom text.");return m}},47870:(e,t,n)=>{n.d(t,{Ep:()=>c,HE:()=>o,Jt:()=>u,O_:()=>i,aZ:()=>r,ei:()=>s,h9:()=>a,rF:()=>h,rN:()=>l,vU:()=>m});let i="implementation-2026-09-19.v1",a={workspace:{label:"Workspace setup",de

19scription:"Configure one company workspace for the features included in this Order Form."},roles:{label:"Staff roles and permissions",description:"Configure the included staff roles and permissions using existing product controls."},workflows:{label:"Workflow configuration",description:"Configure existing workflows for the purchased features. Custom software and new integrations are not included."},onboarding:{label:"Onboarding and launch guidance",description:"Provide initial onboarding guidance and answer setup questions during the Implementation Period. Live training is limited to the sessions listed below."},admin_materials:{label:"Administrator training materials",description:"Provide administrator training materials for the purchased features; custom course production is not included."},peer_materials:{label:"Peer staff training materials",description:"Provide peer staff training materials for the purchased features; custom course production is not included."},recordings:{label:"Recorded video training",description:"Provide recorded video training for the purchased features; custom video production is not included."}},r="Only the selected implementation services and listed training sessions are included. Data migration, custom development, new third-party integrations, on-site visits, and additional training are not included unless expressly listed in this Order Form. Additional work requires written agreement on its scope, price, and schedule before work begins.",s={workspace:{label:"Workspace and administrator setup",feature:"intake"},documentation:{label:"Participant records and documentation",feature:"documentation"},scheduling:{label:"Scheduling",feature:"scheduling"},messaging:{label:"Messaging",feature:"messaging"},community:{label:"Community features",feature:"community"},assessments:{label:"Assessments and outcomes",feature:"assessments"},reporting:{label:"Reports and exports",feature:"reporting"},telehealth:{label:"Telehealth workflows",feature:"telehealth"},claims:{label:"Claims workflows",feature:"claims"}},o={features:"Additional product features",implementation:"Additional implementation work",training:"Training exception",support:"Support exception",state:"State or program wording",other:"Other negotiated contract terms"},l=()=>({version:1,serviceCatalogVersion:i,exceptions:[],onSiteVisits:"",onSiteHours:""}),d={[i]:a},c=[["the configured workspace is available for Customerâs staff to begin using the purchased services","Configured workspace is ready for staff use"],["the configured workspace is available and the first agreed live training session is complete","Workspace is ready and the first live training is complete"]];function m(e,t){return(e.scope?.exceptions||[]).filter(e=>e.category===t).map(e=>e.description.trim()||"[TO COMPLETE: negotiated exception]").join("\n\n")}function u(e){if(!e.scope)return[];let t=e.scope.serviceCatalogVersion,n=d[t];return e.implementationItems.map(e=>({id:e,catalogVersion:t,...n[e]}))}function h(e){let t=(e.scope?.exceptions||[]).map(e=>({label:o[e.category],text:e.description}));for(let[n,i]of[["Additional features",e.customFeatures],["Implementation exception",e.implementationCustom],["Seat-change exception",e.seatChangeTerms],["Additional contract terms",e.additionalTerms],["Custom pricing","custom"===e.billingModel?e.customPricing:""],["Custom support","custom"===e.support?e.supportCustom:""],["Custom renewal","custom"===e.renewal?e.renewalCustom:""],["Custom implementation start","custom"===e.implementationStart?e.implementationStartCustom:""],["Custom payment schedule","custom"===e.subscriptionDue?e.subscriptionDueCustom:""],...e.trainings.map((e,t)=>[`Training ${t+1} details`,e.details]),...(e.implementationFee?e.installments:[]).filter(e=>"custom"===e.due).map((e,t)=>[`Payment milestone ${t+1}`,e.details])])i.trim()&&t.push({label:n,text:i});return e.launchDefinition&&("launch"===e.billingStart||"launch"===e.implementationStart||"launch"===e.subscriptionDue||e.implementationFee&&e.installments.some(e=>"launch"===e.due))&&!c.some(([t])=>t===e.launchDefinition)&&t.push({label:"Custom launch definition",text:e.launchDefinition}),t}},49484:(e,t,n)=>{n.d(t,{BD:()=>E,CB:()=>l,DN:()=>c,Fg:()=>a,H7:()=>m,I9:()=>p,VJ:()=>D,XH:()=>o,Z$:()=>H,aE:()=>T,al:()=>s,hk:()=>$,p_:()=>w,vk:()=>d,zU:()=>r});let i={recovery:"Recovery or peer support organization",provider:"Treatment provider or clinic",youth:"Youth or child welfare program",education:"School, college, or university",government:"Government agency or county"},a=e=>Object.prototype.hasOwnProperty.call(i,e),r="59",s=e=>({seatRate:e.billingUpgradeSeatRate??String(99),claimRate:e.billingUpgradeClaimRate??String(1)}),o=12,l=e=>!!e?.community&&"month_to_month"===e.subscriptionTerm,d=[{from:"1",to:"3",rate:"29"},{from:"4",to:"6",rate:"59"},{from:"7",to:"12",rate:"99"}],c=e=>e?.dataTransfer!==!1;function m(){return{launchRule:"agreed",launchDate:"",liveTraining:"none",adminSessions:"1",peerSessions:"1",inPersonSessions:"0",dataTransfer:!0}}let u={launchRule:["fixed_date","agreed"],liveTraining:["none","included"]},h=new Set(["adminSessions","peerSessions","inPersonSessions"]);function p(e){if(!e||"object"!=typeof e||Array.isArray(e))throw Error("Invalid Community terms.");let t={...e};"one_session"===t.liveTraining?Object.assign(t,{liveTraining:"included",adminSessions:"1",peerSessions:"0"}):"admin_and_peer"===t.liveTraining&&Object.assign(t,{liveTraining:"included",adminSessions:"1",peerSessions:"1"});let n=m();for(let e of Object.keys(n)){let i=n[e],a=t[e];if(!(void 0===a&&h.has(e)))if("boolean"==typeof i){if("boolean"!=typeof a)throw Error(`Invalid ${e}.`);Object.assign(n,{[e]:a})}else{let t=u[e];if("string"!=typeof a||a.length>400||/[\u0000-\u001f]/.test(a)||t&&!t.includes(a))throw Error(`Invalid ${e}.`);Object.assign(n,{[e]:a})}}return n}let g=["zero","one","two","three","four","five","six","seven","eight","nine","ten","eleven","twelve"],f=e=>/^\d{1,9}(?:\.\d{1,2})?$/.test(e.trim())?Math.round(100*Number(e.trim())):null,y=e=>

19"$"+(e/100).toLocaleString("en-US",{minimumFractionDigits:e%100?2:0,maximumFractionDigits:2}),b=e=>/^\d{4}-\d{2}-\d{2}$/.test(e)&&Number.isFinite(Date.parse(`${e}T12:00:00Z`))&&new Date(`${e}T12:00:00Z`).toISOString().slice(0,10)===e,v=e=>b(e)?new Date(`${e}T12:00:00Z`).toLocaleDateString("en-US",{year:"numeric",month:"long",day:"numeric",timeZone:"UTC"}):"[TO COMPLETE: launch date]",w=e=>e.length<3?e.join(" and "):`${e.slice(0,-1).join(", ")}, and ${e[e.length-1]}`,S=e=>e.split(/[,;\n]/).map(e=>e.trim()).filter(Boolean).some(e=>/^(?:MN|Minnesota)$/i.test(e)),C=e=>"community"===e||"growth"===e?e:"standard",A={community:"Community",standard:"Standard",growth:"Growth"},P=e=>g[e]||String(e);function D(e){if(!e.seatDiscountPercent?.trim())return e.seatDiscountMonths?.trim()?["Enter a discount percentage or remove the discount duration."]:[];let t=[],n=f(e.seatDiscountPercent);return(null===n||n<=0||n>1e4)&&t.push("Enter a discount greater than 0% and no more than 100%, with up to two decimal places."),/^(?:[1-9]|1[0-2])$/.test(e.seatDiscountMonths||"")||t.push("Choose a discount duration from 1 to 12 subscription months."),t}function H(e){let t="growth"===e.plan?d.map(e=>({from:Number(e.from),to:Number(e.to),rate:f(e.rate)??0})):[{from:1,to:o,rate:f(e.rate)??0}],n=!!e.seatDiscountPercent?.trim()&&0===D(e).length,i=n?Number(e.seatDiscountMonths):0,a=n?f(e.seatDiscountPercent):0;return t.flatMap(e=>{let t=[];return e.from<=i&&t.push({from:e.from,to:Math.min(e.to,i),originalRate:e.rate,rate:Math.round(e.rate*(1e4-a)/1e4),discountPercent:String(a/100)}),e.to>i&&t.push({...e,from:Math.max(e.from,i+1),originalRate:e.rate}),t})}function T(e){let t=e.deal,n=t.community||m(),i=C(t.plan),a=[];a.push(...D(t)),"0"!==t.invoiceDays&&"30"!==t.invoiceDays&&a.push("Choose the payment deadline: on the scheduled date or within 30 days of invoice."),l(t)&&"cycle"!==t.subscriptionDue&&a.push("Month-to-month agreements must use monthly subscription payments.");let r=(e,t)=>{e||a.push(t)},o=Number(t.seatRows[0]?.count||"");if(r(Number.isInteger(o)&&o>0&&o<=999,"Enter the number of staff seats."),r((f(t.rate)??0)>0,"Enter the price per seat per month."),"community"===i&&e.billingUpgradeOffered){let t=s(e);r((f(t.seatRate)??0)>0,"Enter a positive future upgrade price per seat per month."),r(null!==f(t.claimRate),"Enter the future upgrade fee per submitted claim.")}if(t.implementationFee&&(r((f(t.implementationAmount)??0)>0,"Enter a positive implementation fee."),r("upfront"===t.implementationPaymentMode||"split"===t.implementationPaymentMode||"schedule"===t.implementationPaymentMode,"Choose the implementation fee payment schedule.")),r("cycle"===t.subscriptionDue||"launch"===t.subscriptionDue||"two_installments"===t.subscriptionDue,"Choose the subscription payment schedule."),"fixed_date"===n.launchRule&&r(b(n.launchDate),"Enter the planned launch date."),"included"===n.liveTraining){let e,t;r((e=n.adminSessions,/^\d{1,2}$/.test(e)&&(t=n.peerSessions,/^\d{1,2}$/.test(t))&&Number(n.adminSessions)+Number(n.peerSessions)>0),"Enter at least one live training session.")}return r(/^\d{1,2}$/.test(n.inPersonSessions||"0"),"Enter a whole number of in person training sessions."),"community"!==i&&r(null!==f(t.claimsPerClaim),"Enter the fee per submitted claim."),e.minnesotaEvv&&(r(S(e.operatingStates),"Minnesota EVV requires Minnesota as the operating state."),r(null!==f(t.evvConfigurationAmount||"0"),"Enter the Minnesota EVV configuration fee.")),a}function $(e){let t=e.deal,n=C(t.plan),i="community"!==n,a=Math.max(1,Number(t.seatRows[0]?.count)||0),r=f(t.rate)??0,s=d.map(e=>({from:Number(e.from),to:Number(e.to),rate:f(e.rate)??0})),o=s.reduce((e,t)=>e+t.rate*(t.to-t.from+1),0),l=H(t),c=a*l[0].rate,m=a*l.reduce((e,t)=>e+t.rate*(t.to-t.from+1),0),u=t.implementationFee?f(t.implementationAmount)??0:0,h=t.implementationFee?"split"===t.implementationPaymentMode?"split":"schedule"===t.implementationPaymentMode||"custom"===t.implementationPaymentMode?"schedule":"upfront":"none",p="split"===h&&u>0,g="upfront"===h?u:p?Math.ceil(u/2):0,y=i&&e.minnesotaEvv&&S(e.operatingStates),b=y?f(t.evvConfigurationAmount||"0")??0:0,v=m+b+("schedule"===h?u:0),w=Math.ceil(v/2);return{plan:n,billing:i,seats:a,rate:r,seatPhases:l,ramp:s,rampAnnualPerSeat:o,monthly:c,annual:m,implementationFee:u,implementationMode:h,implementationAtSigning:g,implementationAtLaunch:p?u-g:0,evv:y,evvFee:b,claimRate:i?f(t.claimsPerClaim)??0:0,subscriptionDue:"two_installments"===t.subscriptionDue||"launch"===t.subscriptionDue?t.subscriptionDue:"cycle",installmentTotal:v,firstInstallment:w,secondInstallment:v-w,firstYear:m+u+b}}function E(e){let t=e.deal,n=t.community||m(),i=$(e),{plan:a,billing:r,seats:d,rate:u,ramp:h,rampAnnualPerSeat:p,monthly:g,annual:S,evv:C,evvFee:D,claimRate:H}=i,T=A[a],E="growth"===a,x=l(t),k="0"===t.invoiceDays,I=k?"due":"invoiced",B=k?"paid":"invoiced",R=k?"Payment is due on the date each invoice is issued.":"Invoices are due within 30 days after the invoice date.",O=E?h[h.length-1].rate:u,q=c(t.community),F=1===d?"staff seat":`${P(d)} seats`,M=i.seatPhases.some(e=>e.discountPercent),_=i.seatPhases.some(e=>e.to===o&&e.discountPercent)?"After the 12-month discount ends":"After the first 12 months",N=i.seatPhases.map(e=>`Months ${e.from} to ${e.to}: ${e.discountPercent?`${y(e.originalRate)} less ${e.discountPercent}% = `:""}${y(e.rate)} per staff seat per month (${y(e.rate*d)} per month for the original ${F})`).join("; "),V=M?`${Number(t.seatDiscountPercent)}% off the original monthly per-seat prices for the first ${t.seatDiscountMonths} Subscription Month${"1"===t.seatDiscountMonths?"":"s"}, beginning on the Launch Date. Discounted per-seat prices are rounded to the nearest cent before multiplying by the number of seats. Additional seats receive the same discount for the remainder of that period; adding a seat does not restart it. ${x?`${Number(t.seatDiscountMonths)<o?"After the discount ends, the original per-seat prices in the schedule apply. ":""}${_}, the subscription continues month to month at ${y(O)} per seat per month unless changed by a signed agreement. The discount does not create a 12-month commitment or limit cancellation on 30 days' written notice.`:Number(t.seatDiscountMonths)<o?"The original per-seat prices shown in the schedule apply afterward for the remainder of the Initial Term.":"The discount ends with the Initial Term;

19 any renewal requires a new signed agreement stating its pricing."} The discount applies only to subscription seat charges, excluding implementation, claims, and other charges.`:"",j=i.implementationFee,z=i.implementationMode,L="split"===z&&j>0,U=i.implementationAtSigning,Q=i.implementationAtLaunch,W="two_installments"===i.subscriptionDue,G="launch"===i.subscriptionDue,Z="community"===a&&e.billingUpgradeOffered,J=s(e),Y=f(J.seatRate),K=f(J.claimRate),X="priority"===t.support,ee="included"===n.liveTraining?Math.max(0,Number(n.adminSessions)||0):0,et="included"===n.liveTraining?Math.max(0,Number(n.peerSessions)||0):0,en=Math.max(0,Number(n.inPersonSessions)||0),ei=ee+et+en,ea=e=>`${P(e)} live virtual training session${1===e?"":"s"}`,er=en?`${P(en)} in person training session${1===en?"":"s"}`:"",es=ee&&et?`${ea(ee)} for administrators and ${P(et)} for peer staff`:ee?`${ea(ee)} for administrators`:et?`${ea(et)} for peer staff`:"",eo="fixed_date"===n.launchRule,el=v(n.launchDate),ed=H>0?`${y(H)} per Submitted Claim`:"",ec=W?`${B} within the two installments stated in Section 3`:G?`${I} with the subscription on the Launch Date`:`${I} with the first subscription invoice on the Launch Date`,em=e=>[e,q?"help transferring existing records":"",es,er,"recorded video training",X?"priority onboarding assistance":"onboarding assistance"].filter(Boolean),eu="none"===z?"No implementation fee applies.":"split"===z?`The one-time implementation fee is **${y(j)}: ${y(U)} ${I} at signing and ${y(Q)} ${I} on the agreed Launch Date**. Customer and Smores Health may agree in writing to a different payment schedule.`:"schedule"===z?`The one-time implementation fee is **${y(j)}, ${ec}**.`:`The one-time implementation fee is **${y(j)}, ${I} at signing**.`,eh=t.implementationFee?"It includes":"Implementation includes",ep=q?"The setup and transfer schedule will be coordinated during onboarding.":"The setup schedule will be coordinated during onboarding.",eg="upfront"===z?`Implementation begins after Smores Health receives the signed packet, the ${y(j)} payment, and the information and access reasonably needed for setup.`:"split"===z?`Implementation begins after Smores Health receives the signed packet, the first ${y(U)} installment, and the information and access reasonably needed for setup, unless the Parties agree in writing to a different payment schedule.`:"Implementation begins after Smores Health receives the signed packet and the information and access reasonably needed for setup.",ef="upfront"===z?`Only the implementation fee specified below is ${I} at signing.`:"split"===z?`Only the first implementation installment specified below is ${I} at signing.`:`Nothing is ${I} at signing.`,ey=W||G?"Subscription payments":"Monthly subscription payments",eb=x?"month-to-month subscription":"12-month subscription term",ev=eo?`The Launch Date is ${el}, unless Customer and Smores Health agree in writing to a different date. ${ey} and the ${eb} begin on the agreed Launch Date. There is no retroactive subscription billing.`:`Customer and Smores Health will agree on the Launch Date in writing. ${ey} and the ${eb} begin on that date. Any change to the Launch Date must be agreed by both Parties in writing. There is no retroactive subscription billing.`,ew=x?"The Initial Term begins on the agreed Launch Date and continues month to month until canceled under Section 2. There is no fixed annual end date.":eo?`With ${/^[AEIOU]/.test(el)?"an":"a"} ${el} Launch Date, the Initial Term ends ${((e,t)=>{if(!b(e))return"[TO COMPLETE: term end]";let n=new Date(`${e}T12:00:00Z`),i=n.getUTCDate();n.setUTCDate(1),n.setUTCMonth(n.getUTCMonth()+t);let a=new Date(Date.UTC(n.getUTCFullYear(),n.getUTCMonth()+1,0)).getUTCDate();return n.setUTCDate(Math.min(i,a)-1),v(n.toISOString().slice(0,10))})(n.launchDate,o)}. If launch moves, the end date moves with it so the Initial Term remains a full 12 months.`:"The Initial Term ends on the day before the 12-month anniversary of the agreed Launch Date. If launch moves, the end date moves with it so the Initial Term remains a full 12 months.",{installmentTotal:eS,firstInstallment:eC,secondInstallment:eA}=i,eP=`Added seats${ed?" and per-claim fees":""} are invoiced separately as stated in this Order Form. Invoices are sent by email to Customer's billing contact. ${R} Payment is by check or bank transfer to the account stated on the invoice; no payment card is required. Smores Health will provide its IRS Form W-9 on request. This payment schedule and invoice deadline override the default payment rules in Section 7(B) of the MSA.`,eD=["The Initial Term subscription",D?"the Minnesota EVV configuration fee":"","schedule"===z?"the implementation fee":""].filter(

19Boolean),eH=G?`**One payment at launch.** Subscription fees are not invoiced monthly. ${w(eD)}, **${y(eS)}** in total, ${eD.length>1?"are":"is"} ${I} on the Launch Date. ${eP}`:W?`**Two installments.** Subscription fees are not invoiced monthly. ${"schedule"===z||D||"upfront"===z||"split"===z?`The Initial Term subscription${D?"schedule"===z?", the Minnesota EVV configuration fee,":" and the Minnesota EVV configuration fee":""}${"schedule"===z?" and the implementation fee":""}, **${y(eS)}** in total, ${"schedule"===z||D?"are":"is"} payable in two installments: **${y(eC)}** ${I} on the Launch Date and **${y(eA)}** ${I} 30 days after the Launch Date.`:`The Initial Term subscription, **${y(eS)}**, is payable in two installments: **${y(eC)}** ${I} on the Launch Date and **${y(eA)}** ${I} 30 days after the Launch Date.`} Added seats${ed?" and per-claim fees":""} are invoiced separately as stated in this Order Form. Invoices are sent by email to Customer's billing contact. ${R} Payment is by check or bank transfer to the account stated on the invoice; no payment card is required. Smores Health will provide its IRS Form W-9 on request. This payment schedule and invoice deadline override the default payment rules in Section 7(B) of the MSA.`:`**Subscription Months and invoicing.** Month 1 begins on the Launch Date. Each following Subscription Month begins on the same numbered day of the next month, or the last day of that month if it has no such day, and ends immediately before the next monthly anniversary. Subscription fees are invoiced monthly in advance, with the first invoice issued on the Launch Date and subsequent invoices issued on each monthly anniversary. Invoices are sent by email to Customer's billing contact. ${R} Payment is by check or bank transfer to the account stated on the invoice; no payment card is required. Smores Health will provide its IRS Form W-9 on request. This payment schedule and invoice deadline override the default payment rules in Section 7(B) of the MSA.`,eT=e=>`${y(e)} per month`,e$=M?[...i.seatPhases.map(e=>`| ${T} plan Months ${e.from} to ${e.to} | ${e.discountPercent?`${y(e.originalRate)} less ${e.discountPercent}% = `:""}${y(e.rate)} per seat | ${eT(d*e.rate)} |`),`| Additional ${T} seats | The rate then in effect for the Included Seats | Added to the monthly total |`].join("\n"):E?[...h.map(e=>`| Growth plan Months ${e.from} to ${e.to} | ${y(e.rate)} per seat | ${eT(d*e.rate)} |`),"| Additional Growth seats | The rate then in effect for the Included Seats | Added to the monthly total |"].join("\n"):`| ${T} plan Months 1 to 12 | ${y(u)} per seat | ${eT(g)} |
20| Additional ${T} seats | ${y(u)} per seat | Added to the monthly total |`,eE=x?`${e$}
21| ${T} plan: ${_.toLowerCase()} | ${y(O)} per seat | ${eT(d*O)} |`:e$,ex=[j&&"schedule"!==z?`the ${y(j)} implementation fee`:"",j&&"schedule"===z?`the ${y(j)} implementation fee`:"",D?`the ${y(D)} Minnesota EVV configuration fee`:""].filter(Boolean),{firstYear:ek}=i,eI=ex.filter(e=>"schedule"===z||e.includes("EVV")),eB=w(["additional seats",ed?"per-claim fees":"",Z?"any separately agreed plan upgrade":"","applicable taxes","separately agreed services"].filter(

21Boolean)),eR=[x?`If service continues for all 12 months with the original ${F}, the projected first-year subscription total is **${y(S)}**. This is an illustration, not a minimum purchase or annual commitment.`:E&&!M?`For the original ${F}, the Initial Term subscription total is **${y(S)}** (${y(p)} per seat across the ramp).`:`For the original ${F}, the Initial Term subscription total is **${y(S)}**.`,ex.length?`Together with ${w(ex)}, the ${x?"projected first-year":"first-year"} base total is **${y(ek)}**, excluding ${eB}.`:`The ${x?"projected first-year":"first-year"} base total is **${y(S)}**, excluding ${eB}.`,G?`${"upfront"===z?`The implementation fee is ${B} separately at signing; the remaining`:"split"===z?`The implementation fee is ${B} separately, half at signing and half at launch; the remaining`:"That total,"} **${y(eS)}**${"upfront"===z||"split"===z?"":","} is ${I} on the Launch Date.`:W?`${"upfront"===z?`The implementation fee is ${B} separately at signing; the remaining`:"split"===z?`The implementation fee is ${B} separately, half at signing and half at launch; the remaining`:"That total,"} **${y(eS)}**${"upfront"===z||"split"===z?"":","} is payable in two installments: **${y(eC)}** ${I} on the Launch Date and **${y(eA)}** ${I} 30 days after the Launch Date.`:L?`The first monthly subscription payment is **${y(g)}**, ${I} on the Launch Date. The second ${y(Q)} implementation installment ${D?`and the ${y(D)} Minnesota EVV configuration fee are`:"is"} ${I} with that payment, making the total ${I} at launch **${y(g+Q+D)}**, unless the Parties agree in writing to a different payment schedule. The first ${y(U)} implementation installment is ${I} at signing.`:"schedule"===z?`The first monthly subscription payment is **${y(g)}**, ${I} on the Launch Date, together with the ${y(j)} implementation fee${D?` and the ${y(D)} Minnesota EVV configuration fee`:""}, making the total ${I} at launch **${y(g+j+D)}**.`:"upfront"===z?`The first monthly subscription payment is **${y(g)}**, ${I} on the Launch Date${D?` together with the ${y(D)} Minnesota EVV configuration fee`:""}; the implementation fee is ${B} separately at signing.`:`The first monthly subscription payment is **${y(g)}**, ${I} on the Launch Date${D?` together with the ${y(D)} Minnesota EVV configuration fee`:""}.`].join(" "),eO=[es?`**${es}**`:"",er?`**${er}**`:"","recorded video training",X?"priority onboarding assistance":"onboarding assistance"].filter(Boolean),eq=[`${t.implementationFee?"The implementation fee includes":"Implementation includes"} ${w(eO)} to help Customer's team get started.`,es||er?`The Parties will coordinate the live session${1===ei?"":"s"} during onboarding.`:"",er?"In person sessions take place at Customer's location on dates the Parties agree in writing. Reasonable travel expenses for in person sessions are billed at cost only with Customer's prior written approval.":"","Customer will supply needed information, notices, and consent materials and participate in the agreed onboarding steps. Smores Health will answer reasonable implementation questions during launch and may reschedule implementation activities when Customer delays needed inputs, subject to the launch and billing rules in Section 2.",X?"Standard support is included throughout the subscription at no additional support charge. Priority assistance applies during onboarding; ongoing support follows Smores Health's standard support practices.":"Smores Health will provide standard support throughout the subscription to help Customer's team use the platform.","Response and resolution times are not guaranteed."].filter(Boolean).join(" "),eF=[`Smores Health will set up Customer's workspace: the ${1===d?"Included Seat and its":`${P(d)} Included Seats and their`} agreed permissions, plus participant records, documentation, plans, assessments, scheduling, messaging, supported reports and exports, and administration${r?", including claims settings under the Claims Addendum":""}${C?" and Minnesota EVV settings under Exhibit B":""}, within existing platform capabilities.`,"Customer will identify the reports and existing data fields needed for launch and provide setup details and timely decisions. Any new feature or custom development requires a separate written agreement."].filter(

21Boolean).join(" "),eM=eo?`The Launch Date is ${el}, unless Customer and Smores Health agree in writing to a different date.`:"Customer and Smores Health will agree on the Launch Date in writing. Any change to that date requires both Parties' written agreement.",e_="none"===z?`No implementation fee. Includes ${w(em("standard setup"))}. ${ep}`:"split"===z?`${y(j)} total: ${y(U)} ${I} at signing and ${y(Q)} ${I} at launch, unless the Parties agree in writing to a different payment schedule. Includes ${w(em("standard setup"))}. ${ep}`:"schedule"===z?`${y(j)}, ${ec}, for ${w(em("standard setup"))}. ${ep}`:`${y(j)} ${I} at signing for ${w(em("standard setup"))}. ${ep}`,eN=H>0?`Customer will pay ${y(H)} for each Submitted Claim, as defined and counted in the Claims Addendum, invoiced monthly in arrears. ${R} No flat monthly claims fee applies. Clearinghouse costs are included. No fee is calculated as a percentage of, or is contingent on, any amount billed, allowed, collected, or paid on any claim, and the fee is payable whether a claim is accepted, paid, denied, or adjusted.`:"No per-claim or monthly claims fee applies; claims submission is included in the subscription. Clearinghouse costs are included. No fee is calculated as a percentage of, or is contingent on, any amount billed, allowed, collected, or paid on any claim.";return{includedFeatures:"community"===a?"The Community plan includes the configured documentation, participant, scheduling, messaging, reporting, and administration workflows.":`The ${T} plan includes the configured documentation, participant, scheduling, messaging, assessment, reporting, and administration workflows, video visits, and claims submission under the Claims Addendum.`,planName:T,seatRate:y(u),discountTerms:V,termCommitmentParagraph:x?"**Month-to-month subscription.** The subscription begins on the agreed Launch Date and continues month to month. There is no annual commitment. Either Party may cancel this Order Form for any reason by giving the other Party at least 30 days' written notice under Section 17(G) of the MSA; email to the designated notice contact is sufficient. The notice must state the cancellation date, which must be at least 30 days after receipt. Subscription access and charges continue through that date. Subscription charges for a partial final Subscription Month are prorated by calendar days of service in that month, rounded to the nearest cent. Smores Health will refund any prepaid subscription charges covering days after cancellation within 30 days. There is no early termination fee. Cancellation does not waive one-time fees already due or charges for services already provided. The MSA's other termination and data-export rights remain in effect.":"**Annual commitment.** The Initial Term is 12 consecutive months beginning on the agreed Launch Date and ending on the day before its 12-month anniversary. Customer cannot cancel for convenience during that term or stop paying for the original Included Seats merely by ceasing use. The termination and other rights expressly provided by the MSA and Data Compliance Addenda remain in effect.",subscriptionClock:x?"month-to-month subscription":"12-month subscription clock",coverTermSentence:x?"The agreed Launch Date starts monthly subscription payments; either Party can cancel with at least 30 days' written notice.":"The agreed Launch Date starts the subscription payments and the full 12-month subscription term.",addedSeatTermSentence:x?"Additional seats end when the subscription ends. Adding a seat does not create an annual commitment or restart a discount period.":"Additional seats follow Customer's existing subscription end date unless included in a signed renewal. Adding a seat does not restart or extend the 12-month term.",upgradeSeatRate:null===Y||Y<=0?"[TO COMPLETE: future upgrade seat price]":y(Y),upgradeClaimRate:null===K?"[TO COMPLETE: future upgrade claim fee]":y(K),seatsPhrase:`${d} staff seat${1===d?"":"s"}`,seatCount:String(d),monthlyTotal:eT(g),pricingRows:eE,feeSummaryParagraph:M?`**Subscription discount.** ${V}
22
23${eR}`:eR,dueAtSigningSentence:ef,invoicingParagraph:eH,paymentDeadline:k?"On the scheduled date":"Within 30 days of invoice",originalSeatsSentence:x?`The original ${d}-seat subscription continues monthly until cancellation under Section 2; it does not create an annual seat commitment.`:1===d?"The original staff seat remains committed for the 12-month Initial Term.":`The original ${P(d)} seats remain committed for the 12-month Initial Term.`,seatCommitmentPhrase:`${d}-seat`,additionalSeatRateSentence:E||M?"An authorized administrator may add seats at the per-seat rate then in effect for the Included Seats.":`An authorized administrator may add seats at ${y(u)} per seat per month.`,implementationFeeParagraph:`${eu} ${eh} ${w(em("standard workspace setup"))}

23 as described in Exhibit A.${q&&t.implementationFee?" No separate fee applies to the included transfer.":""} ${eg}`,implementationFeeAmount:y(j),evvFeeParagraph:D?`**Minnesota EVV configuration.** The one-time EVV configuration fee is **${y(D)}, ${ec}**. It covers the configuration described in Exhibit B.`:"",claimsFeeParagraph:r?`**Claims fee.** ${eN}`:"",claimsPricingTerms:r?eN.replace("as defined and counted in the Claims Addendum","as defined and counted in this Addendum"):"",noOtherFeesSentence:r?`During the Initial Term, Smores Health charges no per-participant fee, data or storage fee, support fee, or clearinghouse pass-through${C?", and no EVV configuration or transmission fee,":""} beyond the fees in this Section.`:"",upgradeSeatTotalSentence:null===Y||Y<=0?"[TO COMPLETE: future upgrade subscription total]":`For the original ${F}, the upgraded subscription would be ${y(d*Y)} per month${0===K?", with no per-claim fee":", plus claims"}.`,launchDateTerms:ev,initialTermEndTerms:ew,renewalParagraph:x?"The subscription continues month to month until canceled under Section 2; no annual renewal is required. The end of a discount does not end the subscription or start an annual commitment. Changes to the agreed prices or other contract terms require a written agreement signed by both Parties.":"There is no automatic renewal. Continued service after the Initial Term requires a renewal signed by both Parties for another 12 months. Smores Health may contact Customer before the Initial Term ends to discuss renewal. A reminder or continued use does not itself renew the agreement.",launchRulesSentence:eo?`The ${el} Launch Date and written rescheduling rules remain as stated in Sections 1 and 2.`:"Launch-date confirmation and rescheduling follow Sections 1 and 2.",timingParagraph:`${eo?`Smores Health will coordinate the ${q?"setup and data transfer":"setup"} schedule with Customer during onboarding.`:`The Parties will agree on the Launch Date together and coordinate ${q?"setup and data transfer":"setup"} during onboarding.`} Timing depends on receiving the ${q?"information, access, and data":"information and access"} needed from Customer.`,exhibitTimingNumber:q?"A3":"A2",exhibitTrainingNumber:q?"A4":"A3",setupParagraph:eF,trainingParagraph:eq,trainingExclusion:es||er?"Additional live training sessions, dedicated staffing, custom development, and work outside this Exhibit are not included unless separately agreed in writing.":"Live training, dedicated staffing, custom development, and work outside this Exhibit are not included unless separately agreed in writing.",participantAccountsNote:e.minorsServed?" Records for participants ages 13 to 17 in Customer's program are turned on as stated in Section 5.":"",coverSeats:`The ${T} plan includes ${d} staff seat${1===d?"":"s"}.`,coverImplementation:`${e_} ${R}`,coverScope:r?"Existing participant, documentation, scheduling, messaging, assessment, reporting, administration, video visit, and claims submission features. Specific new features or delivery dates are committed only when separately agreed in writing.":"Existing participant, documentation, scheduling, messaging, assessment, reporting, and administration features. Specific new features or delivery dates are committed only when separately agreed in writing.",coverSubscription:M?`${N}. The ${Number(t.seatDiscountPercent)}% discount applies to the first ${t.seatDiscountMonths} Subscription Months from launch${ed?`; ${ed}`:""}.`:E?`${y(h[0].rate)} per seat per month for months 1 to 3, ${y(h[1].rate)} for months 4 to 6, and ${y(h[2].rate)} ${x?"from month 7 onward":"for months 7 to 12"}, ${y(S)} ${x?"projected for the first year":"for the Initial Term"} for the original ${F}${ed?`, plus ${ed}`:""}.`:`${y(u)} per seat per month, ${y(g)} per month for the original ${F}${ed?`, plus ${ed}`:""}.`,coverLaunch:eo?`Planned for ${el}, with written flexibility under the Order Form. The agreed Launch Date starts ${W||G?"the payment schedule":"monthly billing"} and ${x?"the month-to-month subscription":"the full 12-month term"}; there is no retroactive subscription billing.`:`Customer and Smores Health will agree on the Launch Date in writing. That date starts ${W||G?"the payment schedule":"monthly billing"} and ${x?"the month-to-month subscription":"the full 12-month term"}; there is no retroactive subscription billing.`,coverCommitment:x?"Month to month, paid monthly. Either Party can cancel with at least 30 days' written notice. The final month is prorated; no early termination fee applies.":`The original ${F} ${1===d?"is":"are"} committed for 12 months, ${W?"paid in two installments":G?`${B} in one installment at launch`:"paid monthly"}, with no cancellation for convenience. Added-seat proration and removal rules and the MSA's express termination rights remain.`,coverRenewal:x?"Continues month to month until canceled; no annual renewal or annual commitment.":"A further year requires both Parties' signatures; nothing renews on its own.",coverLaunchSentence:eM,termDescription:x?"Month to month from launch, cancelable by either Party with at least 30 days' written notice.":eo?`12 months beginning on the ${el} Launch Date, or a later date the Parties agree in writing.`:"12 months beginning on the Launch Date the Parties agree in writing.",implementationStartTerms:eg,implementationFeeTerms:`${eu} ${eh} ${w(em("standard workspace setup"))}

23 as described in Exhibit A.`,additionalSeatTerms:x?"Additional seats use the scheduled per-seat rate, including the same remaining discount period. They are prorated from activation, removable at the end of a billing month, and end when the subscription ends.":M?"Additional seats use the scheduled per-seat price and the same remaining discount period, with proration from activation. Adding a seat does not restart the discount or extend the term.":E?"Additional seats are priced at the ramp rate then in effect, prorated from activation, removable at the end of a billing month, and do not extend the 12-month term.":`Additional seats are ${y(u)} per seat per month, prorated from activation, removable at the end of a billing month, and do not extend the 12-month term.`,seats:`${d} Staff seat${1===d?"":"s"}`,pricingTerms:M?`${N}. ${W||G?`${y(S)} for the Initial Term subscription${eI.length?`, ${y(eS)} with ${w(eI)}`:""}, ${G?`${B} in one installment at launch`:`${B} in two installments at launch and 30 days after launch`}. `:"Invoiced monthly in advance from the Launch Date. "}${Number(t.seatDiscountPercent)}% off for the first ${t.seatDiscountMonths} Subscription Months from launch${ed?`; ${ed}`:""}.`:W||G?`${y(S)} for the Initial Term for the original ${F}${eI.length?`, ${y(eS)} with ${w(eI)}`:""}, ${G?`${B} in one installment at launch`:`${B} in two installments at launch and 30 days after launch`}${ed?`; ${ed}`:""}.`:E?`Ramp of ${y(h[0].rate)}, ${y(h[1].rate)}, then ${y(h[2].rate)} per seat per month, invoiced monthly in advance from the Launch Date${ed?`; ${ed}`:""}.`:`${y(u)} per seat per month, ${y(g)} per month for the original ${F}, invoiced monthly in advance from the Launch Date${ed?`; ${ed}`:""}.`,implementationTerms:`${e_} ${R}`,supportTerms:X?"Priority onboarding assistance; standard support afterward at no additional charge.":"Standard support at no additional charge.",renewalTerms:x?"Continues month to month until canceled; no annual renewal is required.":"A further 12 months requires a renewal signed by both Parties; no automatic renewal.",evvStatusSentence:"At signing, Customer's enrollment and readiness steps with DHS and the Aggregator are pending."}}},67654:(e,t,n)=>{n.d(t,{j:()=>i});let i={master_services_agreement:{sourcePath:"docs/legal/contracts/company-packet/02-master-services-agreement.md",sha256:"868dc93df7ca190f6aa2d6f954c654bd3c6038164044edfd5a32be9bb733656a",markdown:"# Master Services Agreement\n\nThis Master Services Agreement (this **Agreement**) is entered into and becomes effective on the date on which the last Party signs the Signing Page of this packet (the **Effective Date**) by and between:\n\n**Customer:** **{{customerLegalName}}**, {{entityDescription}}, with principal address at **{{noticeAddress}}** (the **Customer**),\n\nand\n\n**Smores Health, Inc.**, a Delaware corporation, with principal address at **584 Castro Street, Suite 4102, San Francisco, CA 94114** (**Smores Health**).\n\nCustomer and Smores Health are each a **Party** and together are the **Parties**.\n\n## 1. Purpose And Structure\n\nA. This Agreement governs Customer's purchase and use of Smores Health's software platform, related support, and any professional or implementation services identified in an Order Form or Statement of Work. The Services may support recovery, wellness, education, peer-support, care-coordination, documentation, communication, administrative, or related workflows only to the extent identified in an Order Form.\n\nB. The Agreement consists of:\n\n1. this Agreement;\n\n2. each order form, ordering document, or online purchase record executed by the Parties that references this Agreement (each, an **Order Form**);\n\n3. each statement of work signed by the Parties (each, an **SOW**);\n\n4. the Customer Responsibilities Addendum (the **Customer Addendum**);\n\n5. any Business Associate Agreement, Qualified Service Organization Agreement, data processing addendum, or similar regulated-data rider signed by the Parties (collectively, the **Data Compliance Addenda**); and\n\n6. the Claims Submission Addendum, if executed by the Parties (the **Claims Addendum**), which is the separate written agreement under which Smores Health acts as Customer's limited billing agent for claim preparation and transmission.\n\nC. This Agreement does not make Smores Health the treating provider, medical practice, facility, payer, educational institution, school official, Part 2 program, lawful holder, recovery community organization, or sponsor of Customer's regulated services unless the Parties expressly agree otherwise in a separate written agreement signed by both Parties. The Claims Addendum, if executed, appoints Smores Health as Customer's limited billing agent solely as stated there; it does not make Smores Health a provider, supplier, or payer, and Customer remains the enrolled billing provider of record. Smores Health does not supervise, direct, or control Customer's personnel, users, workflows, documentation, or service delivery, and does not assume responsibility for any clinical, peer-support, educational, treatment, safety, or program decisions.\n\nD. Public-facing platform terms, privacy notices, telehealth platform terms, community rules, and similar clickwrap or end-user materials may be presented to individual users or Authorized Users in connection with their use of the Services. As between Smores Health and Customer, those public-facing materials do not modify the commercial, operational, or regulatory allocation in this Agreement, any applicable Customer Addendum, or any Data Compliance Addenda, except to the extent an applicable Order Form expressly states otherwise.\n\nE. **Initial ordering documents.** Concurrently with this Agreement, the Parties are entering into the Subscription Order Form of even date (the **Initial Order Form**), {{#claims}}the Claims Submission Addendum of even date (the Claims Addendum), {{/claims}}{{#healthData}}the Business Associate Agreement and Qualified Service Organization Agreement of even date (the **BAA/QSOA**), {{/healthData}}the Customer Responsibilities Addendum of even date, and the Data Processing Agreement and Security Exhibit of even date (the **DPA**). The Initial Order Form is entered into under this Agreement and is incorporated into this Agreement by reference as the first Order Form. For purposes of Section 1(B), {{#healthData}}the BAA/QSOA and {{/healthData}}the DPA are Data Compliance Addenda, and the Customer Responsibilities Addendum is the Customer Addendum. {{#claims}}

23The Claims Addendum is the Claims Addendum described in Section 1(B)(6).{{/claims}}\n\nF. **Data handling and onboarding.** Customer will provide accurate onboarding information about its services and the records to be imported or processed, and obtain any permissions or consents required for Customer to provide those records to Smores Health. Each Party remains responsible for its obligations under the applicable data agreements and law. Regulated-data processing will not begin until the applicable agreements, permissions, notices, consents, configuration, and readiness steps are complete. {{#dataRoleStated}}Customer has disclosed its legal and data-processing role as follows: {{dataRole}}. {{/dataRoleStated}}The approved operating states are {{operatingStates}}. {{includedFeatures}} The applicable Data Compliance Addenda govern the regulated records Customer directs through the Services. Workflows that depend on regulated records or services, including video visits, records for participants ages 13 to 17 kept by Customer's staff, claims submission{{#minnesotaEvv}}, electronic visit verification{{/minnesotaEvv}}, and any similar regulated workflow, are available only when turned on in Customer's configuration and on the conditions stated in the Initial Order Form and the Customer Addendum{{#claims}} and, for claims, the Claims Addendum{{/claims}}.\n\nG. **Prior agreements.** If the Parties had a prior pilot or other agreement for the Services, this Agreement and the documents listed in Section 1(E) supersede it as of the Effective Date, except that (1) obligations under that prior agreement that by their terms survive continue to apply to the period before the Effective Date, and (2) all Customer Data disclosed to or created in the Services during that prior period or during any gap between its expiration and the Effective Date is governed by the applicable Data Compliance Addenda of even date, which the Parties agree apply to that period, without any gap in protection. Customer acknowledges that records created in the Services before Smores Health activates Customer's production configuration are retained as Customer Data but are not eligible for claim submission{{#minnesotaEvv}} or electronic visit verification transmission{{/minnesotaEvv}}.\n\n## 2. Definitions\n\nA. **Authorized User** means an individual whom Customer permits to access or use the Services under Customer's account, whether as an employee, contractor, workforce member, peer, supervisor, administrator, or other permitted user.\n\nB. **Customer Data** means data, records, content, files, communications, configurations, prompts, inputs, and other information submitted to, transmitted through, stored in, or otherwise made available to the Services by or on behalf of Customer or Customer's Authorized Users. Customer Data does not include Smores Health IP, platform usage metadata that does not identify Customer or any individual, or information that has been de-identified or aggregated in accordance with applicable law.\n\nC. **Documentation** means Smores Health's then-current technical or user documentation for the Services that Smores Health makes generally available to customers.\n\nD. **Smores Health IP** means the Services, Documentation, software, models, interfaces, workflows, methods, designs, reports, templates, know-how, and other technology or materials owned or licensed by Smores Health, excluding Customer Data.\n\nE. **Services** means Smores Health's hosted software platform, support services, implementation services, and any optional modules, integrations, or related services identified in an Order Form or SOW.\n\nF. **De-identified Data** means information derived from Customer Data that has been de-identified in accordance with 45 CFR 164.514(a) and (b) and, for records subject to 42 CFR Part 2, rendered so that it no longer contains patient identifying information within the meaning of 42 CFR 2.11, together with aggregated or statistical information that does not identify Customer or any individual.\n\n## 3. Orders And Subscription Scope\n\nA. Customer may purchase access to the Services by entering into one or more Order Forms under this Agreement.\n\nB. Each Order Form identifies the applicable Smores Health subscription plan and controls the specific Services, limits, billing metric, support level, and fees purchased by Customer.\n\nC.

23Customer may not exceed the scope, metrics, territories, user counts, workflow types, or other limits stated in the applicable Order Form.\n\nD. If Customer requests additional workflows, modules, storage, implementation services, integrations, or jurisdictions beyond the scope of an existing Order Form, the Parties will document the change in a new or amended Order Form or SOW. Seat additions and removals expressly permitted by an Order Form follow that Order Form's seat-change terms without a separate amendment.\n\n## 4. Access Rights And Service Restrictions\n\nA. Subject to this Agreement and the applicable Order Form, Smores Health grants Customer a limited, non-exclusive, non-transferable, non-sublicensable right during the Term to permit Authorized Users to access and use the Services for Customer's internal business purposes.\n\nB. Customer will not, and will not permit any third party to:\n\n1. sell, resell, license, sublicense, distribute, rent, or lease the Services except as expressly permitted by this Agreement;\n\n2. copy, modify, create derivative works of, reverse engineer, decompile, disassemble, or otherwise attempt to derive source code from the Services except to the limited extent such restriction is prohibited by law;\n\n3. access or use the Services to build a competing product or service;\n\n4. interfere with or disrupt the integrity, security, or performance of the Services;\n\n5. use the Services in violation of law, professional rules, payer rules, or third-party rights;\n\n6. upload malware, unlawful content, or content designed to disable or impair the Services;\n\n7. permit any unauthorized person to access the Services; or\n\n8. use any outputs, reports, documentation formats, templates, workflows, or other materials generated or made available through the Services to develop, replicate, or enable any competing product or service, or to create derivative systems outside the permitted use of the Services.\n\nC. Customer is responsible for all acts and omissions of its Authorized Users and anyone accessing the Services through Customer's accounts, credentials, devices, or systems. Smores Health is not responsible for the conduct, actions, or omissions of Customer's Authorized Users.\n\n## 5. Customer Responsibilities\n\nA. Customer is responsible for:\n\n1. designating administrators with authority to manage Customer's account, users, and settings;\n\n2. maintaining accurate account, billing, and contact information;\n\n3. ensuring that Customer's devices, networks, browsers, and local systems used to access the Services are secure and supported;\n\n4. configuring and using the Services in a manner consistent with the Documentation, this Agreement, any applicable Customer Addendum, and applicable law; and\n\n5. obtaining and maintaining all permissions, consents, rights, and authorizations needed for Customer and Smores Health to lawfully process Customer Data as contemplated by this Agreement.\n\nB. Customer acknowledges that the Customer Addendum allocates responsibility for patient, participant, member, client, and end-user notices; informed consents; releases and authorizations; telehealth compliance; licensure or certification; state-law compliance; minors; rights requests; safety escalation; and similar regulated-service obligations. Customer remains solely responsible for those matters unless the Parties expressly agree otherwise in writing.\n\nC. Customer is solely responsible for the substance, accuracy, legality, and appropriateness of Customer Data and for Customer's decisions, actions, disclosures, communications, care workflows, supervision practices, and reliance on outputs from the Services. Smores Health does not validate or ensure compliance of Customer's use of the Services with applicable law or professional standards.\n\nD. Customer acknowledges that Smores Health does not monitor all activity within the Services and has no obligation to review, audit, or evaluate communications, documentation, disclosures, or user conduct. Any moderation, safety, alerting, reporting, or administrative-visibility functionality is limited to the features Customer has purchased and configured. Smores Health does not undertake responsibility to detect all violations, prevent misconduct, or intervene in real time.\n\n## 6. Support, Changes, And Third-Party Services\n\nA. Smores Health will provide the support level, if any, stated in the applicable Order Form. If no support level is stated, Smores Health will provide commercially reasonable standard support under its then-current support practices, without any guaranteed response or resolution time.\n\nB. Smores Health may update, enhance, modify, or replace the Services from time to time.\n\nC. The Services may interoperate with third-party products, services, infrastru

23cture, video platforms, communications tools, identity services, AI services, hosting services, analytics services, payment processors, and other integrations. Smores Health may use third-party service providers and subprocessors to deliver the Services.\n\nD. **Customer-Managed Integrations.** A third-party product, service, or account is a **Customer-Managed Integration** only when Customer obtains it directly from the third-party provider under Customer's own agreement, administers or controls it, and directs Smores Health or an Authorized User to connect it to the Services. Customer will accept and comply with applicable third-party terms, maintain required licenses, business associate agreements, consents, and other authorizations, and remain responsible for the integration's account configuration and access controls.\n\nE. Customer authorizes Smores Health to transmit Customer Data to and receive Customer Data from a Customer-Managed Integration as reasonably necessary to provide the configured integration at Customer's direction and subject to any applicable Data Compliance Addenda. Customer will not use a Customer-Managed Integration for regulated data unless Customer has determined that the integration is approved and appropriately configured for that use. Smores Health is not responsible for a third-party product or service to the extent Smores Health does not control it, except as expressly stated in a signed Data Compliance Addendum or required by law. Nothing in this Section limits Smores Health's obligations for the Services, Smores Health's handling of Customer Data, or any provider Smores Health engages to perform the Services.\n\n## 7. Fees, Invoicing, And Payment\n\nA. Customer will pay all fees stated in each applicable Order Form.\n\nB. Unless otherwise stated in the applicable Order Form:\n\n1. subscription fees are billed in advance on a monthly basis for month-to-month subscriptions and in advance for each annual subscription period for annual subscriptions;\n\n2. usage-based or overage charges are billed in arrears;\n\n3. payment is due on the date each invoice is issued; and\n\n4. card-based subscriptions may be charged automatically using Customer's designated payment method.\n\nC. Fees are non-cancelable and non-refundable except as expressly stated in this Agreement or required by law.\n\nD. Customer is responsible for all sales, use, excise, value-added, goods and services, withholding, and similar taxes, duties, and charges arising from the Services, excluding taxes based on Smores Health's net income, property, or employees.\n\nE. If Customer does not timely pay undisputed amounts, Smores Health may charge interest at the lesser of 1.5% per month or the maximum rate permitted by law, and Customer will reimburse Smores Health for reasonable collection costs.\n\nF. If Customer is delinquent for more than **10 days** after written notice, Smores Health may suspend access to the affected Services until payment is made, except to the extent suspension would violate law or the Parties agree otherwise in writing.\n\n## 8. Confidentiality\n\nA. **Confidential Information** means non-public information disclosed by one Party (**Discloser**) to the other Party (**Recipient**) that is designated as confidential or that reasonably should be understood to be confidential given the nature of the information and the circumstances of disclosure. Confidential Information includes Customer Data, security information, pricing, product roadmaps, and non-public business, technical, or legal information. Confidential Information does not include information that Recipient can demonstrate:\n\n1. is or becomes publicly available without Recipient's breach of this Agreement;\n\n2. was already known to Recipient without confidentiality obligation before disclosure by Discloser;\n\n3. is lawfully received from a third party without confidentiality obligation; or\n\n4. is independently developed by Recipient without use of or reference to Discloser's Confidential Information.\n\nB. Recipient will:\n\n1. use Discloser's Confidential Information only as necessary to perform or receive the Services and exercise r

23ights under this Agreement;\n\n2. protect Discloser's Confidential Information using at least reasonable care and no less than the care it uses for its own similarly sensitive information; and\n\n3. disclose Confidential Information only to personnel, affiliates, contractors, and advisers who need to know it for purposes consistent with this Agreement and who are bound by confidentiality obligations at least as protective as those in this Agreement.\n\nC. Recipient may disclose Confidential Information to the extent required by law, subpoena, court order, or governmental demand, provided Recipient gives Discloser prompt notice to the extent legally permitted and reasonably cooperates with efforts to seek confidential treatment or limit the disclosure.\n\n## 9. Customer Data, Security, And Regulated Data\n\nA. As between the Parties, Customer retains all right, title, and interest in and to Customer Data.\n\nB. Customer grants Smores Health a non-exclusive right to host, copy, process, transmit, display, and otherwise use Customer Data as necessary to provide, secure, support, maintain, and comply with law in connection with the Services, and for Smores Health's internal operations, including security monitoring, fraud and abuse prevention, support, metering and billing, service analytics, and the analysis, evaluation, and improvement of the Services, using Customer Data including usage, engagement, and audit metadata associated with individual accounts, in each case subject to this Agreement and, for PHI and Part 2 Records, the BAA/QSOA. If the applicable Order Form, SOW, research agreement, or Data Compliance Addendum authorizes research, evaluation, or study-support functionality, Smores Health may process Customer Data for that Customer-directed purpose in accordance with Customer's written instructions and applicable law. Research exports and research datasets will be de-identified, aggregated, limited, or otherwise minimized where feasible, and identifiable Customer Data will be included only where expressly authorized in writing and permitted by applicable law.\n\nC. Smores Health will maintain administrative, technical, and physical safeguards reasonably designed to protect Customer Data against unauthorized access, use, alteration, and disclosure.\n\nD. To the extent Customer Data includes PHI, records protected by 42 CFR Part 2, consumer health data, or other regulated data, the applicable Data Compliance Addenda govern the Parties' obligations with respect to such data. Customer will not use any workflow involving regulated data unless the applicable Data Compliance Addenda required for that workflow have been fully executed or otherwise accepted and remain in effect.\n\nE. **Research and AI improvement.** To the extent Customer has authority to grant these rights, Customer authorizes Smores Health to create and use De-identified Data for research, program evaluation, benchmarking, and the development, training, testing, and improvement of current or future Smores Health products and AI models. This is ongoing permission for those purposes, without additional Customer approval for each project within this scope. It continues after the Agreement ends only for De-identified Data lawfully created and retained, subject to continuing restrictions and required permissions.\n\nBefore processing records for these purposes, Smores Health will confirm that the proposed processing is permitted and that required permissions have been obtained and remain effective. Data subject to agency, contractual, consent, or third-party restrictions, including information derived from that data, is excluded unless the applicable restrictions permit the proposed use and any required approvals have been obtained. Customer's signature does not override those restrictions.{{#minnesotaEvv}} Electronic visit verification records, including visit location data, are excluded from the uses this Section permits and are used and disclosed only as stated in Exhibit B to the Subscription Order Form.{{/minnesotaEvv}} Uncertain eligibility does not authorize use. The Parties will share relevant restrictions and changes; each remains responsible for its own duties.\n\nSmores Health will apply applicable de-identification standards, will not attempt to re-identify individuals, and will not disclose datasets, findings, or model outputs that reasonably identify Customer or an individual. Service providers may assist only on Smores Health's behalf under appropriate written restrictions; this permission does not authorize their independent research or model training. It does not authorize training on identifiable Customer Data, retention of source records contrary to return or deleti

23on duties, or promise that Smores Health currently trains or will develop a model.\n\nAs between the Parties and only to the extent lawfully transferable, Smores Health owns eligible De-identified Data and the models, algorithms, and other work it creates from permitted uses. This does not transfer rights in restricted source or derived information, expand permitted uses, or authorize re-identification. Smores Health will not sell Customer Data or use it for third-party advertising.\n\nF. If Smores Health becomes aware of a confirmed security incident materially affecting Customer Data, Smores Health will notify Customer without unreasonable delay, subject to applicable law, the Documentation, and any applicable Data Compliance Addenda.\n\nG. **Changes in law.** Throughout this packet, legal references mean the applicable provisions as amended, replaced, and legally effective from time to time, including applicable compliance dates and controlling court orders. Each Party will comply with laws and binding agency requirements applicable to its role. The Parties will make amendments necessary for continued compliance; affected processing must comply by the applicable deadline even if an amendment is pending. A change in law does not itself expand the purposes authorized by this packet, replace required permissions, transfer third-party rights, or change fees or service commitments. Express contractual protections remain in effect unless law requires otherwise or the Parties agree to a permitted change under the packet's amendment provisions.\n\n## 10. Artificial Intelligence And Automated Features\n\nA. The Services may include features that use automation, ranking, moderation, summarization, pattern detection, or generative or predictive models supplied by Smores Health or third-party providers.\n\nB. Customer is solely responsible for determining whether and how to use such features in Customer's workflows and for ensuring that Customer's use of such features is lawful and appropriate for Customer's clinical, operational, and regulatory environment.\n\nC. Unless expressly stated otherwise in an Order Form or Documentation, AI-assisted or automated outputs are provided as support tools only and are not a substitute for Customer's professional judgment, supervision, legal review, care decision-making, or compliance determinations.\n\nD. To the extent the Services include matching, ranking, or recommendation functionality, such features are assistive tools only. Customer is solely responsible for reviewing, approving, and making final decisions regarding any assignments, pairings, or relationships facilitated through the Services.\n\nE. Smores Health will not use identifiable Customer Data, including PHI or Part 2 Records, to train, fine-tune, or improve its own or third-party AI models under this packet. Research and model development using eligible De-identified Data are governed by Section 9(E). Existing AI tools may process Customer Data only to provide expressly permitted Services under the applicable Data Compliance Addenda. Service processing does not grant a provider independent training rights, and no AI capability or delivery date is promised by this permission.\n\nF. Customer may not use outputs from AI or automated features to train, develop, or improve any competing product or service.\n\n## 11. Intellectual Property\n\nA. Smores Health and its licensors retain all right, title, and interest in and to the Smores Health IP.\n\nB. Except for the limited rights expressly granted in this Agreement, no rights are granted to Customer by implication, estoppel, or otherwise.\n\nC. If Customer provides suggestions, enhancement requests, feedback, or recommendations regarding the Services, Smores Health may use them without restriction or obligation, provided Smores Health does not identify Customer or any individual in doing so.\n\nD. Except for Customer Data, all structure, organization, design, workflows, templates, and formats embodied in any outputs, reports, or materials generated by the Services constitute Smores Health IP. Customer may use such outputs solely for its internal business purposes in connection with its use of the Services and may not use them to replicate or develop competing systems or processes.\n\nE. Subject to Section 9(E), eligible De-identified Data and the models, algorithms, benchmarks, insights, and other works Smores Health creates through permitted uses are Smores Health IP. No ownership is claimed in restricted information or rights Customer cannot transfer.\n\n## 12. Warranties And Disclaimers\n\nA. Each Party represents that it has the legal power and authority to enter into this Agreement.\n\nB. Smores Health will use commercially reasonable efforts to make the Services available and to provide them with reasonable care and skill. Customer's exclusive remedy for a failure of the Services to operate as de

23scribed in the Documentation is for Smores Health to use commercially reasonable efforts to correct the failure.\n\nC. Customer warrants that Customer has all rights, permissions, and legal authority necessary for Customer and Smores Health to process Customer Data as contemplated by this Agreement.\n\nD. Except as expressly stated in this Agreement, the Services are provided as is and as available. To the maximum extent permitted by law, Smores Health disclaims all warranties, express or implied, including implied warranties of merchantability, fitness for a particular purpose, title, and non-infringement, and does not warrant that the Services will be uninterrupted, error-free, or suitable for every workflow, payer rule, regulatory interpretation, or clinical use case.\n\nE. Smores Health does not provide medical advice, legal advice, reimbursement advice, coding advice, or professional licensure advice.\n\nF. The Services are not a 911 service, emergency dispatch system, crisis line, or substitute for Customer's own emergency-response, escalation, supervision, or clinical safety procedures.\n\n## 13. Indemnification\n\nA. Customer will defend Smores Health and its officers, directors, employees, and contractors against any third-party claim, including any payer, regulator, or government action, arising out of any of the following, and will pay damages finally awarded or amounts approved in settlement by Customer for such claim:\n\n1. Customer Data;\n\n2. Customer's services, treatment, peer-support activities, workflows, disclosures, notices, consents, claims, or instructions;\n\n3. Customer's violation of law, professional standards, payer rules, or third-party rights; or\n\n4. Customer's breach of this Agreement, the Customer Addendum,{{#claims}} the Claims Addendum,{{/claims}} or any applicable Data Compliance Addendum.\n\nB. Smores Health will promptly notify Customer of the claim, allow Customer control of the defense and settlement, and provide reasonable cooperation at Customer's expense. Smores Health may participate in the defense with counsel of its choosing at its own expense. Customer may not settle any claim in a manner that admits liability of or imposes non-monetary obligations on Smores Health without Smores Health's prior written consent, not to be unreasonably withheld.\n\n## 14. Limitation Of Liability\n\nA. Except for excluded claims, neither Party will be liable to the other for any indirect, incidental, special, consequential, exemplary, or punitive damages, or for any loss of profits, revenue, goodwill, or anticipated savings, even if advised of the possibility of such damages.\n\nB. Except for excluded claims, each Party's aggregate liability arising out of or relating to this Agreement will not exceed the total fees paid or payable by Customer to Smores Health under this Agreement during the 12 months preceding the event giving rise to the claim. For clarity, this cap applies to claims arising out of or relating to Section 8 (Confidentiality), the Data Compliance Addenda, and any security incident, including costs of investigation, notification, credit monitoring, regulatory fines and penalties, and third-party claims, except to the extent the claim otherwise qualifies as an excluded claim under Section 14(C).\n\nC. **Excluded claims** means:\n\n1. Customer's payment obligations;\n\n2. Customer's indemnification obligations under Section 13{{#claims}} or Section 8(D) of the Claims Addendum{{/claims}};\n\n3. Customer's breach of Sections 4 or 5;\n\n4. either Party's fraud or willful misconduct; and\n\n5. liabilities that cannot be limited under applicable law.\n\nD. **No personal liability.** No officer, director, employee, contractor, or agent of either Party has any personal liability to the other Party under or in connection with this Agreement, any Order Form, the Claims Addendum, the Customer Addendum, or the Data Compliance Addenda, and each Party will assert any claim arising out of or relating to them solely against the other Party. Notwithstanding Section 17(B), those individuals are intended third-party beneficiaries of this Section 14(D

23) and may enforce it. This Section does not limit an individual's liability for that individual's own fraud or willful misconduct.\n\n## 15. Term, Renewal, And Termination\n\nA. This Agreement begins on the Effective Date and continues until terminated in accordance with this Section 15 (the **Term**).\n\n{{#monthToMonth}}B. The Initial Order Form begins on the agreed Launch Date and continues month to month until canceled under its Section 2. Either Party may cancel it on at least 30 days' written notice, with final subscription proration and refunds as stated there. No annual commitment or annual renewal applies.{{/monthToMonth}}\n\n{{#signedRenewal}}B. Each Order Form begins on the start date stated in the applicable Order Form and ends on its stated end date. Subscriptions do not renew automatically. The Parties may renew through a new Order Form or another written renewal signed by both Parties.{{/signedRenewal}}\n\n{{#otherRenewal}}B. Each Order Form begins on the start date stated in the applicable Order Form and ends on its stated end date. Renewal and post-expiration access are governed by the renewal terms in that Order Form.{{/otherRenewal}}\n\nC. Either Party may terminate this Agreement or an affected Order Form for material breach if the other Party fails to cure the breach within **30 days** after written notice describing the breach in reasonable detail, except that the cure period for Customer's failure to pay undisputed fees is **10 days** after written notice.\n\nD. Either Party may terminate this Agreement immediately upon written notice if the other Party becomes insolvent, makes a general assignment for the benefit of creditors, becomes subject to bankruptcy or similar proceedings that are not dismissed within **60 days**, or ceases doing business in the ordinary course.\n\nE. Smores Health may suspend or terminate affected Services immediately if necessary to prevent a material security risk, unlawful use, legal, regulatory, or compliance risk, or material breach of any applicable Customer Addendum or a Data Compliance Addendum.\n\nF. Customer may use the platform's export features during its subscription. Upon expiration or termination:\n\n1. Customer's access rights cease except as expressly stated in this Agreement;\n\n2. Customer remains responsible for all fees accrued through the effective date of termination;\n\n3. Customer has **30 days** after expiration or termination to request its data by email. Smores Health will make the requested data available within a reasonable time using existing export formats, including for requests made before expiration or termination, subject to applicable law and any Data Compliance Addenda; and\n\n4. thereafter, Smores Health may delete Customer Data in accordance with its retention practices, the Documentation, and any applicable Data Compliance Addenda, except to the extent retention is required by law, backup processes, security purposes, audit needs, or legal hold.\n\n{{#monthToMonth}}G. **Monthly continuation.** The subscription continues month to month at the prices stated in the Order Form until canceled. A discount period does not create an annual commitment. Changes to agreed pricing or other contract terms require a written agreement signed by both Parties.{{/monthToMonth}}\n\n{{#signedRenewal}}G. **No implied renewal.** Continued access to the Services after the end date of an Order Form requires a renewal Order Form or another written renewal signed by both Parties. Smores Health may contact Customer before the end date of the Initial Order Form to discuss renewal, but neither Party is obligated to renew, and no course of dealing, continued use, invoice, or payment creates a renewal, an extension, or a month-to-month term. Any post-expiration access that Smores Health elects in writing to provide is a limited accommodation on the terms Smores Health states in that writing and is not a renewal.{{/signedRenewal}}\n\n{{#otherRenewal}}G. **Renewal.** The renewal terms, rates, notice periods, and any automatic renewal are stated in the applicable Order Form. No renewal is implied beyond the terms expressly stated there.{{/otherRenewal}}\n\n## 16. Order Of Precedence\n\nA. If there is a conflict between an Order Form and this Agreement on commercial terms such as scope, fees, billing metric, or subscription term, the Order Form controls for that Order Form.\n\nB. If there is a conflict between this Agreement and any applicable Customer Addendum on clinical, regulatory, notice, consent, licensure, state-law, or customer-role allocation issues, the Customer Addendum controls.\n\nC. If there is a conflict between this Agreement and a Data Compliance Addendum regarding regulated-data handling, HIPAA, 42 CFR Part 2, breach notification, return or destruction of data, or other legally required data-protection terms, the Data Compliance Addendum controls solely with respect to those matters. Except to the extent expressly required by applicable law, the limitations of liability and remedies set forth in this Agreement remain applicable.\n\n{{#claims}}D. If there is a conflict between this Agreement and the Claims Addendum on the scope or limits of Smores Health's billing-agent role, claim approval and submission, payment flows, or claims-related fees, the Claims Addendum controls.{{/claims}}\n\nE. Except as provided above, this Agreement controls over any conflicting SOW, purchase order, or other customer-generated terms, and any preprinted terms in a purchase order or vendor portal are void unless expressly accepted by Smores Health in writing.\n\n## 17. General\n\nA. **Independent contractors.** The Parties are independent contractors. Nothing in this Agreement creates a partnership, joint venture, fiduciary relationship, or employment relationship.\n\nB. **No third-party beneficiaries.** This Agreement does not create rights in any third party.\n\nC. **Assignment.** Neither Party may assign this Agreement without the other Party's prior written consent, except that either Party may assign this Agreement without consent to an affiliate or in connection with a merger, acquisition, corporate reorganization, or sale of substantially all of its assets, provided the assignee agrees in writing to be bound by this Agreement.\n\nD. **Force majeure.** Neither Party is liable for delay or failure to perform caused by events beyond its reasonable control, excluding payment obligations.\n\nE. **Amendment; waiver.** This Agreement may be amended only in writing signed by both Parties. A waiver is effective only if in writing and applies only to the specific instance waived.\n\nF. **Severability.** If any provision of this Agreement is held unenforceable, the remaining provisions remain in effect and the provision

23will be interpreted as nearly as possible to accomplish its intended purpose.\n\nG. **Notices.** Notices under this Agreement must be in writing and delivered by personal delivery, nationally recognized overnight courier, certified mail, or email to the notice contacts identified below or updated by notice.\n\n**If to Customer:**\n\n**Attention:** {{noticeAttention}}\n\n**Address:** {{customerLegalName}}, {{noticeAddress}}\n\n**Email:** {{noticeEmail}}\n\n**If to Smores Health:**\n\n**Name:** Smores Health, Inc., Attn: Legal\n\n**Address:** 584 Castro Street, Suite 4102, San Francisco, CA 94114, USA\n\n**Email:** [email protected]\n\nH. **Governing law; venue.** This Agreement is governed by the laws of the State of Delaware, without regard to conflict of laws principles, except to the extent preempted by federal law or expressly stated in a signed customer-specific addendum. Subject to each Party's right to seek injunctive relief in any court of competent jurisdiction, the state and federal courts located in Delaware will have exclusive jurisdiction over disputes arising out of or relating to this Agreement unless a signed customer-specific addendum provides otherwise.\n\nI. **Entire agreement.** This Agreement, together with all Order Forms, SOWs, any applicable Customer Addendum, any executed Claims Addendum, and Data Compliance Addenda, constitutes the entire agreement between the Parties regarding its subject matter and supersedes all prior or contemporaneous understandings on that subject matter.\n\nJ. **Counterparts; electronic signatures.** This Agreement may be executed in counterparts, including by electronic signature or electronic exchange of signature pages, each of which is deemed an original and all of which together constitute one instrument.\n\nK. **Brand changes.** Smores Health may market the Services under a different trade name, brand, product name, or domain during the Term. Such a change does not modify the Parties' rights and obligations, and references to Smores Health or the Services include any successor name or brand. Smores Health will give Customer written notice of any change to its corporate name.\n\nL. **Survival.** Sections 7, 8, 9(E), 11, 13, 14, 15(F), 16, 17, and any other provisions that by their nature should survive expiration or termination of this Agreement will survive such expiration or termination.\n\n## 18. Execution\n\nThis Agreement is executed by the signatures on the Signing Page at the end of this packet. Each Party's signature there is its signature on this Agreement and on each other agreement listed on the Signing Page.\n"},team_order_form:{sourcePath:"docs/legal/contracts/company-packet/03-standard-order-form.md",sha256:"9e227f51314f78fb0717417f98406d054d28076e50ec3c0bc3c82b5add400976",markdown:"# Subscription Order Form\n\nThis Subscription Order Form (this **Order Form**) is entered into by and between **Smores Health, Inc.** (**Smores Health**) and **{{customerLegalName}}**, {{entityDescription}} (**Customer**), and is governed by the Master Services Agreement between the Parties of even date (the **MSA**). Capitalized terms not defined in this Order Form have the meanings given in the MSA{{#claims}} or, for claims terms, the Claims Addendum{{/claims}}. This Order Form is effective on the Effective Date of the MSA.\n\nIf there is any conflict between this Order Form and the MSA on commercial terms such as scope, plan, seats, fees, payment dates, or term, this Order Form controls for those terms. The Customer Responsibilities Addendum, {{#healthData}}the BAA/QSOA, {{/healthData}}and the Data Processing Agreement and Security Exhibit apply and control as stated in those agreements. {{#claims}}The Claims Submission Addendum of even date (the **Claims Addendum**) governs the claims submission services purchased under this Order Form.{{/claims}}\n\n## 1. Customer and Subscription Summary\n\n**Customer legal name:** {{customerLegalName}}\n\n**Customer address:** {{noticeAddress}}\n\n{{#providerIdentifier}}**Customer NPI:** {{customerNpi}}

23, as supplied and confirmed by Customer for the purchased services.{{/providerIdentifier}}\n\n**Purchased services:** {{scopeSummary}}\n\n**Initial Term:** {{termDescription}}\n\n**Implementation Start Date:** {{implementationStartTerms}}\n\n**Implementation Period:** the period from the Implementation Start Date until the implementation services in Exhibit A are complete.\n\n**Included seats:** {{seats}} (the **Included Seats**).\n\n**Participant accounts:** unlimited. Participants and the people Customer serves are never seats and are never charged.\n\n**Additional seats:** As stated in the pricing and payment terms in Section 4.\n\n**Agreed fees:** As stated in Section 4, including any payment schedule and implementation installments.\n\n**Invoicing:** as stated in Section 4. Payment by check or bank transfer. No payment card required.\n\n**Support:** As stated in Exhibit A.\n\n**Renewal:** {{renewalTerms}}\n\n## 2. Scope\n\n{{includedFeatures}} {{#claims}}Claims Submission Services are included under the Claims Addendum. {{/claims}}{{#minnesotaEvv}}Minnesota electronic visit verification is included under Exhibit B. {{/minnesotaEvv}}Features, workflows, and their availability may change during the Initial Term.\n\nMatching, readiness checks, claim previews, denial explanations, and similar features are assistive tools only. They are not clinical, supervisory, coding, billing, reimbursement, or legal advice, and Customer remains solely responsible for every assignment, relationship, record, and claim it approves.\n\nThe subscription does not include custom development, custom branding, integration or data migration work, appeal or denial work performed by Smores Health personnel, or any other service performed on Customer's behalf beyond Exhibit A, unless the Parties agree in a signed writing.\n\n## 3. Regulatory and Workflow Configuration\n\n**Customer Responsibilities Addendum incorporated:** Yes.\n\n**Health-data configuration:** {{dataRole}}. {{healthDataSummary}}\n\n{{#claims}}**Claims submission included:** Activated Payer by Payer after required enrollment, configuration, and readiness checks.{{/claims}}\n\n{{#minnesotaEvv}}**Minnesota EVV configuration included:** Transmission is not currently enabled and will begin only after certification and readiness requirements are satisfied.{{/minnesotaEvv}}\n\n**Approved operating states:** {{operatingStates}}.\n\n**Regulated workflows:** Video visits (telehealth), records for participants ages 13 to 17 kept by Customer's staff, claims submission{{#minnesotaEvv}}, electronic visit verification{{/minnesotaEvv}}, and any similar regulated workflow are available only when turned on in Customer's configuration, and only after everything that workflow requires is in place, such as signed agreements, required consents, and setup checks. Video visits are turned on once Customer confirms its provider-side requirements under Section 7 of the Customer Responsibilities Addendum and Smores Health completes its setup checks. Records for participants ages 13 to 17 are turned on once Customer confirms in writing, which may be by email during onboarding, that it has completed the review Section 8 of that Addendum requires. Customer will not take a participant under 18 through the participant billing permission{{#minnesotaEvv}} or EVV consent{{/minnesotaEvv}} workflows. A workflow that Customer's configuration or applicable law does not permit cannot be used or billed through the Services.\n\nNo regulated workflow goes live until the signing packet is fully executed, Customer has delivered any notices, consents, or other materials Smores Health reasonably requests to confirm lawful configuration, and Smores Health has completed its configuration and readiness checks. Any use outside the approved workflow scope, legal configuration, or Customer's identified legal role is a material breach of this Order Form and the MSA.\n\n## 4. Fees and Payment\n\n4.1 **Subscription pricing and payment.**\n\n{{pricingTerms}}\n\n4.2 **Implementation fee and payment milestones.**\n\n{{implementationFeeTerms}}\n\n4.3 **Additional seats.** {{additionalSeatTerms}}\n\n{{#claims}}4.4 **Claims Submission fee.** {{claimsPricingTerms}} The definition and counting of a Submitted Claim are governed by Section 7 of the Claims Addendum. No fee is calculated as a percentage of Medicaid reimbursement.{{/claims}}\n\n4.5 **No other Smores Health fees.** During the Initial Term, Smores Health charges no per-participant fee, data or storage fee, support fee, or clearinghouse pass-through{{#minnesotaEvv}}, and no EVV configuration or transmission fee,{{/minnesotaEvv}} beyond the fees in this Section. Any fee that a payer, the state,{{#minnesotaEvv}} its data aggregator,{{/minnesotaEvv}} or another third party charges Customer directly is Customer's responsibility.\n\n4.6 **Invoices and payment.** {{invoiceTerms}}\n\n4.7 **No refunds.** Fees are non-cancelable and non-refundable.\n\n4.8 **Order of precedence for fees.** This Section 4 controls over Section 7(B) of the MSA for the fees stated in this Order Form.\n\n## 5. Customer Acknowledgments\n\nCustomer acknowledges and agrees that:\n\n- Smores Health is not the treating provider, medical practice, Part 2 program, billing provider, or payer{{#claims}}, and acts as Customer's limited billing agent only as stated in the Claims Addendum{{/claims}};\n- Customer remains responsible for notices, consents, telehealth informed consent, licensure, state-law compliance, rights requests, retention instructions, and legal-process decisions as allocated in the Customer Responsibilities Addendum;\n- Claims submission{{#minnesotaEvv}} and electronic visit verification{{/minnesotaEvv}} remain subject to the applicable permission, enrollment, certification, and readiness conditions;\n- Smores Health's public platform documents do not replace Customer's provider-side notice and consent stack;\n- Smores Health does not monitor all activity within the Services and has no obligation to detect or prevent misconduct or non-compliance, and Customer is solely responsible for supervising its users; and\n- Customer is solely responsible for identifying information subject to 42 CFR Part 2 or other heightened confidentiality laws and for the restrictions that apply to it.\n\n## 6. Special Terms\n\n**1. Implementation, training, and support.** Smores Health will provide the services and payment milestones described

23in Section 4.2 and Exhibit A. {{#minnesotaEvv}}The Minnesota EVV configuration terms in Exhibit B also apply.{{/minnesotaEvv}}\n\n{{#priorPilot}}**2. Continuity from the pilot.** Customer's existing workspace will transition from the pilot into the Initial Term without requiring migration to or creation of a new workspace, subject to the availability, maintenance, suspension, and other terms of the MSA. Section 1(G) of the MSA governs the transition from the pilot-period agreements.{{/priorPilot}}\n\n**3. Seats.** A **Standard Staff Seat** is a named login for a staff member who delivers, documents, or messages about services. An **Administrator Seat** is a named login with organization administration, supervision, reporting, or claim approval rights.\n\n{{#claims}}**4. Claims submission.** Smores Health will activate Claims Submission Services for Customer Payer by Payer as described in the Claims Addendum and will notify Customer as each Payer goes live. Payer enrollment timing is controlled by the Payers, and Smores Health makes no commitment as to the date on which any Payer will be activated. Customer may continue to use its current billing system for services not yet live in the Services, as described in the Claims Addendum. Programs and services beyond those initially configured may be added by written agreement (email is sufficient), with Customer responsible for their codes, rates, authorizations, and payer requirements.{{/claims}}\n\n**5. Access to Customer's other systems.** Customer may give Smores Health personnel access to Customer's other systems and payer portals to support the transition, at Customer's direction and under Customer's control. Customer is responsible for confirming that such access is permitted under Customer's agreements with those vendors. Smores Health will use such access only for tasks Customer requests and will treat information obtained through it as Customer Data. Where a system supports individual user accounts, Customer will issue Smores Health personnel their own credentials, and Smores Health personnel will not use credentials issued to Customer personnel. Migration of historical records is not included unless the Parties agree in writing.\n\n**6. Activation.** {{#claims}}Claims submission and coverage checks are activated payer by payer after the applicable readiness checks. {{/claims}}{{#minnesotaEvv}}Minnesota EVV transmission is not available until its certification and readiness checks are complete. {{/minnesotaEvv}}An agreement or payment does not by itself activate a regulated workflow.\n\n**7. Publicity.** Neither Party will use the other Party's name or logo in public marketing materials, press releases, or customer lists without the other Party's prior written consent.\n\n**8. Renewal and end of term.** {{renewalTerms}} On expiration without renewal, Customer Data is available for export as described in the MSA and DPA. {{#claims}}Section 10(B) of the Claims Addendum governs claims in flight.{{/claims}}\n\n**9. Data rights and research.** Section 9(E) of the MSA {{#healthData}}and Section 3(H) of the BAA/QSOA{{/healthData}} authorize Smores Health to create and use De-identified Data, including for research, benchmarking, and model development, and apply to all Customer Data under this Order Form {{#minnesotaEvv}}other than the electronic visit verification records excluded by Section 9(E) of the MSA{{/minnesotaEvv}}. Customer agrees to consider in good faith invitations to participate in Smores Health research and evaluation studies. Any use of identifiable Customer Data for research beyond Section 9(E) of the MSA requires a separate written agreement and a lawful basis.\n\n**10. Entire commercial terms.** This Order Form, including its applicable exhibits, {{#claims}}together with the Claims Addendum, {{/claims}}states the commercial terms for the Initial Term. Except as expressly permitted by the Parties' agreed terms, a change to fees, term, or scope requires a written amendment or new Order Form signed by both Parties.\n\n{{specialTerms}}\n\n## Exhibit A. Implementation, Training, and Support\n\n{{implementationTerms}}\n\n**Support.** {{supportTerms}}\n\n{{#minnesotaEvv}}## Exhibit B. Minnesota Electronic Visit Verification\n\n**B.1 Backgroun

23d.** Minnesota Statutes section 256B.073, as amended in 2026, includes recovery peer support within the statutory electronic visit verification (**EVV**) framework. January 1, 2027, or federal approval if later, is the statutory floor for third-party-system responsibilities under subdivision 7; it is not a confirmed H0038 operational date. Operational activation under this Order Form remains subject to DHS implementation schedules, waivers, service-code and technical guidance, Aggregator acceptance, and any required federal approval. A provider may use a third-party EVV system only if it meets the requirements of the Minnesota Department of Human Services (**DHS**) and transmits data to the state's designated data aggregator (the **Aggregator**).\n\n**B.2 Included configuration.** As part of the implementation services in this Order Form, Smores Health will configure EVV capture in the Services for Customer's approved EVV services, workers, participants, and workflows, using the identifiers and information Customer supplies, and will provide EVV training materials.\n\n**B.3 Status and path to go-live.** EVV transmission from the Services to the Aggregator is not yet available. {{evvStatus}} Smores Health will work with Customer and the Aggregator in good faith, using commercially reasonable efforts, toward certification and go-live. Certification timing is controlled by the Aggregator and DHS, not by Smores Health. Smores Health does not warrant that transmission will be available by any date, that DHS or the Aggregator will accept any visit, or that Customer will meet any compliance threshold. Customer acknowledges that the state-provided EVV system is available to it at no cost under section 256B.073, and if transmission through the Services is not available when Customer needs it, Customer may use the state-provided system for the interim and Smores Health will make Customer's captured visit data available in a reasonable format. Fees under this Order Form are not reduced, deferred, or refunded on account of EVV timing.\n\n**B.4 Customer responsibilities.** Customer will complete its own enrollment and setup steps with DHS and the Aggregator; supply and keep current the worker, participant, payer, and provider identifiers the Aggregator requires; ensure its workers capture visits at the time of service and use the required codes for edited and missed visits; review and correct data in the Aggregator as DHS requires; obtain each participant's written consent to the disclosure of visit, identity, service, and location data to the Aggregator and DHS through the consent workflow in the Services; determine which of its services are subject to EVV; and comply with any requirement that a provider use one EVV system for all of its EVV-subject services. Customer remains responsible for EVV compliance as the provider, as section 256B.073 provides.\n\n**B.5 Smores Health responsibilities.** Smores Health will comply with the third-party vendor duties in section 256B.073, subdivision 7, as and when they become effective. Customer authorizes Smores Health to communicate with DHS and the Aggregator about Customer's EVV configuration and transmissions and to respond to their requests concerning transmissions made for Customer, and Smores Health will use reasonable efforts to notify Customer of any such request, unless prohibited by law.\n\n**B.6 Location data and consent.** EVV requires capture of the service location, including device location at the start and end of a visit, and transmission of participant, worker, service, date, time, and location data to the Aggregator and DHS. For participants in a program subject to 42 CFR Part 2, these transmissions require the participant's written consent, and the Services will not transmit visits for a participant whose consent is missing, expired, or revoked. For EVV, device location is captured only at the start and end of a visit. Location recorded by the mileage and trip features, where Customer enables them, is separate from EVV, is captured during an active trip, and is Customer Data under the Data Processing Agreement and Security Exhibit.\n\n**B.7 Records.** During the Initial Term, Smores Health retains EVV records in the Services and makes them available to Customer for export. Customer is responsible for exporting and retaining the EVV records it must keep under DHS requirements.\n\n**B.8 Responsibility.** Smores Health is not responsible for actions of DHS or the Aggregator, for claim denials or recoupments arising from visits that were not captured, were captured late, or were edited

23without the required codes, for any determination that Customer must use the state-provided system, or for any compliance rate, sanction, or penalty imposed on Customer. Where a transmission failure is caused by Smores Health, Smores Health will correct and retransmit the affected visits, which, subject to Section 14 of the MSA, is Customer's exclusive remedy for that failure.\n\n{{/minnesotaEvv}}\n\n## Execution\n\nThis Order Form is executed by the signatures on the Signing Page at the end of this packet, which apply to each agreement listed there.\n"},subscription_order_form:{sourcePath:"docs/legal/contracts/company-packet/03-subscription-order-form.md",sha256:"07242c31f9975fac91d2ac6400eae86da863b1764151bd9bb5eb5156ebead8e8",markdown:"# Subscription Order Form\n\nThis Subscription Order Form is between **Smores Health, Inc.** and **{{customerLegalName}}** (Customer), under the Master Services Agreement (MSA) signed with this packet. It becomes effective as specified in the MSA. This Order Form controls commercial terms including plan, seats, fees, payment dates, and subscription term where they conflict with the MSA. The signed data and customer-responsibility agreements retain their stated precedence.{{#claims}} The Claims Submission Addendum of even date (the Claims Addendum) governs the claims submission services purchased under this Order Form.{{/claims}}\n\n## 1. Customer and Plan\n\n**Plan:** {{planName}}.\n\n**Customer notice address:** {{noticeAddress}}.\n\n**Customer coordination contact:** {{noticeContactName}}, {{noticeEmail}}.\n\n**Included Seats:** The {{planName}} plan includes {{seatsPhrase}}.\n\n**Participant accounts:** Participant accounts are unlimited, do not count toward staff seats, and carry no per-participant charge.{{participantAccountsNote}}\n\n**Launch Date:** {{launchDateTerms}}\n\n{{initialTermEndTerms}}\n\n## 2. Term and Launch\n\n{{termCommitmentParagraph}}\n\n**Signing and launch are different dates.** The MSA and this Order Form take effect when signed as specified in the MSA. {{dueAtSigningSentence}} Subscription charges and the {{subscriptionClock}} begin on the agreed Launch Date. No subscription charge accrues for a period before that date.\n\n**Launch coordination.** Customer and Smores Health will work together to complete onboarding for the agreed Launch Date. Any change to that date requires both Parties' written agreement; email is sufficient. The Launch Date cannot precede the Effective Date. If signing is completed after the proposed Launch Date, the Parties must agree on a later date. A delay does not by itself set a Launch Date or start subscription billing.\n\n{{invoicingParagraph}}\n\n**Payment flexibility.** Customer and Smores Health may agree in writing to a different payment schedule. All other terms remain unchanged. A change to the agreed price, commitment, or scope requires a written agreement signed by both Parties.\n\n\x3c!-- pagebreak --\x3e\n\n## 3. Subscription and Seat Charges\n\n| Subscription item | Monthly rate | Total for the original {{seatsPhrase}} |\n| --- | --- | --- |\n{{pricingRows}}\n\n{{feeSummaryParagraph}}\n\n**Original seats.** {{originalSeatsSentence}} Customer may change which staff members use its seats without an additional seat charge. Each seat remains a named login for one person and may not be shared.\n\n**Additional seats.** {{additionalSeatRateSentence}} Charges are prorated from activation through the end of the billing month. The prorated charge is the monthly per-seat rate multiplied by the number of calendar days from activation through the end of that Subscription Month, divided by the total calendar days in that Subscription Month, rounded to the nearest cent. Added seats are billed at the full monthly rate in subsequent Subscription Months while active.{{#billingUpgradeOffered}} If Customer signs a billing-plan upgrade under Section 8, its upgraded per-seat rate applies to added seats from the upgrade's effective date.{{/billingUpgradeOffered}}\n\n**Removing added seats.** An authorized administrator may remove an additional seat effective at the end of a billing month, with no charge for that seat in the following month and no credit for unused days in the current month. This does not reduce the original {{seat

23CommitmentPhrase}} commitment. {{addedSeatTermSentence}} Seat additions and removals under this Section do not require a separate email, signed Order Form, or amendment.\n\n## 4. Implementation and Other Charges\n\n{{implementationFeeParagraph}}\n\n{{#minnesotaEvv}}{{evvFeeParagraph}}\n\n{{/minnesotaEvv}}{{#billingPlan}}{{claimsFeeParagraph}}\n\n{{noOtherFeesSentence}} {{/billingPlan}}Applicable taxes, and any fees a {{#billingPlan}}payer, the state,{{#minnesotaEvv}} its data aggregator,{{/minnesotaEvv}} or other {{/billingPlan}}third party charges Customer directly, remain Customer's responsibility under the MSA. There is no charge for additional work unless agreed in writing as required by the MSA.\n\n## 5. Scope and Configuration\n\n{{includedFeatures}}\n\n{{#claims}}**Claims submission included:** Activated payer by payer after the required enrollment, configuration, and readiness checks under the Claims Addendum.\n\n{{/claims}}{{#minnesotaEvv}}**Minnesota EVV configuration included:** Transmission is not currently enabled and will begin only after the certification and readiness requirements in Exhibit B are satisfied.\n\n{{/minnesotaEvv}}**Feature requests:** We welcome feature requests and may incorporate them into future platform improvements. Specific features or delivery dates are committed only when separately agreed in writing. The committed implementation services are stated in Exhibit A.\n\n**Operating states:** {{operatingStates}}.\n\n**Data handling and onboarding:** Customer will provide accurate onboarding information about its services and the records to be imported or processed, and obtain any permissions or consents required for Customer to provide those records to Smores Health. Each Party remains responsible for its obligations under the applicable data agreements and law. Regulated-data processing will not begin until the applicable agreements, permissions, notices, consents, configuration, and readiness steps are complete.{{#healthData}} The BAA/QSOA applies to the extent of the relationships and records it describes.{{/healthData}}\n\n**Regulated workflows.** Video visits (telehealth), records for participants ages 13 to 17 kept by Customer's staff, claims submission{{#minnesotaEvv}}, electronic visit verification{{/minnesotaEvv}}, and any similar regulated workflow are available only when turned on in Customer's configuration, and only after everything that workflow requires is in place, such as signed agreements, required consents, and setup checks. Video visits are turned on once Customer confirms its provider-side requirements under Section 7 of the Customer Responsibilities Addendum and Smores Health completes its setup checks. Records for participants ages 13 to 17 are turned on once Customer confirms in writing, which may be by email during onboarding, that it has completed the review Section 8 of that Addendum requires.{{#billingPlan}} Customer will not take a participant under 18 through the participant billing permission{{#minnesotaEvv}} or EVV consent{{/minnesotaEvv}} workflows.{{/billingPlan}} {{#billingUpgradeOffered}}Claims submission requires the plan upgrade in Section 8 and an executed Claims Addendum. {{/billingUpgradeOffered}}{{#claims}}Claims submission activates payer by payer under the Claims Addendum. {{/claims}}A workflow that Customer's configuration or applicable law does not permit cannot be used or billed through the Services.\n\n**Reports and included configuration:** Customer may export and share its authorized reports for its own grant, funder, board, and program reporting, subject to the confidentiality, consent, and regulated-data requirements in the signed agreements. This permitted reporting use clarifies the scope of use under the MSA and does not allow development of a competing product. Included reports use supported metrics and available records captured in or imported into the Services. Customer is responsible for reviewing its reports and confirming that they meet its funder or program requirements before submitting them. Reasonable configuration within existing platform capabilities{{#dataTransfer}}

23 and the data transfer described in Exhibit A are{{/dataTransfer}}{{#noDataTransfer}} is{{/noDataTransfer}} included in implementation. New development, integrations, {{#dataTransfer}}additional {{/dataTransfer}}historical-data migration, and other work outside Exhibit A require a separate written agreement stating the scope, price, and schedule before that work begins. No grant award, funder approval, or acceptance of a report is guaranteed.\n\n## 6. Renewal and End of Term\n\n{{renewalParagraph}}\n\nOn expiration or cancellation, access ends and Customer Data is available for export under the MSA and DPA.\n\n## 7. Other Agreed Terms\n\nNeither Party may use the other's name or logo in public marketing without prior written consent. Customer may authorize limited access to its other systems for agreed setup tasks, subject to its vendor agreements and individual credentials where supported. Smores Health will treat information obtained through that access as Customer Data.\n\nThe MSA, Customer Responsibilities Addendum,{{#healthData}} BAA/QSOA,{{/healthData}} and DPA remain in effect, including their data rights, permitted de-identification, confidentiality, security, customer responsibilities, limitations, and termination provisions. AI-assisted outputs and reporting tools support Customer's work; Customer remains responsible for reviewing them and making its own decisions.\n\n{{#billingPlan}}**Billing acknowledgments.** Smores Health is not the treating provider, medical practice, Part 2 program, billing provider, or payer, and acts as Customer's limited billing agent only as stated in the Claims Addendum. Claims submission{{#minnesotaEvv}} and electronic visit verification{{/minnesotaEvv}} remain subject to the applicable permission, enrollment, certification, and readiness conditions. Smores Health will activate Claims Submission Services payer by payer as described in the Claims Addendum and will notify Customer as each payer goes live; payer enrollment timing is controlled by the payers, and Smores Health makes no commitment as to the date on which any payer will be activated. Customer may continue to use its current billing system for services not yet live in the Services. An agreement or payment does not by itself activate a regulated workflow. Section 10(B) of the Claims Addendum governs claims in flight at the end of the term.\n\n{{/billingPlan}}**Data rights and research.** Section 9(E) of the MSA{{#healthData}} and Section 3(H) of the BAA/QSOA{{/healthData}} authorize Smores Health to create and use De-identified Data, including for research, benchmarking, and model development{{#minnesotaEvv}}, other than the electronic visit verification records excluded by Section 9(E) of the MSA{{/minnesotaEvv}}. Customer agrees to consider in good faith invitations to participate in Smores Health research and evaluation studies. Any use of identifiable Customer Data for research beyond Section 9(E) of the MSA requires a separate written agreement and a lawful basis.\n\nThis Order Form and its Exhibit A state the commercial terms and implementation scope. By signing this Order Form, the Parties accept its terms and included services. If an earlier proposal or discussion differs from this signed agreement, the signed agreement controls. A proposal, demonstration, email, or discussion does not add a deliverable or guaranteed completion date unless expressly incorporated in a written agreement signed by both Parties. Routine implementation details within the agreed scope may be coordinated during onboarding without separate written confirmations. Launch-date changes and alternative payment schedules follow Section 2; seat additions and removals follow Section 3. Changes to price, commitment, scope, or other contract terms require a written amendment or new Order Form signed by both Parties.\n\n{{#billingUpgradeOffered}}## 8. Optional Future Billing Upgrade\n\nThe Community plan does not include claims submission. Customer may add it by upgrading to {{upgradeSeatRate}} per seat per month plus {{upgradeClaimRate}} per Submitted Claim. {{upgradeSeatTotalSentence}} The signed plan change will state the effective date and any prorated adjustment; it will not restart the Initial Term unless both Parties expressly agree. The upgrade takes effect with an executed Claims Addendum, which governs claims counting and activation after the applicable enrollment, consent, and readiness checks. Community pricing continues to follow Section 3 unless that upgrade is agreed. Any discount on the upgraded plan must be stated in the signed plan change. No downgrade is automatic.\n\n{{/billingUpgradeOffered}}## Exhibit A. Implementation, Training, and Support\n\n### A1. Standard Setup\n\n{{setupParagraph}}\n\n{{#dataTransfer}}### A2. Help Transferring Existing Records\n\nSmores Health will help move your existing records into the platform. During setup, we'll review your data together and explain what we can transfer.\n\nThe included transfer uses existing import methods for agreed records and supported fields. During onboarding, the Parties will coordinate the record types, date range, approximate volume, format, field mapping, and any fields that cannot be transferred. No separate written import specification is required.\n\nCustomer will provide a complete, usable export in the agreed format and confirm its authority to transfer the records. Material source-data cleanup, reconstruction of missing records, creation or recreation of signatures, unsupported data, additional exports or sources, custom import development, and integrations are outside this scope. Any such work requires a separate written scope, price, and schedule. If the export cannot be handled within the included

23scope, Smores Health will identify the limitation and discuss alternatives with Customer before additional work begins; no extra charge is automatic.\n\nSmores Health will communicate the import results and identify records or fields that were not imported during onboarding; no separate written import report is required. Customer will review the imported records and report discrepancies. Smores Health will use commercially reasonable efforts to correct errors it caused in performing the agreed import without {{#implementationFee}}an additional implementation fee{{/implementationFee}}{{#noImplementationFee}}any charge{{/noImplementationFee}}. This correction commitment does not include repairing defects in Customer's source data. Importing historical records does not recreate or certify original signatures or clinical approval.{{/dataTransfer}}\n\n### {{exhibitTimingNumber}}. Timing and Launch\n\n{{timingParagraph}}\n\n{{launchRulesSentence}} The implementation schedule does not start subscription billing or change the Launch Date automatically. {{#dataTransfer}}Before launch, the Parties will review the configured workspace, staff access, available training materials, and import status. If the Parties agree to launch before the included import is complete, they will coordinate the remaining import work during onboarding; the included import obligation remains. No review or launch confirmation waives the correction or other express rights in the signed agreements.{{/dataTransfer}}{{#noDataTransfer}}Before launch, the Parties will review the configured workspace, staff access, and available training materials. No review or launch confirmation waives the express rights in the signed agreements.{{/noDataTransfer}}\n\n### {{exhibitTrainingNumber}}. Training and Support\n\n{{trainingParagraph}}\n\n{{#implementationFee}}The **{{implementationFeeAmount}} implementation fee** in Section 4 covers this Exhibit's agreed scope; this Exhibit does not create another implementation charge.{{/implementationFee}}{{#noImplementationFee}}No implementation fee applies to this Exhibit's agreed scope, and this Exhibit does not create an implementation charge.{{/noImplementationFee}} {{trainingExclusion}} Section 5 governs feature requests. The signed data-protection agreements apply to the {{#dataTransfer}}import and {{/dataTransfer}}setup, including the required permissions and handling of regulated records.\n\n{{#minnesotaEvv}}## Exhibit B. Minnesota Electronic Visit Verification\n\n**B.1 Background.** Minnesota Statutes section 256B.073, as amended in 2026, includes recovery peer support within the statutory electronic visit verification (**EVV**) framework. January 1, 2027, or federal approval if later, is the statutory floor for third-party-system responsibilities under subdivision 7; it is not a confirmed H0038 operational date. Operational activation under this Order Form remains subject to DHS implementation schedules, waivers, service-code and technical guidance, Aggregator acceptance, and any required federal approval. A provider may use a third-party EVV system only if it meets the requirements of the Minnesota Department of Human Services (**DHS**) and transmits data to the state's designated data aggregator (the **Aggregator**).\n\n**B.2 Included configuration.** As part of the implementation services in this Order Form, Smores Health will configure EVV capture in the Services for Customer's approved EVV services, workers, participants, and workflows, using the identifiers and information Customer supplies, and will provide EVV training materials.\n\n**B.3 Status and path to go-live.** EVV transmission from the Services to the Aggregator is not yet available. {{evvStatusSentence}} Smores Health will work with Customer and the Aggregator in good faith, using commercially reasonable efforts, toward certification and go-live. Certification timing is controlled by the Aggregator and DHS, not by Smores Health. Smores Health does not warrant that transmission will be available by any date, that DHS or the Aggregator will accept any visit, or that Customer will meet any compliance threshold. Customer acknowledges that the state-provided EVV system is available to it at no cost under section 256B.073, and if transmission through the Services is not available when Customer needs it, Customer may use the state-provided system for the interim and Smores Health will make Customer's captured visit data available in a reasonable format. Fees under this Order Form are not reduced, deferred, or refunded on account of EVV timing.\n\n**B.4 Customer responsibilities.** Customer will c

23omplete its own enrollment and setup steps with DHS and the Aggregator; supply and keep current the worker, participant, payer, and provider identifiers the Aggregator requires; ensure its workers capture visits at the time of service and use the required codes for edited and missed visits; review and correct data in the Aggregator as DHS requires; obtain each participant's written consent to the disclosure of visit, identity, service, and location data to the Aggregator and DHS through the consent workflow in the Services; determine which of its services are subject to EVV; and comply with any requirement that a provider use one EVV system for all of its EVV-subject services. Customer remains responsible for EVV compliance as the provider, as section 256B.073 provides.\n\n**B.5 Smores Health responsibilities.** Smores Health will comply with the third-party vendor duties in section 256B.073, subdivision 7, as and when they become effective. Customer authorizes Smores Health to communicate with DHS and the Aggregator about Customer's EVV configuration and transmissions and to respond to their requests concerning transmissions made for Customer, and Smores Health will use reasonable efforts to notify Customer of any such request, unless prohibited by law.\n\n**B.6 Location data and consent.** EVV requires capture of the service location, including device location at the start and end of a visit, and transmission of participant, worker, service, date, time, and location data to the Aggregator and DHS. For participants in a program subject to 42 CFR Part 2, these transmissions require the participant's written consent, and the Services will not transmit visits for a participant whose consent is missing, expired, or revoked. For EVV, device location is captured only at the start and end of a visit. Location recorded by the mileage and trip features, where Customer enables them, is separate from EVV, is captured during an active trip, and is Customer Data under the Data Processing Agreement and Security Exhibit.\n\n**B.7 Records.** During the Initial Term, Smores Health retains EVV records in the Services and makes them available to Customer for export. Customer is responsible for exporting and retaining the EVV records it must keep under DHS requirements.\n\n**B.8 Responsibility.** Smores Health is not responsible for actions of DHS or the Aggregator, for claim denials or recoupments arising from visits that were not captured, were captured late, or were edited without the required codes, for any determination that Customer must use the state-provided system, or for any compliance rate, sanction, or penalty imposed on Customer. Where a transmission failure is caused by Smores Health, Smores Health will correct and retransmit the affected visits, which, subject to Section 14 of the MSA, is Customer's exclusive remedy for that failure.\n\n{{/minnesotaEvv}}\n\n## Execution\n\nThis Order Form is executed by the signatures on the Signing Page at the end of this packet, which apply to each agreement listed there.\n"},claims_submission_addendum:{sourcePath:"docs/legal/contracts/company-packet/04-claims-submission-addendum.md",sha256:"2dc60f5ecede601ca37b53d8b61d60deb29ef14cc3bb7ee785f0fdb121fc0f44",markdown:"# Claims Submission Addendum\n\nThis Claims Submission Addendum (this **Addendum**) is entered into and becomes effective on the date on which the last Party signs the Signing Page of this packet (the **Effective Date**) by and between:\n\n**Customer:** **{{customerLegalName}}**, {{entityDescription}}, with principal address at **{{noticeAddress}}** (the **Customer**)\n\nand\n\n**Smores Health, Inc.**, a Delaware corporation, with principal address at **584 Castro Street, Suite 4102, San Francisco, CA 94114** (**Smores Health**).\n\nCustomer and Smores Health are each a **Party** and together are the **Parties**.\n\n## 1. Incorporation; Purpose\n\nA. This Addendum is incorporated into and made part of the Master Services Agreement between the Parties of even date (the **Services Agreement**) and applies to the Services purchased under the Subscription Order Form of even date (the **Order Form**). Except as expressly modified in this Addendum, the Services Agreement remains unchanged.\n\nB. The purpose of this Addendum is to authorize Smores Health to prepare and submit health care claims to Payers as Customer's billing agent, to allocate the responsibilities that come with that role, and to state the limits of that role.\n\nC. This Addendum works alongside the Business Associate Agreement and Qualified Service Organization Agreement between the Parties of even date (the **BAA/QSOA**) and the Customer Responsibilities Addendum of even date. Nothing in this Addendum reduces any obligation imposed by HIPAA, 42 CFR Part 2, the federal False Claims Act or applicable state false-claims law, other applicable law, payer rules, or the BAA/QSOA.\n\n## 2. Definitions\n\nA. **Claim** means an electronic health care claim, and any correction, replacement, or cancellation of such a claim, prepared from Customer's records in the Services for submission to a Payer.\n\nB. **Payer** means a health plan, state Medicaid agency, Medicaid managed care organization, or other third-party payer to which a Claim is submitted.\n\nC. **Clearinghouse** means the health care clearinghouse Smores Health uses to transmit Claims and receive Payer responses, acting as Smores Health's subcontractor under the BAA/QSOA. Smores Health may change the Clearinghouse.\n\nD. **Approved Claim** means a Claim whose exact contents an authorized Customer administrator has reviewed and approved in the Services. Approval of a Claim is Customer's authorization and direction to submit that exact Claim.\n\nE. **Remittance Advice** means the electronic remittance advice and related claim status responses a Payer issues. Payer remittance routing operates at the level of Customer's Payer enrollment for a provider identifier, so Remittance Advice delivered under that enrollment may concern any claim of Customer's under that enrollment, including claims Customer submitted outside the Services.\n\nF. **Eligibility Inquiry** means an electronic coverage or eligibility inquiry sent to a Payer about an individual, and the Payer's response.\n\nG. **Submitted Claim** means each transmission of an Approved Claim to a Payer through the Clearinghouse, counted as stated in Section 7.\n\nH. **Claims Submission Services** means the services described

23in Section 3.\n\n## 3. Appointment And Scope Of Services\n\nA. Customer appoints Smores Health as its non-exclusive billing agent, and Smores Health accepts the appointment, solely to perform the following on Customer's behalf and at Customer's direction: prepare draft Claims from records Customer creates in the Services; submit Approved Claims to Payers through the Clearinghouse; receive and record Payer acknowledgments, claim status responses, and Remittance Advice; present Payer responses to Customer in the Services; upon Customer's approval in each instance, submit corrections, replacements, or cancellations of previously submitted Claims; and, where Customer has enabled coverage checks in the Services, submit Eligibility Inquiries for individuals whose recorded permission covers them and present the responses to Customer.\n\nB. The appointment in this Section is a limited agency for claim preparation and transmission only. It does not authorize Smores Health to bind Customer to any Payer contract, to negotiate with any Payer, to alter Customer's Payer enrollments except as Customer directs under Section 5(G), or to act for Customer in any matter not described in Section 3(A).\n\nC. Smores Health will submit no Claim, and no correction, replacement, or cancellation of a Claim, that is not an Approved Claim. Nothing is submitted or resubmitted without a Customer administrator's approval of the exact contents submitted.\n\nD. **Activation by Payer.** Smores Health will activate Claims Submission Services for each Payer when the Payer enrollments, notices, approver designation, billing information, and readiness checks that Smores Health requires for that Payer are complete, and will notify Customer when each Payer is live. Payer enrollment timing is controlled by the Payers, and Smores Health makes no commitment as to the date on which any Payer will be activated.\n\nE. **Transition.** Customer may continue to submit claims through its current billing system for services and programs that are not yet live in the Services, and Customer decides when to stop using that system for each program. Customer will not submit the same service to a Payer through both the Services and another system. Smores Health has no responsibility for claims submitted outside the Services except as stated in Section 4(D).\n\n## 4. Customer Remains The Provider; Payment Flows\n\nA. Customer is and remains the enrolled, billing, and rendering provider of record for every Claim. Every Claim is submitted under Customer's name, National Provider Identifier, taxonomy, and Payer enrollments. This Addendum does not make Smores Health a provider, supplier, Payer, or party to any Payer agreement.\n\nB. All Payer payments for Claims are made directly by the Payer to Customer under Customer's existing payment arrangements, consistent with 42 CFR 447.10. Smores Health does not receive, hold, endorse, deposit, or direct any Payer payment or participant funds, and nothing in this Addendum assigns or reassigns any Customer receivable to Smores Health.\n\nC. Customer authorizes delivery of Remittance Advice and claim status information to Smores Health through the Clearinghouse so the Services can record claim outcomes. This routing concerns information only and does not change where money is paid. Customer will cooperate in the Payer steps needed to establish this routing, and Smores Health will reasonably cooperate in re-routing Remittance Advice to Customer or its designee on termination.\n\nD. Because remittance routing operates at the enrollment level, Customer acknowledges and authorizes that the Remittance Advice Smores Health receives may include remittance information for claims Customer submitted outside the Services. Smores Health will make such remittance information available to Customer, will use it solely to deliver it to Customer and to provide the Services, and will treat it as regulated data under the BAA/QSOA. Smores Health has no responsibility for posting, reconciling, appealing, or otherwise acting on remittance information for claims submitted outside the Services.\n\n## 5. Customer Responsibilities\n\nCustomer represents, warrants, and covenants on an ongoing basis that:\n\nA. Customer is solely responsible for the truthfulness, accuracy, completeness, and program appropriateness of the services, documentation, diagnoses, times, and other facts underlying each Claim, and for approving only Claims that Customer is legally entitled to submit.\n\nB. Customer holds and will maintain all licenses, certifications, Payer enrollments, and program approvals required to furnish and bill the services on its Claims, and will keep the organizational information used on Claims accurate in the Services and notify Smores Health promptly of any change.\n\nC. Before directing submission of any Claim or Eligibility Inquiry that disclose

23s information protected by 42 CFR Part 2, Customer will ensure a valid written consent meeting 42 CFR 2.31 covering disclosure to the Payer, Smores Health, and the Clearinghouse is in effect for the individual, including the eligibility purpose where coverage checks are enabled. Smores Health may decline any submission where the recorded consent is missing, expired, or revoked.\n\nD. Customer is responsible for its relationships with Payers, including enrollment, credentialing, revalidation, prior authorization, and responding to Payer audits, overpayment demands, and recoupments, and will notify Smores Health promptly of any Payer or regulator inquiry concerning Claims submitted under this Addendum.\n\nE. Customer will designate and maintain at least one administrator, who is a member of Customer's own workforce, authorized to approve Claims, and will ensure approvals are given only by personnel with authority and knowledge to do so. Customer may change its approvers by written notice to Smores Health.\n\nF. Customer authorizes Smores Health to deliver, in Customer's name and on Customer's behalf, the notice required by 42 CFR 2.32 and any related statement of consent scope to the Clearinghouse and to each Payer, in the manner Smores Health reasonably determines, including standing written notices and notes within Claims. Customer will provide, on request, a copy of the signed consent behind any transaction.\n\nG. Customer authorizes Smores Health to enroll Customer as a provider with the Clearinghouse under Smores Health's account and to prepare and submit Payer transaction enrollments on Customer's behalf. Customer will complete, with Smores Health's guidance, the Payer enrollment and affiliation steps that only the provider can complete, will sign any enrollment authorization a Payer or the Clearinghouse requires, will keep its own applicable Medicaid or other Payer enrollment and portal access active, and authorizes Smores Health to communicate with Payers and the Clearinghouse on Customer's behalf for enrollment, routing, and notice purposes.\n\nH. Customer will not direct submission of a Claim for a participant under 18 years of age, or for any individual who cannot sign the participant billing permission personally, unless the Parties have agreed in writing on a representative-consent process for that individual.\n\nI. Customer is responsible for reviewing Payer responses in the Services, for approving Claims in time to meet each Payer's filing deadlines, and for deciding whether to correct, resubmit, appeal, or write off any Claim. Smores Health will transmit Approved Claims promptly and is not responsible for a timely-filing denial except where caused by its failure to transmit an Approved Claim within ten business days after approval.\n\nJ. Neither Customer nor, to Customer's knowledge, any individual who furnishes, supervises, or documents a service on a Claim is excluded, debarred, or suspended from any federal or state health care program or is the subject of a pending exclusion action, government investigation, subpoena, or audit concerning health care billing. Customer will screen those individuals against the HHS OIG List of Excluded Individuals and Entities before activation and at least monthly thereafter, will not direct submission of a Claim for a service furnished, supervised, or documented by an excluded individual, and will notify Smores Health in writing within five business days after learning of any exclusion, investigation, subpoena, or audit described in this paragraph.\n\n## 6. Smores Health Responsibilities\n\nSmores Health will: transmit each Approved Claim so that the Claim transmitted matches the contents the Customer administrator approved; record the Payer responses it receives for submitted Claims and present them to Customer in the Services; maintain records of submissions, approvals, and Payer responses during the term of the Services Agreement and make them available to Customer for export; safeguard Claim information as regulated data under the BAA/QSOA; maintain any registration or license legally required of Smores Health in its role under this Addendum; and bind the Clearinghouse in writing as required by the BAA/QSOA and 42 CFR Part 2.\n\n## 7. Fees\n\nA. **Claims pricing and payment.** {{claimsPricingTerms}}\n\nB. Each transmission of an Approved Claim to a Payer through the Clearinghouse counts as one Submitted Claim, including each corrected claim, replacement claim, and cancellation that Customer approves. No fee is charged for a retransmission required solely to correct a transmission or formatting defect attributable to Smores Health or the Clearinghouse.\n\nC. No fee under this Addendum is calculated as a percentage of, or is otherwise contingent on, any amount billed, allowed, collected, or paid on any Claim. Fees are payable regardless of whether a Claim is accepted, paid, denied, or adjusted, consistent with 42 CFR 447.10 and applicable state requirements for billing intermediary compensation.\n\nD. Claims invoicing, payment dates, and included Clearinghouse costs are as stated in Section 7(A) and the Order Form.\n\nE. If Customer enables coverage checks, Eligibility Inquiries are included at no additional charge during the Initial Term, subject to reasonable usage limits Smores Health may set and communicate in writing.\n\n## 8. No Guarantee Of Payment; Responsibility For Claims\n\nA. Payers adjudicate Claims. Smores Health does not represent, warrant, or guarantee that any Claim will be accepted, paid, paid at any particular amount, or paid within any particular time, and does not provide coding, billing, legal, or reimbursement advice. Information the Services present about Payer responses restates what the Payer communicated.\n\nB. Customer remains responsible for reviewing claim outcomes and deciding whether and how to correct, resubmit, appeal, or write off any Claim.\n\n{{#minnesotaEvv}}C. Once Minnesota requires electronic visit verification for a service, a Payer may deny or recoup a Claim for that service if the required visit data was not transmitted or does not match the Claim. Smores Health is not responsible for any such denial or recoupment. Where a transmission failure is caused by Smores Health, Customer's exclusive remedy is correction and retransmission of the affected visits as stated in Section B.8 of Exhibit B to the Order Form, subject to Section 14 of the Services Agreement.{{/minnesotaEvv}}\n\nD. Customer will defend and indemnify Smores Health and its officers, directors, employees, and contractors against any third-party claim, Payer or government action, audit finding, overpayment demand, recoupment, penalty, or investigation cost arising from the contents of any Claim or Eligibility Inquiry, the services or documentation underlying it, Customer's billing practices, or Customer's approval of a Claim it was not entitled to submit, except to the extent caused by Smores Health's failure to transmit an Approved Claim as approved. Section 13(B) of the Services Agreement applies to this indemnity. Smores Health's responsibility for a Claim that was not transmitted as approved is to correct and retransmit it as Customer approves, subject to Section 14 of the Services Agreement.\n\n## 9. Suspension\n\nSmores Health may decline or suspend submission of any Claim, or of Claims generally, where required consent or notice conditions are not met, where a Payer or regulator so directs, where the Services Agreement permits suspension, including for non-payment, or where Smores Health reasonably believes submission would violate applicable law. Smores Health will notify Customer of any such suspension and the reason.\n\n## 10. Term; Effect Of Termination\n\nA. This Addendum takes effect on the Effective Date and continues until the Services Agreement or the Order Form expires or is terminated, unless earlier terminated in accordance with the Services Agreement. Smores Health may terminate this Addendum alone, without terminating the Services Agreement, on 30 days' written notice, in which case the Claims Submission fee ceases for Claims approved after the effective date of termination and the Order Form otherwise continues.\n\nB. On termination or expiration of this Addendum: Smores Health will submit no further Claims; Smores Health will reasonably cooperate with Customer to re-route Remittance Advice to Customer or its designee; Remittance Advice received before re-routing takes effect will be made available to Customer under Section 4(D); and Customer may export its Claim records in accordance with the Services Agreement.\n\nC. Sections 4(B), 4(D), 5, 7, 8, and 10, and any provision that by its nature should survive, survive termination.\n\n## 11. Order Form Details\n\n**Claims Submission Services included:** Activated payer by payer under Section 3(D); not available for production use until activation and readiness checks are complete.\n\n**Payers in scope:** the payers Customer confirms and Smores Health accepts in writing, each activated separately under Section 3(D), as supp

23orted by the Clearinghouse.\n\n**Programs and services in scope:** those configured in the Services for each activated Payer.\n\n**States in scope:** {{operatingStates}}.\n\n**Flat periodic fee and payment timing:** As stated in Section 7(A).\n\n**Claims pricing:** As stated in Section 7(A).\n\n**Remittance Advice routing:** Clearinghouse routing per Sections 4(C) and 4(D).\n\n**Coverage checks enabled:** No, unless Customer enables them in the Services with the participant permission recorded there.\n\n**Customer claim approvers:** designated by Customer in writing before activation and changed by written notice under Section 5(E).\n\n**Customer billing contact for claims-related notices:** designated by Customer in writing before activation.\n\n## Execution\n\nThis Addendum is executed by the signatures on the Signing Page at the end of this packet, which apply to each agreement listed there.\n"},baa_qsoa:{sourcePath:"docs/legal/contracts/company-packet/05-business-associate-and-qsoa.md",sha256:"7997463be88a58312c6e9b1352695c68f5401457ad90d01af7f6753b1ef56c45",markdown:"# Business Associate Agreement and Qualified Service Organization Agreement\n\nThis Business Associate Agreement and Qualified Service Organization Agreement (this **BAA/QSOA**) is entered into and becomes effective on the date on which the last Party signs the Signing Page of this packet (the **Effective Date**) by and between:\n\n**Customer:** **{{customerLegalName}}**, {{entityDescription}}, with principal address at **{{noticeAddress}}** (the **Customer**)\n\nand\n\n**Smores Health, Inc.**, a Delaware corporation, with principal address at **584 Castro Street, Suite 4102, San Francisco, CA 94114** (**Business Associate**).\n\nCustomer and Business Associate are each a **Party** and together are the **Parties**.\n\nThis BAA/QSOA is incorporated into the Master Services Agreement between the Parties of even date and applies to the Services provided under the Subscription Order Form{{#claims}} and the Claims Submission Addendum of even date{{/claims}}. This BAA/QSOA is coterminous with the Master Services Agreement, whose Initial Order Form states the Initial Term unless earlier terminated as provided in the Master Services Agreement or in this BAA/QSOA, subject in all cases to the term, survival, return, and destruction provisions of Section 12 of this BAA/QSOA. Customer will provide accurate onboarding information about its services and the records to be imported or processed, and obtain any permissions or consents required for Customer to provide those records to Smores Health. Each Party remains responsible for its obligations under the applicable data agreements and law. Regulated-data processing will not begin until the applicable agreements, permissions, notices, consents, configuration, and readiness steps are complete. {{#dataRoleStated}}Customer has disclosed the following legal and data-processing role: {{dataRole}}. {{/dataRoleStated}}The applicable HIPAA and Part 2 relationships are described in Section 1. As of the Effective Date, this BAA/QSOA replaces any prior business associate agreement or qualified service organization agreement between the Parties for the Services and applies to all PHI and Part 2 Records that Business Associate holds for Customer, including any received under a prior agreement and during any gap between its expiration and the Effective Date, which the Parties agree is governed by this BAA/QSOA, without any gap in protection.\n\n## 1. Background\n\nA. The Parties have entered into a Master Services Agreement of even date, together with the Subscription Order Form{{#claims}} and the Claims Submission Addendum issued under it{{/claims}} (collectively, the **Services Agreement**), under which Business Associate provides technology platform and related infrastructure services to Customer.{{#claims}} Claims Submission Services activate separately for each Payer only after the applicable activation requirements in the Claims Submission Addendum are complete.{{/claims}}{{#minnesotaEvv}} Electronic visit verification transmission activates only after the certification and readiness requirements in Exhibit B to the Subscription Order Form are complete.{{/minnesotaEvv}}\n\nB. To the extent Customer is a covered entity or business associate subject to the Health Insurance Portability and Accountability Act of 1996 and its implementing regulations, as amended from time to time (**HIPAA**), and Business Associate creates, receives, maintains, or transmits Protected Health Information on behalf of Customer, this BAA/QSOA constitutes the Parties' business associate agreement under 45 CFR 164.502(e) and 45 CFR 164.504(e).\n\nC. To the extent the Services involve records protected by 42 CFR Part 2 (**Part 2**), this BAA/QSOA also constitutes:\n\n1. a qualified service organization agreement between Customer and Business Associate to the extent Customer is a Part 2 program disclosing information needed by Business Associate to provide services to or on behalf of the program; and\n\n2. a written contract or comparable legal instrument binding Business Associate as a contractor, subcontractor, or similar service recipient to the requirements of Part 2 to the extent Customer is a lawful holder or other recipient permitted to disclose such records to Business Associate.\n\nD. Business Associate acknowledges that, with respect to any records protected by Part 2 that it receives from or on behalf of Customer, Business Associate is fully bound by Part 2 and, if necessary, will resist in judicial proceedings any efforts to obtain access to patient records except as permitted by Part 2.\n\n## 2. Definitions\n\nCapitalized terms not otherwise defined in this BAA/QSOA have the meanings set forth in the Services Agreement, HIPAA, and, where applicable, Part 2.\n\nA. **Breach** has the meaning set forth in 45 CFR 164.402.\n\nB. **Breach Notification Rule** means Subpart D of 45 CFR Part 164.\n\nC. **Designated Record Set** has the meaning set forth in 45 CFR 164.501.\n\nD. **Electronic PHI** means electronic protected health information as defined in 45 CFR 160.103.\n\nE. **Health Care Operations** has the meaning set forth in 45 CFR 164.501.\n\nF. **HIPAA Privacy Rule** means Subpart E of 45 CFR Part 164.\n\nG. **HIPAA Security Rule** means Subpart C of 45 CFR Part 164.\n\nH. **Individual** has the meaning set forth in 45 CFR 160.103 and includes a personal representative to the extent recognized under applicable law.\n\nI. **Part 2 Record** means any record, or information contained in a record, received by Business Associate from or on behalf of Customer that is protected by Part 2.\n\nJ. **Protected Health Information** or **PHI** has the meaning set forth in 45 CFR 160.103, limited to PHI created, received, maintained, or transmitted by Business Associate from or on behalf of Customer.\n\nK. **Security Incident** has the meaning set forth in 45 CFR 164.304.\n\nL. **SUD Counseling Notes** means notes protected by Part 2 that are maintained separately from the rest of the patient's SUD treatment and medical record and require separate patient consent for use or disclosure.\n\nM. **Unsecured PHI** has the meaning set forth in 45 CFR 164.402.\n\n## 3. Permitted Uses And Disclosures\n\nA. **Services.** Except as otherwise limited by this BAA/QSOA or applicable law, Business Associate may use and disclose PHI and, where applicable, Part 2 Records to perform its obligations under the Services Agreement and as otherwise permitted or required by this BAA/QSOA or required by law.\n\nB. **Management and administration.** Business Associate may use PHI for the proper management and administration of Business Associate and to carry out its legal responsibilities. Business Associate may disclose PHI for these purposes only if:\n\n1. the disclosure is required by law; or\n\n2. Business Associate obtains reasonable written assurances from the recipient that the recipient will hold the PHI confidential, use or further disclose it only as required by law or for the purpose for which it was disclosed, and notify Business Associate of any unauthorized use or disclosure of which the recipient becomes aware.\n\nC. **Minimum necessary.** Business Associate will request, use, and disclose only the minimum necessary PHI and Part 2 Records to accomplish the intended purpose, to the extent the minimum necessary standard or an analogous limitation applies.\n\nD. **No impermissible use or disclosure.** Business Associate will not use or disclose PHI in a manner that would violate HIPAA if done by Customer, except as expressly permitted for business associates under HIPAA. Business Associate will not use or disclose Part 2 Records except as permitted by Part 2, this BAA/QSOA, the Services Agreement, and Customer's lawful instructions.\n\nE. **Part 2 redisclosure limits.** Notwithstanding anything else in this BAA/QSOA:\n\n1. Business Associate will not use or disclose any Part 2 Record, or testimony describing the contents of a Part 2 Record, in any civil, criminal, administrative, or legislative proceeding against the patient absent the patient's specific written consent for that proceeding or an order satisfying Part 2 Subpart E.\n\n2. If Customer is a HIPAA covered entity or business associate and disclose

23s Part 2 Records to Business Associate pursuant to a valid patient consent permitting treatment, payment, or health care operations, Business Associate may use and disclose such Part 2 Records in accordance with HIPAA and this BAA/QSOA, except for uses and disclosures for civil, criminal, administrative, or legislative proceedings against the patient.\n\n3. If Customer is acting as a lawful holder other than a HIPAA covered entity or business associate, Business Associate may use and disclose Part 2 Records only as necessary to carry out the payment or health care operations, or other specifically authorized function, for which Customer lawfully engaged Business Associate and only as otherwise permitted by Part 2.\n\nF. **Consent-based disclosures.** If Business Associate makes a disclosure of a Part 2 Record on Customer's behalf pursuant to patient consent, Business Associate will accompany each such disclosure with the notice required by 42 CFR 2.32 and, where Part 2 requires, a copy of the consent or a clear explanation of the scope of the consent. Customer will provide Business Associate with the consent or all information reasonably necessary to provide a clear explanation of its scope, and Business Associate will not make the disclosure unless Customer has provided the information necessary to satisfy these requirements.\n\nG. **SUD Counseling Notes.** Business Associate will not use or disclose SUD Counseling Notes except as specifically instructed by Customer and only as permitted by Part 2 and other applicable law.\n\nH. **De-identification, research, and AI improvement.** To the extent Customer has authority and applicable requirements permit it, Customer authorizes Business Associate to create De-identified Data from PHI using the methods in 45 CFR 164.514(a) through (c), and from Part 2 Records consistently with 42 CFR 2.16 and applicable de-identification requirements. This authority is subject to the eligibility and permission checks in MSA Section 9(E), including before processing source records for these purposes. The permitted purposes, duration, restrictions, service-provider limits, and prohibition on re-identification in that section apply here. Agency, contractual, consent, and third-party restrictions that continue after de-identification remain binding; de-identification alone does not remove them.\n\nBusiness Associate may also provide data aggregation services relating to Customer's Health Care Operations, as permitted by 45 CFR 164.504(e)(2)(i)(B), by combining PHI received from Customer with PHI received in its capacity as business associate of other covered entities to permit data analyses relating to the respective covered entities' Health Care Operations, such as benchmarks, outcome measures, and quality reporting. Business Associate will combine Part 2 Records across programs only after they have been de-identified under this Section. Combining data for Smores Health's own research or model development requires each source to be independently eligible under MSA Section 9(E). Results of data aggregation are shared with Customer or others only in de-identified or aggregate form.{{#minnesotaEvv}} This Section 3(H) does not apply to electronic visit verification records, including visit location data, which Business Associate uses and discloses only as stated in Section 9(E) of the Services Agreement and Exhibit B to the Subscription Order Form.{{/minnesotaEvv}}\n\nI. **No sale or marketing.** Except as expressly permitted by law and this BAA/QSOA, Business Associate will not sell PHI or Part 2 Records and will not use PHI or Part 2 Records for marketing without Customer's prior written instruction and any required patient authorization or consent.\n\nJ. **AI processing and model training.** Business Associate will not use identifiable PHI or Part 2 Records to develop, train, fine-tune, or improve its own or third-party AI models under this packet. Existing AI, safety, moderation, and automation tools may process these records only to provide, secure, support, or maintain the expressly permitted Services under this BAA/QSOA and applicable requirements. Model development using eligible De-identified Data is governed by Section 3(H) and MSA Section 9(E).\n\nK. **Research and evaluation.** Research using eligible De-identified Data for Smores Health's own purposes is authorized only under Section 3(H) and MSA Section 9(E), without additional Customer approval for each project within that scope. Customer-directed research involving identifiable PHI or Part 2 Records requires Customer's express written instructions identifying the use and fields, a separate applicable research or data use agreement, and the legally required basis, consents, waivers, institutional reviews, and agency permissions. Each Party must perform the duties applicable to its role; Customer's instructions cannot substitute for another person's or agency's required approval. Research exports must be minimized and protected as required, and publications involving Part 2 Records must not identify or reasonably permit re-identification of patients. No identifiable-data research is authorized merely by signing this packet.\n\nL. **Platform role; no supervision; no duty to monitor.** Business Associate provides a technology platform and related infrastru

23cture used by Customer to support its operations. Business Associate does not provide clinical, medical, behavioral health, recovery, education, or peer-support services and does not supervise, direct, or control Customer's personnel, users, or workflows. Business Associate has no obligation to monitor, review, or evaluate communications, documentation, disclosures, or other content transmitted through the Services. Business Associate does not guarantee the accuracy, completeness, appropriateness, or safety of any user-generated content or interactions. Customer retains sole responsibility for service delivery, supervision, decision-making, and compliance with all applicable laws and regulations.\n\n## 4. Safeguards And Compliance\n\nA. **General safeguards.** Business Associate will use appropriate administrative, physical, and technical safeguards to prevent any use or disclosure of PHI or Part 2 Records other than as provided for by the Services Agreement, this BAA/QSOA, or applicable law.\n\nB. **HIPAA Security Rule.** To the extent Business Associate creates, receives, maintains, or transmits Electronic PHI on behalf of Customer, Business Associate will comply with the HIPAA Security Rule.\n\nC. **Part 2 security policies and procedures.** To the extent Business Associate receives or maintains Part 2 Records, Business Associate will maintain formal policies and procedures reasonably designed to protect against unauthorized uses and disclosures of such records and against reasonably anticipated threats or hazards to their security, consistent with 42 CFR 2.16.\n\nD. **HIPAA provisions applicable to Business Associate.** To the extent Business Associate is required under the Services Agreement to carry out one or more of Customer's obligations under the HIPAA Privacy Rule, Business Associate will comply with the requirements of the HIPAA Privacy Rule that apply to Customer in the performance of such obligation.\n\nE. **Workforce.** Business Associate will ensure that its workforce members and agents with access to PHI or Part 2 Records are subject to appropriate confidentiality obligations, training, and sanctions for violations.\n\nF. **Policies.** Business Associate will maintain written privacy and information security policies and procedures reasonably designed to comply with this BAA/QSOA and applicable law.\n\nG. **No monitoring obligation.** Customer acknowledges that Business Associate's safeguards and security measures are designed to protect the confidentiality, integrity, and availability of PHI and Part 2 Records, and not to monitor or evaluate the substance of user activity or interactions. Any moderation, safety, alerting, reporting, or administrative-visibility functionality is limited to the features Customer has purchased and configured. Business Associate does not undertake any obligation to detect, prevent, or respond to all harmful, inappropriate, or non-compliant conduct by Customer or its users.\n\n## 5. Security Incidents, Unauthorized Uses And Disclosures, And Breaches\n\nA. **Security Incidents.** Business Associate will report to Customer any Security Incident involving Electronic PHI of which Business Associate becomes aware without unreasonable delay and within the time required by applicable law. Routine unsuccessful security events that do not result in unauthorized access to Electronic PHI may be logged and reported in summary form upon request.\n\nB. **Unauthorized uses or disclosures of PHI.** Business Associate will report to Customer without unreasonable delay any use or disclosure of PHI not permitted by this BAA/QSOA of which Business Associate becomes aware.\n\nC. **Unauthorized uses or disclosures of Part 2 Records.** Business Associate will report to Customer without unreasonable delay any unauthorized use or disclosure of Part 2 Records of which Business Associate becomes aware.\n\nD. **Breaches.** Business Associate will notify Customer of any Breach of Unsecured PHI and any breach of records protected by Part 2 without unreasonable delay and within the time required by 45 CFR 164.410 and other applicable law.\n\nE. **Content of notice.** The notice described

23in this Section 5 will include, to the extent known at the time:\n\n1. the nature of the incident;\n\n2. the date of the incident and the date of discovery, if known;\n\n3. the categories of information involved;\n\n4. the identities of affected individuals, if known or reasonably ascertainable;\n\n5. the steps Business Associate is taking to investigate, mitigate harm, and prevent recurrence; and\n\n6. contact information for follow-up.\n\nF. **Mitigation and cooperation.** Business Associate will provide supplemental information as it becomes available, use commercially reasonable efforts to mitigate harmful effects of any unauthorized use or disclosure of PHI or Part 2 Records caused by Business Associate, and reasonably cooperate with Customer in Customer's investigation, risk assessment, mitigation efforts, and legally required notifications.\n\n## 6. Subcontractors, Agents, And Downstream Service Providers\n\nA. Business Associate will ensure that any subcontractor, agent, or other third party that creates, receives, maintains, or transmits PHI on behalf of Business Associate agrees in writing to restrictions, conditions, and security requirements that are no less protective than those that apply to Business Associate under this BAA/QSOA, as required by HIPAA.\n\nB. With respect to Part 2 Records, Business Associate will ensure that any subcontractor, downstream service provider, or contract agent receiving such records from Business Associate:\n\n1. is fully bound by Part 2 upon receipt of the records;\n\n2. is furnished with the notice required by 42 CFR 2.32 to the extent applicable to the disclosure;\n\n3. is subject to written obligations requiring appropriate safeguards against unauthorized use or disclosure;\n\n4. is required to report unauthorized uses, disclosures, and breaches of Part 2 Records to Business Associate;\n\n5. receives only the information necessary for it to perform its duties; and\n\n6. is not permitted to further disclose the information to any other third party except to a contract agent assisting it in performing the contracted services and only so long as that contract agent is bound to the same extent and may further disclose the information only back to the subcontractor or to Business Associate and, as applicable, Customer.\n\nC. Business Associate remains responsible for the acts and omissions of its subcontractors and agents to the extent required by law and this BAA/QSOA.\n\nD. Upon Customer's written request, Business Associate will provide a then-current informational list of subcontractors that handle PHI or Part 2 Records for or on behalf of Customer. Any such list is provided for transparency only, is not incorporated into this BAA/QSOA, and does not amend or expand Business Associate's obligations under the Services Agreement or this BAA/QSOA.\n\n## 7. Audit Reports And Compliance Review\n\nUpon Customer's written request no more than once per calendar year, Business Associate will make available its most recent available SOC 2 Type 2 report, subject to the report's restricted-use terms and reasonable confidentiality undertakings. Business Associate has no other obligation to provide audit reports, assessments, or policies to Customer, except as required by applicable law.\n\n## 8. Access, Amendment, Accounting, Restrictions, And Complaints\n\nA. **Access.** Business Associate will make available PHI in a Designated Record Set to Customer as reasonably necessary for Customer to satisfy its obligations under 45 CFR 164.524. If Business Associate receives a direct request for access relating to Customer data, Business Associate will forward the request to Customer promptly.\n\nB. **Amendment.** Business Associate will make amendments to PHI in a Designated Record Set as directed by Customer pursuant to 45 CFR 164.526. If Business Associate receives a direct amendment request relating to Customer data, Business Associate will forward the request to Customer promptly.\n\nC. **Accounting.** Business Associate will document disclosures of PHI as required by 45 CFR 164.528 and, to the extent applicable, disclosures of Part 2 Records for which Customer must provide an accounting or disclosure history. Business Associate will provide reasonably requested information to Customer so Customer can respond to rights requests, audits, or investigations.\n\nD. **Restrictions and confidential communications.** To the extent the Services are expressly configured for Business Associate to assist Customer with restriction requests, confidential communications requests, revocations, or similar rights workflows, Business Associate will apply Customer's written instructions regarding such requests within the scope of the Services.\n\nE. **Complaints and inquiries.** If Business Associate receives a complaint, regulator inquiry, or patient-facing inquiry specifically concerning Customer's PHI or Part 2 Records, Business Associate will promptly notify Customer unless prohibited by law.\n\n## 9. HHS And Regulator Access\n\nBusiness Associate will make its internal practices, books, agreements, records, and policies and procedures relating to the use and disclosure of PHI or Part 2 Records available to the Secretary of HHS or other governmental authority to the extent required by applicable law, for purposes of determining compliance with HIPAA, Part 2, or other applicable law.\n\n## 10. Customer Responsibilities\n\nCustomer will:\n\nA. provide Business Associate with any applicable limitations in Customer's notice of privacy practices and any restrictions, revocations, or consent limitations that affect Business Associate's permitted uses and disclosures;\n\nB. obtain, maintain, and document all patient notices, authorizations, consents, legal bases, and instructions required for Customer and Business Associate to use and disclose PHI and Part 2 Records as contemplated by the Services Agreement, any applicable Customer Responsibilities Addendum, this BAA/QSOA, and applicable law;\n\nC. provide Business Associate with the information reasonably necessary to identify whether data is subject to HIPAA, Part 2, or other heightened confidentiality restrictions and to identify the scope of any relevant consent or authorization;\n\nD. notify Business Associate of material changes to Customer's services, sources or types of records, or permissions and restrictions that affect how the disclosed records may be handled;\n\nE. if Customer instructs Business Associate to disclose Part 2 Records based on patient consent, provide Business Associate with the consent or the information reasonably necessary to furnish a copy of the consent or a clear explanation of the scope of the consent as required by Part 2;\n\nF. not request Business Associate to use or disclose PHI or Part 2 Records in any manner that would not be permissible under applicable law if done by Customer directly;\n\nG. comply with any Customer Responsibilities Addendum to the extent applicable; and\n\nH. to the extent the Services include automated features, analytics, or machine learning or artificial intelligence-assisted outputs, review, validate, and determine the appropriateness of such outputs before any use in service delivery, care delivery, peer support, education, supervision, reporting, or decision-making.\n\nBusiness Associate does not warrant the accuracy or reliability of such outputs, and such outputs do not constitute clinical, legal, educational, or professional advice.\n\n## 11. Data Stewardship And Ownership\n\nA. Business Associate's stewardship, custody, or processing of PHI or Part 2 Records does not confer ownership rights in such information on Business Associate.\n\nB. Except as expressly permitted by this BAA/QSOA, the Services Agreement, or applicable law, Business Associate will not claim any independent right to use or disclose PHI or Part 2 Records for its own separate purposes.\n\n## 12. Term And Termination\n\nA. This BAA/QSOA becomes effective on the Effective Date and remains in effect until the later of: (i) termination or expiration of the Services Agreement, and (ii) return or destruction of all PHI and Part 2 Records for which Business Associate remains responsible, unless earlier terminated in accordance with this Section 12.\n\nB. If Customer determines that Business Associate has materially breached this BAA/QSOA, Customer may provide written notice specifying the breach. Business Associate will have **30 days** to cure the breach to Customer's reasonable satisfaction. If Business Associate does not cure the breach within that period, Customer may terminate this BAA/QSOA and, if appropriate, the affected Services. If termination is not feasible, Customer may report the problem to HHS or other appropriate authority as required by law.\n\nC. If Business Associate determines that Customer has materially breached this BAA/QSOA, Business Associate may provide written notice specifying the breach. Customer will have **30 days** to cure the breach to Business Associate's reasonable satisfaction. If Customer does not cure the breach within that period, Business Associate may terminate this BAA/QSOA and, if appropriate, the affected Services.\n\nD. Upon termination of this BAA/QSOA or the Services Agreement, Business Associate will, at Customer's option and to the extent feasible, return or destroy all PHI and Part 2 Records maintained by Business Associate on behalf of Customer and retain no copies, except to the extent retention is required by law, backup processes, security purposes, audit requirements, or legal hold.\n\nE. If return or destruction is not feasible, Business Associate will extend the protections of this BAA/QSOA to the retained PHI or Part 2 Records and limit further uses and disclosures to those purposes that make return or destruction infeasible, for so long as the information is retained.\n\nF. Sections 3 through 13 survive termination of this BAA/QSOA to the extent required to fulfill their purposes.\n\n## 13. Order Of Precedence, Interpretation, And Notices\n\nA. This BAA/QSOA is incorporated into and made part of the Services Agreement.\n\nB. If there is a conflict between this BAA/QSOA and the Services Agreement on regulated-data handling, HIPAA, Part 2, breach, return or destruction, or other legally required or specifically negotiated data-compliance terms, this BAA/QSOA controls to the extent stated here or necessary to satisfy applicable law. Except to the extent expressly required by applicable law, the limitations of liability and remedies set forth in the Services Agreement apply to this BAA/QSOA and to any claim arising out of or relating to it.\n\nC. If there is a conflict between this BAA/QSOA and any applicable Customer Responsibilities Addendum, the Customer Responsibilities Addendum controls with respect to Customer's clinical, notice, consent, licensure, certification, education, program, safety-escalation, and state-law responsibilities, and this BAA/QSOA controls with respect to the specific HIPAA and Part 2 contract obligations of Business Associate and Customer relating to PHI and Part 2 Records. Customer's use of the Services and all user activity remain subject to the Services Agreement and any applicable Customer Responsibilities Addendum governing operational, clinical, educational, recovery-program, or organizational responsibilities.\n\nD. Any ambiguity in this BAA/QSOA will be resolved

23in favor of a meaning that permits compliance with HIPAA and Part 2 and preserves patient confidentiality to the maximum extent required by law.\n\nE. All notices required or permitted under this BAA/QSOA must be in writing and delivered by personal delivery, nationally recognized overnight courier, certified mail, or electronic mail to the notice contacts below or to any updated contact provided by notice.\n\n**If to Customer:**\n\n**Attention:** {{noticeAttention}}\n\n**Address:** {{customerLegalName}}, {{noticeAddress}}\n\n**Email:** {{noticeEmail}}\n\n**If to Business Associate:**\n\n**Name:** Smores Health, Inc., Attn: Legal\n\n**Address:** 584 Castro Street, Suite 4102, San Francisco, CA 94114, USA\n\n**Email:** [email protected]\n\nEmail notice is effective when sent unless the sender receives notice of failed delivery.\n\n## 14. Miscellaneous\n\nA. **Independent contractors.** The Parties are independent contractors. Nothing in this BAA/QSOA creates a partnership, joint venture, or employment relationship.\n\nB. **No waiver.** Failure to enforce any provision of this BAA/QSOA is not a waiver of that provision or any other provision.\n\nC. **Severability.** If any provision of this BAA/QSOA is held invalid or unenforceable, the remaining provisions remain in full force and effect.\n\nD. **Governing law.** This BAA/QSOA is governed by the laws of the State of Delaware, without regard to conflict of laws principles, except to the extent preempted by federal law or expressly stated in a signed customer-specific addendum.\n\nE. **Counterparts; electronic signature.** This BAA/QSOA may be executed in counterparts, including by electronic signature, each of which is deemed an original and all of which together constitute one instrument.\n\nF. **Changes in law.** MSA Section 9(G) applies to this BAA/QSOA. It does not replace any required term, approval, safeguard, or amendment.\n\n## 15. Platform Moderation and Limitations\n\nTo the extent Business Associate provides tools that enable content moderation, flagging, or administrative visibility, such functionality is provided on a limited, supplemental basis and is not exhaustive. Any moderation or review performed by Business Associate is reactive and does not create an obligation to monitor all activity or prevent all harmful or non-compliant conduct.\n\nCustomer remains solely responsible for supervising users, enforcing policies, and ensuring appropriate use of the Services.\n\n## Exhibit A. Description Of Services\n\n{{#bothRegulated}}Business Associate provides a software platform and related services to Customer, which may include hosting, processing, transmitting, and storing PHI and Part 2 Records at Customer's direction for the purposes described in the Services Agreement. Where the Parties have executed a Claims Submission Addendum, Claims Submission Services activate separately for each Payer only after the applicable activation requirements in that addendum are complete. Where Customer has elected electronic visit verification, transmission to the state's designated data aggregator activates only after the certification and readiness requirements in Exhibit B to the Subscription Order Form are complete. Once the applicable workflow is activated, the Services may include preparing and submitting claims and eligibility inquiries, receiving and recording payer responses and remittance advice through Business Associate's clearinghouse subcontractor, and transmitting visit records to the state's designated data aggregator, each as Customer's limited agent and as described in the Services Agreement.{{/bothRegulated}}\n\n{{#notBothRegulated}}Business Associate provides a software platform and related services to Customer, which may include hosting, processing, transmitting, and storing PHI and Part 2 Records at Customer's direction for the purposes described in the Services Agreement.{{#claims}} Where the Parties have executed a Claims Submission Addendum, Claims Submission Services activate separately for each Payer only after the applicable activation requirements in that addendum are complete. Once activated, the Services may include preparing and submitting approved claims and permitted eligibility inquiries, receiving and recording payer responses and remittance advice through the clearinghouse subcontractor, as described

23in that addendum.{{/claims}}{{#minnesotaEvv}} Where Customer has elected Minnesota electronic visit verification, transmission to the state's designated data aggregator activates only after the certification and readiness requirements in Exhibit B to the Subscription Order Form are complete.{{/minnesotaEvv}}{{/notBothRegulated}}\n\n## Execution\n\nThis BAA/QSOA is executed by the signatures on the Signing Page at the end of this packet, which apply to each agreement listed there.\n"},customer_responsibilities:{sourcePath:"docs/legal/contracts/company-packet/06-customer-responsibilities-addendum.md",sha256:"cd56b9178b832ca683e71516ceb7572a6cb2553ee2cfcdbe5c03e24e34c64e87",markdown:"# Customer Responsibilities Addendum\n\nThis Customer Responsibilities Addendum (this **Addendum**) is entered into and becomes effective on the date on which the last Party signs the Signing Page of this packet (the **Effective Date**) by and between:\n\n**Customer:** **{{customerLegalName}}**, {{entityDescription}}, with principal address at **{{noticeAddress}}** (the **Customer**)\n\nand\n\n**Smores Health, Inc.**, a Delaware corporation, with principal address at **584 Castro Street, Suite 4102, San Francisco, CA 94114** (**Smores Health**).\n\nCustomer and Smores Health are each a **Party** and together are the **Parties**.\n\n## 1. Incorporation; Purpose\n\nA. This Addendum is incorporated into and made part of the Master Services Agreement between the Parties of even date (the **Services Agreement**) and applies to the Services under the Subscription Order Form{{#claims}} and the Claims Submission Addendum of even date{{/claims}}. This Addendum is coterminous with the Services Agreement, subject to its express survival provisions. The Initial Term is stated in the Subscription Order Form. As of the Effective Date, this Addendum replaces any prior customer responsibilities addendum between the Parties for the Services.\n\nB. The purpose of this Addendum is to allocate responsibility for the clinical, regulatory, and patient-facing obligations associated with the Customer's use of Smores Health's software platform and related services.\n\nC. This Addendum is intended to work alongside any applicable Business Associate Agreement and Qualified Service Organization Agreement between the Parties (the **BAA/QSOA**). This Addendum does not reduce any obligation imposed by HIPAA, 42 CFR Part 2, state law, professional licensure rules, or the BAA/QSOA.\n\nD. **Data handling and onboarding.** Customer will provide accurate onboarding information about its services and the records to be imported or processed, and obtain any permissions or consents required for Customer to provide those records to Smores Health. Each Party remains responsible for its obligations under the applicable data agreements and law. Regulated-data processing will not begin until the applicable agreements, permissions, notices, consents, configuration, and readiness steps are complete. {{#dataRoleStated}}Customer has disclosed its legal and data-processing role as follows: {{dataRole}}. {{/dataRoleStated}}The approved operating states are {{operatingStates}}. {{includedFeatures}} Workflows that depend on regulated records or services, including video visits, records for participants ages 13 to 17 kept by Customer's staff, claims submission{{#minnesotaEvv}}, electronic visit verification{{/minnesotaEvv}}, and any similar regulated workflow, are available only when turned on in Customer's configuration and on the conditions stated in the Subscription Order Form and Sections 7 and 8 of this Addendum. Smores Health turns on records for participants ages 13 to 17 only after Customer confirms in writing that it has completed the review Section 8 requires. Customer will notify Smores Health in writing before requesting any change to this configuration.\n\n## 2. Core Role Allocation\n\nA. The Parties acknowledge that Smores Health provides a technology platform and administrative service offering. Unless the Parties expressly agree otherwise in a separate written agreement signed by both Parties, Smores Health is not the treating provider, medical practice, facility, program sponsor, billing provider, health plan, or 42 CFR Part 2 program for Customer-delivered services. If the Parties execute a Claims Submission Addendum, Smores Health will arrange for Customer-approved claims to be transmitted to payers through a healthcare clearinghouse, solely as Customer's limited billing agent and only as stated in that addendum; Customer remains the enrolled billing provider of record for every claim.\n\nB. Customer is solely responsible for the care relationship, program relationship, peer-support relationship, or other regulated service relationship with each patient, participant, client, member, or end user whose information is processed through the Services on Customer's behalf.\n\nC. Where regulated customer data is involved, Smores Health may act as a HIPAA business associate, subcontractor, service provider, qual

23ified service organization, contractor, or similar service recipient, depending on Customer's legal status and instructions. Customer is solely responsible for determining and accurately disclosing Customer's own legal status, including whether Customer is acting as a covered entity, business associate, Part 2 program, lawful holder, intermediary, contractor, subcontractor, or other regulated recipient.\n\nD. Customer will not represent, and will ensure its workforce and agents do not represent, that Smores Health's public platform documents are a substitute for Customer's own required patient notices, informed consents, authorizations, or releases.\n\nE. Smores Health does not supervise, direct, or control Customer's personnel, users, workflows, documentation practices, or service delivery. Customer retains sole responsibility for all operational, clinical, peer-support, and compliance activities conducted through the Services.\n\n## 3. Customer Representations And Continuing Covenants\n\nCustomer represents, warrants, and covenants on an ongoing basis that:\n\nA. Customer has full legal authority to use the Services in connection with the records, workflows, and regulated activities Customer directs through the Services.\n\nB. Customer has obtained, and will maintain, all provider, facility, program, practice, business, organizational, and data-sharing authority required to disclose information to Smores Health and to instruct Smores Health regarding such information.\n\nC. If Customer is acting on behalf of, or as a contractor, subcontractor, business associate, qualified service organization, intermediary, or other service recipient to, another regulated entity, Customer is solely responsible for ensuring that its upstream agreements and authorizations permit Customer to engage Smores Health and to flow down any required restrictions, notices, and obligations.\n\nD. Customer is solely responsible for ensuring that its workforce, including certified peers, supervisors, program managers, contractors, and other personnel, are properly qualified, credentialed, trained, supervised, and legally permitted to perform the services they provide.\n\nE. Customer is solely responsible for determining the states, territories, tribal jurisdictions, and other locations in which Customer will operate through the Services and for ensuring that Customer's use of the Services is lawful in each such location.\n\nF. Customer will not use or permit use of the Services for minor workflows, minor treatment, or minor telehealth unless and until: (i) Customer has completed a state-specific minor-law analysis, (ii) Customer has implemented an approved minor consent and notice packet, and (iii) Smores Health has approved such use in writing.\n\nG. Customer is solely responsible for maintaining its own policies, procedures, training, and internal controls to the extent required by HIPAA, 42 CFR Part 2, state law, professional standards, payer rules, or Customer's own compliance commitments.\n\nH. Customer is solely responsible for approving, provisioning, deprovisioning, and supervising Customer-authorized user accounts, role assignments, access levels, workforce devices, and local environment controls used by Customer personnel to access the Services.\n\nI. Customer will promptly notify Smores Health of any change in Customer's regulatory status, licensing status, program status, legal authority, service model, operating states, or patient population that could affect the Parties' compliance obligations.\n\nJ. Customer is solely responsible for reviewing and validating any outputs generated by the Services, including automated or AI-assisted features, prior to use in care delivery, peer support, or decision-making.\n\nK. Customer may use outputs, reports, documentation formats, workflow structures, templates, prompts, and other materials generated or made available through the Services solely in connection with Customer's permitted internal use of the Services and Customer's regulated operations. Customer will not use such materials to develop, replicate, train, improve, or enable any competing product, service, workflow, or system, except to the extent such materials constitute Customer Data.\n\nL. For each Customer-Managed Integration, as defined in the Services Agreement, Customer represents, warrants, and covenants that: (i) Customer or its Authorized User has authority to enable, connect, administer, and use the third-party account; (ii) Customer has accepted and will comply with applicable third-party terms and has obtained and will maintain any required license, business associate agreement, consent, or other authorization for Customer Data processed through the integration; (iii) Customer has determined that the integration is approved and appropriately configured for Customer's regulated-data use; and (iv) Customer authorizes Smores Health to transmit Customer Data to and receive Customer Data from the integration as reasonably necessary to provide the configured integration at Customer's direction. Technical connection or OAuth consent alone does not establish that Customer has satisfied these obligations. Nothing in this paragraph limits Smores Health's obligations for its own Services, its handling of Customer Data, or any provider Smores Health engages to perform the Services.\n\n## 4. Customer-Owned Notices, Consents, And Care Documents\n\nCustomer is solely responsible for preparing, maintaining, versioning, delivering, and enforcing the patient-facing and provider-facing documents that govern Customer's regulated services, including the following to the extent applicable:\n\nA. Customer's HIPAA Notice of Privacy Practices, including any limitations, revisions, and acknowledgments required by 45 CFR 164.520 and related law.\n\nB. Customer's 42 CFR Part 2 patient notice, including any model or adapted notice required by 42 CFR 2.22 and related HHS guidance.\n\nC.

23Customer's telehealth informed consent, including all state-specific telehealth disclosures, acknowledgments, emergency procedures, and consent requirements applicable in the state where the patient is located at the time of service.\n\nD. Customer's written authorizations, releases of information, Part 2 consents, treatment/payment/health care operations consents, revocation forms, restriction-request forms, and any other care-disclosure documents required by HIPAA, 42 CFR Part 2, or state law.\n\nE. Customer's special consent workflows for any specially protected category of information for which a separate or heightened consent is required, including substance use disorder counseling notes where applicable.\n\nF. Customer's minor-treatment, parental-consent, guardian-consent, personal-representative, and related state-specific forms and workflows.\n\nG. Any clinical intake forms, emergency contacts, crisis protocols, complaint notices, or provider-specific disclosures that must be presented as part of Customer's care relationship.\n\nCustomer acknowledges that Smores Health's Privacy Policy, Terms of Service, Telehealth Platform Agreement, community rules, onboarding flows, and similar platform documents are platform documents only and are not, by themselves, Customer's HIPAA notice, Part 2 patient notice, telehealth informed consent, release of information, or other legally sufficient care-side consent instrument.\n\n## 5. Customer Responsibility For Disclosure Authority And Legal Basis\n\nCustomer is solely responsible for determining, documenting, and communicating to Smores Health the lawful basis for each use, disclosure, export, access, restriction, or transmission of regulated information that Customer directs through the Services, including:\n\nA. whether the information is protected by HIPAA, 42 CFR Part 2, state confidentiality law, or multiple legal regimes at once;\n\nB. whether the information may be used or disclosed for treatment, payment, health care operations, platform support, management and administration, research, public health, reporting, legal process, or any other purpose;\n\nC. whether the intended recipient is a treating provider, covered entity, business associate, Part 2 program, lawful holder, intermediary, contractor, subcontractor, public health authority, payer, family member, personal representative, court, law enforcement authority, or another recipient type with distinct legal treatment;\n\nD. whether a valid written consent, authorization, court order, emergency exception, mandatory-reporting basis, or other legal basis is required before Customer instructs Smores Health to facilitate or support a disclosure; and\n\nE. whether any redisclosure notice, consent copy, limitation, or downstream contractual term must accompany the disclosure.\n\nCustomer will not instruct Smores Health to make, facilitate, or support any use or disclosure that would be unlawful if made by Customer directly.\n\n## 6. Part 2-Specific Responsibilities\n\nTo the extent Customer uses the Services in connection with records protected by 42 CFR Part 2, Customer is solely responsible for:\n\nA. determining whether Customer is a Part 2 program, lawful holder, intermediary, contractor, or other recipient regulated under 42 CFR Part 2;\n\nB. providing the Part 2 patient notice and honoring the patient rights associated with such records;\n\nC. obtaining and maintaining any written consent required under 42 CFR Part 2, including any consent required for treatment, payment, health care operations, prescription drug monitoring program reporting, research, non-routine disclosures, or specially protected notes;\n\nD. tracking consent scope, recipient scope, expiration, revocation, restrictions, and any limitations communicated by the patient;\n\nE. ensuring that any instructions to Smores Health regarding disclosure of Part 2 records include the information needed to determine the permitted recipient category, purpose, and any required accompanying notice;\n\nF. ensuring that Part 2 records are not used or disclosed in civ

23il, criminal, administrative, or legislative proceedings against the patient absent a valid patient consent or an order that satisfies Subpart E of 42 CFR Part 2; and\n\nG. ensuring that any required contractor, subcontractor, intermediary, or downstream recipient restrictions are properly imposed and documented.\n\n## 7. Telehealth, Patient Location, And State-Law Responsibilities\n\nCustomer is solely responsible for all provider-side telehealth compliance obligations, including:\n\nA. confirming the patient's location at the time of service and determining whether the service may lawfully be delivered in that location;\n\nB. ensuring that the professional providing the service is licensed, certified, registered, supervised, or otherwise legally permitted to provide the service in the location where the patient is located;\n\nC. obtaining, documenting, and storing any required telehealth informed consent or equivalent acknowledgment before or during the encounter as required by applicable law;\n\nD. maintaining emergency-response protocols, crisis-escalation workflows, and local emergency contact procedures appropriate to the patient's location; and\n\nE. complying with all state-law rules governing telehealth modality, supervision, prescribing, documentation, minors, mandatory reporting, and record retention.\n\n## 8. Minors, Personal Representatives, And State-Specific Consent Rules\n\nCustomer is solely responsible for determining, under applicable state law and 42 CFR 2.14 where relevant:\n\nA. whether a minor may consent to the relevant service without a parent or guardian;\n\nB. when a parent, guardian, or both the minor and the parent or guardian must consent;\n\nC. when a parent, guardian, or other personal representative may access records or exercise r

23ights on behalf of the patient;\n\nD. when confidentiality must be preserved from a parent, guardian, or other representative; and\n\nE. what form language, workflow controls, identity checks, and state-specific restrictions are required before minor workflows may be enabled.\n\nCustomer will not rely on Smores Health to make these determinations for Customer and will not activate or request activation of minor workflows unless Customer has completed the required state-specific analysis and documentation.\n\n## 9. Rights Requests, Complaints, Restrictions, And Revocations\n\nCustomer is solely responsible for receiving, evaluating, and responding to patient, client, member, and personal representative requests and complaints relating to Customer's regulated records and services, including:\n\nA. access, inspection, and copies;\n\nB. amendments or corrections;\n\nC. restrictions on use or disclosure, including any restriction request that Customer agrees to honor with respect to a health plan or other recipient;\n\nD. accounting or disclosure-history requests;\n\nE. revocation of consent or authorization;\n\nF. confidential communications requests;\n\nG. complaints to Customer, HHS, or other authorities; and\n\nH. disputes concerning whether a requester is a personal representative or otherwise authorized to act.\n\nSmores Health will provide reasonable cooperation as described in the Services Agreement and any BAA/QSOA, but Customer remains responsible for the substantive legal determination and for the timeliness and content of any response unless the Parties expressly agree otherwise in writing.\n\n## 10. Legal Process, Mandatory Reporting, And High-Risk Disclosure Decisions\n\nCustomer is solely responsible for determining whether and how Customer may respond to subpoenas, summonses, warrants, court orders, law-enforcement requests, audits, evaluations, public health disclosures, prescription drug monitoring program reporting, abuse or neglect reporting, threats of harm, or other compulsory or sensitive disclosure scenarios.\n\nWithout limiting the foregoing:\n\nA. Customer will not instruct Smores Health to disclose Part 2 records in response to legal process unless Customer has determined and documented that the disclosure is permitted under 42 CFR Part 2, including Subpart E where applicable.\n\nB. Customer will not instruct Smores Health to report Part 2 records to a prescription drug monitoring program unless Customer has determined that the required patient consent and any other legal predicates have been satisfied.\n\nC. Customer will not rely on Smores Health's platform documents or default workflows as a substitute for Customer's own legal review of mandatory-reporting or public-health obligations.\n\n## 11. Retention, Deletion, Export, And Legal Hold\n\nCustomer is solely responsible for:\n\nA. defining the retention schedule applicable to Customer records and workflows;\n\nB. determining whether Customer records are subject to any legal hold, preservation duty, payer requirement, audit requirement, or state-law retention rule;

23\n\nC. instructing Smores Health regarding deletion, export, archival handling, suspension of deletion, and restoration requests; and\n\nD. determining whether any requested deletion, export, or restriction may lawfully be honored in light of Customer's obligations.\n\nSmores Health may preserve logs, audit trails, security records, backup artifacts, and other technical records as permitted by the Services Agreement, the BAA/QSOA, and applicable law.\n\n## 12. Contact And Notice Of Changes\n\nSmores Health will use Customer's contact listed in the Order Form and the DPA for onboarding and notices, unless Customer provides another contact. The contact details and notice routing follow Section 14 of the DPA.\n\nCustomer will promptly notify Smores Health of:\n\n1. any material change to Customer's notices, consents, or restrictions that affects Smores Health's permitted uses or disclosures;\n\n2. any material revocation, restriction, complaint, or legal dispute that affects the Services;\n\n3. any material enforcement action, investigation, or alleged breach involving Customer's use of the Services; and\n\n4. any change to Customer's approved operating states, patient population, or service model.\n\n## 13. Customer Onboarding Deliverables\n\nBefore Customer uses the Services for regulated workflows, and thereafter upon request or material revision, Customer will provide Smores Health with, or otherwise confirm to Smores Health in a form reasonably acceptable to Smores Health, the items applicable to Customer's use case:\n\nA. Customer's current Notice of Privacy Practices, if applicable;\n\nB. Customer's current Part 2 patient notice, if applicable;\n\nC. Customer's current telehealth informed consent packet and emergency workflow, if applicable;\n\nD. Customer's current authorization, release-of-information, consent, revocation, and restriction forms used with the Services;\n\nE. Customer's list of approved operating states and any state-specific limitations;\n\nF. Customer's minor packet and state-law analysis, if Customer seeks to enable any minor workflow;\n\nG. any additional materials reasonably requested by Smores Health to verify the lawful configuration of the Services.\n\nSmores Health may condition launch, continued operation of a regulated workflow, or enablement of a new feature on Customer's timely delivery or confirmation of the required materials. Smores Health may require copies of underlying documents, rather than attestation alone, where Smores Health reasonably determines that additional verification is needed for the requested workflow, jurisdiction, customer type, or risk posture.\n\nSmores Health may apply a risk-based approach to onboarding and verification. For certain customers or use cases, Smores Health may rely on Customer attestations, while for others Smores Health may require documentation, validation, or additional compliance review. Customer acknowledges that Smores Health's onboarding or verification activities do not transfer responsibility for compliance or lawful operation from Customer to Smores Health.\n\n## 14. Smores Health Reliance; Suspension Rights\n\nSmores Health may rely on Customer's representations, documents, instructions, and legal determinations without independent verification unless Smores Health has actual knowledge that such reliance would be unlawful.\n\nIf Smores Health reasonably determines that Customer has failed to provide required documents, has provided materially inaccurate information, or is using the Services in a way that presents material legal, regulatory, compliance, or security risk, Smores Health may suspend or limit the affected workflow, feature, integration, state, or account until the issue is resolved.\n\n## 15. Order Of Precedence\n\nA. This Addendum supplements the Services Agreement and any BAA/QSOA.\n\nB. If there is a conflict between this Addendum and the Services Agreement on Customer's clinical, regulatory, notice, consent, licensure, or state-law responsibilities, this Addendum controls.\n\nC. If there is a conflict between this Addendum and the BAA/QSOA on a matter expressly governed by HIPAA or 42 CFR Part 2 contract requirements, the BAA/QSOA controls to the extent necessary to satisfy applicable law, and this Addendum will otherwise be interpreted to complement the BAA/QSOA.\n\n## 16. Survival\n\nSections 2 through 15 and 17 through {{#regulatedServices}}20{{/regulatedServices}}{{#notRegulatedServices}}19{{/notRegulatedServices}} survive termination of the Services Agreement for so long as either Party retains Customer data, audit records, backup materials, legal-hold materials, or any record subject to ongoing legal obligations.\n\nCustomer's retention of its own records does not, by itself, extend Smores Health's affirmative obligations after termination. Smores Health's data obligations survive only as stated in the Services Agreement, the BAA/QSOA, or applicable law.\n\n## 17. No Duty to Monitor\n\nCustomer acknowledges that Smores Health does not monitor all activity within the Services and has no obligation to review, audit, or evaluate communications, documentation, disclosures, or user conduct.\n\nSmores Health does not undertake responsibility to detect violations, prevent misconduct, or intervene in real time. Customer is solely responsible for supervising users, enforcing policies, and ensuring lawful and appropriate use of the Services.\n\n## 18. No Responsibility for User Conduct\n\nSmores Health is not responsible for the conduct, actions, or omissions of Customer, its workforce, or end users. Customer is solely responsible for all decisions, interactions, documentation, and services delivered through the Services.\n\n## 19. State And Program Responsibilities\n\n{{#minnesota}}Without limiting the other Sections of this Addendum, Customer is solely responsible for compliance with Minnesota law applicable to its services, records, data, and billing, including the Minnesota Health Records Act (Minnesota Statutes sections 144.291 to 144.298) and any patient consent it requires for releases Customer directs through the Services; the Minnesota Government Data Practices Act to the extent it applies to data Customer handles under contracts with government entities, including flowing down to Smores Health in writing any specific handling requirement those contracts impose; Customer's Minnesota Health Care Programs enrollment, provider agreement, certification, and staff qual

23ification requirements; Customer's obligations as a provider under Minnesota Statutes section 256B.073 (electronic visit verification), but only to the extent and when those obligations apply to the services Customer provides under then-current law, applicable federal approval conditions, and Minnesota Department of Human Services guidance; record retention periods required by Minnesota Health Care Programs, the Department of Human Services, and payers; and any breach notification Minnesota law requires of Customer.{{/minnesota}}\n\n{{stateTerms}}\n\n{{#orgYouth}}**Consent and access authority for youth.** For each participant under 18, Customer will identify and document under Section 8 the person or agency with legal authority to consent to the relevant service and to the sharing of the participant's records, taking account of applicable state law, any court order, and the authority of any agency with custody of the participant. Customer will tell Smores Health in writing of any restriction that affects who may access a participant's records through the Services. Smores Health will apply the access settings Customer configures and is not responsible for determining a person's legal authority.\n\n**Mandatory reporting.** Each Party and each individual retains any duty under applicable law to report suspected child abuse or neglect directly to the appropriate authority within the legally required time. Nothing in the Services or these agreements replaces or delays that report.{{/orgYouth}}\n\n{{#texas}}**Texas.** Where a participant is under 18, Texas Family Code Chapters 32 and 266 and any conservatorship of the Texas Department of Family and Protective Services determine who may consent to a service and to the sharing of records, and each person's duty to report suspected child abuse or neglect arises under Texas Family Code Chapter 261.{{/texas}}\n\n**Agency contract terms.** If Customer's contract with a state agency, county, or other funder requires specific data security, incident notice, data location, return or destruction, audit, or other terms to be imposed on Customer's technology vendors, Customer will provide those terms to Smores Health in writing before any records subject to them are processed in the Services. Such terms bind Smores Health only when set out in a written addendum signed by both Parties. Customer is responsible for obtaining any approval its contract requires before purchasing or using the Services and for the accuracy of the information it gives the agency about the Services. Smores Health will provide reasonable vendor and security information on request to support that approval. This packet does not represent that Smores Health holds any state cloud authorization, FedRAMP authorization, or agency approval.\n\n{{#orgEducation}}**Education records.** Where Customer is an educational agency or institution subject to the Family Educational Rights and Privacy Act, records that are education records under that Act are handled only as the Parties agree in a signed FERPA addendum, and Customer designates Smores Health a school official with a legitimate educational interest only to the extent stated there. No education record may be routed through the Services before that addendum is signed.{{/orgEducation}}\n\n**Public entity terms.** If Customer is a government agency, county, city, public university, or other public entity, its obligations under public records, procurement, appropriation, and open meetings law are not waived by this packet, and Smores Health will cooperate with a lawful public records request concerning these agreements, subject to the confidentiality terms that apply to participant records and to Smores Health's non-public security and pricing information.\n\n{{#regulatedServices}}## 20. Claims And Electronic Visit Verification Cross-References\n\n{{#claims}}A. Customer's responsibilities as the enrolled billing provider of record, including the accuracy of every claim, participant billing permission, payer enrollment, and claim approval, are stated in the Claims Submission Addendum and are incorporated here by reference.{{/claims}}\n\n{{#minnesotaEvv}}B. To the extent and when Minnesota EVV applies to Customer's services under then-current law, applicable federal approval conditions, and Minne

23sota Department of Human Services guidance, Customer's responsibilities, including participant consent for the transmission of visit and location data, worker setup, and interim use of the state-provided system, are stated in Exhibit B to the Subscription Order Form and are incorporated here by reference. EVV transmission through the Services remains subject to the certification, readiness, and activation conditions in Exhibit B.{{/minnesotaEvv}}\n\n{{/regulatedServices}}\n\n## Execution\n\nThis Addendum is executed by the signatures on the Signing Page at the end of this packet, which apply to each agreement listed there.\n"},data_security:{sourcePath:"docs/legal/contracts/company-packet/07-data-processing-and-security-exhibit.md",sha256:"6d24703940eb8f566d8c97e560ec1cbf637b0788bf1543af88517316c3c0b944",markdown:"# Data Processing Agreement and Security Exhibit (DPA)\n\nThis Data Processing Agreement and Security Exhibit (this **DPA**) is entered into and becomes effective on the date on which the last Party signs the Signing Page of this packet (the **Effective Date**) by and between:\n\n**Customer:** **{{customerLegalName}}**, {{entityDescription}}, with principal address at **{{noticeAddress}}** (the **Customer**)\n\nand\n\n**Smores Health, Inc.**, a Delaware corporation, with principal address at **584 Castro Street, Suite 4102, San Francisco, CA 94114** (**Smores Health**).\n\nCustomer and Smores Health are each a **Party** and together are the **Parties**.\n\n## 1. Background And Incorporation\n\nA. The Parties have entered into a Master Services Agreement of even date, together with the Subscription Order Form{{#claims}} and the Claims Submission Addendum issued under it{{/claims}} (collectively, the **Services Agreement**), under which Smores Health provides a software platform and related services (collectively, the **Services**) to Customer. This DPA is coterminous with the Services Agreement, subject to the survival provisions of Section 13. As of the Effective Date, this DPA replaces any prior data processing agreement between the Parties for the Services and applies to all Customer Data Smores Health holds for Customer, including data received under a prior agreement and during any intervening period, without any gap in protection. The Services may support recovery, wellness, education, peer-support, care-coordination, documentation, communication, administrative, or related workflows only to the extent identified in the Services Agreement or an applicable Order Form.\n\nB. This DPA describes the data-processing and information-security obligations that apply when Smores Health processes Customer Data on Customer's behalf. It supplements the Services Agreement, the Business Associate Agreement and Qualified Service Organization Agreement (**BAA/QSOA**), and the Customer Responsibilities Addendum.\n\nC. In the event of a conflict, the more protective data-handling requirement controls solely with respect to the relevant category of regulated data. This conflict rule does not alter the limitations of liability or remedies in the Services Agreement except to the extent expressly required by applicable law.\n\n## 2. Definitions\n\nCapitalized terms not otherwise defined herein have the meanings given in the Services Agreement, the BAA/QSOA, applicable law, or industry-standard usage.\n\n**Authorized Personnel** means Smores Health employees, contractors, and Subprocessors with a documented need to access Customer Data to perform the Services.\n\n**Customer Data** means data submitted to or generated by the Services on behalf of Customer, including Personal Data and, to the extent Customer routes such information through the Services, Protected Health Information (**PHI**), 42 CFR Part 2 records (**Part 2 Records**), consumer health data, or other regulated information.\n\n**Personal Data** means information relating to an identified or identifiable natural person.\n\n**Processing** means any operation performed on Customer Data, whether or not by automated means, including collection, recording, organization, structuring, storage, retrieval, use, disclosure, transmission, restriction, erasure, or destruction.\n\n**Security Incident** means any confirmed unauthorized access to, acquisition of, use of, disclosure of, alteration of, loss of, or destruction of Customer Data.\n\n**Subprocessor** means any third party that Processes Customer Data on Smores Health's behalf.\n\n## 3. Roles And Scope\n\n3.1 Customer determines the purposes for which Customer Data is submitted to and processed through the Services. To the extent applicable privacy laws use controller, processor, business, service provider, covered entity, business associate, school official, contractor, or comparable terms, the Parties' roles are as stated in the Services Agreement and applicable Data Compliance Addenda. Smores Health acts on Customer's documented instructions except where applicable law requires otherwise.\n\n3.2 Smores Health will Process Customer Data only:\n\n(a) to provide the Services in accordance with the Services Agreement and Customer's lawful written instructions;\n\n(b) as required by applicable law; or\n\n(c) as expressly permitted in this DPA, the BAA/QSOA, the Customer Responsibilities Addendum, or the Services Agreement, including Smores Health's internal operations described

23in Section 9(B) of the Master Services Agreement.\n\n3.3 Smores Health does not sell or otherwise commercialize Customer Data and will not retain, use, or disclose Customer Data for any purpose other than performing the Services and Smores Health's internal operations as described in the Services Agreement, except as expressly permitted by this DPA, the BAA/QSOA, or the Services Agreement.\n\n3.4 **Research and AI improvement.** MSA Section 9(E) and BAA/QSOA Section 3(H) provide ongoing permission to create and use eligible De-identified Data for research, program evaluation, benchmarking, and development, training, testing, and improvement of current or future Smores Health products and AI models. Their eligibility checks, required permissions, exclusions, duration, provider restrictions, and prohibition on re-identification apply here. Applicable restrictions remain effective after de-identification. Customer-directed research involving identifiable Customer Data requires a separate written agreement identifying the permitted purposes and fields and all required legal bases, consents, reviews, and approvals. Signing this packet does not authorize that identifiable-data research or AI training on identifiable Customer Data. Each Party remains responsible for its own duties.\n\n3.5 **Changes in law.** MSA Section 9(G) applies to this DPA, without replacing required terms, approvals, safeguards, or amendments.\n\n## 4. Categories Of Data, Data Subjects, And Duration\n\n**Categories of data subjects:** Customer's Authorized Users, staff, contractors, administrators, supervisors, peers, participants, clients, members, or other end users whose information Customer routes through the Services.\n\n**Categories of Customer Data:** information Customer routes through the Services, which may include contact and account information, messaging and documentation content, assessments and plans, engagement and audit metadata,{{#claims}} insurance, claims, and remittance information,{{/claims}}{{#minnesotaEvv}} electronic visit verification records including service-location data, mileage and trip records including worker device location during an active trip where Customer enables those features,{{/minnesotaEvv}} and other information Customer submits within the agreed scope of the Subscription Order Form.\n\n**Special categories of data:** health, behavioral health, and substance use disorder information, including records protected by 42 CFR Part 2, where Customer lawfully directs such records through the configured Services.{{#minnesotaEvv}} Location data captured for electronic visit verification and for mileage and trip tracking is also processed.{{/minnesotaEvv}}\n\n**Nature and purpose of Processing:** Provision of the Services, permitted internal operations under MSA Section 9(B), creation and use of eligible De-identified Data under MSA Section 9(E), and separately authorized Customer-directed research under Section 3.4.{{#claims}} Claims Submission Services are included only after the applicable activation, readiness, authorization, and other conditions stated in the Claims Submission Addendum have been satisfied for the applicable payer, workflow, and Customer configuration.{{/claims}}{{#minnesotaEvv}} Minnesota electronic visit verification transmission is included only after the certification, readiness, authorization, and other conditions in Exhibit B to the Subscription Order Form have been satisfied.{{/minnesotaEvv}}{{#regulatedServices}} Before activation, Processing related to those services is limited to configuration, testing, implementation, and readiness activities permitted by those documents.{{/regulatedServices}}\n\n**Duration of Processing:** For the term of the Services Agreement and applicable survival periods. Continued use of eligible De-identified Data follows MSA Section 9(E) and does not expand retention rights for source records.\n\n## 5. Security Program\n\n5.1 Smores Health maintains a written information security program with administrative, physical, and technical safeguards reasonably designed to protect Customer Data against unauthorized access, use, alteration, loss, or destruction and to comply with the HIPAA Security Rule at 45 CFR Part 164 Subpart C and the security provisions of 42 CFR 2.16. Any independent audit report made available by Smores Health is subject to its stated scope and review period.\n\n5.2 The program includes, as Smores Health reasonably determines appropriate: encryption of Customer Data in transit and at rest; role-based access controls with multi-factor authentication for privileged access; audit logging; backup and recovery procedures; vulnerability and patch management; secure development and change management; workforce confidentiality obligations and security awareness training; and a written incident response plan and business continuity plan.\n\n5.3 Subprocessors may process Customer Data only as permitted by this DPA, the Services Agreement, and the applicable Data Compliance Addenda, and Customer-Managed Integrations may process Customer Data only at Customer's direction as provided in the Services Agreement. Smores Health currently configures the storage of production Customer Data within the United States and will use reasonable efforts to notify Customer before Smores Health authorizes production Customer Data to be stored outside the United States, except where Customer directs storage through a Customer-Managed Integration or applicable law prohibits advance notice.\n\n5.4 Smores Health may modify its security controls over time, provided the program remains reasonably designed to meet the requirements of applicable law.\n\n## 6. Confidentiality Of Personnel\n\n6.1 Authorized Personnel are bound by written confidentiality obligations covering Customer Data and survive termination of their relationship with Smores Health.\n\n6.2 Smores Health's workforce sanctions process addresses unauthorized access, use, or disclosure of Customer Data.\n\n## 7. Subprocessors\n\n7.1 Smores Health may engage third parties to Process Customer Data on its behalf (Subprocessors), including cloud hosting, clearinghouse, communications, location, and similar service providers, and may add or replace Subprocessors at its discretion.\n\n7.2 Smores Health will enter into a written agreement with each Subprocessor that imposes data-protection obligations appropriate to the nature of the Processing and, where the Subprocessor handles PHI or Part 2 Records, the restrictions, conditions, safeguards, and reporting obligations required by applicable law and the BAA/QSOA. Smores Health is responsible for the acts and omissions of its Subprocessors only to the extent required by applicable law and the BAA/QSOA, and in all cases subject to the limitations of liability and remedies in the Services Agreement.\n\n7.3 Upon Customer's written request, Smores Health will provide a then-current informational list of Subprocessors that Process Customer Data on Smores Health's behalf. Any such list is provided for transparency only, is not incorporated into this DPA, and does not amend or expand Smores Health's obligations under the Services Agreement, this DPA, or the BAA/QSOA.\n\n## 8. Data Subject Rights And Cooperation\n\n8.1 Smores Health will, to the extent te

23chnically feasible, provide reasonable assistance to enable Customer to respond to verifiable data subject requests for access, correction, deletion, restriction, portability, or other rights under applicable law. Assistance beyond the self-service tools in the Services may be subject to Smores Health's then-current professional services rates.\n\n8.2 If Smores Health receives a direct request from a data subject relating to Customer Data, Smores Health will forward the request to Customer promptly and will not respond to the data subject other than to confirm receipt and direct the data subject to Customer, except as required by law.\n\n8.3 The substantive determination and timing of any response to a data subject rights request is Customer's responsibility unless the Parties expressly agree otherwise.\n\n## 9. Security Incident Notification\n\n9.1 Smores Health will notify Customer of any Security Incident affecting Customer Data without unreasonable delay and within the time required by applicable law, including 45 CFR 164.410 where the Customer Data includes PHI.\n\n9.2 Notification will include, to the extent then known, the nature of the incident, the categories of Customer Data affected, the date of discovery, and the containment steps taken, and Smores Health will provide supplemental information as it becomes available.\n\n9.3 Smores Health will reasonably cooperate with Customer's regulatory reporting and individual notification obligations under HIPAA, the HIPAA Breach Notification Rule, 42 CFR Part 2, and applicable state breach-notification laws.\n\n9.4 Notification of a Security Incident is not, by itself, an acknowledgment by Smores Health of fault or liability.\n\n9.5 Smores Health's designated security contact is **[email protected]**. Smores Health will promptly notify Customer of changes to its security contact.\n\n## 10. Audits And Compliance Reports\n\n10.1 On Customer's written request no more than once per calendar year, Smores Health will make available its most recent available SOC 2 Type 2 report (Security criteria), subject to the report's restricted-use terms and reasonable confidentiality undertakings.\n\n10.2 Smores Health has no other obligation to provide audit reports, assessments, policies, or on-site or remote audits to Customer, except as required by applicable law. Smores Health will make its internal practices, books, and records available to the Secretary of HHS as required by the BAA/QSOA.\n\n## 11. Return Or Destruction Of Customer Data\n\n11.1 Upon termination of the Services Agreement, Smores Health will, at Customer's option and to the extent feasible:\n\n(a) make Customer Data available within a reasonable time using existing export formats after Customer requests its data by email before expiration or termination or within thirty (30) days afterward. Customer may use the platform's export features during its subscription; and\n\n(b) within a reasonable time after termination, destroy or de-identify Customer Data in Smores Health's possession, subject to the carve-outs in this Section.\n\n11.2 **Regulated records.** PHI, Part 2 Records, and other regulated records will be returned, destroyed, de-identified, or retained only as permitted by applicable law, Customer's written instructions, and the applicable Data Compliance Addenda. If hard deletion is not technically feasible from backups, audit logs, security records, or legal-hold repositories, Smores Health will protect the retained data under this DPA until deletion or anonymization occurs in the ordinary course.\n\n11.3 **End-user retention.** Smores Health will not retain Customer-controlled regulated records for an end user's independent use after termination unless Customer expressly authorizes that transition in writing or the data is no longer Customer Data under the Services Agreement and applicable law.\n\n11.4 **Backups, logs, and legal hold.** Smores Health may retain Customer Data in backups, audit logs, and security records in accordance with Smores Health's retention practices, and longer where required by applicable law, court order, regulator demand, pending investigation, or legal hold. Retained Customer Data remains subject to this DPA.\n\n11.5 Upon completion of return or destruction, Smores Health will, on written request, provide Customer with written confirmation of completion.\n\n## 12. Limitations And Order Of Precedence\n\n12.1 This DPA does not relieve Customer of its responsibilities under the Services Agreement or any applicable Customer Responsibilities Addendum, including responsibility for the lawful basis for Processing, notices, consents, authorizations, and customer-side regulated documents.\n\n12.2 In the event of a conflict between this DPA and another Data Compliance Addendum on a matter expressly governed by HIPAA or Part 2, the applicable Data Compliance Addendum controls. Where two addenda overlap, the more protective data-handling requirement controls solely with respect to the regulated data at issue.\n\n12.3 This DPA controls over the Services Agreement solely with respect to data-

23processing and security obligations. Except to the extent expressly required by applicable law, the limitations of liability and remedies set forth in the Services Agreement remain applicable.\n\n## 13. Term, Termination, And Survival\n\n13.1 This DPA is effective as of the Effective Date and continues for the term of the Services Agreement and any survival period set forth in any applicable Data Compliance Addendum.\n\n13.2 Sections 5 (with respect to retained Customer Data), 6, 9 (for incidents discovered after termination), 11, and 12 survive termination.\n\n## 14. Notices And Contacts\n\nNotices under this DPA will be delivered as set forth in the Services Agreement. Smores Health will use Customer's contact listed below for onboarding and notices, including Security Incident notifications, unless Customer provides another contact.\n\n**Smores Health security contact:** [email protected], or by mail to Smores Health, Inc., Attn: HIPAA Security Officer, 584 Castro Street, Suite 4102, San Francisco, CA 94114.\n\n\n\n**Customer contact:** {{noticeContactName}}, {{noticeEmail}}. This contact is for coordination and notices and need not be the person who signs.\n\nCustomer may provide a replacement contact by email. If the listed contact cannot be reached, required notices will also be sent to the Customer notice contact and address specified in the Master Services Agreement. Missing or outdated contact details do not extend any notification deadline under the signed agreements or applicable law.\n\n## 15. General Provisions\n\n15.1 **Severability.** If any provision of this DPA is held invalid or unenforceable, the remaining provisions remain in full force and effect.\n\n15.2 **Counterparts; electronic signatures.** This DPA may be executed in counterparts, including by electronic signature.\n\n15.3 **Entire agreement.** This DPA, together with the Services Agreement and any applicable Data Compliance Addenda, constitutes the entire agreement of the Parties with respect to the data processing and security obligations described herein.\n\n\x3c!-- pagebreak --\x3e\n\n## Breach Notification Contact Detail\n\nSmores Health's designated breach notification contact is the HIPAA Security Officer.\n\n**Role:** HIPAA Security Officer\n\n**Email:** [email protected]\n\n**Mail:** Smores Health, Inc., Attn: HIPAA Security Officer, 584 Castro Street, Suite 4102, San Francisco, CA 94114\n\n## Execution\n\nThis DPA is executed by the signatures on the Signing Page at the end of this packet, which apply to each agreement listed there.\n"},signing_page:{sourcePath:"docs/legal/contracts/company-packet/08-signing-page.md",sha256:"5f2e011797d1626b468565e7b55cba4229d1f7c7bd2cbff165165585d245be3d",markdown:"# Signing Page\n\nBy signing below, each Party executes every agreement listed here as of the Effective Date stated in the Master Services Agreement. One signature by each Party applies to all of them.\n\n- Master Services Agreement\n- Subscription Order Form, including its exhibits\n{{#claims}}- Claims Submission Addendum\n{{/claims}}{{#healthData}}- Business Associate Agreement and Qualified Service Organization Agreement\n{{/healthData}}- Customer Responsibilities Addendum\n- Data Processing Agreement and Security Exhibit\n\nEach person signing below represents that they are authorized to bind the Party identified with their signature and that the Party has obtained any approvals required to enter into these agreements.\n\n**Customer: {{customerLegalName}}**\n\nName: {{signerName}}\n\nTitle: {{signerTitle}}\n\nSignature: ________________________________\n\nDate: ______________________________\n\n**Smores Health, Inc.**\n\nName: {{peerakeetSignerName}}\n\nTitle: {{peerakeetSignerTitle}}\n\nSignature: ________________________________\n\nDate: ______________________________\n"}}}}]);

Line numbers count LF bytes from the start of the resource, as the search results do. Vendor segments are library code the classifier recognised; they are stored but not indexed. Bytes are shown as Latin1 characters, one per byte.