FOUNDER’S GARAGE

TERMS OF SERVICE

Enterprise SaaS, Implementation, Support, and Authorized-User Terms

EFFECTIVE TERMS

Effective May 1, 2026. Last revised August 3, 2026. Published and archived under the version-control provisions in Schedule 4.

Document Control and Version History

Required publication fields

Section Index

FOUNDER’S GARAGE TERMS OF SERVICE

Version 1.0 - Effective May 1, 2026

These Terms of Service (the “Terms”) are entered into between Founder’s Garage, LLC, a Texas limited liability company (“Founder’s Garage,” “FG,” “we,” “us,” or “our”), and the organization or person identified in an Order, account registration, or acceptance record (“Customer,” “you,” or “your”). These Terms govern access to and use of all current and future products, websites, applications, platforms, hosted services, features, documentation, support, implementation, training, and related professional services offered by Founder’s Garage, LLC, including HSQIA (collectively, the “Services”).

1. Definitions

“Affiliate” means an entity that directly or indirectly controls, is controlled by, or is under common control with a party.

“Authorized User” means an employee, contractor, agent, patient, family member, visitor, external reporter, or other person permitted by Customer to access or use the Services under Customer’s account, including a Public Submitter.

“BAA” means a business associate agreement executed by the parties that governs Protected Health Information under HIPAA.

“Customer Data” means all data, text, narratives, reports, complaints, grievances, incidents, investigation materials, action plans, attachments, audio, images, maps, location data, personal information, PHI, configurations, and other content submitted to, stored in, transmitted through, or generated from Customer’s use of the Services. Customer Data excludes FG Technology and Usage Data.

“Documentation” means FG’s then-current user, administrator, technical, security, and support documentation made available for the Services.

“FG Technology” means the Services and all software, source code, object code, APIs, schemas, workflows, templates, designs, models, algorithms, methods, know-how, Documentation, updates, improvements, and derivative works owned or licensed by FG, excluding Customer Data.

“Order” means an order form, subscription order, proposal, quote, online order, purchase document accepted by FG, or other ordering document that identifies the Services, term, fees, and Customer.

“Professional Services” means implementation, configuration, migration, integration, training, consulting, custom development, or other services described in an SOW.

“Public Submitter” means a patient, family member, caregiver, visitor, employee, contractor, or other person who submits information through a public, anonymous, confidential, external, or unauthenticated form.

“SOW” means a statement of work or change order signed or otherwise accepted by authorized representatives of the parties.

“Usage Data” means technical, operational, security, performance, and usage information about operation of the Services that does not identify an individual or reveal Customer Confidential Information, except as needed for security, support, billing, or compliance.

2. Agreement Structure and Order of Precedence

2.1 Contract Documents

The “Agreement” consists of these Terms, each applicable Order, SOW, BAA, data processing addendum (“DPA”), service level agreement (“SLA”), support policy, Schedule, and other document expressly incorporated by reference.

2.2 Order of Precedence

If documents conflict, the following order controls unless a signed document expressly states otherwise and identifies the provision it overrides: (a) BAA for PHI matters; (b) DPA for personal-data matters; (c) Order; (d) SOW or change order; (e) SLA; (f) these Terms; (g) Schedules and incorporated policies; and (h) Documentation.

2.3 Purchase Orders

Terms printed on or linked from Customer purchase orders, procurement portals, vendor forms, or other Customer documents do not modify the Agreement unless FG expressly signs an amendment identifying the modified provision. A purchase order may be used for administrative convenience only.

2.4 Affiliates

Customer Affiliates may use the Services only if permitted in an Order. Customer remains jointly responsible for its Affiliates and their Authorized Users unless an Affiliate signs a separate Order directly with FG.

3. Acceptance, Authority, and Eligibility

3.1 Acceptance

Customer accepts the Agreement by signing or electronically accepting an Order; creating or activating an organizational account; clicking an acceptance control; permitting an Authorized User to access the Services after notice of the Terms; or otherwise using the Services after the Terms are presented.

3.2 Authority

The person accepting represents and warrants that the person is at least eighteen years old, has legal capacity, and has authority to bind Customer. If the person lacks authority, the person must not accept or use the Services on Customer’s behalf.

3.3 Enterprise Use

The Services are primarily offered for organizational and professional use. Consumer protection laws that cannot lawfully be waived remain applicable to Public Submitters, but Public Submitters do not obtain rights under Customer’s Order or become third-party beneficiaries.

3.4 Minors

The Services are not directed to children under thirteen. Customer may permit a minor to use an authorized public or patient form only when lawful and subject to Customer’s notices, consent procedures, and supervision. FG does not determine whether parental, guardian, or minor consent is legally sufficient.

4. Services and Subscription License

4.1 Provision of Services

Subject to payment and compliance with the Agreement, FG grants Customer a limited, non-exclusive, non-transferable, non-sublicensable right during the applicable Subscription Term to permit Authorized Users to access and use the Services solely for Customer’s internal operations and the approved external-reporting purposes described in the Order and Documentation.

4.2 Scope and Limits

The Order may limit users, facilities, locations, storage, forms, workflows, integrations, modules, transaction volume, or other usage. Customer will not exceed those limits. FG may charge then-current fees for excess use or require an updated Order.

4.3 Reservations

FG and its licensors retain all rights not expressly granted. No source code, ownership interest, or implied license is transferred to Customer.

4.4 Trials, Pilots, and Beta Features

Trials, pilots, previews, and beta features may be changed or discontinued at any time; are provided “AS IS”; may not be used with PHI, regulated data, or production workflows unless FG authorizes such use in writing; and are excluded from warranties, SLAs, service credits, and indemnity obligations to the maximum extent permitted by law.

4.5 No Resale or Service Bureau

Customer may not resell, sublicense, time-share, white-label, or provide the Services as a service bureau except as expressly authorized in an Order.

5. Customer Administration, Authorized Users, and Roles

5.1 Customer Control

Customer controls its account, organizational structure, facilities, maps, forms, workflows, classifications, routing, access, retention choices, and Authorized Users. Customer is responsible for all configuration decisions and activity under its account, whether authorized or unauthorized, except to the extent directly caused by FG’s breach of the Agreement.

5.2 Role-Based Access

The Services may support roles such as Reporter, Manager, Reviewer, Administrator, Risk Administrator, Investigator, Executive, System Administrator, Patient, and Public Submitter. Role names are descriptive only. Customer determines each role’s permissions, data scope, delegation, separation of duties, and suitability under Customer policies and law.

5.3 Administrator Responsibilities

Customer will designate qualified account owners and administrators, maintain at least two active administrative contacts where reasonably practical, apply least-privilege principles, review access periodically, promptly remove departed or reassigned users, protect credentials and API keys, configure multifactor authentication or single sign-on where available, and review audit logs and security notices.

5.4 User Conduct and Credentials

Each Authorized User must use a unique account unless the Documentation expressly permits a shared public form. Customer may not permit credential sharing. Customer will promptly notify FG of suspected compromise, unauthorized access, or material misuse and will cooperate in containment and investigation.

5.5 Customer Responsibility for Users

Customer is responsible for Authorized Users’ compliance with the Agreement and for actions taken through their accounts. FG may rely on instructions from Customer’s account owner and designated administrators.

5.6 Permissions Are Configurable

A displayed role, permission, warning, workflow status, or system recommendation does not establish legal authority, professional qualification, approval authority, or compliance. Customer must validate permissions and workflows before production use and after material changes.

6. Customer Responsibilities

Customer will:

• use the Services only in accordance with the Agreement, Documentation, Customer policies, and applicable law;

• provide accurate, complete, and timely information, decisions, approvals, access, personnel, and technical resources needed for implementation and support;

• determine the lawfulness, necessity, and minimum-necessary scope of Customer Data and obtain all notices, authorizations, consents, releases, permissions, and rights needed for FG to process Customer Data as instructed;

• maintain appropriate policies, staffing, escalation procedures, emergency channels, backup procedures, business-continuity plans, and systems of record independent of the Services;

• review the accuracy and appropriateness of reports, classifications, alerts, transcriptions, analytics, recommendations, and exports before relying on, disclosing, or acting on them;

• maintain its devices, networks, browsers, telecommunications, identity systems, integrations, and endpoint security;

• comply with retention, legal-hold, public-records, discovery, reporting, labor, privacy, consent, and records-management obligations; and

• promptly report defects with sufficient information for FG to reproduce and investigate them.

6.2 No Delegation of Customer Duties

Unless a signed SOW expressly states otherwise, FG does not assume Customer’s duties to monitor queues, review reports, investigate events, determine harm, provide care, respond to grievances, make disclosures, notify regulators, file claims, preserve privilege, complete corrective actions, enforce policy, or meet deadlines.

7. Healthcare, Safety, Risk, Complaint, and Grievance Use

7.1 Administrative Tool Only

The Services may support reporting, classification, routing, investigation, action planning, analytics, readiness, complaint and grievance management, service recovery, workforce safety, and related workflows. The Services are administrative and decision-support tools only and do not practice medicine, nursing, law, risk management, compliance, human resources, claims administration, or any licensed profession.

7.2 No Emergency Use

The Services are not monitored emergency channels and must not be used as a substitute for 911, emergency clinical response, security dispatch, a rapid-response system, a suicide or crisis line, a hazardous-material response system, or any legally required urgent-reporting mechanism. Customer must clearly communicate alternative emergency procedures to Users and Public Submitters.

7.3 No Duty to Monitor or Intervene

FG has no duty to monitor Customer Data, identify threats, assess reports, contact individuals, initiate emergency response, investigate allegations, preserve evidence, notify Customer personnel, or take corrective action. Automated routing, alerts, escalation indicators, and dashboards are conveniences and may be delayed, incomplete, misconfigured, or unavailable. Customer must maintain active human oversight.

7.4 Clinical and Professional Decisions

Customer and its qualified professionals remain solely responsible for care decisions, diagnosis, treatment, patient communications, staffing, credentialing, peer review, discipline, employment, insurance, legal, regulatory, and safety decisions. No output may be used as the sole basis for a decision that materially affects a person’s health, safety, employment, credentials, benefits, legal rights, or access to services.

7.5 Regulatory and Accreditation Obligations

FG does not guarantee compliance with HIPAA, HITECH, 42 C.F.R. Part 2, CMS conditions, accreditation standards, OSHA, workers’ compensation rules, Texas Department of Insurance requirements, professional-review statutes, grievance timelines, mandatory reporting laws, or any other law or standard. Customer is solely responsible for identifying and satisfying applicable requirements and validating its configurations, reports, integrations, and procedures.

7.6 Incident Classification and Closure

Categories, harm scores, near-miss indicators, severity levels, root-cause fields, readiness scores, closure requirements, and workflow gates are configurable tools. Customer determines and validates their definitions, evidentiary standards, approval authority, segregation of duties, and use. A system status such as “closed,” “resolved,” “substantiated,” or “complete” does not itself establish legal sufficiency or factual correctness.

7.7 Complaints, Grievances, and Service Recovery

Customer is solely responsible for determining whether a submission is a complaint, grievance, claim, adverse event, regulatory matter, pre-litigation matter, or other category; for required acknowledgements and responses; and for the legality of service-recovery payments, write-offs, refunds, communications, and disclosures.

7.8 Privilege and Confidentiality Not Guaranteed

Use of the Services does not create or preserve attorney-client privilege, work-product protection, peer-review privilege, patient-safety work-product protection, whistleblower protection, quality-assurance privilege, or any other immunity or confidentiality. Customer must obtain legal advice and configure access, labels, segregation, export, and retention accordingly.

7.9 Anonymous and Confidential Reporting

Features labeled “anonymous,” “confidential,” or similar reflect configured display and access rules, not an absolute guarantee of anonymity or nondisclosure. Identity may be inferred or revealed through content, metadata, account activity, IP or device information, audit logs, integrations, legal process, safety needs, or Customer action. Customer must provide accurate notices and must not promise anonymity or confidentiality beyond what Customer can lawfully and technically deliver.

7.10 Non-Retaliation

Customer is responsible for complying with non-retaliation, whistleblower, labor, and reporting-protection laws and for ensuring that good-faith reporting is not discouraged. FG does not monitor or enforce Customer employment practices.

8. Public, Patient, Family, and External Submissions

8.1 Customer, Not FG, Receives the Submission

A public or external form is provided on Customer’s behalf. Customer, not FG, is responsible for reviewing, investigating, responding to, and retaining submissions and for providing legally required notices, accommodations, translations, and communications.

8.2 Submitter License and Instructions

A Public Submitter grants Customer and FG a worldwide, non-exclusive, royalty-free license to host, copy, transmit, process, display, disclose, and otherwise use the submitted content as needed to provide the Services, route the submission, protect persons or systems, comply with law, and exercise legal rights. The Submitter represents that the submission is made in good faith and that the Submitter has the right to provide the information and attachments.

8.3 No Emergency, Care, or Response Guarantee

Submitting a form does not request or guarantee medical care, emergency assistance, legal protection, investigation, confidentiality, response, resolution, reimbursement, or any particular outcome. Public Submitters should use Customer’s designated emergency, clinical, grievance, complaint, privacy, and legal channels when required.

8.4 No Third-Party Beneficiary

Public Submitters and other individuals described in Customer Data are not third-party beneficiaries of the Agreement and have no claim against FG based solely on the availability, routing, handling, or content of a Customer form.

8.5 Abusive or Unlawful Content

FG may block or remove submissions, limit access, preserve evidence, or disclose information when reasonably necessary to address malware, threats, unlawful content, harassment, abuse, security risks, or legal process. FG has no obligation to screen all submissions.

9. Customer Data and Data Rights

9.1 Customer Ownership

As between the parties, Customer retains all right, title, and interest in Customer Data, including Customer-specific incident, complaint, grievance, investigation, action-plan, report, export, and analytics content generated from Customer Data. FG retains ownership of FG Technology embedded in or used to generate such outputs.

9.2 License to Provide the Services

Customer grants FG, its Affiliates, and approved subprocessors a worldwide, non-exclusive, limited-term license to host, copy, transmit, display, transform, index, analyze, back up, and otherwise process Customer Data solely to provide, secure, support, maintain, improve, and comply with law regarding the Services and as otherwise authorized in the Agreement.

9.3 Customer Instructions

Customer’s configuration, User actions, administrator instructions, support requests, Orders, SOWs, and use of features constitute processing instructions. FG may refuse an instruction that is unlawful, insecure, outside scope, technically infeasible, or inconsistent with the Agreement.

9.4 Data Accuracy and Legality

Customer is solely responsible for Customer Data’s accuracy, quality, integrity, completeness, legality, reliability, and appropriateness. FG is not responsible for correcting factual disputes or determining whether allegations are substantiated.

9.5 Sensitive Data

Customer must not submit data categories that the Order or Documentation does not authorize. Psychotherapy notes, substance-use-disorder records regulated by 42 C.F.R. Part 2, payment-card data, biometric identifiers, genetic data, government secrets, classified information, and similar highly restricted data may be submitted only when the Order expressly authorizes them and applicable safeguards and agreements are in place.

9.6 Data Portability

Customer may export Customer Data using available functionality, subject to role permissions, technical limits, security controls, payment status, and the Agreement. Custom extraction, migration, transformation, or validation may require Professional Services and additional fees.

10. Protected Health Information and Business Associate Terms

10.1 BAA Required

Customer may permit FG to create, receive, maintain, or transmit PHI only for Services expressly designated as HIPAA-enabled and only after the parties have executed or validly incorporated a BAA. These Terms are not a BAA and do not independently authorize PHI processing.

10.2 BAA Controls

If the BAA conflicts with these Terms concerning PHI, the BAA controls. Terms such as “PHI,” “Business Associate,” “Covered Entity,” “Security Incident,” and “Breach” have the meanings assigned by HIPAA when used in the BAA context.

10.3 Customer HIPAA Responsibilities

Customer remains responsible for determining whether it is a Covered Entity, Business Associate, hybrid entity, or other regulated entity; applying the minimum-necessary standard; providing privacy notices; obtaining authorizations; managing access; identifying designated record sets; responding to individual rights; and making legally required notifications and reports.

10.4 PHI in Support and Testing

Customer will not include PHI in support tickets, email, screenshots, logs, test environments, training environments, or demonstrations unless FG has expressly authorized that channel or environment for PHI. Customer will use synthetic or de-identified data where reasonably possible.

10.5 Substance-Use and Specially Protected Records

A HIPAA BAA alone may not authorize processing of records subject to 42 C.F.R. Part 2 or other specially protected information. Customer must obtain FG’s prior written agreement and satisfy all additional requirements before submitting such data.

11. Privacy and Data Protection

11.1 Roles

For personal data processed on Customer’s behalf, Customer is the controller or business and FG is the processor or service provider, except for account, billing, security, fraud-prevention, legal, and business-contact data that FG processes for its own legitimate purposes as described in the Privacy Policy.

11.2 DPA

If applicable data-protection law requires additional processor terms, the parties will execute or incorporate FG’s then-current DPA. The DPA controls for personal-data processing matters.

11.3 Customer Notices and Rights

Customer is responsible for lawful collection and use, privacy notices, consent or other legal bases, response to data-subject requests, and instructions to FG. FG will provide reasonable assistance as required by the DPA and may charge for requests outside included services or caused by Customer configuration or conduct.

11.4 Cross-Border Processing and Data Location

Data hosting, support access, subprocessors, and cross-border transfers will be as stated in the Order, DPA, BAA, or subprocessor list. No data-residency commitment applies unless expressly stated in a signed Order or addendum.

11.5 Privacy Policy

FG’s Privacy Policy governs personal information collected through FG-controlled websites, sales, account administration, and similar business activities. Customer’s privacy notices govern Customer forms and Customer Data.

12. Security and Shared Responsibility

12.1 FG Safeguards

FG will maintain commercially reasonable administrative, physical, and technical safeguards designed to protect the confidentiality, integrity, and availability of Customer Data in FG-controlled systems, as further described in the applicable security documentation, DPA, BAA, or Order.

12.2 No Absolute Security

No service, transmission, storage system, or security measure is completely secure. FG does not warrant that unauthorized persons will never defeat security measures or that Customer Data will never be accessed, lost, altered, intercepted, or disclosed.

12.3 Shared Responsibility

Customer is responsible for identity management, role design, endpoint and network security, credential protection, user training, lawful data entry, integration configuration, exports, downloads, devices, local storage, and all Customer-controlled systems. Security obligations may be allocated in a separate shared-responsibility matrix.

12.4 Security Incidents

FG will notify Customer of confirmed unauthorized access to Customer Data as required by the BAA, DPA, applicable law, or Order. Routine unsuccessful attacks, scans, pings, blocked login attempts, and similar events that do not result in unauthorized access need not be individually reported unless required by law.

12.5 Customer Security Events

Customer will immediately notify FG of compromised credentials, unauthorized access, malicious integrations, or other events that may affect the Services and will take requested containment actions. FG may suspend access to protect Customer, other customers, or the Services.

12.6 Security Review

Upon reasonable written request and subject to confidentiality, FG may provide then-current security documentation or independent assessment reports. On-site audits, custom questionnaires, penetration tests, or extensive evidence requests require prior agreement and may be subject to fees, scope, frequency, and security restrictions.

12.7 No Unauthorized Testing

Customer may not conduct penetration testing, vulnerability scanning, load testing, social engineering, or security research against the Services without FG’s prior written authorization and compliance with FG’s testing rules.

13. Artificial Intelligence, Automation, and Machine-Assisted Features

13.1 Covered Features

The Services may use machine learning, natural-language processing, transcription, semantic similarity, classification, summarization, recommendation, anomaly detection, predictive analytics, or other automated features (“Automated Features”).

13.2 Optional and Configurable

Automated Features may be optional, may be disabled or limited by administrators where available, and may change as models and technology evolve. Customer must determine whether each feature is appropriate for its use case and legal environment.

13.3 Probabilistic Outputs

Automated outputs are predictions based on patterns and may be inaccurate, incomplete, inconsistent, biased, offensive, non-unique, or unsuitable. Confidence scores do not establish truth, clinical validity, legal sufficiency, causation, or compliance.

13.4 Mandatory Human Review

Customer must implement meaningful human review before relying on an Automated Feature. Customer will not use an output as the sole basis for medical care, emergency response, employment, discipline, credentialing, insurance, legal rights, regulatory reporting, patient communication, or any other consequential decision.

13.5 No Professional Advice or Medical Device Representation

Automated Features do not provide medical, legal, compliance, employment, insurance, or other professional advice and are not represented as regulated medical devices or autonomous clinical decision systems unless a signed Order expressly states otherwise.

13.6 Inputs and Permissions

Customer is responsible for the content, legality, and sensitivity of inputs and for obtaining consent and authority to process them. Customer should not submit sensitive personal information to an Automated Feature unless the feature, Order, BAA, DPA, and Customer policy authorize that processing.

13.7 Model Training

FG will not use Customer Data or PHI to train generalized models made available to other customers unless Customer gives express written opt-in consent and such use is permitted by the BAA, DPA, and applicable law. FG may use Usage Data and de-identified operational information to secure, evaluate, and improve the Services as stated in Section 16.

13.8 Third-Party Models

If an Automated Feature uses a third-party model or processing location, applicable disclosures, subprocessors, regions, and additional terms will be provided through the Documentation, DPA, BAA, Order, or feature notice. Customer’s activation or use constitutes an instruction to process inputs as disclosed.

13.9 Customer Validation

Customer will test Automated Features using representative, non-production data before operational use; establish thresholds and review procedures; monitor performance and disparate impacts; preserve appropriate records; and discontinue use where results are unsafe, unreliable, discriminatory, or unlawful.

14. Audio, Transcription, Images, Attachments, Maps, and Location Data

14.1 Recording Consent

Customer and Users are solely responsible for obtaining all legally required consent before recording, uploading, transcribing, or sharing audio or video. The availability of a recording feature does not establish that recording is lawful. Customer must comply with wiretap, workplace-monitoring, patient-consent, privacy, and labor laws.

14.2 Transcription Accuracy

Transcriptions may omit, add, or misstate words, speakers, dates, medications, names, or events. Customer must compare important transcriptions with the original recording and correct errors before use. The recording, not the transcription, should be treated as the source where lawful and available.

14.3 Attachments

Customer must scan, classify, and lawfully manage attachments. FG may apply malware detection or file restrictions but does not guarantee that attachments are safe, authentic, complete, admissible, correctly associated, or free of hidden data.

14.4 Maps and Location

Maps, floor plans, zones, pins, coordinates, and heat maps are visual references and analytics aids only. They may be approximate, outdated, misconfigured, or affected by device and source-data limitations. They must not be used as the sole source for emergency dispatch, evacuation, clinical location, wayfinding, legal property boundaries, or safety-critical decisions.

14.5 Rights in Media and Plans

Customer represents that it has all rights and permissions needed to upload recordings, photographs, correspondence, medical records, policies, floor plans, facility maps, and other materials and to permit FG to process them under the Agreement.

15. Integrations, APIs, and Third-Party Services

15.1 Customer Direction

Customer may direct the Services to exchange data with EHRs, HR systems, identity providers, analytics platforms, warehouses, claims systems, messaging services, or other third-party products. Customer authorizes FG to transmit Customer Data as configured and is responsible for the destination, mapping, scope, access, and legal basis.

15.2 Third-Party Terms

Third-party products are governed by their own terms, security, availability, and privacy practices. FG does not control them and is not liable for their acts, omissions, changes, discontinuation, data use, or security, even when an integration is described in Documentation or facilitated by FG.

15.3 API Use

Customer will protect API credentials, comply with rate limits and Documentation, validate payloads and acknowledgements, implement error handling and monitoring, and prevent unauthorized or excessive use. FG may modify or deprecate APIs with reasonable notice when commercially practicable.

15.4 Integration Failures

Customer must independently monitor legally or operationally significant interfaces, queues, acknowledgements, retries, and downstream systems. FG does not guarantee that third-party data is accurate, timely, complete, or accepted by a regulator, payer, TPA, EHR, warehouse, or other recipient.

15.5 Custom Integrations

Custom integrations, migrations, data feeds, and mapping are governed by an SOW. Changes to Customer or third-party systems may require additional work and fees.

16. De-Identified Data, Usage Data, and Benchmarking

16.1 Usage Data

FG may collect and use Usage Data to operate, secure, support, measure, bill, troubleshoot, and improve the Services; enforce the Agreement; and comply with law. Usage Data will not be sold as Customer-identifiable data.

16.2 De-Identification

FG may create and use data that has been de-identified or aggregated so that it does not identify Customer or any individual and cannot reasonably be re-identified, provided that FG applies applicable legal de-identification requirements, does not attempt re-identification, and does not disclose Customer Confidential Information.

16.3 Benchmarking and Product Research

FG will not use Customer Data or PHI for cross-customer benchmarking, commercial research, or generalized model training unless the Order, BAA, DPA, or separate written opt-in expressly permits that use. Operational telemetry necessary for security, performance, support, and billing does not require an opt-in.

16.4 Customer-Specific Analytics

Customer owns its Customer-specific reports and analytics outputs, subject to FG’s ownership of the underlying platform, visualizations, methods, and reusable technology.

17. Support, Availability, Maintenance, and Service Changes

17.1 Support

FG will provide support at the level stated in the Order or then-current support policy. Customer will designate trained support contacts, provide reproducible information, cooperate with troubleshooting, and use the support channel for non-emergency technical issues.

17.2 Availability

Any uptime commitment, measurement method, exclusion, or service credit applies only if stated in a signed Order or SLA. Availability targets are not warranties. Service credits, if any, are Customer’s exclusive monetary remedy for failure to meet an SLA.

17.3 Maintenance

FG may perform scheduled and emergency maintenance. FG will provide reasonable advance notice of material scheduled downtime when commercially practicable. Emergency maintenance may occur without advance notice.

17.4 Excluded Downtime

Unless an SLA states otherwise, downtime caused by Customer, Users, third parties, integrations, internet or telecommunications failures, force majeure, suspension, beta features, unauthorized use, Customer systems, or maintenance is excluded from availability calculations.

17.5 Service Evolution

FG may update, enhance, replace, or discontinue features to improve the Services, address security, comply with law, or manage technology. During a paid term, FG will not materially reduce the core functionality purchased in the applicable Order without providing a commercially reasonable alternative or termination right for the materially affected Service, except where change is required for security, law, or third-party dependency.

17.6 Documentation and Training Updates

Customer is responsible for reviewing release notes, revised Documentation, notices, and updated training materials and for retraining Users and revalidating workflows when changes affect Customer operations.

18. Professional Services, Implementation, UAT, and Acceptance

18.1 SOW Required

Professional Services are provided only as stated in an SOW. Each SOW may define scope, assumptions, dependencies, deliverables, milestones, fees, expenses, acceptance criteria, and change control.

18.2 Customer Cooperation

Timely access to Customer personnel, data, systems, decisions, approvals, environments, and subject-matter experts is a material dependency. FG is not responsible for delays, rework, defects, or added costs caused by Customer or third parties. Schedule and fees may be adjusted through change control.

18.3 Change Control

A change to scope, assumptions, integrations, data, deliverables, timing, or responsibilities is binding only through a written change order accepted by authorized representatives. FG is not required to perform out-of-scope work.

18.4 Customer Validation and UAT

Customer must conduct complete UAT before production use, including forms, conditional logic, permissions, segregation of duties, maps, classifications, notifications, escalations, reports, exports, integrations, retention, mobile behavior, accessibility, and anticipated failure scenarios. Customer will use synthetic or de-identified test data unless the environment is approved for regulated data.

18.5 Acceptance

Unless an SOW states otherwise, a deliverable is accepted upon the earliest of: (a) written acceptance; (b) production use; (c) payment without a timely written rejection; or (d) ten business days after delivery without a written rejection describing a reproducible material failure to satisfy an express acceptance criterion. Minor defects that do not materially impair use do not delay acceptance.

18.6 Remedy for Rejected Deliverables

FG will use commercially reasonable efforts to correct a validly rejected material nonconformity. Reperformance or correction is Customer’s exclusive remedy for Professional Services warranty claims. If FG cannot cure after a reasonable opportunity, Customer may terminate the affected, unaccepted SOW deliverable and receive a refund of fees paid specifically for that deliverable.

18.7 Production Authorization

Customer’s authorization to go live confirms that Customer has completed UAT, approved configuration and data, established policies and staffing, trained Users, validated integrations, and accepted known limitations, except for defects expressly documented in a mutually accepted go-live plan.

18.8 Training

Training is educational and does not replace Customer policy, professional education, legal advice, compliance training, emergency preparation, or competency validation. Customer is responsible for attendance, internal training, onboarding, refreshers, and version-specific updates.

19. Fees, Taxes, and Payment

19.1 Fees

Customer will pay all fees stated in the Order and SOW. Subscription fees are based on access rights and purchased capacity, not actual use, and are non-cancellable and non-refundable except as expressly stated in the Agreement.

19.2 Invoicing and Payment

Unless the Order states otherwise, invoices are due net thirty days from invoice date. Customer will provide accurate billing information and purchase-order details before service commencement. Failure to issue a purchase order does not excuse payment.

19.3 Disputes

Customer must notify FG in writing of a good-faith invoice dispute within fifteen days of invoice receipt, describing the disputed amount and basis. Customer will timely pay undisputed amounts. The parties will work in good faith to resolve the dispute.

19.4 Late Amounts

Overdue undisputed amounts may accrue interest at the lesser of 1.5% per month or the maximum lawful rate, plus reasonable collection costs. FG may suspend under Section 21 after notice and opportunity to cure.

19.5 Taxes

Fees exclude taxes, duties, levies, and similar governmental assessments. Customer is responsible for all such amounts except taxes based on FG’s net income. Customer will provide valid exemption documentation before invoicing.

19.6 Expenses

Customer will reimburse reasonable, pre-approved travel and out-of-pocket expenses for Professional Services unless the SOW states they are included.

20. Subscription Term and Renewal

20.1 Term

These Terms begin when accepted and remain in effect while any Order or account remains active. Each Order continues for its stated initial subscription term.

20.2 Automatic Renewal

Unless the Order states otherwise, each paid subscription automatically renews for successive one-year periods unless either party gives written notice of non-renewal at least sixty days before the current term ends. Renewal fees will be FG’s then-current rates or the rates stated in the Order.

20.3 No Midterm Cancellation

Customer may not cancel an Order for convenience during a committed term unless the Order expressly permits it. Discontinuing use does not eliminate payment obligations.

21. Suspension

21.1 Grounds

FG may suspend all or part of the Services if: (a) undisputed fees are more than thirty days overdue after notice; (b) Customer or a User materially breaches the Agreement; (c) use poses a security, legal, safety, or operational risk; (d) suspension is required by law or government order; (e) Customer exceeds usage limits and does not promptly cure; or (f) Customer’s conduct threatens FG, the Services, another customer, or a third party.

21.2 Scope and Notice

FG will limit suspension to the extent reasonably necessary and provide prior notice and an opportunity to cure when practicable. FG may suspend immediately for urgent security, legal, or safety reasons.

21.3 No Relief from Payment

Suspension does not relieve Customer of payment obligations or responsibility for Customer Data, exports, legal holds, emergency processes, or continuity plans.

22. Termination and Effect of Termination

22.1 Termination for Cause

Either party may terminate an affected Order or SOW if the other party materially breaches the Agreement and fails to cure within thirty days after written notice. The cure period is ten days for nonpayment and may be omitted where breach is incurable, unlawful, fraudulent, or creates an urgent security or safety threat.

22.2 Insolvency

Either party may terminate if the other becomes insolvent, makes an assignment for creditors, enters liquidation, or becomes subject to a bankruptcy proceeding not dismissed within sixty days, to the extent permitted by law.

22.3 Effect

Upon expiration or termination, Customer’s rights to access the affected Services end; Customer will cease use; all accrued fees become due; and each party will return or destroy the other’s Confidential Information as required by the Agreement, subject to retention rights and legal obligations.

22.4 Refunds

If Customer terminates for FG’s uncured material breach, FG will refund prepaid subscription fees allocable to the unused portion of the terminated Service. If FG terminates for Customer breach, Customer remains responsible for committed fees to the extent permitted by law.

22.5 Survival

Provisions concerning payment, ownership, confidentiality, data export and deletion, disclaimers, indemnification, liability limits, dispute resolution, and any terms that by their nature should survive will survive expiration or termination.

23. Data Export, Retention, Legal Holds, and Deletion

23.1 Active-Term Exports

Customer should regularly export records needed for operations, compliance, legal holds, or continuity. The Services are not Customer’s sole archival, medical-record, claims, regulatory, or evidence repository unless a signed Order expressly states otherwise.

23.2 Post-Term Access

Upon written request made within thirty days after termination or expiration and subject to payment of undisputed fees, FG will make Customer Data available in a generally available export format. Complex migration, transformation, validation, or media delivery may require fees.

23.3 Deletion

After the post-term retrieval period, FG may delete Customer Data from active systems. Unless the BAA, DPA, Order, or law requires another period, FG will use commercially reasonable efforts to complete deletion from active systems within ninety days, subject to backup rotation, disaster recovery, legal holds, security records, and technically infeasible remnants.

23.4 Backups

Data in backups may remain until overwritten through ordinary cycles and will remain protected and inaccessible for ordinary business use. FG is not required to restore individual items from backup except as expressly stated in an Order or disaster-recovery obligation.

23.5 Customer Retention and Legal Holds

Customer is responsible for retention schedules, holds, preservation notices, discovery, public-records obligations, and suspending deletion where required. FG acts on Customer’s documented instructions and may charge for extraordinary preservation or retrieval work.

23.6 Certification

Where required by the BAA, DPA, or Order, FG will provide reasonable certification of deletion after applicable periods, subject to lawful retention and backup exceptions.

24. Confidentiality

24.1 Definition

“Confidential Information” means nonpublic information disclosed by one party to the other that is marked confidential or reasonably should be understood as confidential, including Customer Data, PHI, security information, product plans, pricing, credentials, technical information, and business information.

24.2 Obligations

The receiving party will use Confidential Information only to perform or exercise rights under the Agreement; protect it using at least reasonable care; and disclose it only to personnel, professional advisers, Affiliates, and subcontractors who need to know and are bound by confidentiality obligations at least as protective.

24.3 Exclusions

Confidential Information excludes information the receiving party can document: was lawfully known without restriction; becomes public without breach; is received lawfully from a third party without duty; or is independently developed without use of the disclosing party’s Confidential Information.

24.4 Required Disclosure

The receiving party may disclose information required by law, subpoena, court order, public-records law, or regulator, provided it gives advance notice when lawful, reasonably assists with protective measures at the disclosing party’s expense, and discloses only what is required.

24.5 Duration and Equitable Relief

Confidentiality obligations continue for five years after disclosure, except trade secrets remain protected while legally qualifying and PHI remains protected as required by the BAA and law. Unauthorized disclosure may cause irreparable harm for which injunctive relief may be appropriate.

25. Intellectual Property and Feedback

25.1 FG Ownership

FG and its licensors own FG Technology and all related intellectual-property rights. Customer receives only the rights expressly granted in the Agreement.

25.2 Customer Materials and Configurations

Customer owns Customer Data and Customer-provided trademarks, policies, forms, and materials. Customer-specific configuration data belongs to Customer, but FG retains ownership of the underlying platform, schema, workflow engine, templates, generic components, methods, and know-how used to create or operate configurations.

25.3 Professional Services Deliverables

Unless an SOW expressly states otherwise, FG owns reusable tools, code, templates, methods, and generalized know-how included in deliverables. Upon payment, Customer receives a non-exclusive, non-transferable license to use deliverables internally with the Services during the applicable term. Customer-owned materials embedded in a deliverable remain Customer’s property.

25.4 Feedback

Customer grants FG a perpetual, irrevocable, worldwide, royalty-free right to use and incorporate suggestions, enhancement requests, recommendations, and other feedback without restriction or attribution, provided FG does not identify Customer or disclose Customer Confidential Information.

25.5 Marks and Publicity

Neither party may use the other’s name or marks publicly without consent, except FG may identify Customer in an internal customer list. Any public logo use, case study, press release, or testimonial requires Customer’s prior written approval.

26. Acceptable Use and Prohibited Conduct

Customer and Users must comply with Schedule 1. Without limiting Schedule 1, they may not use the Services unlawfully; interfere with security or operation; access data without authority; upload malicious or infringing content; make knowingly false or malicious reports; re-identify de-identified data; bypass usage limits; reverse engineer; or use the Services to build or train a competing product.

27. Customer Representations and Warranties

Customer represents, warrants, and covenants that:

• it has authority to enter the Agreement and permit all Authorized Users and Customer Affiliates to use the Services;

• it has all rights, notices, consents, authorizations, and lawful bases required for Customer Data and FG’s instructed processing;

• Customer Data, Customer materials, configurations, instructions, and use will not violate law, privacy, confidentiality, privilege, contract, intellectual-property, publicity, or other rights;

• it will not represent that FG provides medical care, emergency response, legal advice, regulatory certification, or guaranteed anonymity, compliance, safety, or outcomes;

• it will maintain qualified human oversight and independent emergency, compliance, legal, clinical, safety, and continuity processes; and

• it will promptly correct inaccurate notices, configurations, permissions, or representations within its control.

28. Founder’s Garage Limited Warranties

28.1 Service Warranty

During a paid Subscription Term, FG warrants that the production Services will perform materially in accordance with the applicable Documentation under normal authorized use.

28.2 Professional Services Warranty

FG warrants that Professional Services will be performed in a professional and workmanlike manner by personnel with appropriate skill.

28.3 Exclusions

The warranties do not apply to issues caused by Customer Data; Customer configurations or instructions; misuse; unauthorized changes; unsupported environments; third-party products; integrations; internet or telecommunications; failure to follow Documentation; beta features; force majeure; or Customer’s failure to install or permit updates.

28.4 Exclusive Remedy

Customer must notify FG of a warranty claim promptly and with sufficient detail. FG’s exclusive obligation and Customer’s exclusive remedy is correction or reperformance. If FG cannot cure a material Service nonconformity within a reasonable period, Customer may terminate the affected Service and receive a refund of prepaid fees for the unused portion.

29. Disclaimers

EXCEPT FOR THE EXPRESS WARRANTIES IN SECTION 28 AND TO THE MAXIMUM EXTENT PERMITTED BY LAW, THE SERVICES, AUTOMATED OUTPUTS, REPORTS, CONTENT, DOCUMENTATION, SUPPORT, PROFESSIONAL SERVICES, BETA FEATURES, AND THIRD-PARTY MATERIALS ARE PROVIDED “AS IS” AND “AS AVAILABLE.” FG DISCLAIMS ALL OTHER WARRANTIES AND CONDITIONS, EXPRESS, IMPLIED, STATUTORY, OR OTHERWISE, INCLUDING MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, TITLE, NON-INFRINGEMENT, ACCURACY, COMPLETENESS, QUIET ENJOYMENT, AND WARRANTIES ARISING FROM COURSE OF DEALING OR USAGE OF TRADE.

FG DOES NOT WARRANT THAT THE SERVICES WILL BE UNINTERRUPTED, ERROR-FREE, SECURE, FREE OF HARMFUL COMPONENTS, OR COMPATIBLE WITH EVERY SYSTEM; THAT DATA, ALERTS, TRANSCRIPTIONS, CLASSIFICATIONS, ANALYTICS, OR OUTPUTS WILL BE ACCURATE OR COMPLETE; THAT INCIDENTS OR COMPLAINTS WILL BE ROUTED, REVIEWED, RESOLVED, OR REPORTED ON TIME; OR THAT USE WILL PREVENT HARM, IMPROVE OUTCOMES, SATISFY LAW OR ACCREDITATION, PRESERVE PRIVILEGE, OR PRODUCE ANY PARTICULAR RESULT.

CUSTOMER ACKNOWLEDGES THAT INTERNET, MOBILE, EMAIL, SMS, THIRD-PARTY, AND INTEGRATION SERVICES INVOLVE DELAYS AND RISKS OUTSIDE FG’S CONTROL. CUSTOMER IS RESPONSIBLE FOR INDEPENDENT VERIFICATION, BACKUP, MONITORING, ESCALATION, AND CONTINUITY.

30. Indemnification

30.1 Customer Indemnity

To the maximum extent permitted by law, Customer will defend, indemnify, and hold harmless FG, its Affiliates, licensors, hosting providers, subprocessors, and their officers, directors, employees, contractors, and agents (“FG Indemnified Parties”) from third-party claims, investigations, demands, proceedings, fines, penalties, damages, judgments, settlements, losses, liabilities, costs, and reasonable attorneys’ fees arising out of or relating to:

• Customer Data, Customer materials, Customer instructions, or allegations that any of them infringe, misappropriate, violate privacy, breach confidentiality, defame, or otherwise violate a third party’s rights;

• Customer’s or an Authorized User’s use or misuse of the Services, breach of the Agreement, unlawful conduct, or violation of the Acceptable Use Policy;

• Customer’s forms, notices, promises, consent practices, reporting channels, employment practices, patient communications, service recovery, investigations, classifications, closures, disclosures, exports, integrations, or decisions;

• Customer’s failure to obtain consent, comply with law, make required reports or notifications, respond to an emergency, preserve records or privilege, or maintain appropriate human review and continuity procedures;

• bodily injury, death, property damage, employment action, professional discipline, denial of benefits or services, or other consequential decision arising from Customer’s acts or omissions or reliance on Service outputs; or

• a third-party product, system, integration, destination, or service selected, controlled, or supplied by Customer.

Customer has no obligation under this Section to the extent a final, non-appealable judgment determines the claim was directly caused by FG’s gross negligence, willful misconduct, or material breach of the Agreement.

30.2 FG Intellectual-Property Indemnity

FG will defend Customer against a third-party claim alleging that Customer’s authorized use of the unmodified production Services infringes a United States patent, copyright, or trade secret, and will indemnify Customer for final damages awarded or settlements approved by FG. FG may obtain a license, modify or replace the affected Service, or terminate it and refund prepaid unused fees for the affected period.

30.3 IP Indemnity Exclusions

FG’s obligation does not apply to claims arising from Customer Data, inputs, outputs derived from Customer Data, Customer materials, specifications, configurations, combinations with non-FG items, modifications not made by FG, use outside the Agreement, continued use after notice, third-party products, open-source components governed by separate terms, or beta features. Section 30.2 states Customer’s exclusive remedy for intellectual-property claims.

30.4 Procedure

The indemnified party must promptly notify the indemnifying party, provide reasonable cooperation at the indemnifying party’s expense, and allow the indemnifying party to control defense and settlement. Delay relieves the obligation only to the extent of material prejudice. No settlement may admit fault by or impose nonmonetary obligations on the indemnified party without its prior written consent, not to be unreasonably withheld.

31. Limitation of Liability

31.1 Excluded Damages

TO THE MAXIMUM EXTENT PERMITTED BY LAW, NEITHER PARTY NOR ITS AFFILIATES, LICENSORS, OR SUPPLIERS WILL BE LIABLE FOR INDIRECT, INCIDENTAL, SPECIAL, CONSEQUENTIAL, EXEMPLARY, PUNITIVE, OR ENHANCED DAMAGES; LOST PROFITS, REVENUE, SAVINGS, GOODWILL, OR BUSINESS; LOSS, CORRUPTION, OR INACCURACY OF DATA; BUSINESS INTERRUPTION; COST OF SUBSTITUTE SERVICES; OR DELAY, EVEN IF ADVISED OF THE POSSIBILITY.

31.2 General Cap

EXCEPT FOR EXCLUDED CLAIMS, EACH PARTY’S TOTAL AGGREGATE LIABILITY ARISING OUT OF OR RELATING TO THE AGREEMENT WILL NOT EXCEED THE FEES PAID OR PAYABLE BY CUSTOMER FOR THE AFFECTED SERVICES UNDER THE APPLICABLE ORDER DURING THE TWELVE MONTHS IMMEDIATELY PRECEDING THE FIRST EVENT GIVING RISE TO LIABILITY.

31.3 Enhanced Data Cap

If a signed BAA or DPA does not state a different cap, FG’s aggregate liability for a confirmed breach of its confidentiality, data-protection, or security obligations involving Customer Data will not exceed two times the fees paid or payable for the affected Services during the twelve months preceding the first event. The General Cap and Enhanced Data Cap are not cumulative for the same event.

31.4 Excluded Claims

“Excluded Claims” means: (a) Customer’s payment obligations; (b) Customer’s obligations under Section 30.1; (c) either party’s fraud, willful misconduct, or liability that cannot lawfully be limited; (d) Customer’s infringement or misappropriation of FG Technology; and (e) Customer’s breach of the Acceptable Use Policy involving unauthorized access, security attacks, or unlawful data processing. FG’s IP indemnity remains subject to the General Cap unless an Order expressly states otherwise.

31.5 Allocation of Risk

The fees reflect this allocation of risk. The limitations apply regardless of legal theory and even if a limited remedy fails of its essential purpose. Each claim is aggregated with all related claims under the Agreement.

31.6 Public Entities

For a governmental Customer, obligations apply only to the extent permitted by applicable law and without waiving sovereign, governmental, qualified, or other immunity. The parties will address legally required modifications in the applicable Order.

32. Compliance, Export Controls, and Government Customers

32.1 Applicable Law

Each party will comply with laws applicable to its own performance. FG is not responsible for laws applicable to Customer’s industry, professional practice, Customer Data, configurations, Users, reporting obligations, or use cases except as expressly stated in the BAA, DPA, or Order.

32.2 Export and Sanctions

Customer will comply with United States export-control, sanctions, and anti-boycott laws and will not permit access from or by prohibited jurisdictions or persons. Customer represents that it is not a restricted party and will not use the Services for prohibited end uses.

32.3 Anti-Corruption

Neither party will offer or accept unlawful bribes, kickbacks, or improper payments in connection with the Agreement. Customer will comply with applicable procurement, ethics, and conflict-of-interest rules.

32.4 Government Use

The Services are commercial computer software and commercial computer software documentation. Government users receive only the rights granted under the Agreement. Customer is responsible for identifying mandatory government terms before execution of an Order.

32.5 Public Records

A governmental Customer is responsible for public-records obligations. FG may disclose records as required by law after providing notice when lawful. Customer will reimburse reasonable costs of extraordinary collection, review, redaction, preservation, or production unless prohibited by law or otherwise agreed.

32.6 No Debarment Representation Beyond Order

Any certifications concerning debarment, HUB participation, background checks, insurance, accessibility, cybersecurity frameworks, or public contracting apply only if expressly included in a signed Order, certification, or SOW.

33. Dispute Resolution, Binding Arbitration, and Governing Law

33.1 Required Informal Resolution

Before starting arbitration or litigation, the claimant must send a written Notice of Dispute to support@hsqia.com and to the other party’s notice address. The notice must identify the claimant, account or Customer, facts, legal basis, and requested relief. The parties will attempt in good faith to resolve the dispute for sixty days after receipt. Organizational Customers will participate through authorized business representatives; an individual claimant may request a telephone or video conference. This requirement does not prevent a small-claims filing, urgent provisional relief, a filing needed to preserve a limitation period, or immediate security action.

33.2 Agreement to Binding Arbitration

Except for the matters expressly excluded in Section 33.10, every dispute, claim, or controversy arising out of or relating to the Agreement, the Services, Customer Data, any Order or SOW, marketing, privacy, security, billing, termination, or the relationship between the parties will be resolved by final and binding individual arbitration administered by the American Arbitration Association (“AAA”). The Federal Arbitration Act governs the interpretation and enforcement of this arbitration agreement and preempts inconsistent state law to the extent applicable.

33.3 Applicable AAA Rules

The AAA Commercial Arbitration Rules and Mediation Procedures apply to disputes involving an organization, business, governmental entity, or person acting for a Customer. The AAA Consumer Arbitration Rules and Mediation Procedures apply when an individual uses the Services primarily for personal, family, or household purposes and those rules legally apply. The AAA Mass Arbitration Supplementary Rules apply to coordinated filings that satisfy those rules. The applicable rules are incorporated by reference as then in effect when the demand is filed, except where this Section expressly provides otherwise.

33.4 Arbitrator and Authority

The arbitration will be conducted by one neutral arbitrator. Except for questions reserved to a court in this Section, the arbitrator has exclusive authority to resolve disputes concerning interpretation, applicability, enforceability, or formation of the Agreement and may award any individual remedy available in court. A court, not the arbitrator, will decide whether the class-action waiver is enforceable and whether a dispute may proceed on a class, collective, consolidated, or representative basis.

33.5 Location and Hearing Format

The legal seat and agreed hearing location is Ellis County, Texas. The arbitrator may conduct proceedings by documents, telephone, video, or in person. For a consumer dispute, a different location or remote format will be used when required by applicable law or the AAA Consumer Arbitration Rules. Judgment on the award may be entered in any court with jurisdiction.

33.6 Individual Proceedings and Class-Action Waiver

TO THE MAXIMUM EXTENT PERMITTED BY LAW, EACH PARTY AGREES THAT CLAIMS MAY BE BROUGHT ONLY IN THAT PARTY’S INDIVIDUAL CAPACITY. NO CLAIM MAY PROCEED AS A CLASS, COLLECTIVE, CONSOLIDATED, REPRESENTATIVE, PRIVATE-ATTORNEY-GENERAL, OR JOINT PROCEEDING. THE ARBITRATOR MAY NOT CONSOLIDATE CLAIMS OF DIFFERENT PERSONS OR PRESIDE OVER ANY FORM OF REPRESENTATIVE PROCEEDING WITHOUT THE EXPRESS WRITTEN CONSENT OF ALL PARTIES.

33.7 Coordinated or Mass Filings

If twenty-five or more substantially similar demands are submitted against the same party by or with coordinated counsel or organizations within a one-hundred-eighty-day period, the AAA Mass Arbitration Supplementary Rules will govern administration. The parties will cooperate with AAA regarding efficient staging, selection of process or merit arbitrators, and preservation of claims while demands are administratively held. This provision does not authorize class arbitration or consolidation of merits determinations without written consent.

33.8 Fees and Award

Filing, administrative, and arbitrator fees will be allocated under the applicable AAA rules. For a qualifying consumer matter, FG will pay fees to the extent required by the AAA Consumer Arbitration Rules or applicable law. Each party bears its own attorneys’ fees unless a statute, rule, or the arbitrator permits an award. The arbitrator will issue a reasoned written award and may grant relief only to the individual claimant and only to the extent necessary to resolve that claimant’s claim.

33.9 Confidentiality

The parties will keep nonpublic arbitration materials and proceedings confidential except as reasonably necessary to conduct the case, enforce or challenge an award, comply with law, satisfy regulatory or public-records duties, or consult professional advisers bound by confidentiality.

33.10 Excluded Matters

Either party may bring an eligible individual action in small-claims court. Either party may seek temporary or preliminary injunctive relief in a court of competent jurisdiction to protect Confidential Information, intellectual property, account or platform security, or prevent unauthorized access or misuse while arbitration is pending. FG may pursue collection of undisputed amounts in court where permitted. Government Customers may address mandatory statutory restrictions in an Order.

33.11 Individual User Opt-Out

An individual who accepts these Terms solely in an individual capacity and not for an organizational Customer may opt out of arbitration by emailing support@hsqia.com within thirty days after first acceptance. The notice must state the individual’s full name, account email, acceptance date, and an unambiguous decision to opt out of arbitration. Opting out does not affect other Terms. Organizational Customers may opt out only through an Order signed by FG.

33.12 Severability of Arbitration Terms

If any part of this Section is unenforceable, it will be severed or reformed only to the minimum extent necessary. If the individual-proceedings waiver is unenforceable for a particular claim, that claim must proceed in a court of competent jurisdiction and not in class arbitration; any enforceable individual claims will remain subject to arbitration and may be stayed pending the court proceeding.

33.13 Governing Law and Court Venue

The Agreement is governed by Texas law, without regard to conflict-of-law rules, except that the Federal Arbitration Act governs arbitration. The United Nations Convention on Contracts for the International Sale of Goods does not apply. For any matter permitted to proceed in court, each party consents to exclusive jurisdiction in the state courts located in Ellis County, Texas and the federal courts serving Ellis County, Texas, subject to mandatory law.

33.14 Jury-Trial Waiver

TO THE MAXIMUM EXTENT PERMITTED BY LAW, EACH PARTY KNOWINGLY, VOLUNTARILY, AND IRREVOCABLY WAIVES TRIAL BY JURY IN EVERY ACTION OR PROCEEDING ARISING OUT OF OR RELATING TO THE AGREEMENT OR SERVICES THAT IS NOT RESOLVED IN ARBITRATION.

33.15 Time to Bring Claims

An organizational Customer or FG must bring any claim within one year after the claimant knew or reasonably should have known of the basis for the claim, except claims for nonpayment, infringement, confidentiality, fraud, indemnification, or obligations that cannot lawfully be shortened. An individual consumer retains any longer nonwaivable statutory limitation period.

34. Notices

34.1 Operational Notices

FG may provide operational, security, product, billing, and Terms notices by email to Customer’s account owner, through the Services, or by posting to an identified legal or status page. Customer must keep contact information current and monitor designated channels.

34.2 Legal Notices to FG

Formal legal notices must be sent by nationally recognized overnight courier or certified mail to Founder’s Garage, LLC, 110 Balsam Ln, Waxahachie, TX 75167, Attention: Legal, with a copy by email to support@hsqia.com. Notices are effective upon confirmed delivery. Email alone is insufficient for litigation or termination notices unless FG acknowledges receipt in writing.

34.3 Notices to Customer

Formal notices to Customer may be sent to the address and email in the Order. Customer is responsible for updating those contacts. Notice is effective upon confirmed electronic delivery or two business days after courier dispatch.

35. Changes to the Services and These Terms

35.1 Version Identification

Every published version will display a unique version number, revision date, effective date, and link to archived prior versions. FG will maintain a change summary and internal approval record.

35.2 Material Changes

FG will provide at least thirty days’ advance notice of a material change that materially increases Customer obligations or reduces Customer rights, unless a shorter period is reasonably necessary for law, security, fraud prevention, third-party requirements, or urgent operational protection.

35.3 Fixed-Term Enterprise Orders

For a paid fixed-term Order, a material change will not apply before renewal if it materially increases Customer’s financial or liability obligations, unless Customer accepts it, the Order permits it, or the change is required by law or necessary to address a material security risk. Non-material clarifications, new features, and protective changes may apply when posted.

35.4 Acceptance and Reacceptance

FG may require an authorized Customer representative or Users to reaccept a material version. Continued use after the effective date constitutes acceptance when legally permitted and after required notice. If Customer rejects a material change that applies during a renewal term, Customer’s remedy is to stop use and give timely non-renewal notice, unless the change grants a separate termination right.

35.5 Acceptance Records

FG may retain records of acceptance and notice, including Customer, User, representative authority, version, timestamp, account, IP address, device or browser information, notice method, and reacceptance status, subject to the Privacy Policy and applicable law.

35.6 Archive Integrity

Published versions will be preserved in an immutable or access-controlled archive. Corrections that do not change meaning may be documented without a new effective version; substantive changes require a new version number.

36. General Terms

36.1 Assignment

Neither party may assign the Agreement without the other’s prior written consent, except to an Affiliate or in connection with a merger, reorganization, or sale of substantially all assets related to the Agreement, provided the assignee assumes the obligations and is not a direct competitor of the non-assigning party. Customer may not assign to a competitor of FG without consent.

36.2 Subcontractors

FG may use Affiliates and subcontractors to provide the Services and remains responsible for their performance to the extent required by the Agreement. Subprocessors handling personal data or PHI are governed by the DPA or BAA.

36.3 Independent Contractors

The parties are independent contractors. The Agreement does not create an agency, partnership, fiduciary, employment, franchise, joint venture, or exclusive relationship.

36.4 Force Majeure

Neither party is liable for delay or failure caused by events beyond reasonable control, including natural disasters, epidemics, war, terrorism, civil unrest, labor disputes, utility or internet failures, cloud or telecommunications outages, government action, and cyberattacks not caused by that party’s failure to use reasonable safeguards. Force majeure does not excuse payment for Services already provided.

36.5 Severability and Reformation

If a provision is unenforceable, it will be modified to the minimum extent needed to make it enforceable while preserving intent, and the remaining provisions remain effective.

36.6 Waiver

A waiver must be in writing and applies only to the specific instance. Delay or failure to enforce is not a waiver.

36.7 No Third-Party Beneficiaries

Except for FG Indemnified Parties, the Agreement creates no third-party beneficiary rights.

36.8 Interpretation

Headings are for convenience. “Including” means “including without limitation.” Electronic records and signatures are originals. The parties waive any rule construing ambiguity against the drafter.

36.9 Entire Agreement

The Agreement is the complete agreement concerning its subject matter and supersedes prior or contemporaneous proposals, representations, and understandings. Customer acknowledges it has not relied on statements not expressly included in the Agreement.

36.10 Counterparts and Electronic Acceptance

Orders, SOWs, and amendments may be executed in counterparts and electronically. Electronic signatures, click acceptance, and authenticated account actions have the same effect as originals to the extent permitted by law.

Schedule 1 - Acceptable Use Policy

This Acceptable Use Policy is incorporated into the Terms. Customer is responsible for compliance by all Authorized Users and Public Submitters to the extent Customer controls their use.

A. Lawful and Authorized Use

• Use the Services only for lawful, authorized organizational purposes and within the scope of the Order, Documentation, role permissions, and Customer policy.

• Do not access, collect, submit, disclose, or export information without authorization or a valid legal basis.

• Do not use the Services to violate privacy, healthcare, employment, discrimination, whistleblower, surveillance, intellectual-property, export, sanctions, or other laws.

B. Security and Platform Integrity

• Do not introduce malware, ransomware, harmful code, corrupted files, credential harvesters, or destructive content.

• Do not probe, scan, test, attack, overload, disrupt, bypass, disable, or circumvent authentication, authorization, security, logging, rate limits, usage limits, or technical controls.

• Do not use automated scraping, bots, bulk extraction, or excessive API calls except as expressly authorized.

• Do not share credentials, impersonate another person, create unauthorized accounts, or conceal the origin of activity.

C. Content and Reporting Conduct

• Good-faith reports are permitted even if later unsubstantiated. Do not knowingly submit false, fabricated, fraudulent, retaliatory, defamatory, threatening, harassing, discriminatory, or malicious content.

• Do not upload content that infringes intellectual property, privacy, confidentiality, privilege, publicity, or contractual rights.

• Do not include unnecessary sensitive information, passwords, secret keys, payment-card data, or specially regulated records in narratives, attachments, support requests, or test environments.

D. Safety and Consequential Decisions

• Do not use the Services as an emergency channel or as the sole means to identify or respond to imminent danger.

• Do not make a medical, employment, credentialing, disciplinary, insurance, legal, benefit, or other consequential decision solely from an automated output.

• Do not use the Services for unlawful surveillance, stalking, biometric categorization, discriminatory profiling, or retaliation.

E. Intellectual Property and Competition

• Do not reverse engineer, decompile, disassemble, copy, frame, mirror, or create derivative works of FG Technology except where law expressly prohibits the restriction.

• Do not use nonpublic features, outputs, Documentation, APIs, or access to develop, benchmark, train, validate, or offer a competing product or model without FG’s written consent.

• Do not remove proprietary notices or publish nonpublic performance or security test results without FG’s written approval.

F. Data and AI Restrictions

• Do not attempt to re-identify de-identified or aggregated data.

• Do not use Automated Features to generate unlawful, deceptive, discriminatory, harmful, or rights-violating content.

• Do not circumvent AI safeguards or submit data to an Automated Feature without authority and required consent.

G. Enforcement

• FG may investigate suspected violations, preserve evidence, restrict content, suspend access, or notify Customer or authorities where reasonably necessary and lawful.

• FG will consider the nature, severity, recurrence, risk, and Customer cooperation when selecting enforcement measures. Immediate suspension may occur for urgent security, safety, or legal risks.

Schedule 2 - AI and Automated-Feature Terms

This Schedule supplements Section 13 and applies whenever Customer activates or uses an Automated Feature.

1. Governance and Authorization

• Customer will maintain a current inventory of enabled Automated Features, approved use cases, data categories, owners, human reviewers, validation results, and restrictions.

• Only authorized administrators may enable a feature that processes sensitive data or affects consequential workflows.

• Customer will provide required workforce, patient, and public notices and obtain consent where applicable.

2. Validation and Monitoring

• Before production use, Customer will test accuracy, false positives, false negatives, edge cases, bias, accessibility, language performance, and failure handling using representative data.

• Customer will periodically reevaluate performance after model, workflow, taxonomy, population, law, or data changes.

• Customer will permit Users to correct outputs and will preserve the original input, output, reviewer, correction, and final decision where required by policy or law.

3. Human Oversight

• A qualified person must review outputs in context and may not defer professional judgment merely because a confidence score or recommendation is displayed.

• Customer must provide a path to override, correct, escalate, or discontinue an output.

• Customer remains responsible for every decision, communication, report, and action taken or omitted based on an output.

4. Data Use

• Customer will minimize sensitive inputs and use de-identified or synthetic data for testing where possible.

• FG will not train generalized cross-customer models on Customer Data or PHI without explicit written opt-in and applicable BAA/DPA authorization.

• Third-party model processing is subject to disclosed subprocessor, region, security, and retention terms.

5. No Guaranteed Explainability or Uniqueness

• Outputs may be non-unique and similar outputs may be generated for other users.

• FG does not guarantee that every output can be fully explained, reproduced, or traced to a specific source.

• Customer will not represent an output as independently verified, clinically validated, legally authoritative, or unbiased unless Customer has separately established that fact.

Schedule 3 - Implementation, UAT, and Configuration Responsibility

This Schedule allocates responsibility for configuration-heavy implementations. It does not replace a project-specific SOW.

Schedule 4 - Versioning, Notice, and Acceptance Records

FG will operate the following minimum controls for published legal terms and incorporated policies:

Enterprise Acceptance Record

This block may be used in an Order or electronic acceptance workflow to link a Customer’s acceptance to Version 1.0 and preserve authority, timestamp, and technical evidence.