Master Services Agreement

This Master Services Agreement (which, with any Order Form, as defined below, shall be referred to herein as the “Agreement”) is entered into as of * (the “Effective Date”) set forth on execution of an order form that references this agreement, by and between nPhase, Inc., a Delaware corporation (“nPhase”), with offices at 1015 Atlantic Blvd #328, Atlantic Beach, FL 32233, and Customer. (“the Customer”). Both nPhase and Customer may be referred to as the “Parties” or, individually, as a “Party.” For and in consideration of the mutual covenants set forth herein, and for other good and valuable consideration, the Parties hereto agree as follows:

1. SERVICES AND SUPPORT.

• nPhase shall provide hosted services consisting of web-based access to nPhase’s proprietary tools as further described in the attached nPhase Order Form, (the “Applicable nPhase Application” or the Application”), and any other order forms fully executed by the Parties after the Effective Date (each, an “Order Form”) and related support services (collectively, the “Services”) in Schedule 1. A separate Order Form shall be required for each study (or groups of studies, where expressly stated in the Order Form) or other services for which Customer seeks to use the Services. All Order Forms shall be governed by, and made a part of, this Agreement. If Customer’s usage for a particular study or service exceeds that shown in the applicable Order Form, nPhase shall charge Customer for such additional usage at rates comparable to those in such Order Form prior to the application of any discount (unless otherwise stated in the applicable Order Form). nPhase reserves the right to change its rates for the Services, and to impose additional fees, with respect to any new Order Form entered in connection herewith.
• Customer shall be responsible for obtaining and maintaining all equipment and ancillary services needed to connect to, access or otherwise use the Services (collectively, “Equipment”), and for ensuring that the Equipment is compatible with the Services and complies with the specifications in nPhase’s then-current published policies. Customer also shall be responsible for maintaining the security of the Equipment, its account, all passwords and files, and for all use of the Services through its registered account.
• Subject to the terms in Schedule 1, nPhase shall provide Customer with technical support (or other support that may be agreed to on an Order Form), in accordance with the terms of this Agreement. nPhase will use its best efforts to provide 98.5% Uptime (24x7x365) of the Services, per calendar month, excluding regularly scheduled maintenance times, which shall not exceed 2.5 hours per calendar week, and excluding outages beyond nPhase’s control (such as those caused by Customer’s computers or connectivity, performance failure’s by nPhase’s web hosting service provider or a general internet failure). As used herein, “Uptime” means availability and access to the Services by Customer.
• Customer understands and accepts that nPhase will be providing the Services over an online hosted service using an external data center provider for its cloud infrastructure. Customer may access the Services by various means, including a public Internet network or common carrier connection or other TCP/IP-enabled network connection (“Network Connection”) provided by an Internet Service Provider, online service provider or another network provider. Customer understands and accepts that the reduced performance or non-availability of this Network Connection may result in reduced performance, interruption or temporary termination of the Services. Customer further understands and accepts that nPhase bears no responsibility for the performance or availability of the Network Connection or the performance failures of the external data center provider

2. STUDIES. The terms of each Order Form shall apply solely to the study (or group of studies) identified in such Order Form. Upon completion of each study, Customer shall notify nPhase and the study will be archived. Other arrangements such as maintaining the study live after completion may be made on request and subject to nPhase’s then-current policies with respect thereto. If a Customer exceeds the study use scope permitted as set forth in the applicable Order Form (“Overage”), nPhase may invoice Customer for such Overage, and Customer agrees to promptly execute an additional Order Form for such Overage and pay the subscription fees due in accordance with this Agreement.

3. REGISTRATION; LOG-IN INFORMATION. Customer shall be given log-in user names and initial passwords (the “Log-In Information”). Customer shall be responsible for maintaining the confidentiality and security of its Log-In Information, and shall be fully responsible for all activities which occur as the result of access using the Log-In Information. Customer shall immediately notify nPhase at [email protected] of any actual or suspected unauthorized use of its Log-Information or similar breach of security.

4. FEES. Unless otherwise stated in the Order Form, nPhase shall invoice Customer electronically (or at Customer’s request, in hard copy) at the beginning of each calendar month during which the Services shall be performed. All invoices shall be paid within thirty (30) days of the date of invoice. In the event of an error in any invoice, no adjustment shall be made unless Customer has contacted nPhase in writing (which may be via e-mail to [email protected] with confirmed receipt) within sixty (60) days of the date of the disputed invoice. Unpaid invoices are subject to a finance charge of 1.5% per month on any outstanding balance, or the maximum permitted by law, if lower, plus all expenses of collection. Customer shall be responsible for all applicable duties, withholdings and taxes associated with sale or use of the Services. If any charge owing by Customer under this agreement for services is 30 days or more overdue, nPhase may suspend Services until such amounts are paid in full, provided that nPhase will give Customer at least 10 days’ prior notice that its account is overdue before suspending services to Customer.

Investigator Initiated Studies Non-Commercial/Non-Sponsored Studies (IIS): nPhase offers discounted pricing for non-commercial studies. Investigator Initiated Studies that are Non- Commercial /Non-Sponsored Studies are studies that do not 1) have a commercial sponsor (or receive funding from a commercial entity) for a clinical trial or evidence program; 2) advance claims for a sponsor’s product; 3) have their study data shared to anyone other than the Customer; or 4) sell the data resulting from the study. All other studies that do not meet this definition are classified as Commercial studies and have Commercial study pricing. The Customer is responsible for checking to see if it is being billed correctly for commercial vs non-commercial studies. If the Customer intends to use the nPhase services for commercial studies, and has only been billed for non-commercial studies for these studies, then it must inform nPhase so that nPhase can provide a commercial study pricing offer. Customer will provide information to confirm its non-commercial studies are non-commercial upon request by nPhase. If upon review, it is determined that the Customer has paid non-commercial study rates for commercial studies, then Customer is obligated to pay the commercial rate for these studies retrospectively and prospectively.

The Build, UAT, and Production environments may only be used for contracted studies. If any non-contracted study is created in the Build, UAT, or Production environments at any time nPhase may bill for that study at the rate of its Tier 3 SaaS list-rate starting from the earliest date of the non-contracted study creation.” The Sandbox environment is for provided to the Customer for trial purposes only. Customer agrees not to run actual studies in the Sandbox environment. Customer agrees to only create Studies in the Applicable nPhase Application that are contracted for. When creating a new study in the Application, Customer agrees to enter into the Study Name field in the Applicable nPhase Application that same study name supplied in the Protocol Title on the applicable order form. If parameter limits of an order form are exceeded, then Customer will be obligated to pay the full commercial rate for this excess, unless otherwise stated in the applicable order form.

With respect to prices in any given Order Form: Unless otherwise stated in the applicable Order Form, prices may be increased annually, but not to exceed a rate per year equal to the cumulative trailing one (1) year Consumer Price Index (CPI) as reported by the U.S. Bureau of Labor Statistics.

5. RESTRICTIONS ON USE. This is a contract for services only. The underlying software used to provide Software as a Service shall be maintained only by nPhase; no license is granted in it to the Customer. Customer shall not, directly or indirectly: reverse engineer, decompile, disassemble or otherwise attempt to discover the source code, object code or underlying structure, ideas or algorithms of the Services or any software or documentation related to the Services (“Software”); modify, translate, or create derivative works based on the Services or any Software; copy, rent, lease, distribute, pledge, assign, mask or otherwise use in a manner that conceals the fact that the product being used is an nPhase Application , or otherwise transfer or encumber rights to the Services or any Software; or use the Services or any Software for timesharing or service bureau purposes or otherwise for the benefit of a third Party. Customer shall not resell nPhase Software as a Service to any third party. Customer shall not distribute for no charge nPhase Software as a Service to any third party, other than that required for a specific study that is contracted under an executed Order Form with nPhase.

6. CONFIDENTIAL INFORMATION. Each Party (the “Receiving Party”) has disclosed or may disclose information relating to the other Party’s business (“Proprietary Information” of the “Disclosing Party”), provided however that nothing other than Service Data (as defined below) shall be considered Proprietary Information of Customer unless either the information is or was disclosed in written form (including e-mail) and is conspicuously marked “Confidential” or “Proprietary,” or it is identified as confidential or proprietary when orally disclosed and is then delivered in the appropriately marked form within ten (10) days of oral disclosure. The Receiving Party shall: (i) take reasonable precautions to protect such Proprietary Information, and (ii) not use (except as expressly permitted herein) or divulge to any third person any such Proprietary Information. Except with respect to Service Data, the Disclosing Party agrees that the foregoing shall not apply if the Receiving Party can document that the information (a) is or has become generally available to the public other than through breach of this Agreement or any similar obligation of confidentiality by anyone; (b) was in its possession or known by its prior to receipt from the Disclosing Party other than through anyone’s breach of confidentiality; (c) was rightfully disclosed to it by a third Party; (d) was independently developed without use of any Proprietary Information of the Disclosing Party; or (e) is required by law or regulatory or judicial order to be disclosed, in which case the Receiving Party shall provide written notice to the Disclosing Party prior to any required disclosure and cooperate with the Disclosing Party, at the Disclosing Party’s expense, in limiting disclosure to the greatest extent possible. Notwithstanding anything to the contrary in this Agreement, nPhase may collect and use, on an entirely anonymous and aggregated basis, the Service Data, provided however that no such use shall identify or otherwise be linked to Customer or any of its Clinical Data (or any test subject related to such Clinical Data), or otherwise make it possible for any third Party to associate Customer with any services provided by nPhase or to associate any Clinical Data with any test subject. “Service Data” shall mean all data contained in the Services including but not limited to configuration information, usage information, access logs, Clinical Data and other Customer-entered data. “Clinical Data” is all data entered by Customer in the Services that is based on direct observation of, or reporting by or otherwise directly related to, a test subject. During the term of this Agreement and for a period of twelve (12) months thereafter, each party agrees not to solicit for employment or engagement, directly or indirectly, any employee of the other party.

7. TERM AND TERMINATION.

• Term. This Agreement shall commence on the Effective Date and shall continue for three (3) years (the “Initial Term”), and then automatically renew for subsequent one-year terms (each, a “Renewal Term”), unless one Party notifies the other in writing, no less than thirty (30) days prior to end of the Initial Term or any Renewal Term, of its intention not to renew, or unless otherwise terminated in accordance with this Agreement. The Initial Term and any Renewal Term(s) shall collectively be referred to herein as the “Term.”
• Termination for Cause. Either Party may terminate this Agreement in the event of breach of a material obligation by the other Party if such breach remains uncured to the reasonable satisfaction of the non-breaching Party thirty (30) days after written notice specifying the breach. nPhase may terminate this Agreement upon ten (10) days prior written notice if Customer fails to pay the full amount of any invoice (other than invoices subject to reasonable dispute) when due, if such amount is not paid within the ten-day cure period. Either Party may terminate this Agreement immediately by written notice if the other Party becomes insolvent, is dissolved or liquidated (except for reorganization), makes a general assignment for the benefit of its creditors, files or has filed against it a petition for bankruptcy, or has a receiver appointed for a substantial part of its assets.
• Other Termination by Customer. Customer may terminate this Agreement or any Order Form hereunder immediately upon written notice if (i) authorization from the FDA or other regulatory authority is withdrawn, (ii) Customer’s client, if applicable, terminates for safety or ethical reasons, or (iii) Customer’s client, if applicable, modifies or terminates the applicable agreement between it and Customer, or (iv) the Customer client or Customer modifies the applicable study in a manner that eliminates the need for the Services. In the event of any termination requested by Customer under this Subsection 7(c), there shall be no refund of any pre-paid amounts, provided however that nPhase shall provide a credit of such unused pre-paid amounts to any future Order Forms.

8. COMPLIANCE WITH APPLICABLE LAWS. Each Party shall comply with all laws and regulations applicable to the Services, including but not limited to the requirements of the Health Insurance Portability and Accountability Act (“HIPAA”) governing Personal Health Information (“PHI”), as defined in the Privacy Rule and the Security Rule of HIPAA (collectively, “Applicable Laws”). When using the Services, Customer shall ensure that its staff is fully trained in handling all PHI in compliance with all Applicable Laws that PHI collected by Customer is correctly designated as such, and that appropriate controls on access to and use of the Services are implemented and monitored by Customer. Customer understands and agrees that nPhase shall have no responsibility or liability of any kind relating to the dissemination or use of any Clinical Data or any material derived from any Clinical Data once it leaves the direct control of nPhase (e.g., by screen shot, export, report, etc.).

9. INDEMNITIES.

• nPhase hereby agrees to indemnify, defend and hold harmless Customer and its parents, subsidiaries, affiliates, officers, directors and employees, from all losses, liabilities, costs, damages, penalties, fines and expenses, including reasonable attorneys’ fees (collectively, “Losses”) arising from any and all third-Party claims, demands, threats, suits or proceedings (each, a “Claim”) arising from any breach by nPhase of Section 8 (Compliance with Applicable Laws), or from any allegation that the Services infringe, violate or misappropriate the intellectual property rights of any third Party that occurs as a result of nPhase’s negligent acts, errors or omissions.
• Customer agrees to indemnify, defend and hold nPhase and its parents, subsidiaries, affiliates, officers, directors and employees, harmless from all Losses arising from any and all Claims arising from any negligent act error or omission of Customer in breach of this Agreement, including but not limited to any violation of any Applicable Law in connection with Customer’s use of the Services.
• If any Claim is asserted or instituted with respect to which Customer or nPhase is entitled to indemnification, then the Party seeking indemnification shall promptly notify the indemnifying Party of all material details of such Claim known to it. The Party seeking indemnification shall cooperate with the indemnifying Party in the defense of the Claim, and shall not compromise or otherwise settle any such Claim without the indemnifying Party’s prior written consent, which shall not be unreasonably withheld, delayed or conditioned.

10. PROPRIETARY RIGHTS. Customer acquires only the right to use the Services, and does not acquire any rights of ownership whatsoever in or to the Services, or any technology used to provide the Services. All rights, title, and interest in and to the Services and (other than content created as a result of use of the Services by Customer), the material on the nPhase Web site, including without limitation all intellectual property rights therein, shall at all times exclusively remain with nPhase. All rights not expressly granted to Customer under this Agreement are reserved to nPhase. Customer shall retain all rights, including ownership of all intellectual property rights to content created or uploaded by Customer while using the Services.

11. WARRANTIES; DISCLAIMERS OF WARRANTIES. Each Party represents and warrants that it has the power and authority to enter into and fully perform its obligations under this Agreement. nPhase represents and warrants that it shall use reasonable efforts consistent with prevailing industry standards to maintain the Services in a manner that minimizes errors and interruptions in the Services. Services may be temporarily unavailable for scheduled maintenance or for unscheduled emergency maintenance, either by nPhase or by third-Party providers, or due to other causes beyond nPhase’s reasonable control. nPhase does not warrant that the Services shall be uninterrupted or error free, or that defects in the Services shall be corrected; nor does nPhase make any warranty as to the results that may be obtained from use of the Services. THE SERVICES ARE PROVIDED “AS IS” AND NPHASE DISCLAIMS ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE, AND NON-INFRINGEMENT (PROVIDED HOWEVER THAT THE FOREGOING DISCLAIMERS OF WARRANTY SHALL NOT DIMINISH THE OBLIGATION OF NPHASE TO PROVIDE THE SERVICES IN ACCORDANCE WITH SUBSECTION 1 (c) OR THE INDEMNITIES IN SUBSECTION 9(a)). CUSTOMER IS SOLELY RESPONSIBLE FOR AND ASSUMES ALL LIABILITY RELATING TO: (A) THE DESIGN, STRUCTURE AND CONTENT OF ALL STUDY PROTOCOLS; (B) DECISIONS ABOUT CUSTOMER’S COMPUTER AND COMMUNICATIONS SYSTEMS NEEDED TO ACCESS THE SERVICES; AND (C) ALL PURCHASES OF ANY NECESSARY HARDWARE, SOFTWARE, SERVICES OR LICENSES REQUIRED BY CUSTOMER TO ACCESS AND USE THE SERVICES AS CONTEMPLATED HEREIN. IF nPhase REASONABLY BELIEVES THAT AN nPhase SERVICE OR ACTION REQUESTED BY CUSTOMER WOULD NOT CONFORM WITH LEGALLY PERMISSIBLE STUDY CRITERIA, nPhase MAY REQUIRE PRIOR TO PROCEEDING, THAT CUSTOMER PROVIDE A WRITTEN CERTIFICATION OF COMPLIANCE WITH SUCH STUDY CRITERIA FROM A SENIOR REGULATORY AFFAIRS OFFICER IN FORM AND SUBSTANCE REASONABLY SATISFACTORY TO nPhase. CUSTOMER AGREES TO PROVIDE NOTICE TO nPhase AS SOON AS IT BECOMES REASONABLY AWARE OF ANY PRIVACY OR DATA PROTECTION STATUTES, RULES OR REGULATIONS WHICH ARE OR BECOME APPLICABLE TO ITS BUSINESS AND WHICH COULD BE IMPOSED ON nPhase AS A RESULT OF ITS PERFORMANCE OF THE nPhase SERVICES OR CUSTOMER’S USE OF THE nPhase SERVICES, AND ANY ACTUAL OR POTENTIAL VIOLATIONS THEREOF.

Customer represents and warrants that is has implemented industry standard virus and malware protection in the software it uses to access the nPhase Services and that is will not use the Services to store or transmit Malicious Code. “Malicious Code” means code, files, scripts, agents or programs intended to do harm, including, for example, viruses, worms, time bombs and Trojan horses.

12. LIMITATION OF LIABILITY. NEITHER PARTY OR ITS OFFICERS, AFFILIATES, REPRESENTATIVES, SUPPLIERS, CONTRACTORS OR EMPLOYEES SHALL BE LIABLE UNDER ANY CONTRACT, NEGLIGENCE, STRICT LIABILITY OR OTHER THEORY: (A) FOR ERROR OR INTERRUPTION OF USE OR FOR LOSS OR INACCURACY OR CORRUPTION OF DATA OR COST OF PROCUREMENT OF SUBSTITUTE GOODS, SERVICES OR TECHNOLOGY OR LOSS OF BUSINESS; (B) FOR ANY INDIRECT, INCIDENTAL, SPECIAL OR CONSEQUENTIAL DAMAGES; (C) FOR ANY MATTER BEYOND THAT PARTY’S REASONABLE CONTROL, EVEN IF THE PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH LOSS OR DAMAGE; OR (D) FOR ANY AMOUNTS THAT, TOGETHER WITH AMOUNTS ASSOCIATED WITH ALL OTHER CLAIMS, EXCEED THE FEES PAID BY CUSTOMER TO NPHASE FOR THE SERVICES UNDER THE APPLICABLE ORDER FORM IN THE TWELVE (12) MONTHS PRIOR TO THE ACT THAT GAVE RISE TO THE LIABILITY. IN NO EVENT SHALL EITHER PARTY BE DIRECTLY LIABLE TO THE OTHER PARTY FOR ANY PUNITIVE OR EXEMPLARY DAMAGES. (E) IN THE EVENT OF A DATA BREACH OR UNAUTHORIZED ACCESS, NPHASE ‘S LIABILITY SHALL BE LIMITED TO DATA FIELDS THAT WERE PROPERLY DESIGNATED AS PHI BY CLIENT IN ACCORDANCE WITH THE PROCEDURES DESCRIBED BELOW. NPHASE SHALL NOT BE LIABLE FOR ANY BREACH OR UNAUTHORIZED DISCLOSURE OF PHI CONTAINED IN FIELDS THAT CLIENT FAILED TO PROPERLY DESIGNATE AS PHI WITHIN THE PLATFORM. IN THE EVENT OF A DATA BREACH OR UNAUTHORIZED ACCESS, NPHASE’S LIABILITY SHALL BE LIMITED TO DATA FIELDS THAT THE CLIENT PROPERLY DESIGNATED AS PHI IN ACCORDANCE WITH THE PROCEDURES DESCRIBED BELOW.

13. SECURITY OF DATA. During the Term nPhase shall maintain a comprehensive data security program, which shall include the following: (a) nPhase shall have a written information security plan that fully documents the content and implementation of nPhase’s administrative, technical, and physical safeguards to protect the Service Data; (b) nPhase shall conduct periodic risk assessments (at a minimum, annually) and use the results of those risk assessments to update its security program as needed; and (c) nPhase shall notify Customer within a reasonable time period, but within no more than seventy-two (72) hours, if it has reason to suspect that there has been unauthorized access to or acquisition of any Service Data. All nPhase employees and contractors with access to Service Data shall be trained in procedures to ensure compliance by nPhase with the obligations set forth in Section 8 (Compliance with Applicable Laws).

Customer shall promptly notify nPhase of any suspected unauthorized access to the Applications. Customer acknowledges that the nPhase Applications provides field-level encryption capabilities for data designated as Protected Health Information (PHI) within Case Report Forms (CRFs) and data collection forms.

Customer Responsibilities: 1) Customer shall identify and designate all fields containing PHI by selecting the “Does value contain PHI” checkbox at the field level within the platform during form configuration; 2) Customer is solely responsible for properly identifying and designating all PHI fields in accordance with HIPAA regulations and applicable privacy laws; and 3) Field-level PHI encryption is available within CRFs and data collection forms. Customer acknowledges that certain platform components, including but not limited to enrollment modules, do not support field-level PHI encryption.

14. INDEPENDENT CONTRACTORS. For all purposes hereof and in the performance of its obligations under this Agreement, nPhase is and shall remain an independent contractor. Nothing in this Agreement shall be deemed or construed to create an employer/employee, joint venture, or partnership relationship between nPhase and Customer. Neither Party shall have any authority to make any promise, representation, or contract of any nature on behalf of the other Party.

15. PUBLICITY. Neither Party shall issue any press release or other publicity without the prior review and written consent of the other (which may be given via e-mail), provided however that nPhase may during the Term include Customer on its published customer list. Neither Party shall reasonably delay or withhold consent if the content of the publicity is accurate and does not violate any other conditions of this Agreement.

16. ASSIGNMENT. Neither Party may assign or otherwise transfer its rights under this Agreement without the prior written consent of the other Party (which may be given via e-mail), provided however that either Party may assign this Agreement, provided that it gives written notice, in connection with a merger, sale or acquisition of it, or a sale of all or substantially all the assets to which this Agreement relates. If there is a merger, sale or acquisition of substantially all the assets to which this Agreement relates, the acquiring company is obligated to the terms of this Agreement and any associated and active Order Forms.

17. GENERAL. If any provision of this Agreement is found to be unenforceable or invalid, that provision shall be limited or eliminated to the minimum extent necessary to allow this Agreement to remain in full force and effect and enforceable. This Agreement, with any Order Form that is attached, or that is executed by the Parties and effective on or after the Effective Date, is the complete and exclusive statement of the mutual understanding of the Parties and supersedes and cancels all previous written and oral agreements, communications and other understandings relating to the subject matter of this Agreement. All waivers and modifications must be in a writing signed by both Parties, except as otherwise provided herein. This Agreement shall be governed by the laws of the State of Florida without regard to any conflict of laws principle that would refer the governance, interpretation or construction of this Agreement to the laws of another jurisdiction. Each Party irrevocably submits to the personal jurisdiction of the courts located in Duval County, Florida, and agrees that such courts shall have exclusive jurisdiction with respect to this Agreement, and that venue shall be proper in any such court. Upon termination, nPhase may, but is not obligated to, delete archived Service Data (to the extent permitted under Applicable Laws). In the event of any dispute under this Agreement, the Parties shall work in good faith, for a period of no less than thirty (renew) days from the date of written notice of such dispute, to resolve the matter informally, prior to the commencement of any formal proceeding. All notices under this Agreement shall be in writing and shall be deemed to have been duly given: upon receipt, if delivered personally or by a recognized overnight delivery service; when receipt is electronically confirmed, if transmitted by e-mail; and upon receipt, if sent by certified or registered mail, return receipt requested. Notices for non-renewal of this Agreement and/or termination of any order form shall be emailed to [email protected]. All other notices to nPhase shall be sent to 1015 Atlantic Blvd #328, Atlantic Beach, FL 32233, Attn: Legal Dept.; e-mail notices shall be sent to [email protected] and [email protected] .

Schedule 1 – Hosting & Support Services

A) Hosting Services

This Schedule 1A is incorporated by reference into and made a part of the Agreement made between nPhase and the Customer. Any capitalized terms not defined in this Schedule shall have the meaning set forth in the Agreement. Should a conflict arise between this Schedule and the Agreement, the provisions of this Schedule shall control.

Scope of Hosting Services. During the Term of the Agreement, and provided Customer has paid the applicable Hosting Service fees set forth in the Order Form, nPhase will provide hosting of the nPhase Applications on its servers and related services as set forth below (the “Hosting Services”).

1. Access Address. nPhase will host the nPhase Applications at a website address that will be provided to Customer. nPhase will install and operate the host portion of the Hosting Services, together with necessary operating systems, applications, hardware, software and utilities, utilizing industry standard security standards. Customer may use the nPhase Applications only through Internet access. nPhase Applications, if any, provided for installation on Customer’s machines may only be used in connection with Internet access to the nPhase Applications.
2. Equipment. Customer shall provide the equipment, software and telecommunications access (e.g., through an ISP) necessary for its access to or use of the nPhase Applications. Customer shall be responsible for providing the hardware and software to be used at Customer’s location(s) and necessary to access the nPhase Applications (e.g., Customer must have an approved browser), including connectivity to the nPhase Applications.
3. Availability. nPhase will use reasonable best efforts to ensure that the Hosting Services will be accessible, operational and fully functional in all material respects (i.e. capable of performing as contemplated in the ordinary course of business) (“Available”) with 98.5% Availability. “Availability” is calculated as actual uptime when the nPhase Applications are Available, divided by scheduled uptime when the nPhase Applications are scheduled to be Available, with the result expressed as a percentage. Scheduled maintenance will be excluded when calculating actual uptime. Service levels will be calculated monthly, commencing on the month that Customer begins receipt of Hosting Services. nPhase will monitor the Hosting Services and its related environment twenty-four (24) hours a day, seven (7) days a week. nPhase will respond to and resolve any outage(s) or interruption(s) of the Hosting Services within the timeframes set forth in Schedule 1B, in accordance with the severity level designated in accordance with Schedule 1B. Scheduled maintenance will take place during non-business hours with a minimum of 24 hours prior notice to Customer of any required downtime and appropriate messaging provided to Authorized Users (which notice may take the form of either an email notification, a message on the EDC sites, or both). For emergency maintenance, nPhase will provide a minimum of 4 hours’ notice to Customer and appropriate messaging provided to Authorized Users (which notice may take the form of either an email notification, a message on the EDC sites, or both). For purposes of service levels, emergency maintenance will be considered maintenance performed outside of scheduled maintenance and not be counted as available time.
4. Service Level Exclusions. In no event will nPhase be responsible for failure to meet the foregoing service levels for the following reasons: (i) events of force majeure, as set forth in the Agreement, (ii) Customer’s breach of the Agreement or failure to perform its responsibilities in a timely manner, (iii) willful misconduct of Customer, (iv) causes under the control of Customer, and (v) failure of any third-Party telecommunications carrier.
5. Business Recovery and Backups. nPhase shall maintain and update daily backup of the Customer data hosted by nPhase. nPhase will also (a) maintain, using industry standard practices, a business recovery plan and a disaster recovery plan for all of the Hosting Services, and the capacity to execute such plans, and (b) use its best efforts to implement such plans upon a disaster occurrence. In the event of a disaster occurrence, nPhase will not increase its fees or charge Customer usage fees in addition to the fees set forth in this Agreement.
6. Security/Virus Scanning.
   1. Security. nPhase will provide a security administration process and a secure environment for the servers, network, data components, content and all other hardware and software associated with the Hosting Services, the nPhase Applications and Customer data, in accordance with standard industry practices, and shall implement and enforce all security policies, standards and measures and any regulatory agency requirements applicable to nPhase’s business, to (i) prevent unauthorized use, access or modification of, and otherwise protect, the environment, hardware, software and content; (ii) prevent unauthorized use, access, disclosure or modification of any data or information being collected or generated by, input into, transmitted to or from, or stored within the Hosting Services, nPhase Applications and/or systems under nPhase’s control; (iii) protect the confidentiality of Customer data; (iv) detect and prevent denial of service attacks; and (v) detect and prevent intrusion. nPhase uses secure encryption technology to provide security for Internet data exchange.
   2. Encryption. For access to the nPhase Applications, nPhase uses 256-bit Strong Encryption.
   3. Virus Scanning. nPhase will provide virus protection on all systems used to provide nPhase Applications and Services to Customer. nPhase will install, maintain and update virus control software for all systems used to provide Services to Customer. nPhase will use industry standard software scanning technology (updated with the then-current virus signatures and data) to test the nPhase Applications and Services in order to, wherever possible, ensure the nPhase Applications and Services will not contain, and shall use reasonable best efforts to remove any known harmful programs, data, or contaminants, including any codes or instructions that may be used to access, modify, delete, damage, disable or otherwise prevent the proper operation of a computer hardware system or the associated software (individually referred to as a “Virus”, and collectively as “Viruses”). nPhase will not knowingly introduce any Viruses into Customer’s systems. nPhase agrees that in the event a Virus is found to have been introduced into nPhase’s systems or into Customer’s systems, nPhase will use reasonable best efforts to assist Customer in reducing the effects of the Virus. To the extent a virus has been introduced into nPhase’s or Customer’s systems through Customer’s use of the nPhase Applications and/or Services, Customer shall be responsible for all fees and expenses (at nPhase’s then current rates) for nPhase to provide the remedial or mitigating services described herein.
   4. Compliance with Acceptable Use Policies. Customer will, and shall use commercially reasonable efforts to cause all persons with access to the nPhase Applications to, comply at all times with all laws, regulations and acceptable use policies applicable to Customer’s business and/or the use of the nPhase Applications and Services. nPhase will, and shall use commercially reasonable efforts to cause its contractors to, comply at all times with all laws, regulations and acceptable use policies applicable to nPhase Applications, Services and business.
7. Additional Hosting Procedures. The following are the procedures applicable to Customer accessing and using the nPhase Applications.
   1. Entry. As data from a clinical research is entered by Customer’s data collector, nPhase will store the information in nPhase’s servers. nPhase’s servers will automatically record the log-in time, the identity of the Customer’s data collector and the location from which the clinical research data has been gathered.
   2. Access. Customer will be provided with password protected access to the saved clinical research data. Customer will be able to review data collected and aggregated at any point in time prior to completion of the clinical research database.
8. FDA Audit. Upon request, nPhase shall make available to the U.S. Food and Drug Administration (“FDA”) all records lawfully required by governmental regulations relating to the Hosting Services. If the FDA performs an audit, Customer shall reimburse nPhase and its subcontractors for time expended and expenses incurred in conjunction with any such audit, except to the extent that any such audit findings require remedial actions directly and solely attributable to the Hosting Services and/or nPhase Applications.

B) Technical Support Services

This Schedule 1B is incorporated by reference into and made a part of the Agreement made between nPhase and Customer. Any capitalized terms not defined in this Schedule shall have the meaning set forth in the Agreement. Should a conflict arise between this Schedule and the Agreement, the provisions of this Schedule shall control.

If a customer reaches out for contracted technical support specific to a study in BUILD or UAT environments, it is considered permission for nPhase’s Customer Care team to access the environments for the business purpose of the technical support case. As such, customer assumes responsibility that all live/real data will be added to a PROD (Production) environment only. For extenuating circumstances where support is not possible without nPhase direct access to the PROD study, a Production Access form will be signed off by the customer’s designated Support Rights user with the specifications and scope of the Production access granted to nPhase.

Scope of Technical Support Services. During the Term of the Agreement, and provided Customer has paid the applicable Hosting Service fees set forth in the Order Form, nPhase will provide Technical Support and update to customers based on the occurrence of any of the following circumstances as set forth below (the “Support Services”):

• Inability to access the hosted Aapplication
• Performance issues – freezing, (500) error messages, latency
• (Perceived) Bugs
• The Applicable nPhase Appplication is not operating per User Manual

1. Maintenance Support Service and Communication Channels.
   Each Customer will nominate a (primary) local Systems Administrator who is enabled to nominate other user(s) as Systems Administrator(s) as required. The Systems Administrator(s) will be responsible at the Customer end for nominating users of the REDCap Cloud EDC application with ‘Support Rights’. These Technical Support users will act as a channel/filter for resolving any technical issues/queries that arise locally. For Technical Issues that locally appointed Technical Support user(s) are unable to resolve, nPhase will provide technical support and upgrades to the REDCap Cloud applications as set forth below (the “Support Services”). If production database access is required for nPhase to provide technical support, Customer authorizes Technical Support user(s) the right to sign a Production Access Form on behalf of the customer for nPhase to access the customer’s live database.
   The following communication methods are available to Customers to obtain assistance from nPhase Support:
   1. Availability of Technical Support: Technical Support is available between the hours of 9:00 a.m. and 5:00 p.m. (PST & EST, and GMT), Monday through Friday, excluding nPhase’s published holidays.
   2. Access to Technical Support: Technical Support is required to be accessed directly through the Applicable nPhase Application by Technical Support users generating a Web Ticket. The Application Support Web Ticket System is the primary technical support medium as web generated tickets are the most effective, secure method of communication to enable local nominated Technical Support users to create tickets, check status, and monitor progress through resolution.
   3. Updated Release Notes: Associated with error corrections to the Application.
   4. Customer Support Surveys: To allow Customer to assist nPhase with the evaluation of Support Services.
2. Resolution of Technical Support Issues. nPhase will use commercially reasonable efforts to provide Customer with resolution(s) to technical issues. Customer shall provide nPhase with documentation of the technical issue and all other reasonable support and assistance requested by nPhase including but not limited to access of a non-live copy of the database, software, and data to investigate the reported technical issue(s) concerning nPhase products. If the root cause is determined to be a result of client’s misuse of the system, either deliberately or accidentally, nPhase may bill for the time required to determine the root cause.
3. nPhase Response Standards. nPhase will provide advice and correction of technical issues in the Applicable nPhase Application and assistance relating to the operation of the Application and services outages, as reasonably determined by nPhase, with input from Customer.
4. Customer Responsibilities. Customer shall:
   1. Nominate up to two (2) of its personnel as Technical Support users as soon as practicable following the Effective Date, for the purpose of acting as the sole liaison channel between Customer and nPhase. Customer shall identify its liaison personnel in writing to nPhase and subsequently may re-designate alternative users as replacements for such nominated personnel and provide nPhase with e-mail notice thereof. Customer shall institute internal business procedures to require all users of the Applications seeking Support Services to channel their requests through these (up to) 2 nominated individuals.
   2. Provide nPhase with documentation of the technical issue and provide nPhase with the necessary software and data required to reproduce the technical issue reported by Customer and all other reasonable support and assistance requested by nPhase as necessary to discover the cause or a cure for the reported technical issue concerning the Applications.
   3. Support and maintain Third-Party software used at Customer’s location and used in conjunction with the Applications.
   4. 150 MB daily total maximum of data transmitted via API, Imports, and Exports in the Production environment and 10 MB daily total maximum of data transmitted via API, Imports, and Exports in both Build and UAT environments: Burst Limit – The default burst limit is 1,000 API calls allowed within a10-minute fixed window. until the burst period resets; Daily Limit – A default limit of 75000 API calls within a 24-hour period.
5. Exclusions. The following services are not included in Support Services. Some of the following Professional Services may be obtained from nPhase on an additional fee basis and subject to Customer’s execution of a Statement of Work for the same:
   1. Configuration and Integration. Configuration and integration services.
   2. Professional Services and Content Development. Professional Services and content development including strategy and design services, systems architecture and integration.
   3. Training. Training on the nPhase Applications or other software or hardware packages.
   4. Misuse or Modification. Support for nPhase Applications that has been misused by Customer or any third-Party acting on Customer’s behalf.
   5. On-Site Support. Support provided by nPhase at Customer’s premises or any other premises requiring travel and living expenses.
   6. Connectivity Issues. Assistance with Customer or any other Party accessing the nPhase Applications remotely, if applicable.
   7. Third Party ASP Support. Support directly to third-Parties that host the nPhase Applications for Customer, if applicable.
   8. Problems caused by Customer. To the extent any errors or deficiencies are caused by Customer or its Authorized Users, nPhase will provide maintenance at an additional time and materials charge, subject to resource availability, based upon the fees and expenses set forth in this Agreement for Professional Services, and a minimum two-hour charge.
      If nPhase determines that a technical issue reported in the Applications is caused by misuse or modification of the Applications by Customer or by a third Party acting on Customer’s behalf, by Customer’s data or by software not provided or made available to Customer by nPhase, nPhase may charge nPhase’s then-current standard time and materials rates for Professional Services for time spent diagnosing and/or correcting such problems.
6. Updates. nPhase will from time-to-time update the equivalent Application subscribed to in the applicable order form(s) executed with the Customer under support agreements to incorporate bug fixes and/or to improve or add features and/or functionality.
   If a support case ultimately is determined to be outside of the scope of Technical Support Services outlined above, the customer will be billed at an hourly rate based on the scope of work required.