Kubyk Scale Terms

C.1 Introduction

These Kubyk Scale Terms ("Schedule C") supplement the Kubyk Master Terms of Service (the "Master Terms") and govern your use of the Kubyk Scale Tier of the Kubyk Platform. Capitalized terms not defined in this Schedule C have the meanings given in the Master Terms.

The Kubyk Scale Tier may be used only for a Permitted Activity, and permits the processing of PHI only in connection with a Permitted Activity and only under an executed Business Associate Agreement. The Kubyk Scale Tier does not permit Commercial or Production Deployment (as defined below), which requires a separate enterprise license from KeborMed.

C.2 Definitions

"Auditor" means a User with read-only access to audit logs within the System Admin Portal, granted for audit or inspection purposes. An Auditor has no access to Scale Data or PHI and no ability to create, modify, or delete data or configurations.

"cFMEA" means cybersecurity Failure Modes and Effects Analysis.

"Commercial or Production Deployment" means use of the Kubyk Platform in the ordinary course of delivering healthcare services or other commercial operations to patients, customers, or users, other than solely for research, evaluation, validation, testing, pilot, demonstration, or training purposes. Commercial or Production Deployment includes use of the Kubyk Platform as part of any product or service that is offered, marketed, licensed, sold, leased, distributed, or otherwise made available to third parties for consideration.

"Completion Date" means, for a Permitted Activity, the date on which it ends or, where it is subject to Institutional Review Board or Ethics Committee approval, the date on which that approval lapses or is withdrawn, whichever occurs first.

"CORE" means the core cloud components of the Kubyk Platform that are common to all deployments, excluding add-on cloud services, the portals described in Section C.5, and mobile applications.

"Customer Support User" means a User with the ability to interact only with Tenants that have been assigned to them.

"Data Expectation" means the frequency at which data for a parameter is expected to be received, as configured by you within the Kubyk Platform. A parameter subject to a Data Expectation is reported in one of three states only: pending, where no data has yet been received; current, where expected data has been received; and overdue, where expected data has not been received.

"Data Plane" means the portion of the Kubyk Platform where Scale Data is stored.

"DHT" means Digital Health Technology, as that term is defined in the 2023 FDA Guidance Document Digital Health Technologies for Remote Data Acquisition in Clinical Investigations - Guidance for Industry, Investigators and Other Stakeholders.

"HCP Portal" means the interface through which a Healthcare Provider User accesses the data of the Patients assigned to them.

"Healthcare Provider User" means a User who accesses the HCP Portal in order to view data for the Patients assigned to them within a Tenant.

"KeborMed Master File" means the Master File maintained by KeborMed with the FDA for the CORE components of the Kubyk Platform.

"Patient" means an individual whose data is collected within a Tenant in the conduct of a Permitted Activity, and who may access the Patient Portal.

"Patient ID" means an identifier assigned to a Patient within a Tenant. A Patient ID is used alongside the Patient's name and other PHI and is not a de-identification or pseudonymization mechanism.

"Patient Portal" means the interface through which a Patient accesses their own data.

"Permitted Activity" means the use of the Kubyk Scale Tier solely for research, evaluation, validation, testing, pilot, demonstration, or training purposes which are permitted under Section C.11 of this Schedule C.

"QMS" means quality management system.

"QMS Requirements" means the requirements of ISO 13485:2016 and IEC 62304:2006/A1:2015.

"Scale Data" means Customer Data generated in the conduct of a Permitted Activity and stored in the Data Plane, including any PHI.

"sFMEA" means software Failure Modes and Effects Analysis.

"SLA" means the Service Level Agreement attached as Exhibit A to this Schedule C.

"Super Admin User" means the Kubyk Account Admin User. The Super Admin User has the same rights as a System Admin User within the System Admin Portal, and additionally has access to the Account Management Portal.

"System Admin Portal" means the administrative interface through which the Super Admin User and System Admin Users administer your Tenants, Users, datasources, devices, and settings across all Tenants.

"System Admin User" means a User with full access to manage all functions within the System Admin Portal.

"Tenant" means a discrete, logically isolated workspace within your Customer Account used for the conduct of a Permitted Activity, with its own Users, data, configurations, and access controls.

"Tenant Admin Portal" means the per-Tenant administrative interface through which a Tenant Admin User manages a single Tenant.

"Tenant Admin User" means a User with full access to manage a single Tenant through the Tenant Admin Portal, including Healthcare Provider Users, Patients, devices, and data access within that Tenant.

C.3 Fees

The monthly subscription fee is billed monthly in advance (the "Monthly Fee"). The annual subscription fee is billed annually in advance (the "Annual Fee"). All fees are exclusive of taxes, which will be charged as applicable.

(a) Payment Terms: Fees are due on the first day of each billing period. We do not collect or store credit card numbers; payment information is handled by our payment processor (currently Stripe), and by providing a payment method you authorize us to charge accrued fees on a recurring basis until you cancel.

(b) Non-Refundability: Except as required by law, and except for any refund due on termination by us for convenience or under the SLA, all payment obligations are non-cancelable and fees paid are non-refundable. Failure to pay may result in immediate suspension of your access, subject to Section C.14.

(c) Price Changes: We may adjust pricing with thirty (30) days prior notice. Your continued use after the effective date constitutes acceptance.

C.4 Account Limits

The Kubyk Scale Tier includes two environments: staging and production. The limits set out below (the "Account Limits") apply to the production environment. Limits for the staging environment are those of the Kubyk Lab+ Tier, as set out in Schedule B. Where a storage limit is stated in data points, a "data point" means a single timestamped sensor or device reading stored in the Data Plane, inclusive of any attachments associated with that reading. The storage limit and the data point limit apply independently; the Account Limits for stored data are reached when either figure is met. You are responsible for monitoring your usage against the Account Limits. We will endeavor to notify you as you approach a limit. Where a limit is reached, you will be unable to create further items of the type limited, or to store further data, until the limit is increased. We will not delete Scale Data on account of a limit being reached. Additional capacity may be available at additional cost. Additional capacity does not extend the scope of a Permitted Activity, and the restrictions in Sections C.11 and C.11.4 continue to apply.

C.5 Four-Portal Architecture

The Kubyk Scale Tier includes access to four portal types:

(a) System Admin Portal: Customer-operated portal through which your Super Admin User and System Admin Users administer your Tenants, Users, datasources, devices, and settings across all Tenants.

(b) Tenant Admin Portal: Customer-operated portal for organization management, user provisioning, device registration, and datasource configuration within a single Tenant.

(c) Healthcare Provider (HCP) Portal: Interface through which a Healthcare Provider User views data for the Patients assigned to them within a Tenant and configures Data Expectations.

(d) Patient Portal: Interface through which a Patient views their own data, manages device connections, and shares data with their clinical team.

C.6 PHI Processing and HIPAA Compliance

IMPORTANT: Processing of Protected Health Information (PHI) requires execution of a Business Associate Agreement (BAA).

(a) BAA Requirement: Execution of the standard Kubyk Business Associate Agreement is a condition precedent to your use of the Kubyk Scale Tier and to the processing of any PHI. It must be executed on behalf of the legal entity identified in your Customer Account, by an individual authorized to bind that entity.

(b) HIPAA Compliance: Upon BAA execution, we will implement and maintain appropriate administrative, physical, and technical safeguards as required by HIPAA.

(c) Customer Obligations: You remain responsible for: (i) obtaining all necessary patient consents and authorizations; (ii) ensuring minimum necessary use of PHI; (iii) maintaining your own HIPAA compliance program; and (iv) promptly reporting any suspected security incidents.

(d) Breach Notification: We will notify you of any breach of unsecured PHI within the period, and subject to the exclusions, set out in the BAA.

(e) Scope: PHI may be processed only in connection with a Permitted Activity, only within a Tenant used for that Permitted Activity, and only to the extent necessary for such use. After the Completion Date of a Permitted Activity, no further PHI may be collected for that activity, and PHI already collected may be retained only while your subscription remains in effect and, after termination or suspension, as provided in Section C.14(b), in each case subject to the BAA.

(f) Precedence and lapse: Where the BAA conflicts with this Schedule C or the Master Terms as to the handling of PHI, the BAA controls; in all other respects the Terms govern. If the BAA is terminated or expires, KeborMed may immediately suspend the processing of PHI across the Customer Account.

C.7 Audit Trails and Compliance Features

The Kubyk Scale Tier includes comprehensive audit and compliance capabilities:

(a) Audit Logging: All user actions, data access events, and system changes are logged with timestamps, user identification, and action details. Recent audit log entries are viewable in the System Admin Portal by your Super Admin User, System Admin Users, and Auditors. We retain the complete audit log and its associated metadata for the duration of your subscription, and will provide you with a copy in human-readable form on request. We may also make audit logs available for export within the Kubyk Platform.

(b) Access Controls: Role-based access control (RBAC) with configurable permissions, multi-factor authentication (MFA) requirement, and session management.

(c) Data Encryption: All data encrypted at rest (AES-256) and in transit (TLS 1.3). Customer-managed encryption keys available upon request.

(d) Compliance Evidence: Evidence of our ISO 27001 certification and our HIPAA compliance attestations is available upon execution of an appropriate non-disclosure agreement.

(e) Data Residency: Customer data is stored in Microsoft Azure US regions.

C.8 Data Architecture

The Kubyk Scale Tier maintains dual-plane architecture with enhanced capabilities:

(a) Authentication Plane: Account credentials and User management remain segregated from clinical data.

(b) Data Plane: With the BAA in place, the Data Plane may contain PHI. Patients are identified within a Tenant by Patient ID together with name and other PHI.

(c) Multi-Tenancy: Logical data segregation between Tenants with cryptographic isolation of encryption keys.

C.9 Liability Cap

For purposes of Section 10 of the Master Terms, the Liability Cap for the Kubyk Scale Tier is THE TOTAL FEES PAID BY YOU TO KEBORMED UNDER THIS SCHEDULE C IN THE TWELVE (12) MONTHS PRECEDING THE EVENT GIVING RISE TO THE CLAIM. The Liability Cap applies to all liability arising out of or relating to your use of the Kubyk Scale Tier, including under the Business Associate Agreement. It does not apply to the exclusions set forth in Section 10.3 of the Master Terms.

C.10 Support and Service Levels

Service and support levels are provided in the SLA attached as Exhibit A and the Support Policy attached as Exhibit B.

C.11 Permitted Activities and Restrictions

(a) Permitted Activities only. Subject to execution of a BAA and compliance with your regulatory responsibilities under Section C.13, the Kubyk Scale Tier may be used only for a Permitted Activity. It is not licensed for any other activity, whether or not that activity is commercial, and any other use is a material breach for purposes of Section 11.3 of the Master Terms. An activity is a Permitted Activity only if it is conducted on a device or solution that is not cleared, approved, or commercially distributed, it is not a Commercial or Production Deployment, it is not an activity described in Section C.11.4, and the representations in Section C.11.3 are true in respect of it.

(b) No clinical or monitoring function. You may not use the Kubyk Platform in a therapy delivery, life support, emergency response, patient monitoring, or clinical decision-making function, or rely on it for real-time or time-critical monitoring, whether or not otherwise within a Permitted Activity.

(c) Regulated Devices. The Kubyk Scale Tier may support a Regulated Device only to the extent that support consists of a Permitted Activity. Any other support of a Regulated Device, including any use in a device that is commercially distributed, cleared, approved, or otherwise marketed, requires an enterprise license from KeborMed.

(d) Geographic scope. Each Permitted Activity must be conducted at sites located in the United States, and all Users accessing Scale Data must be located in the United States. Activities involving sites or participants outside the United States require an enterprise license from KeborMed.

(e) Beta Features. No Beta Feature is offered under this Schedule C, and the Business Associate Agreement does not extend to Beta Features.

(f) Consequences. Violation of this Section C.11 permits KeborMed to suspend or terminate your access immediately and without notice.

C.11.1 How the Kubyk Platform Handles Scale Data

(a) No evaluation of values. The Kubyk Platform stores and displays values as received. It does not compare a value against any threshold, range, or criterion, does not characterize a value as normal, abnormal, high, low, or out of range, and does not indicate any such characterization through color, icon, ordering, or any other means. KeborMed makes no clinical claim in respect of any value displayed.

(b) Recorded signals. Where a datasource supplies a recorded physiological signal, the Kubyk Platform stores that recording and displays it as recorded, at standard calibration, so that it can be reviewed as captured. KeborMed does not process, filter, or interpret the signal, derives no rhythm analysis, heart rate, or interval measurement from it, and does not display any classification or finding reported by the recording device. No display of a recording is intended for diagnostic interpretation.

(c) Data Expectations. The Kubyk Platform reports whether data expected under a Data Expectation you have configured has been received, and may notify a Healthcare Provider User when it has not. KeborMed does not supply, recommend, or default any Data Expectation value. Such a report or notification states only whether expected data was received; it does not state or imply a reason for any absence of data, and does not report, characterize, or imply anything about a Patient's condition, conduct, or use of a device.

(d) No monitoring. KeborMed does not monitor the Kubyk Platform, Scale Data, or notifications on your behalf, and does not provide a monitoring service. Delivery of a notification depends on device connectivity, network availability, and third-party messaging providers; it is not guaranteed, is not delivered within any committed time, and may fail without indication. You must not rely on a notification, or on the absence of one, for any clinical, safety, or time-critical purpose.

C.11.2 Your Responsibilities

You are solely responsible for: (i) the review and interpretation of all Scale Data, and for maintaining independent clinical and operational processes for any purpose for which the Kubyk Platform may not be relied upon; (ii) determining what data is necessary for your Permitted Activity and limiting the PHI you place in the Data Plane accordingly, KeborMed having no obligation to review the content of Scale Data; (iii) the creation, assignment, and removal of Users, Healthcare Provider Users, and Patients within your Tenants, the accuracy of the Patient records created, and ensuring that access to PHI is limited to individuals authorized by you, including where you designate a Tenant Admin User at a participating institution; and (iv) maintaining the records required by applicable law and regulation outside the Kubyk Platform.

C.11.3 Representations

You represent and warrant that, at all times while you use the Kubyk Scale Tier, the following are true: (a) where you collect personal data or PHI, each participant whose data you collect has provided informed consent for the collection and processing of their data, or you are otherwise legally authorized to collect and process it, including under a waiver of authorization granted in accordance with 45 CFR §164.512(i); and if a participant withdraws, you will promptly cease collecting their data and will handle data already collected in accordance with the consent obtained, the approval or determination under subsection (c), and applicable law, with any deletion handled under Section C.14(d); (b) no participant receives clinical care through the Kubyk Platform, and none of the participants is in an existing care relationship with you; (c) your Permitted Activity is conducted under, and continues to be covered by, current approval or a favorable opinion from an Institutional Review Board or Ethics Committee, a documented determination by such a body, or by another body or official authorized to make it, that the activity is exempt from review or does not constitute human subject research, or a documented waiver or alteration of a requirement of review or of informed consent granted by such a body, which must remain valid and must not have lapsed, been suspended, or been withdrawn, and a named principal investigator or other responsible individual must be accountable for the conduct of the activity at each participating site; (d) if your Permitted Activity is a clinical investigation of a Regulated Device, it has current Institutional Review Board approval and is conducted under an Investigational Device Exemption, a documented non-significant risk determination, or another documented basis for exemption; and (e) if your Permitted Activity is human subject research or a clinical investigation, clinical trial insurance is in place covering that activity as required by applicable law and by the approving Institutional Review Board or Ethics Committee, and you will provide evidence of that coverage within fifteen (15) business days of KeborMed's request. Some of these matters may be performed or determined by a participating institution or investigator rather than by you. That is sufficient, provided you ensure it has been done and can provide evidence of it on request.

Subsections (c), (d), and (e) apply according to the nature of the activity, whether or not you have characterized it as such. An evaluation, test, or pilot conducted to assess the safety or effectiveness of a Regulated Device in humans is a clinical investigation for purposes of subsection (d). If any of these representations ceases to be true, you must immediately cease the activity to which the representation relates and notify KeborMed within ten (10) business days. KeborMed does not review, approve, or endorse your Permitted Activity, and has no obligation to verify any of the matters represented above.

C.11.4 Activities Requiring an Enterprise License

The Kubyk Scale Tier is not available for, and you may not use it in connection with, an activity in which: (a) the Kubyk Platform serves a function described in Section C.11(b), or the activity requires the evaluation of values against clinical thresholds, out-of-range notification, or any form of monitoring service; (b) any participant is in an existing care relationship with you and is not an enrolled subject of a study conducted under the oversight described in Section C.11.3(c); (c) the activity requires controlled software versioning, formal release qualification, or change control commitments; (d) the activity requires a Letter of Authorization to reference the KeborMed Master File, a supplier qualification audit of KeborMed (other than a qualification based on the Standard Qualification Pack described in Exhibit C), or validation or qualification documentation beyond the Regulatory Support Documentation we provide under Exhibit C; (e) the activity includes sites or participants outside the United States; or (f) the activity requires KeborMed to act in a role beyond that of a business associate providing hosted infrastructure. The Kubyk Scale Tier is delivered on KeborMed's standard release schedule.

C.11.5 Verification

KeborMed may request a written certification, signed by an authorized representative, of your compliance with Section C.11.3. You will respond within fifteen (15) business days, and failure to respond permits KeborMed to suspend the processing of PHI until the certification is provided.

C.12 KeborMed Regulatory Responsibilities; Intellectual Property Warranties and Intellectual Property Indemnification

(a) Maintenance of QMS. We represent and warrant that we maintain, and agree that during the term of your subscription we will continue to maintain, a QMS in accordance with the QMS Requirements. IN ADDITION TO THE WARRANTY DISCLAIMER IN SECTION 8 OF THE MASTER TERMS, WE DISCLAIM ANY WARRANTY THAT THE KUBYK PLATFORM IS SUITABLE FOR ANY MEDICAL OR CLINICAL PURPOSE, THAT IT WILL MEET YOUR REGULATORY REQUIREMENTS, OR THAT IT WILL ACHIEVE ANY PARTICULAR CLINICAL, SAFETY OR PERFORMANCE OUTCOME.

(b) Master File. We will share a copy of the table of contents of the KeborMed Master File with you upon request. For the avoidance of doubt, you will not have access to the contents of the KeborMed Master File. A Letter of Authorization to reference the KeborMed Master File in any filing with the FDA is not available under this Schedule C and requires an enterprise license from KeborMed.

(c) Provision of Documentation. We will provide Regulatory Support Documentation as described in Exhibit C. It may include our sFMEA and cFMEA for the Kubyk Platform. Regulatory Support Documentation describes the Kubyk Platform only. It does not address your device, your protocol, or your use of the Kubyk Platform, and it is not a validation of the Kubyk Platform for your intended use.

(d) Intellectual Property Warranty and Indemnification. We represent and warrant to you that we have the right to license the Kubyk Platform and any third party software or other products provided to you together with the Kubyk Platform. We agree to indemnify, defend and hold you harmless against all claims, damages and liabilities resulting from a claim that the Kubyk Platform, in and of itself, infringes a United States patent, copyright or trademark, provided that you give us prompt, written notice of any such loss, damage or claim, sole control of the defense and settlement of any claim, and all reasonable assistance to defend any claim. Notwithstanding the preceding sentence, we shall not be responsible for, and shall not have an obligation to indemnify you with respect to, any claims of intellectual property infringement to the extent they arise from modifications or customizations of the Kubyk Platform by you or for claims relating to specific clinical use cases. Notwithstanding the preceding provisions of this paragraph (d), in the event of such an infringement we shall have the right to modify the Kubyk Platform so that it is non-infringing, or obtain the right for you to use such third party intellectual property.

C.13 Customer Regulatory Responsibilities and Indemnification

(a) General. You are responsible for compliance with all regulatory requirements for the use of the Kubyk Platform in your Permitted Activity, including without limitation complying with the requirements of 21 CFR Part 812 applicable to clinical studies; determining whether or not you are required to file an investigational device exemption (IDE) application with the FDA; fulfilling any applicable institutional review board requirements; and obtaining informed consent from trial subjects.

(b) Sponsor Acknowledgment. You acknowledge that, while we are a supplier of software to manufacturers of Regulated Devices and maintain the KeborMed Master File with the FDA, we are not a manufacturer of medical devices; and the Kubyk Platform and the KeborMed Platform are not medical devices as they are not designed to diagnose, treat or prevent any particular disease. You further acknowledge that you have not relied on, and shall have no remedy arising from, any statement, representation, description, or other information provided in our marketing materials, presentations, website content, product descriptions or other promotional communications, it being understood that any such materials are provided solely for general information purposes and do not constitute a warranty, representation, or guarantee of any kind regarding the Kubyk Platform, its performance, or its suitability for any medical, clinical, or regulatory purpose.

(c) Sponsor Responsibilities. You shall have the responsibilities of a sponsor or other regulated entity under the 2023 FDA Guidance Document Digital Health Technologies for Remote Data Acquisition in Clinical Investigations Guidance for Industry, Investigators and Other Stakeholders (the "FDA Guidance"), the FDA’s guidance Electronic Systems, Electronic Records, and Electronic Signatures in Clinical Investigations: Questions and Answers (October 2024), and the FDA’s guidance Conducting Clinical Trials With Decentralized Elements (September 2024), in each case as amended or superseded and to the extent applicable to your Permitted Activity. You shall be responsible for determining that the Kubyk Platform is "fit for purpose" for use as a DHT in the investigation (as that term is used in the FDA Guidance), and for any verification and validation required to reflect the use of the Kubyk Platform together with your device for its intended purpose. You acknowledge that any sFMEA or cFMEA delivered by us to you pursuant to Section C.12 only outlines general risks associated with use of the Kubyk Platform, and that it is your responsibility to analyze the specific risks associated with the use of the Kubyk Platform in your Permitted Activity based upon the intended use and user needs of the Kubyk Platform for that Permitted Activity, and to develop a risk management plan as required by the FDA Guidance.

(d) Indemnification. In addition to your indemnification obligations under Section 9 of the Master Terms, you agree to indemnify and hold us and our affiliates, officers, directors and agents from and against any and all claims, damages, losses, liabilities and expenses (including reasonable attorneys' fees) arising out of or relating to your use of the Kubyk Platform in a Permitted Activity, including but not limited to: injuries or adverse events involving study participants; claims arising from your medical device, software, algorithms, or clinical protocols; and claims alleging failure to comply with applicable laws, regulations, or IRB requirements.

C.14 Data Retention and Deletion

(a) Active Subscription: Customer Data is retained for the duration of the subscription.

(b) Post-Termination: For thirty (30) days following the effective date of termination or suspension for non-payment (the "Retrieval Period"), KeborMed will maintain Scale Data in a retrievable state and provide access to export it, restoring export-only access where access has been suspended. Where we terminate for convenience under Section C.15(a), or give notice of non-renewal under Section C.15(a), the Retrieval Period is ninety (90) days at no additional charge. In any other case, you may extend the Retrieval Period to a total of up to ninety (90) days by written request given before the Retrieval Period ends, provided that all outstanding fees have been paid, at a fee of fifty percent (50%) of the Monthly Fee for each additional period of thirty (30) days or part of one, payable in advance. You are solely responsible for exporting and retaining all Scale Data required for your record retention obligations before the Retrieval Period ends. After the Retrieval Period, data will be securely deleted within sixty (60) days, subject to legal holds or regulatory requirements.

(c) Audit Logs: We retain audit logs and their associated metadata for the duration of your subscription. A copy is available to you on request, in human-readable form, during your subscription and during the Retrieval Period in Section C.14(b). Retaining audit logs for as long as the records to which they relate, as required by the regulations applicable to you, remains your responsibility under Section C.11.2.

(d) Data Deletion: Where you need Scale Data deleted, whether on a participant's withdrawal, at the direction of an Institutional Review Board or Ethics Committee, or for any other reason, KeborMed shall perform the deletion upon your written request. Deletion may be subject to a separate statement of work where the scale or accumulated volume of such requests warrants it. Audit log entries and routine backup media are not affected.

C.15 Term and Renewal

(a) Term and Renewal. Your subscription begins on the date your first billing period starts and continues for successive billing periods, monthly or annual according to the plan you select, renewing automatically at the end of each period unless either party gives notice of non-renewal at least thirty (30) days before the renewal date. Either party may terminate in accordance with Section 11.2 of the Master Terms. Fees already paid are not refunded on termination, except as provided in Section C.3(b).

(b) Downgrade. You may not downgrade from the Kubyk Scale Tier to the Kubyk Lab Tier or the Kubyk Lab+ Tier. If you wish to use a lower tier, you must terminate your subscription in accordance with the Master Terms and establish a new Customer Account.

(c) Upgrade from a prior tier. Where you upgrade from the Kubyk Lab Tier or the Kubyk Lab+ Tier, this Schedule C applies from the effective date of the upgrade; no PHI may be introduced before the Business Associate Agreement has been executed; datasource and device configurations may be carried over but Customer Data created under the prior tier is not migrated, and you are solely responsible for exporting it and for confirming that any carried-over configuration is appropriate for your Permitted Activity; and Customer Data created under a prior tier remains subject to the restrictions of that tier, upgrading being neither a cure for nor a defense to any breach of those restrictions occurring before it.

C.16 Clinical Use Disclaimer

THE KUBYK SCALE TIER IS NOT A MEDICAL DEVICE AND IS NOT INTENDED FOR USE IN THE DIAGNOSIS, CURE, MITIGATION, TREATMENT, OR PREVENTION OF DISEASE. IT IS NOT INTENDED FOR USE IN PATIENT CARE, IN COMMERCIAL OR PRODUCTION DEPLOYMENT, OR IN ANY APPLICATION WHERE FAILURE COULD RESULT IN PERSONAL INJURY, DEATH, OR SIGNIFICANT PROPERTY DAMAGE. THE KUBYK PLATFORM MUST NOT BE RELIED UPON FOR REAL-TIME MONITORING, ALARMING, OR ANY TIME-CRITICAL CLINICAL FUNCTION. NO CLINICAL DECISION MAY BE MADE ON THE BASIS OF DATA PRESENTED BY THE KUBYK PLATFORM WITHOUT INDEPENDENT VERIFICATION.

Exhibit A: Kubyk Scale Tier Service Level Agreement

The Kubyk Platform is Internet-based. You acknowledge that the Internet is neither owned nor controlled by any one entity, and that we rely on third party hosting providers (currently Microsoft Azure). Therefore, we cannot warrant or guarantee that you will be able to access the Kubyk Platform at any given time with respect to causes beyond our control described in detail in Section 4 below.

1. We will be responsible for the maintenance and performance of the Kubyk Platform.

2. We will endeavor to provide 99.5% uptime in any calendar month, excluding maintenance covered by Section 3 below.

2.1 "Downtime" means your inability to access the Kubyk Platform, excluding issues local to your premises, force majeure, third party hosting providers or upstream Internet connectivity; and

2.2 "Uptime" means the time that the Kubyk Platform is working and available to you.

2.3 Downtime does not include any period during which your access is suspended or restricted in accordance with the Terms, or during which write operations are declined because an Account Limit has been reached.

3. We may be required to complete both routine and scheduled, and non-scheduled maintenance of the Kubyk Platform, and you consent to us performing such maintenance of the Kubyk Platform as required, giving you as much prior notification as is practicable.

4. We shall not be liable for problems, disruptions, interruption or failure of telecommunication or digital transmission links, including those provided by third party hosting providers, failure of data transmission, delays or other failures or causes outside of our control, to the extent they could not have been prevented by any commercially reasonable action or inaction on our part, and which by exercise of commercially reasonable diligence we are unable to overcome, including but not limited to, to the extent related to:

4.1 misuse of the Kubyk Platform by you or your Users;

4.2 issues due to Internet Service Provider, hostile network attacks, network congestion;

4.3 any fault or negligence on the part of you or your Users, including any failure or delay in recovery of service attributable to your failure to provide timely access, information, or cooperation;

4.4 any services or equipment directly provided by you, your Users, or any of your third-party vendors/suppliers;

4.5 any failure of you or your Users to provide a suitable environment for, or to properly maintain, any computer equipment and/or hardware used to access the Kubyk Platform;

4.6 any loss of or interruption in the source of power, systems, or connections provided by suppliers by subcontractors;

4.7 any force majeure occurrence;

4.8 any Custom Local Datasource, Custom Remote Datasource, or other code, configuration, or endpoint supplied, hosted, or controlled by you, including the availability, latency, or correctness of any server or service to or from which the Kubyk Platform sends or receives data at your direction;

4.9 any Device registered by you, or the connectivity between such a Device and the Kubyk Platform; and

4.10 any third-party service or data source you elect to connect to the Kubyk Platform.

Paragraphs 4.1, 4.3, 4.4, 4.5, and 4.8 to 4.10 apply without regard to the commercial reasonableness qualification in the opening sentence of this Section 4.

5. If the Uptime for a calendar month is below 99.5%, You shall be entitled to a credit, or if you have prepaid a refund, against the fees attributable to that month, being the Monthly Fee or, for annual subscriptions, one twelfth of the Annual Fee in accordance with the table below. The issuance of credits or refunds is the sole and exclusive remedy of you and our sole and exclusive obligation, for any failure of KeborMed to satisfy this Service Level Agreement. In order to receive a credit or refund, you must notify us in writing within fifteen (15) days from the time you become eligible to receive a credit.

Exhibit B: Support Policy

1.0 Scope and Coordination

We will provide support to you as described in this policy. You agree to follow our standard support procedures to receive support services.

1.1 Scope. Our support obligations under this policy apply only to the components of the Kubyk Platform operated by us. They do not apply to components configured or operated by you or on your behalf, including custom local datasources, devices, device firmware, your network, your identity provider, or any third-party service you connect to the Kubyk Platform.

1.2 Exclusions. The exclusions set out in Section 4 of Exhibit A apply equally to this policy, including issues attributable to third-party hosting providers, Internet service providers, network congestion, your or your Users' acts or omissions, equipment or services provided by you or your vendors, loss of power or supplier connections, and force majeure.

1.3 Response times are targets. The response times set out in Section 4.0 are targets and not commitments. Our failure to meet a response time is not a breach of this policy, Schedule C, or the Master Terms. Where a support issue involves the availability of the Kubyk Platform, the credits described in Exhibit A are your sole and exclusive remedy and our sole and exclusive obligation.

2.0 Services Provided

We will provide the following support services:

• Monitoring of core infrastructure components.
• Assistance in identifying and resolving issues related to the Kubyk Platform.

3.0 Support Levels

Tier 1 Support

Initial issue identification and basic troubleshooting performed by you. For the avoidance of doubt, you will be responsible for interfacing with all third parties (e.g., clinical trial subjects and healthcare providers).

Tier 2 Support

Issue investigation and resolution by us for problems escalated from Tier 1.

All support communications under this policy will be conducted by email, using the address set out in Section 4.0.

4.0 Performance Guidelines

Support Channel: Email (support@kebormed.com).

You must report issues by email. We may make additional channels available at our discretion.

Business hours are 9:00 a.m. to 5:00 p.m. United States Eastern time, Monday through Friday, excluding United States federal holidays. Response targets apply during business hours only.

5.0 Excessive Use of Support Resources

Because the Kubyk Scale Tier is designed for light-touch support, support in excess of the levels typical for this tier may be subject to a separate statement of work.

Exhibit C: Kubyk Regulatory Support

1. Purpose. We will support your use of the Kubyk Platform in your Permitted Activity and related regulatory submissions as described in this Exhibit, so that you can (a) describe the Kubyk Platform in a regulatory submission relating to your Permitted Activity, and (b) evaluate us as an information technology service provider, including under the FDA’s guidance Electronic Systems, Electronic Records, and Electronic Signatures in Clinical Investigations: Questions and Answers (October 2024) and related FDA guidance on digital health technologies and decentralized elements in clinical investigations.

2. Regulatory Support Documentation. On your written request, we will provide documentation describing the Kubyk Platform and our related processes (“Regulatory Support Documentation”), to the extent reasonably necessary for the purposes in paragraph 1. We will determine the form, scope, and level of detail of the Regulatory Support Documentation in good faith, having regard to the purpose of your request. It may consist of summaries, descriptions, or excerpts of our internal documentation rather than the internal records themselves. We provide Regulatory Support Documentation in our standard form, once for each Permitted Activity, together with any updated version we have since issued if you request one. We may publish an index of currently available Regulatory Support Documentation. Any such index is for information only, does not form part of the Terms, and may change from time to time.

3. Timing. We will use commercially reasonable efforts to provide Regulatory Support Documentation promptly following your request, and in any event within thirty (30) days.

4. Versions. Regulatory Support Documentation describes the version of the Kubyk Platform identified in it, as of the date it is provided, and we may update it from time to time. On request, we will identify the version of the Kubyk Platform in use for your Tenants and the versions in use during a period you specify, as recorded in our release records. This is an identification of versions only. It is not a commitment to controlled software versioning, formal release qualification, or change control, which are addressed in Section C.11.4(c).

5. Standard Qualification Pack. We make available a standard, pre-completed response to common supplier qualification questions about KeborMed and the Kubyk Platform, together with evidence of our certifications (the “Standard Qualification Pack”). The Standard Qualification Pack is the same for all customers of the Kubyk Scale Tier and forms part of the Regulatory Support Documentation.

6. Review of underlying records at FDA request. Other than the sFMEA and cFMEA referred to in Section C.12(c), our design and development records, verification and validation records, standard operating procedures, change control records, and information security records are our Confidential Information and are not provided as copies. Where FDA, in connection with an inspection relating to your Permitted Activity, requests to review records underlying the Regulatory Support Documentation, we will make the relevant portions available for review by FDA remotely, in read-only form, promptly following your request, at rates we quote in advance. We will not delay making records available to FDA pending agreement on those rates.

7. Regulatory inspections. If FDA or another regulatory authority asks to inspect us, or records we hold, in connection with your Permitted Activity, we will cooperate reasonably and, unless legally prohibited, notify you promptly. Any access we provide to Scale Data in connection with such an inspection will be limited to what is required by law, consistent with Section 14.3 of the Master Terms and the Business Associate Agreement.

8. Scale Data and audit logs. Scale Data and audit logs are not Regulatory Support Documentation. Audit logs are available to you as described in Sections C.7(a) and C.14(c), and Scale Data as described in Section C.14.

9. Scope. Regulatory Support Documentation describes the Kubyk Platform as provided by us. It does not cover any Custom Local Datasource, Custom Remote Datasource, Device, configuration, or integration supplied or made by you or a third party, for which you are responsible.

10. Nature of the support. Regulatory Support Documentation consists of factual descriptions of the Kubyk Platform and of our processes. It is not a validation of the Kubyk Platform for your intended use, and it does not constitute a determination that the Kubyk Platform is fit for purpose in your Permitted Activity, which remains your responsibility under Section C.13(c). It is not a representation about the regulatory status or classification of any product you develop or use with the Kubyk Platform. Nothing in this Exhibit expands the Permitted Activity or the uses permitted under Section C.11 or Sections 1.1 and 4.9 of the Master Terms.

11. Your regulatory obligations. In addition to your responsibilities under Sections C.11.2 and C.13, you are responsible for: acceptance testing for your intended use; your data management and safety monitoring plans; maintaining your list of authorized data originators; training your personnel and participants and keeping records of that training; and submitting any letter of non-repudiation required for your use of electronic signatures. We do not assume any of your regulatory obligations under this Exhibit, including any sponsor obligations that may be transferred to a contract research organization or similar party.

12. Confidentiality and retention. Regulatory Support Documentation is our Confidential Information under Section 7 of the Master Terms. You may disclose it to the FDA and other regulatory authorities, Institutional Review Boards and Ethics Committees, and your auditors and advisors who are bound by confidentiality obligations, to the extent needed for the purposes in paragraph 1. Notwithstanding Section 11.4(c) of the Master Terms, you may retain Regulatory Support Documentation after termination for as long as you need it to meet your record retention obligations for your Permitted Activity, subject to your continuing confidentiality obligations.

13. Fees and exclusions. Regulatory Support Documentation in our standard form, including the Standard Qualification Pack, the table of contents of the KeborMed Master File described in Section C.12(b), and the support described in paragraphs 4 and 7 are included in your Monthly Fee or Annual Fee. The support described in paragraph 6 is provided at rates we quote in advance. Completing your questionnaires or templates, producing customized documentation, and supporting audits or regulatory inspections of you beyond paragraphs 6 and 7 are not included and may be subject to a separate statement of work. A Letter of Authorization to reference the KeborMed Master File, and supplier qualification audits of KeborMed, are not available under this Schedule C, as set out in Sections C.11.4(d) and C.12(b).