Master Subscription Agreement

This Master Subscription Agreement ("Agreement") is between Sefton Health, Inc., a Delaware corporation ("Sefton," "we"), and the customer identified at sign-up or in an Order ("Customer," "you"). It governs Customer's access to and use of the Sefton platform (the "Service"). By creating an account, accepting an Order, or using the Service, Customer agrees to this Agreement. If you act for an organization, you represent you are authorized to bind it.

1.1 "Order" — an ordering document, online sign-up, or plan selection specifying the subscription, seats, and fees.

1.2 "Service" — the Sefton software-as-a-service platform and related applications/APIs.

1.3 "Customer Data" — data Customer or its users submit to the Service, including PHI. PHI is additionally governed by the BAA.

1.4 "PHI" — Protected Health Information as defined in the HIPAA Rules (45 CFR Parts 160, 164).

1.5 "AI Features," "AI Output," "Clinician of Record" — as defined in the AI-Features Addendum.

1.6 "Documentation" — Sefton's then-current usage documentation.

1.7 "Subscription Term" — the period in §6.

2.1 License. Subject to this Agreement, Sefton grants Customer a limited, non-exclusive, non-transferable right to access and use the Service during the Subscription Term for Customer's internal clinical/business operations. The license is not "revocable at will"; it ends or is suspended only per §§6–7.

2.2 Eligibility. Clinician users must be licensed healthcare providers or their authorized agents.

2.3 Acceptable use. Customer will not: use the Service unlawfully; exceed licensed seats; reverse engineer except as permitted by law; resell or provide the Service to third parties; upload malicious code; or use the Service to build a competing product.

2.4 Customer responsibility. Customer is responsible for its users' acts, for credential security and MFA, and for the accuracy and legality of Customer Data. Customer will notify Sefton promptly of any unauthorized access to its accounts.

2.5 AI fair use. Use of AI-assisted features, including documentation and translation, is subject to reasonable fair use. Sefton may contact Customer about, and after notice limit, use that materially exceeds the usage the plan is priced for.

3.1 Fees. Customer pays the fees in the Order on a recurring (e.g., monthly) basis, in advance. Fees are non-refundable except as required by law or expressly stated.

3.2 Trial. Plans may include a free trial. Unless cancelled before the trial ends, the subscription converts to paid at the then-current price.

3.3 Auto-renewal. Subscriptions auto-renew for successive periods unless cancelled per §6.

3.4 Payment processor. Payments are processed by Stripe; Customer authorizes recurring charges. Sefton does not store full card data and keeps payment/subscription payloads PHI-free. Failed payment may lead to suspension after a grace period (§7).

3.5 Taxes. Fees are exclusive of taxes; Customer is responsible for applicable taxes other than Sefton's income taxes.

3.6 Price changes. Sefton may change pricing on reasonable advance notice, effective at the next renewal. Subscription rates may adjust by up to 4% annually at renewal; Sefton will give written notice of any increase at least 30 days before the renewal it applies to.

4.1 Ownership. As between the parties, Customer owns Customer Data; Sefton owns the Service.

4.2 PHI / BAA precedence. Sefton processes PHI as Customer's Business Associate solely to provide the Service, under the BAA, which controls over this Agreement for PHI (45 CFR 164.502(e), 164.504(e)).

4.3 Privacy & security. Sefton maintains administrative, physical, and technical safeguards per the HIPAA Security Rule (45 CFR 164.308, 164.312) and the Privacy Policy.

4.4 Non-PHI personal data breach. For any breach of non-PHI personal information, the parties comply with applicable breach-notification law (e.g., N.J.S.A. 56:8-161 to -166). PHI breaches are governed by the BAA / 45 CFR 164.410.

4.5 Aggregated/de-identified data. Sefton may use data that is de-identified per 45 CFR 164.514(a)-(c) for service operation/improvement. Unless Customer opts out of Network Intelligence, Sefton may also use such data to produce aggregated cross-practice benchmarks, shown only to customers that contribute. Unless Customer separately opts out of research, Sefton may also use such data, in aggregate, for research and publish aggregate findings that identify no individual, clinician, or customer. Sefton will not sell such data, re-identify or attempt to re-identify it, or disclose any customer's identity through these uses. PHI is not used to train AI/ML models (AI-Features Addendum §6.2).

5.1 Sefton IP. Sefton and its licensors own all rights in the Service, software, and Documentation (excluding Customer Data). No rights are granted except the §2.1 license.

5.2 Feedback. Customer grants Sefton a perpetual, royalty-free license to use feedback, with no obligation.

5.3 Third-party / code licensing. CPT® content is licensed to Sefton by the AMA (Distribution License Agreement ID 106526) and provided to Customer subject to the CPT End-User Terms, which Customer accepts before CPT content is first shown. HCPCS and ICD-10 codes are public-domain code sets. See AI-Features Addendum §7.2/§11.3.

6.1 Term. This Agreement runs for the Subscription Term in the Order and renews per §3.3 until terminated.

6.2 Termination for cause. Either party may terminate on material breach uncured within 30 days' notice. Sefton may suspend/terminate for non-payment after notice (§7) or to protect the Service or third parties.

6.3 Termination for convenience / cancellation. Customer may cancel to prevent renewal via account settings effective at period end.

6.4 Effect of termination. Access ends; accrued fees remain due. Sefton will make Customer Data available for export for a reasonable period, then return or destroy PHI per the BAA (45 CFR 164.504(e)(2)(ii)(J)) and delete or de-identify other Customer Data per the Privacy Policy and retention law.

6.5 Survival. §§3 (accrued fees), 4, 5, 8.3, 9, 10, 11, 12, 13, 14.5, 14.9, and this §6.5 survive termination.

7.1 Sefton may suspend access for non-payment after a grace period, a security threat, or a legal-compliance reason, with notice where practicable, restoring access on cure.

8.1 Mutual. Each party warrants it has authority to enter this Agreement.

8.2 Service. Sefton will provide the Service with reasonable skill and care and materially per the Documentation.

8.3 Disclaimer. EXCEPT AS EXPRESSLY STATED, THE SERVICE AND AI OUTPUT ARE PROVIDED "AS IS" AND SEFTON DISCLAIMS ALL IMPLIED WARRANTIES, INCLUDING MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, AND NON-INFRINGEMENT. THE SERVICE IS A TOOL AND DOES NOT PROVIDE MEDICAL ADVICE; CUSTOMER IS RESPONSIBLE FOR CLINICAL, CODING, AND BILLING DECISIONS (AI-Features Addendum §3).

9.1 By Sefton. Sefton will defend Customer against third-party claims that (a) the Service infringes a U.S. patent, copyright, or trade secret, or (b) arise from Sefton's breach of the BAA/HIPAA obligations or its data-security failure causing a breach of unsecured PHI/personal data — and pay resulting damages; excluding claims from Customer Data, Customer's use in breach, or third-party code (e.g., CPT®) used outside license.

9.2 By Customer. Customer will defend Sefton against third-party claims arising from Customer Data, Customer's clinical/coding/billing decisions (AI-Features Addendum §10.3), Customer's breach, or Customer's failure to obtain required patient consents.

9.3 Procedure. Indemnified party gives prompt notice; indemnifying party controls defense; no settlement imposing non-indemnified liability without consent.

10.1 Cap. EXCEPT FOR EXCLUDED CLAIMS, EACH PARTY'S TOTAL AGGREGATE LIABILITY WILL NOT EXCEED THE FEES PAID BY CUSTOMER IN THE 12 MONTHS BEFORE THE EVENT.

10.2 Consequential exclusion. NEITHER PARTY IS LIABLE FOR INDIRECT, INCIDENTAL, SPECIAL, CONSEQUENTIAL, OR PUNITIVE DAMAGES, OR LOST PROFITS/DATA.

10.3 Excluded claims (uncapped): indemnification obligations; breach of the BAA / HIPAA obligations; a party's fraud, willful misconduct or gross negligence; Customer's payment obligations; and infringement of the other's IP.

10.4 Savings (scoped). Nothing limits liability that cannot be limited by law or Sefton's BAA/HIPAA obligations; this clause does not otherwise vacate §§10.1–10.3.

11.1 Each party protects the other's non-public information, using it only for this Agreement. PHI is governed by the BAA, not this section. Standard exclusions (public, independently developed, rightfully received) and compelled-disclosure-with-notice apply.

12.1 Roles. Customer is the Covered Entity (or its BA) and the Clinician of Record; Sefton is the Business Associate. Each complies with HIPAA/HITECH as applicable to its role.

12.2 Customer compliance. Customer is responsible for its regulatory obligations, including licensure, payer rules, claim accuracy (False Claims Act, 31 U.S.C. §3729 — see AI-Features Addendum §7), language-access (ACA §1557 — see Addendum §8.2), and patient consents.

12.3 Anti-kickback / referrals. Neither party will use the Service in a manner violating the Anti-Kickback Statute (42 U.S.C. §1320a-7b) or Stark (42 U.S.C. §1395nn).

12.4 Gated revenue-cycle and telehealth features. Telehealth, automated documentation, eligibility, claim submission and ERA/payment posting depend on third-party services and on Customer's own enrollment and patient consents. Some live revenue-cycle capabilities require configuration, payer or clearinghouse enrollment, or approval before use. Customer is responsible for the payer and regulatory requirements that apply to its use.

12.5 Sample consent and intake documents. Any sample or template consent, notice or intake document Sefton provides (including the telehealth recording and automated-documentation consent) is offered for convenience. Customer alone is responsible for ensuring that the consents and notices it presents to its patients are adequate, accurate and enforceable under the laws that apply to its practice.

12.6 No compliance guarantee. Use of the Service does not by itself make Customer compliant with HIPAA or any other law. Sefton provides tools and safeguards designed to support compliance; Customer remains responsible for its own compliance program, policies, training and obligations as a covered entity.

13.1 Governing law; courts; jury waiver.

(a) New Jersey law governs this Agreement, excluding its conflict-of-laws rules.

(b) Informal resolution first. Before filing suit, a party will send written notice describing the dispute, and the parties' representatives will try in good faith to resolve it for 30 days. This does not apply to a claim for injunctive relief or to collection of undisputed fees.

(c) Courts. The state courts of New Jersey sitting in Bergen County and the United States District Court for the District of New Jersey have exclusive jurisdiction, and each party consents to them. A party may bring a claim within the jurisdictional limit of the Special Civil Part or Small Claims Section of the Superior Court of New Jersey there. Either party may seek injunctive relief in any court of competent jurisdiction to protect its intellectual property or confidential information or to stop a security threat.

(d) JURY WAIVER. EACH PARTY KNOWINGLY AND VOLUNTARILY WAIVES ANY RIGHT TO A TRIAL BY JURY IN ANY ACTION ARISING OUT OF OR RELATING TO THIS AGREEMENT. ALL CLAIMS WILL BE DECIDED BY A JUDGE.

(e) There is no agreement to arbitrate, and nothing in an Order creates one.

13.2 Assignment. No assignment without consent, except in a merger/asset sale with notice; the BAA's subcontractor/assignment terms also apply to PHI.

13.3 Force majeure; Notices; Entire agreement (this MSA + BAA + AI-Features Addendum + Privacy Policy + Orders); Severability; Waiver; No third-party beneficiaries (patients are not third-party beneficiaries). Order of precedence: BAA (for PHI) > AI-Features Addendum (for AI behavior) > this MSA > Privacy Policy > Order. An Order may vary the MSA's commercial terms but may NOT override the BAA, any HIPAA obligation, or the AI-Features Addendum's clinical-responsibility allocation.

13.4 Changes. Changes to this Agreement are governed by §15.

13.5 Contact. Sefton Health, Inc. — admin@sefton.health.

14.1 Insurance. Each party will maintain insurance appropriate to its role. Sefton will maintain cyber/technology errors-and-omissions coverage; Customer will maintain professional liability (malpractice) and general liability coverage.

14.2 Availability / support. Sefton will use commercially reasonable efforts to keep the Service available, excluding maintenance and factors outside its control; support is per the then-current channels.

14.3 Subprocessors. Sefton uses subprocessors to provide the Service (currently AWS for hosting/AI, Stripe for payments, Claim.MD for clearinghouse and ERA). PHI-bearing subprocessors operate under the BAA's flow-down (BAA Part 2). Sefton will maintain the inventory and flow down protections to new PHI-bearing subprocessors.

14.4 Security attestations / audit. On reasonable request and NDA, Sefton will provide available security attestations (e.g., its SOC 2 status, pen-test summary) in lieu of on-site audits, subject to the BAA's HHS-access terms.

14.5 Transition assistance. On termination, Sefton will provide Customer Data export in a commercially reasonable structured format within 30 days of request, then return/destroy PHI per the BAA (§6.4).

14.6 Beta features. Features designated beta/preview are provided "AS IS," excluded from the §8.2 warranty, and may change or be withdrawn.

14.7 Export / sanctions / anti-corruption. Each party complies with U.S. export controls, OFAC sanctions, and the FCPA (15 U.S.C. §78dd-1 et seq.).

14.8 Publicity. Neither party uses the other's name/marks in marketing without prior written consent (email sufficient), except factual existence of the relationship.

14.9 Third-party services. Some features connect to services Customer chooses to use under that third party's own terms (for example a payer portal, an identity provider for sign-in, or Apple Health at a patient's direction). Sefton is not responsible for a third-party service outside its control. This does not limit Sefton's responsibility for its own subprocessors under §14.3 and the BAA.

15.1 Sefton may update this Agreement; material changes are notified by email or in-product at least 30 days before they take effect at the next renewal, and Customer's continued use after the effective date is acceptance; if Customer objects, its sole remedy is to cancel before the effective date.