Master Services Agreement

Order Forms. Customer will purchase Services by executing one or more ordering documents that reference this Agreement (each an “Order Form”). Each Order Form specifies the subscription modules, quantities of active units, Hardware, Implementation Services, subscription term, and fees. Each Order Form is incorporated into and governed by this Agreement. Customer affiliates may execute Order Forms under this Agreement, in which case “Customer” refers to that affiliate for purposes of that Order Form.

Documents included. This Agreement consists of this main body, each Order Form, the Data Processing Addendum (“DPA”) executed by the Parties, Exhibit A (Support and Service Levels), which is attached to and incorporated into this Agreement, and any other Exhibit or Statement of Work expressly incorporated by an Order Form. TapFlow’s online Terms of Service and Privacy Policy apply to Authorized Users’ day-to-day use of the Services to the extent they do not conflict with this Agreement.

Order of precedence. In the event of conflict, the following order controls, from highest to lowest: (a) the DPA, solely as to the processing of Personal Data; (b) an Order Form, solely as to the commercial terms it expressly states (fees, quantities, term, and any negotiated deviation identified as such); (c) this main body; (d) Exhibit A and any Statement of Work; and (e) the Documentation and online Terms of Service. Pre-printed terms on a Customer purchase order, vendor portal, or similar document have no effect, even if acknowledged by TapFlow.

Individual Plans. This Agreement does not govern self-service Individual Plans purchased by individual healthcare professionals through TapFlow’s online checkout, which are governed solely by TapFlow’s online Terms of Service. An Authorized User’s separate Individual Plan, if any, is not part of Customer’s account, and Customer Data does not include its contents.

“Authorized User” means an individual employee, contractor, clinician, or agent of Customer whom Customer permits to access the Services under Customer’s account.

“Confidential Information” means non-public information disclosed by one Party to the other in connection with this Agreement that is marked confidential or that a reasonable person would understand to be confidential, including Customer Data, TapFlow’s software, pricing, roadmaps, and security documentation, and the terms of this Agreement.

“Customer Data” means data, records, checklist and inspection responses, sensor readings, photographs, and other content submitted to or generated within the Services by or on behalf of Customer. Customer Data is limited to operational and workforce information as described in Section 8.

“Documentation” means TapFlow’s then-current user guides, technical specifications, hardware placement guidance, and support materials made available for the Services.

“Hardware” means physical products supplied by TapFlow, including NFC tags and stickers, QR posters and labels, environmental sensors, mounting hardware (including adhesive-backed metal plates and magnets), cleaning and adhesive-removal supplies, and related accessories.

“Implementation Services” means onboarding, configuration, site and checkpoint setup, training, and other professional services described in an Order Form or Statement of Work.

“Personal Data” means information relating to an identified or identifiable natural person that is contained in Customer Data, such as the names, roles, credentials, and activity records of Authorized Users. Personal Data is governed by the DPA.

“Restricted Health Information” means individually identifiable health information about a patient, resident, or other individual receiving care, including any information that would constitute Protected Health Information under 45 C.F.R. § 160.103 if held by a covered entity or business associate.

“Services” means the TapFlow Health cloud software platform, including web and mobile applications, the TapFlow Health platform, the TapFlow Credentialing and TapFlow Skills Sheets add-on modules, the TapFlow Plus and TapFlow Complete bundles, and any other modules identified in an Order Form, together with related APIs, Documentation, and support. “Services” includes Hardware and Implementation Services where the context requires.

“Subscription Term” means the period during which Customer is entitled to use the subscribed Services, as stated in the applicable Order Form, including any renewal term.

“Unit” means the billing unit for a subscription as stated in the Order Form — for example, a hospital unit, department, clinic site, or other location grouping of checkpoints — as configured in the Services.

Access grant. Subject to this Agreement and payment of the applicable fees, TapFlow grants Customer a non-exclusive, non-transferable, non-sublicensable right during the Subscription Term to access and use the subscribed Services, and to permit Authorized Users to do so, solely for Customer’s internal operational, compliance, and workforce-management purposes.

Provisioning and tenancy. TapFlow will provision a logically isolated tenant for Customer within its multi-tenant cloud environment. Customer administers its own sites, units, checkpoints, roles, and Authorized Users through the administrative console.

Support. TapFlow will provide the support described in Exhibit A (Support and Service Levels). Support is provided in English during the hours stated there and includes access to Documentation, email support, and reasonable remote assistance with configuration questions.

Updates and changes. TapFlow may update the Services from time to time, including by adding, modifying, or retiring features, provided that TapFlow will not materially reduce the core functionality of a subscribed module during a paid Subscription Term. If TapFlow does so, Customer’s exclusive remedy is to terminate the affected Order Form on written notice and receive a prorated refund of prepaid, unused fees for the affected module.

Implementation Services. TapFlow will perform Implementation Services described in an Order Form or Statement of Work in a professional and workmanlike manner. Unless otherwise stated, Implementation Services are delivered remotely, and Customer will provide timely access to the personnel, site information, floor plans, equipment lists, and decisions reasonably required. Deliverables are deemed accepted ten (10) business days after delivery unless Customer identifies a material non-conformity in writing within that period.

Trials and pilots. Any free trial, pilot, or evaluation access is provided as-is, may be modified or ended by TapFlow at any time, is excluded from Exhibit A, and is subject to the disclaimers and limitations in Sections 12 and 13. Trial data may be deleted fourteen (14) days after the trial ends unless the account converts to a paid subscription.

Sale of Hardware. Hardware is sold, not licensed. Title and risk of loss pass to Customer upon delivery to the carrier at TapFlow’s shipping point (FOB origin) unless the Order Form states otherwise. Shipping dates are estimates. Custom-artwork Hardware requires Customer’s approval of a proof before production and is non-returnable once production begins.

Limited warranty. TapFlow warrants that Hardware will be free from material defects in materials and workmanship under normal use, in accordance with the Documentation, for one (1) year from delivery (the “Hardware Warranty Period”). Customer’s exclusive remedy, and TapFlow’s entire liability, for breach of this warranty is repair or replacement of the non-conforming Hardware or, at TapFlow’s option, a refund of the amounts paid for it.

Exclusions. The Hardware warranty does not cover damage or failure resulting from misuse, improper installation, application to surfaces outside published specifications, exposure to chemicals, cleaning agents, or sterilization processes not specified in the Documentation, RF or electromagnetic interference, physical alteration, or use with readers, devices, or software not approved by TapFlow.

Placement responsibility. Customer is solely responsible for where and how Hardware is installed in its facilities, including ensuring that placement does not obstruct or interfere with the operation of any medical device or equipment, complies with Customer’s infection-prevention, environmental-services, and biomedical-engineering policies, and satisfies any facility, manufacturer, or regulatory requirement. Customer will not affix Hardware to any patient, to any item worn or carried by a patient, or to any surface that contacts a patient during care.

Consumables. NFC tags, stickers, labels, and posters are consumable items that wear with use and cleaning and may require periodic replacement. Replacement Hardware is purchased at the then-current catalog price unless an Order Form includes a replacement allowance.

Supplies. Alcohol prep pads and adhesive remover are third-party products resold as supplied by their manufacturers. They are not Hardware for purposes of Section 4.2, are excluded from the Hardware warranty, and carry only any warranty provided by their manufacturer. Customer will use them in accordance with manufacturer labeling and Safety Data Sheets, its infection-prevention and environmental-services policies, and equipment manufacturers’ cleaning instructions, and will not apply adhesive remover to any patient-contact surface or any surface on which the equipment manufacturer prohibits solvents. Third-party product names (for example, Goo Gone®) are trademarks of their respective owners.

Sensors. Where Customer purchases environmental sensors, Customer is responsible for placement in accordance with the Documentation, for maintaining network connectivity and power, and for its own policies on responding to readings. Sensor readings are informational and are not a substitute for Customer’s validated monitoring processes, alarms, or manual checks required by applicable standards.

Accounts. Customer is responsible for the accuracy of its account information, the provisioning and timely deprovisioning of Authorized Users, the configuration of roles and permissions, the confidentiality of credentials, and all activity under its accounts. Credentials may not be shared between individuals. Customer will notify TapFlow promptly at support@tapflowhealth.com upon becoming aware of any unauthorized access.

Restrictions. Customer will not, and will not permit any Authorized User or third party to:

Compliance records. The Services record when and by whom a checkpoint was scanned and a task marked complete. Customer acknowledges that intentionally falsifying compliance records may violate accreditation standards and law, and agrees that TapFlow may suspend affected accounts upon reasonable evidence of systematic falsification, after notice to Customer where practicable.

Customer environment. Customer is responsible for the devices, browsers, NFC and camera hardware, network connectivity, identity providers, and security controls within its own environment. Certain Service functions depend on those elements, and TapFlow does not warrant uninterrupted scanning capability.

Suspension for security threats. TapFlow may suspend access to the Services, in whole or in part, if it reasonably determines that Customer’s or an Authorized User’s use poses a security risk to the Services or to other customers, may adversely affect the Services, or violates Section 5.2. TapFlow will notify Customer before suspending where practicable and will limit any suspension in scope and duration to the extent reasonably practicable.

Third-party services. The Services may interoperate with third-party products (for example, identity providers, messaging platforms, or asset-management systems). Those products are governed by their own terms, and TapFlow is not responsible for their availability, security, or performance. Enabling an integration constitutes Customer’s authorization for TapFlow to exchange the necessary data with that third party, subject to Section 8.

Fees. Customer will pay the fees stated in each Order Form. Subscription fees are billed monthly in advance per active Unit unless the Order Form states otherwise. Hardware and Implementation Services are billed at order or project start. TapFlow’s then-current list prices are set out in its Product Catalog & Price List, but a signed Order Form governs pricing for its stated term.

Payment terms. Invoices are due net thirty (30) days from the invoice date in U.S. dollars. Undisputed amounts more than thirty (30) days past due may accrue interest at the lesser of 1.5% per month or the maximum rate permitted by law. Customer must notify TapFlow in writing of any good-faith invoice dispute within fifteen (15) days of the invoice date, and the Parties will work promptly to resolve it; undisputed portions remain payable when due.

Suspension for non-payment. If undisputed fees remain unpaid thirty (30) days after written notice of delinquency, TapFlow may suspend the Services until paid. TapFlow will limit any suspension in scope and duration to the extent reasonably practicable and will not suspend Services during a pending good-faith dispute.

Mid-term additions. Additional Units, modules, or Authorized User tiers added during a Subscription Term are billed at the rates in the applicable Order Form (or, if none, TapFlow’s then-current list price), prorated through the end of the then-current term, and co-terminated with the underlying subscription.

Price changes. TapFlow may increase subscription fees effective on renewal by giving at least sixty (60) days’ written notice before the end of the then-current term.

Taxes. Fees exclude sales, use, excise, VAT, GST, and similar taxes, duties, and levies, which Customer will pay unless it provides a valid exemption certificate. Each Party is responsible for taxes on its own income. Fees also exclude any vendor-management, credentialing, or facility-access fees imposed by Customer or its vendors, which are Customer’s responsibility.

Vendor credentialing. If Customer requires TapFlow to register with a third-party vendor credentialing or onboarding service as a condition of on-site access, Customer will identify the requirement in the Order Form and reimburse TapFlow for the associated registration fees unless otherwise agreed.

Agreement term. This Agreement begins on the Effective Date and continues until all Order Forms have expired or been terminated, unless terminated earlier under this Section 7.

Subscription Term and renewal. Each Subscription Term is stated in the Order Form. Unless the Order Form states otherwise, a subscription renews automatically for successive terms equal in length to the initial term unless either Party gives written notice of non-renewal at least thirty (30) days before the end of the then-current term.

Termination for cause. Either Party may terminate this Agreement or any affected Order Form on written notice if the other Party (a) materially breaches this Agreement and fails to cure the breach within thirty (30) days after receiving written notice describing it; or (b) becomes insolvent, makes a general assignment for the benefit of creditors, or becomes the subject of a bankruptcy, receivership, or similar proceeding that is not dismissed within sixty (60) days.

Effect of termination. Upon expiration or termination, Customer’s right to access the Services ends, and Customer will pay all fees accrued through the effective date. If Customer terminates for TapFlow’s uncured material breach, TapFlow will refund prepaid fees for the unused remainder of the Subscription Term. If TapFlow terminates for Customer’s uncured material breach, all fees for the remainder of the then-current Subscription Term become due.

Data export and deletion. For thirty (30) days after expiration or termination (the “Transition Period”), Customer may export Customer Data using the Services’ standard export functions, and TapFlow will provide reasonable assistance on request at its then-current professional-services rates. After the Transition Period, TapFlow will delete Customer Data in its production systems within thirty (30) days and from backups in the ordinary course of backup rotation (not to exceed thirty-five (35) days after production deletion), in each case except as required by law and as described in the DPA. Customer is solely responsible for retaining any records it needs to satisfy its own accreditation, licensure, or regulatory obligations.

Survival. Sections 2, 5.2, 5.5, 5.6, 6, 7.4–7.6, 8, 9, 10, 11, 12, 13, 14, 17, and 18 survive expiration or termination.

No Restricted Health Information. Customer will not, and will ensure that its Authorized Users do not, submit Restricted Health Information to the Services in any form, including in free-text notes, photographs, attachments, task names, checkpoint labels, or credentialing records. The Parties acknowledge that this restriction is a material term and a condition of the pricing and risk allocation in this Agreement.

Permitted content. Customer Data is limited to operational and workforce information — for example, equipment identifiers and locations, asset, serial, and lot numbers, checklist and inspection responses, expiration dates of supplies, environmental readings, timestamps, site, unit, and department names, and the names, roles, licenses, certifications, competencies, and activity records of Authorized Users. Information about Customer’s workforce is not Restricted Health Information and is permitted, subject to the DPA. Customer will not submit employee health information (for example, immunization records, fit-test results, or medical clearances); DPA Section 3.4 applies.

Photographs and free text. Where the Services permit photographs or free-text entries, Customer will implement and enforce policies to ensure that no patient, patient identifier, wristband, chart, monitor display, medication label bearing a patient name, or other patient-identifying material is captured or entered.

Inadvertent submission. If either Party becomes aware that Restricted Health Information has been submitted to the Services, it will promptly notify the other. Customer will remove the information using the Services’ delete functions or, if unable, request deletion by TapFlow. TapFlow may, without liability, delete or quarantine any content it reasonably believes to be Restricted Health Information and may suspend the affected account if submissions recur after notice. Any such submission is a breach by Customer, and Customer is responsible for all consequences of it, including any notification obligations arising under HIPAA, state law, or Customer’s own policies.

No BAA. Nothing in this Agreement creates a business associate relationship. If Customer determines that its intended use of the Services would require a business associate agreement, Customer must not proceed with that use and should contact TapFlow to discuss whether an alternative configuration is available.

Ownership and license. As between the Parties, Customer owns all Customer Data. Customer grants TapFlow a non-exclusive, worldwide, royalty-free license to host, process, transmit, display, back up, and otherwise use Customer Data solely to provide, secure, support, and improve the Services, to comply with law, and as otherwise permitted in this Agreement and the DPA.

Aggregated and de-identified data. TapFlow may create and use aggregated or de-identified data derived from Customer’s use of the Services (for example, compliance-completion benchmarks, checkpoint volume statistics, sensor trend data, and product analytics), provided such data does not identify Customer, any facility, or any individual and is not disclosed in a manner that would reasonably permit re-identification.

Customer warranties. Customer represents and warrants that it has obtained all rights, consents, notices, and authorizations required for TapFlow to process Customer Data as contemplated by this Agreement, including any employee-privacy notices required by applicable law for Authorized User information.

Biometric information. The Services do not collect, capture, or store biometric identifiers or biometric information as defined in the Illinois Biometric Information Privacy Act (740 ILCS 14/1 et seq.). Customer will not configure or use the Services, including any photograph, attachment, or integration feature, to collect, capture, or store biometric identifiers or biometric information, and any such use is a breach of this Section 8.

Security program. TapFlow will maintain a written information security program with administrative, physical, and technical safeguards designed to protect the security, confidentiality, and integrity of Customer Data and appropriate to the nature of that data, including at minimum the measures described in the DPA. Those measures include encryption of Customer Data in transit and at rest, logical tenant isolation enforced at the database layer, role-based access control, multi-factor authentication for TapFlow administrative access, audit logging, and regular backups.

Security incidents. TapFlow will notify Customer without undue delay, and in any event within seventy-two (72) hours (or any shorter period required by applicable law), after confirming a Security Incident (as defined in the DPA) affecting Customer Data, and will provide the information and cooperation described in the DPA.

Assessments. No more than once per twelve (12) months, and on at least thirty (30) days’ written notice, Customer may request TapFlow’s then-current security documentation, third-party assessment reports, or a completed security questionnaire. TapFlow may satisfy the request by providing summaries of its most recent independent assessment and penetration test where available. Any on-site or hands-on audit requires TapFlow’s prior written consent, is at Customer’s expense, and is subject to reasonable confidentiality and scope limitations.

Subprocessors. TapFlow uses third-party service providers, including Microsoft Azure for cloud hosting, to deliver the Services. TapFlow’s current subprocessor list is set out in the DPA and available at www.tapflowhealth.com/subprocessors. TapFlow remains responsible for its subprocessors’ performance of TapFlow’s obligations.

Data location. Customer Data is hosted in data centers located in the United States. TapFlow will not transfer Customer Data outside the United States without Customer’s prior written consent, except for transient access by support personnel as described in the DPA.

Obligations. The receiving Party will (a) use the disclosing Party’s Confidential Information only to perform under or exercise rights granted by this Agreement; (b) protect it using at least the degree of care it uses for its own confidential information of similar sensitivity, and no less than reasonable care; and (c) disclose it only to its employees, contractors, affiliates, and professional advisors who need to know it and are bound by obligations at least as protective as this Section 10.

Exclusions. Confidential Information does not include information that (a) is or becomes publicly available through no fault of the receiving Party; (b) was rightfully known to the receiving Party without restriction before disclosure; (c) is rightfully received from a third party without restriction; or (d) is independently developed without use of the disclosing Party’s Confidential Information.

Compelled disclosure. The receiving Party may disclose Confidential Information to the extent required by law, subpoena, or court order, provided it gives the disclosing Party prompt notice (where legally permitted) and reasonable cooperation to seek protective treatment, and discloses only the portion legally required. If Customer is a public body subject to the Illinois Freedom of Information Act or a similar public-records law, disclosures required by that law are not a breach of this Section 10, provided Customer asserts any available exemption for TapFlow’s trade secrets and confidential commercial information and, where permitted, gives TapFlow notice and an opportunity to object.

Duration and return. These obligations continue for five (5) years after termination of this Agreement, and indefinitely for trade secrets and Customer Data. On request after termination, each Party will return or destroy the other’s Confidential Information, subject to routine backup retention and legal-hold obligations.

Equitable relief. Unauthorized use or disclosure of Confidential Information may cause irreparable harm for which monetary damages are an inadequate remedy, and the disclosing Party may seek injunctive relief in addition to any other remedy, without the requirement to post bond and without first complying with Sections 17.2 and 17.3.

TapFlow property. TapFlow and its licensors own all right, title, and interest in and to the Services, Documentation, software, Hardware designs, tag encoding schemes, data models, templates, and all improvements, modifications, and derivative works of them, together with all intellectual property rights therein. No rights are granted to Customer except as expressly stated in this Agreement.

Trademarks. TapFlow™, TapFlow Systems™, TapFlow Health™, and the TapFlow logo are trademarks of TapFlow Systems LLC (U.S. application Serial No. 50055717 pending for TAPFLOW). Customer will not use TapFlow’s marks except as necessary to identify the Services internally.

Feedback. If Customer or an Authorized User provides suggestions, feature requests, or other feedback, TapFlow may use it without restriction, attribution, or compensation, provided TapFlow does not identify Customer as its source without consent.

Customer configurations. Checklists, templates, workflows, and other configurations that Customer creates within the Services are Customer Data. TapFlow may make comparable functionality or generic templates available to other customers, provided it does not use Customer’s Confidential Information to do so.

Publicity. Neither Party will use the other’s name or marks in press releases, customer lists, or marketing materials without prior written consent.

Mutual. Each Party represents that it is duly organized and has the authority to enter into and perform this Agreement, and that doing so does not conflict with any other agreement by which it is bound.

TapFlow. TapFlow warrants that (a) the Services will perform materially in accordance with the Documentation during the Subscription Term; (b) Implementation Services will be performed in a professional and workmanlike manner; and (c) it will not knowingly introduce malicious code into the Services. Customer’s exclusive remedy for breach of clause (a) or (b) is for TapFlow to use commercially reasonable efforts to correct the non-conformity or re-perform the Implementation Services, and if TapFlow cannot do so within thirty (30) days after written notice, Customer may terminate the affected Order Form and receive a prorated refund of prepaid, unused fees.

Customer. Customer warrants that its use of the Services will comply with this Agreement and applicable law, including Section 8.

Clinical and regulatory disclaimer.

General disclaimer.

Exclusion of indirect damages.

Cap.

Exclusions and super-cap. Section 13.1 and 13.2 do not limit (a) Customer’s obligation to pay fees; (b) a Party’s indemnification obligations under Section 14 (subject, for TapFlow’s obligations under Section 14.1, to Section 13.5); (c) Customer’s breach of Section 5.2 or Section 8, or infringement or misappropriation of TapFlow’s intellectual property; or (d) either Party’s gross negligence, willful misconduct, or fraud.

Allocation of risk. The Parties agree that the limitations in this Section 13 reflect a deliberate allocation of risk that is reflected in the fees, that TapFlow would not enter into this Agreement without them, and that they apply notwithstanding the failure of essential purpose of any limited remedy.

Intellectual property indemnity limit. TapFlow’s total liability under Section 14.1 will not exceed the greater of (a) two (2) times the amount described in Section 13.2 or (b) two hundred fifty thousand dollars ($250,000).

By TapFlow. TapFlow will defend Customer and its officers, directors, and employees against any third-party claim alleging that the Services, as provided by TapFlow and used in accordance with this Agreement, infringe a U.S. patent, copyright, or trademark or misappropriate a trade secret, and will pay damages finally awarded by a court or agreed in a settlement approved by TapFlow. TapFlow has no obligation for claims arising from Customer Data, Customer’s configurations, modifications not made by TapFlow, combination with products or processes not supplied by TapFlow, or use after TapFlow has notified Customer to cease use. If the Services become, or in TapFlow’s opinion are likely to become, the subject of an infringement claim, TapFlow may at its option and expense procure the right for Customer to continue use, modify or replace the Services to be non-infringing, or terminate the affected Order Form and refund prepaid, unused fees. This Section 14.1 states TapFlow’s entire liability for infringement claims.

By Customer. Customer will defend TapFlow and its officers, members, employees, and contractors against any third-party claim arising from (a) Customer Data, including any claim that Customer Data infringes or misappropriates third-party rights or violates law; (b) the submission of Restricted Health Information to the Services in breach of Section 8, including any regulatory investigation, notification cost, or fine; (c) Customer’s use of the Services in violation of this Agreement or applicable law; (d) Customer’s placement or use of Hardware in its facilities, including any bodily injury or property damage arising from placement or interference with equipment; or (e) Customer’s clinical, operational, staffing, credentialing, or regulatory decisions, and will pay damages finally awarded by a court or agreed in a settlement approved by Customer.

Procedure. The indemnified Party will give the indemnifying Party prompt written notice of the claim (provided that delay relieves the indemnifying Party of its obligations only to the extent it is prejudiced), sole control of the defense and settlement (provided that no settlement may impose liability or obligations on the indemnified Party, or admit fault on its behalf, without its written consent, not to be unreasonably withheld), and reasonable cooperation at the indemnifying Party’s expense. The indemnified Party may participate with counsel of its own choosing at its own expense.

Coverage. During the term of this Agreement, TapFlow will maintain, at its own expense, insurance with carriers rated A- VII or better by A.M. Best, with limits not less than the following:

Additional insured and waiver of subrogation. TapFlow’s general liability and umbrella policies include blanket additional-insured-by-contract endorsements. On written request, TapFlow will name Customer as an additional insured on those policies with respect to liability arising out of TapFlow’s operations under this Agreement, will request that its carrier endorse a waiver of subrogation in Customer’s favor on the general liability policy, and will furnish a certificate of insurance evidencing the coverage in Section 15.1. Additional insured status and a waiver of subrogation under the Technology Errors & Omissions coverage will be provided only where expressly required by an Order Form, and then only to the extent the policy permits. Additional insured status does not extend to the Data Breach coverage.

Claims-made coverage. TapFlow’s Technology Errors & Omissions and Data Breach coverages are written on a claims-made basis with a retroactive date of September 1, 2026. TapFlow will use commercially reasonable efforts to maintain continuous coverage with that retroactive date, or to purchase an extended reporting period, so that wrongful acts occurring during the term of this Agreement remain reportable for at least one (1) year after termination.

Notice. TapFlow will notify Customer within thirty (30) days if any policy in Section 15.1 is cancelled, non-renewed, or materially reduced below the stated limits, and will use commercially reasonable efforts to replace the coverage without lapse.

Relationship to liability. The insurance requirements in this Section 15 describe coverage TapFlow carries; they neither expand nor limit either Party’s liability, which is governed by Section 13.

Purpose. The Parties intend to resolve disputes efficiently and in good faith and will follow the escalating process in this Section 17 before commencing litigation, except as provided in Section 17.5.

Executive negotiation. A Party will initiate the process by delivering written notice describing the dispute in reasonable detail (a “Dispute Notice”). Within ten (10) business days after the Dispute Notice, each Party will designate a senior representative with authority to resolve the dispute — for TapFlow, its Managing Member or designee; for Customer, an executive at the level of Vice President or above, or a designee with equivalent settlement authority. The representatives will meet (in person or by video conference) at least once and will negotiate in good faith for a period of thirty (30) days after the Dispute Notice, or such longer period as they agree in writing.

Mediation. If the dispute is not resolved through executive negotiation, either Party may submit it to non-binding mediation administered by JAMS (or another mediator the Parties agree on in writing) in Cook County, Illinois. The Parties will select a mediator within fifteen (15) days after the mediation request and will participate in at least one mediation session within sixty (60) days after that request. The mediator’s fees and administrative costs will be shared equally; each Party bears its own attorneys’ fees and expenses. Mediation communications are confidential settlement communications and are inadmissible in any later proceeding.

Litigation; venue. If the dispute is not resolved within thirty (30) days after the first mediation session (or if a Party fails to participate in mediation as required), either Party may commence litigation. The Parties consent to the exclusive jurisdiction and venue of the state and federal courts located in Cook County, Illinois, waive any objection to that venue based on inconvenient forum, and agree not to bring any action arising out of this Agreement in any other court. EACH PARTY WAIVES ANY RIGHT TO A JURY TRIAL IN ANY ACTION ARISING OUT OF OR RELATED TO THIS AGREEMENT, TO THE EXTENT PERMITTED BY LAW.

Emergency and equitable relief. Notwithstanding Sections 17.2 and 17.3, either Party may at any time seek a temporary restraining order, preliminary or permanent injunction, or other equitable relief from a court of competent jurisdiction, without first completing negotiation or mediation, to prevent or stop (a) actual or threatened misuse or disclosure of Confidential Information; (b) infringement or misappropriation of intellectual property; (c) unauthorized access to, or a security threat affecting, the Services or Customer Data; or (d) any other conduct that threatens irreparable harm. Seeking such relief does not waive the process in this Section 17 for the remainder of the dispute.

Attorneys’ fees. Each Party will bear its own attorneys’ fees and costs in any dispute, except where a statute, court order, or another provision of this Agreement (including Section 14) provides otherwise.

Tolling; continued performance. All applicable statutes of limitation are tolled while the Parties are engaged in the process in Sections 17.2 and 17.3. Each Party will continue performing its obligations under this Agreement during any dispute, except that TapFlow may exercise its suspension rights under Section 6.3 and either Party may exercise its termination rights under Section 7.3.

Assignment. Neither Party may assign this Agreement without the other’s prior written consent, not to be unreasonably withheld, except that either Party may assign it in its entirety, on written notice, to an affiliate or to a successor in connection with a merger, acquisition, reorganization, or sale of all or substantially all of its assets, provided the assignee assumes all obligations. Any other purported assignment is void.

Force majeure. Neither Party is liable for delay or failure to perform (other than payment obligations) caused by events beyond its reasonable control, including natural disasters, epidemics, war, terrorism, labor disputes, governmental action, internet or utility failures, or denial-of-service attacks, provided it uses reasonable efforts to mitigate and resume performance.

Independent contractors. The Parties are independent contractors. Nothing in this Agreement creates a partnership, joint venture, agency, franchise, or employment relationship. TapFlow personnel who visit Customer facilities will comply with Customer’s reasonable, written site-access, safety, and confidentiality policies provided in advance.

Notices. Legal notices must be in writing and delivered by hand, nationally recognized overnight courier, or email with confirmation of receipt. Notices to TapFlow: TapFlow Systems LLC, Attn: Legal, 520 N Irving Ave, Hillside, IL 60162-1222; email: support@tapflowhealth.com. Notices to Customer: the address and email in the signature block or applicable Order Form. Notices are effective on receipt.

Export and sanctions; government use. Each Party will comply with applicable export-control and sanctions laws. If Customer is a U.S. government entity, the Services are “commercial computer software” and “commercial computer software documentation” under FAR 12.212 and DFARS 227.7202, licensed only with the rights stated in this Agreement.

Non-solicitation. During the term and for twelve (12) months after, neither Party will directly solicit for employment any employee of the other Party who was materially involved in performing this Agreement, excluding responses to general advertisements.

Severability; waiver. If any provision is held unenforceable, it will be modified to the minimum extent necessary to be enforceable and the remainder will remain in effect. A waiver is effective only if in writing, and a failure or delay in enforcing any provision is not a waiver.

Entire agreement; amendment. This Agreement (including the DPA, Order Forms, and incorporated Exhibits) is the entire agreement between the Parties regarding its subject matter and supersedes all prior or contemporaneous proposals, quotations, and understandings, written or oral. It may be amended only by a written instrument signed by authorized representatives of both Parties. Click-through or shrink-wrap terms presented during use of the Services do not amend this Agreement.

Counterparts; electronic signatures. This Agreement and any Order Form may be executed in counterparts and by electronic signature, each of which is an original and all of which together are one instrument.

Interpretation. Headings are for convenience only. “Including” means “including without limitation.” This Agreement was negotiated by both Parties and will not be construed against either as drafter.