BSI Subscription Terms of Service

1. Platform and Services

BSI provides a hosted platform and related services for healthcare suppliers and other authorized business users, which may include billing workflow, revenue-cycle support, claims and document management, compliance tools, reporting, integrations, communications, automation, AI Features, and operational services. The specific Services, Facilities, Authorized Users, usage entitlements, implementation services, and support included in Subscriber’s subscription are identified in the applicable Order Form, Fee Schedule and Business Services Election Form, Subscription Tier, or enabled account configuration. Features not included in Subscriber’s Subscription Tier are not licensed merely because they are technically visible or accessible. No service level, response time, uptime commitment, or remedy applies unless expressly stated in an Order Form signed by an authorized BSI representative.

2. Definitions

"AI Features" means any feature of the Services that uses machine learning, generative AI, large language models, predictive analytics, automated classification, extraction, recommendation, summarization, or similar computational techniques.

"AI Input" means any prompt, instruction, file, data, Content, or other information submitted to an AI Feature by or for Subscriber.

"AI Output" means any content, prediction, classification, recommendation, summary, response, or other result generated by an AI Feature from an AI Input.

"API" means an application programming interface, webhook, software development kit, integration connector, or other machine-to-machine interface that BSI expressly documents and authorizes Subscriber to use.

"API Credentials" means API keys, tokens, client secrets, certificates, OAuth credentials, signing keys, or other credentials issued or approved for access to an API.

"Authorized User" means an individual employee, contractor, or agent whom Subscriber authorizes to use the Services for Subscriber’s internal business purposes and for whom Subscriber has purchased or received the required entitlement.

"Confidential Information" means nonpublic information disclosed by or on behalf of a party that is designated confidential or that reasonably should be understood as confidential given its nature and the circumstances of disclosure, including Customer Data, PHI, security information, source code, product roadmaps, pricing, business plans, and trade secrets.

"Customer Data" means Content and Service Data submitted to, collected by, transmitted through, or stored in the Services by or for Subscriber, including AI Inputs, but excluding De-Identified Data and Usage Data.

"De-Identified Data" means data that does not identify and cannot reasonably be used to identify Subscriber, an Authorized User, a patient, or another individual and, when derived from PHI, has been de-identified in accordance with 45 C.F.R. Sections 164.514(a)-(c) or another method permitted by the Business Associate Agreement and Applicable Law.

"Documentation" means BSI’s then-current user guides, technical documentation, supported-use instructions, security requirements, API documentation, and written policies made available for the Services.

"Facility" means each office, operational location, legal entity, or other location identified or maintained in the BFLOW system, regardless of whether the location has a separate National Provider Identifier. Subscriber is billed for each Facility as stated in the applicable Fee Schedule.

"Order Form" means an order, quote, Fee Schedule and Business Services Election Form, online selection, statement of work, or similar ordering document accepted by BSI that identifies Services, fees, quantities, usage entitlements, or other subscription details.

"PHI" means protected health information as defined under the Health Insurance Portability and Accountability Act of 1996, as amended, and its implementing regulations (collectively, "HIPAA").

"Service Data" means medical-practice operational, financial, patient, medical-supply, medical-service, claims, payer, insurance, and related data processed through the Services by or for Subscriber, including PHI where applicable.

"Subscription Fees" means the recurring, usage-based, maintenance, implementation, support, transaction, overage, pass-through, and other fees applicable to Subscriber’s use of the Services.

"Subscription Tier" means the services, features, capacity, pricing, and usage package selected or purchased by Subscriber.

"Third-Party Services" means products, platforms, data sources, AI models, payment processors, communications providers, clearinghouses, payer portals, or other services not controlled by BSI that interoperate with or support the Services.

"Usage Data" means telemetry, logs, metrics, diagnostic data, configuration data, API-call data, performance data, and statistical information about use and operation of the Services that does not include identifiable Customer Data or PHI.

"Usage Limits" means any rate limit, transaction limit, storage limit, user or Facility limit, credit allocation, concurrency limit, model or token limit, or other technical or commercial entitlement applicable to the Services.

3. Order Forms; Priority; Scope

Each Order Form is governed by this Agreement. If documents conflict, the Business Associate Agreement controls solely with respect to PHI and HIPAA obligations; an Order Form signed by an authorized BSI representative controls solely as to the specific Services, fees, quantities, or provision it expressly modifies; these Terms control next; and the Documentation controls last. A purchase order, vendor portal term, click-through term, or other Subscriber document does not modify the Agreement, even if BSI accepts it for administrative convenience, unless an authorized BSI representative expressly signs the modification.

4. Eligibility, Accounts, and Authorized Users

Subscriber must maintain an account, designate at least one administrative Authorized User, provide accurate and current account and billing information, and execute BSI’s Business Associate Agreement before transmitting PHI. Subscriber is responsible for all acts and omissions of its Authorized Users, contractors, agents, and anyone using Subscriber’s credentials, and for ensuring their compliance with the Agreement.

Subscriber and each Authorized User must maintain unique credentials, use multifactor authentication when offered or required, keep credentials confidential, promptly remove access for individuals who no longer require it, and immediately notify BSI at support@bflowsolutions.com of suspected unauthorized access, credential compromise, or other account-related security incident or if they have found any potential compromises in the BSI platform. Credentials may not be shared, transferred, published, embedded in publicly accessible code, or used by more than one individual unless BSI expressly permits a service account. BSI may review account activity and user counts to verify compliance.

5. Subscription License and Authorized Use

Subject to Subscriber’s payment of all fees and continuing compliance with the Agreement, BSI grants Subscriber a limited, non-exclusive, non-transferable, non-sublicensable, revocable right during the Subscription Term for its Authorized Users to access and use the Services and Documentation solely for Subscriber’s internal business operations and only within the purchased Subscription Tier, Facilities, Usage Limits, Documentation, and intended functionality. Subscriber receives no ownership interest in the Services. Any right not expressly granted is reserved by BSI and its licensors.

6. APIs, Endpoints, Integrations, and Automated Access

Authorized interfaces only. Subscriber may access the Services only through the user interface, APIs, endpoints, webhooks, connectors, and other access methods that BSI expressly documents and enables for Subscriber’s Subscription Tier. Subscriber may not access, call, probe, discover, map, scan, or attempt to use any undocumented, private, internal, administrative, development, staging, deprecated, disabled, or otherwise unauthorized endpoint, route, service, database, model interface, object-storage location, or integration hook. Subscriber may not use a documented endpoint for a purpose, data type, volume, workflow, or environment not contemplated by the Documentation or Order Form.

API Credentials and integrations. Subscriber is responsible for securing API Credentials, limiting them to the least privilege necessary, rotating them when reasonably requested, and using separate credentials where BSI requires them. Subscriber may not share API Credentials outside Subscriber’s authorized integration, expose them in client-side code or public repositories, or transfer them to a third party without BSI’s written approval. Subscriber is responsible for each application, bot, agent, script, workflow, or integration that uses its account or API Credentials, including those provided by a third party.

Usage controls. Subscriber will comply with Usage Limits, retry and backoff instructions, authentication requirements, data-format rules, and all other technical controls. Subscriber may not evade or bypass a Usage Limit, metering control, access control, fee, security mechanism, or suspension; generate excessive, duplicative, abusive, or unnecessary calls; scrape or bulk-extract data; use browser automation, robotic process automation, headless browsers, or similar tools except as BSI expressly authorizes; or interfere with other customers’ use of the Services. BSI may monitor API and integration activity, throttle or reject requests, require changes, rotate or revoke API Credentials, disable an integration, or suspend access when reasonably necessary to protect the Services, enforce the Agreement, or manage capacity.

Changes. BSI may modify, version, replace, or discontinue an API or endpoint. BSI will use commercially reasonable efforts to provide advance notice of a material change to a generally available documented API when practicable, but may make immediate changes to address security, legal, third-party, or operational issues. Unless expressly stated in an Order Form, BSI does not guarantee backward compatibility or continued availability of an API version.

7. Acceptable Use and Prohibited Conduct

Subscriber will use the Services only for lawful, authorized business purposes and in accordance with the Agreement, Documentation, and Applicable Law. Subscriber will not, and will not permit any person to: (a) reverse engineer, decompile, disassemble, translate, derive source code from, or attempt to discover the architecture, models, prompts, weights, algorithms, or nonpublic components of the Services, except to the limited extent a restriction is prohibited by nonwaivable law; (b) copy, modify, sell, resell, sublicense, distribute, rent, lease, timeshare, outsource, or provide the Services for the benefit of a third party; (c) access the Services to build, benchmark, train, validate, or improve a competing product, service, dataset, or AI model, or publish benchmark results without BSI’s written consent; (d) circumvent a security control, content filter, guardrail, Usage Limit, billing mechanism, audit control, or access restriction; (e) conduct vulnerability testing, penetration testing, load testing, denial-of-service testing, prompt-injection testing, or red-team activity without BSI’s prior written authorization; (f) introduce malware, malicious code, harmful prompts, or instructions intended to exfiltrate data, reveal system prompts, manipulate another user’s data, or compromise the Services; (g) access or attempt to access another customer’s account, data, or environment; (h) send spam, unlawful communications, deceptive content, or content that infringes, misappropriates, harasses, discriminates, defames, or violates privacy or publicity rights; (i) process data that Subscriber lacks the right or authority to process; (j) use the Services in a manner that creates a material risk of physical, clinical, financial, legal, privacy, or security harm; or (k) use the Services in any manner not reasonably contemplated by the Agreement, Documentation, enabled configuration, or intended functionality. Subscriber must promptly cooperate with BSI’s reasonable investigation of suspected misuse. BSI may preserve and disclose relevant information as permitted by the Agreement, the Business Associate Agreement, and Applicable Law.

8. AI-Enabled Features

Permitted use and human oversight. AI Features are assistive tools and may produce probabilistic, incomplete, inaccurate, biased, outdated, offensive, or non-unique results. Subscriber is solely responsible for determining whether an AI Feature is appropriate for a use case; reviewing and validating each AI Output with qualified personnel; independently confirming coding, coverage, compliance, clinical, legal, financial, and operational conclusions; and maintaining meaningful human review before relying on an AI Output or taking action. AI Outputs may not be used as the sole basis for diagnosis, treatment, patient care, claim submission, coverage determination, legal advice, or any decision that produces a legal or similarly significant effect on an individual unless the use is expressly supported by the Documentation and complies with Applicable Law.

Inputs, rights, and PHI. Subscriber is responsible for AI Inputs and represents that it has all rights, permissions, notices, consents, and legal bases required to provide and process them. Subscriber may submit PHI to an AI Feature only when BSI has expressly identified that feature in writing as approved for PHI, the parties’ Business Associate Agreement applies, and Subscriber follows the Documentation. Subscriber must not place PHI, sensitive personal information, credentials, or other regulated data into a general-purpose or non-PHI-enabled AI Feature.

Ownership and non-uniqueness. As between the parties, Subscriber retains its rights in AI Inputs and, to the extent permitted by law, owns the AI Output generated specifically for Subscriber, subject to BSI’s and its licensors’ ownership of the Services, models, system prompts, templates, methods, Documentation, and other underlying technology. AI Outputs may not be unique, and the same or similar output may be generated for others. BSI does not represent that an AI Output is protectable, noninfringing, accurate, or fit for a particular purpose.

Data use and providers. BSI may process AI Inputs and AI Outputs to provide, secure, support, troubleshoot, monitor, and improve the Services as permitted by this Agreement and the Business Associate Agreement. BSI will not use identifiable Customer Data or PHI to train a general-purpose AI model for the benefit of unaffiliated third parties unless Subscriber expressly authorizes that use in writing. BSI may use De-Identified Data and Usage Data to develop, train, test, evaluate, secure, and improve its services and models. AI Features may use approved Third-Party Services and subprocessors; when PHI is involved, BSI will address them as required by the Business Associate Agreement and Applicable Law.

Responsible deployment. Subscriber will comply with laws governing automated decision systems, AI-generated content, discrimination, transparency, notice, consent, recordkeeping, and human review that apply to its use. Subscriber may not remove or conceal any disclosure, provenance indicator, watermark, usage notice, or limitation included with an AI Output. BSI may label, restrict, monitor, modify, or disable an AI Feature at any time when necessary for safety, quality, security, legal compliance, provider requirements, or prevention of abuse.

9. Subscriber Responsibilities for Billing and Revenue-Cycle Services

Subscriber remains the healthcare supplier, provider, or responsible business and retains ultimate responsibility for its patients, products, services, coding, documentation, claims, collections, and compliance. Subscriber will timely and accurately: (a) provide all claim information and supporting documentation required by payers and BSI; (b) enter all relevant information into the Platform; (c) review, approve, and submit claims; (d) provide copies of explanations of benefits, remittance advice, correspondence received from payers, and records of payments received directly from patients or others; (e) verify the accuracy and completeness of every claim and transaction before submission; and (f) maintain records required by Applicable Law and payer contracts.

If a claim has been billed and Subscriber has not provided BSI with the remittance advice or other information necessary to post and reconcile the claim within 120 days, BSI may collect the fees due to BSI on that claim and close or write off the remaining balance in the Platform’s accounts-receivable record. That administrative action does not waive Subscriber’s responsibility for the underlying account, and BSI does not guarantee that any claim will be paid or reimbursed.

10. Third-Party Services and Credentials

Subscriber authorizes BSI and its service providers to access, request, receive, transmit, and process information through Third-Party Services as reasonably necessary to provide the selected Services. Subscriber will use OAuth, delegated access, or another approved authorization method when available. If account credentials must be provided, Subscriber represents that it is authorized to provide them and directs BSI to use them for the Services. Subscriber is responsible for maintaining its rights and accounts with each Third-Party Service and for complying with the third party’s terms.

Third-Party Services are not controlled by BSI and may change, suspend, revoke access, impose fees, modify APIs, lose data, or discontinue functionality. BSI is not liable for an act, omission, outage, security event, data practice, termination, or change of a Third-Party Service, or for loss resulting from Subscriber’s authorization of access, except to the extent caused by BSI’s breach of an express obligation under the Agreement. BSI may replace a third-party provider or integration and may suspend an affected feature if continued operation creates a legal, security, or operational risk.

11. Customer Data; Rights and License

As between the parties, Subscriber retains all right, title, and interest in Customer Data. Subscriber grants BSI and its affiliates, contractors, subprocessors, and service providers a non-exclusive, worldwide, royalty-free right during the Subscription Term and applicable retention period to host, copy, transmit, process, display, modify, create technical derivatives of, and otherwise use Customer Data only as reasonably necessary to provide, secure, support, maintain, comply with law regarding, and improve the Services in accordance with this Agreement and the Business Associate Agreement. This license does not transfer ownership of identifiable Customer Data to BSI.

Subscriber is responsible for the legality, quality, accuracy, integrity, and completeness of Customer Data and for providing all required notices and obtaining all required rights, consents, and authorizations. Subscriber will not instruct BSI to process Customer Data in violation of Applicable Law, payer requirements, or a third party’s rights.

12. De-Identified Data, Usage Data, and Analytics

BSI may create De-Identified Data from Customer Data and may collect and generate Usage Data. To the extent permitted by the Business Associate Agreement and Applicable Law, BSI owns De-Identified Data and Usage Data and may use, disclose, license, commercialize, analyze, benchmark, combine, improve, and create derivative works from them for lawful business purposes, including analytics, product development, security, service improvement, and AI model evaluation or training. BSI will not attempt to re-identify De-Identified Data except as permitted by law for testing de-identification methods or validating compliance, and will require a recipient of De-Identified Data not to re-identify it when required by Applicable Law.

13. Security

BSI will maintain commercially reasonable administrative, technical, and physical safeguards designed to protect the confidentiality, integrity, and availability of Customer Data, taking into account the nature of the Services and data. No system is completely secure, and BSI does not warrant that unauthorized access, cyberattack, data loss, or service interruption will never occur. BSI will address a Security Incident involving PHI or other regulated Customer Data in accordance with the Business Associate Agreement and Applicable Law.

Subscriber is responsible for the security of its devices, networks, browsers, systems, integrations, credentials, workforce, and data before transmission to and after export from the Services. Subscriber will apply security updates, use supported software, restrict privileges, monitor Authorized Users, maintain appropriate backups, and promptly mitigate a known security issue within its control. Subscriber may not perform or authorize a security assessment of the Services without BSI’s prior written approval and agreed rules of engagement.

14. Privacy and HIPAA

Each party will comply with the privacy, data-protection, breach-notification, records, and security laws applicable to its performance under the Agreement. To the extent BSI creates, receives, maintains, or transmits PHI on Subscriber’s behalf as a business associate, the parties’ Business Associate Agreement governs that PHI and controls over conflicting provisions of these Terms. Subscriber will not transmit PHI until the Business Associate Agreement is effective.

Subscriber is responsible for determining its legal status and obligations; providing legally sufficient privacy notices; obtaining any required patient, consumer, or user permissions or authorizations; applying the minimum-necessary standard where applicable; honoring restrictions and rights; and configuring and using the Services consistently with Applicable Law. Subscriber will not use a feature, integration, AI Feature, communication channel, or Third-Party Service to process PHI unless BSI has expressly approved that use in writing. If the parties execute a data processing addendum for personal information other than PHI, that addendum controls for its subject matter.

15. Confidentiality

The receiving party will: (a) use the disclosing party’s Confidential Information only to exercise rights or perform obligations under the Agreement; (b) protect it using at least reasonable care and no less care than the receiving party uses for similar information of its own; and (c) disclose it only to personnel, professional advisers, affiliates, contractors, and subprocessors who have a need to know and are bound by confidentiality duties at least as protective as those in this Section. The receiving party is responsible for a permitted recipient’s violation of these duties.

Confidential Information does not include information that the receiving party can document: (a) is or becomes public without breach of the Agreement; (b) was lawfully known without confidentiality restriction before disclosure; (c) is received lawfully from a third party without confidentiality restriction; or (d) is independently developed without use of the disclosing party’s Confidential Information. If disclosure is required by law, subpoena, or court order, the receiving party may disclose only the required portion and, when legally permitted, will provide prompt notice and reasonable assistance so the disclosing party may seek protection.

A party may seek injunctive or equitable relief for actual or threatened misuse of its Confidential Information without waiving any other remedy. These obligations continue for five years after disclosure, except that trade secrets remain protected for so long as they qualify as trade secrets and PHI remains protected as required by the Business Associate Agreement and Applicable Law.

16. BSI Intellectual Property

BSI and its licensors own all right, title, and interest in and to the Services, Platform, APIs, Documentation, AI Features, models, prompts, algorithms, workflows, designs, user interfaces, software, code, inventions, methods, know-how, Usage Data, De-Identified Data, improvements, updates, derivative works, and all related intellectual-property rights. Subscriber may not remove or alter proprietary notices. The BFLOW name, logos, page headers, graphics, icons, and trade dress are trademarks or trade dress of BSI or its licensors. Except for the limited subscription right in Section 5 and rights expressly granted in Sections 8 and 11, no license is granted by implication, estoppel, or otherwise.

17. Feedback

Feedback, suggestions, ideas, enhancement requests, and recommendations provided by Subscriber or an Authorized User are voluntary and non-confidential. Subscriber grants BSI a worldwide, perpetual, irrevocable, transferable, sublicensable, royalty-free right to use, disclose, reproduce, modify, commercialize, and incorporate Feedback into any product or service without restriction, compensation, or attribution, provided BSI does not identify Subscriber as the source without permission.

18. Subscriber Name and Logo

Subscriber grants BSI a non-exclusive, worldwide, royalty-free license during the Subscription Term to use Subscriber’s name, trademarks, and logos solely to identify Subscriber as a customer and to create customary customer lists and marketing materials. BSI will follow any reasonable written brand guidelines provided by Subscriber. Subscriber may revoke this promotional license on 30 days’ written notice to support@bflowsolutions.com. Revocation does not require recall of materials already printed or distributed, but BSI will discontinue new use within a commercially reasonable period.

19. Service Operation, Updates, Maintenance, and Beta Features

BSI may update, enhance, configure, replace, or modify the Services and may perform scheduled or emergency maintenance. BSI will use commercially reasonable efforts to avoid materially reducing the core functionality of a generally available paid Service, but may make immediate changes required for security, legal compliance, third-party changes, safety, abuse prevention, or system integrity.

Subscriber authorizes automatic software and configuration updates. Subscriber’s purchase is not contingent on delivery of future functionality or on any oral or written statement about future products or features.

A feature identified as alpha, beta, preview, early access, evaluation, experimental, or similar is provided for testing, may be changed or discontinued at any time, may be subject to additional restrictions, and is provided without any service level, support commitment, warranty, or obligation to retain data. Subscriber will not use a beta feature for production claims, patient care, or PHI unless BSI expressly authorizes that use in writing.

BSI may provide corrective, adaptive, perfective, preventive, and security maintenance to fix defects, adapt to changes, improve performance or usability, add or remove functionality, address vulnerabilities, or maintain compatibility. Maintenance does not obligate BSI to develop a particular feature or support an unsupported configuration.

20. Fees, Billing, Taxes, and Digital Operations

Fees and payment authorization. Subscriber will pay the Subscription Fees and other charges in the applicable Order Form and Fee Schedule. Subscriber authorizes BSI and its payment processor to charge the designated payment method for recurring fees in advance and for usage, overages, pass-through costs, professional services, and other amounts when incurred or as stated in the Order Form. This authorization continues until all amounts due under the Agreement are paid. Subscriber will maintain accurate billing information and a valid payment method.

Usage-based services and Digital Ops Wallet. Usage-based operational services may be deducted from a Digital Ops Wallet or monthly credit allocation at the rates in Exhibit D or the applicable Fee Schedule. Usage in excess of included credits is billed at the then-current overage rate. BSI’s metering records control absent manifest error. Credits have no cash value, may not be transferred, and expire as stated in the Order Form or, if unstated, at the end of the applicable billing period.

Maintenance and resource fees. Unless superseded in an Order Form, Subscriber will pay an annual training and resource update fee of $499 and a quarterly software maintenance fee of $250. These fees support documentation, frequently asked questions, training, chat and video resources, corrective maintenance, adaptive maintenance, perfective maintenance, preventive maintenance, security updates, and platform upkeep.

Declines, late amounts, and suspension. A declined payment may incur a $65 charge to the extent permitted by law and reasonably related to BSI’s administrative and processing costs. Amounts more than 15 days past due accrue interest at the lesser of 1.5% per month or the maximum lawful rate, plus reasonable collection costs. BSI may suspend or terminate the Services for nonpayment. Three consecutive months with a declined payment method may result in termination. Subscriber remains responsible for charges incurred during a suspension.

Taxes and disputes. Fees exclude sales, use, excise, withholding, and similar taxes, duties, and assessments, other than taxes on BSI’s net income. Subscriber will pay applicable taxes unless it provides a valid exemption certificate. Subscriber must notify BSI of a good-faith billing dispute within 30 days after the charge and timely pay all undisputed amounts. Subscriber may not offset or withhold payment except as required by law.

No refunds. Except as expressly stated in the Agreement or required by law, fees are non-cancelable, nonrefundable, and not prorated. Termination does not relieve Subscriber of fees incurred or payable through the effective termination date.

21. Initial 30-Day Term; Evaluation; Automatic Renewal

Binding initial term. The Agreement becomes effective when Subscriber signs, electronically accepts, or otherwise executes it (the "Effective Date") and creates a binding initial subscription term of 30 consecutive calendar days beginning on the Effective Date (the "Initial Term"). Subscriber is committing to the entire Initial Term when it signs. Any reference to a trial, pilot, evaluation, onboarding period, proof of concept, or promotional period describes Subscriber’s opportunity to evaluate the Services during the Initial Term; it does not create a seven-day contract, a free-cancellation right, or a right to avoid fees unless an Order Form signed by BSI expressly provides otherwise.

Automatic 30-day renewal. At the end of the Initial Term, the Agreement automatically renews for successive 30-day periods (each a "Renewal Term" and, together with the Initial Term, the "Subscription Term") without further signature or action by either party. BSI may automatically charge Subscriber’s payment method on each renewal date at the rates then in effect, subject to any advance notice required by Section 34 or Applicable Law.

Termination on 30 days’ notice. Either party may terminate the Agreement for convenience by giving the other party at least 30 calendar days’ written notice in accordance with Section 33. A termination notice becomes effective 30 calendar days after receipt unless it states a later date. The Agreement and all payment obligations continue during the notice period. If the effective termination date occurs during a billing period, fees already charged are not prorated or refunded, except as required by law. Immediate suspension and termination rights for cause are stated in Sections 22 and 23.

22. Immediate Suspension and Protective Measures

BSI may immediately, with or without advance notice, suspend, limit, throttle, quarantine, or disable any account, Authorized User, API Credential, endpoint, integration, data flow, AI Feature, or other part of the Services if BSI reasonably believes: (a) Subscriber or an Authorized User has breached or is likely to breach the Agreement; (b) the Services are being abused, misused, accessed in an unauthorized manner, or used outside the contemplated scope; (c) activity threatens the security, integrity, availability, performance, reputation, or lawful operation of the Services, BSI, another customer, or a third party; (d) fraudulent, illegal, harmful, or deceptive conduct may be occurring; (e) a payment is more than 15 days past due; (f) usage materially exceeds Usage Limits or causes excessive load; (g) suspension is requested by a Third-Party Service or governmental authority; or (h) suspension is necessary to comply with law or prevent harm.

BSI will use commercially reasonable efforts to notify Subscriber promptly when doing so would not increase risk, violate law, compromise an investigation, or undermine a protective measure. BSI may require remediation, credential rotation, configuration changes, security assurances, reimbursement of extraordinary costs, or payment of overdue amounts before restoring access.

Suspension does not limit BSI’s right to terminate and does not excuse Subscriber’s payment obligations.

23. Termination for Cause

BSI immediate termination right. BSI may terminate the Agreement, an Order Form, or affected Services immediately upon written notice if Subscriber or any person acting through Subscriber’s account: (a) breaches any provision of the Agreement; (b) abuses, misuses, or uses the Services in a manner not contemplated by the Agreement or Documentation; (c) violates Sections 6, 7, 8, 13, 14, 15, or 16; (d) accesses or attempts to access an unauthorized endpoint, environment, account, dataset, model, or system; (e) creates a security, privacy, legal, operational, financial, or reputational risk; (f) engages in fraud, unlawful conduct, repeated rate-limit evasion, credential sharing, data scraping, malicious automation, or nonpayment; (g) makes a material misrepresentation; (h) becomes insolvent, ceases business, makes an assignment for creditors, or becomes subject to a bankruptcy or similar proceeding to the extent termination is permitted by law; or (i) causes BSI or a Third-Party Service to be unable lawfully or safely to continue providing the Services. No cure period is required for BSI to exercise these rights unless BSI expressly grants one in writing.

Subscriber termination for BSI breach. Subscriber may terminate the affected Order Form if BSI materially breaches the Agreement and fails to cure that breach within 30 days after receiving a written notice that specifically describes the breach. This remedy does not apply to an outage, feature change, Third-Party Service issue, beta feature, or event excused under the Agreement unless it separately constitutes an uncured material breach.

BSI may elect to provide a cure opportunity for a Subscriber breach without waiving its right to suspend or terminate immediately for that or a later breach. Termination rights are cumulative and do not limit any other remedy.

24. Effect of Termination; Data Export and Deletion

Upon termination or expiration: (a) Subscriber’s rights to access and use the Services end; (b) Subscriber must stop using and delete BSI software, Documentation, and API Credentials in its possession; (c) all accrued and unpaid amounts become immediately due; and (d) each party will return or destroy the other’s Confidential Information on request, subject to legal retention obligations, routine backups, and the Business Associate Agreement.

For 60 days after the effective termination date, Subscriber may request a standard export of available Customer Data. BSI may charge its then-current professional-services or export fee for extraction, transformation, or transfer beyond self-service functionality.

Subscriber is responsible for requesting and validating the export. After the 60-day period, BSI may delete or render inaccessible Subscriber’s account and Customer Data without further notice, subject to the Business Associate Agreement, Applicable Law, litigation holds, and limited retention in secure backups. Backup copies may remain until overwritten in the ordinary course and will remain protected while retained. BSI may retain De-Identified Data, Usage Data, billing records, audit records, and other information it is legally entitled or required to retain.

Sections 8, 11 through 18, 20, 24, and 26 through 36, together with provisions that by their nature should survive, survive termination.

25. Representations and Warranties

Each party represents that it is duly organized or otherwise legally authorized to enter into the Agreement and that the person accepting the Agreement has authority to bind it. Subscriber additionally represents and warrants that: (a) its use of the Services and all Customer Data comply with Applicable Law and third-party rights; (b) it has all licenses, accreditations, provider or supplier numbers, approvals, payer enrollments, and surety bonds required for its business and claims; (c) information submitted to BSI and payers is accurate, complete, and not misleading; (d) it is authorized to direct BSI and Third-Party Services to process Customer Data; and (e) it will not use an AI Output, automation, or recommendation without the review required by Section 8.

26. Disclaimers

TO THE MAXIMUM EXTENT PERMITTED BY LAW, THE SERVICES, PLATFORM, APIS, AI FEATURES, AI OUTPUTS, DOCUMENTATION, BETA FEATURES, THIRD-PARTY SERVICES, AND ALL RELATED MATERIALS ARE PROVIDED "AS IS" AND "AS AVAILABLE." BSI AND ITS LICENSORS DISCLAIM ALL EXPRESS, IMPLIED, STATUTORY, AND OTHER WARRANTIES, INCLUDING WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, TITLE, NON-INFRINGEMENT, ACCURACY, COMPLETENESS, QUIET ENJOYMENT, AND WARRANTIES ARISING FROM COURSE OF DEALING OR USAGE OF TRADE. BSI DOES NOT WARRANT THAT THE SERVICES WILL BE UNINTERRUPTED, ERROR-FREE, SECURE, COMPATIBLE WITH EVERY CONFIGURATION, OR FREE OF HARMFUL COMPONENTS, OR THAT DATA WILL NEVER BE LOST.

BSI DOES NOT PROVIDE MEDICAL, CLINICAL, LEGAL, TAX, ACCOUNTING, CODING, COVERAGE, OR PAYER ADVICE THROUGH THE SERVICES. BSI DOES NOT WARRANT THAT AN AI OUTPUT, CLAIM, CODE, DOCUMENT, WORKFLOW, OR RECOMMENDATION IS ACCURATE, COMPLIANT, COMPLETE, NONINFRINGING, OR ELIGIBLE FOR PAYMENT. SUBSCRIBER IS RESPONSIBLE FOR INDEPENDENT REVIEW, PROFESSIONAL JUDGMENT, AND FINAL DECISIONS. NO ORAL OR WRITTEN INFORMATION CREATES A WARRANTY NOT EXPRESSLY STATED IN THE AGREEMENT.

27. Claims, Third-Party, and Backup Disclaimers

BSI is not liable for a delay, denial, underpayment, recoupment, audit result, penalty, or other loss caused by incomplete, inaccurate, noncompliant, late, or missing information; Subscriber’s failure to review or submit a claim; payer or governmental action; a Third-Party Service; or Subscriber’s products, services, documentation, coding, or business practices. Subscriber is responsible for verifying every claim and transaction. BSI does not guarantee that a noncompliant claim can be corrected or resubmitted or that a payer will accept or reimburse any claim.

BSI will use commercially reasonable efforts to maintain periodic backups appropriate to the Services, but the Services are not Subscriber’s system of record or archival service unless an Order Form expressly states otherwise. BSI cannot guarantee recovery of data entered or changed during the 24 hours before an outage or security event. Subscriber will maintain independent copies of information it is required to retain.

28. Limitation of Liability

TO THE MAXIMUM EXTENT PERMITTED BY LAW, BSI, ITS AFFILIATES, LICENSORS, SERVICE PROVIDERS, OFFICERS, DIRECTORS, EMPLOYEES, AND AGENTS WILL NOT BE LIABLE FOR ANY INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, PUNITIVE, ENHANCED, OR CONSEQUENTIAL DAMAGES; LOSS OF PROFITS, REVENUE, SAVINGS, BUSINESS, GOODWILL, OR DATA; BUSINESS INTERRUPTION; COST OF REPLACEMENT SERVICES; SECURITY-BREACH-RELATED LOSS; OR LOSS ARISING FROM AI OUTPUTS, THIRD-PARTY SERVICES, CLAIMS, OR PAYER DECISIONS, WHETHER BASED IN CONTRACT, TORT, STRICT LIABILITY, STATUTE, OR ANY OTHER THEORY, EVEN IF ADVISED OF THE POSSIBILITY.

TO THE MAXIMUM EXTENT PERMITTED BY LAW, BSI’S TOTAL AGGREGATE LIABILITY ARISING OUT OF OR RELATING TO THE AGREEMENT OR SERVICES WILL NOT EXCEED THE SUBSCRIPTION FEES ACTUALLY PAID TO BSI FOR THE AFFECTED SERVICES DURING THE THREE MONTHS IMMEDIATELY BEFORE THE FIRST EVENT GIVING RISE TO LIABILITY. MULTIPLE CLAIMS DO NOT INCREASE THIS LIMIT.

These exclusions and limits apply to the fullest extent permitted by law, are an essential basis of the parties’ bargain, and apply even if a remedy fails of its essential purpose. They do not limit Subscriber’s payment obligations, indemnification obligations, liability for misuse of the Services or infringement of BSI’s intellectual property, or any liability that cannot lawfully be limited. The Business Associate Agreement controls to the extent it expressly provides a different allocation for PHI.

29. Indemnification

Subscriber indemnity. Subscriber will defend, indemnify, and hold harmless BSI and its affiliates, licensors, service providers, officers, directors, employees, agents, successors, and assigns from third-party claims, investigations, losses, liabilities, judgments, penalties, damages, costs, and reasonable attorneys’ fees arising out of or relating to: (a) Customer Data, AI Inputs, Subscriber’s products or services, or a claim submitted by or for Subscriber; (b) Subscriber’s or an Authorized User’s use, misuse, or unauthorized use of the Services, APIs, endpoints, AI Features, or Third-Party Services; (c) Subscriber’s breach of the Agreement; (d) violation of HIPAA or other privacy, security, healthcare, payer, billing, advertising, communications, export, sanctions, or AI law by Subscriber; (e) infringement, misappropriation, or violation of a third party’s rights by Subscriber, Customer Data, or an AI Input; or (f) Subscriber’s reliance on, distribution of, or action based on an AI Output.

Limited BSI IP indemnity. BSI will defend Subscriber against a third-party claim that Subscriber’s authorized use of the unmodified, generally available Services directly infringes a United States patent, copyright, or trademark, and will pay damages finally awarded or agreed in a settlement approved by BSI. BSI has no obligation for a claim arising from Customer Data, AI Inputs or Outputs, Third-Party Services, open-source software, a modification not made by BSI, a combination not supplied by BSI, continued use after notice, use outside the Agreement or Documentation, or compliance with Subscriber’s instruction. If such a claim appears likely, BSI may modify or replace the affected Service, obtain continued-use rights, or terminate it and refund prepaid recurring fees for the unused portion of the affected 30-day term. This paragraph states Subscriber’s exclusive remedy and BSI’s entire liability for an intellectual-property claim.

Procedure. The indemnified party will promptly notify the indemnifying party, provide reasonable cooperation at the indemnifying party’s expense, and allow the indemnifying party to control the defense and settlement. Delay in notice relieves obligations only to the extent materially prejudicial. The indemnifying party may not settle a claim in a manner that admits fault by, imposes nonmonetary obligations on, or fails to fully release the indemnified party without written consent, not to be unreasonably withheld.

30. Compliance, Export Controls, and Sanctions

Each party will comply with laws applicable to its performance under the Agreement. Subscriber will not use the Services to violate healthcare-program, false-claims, anti-kickback, privacy, consumer-protection, communications, employment, civil-rights, discrimination, accessibility, AI, or automated-decision laws. Subscriber will make disclosures, provide notices, obtain consents, conduct assessments, and preserve human review where required for its use case.

The Services may be subject to United States export controls and sanctions. Subscriber represents that it and its Authorized Users are not prohibited or restricted parties and will not access, export, reexport, release, transfer, or use the Services in a prohibited country, for a prohibited end use, or in violation of export-control or sanctions law.

31. Force Majeure

BSI is not liable for delay, interruption, degraded performance, or failure to perform caused by circumstances beyond its reasonable control, including acts of God; fire; flood; earthquake; severe weather; epidemic or pandemic; war; terrorism; civil unrest; labor dispute; embargo; governmental order or action; utility, telecommunications, internet, DNS, hosting, cloud, payment-network, clearinghouse, payer, AI-provider, or Third-Party Service failure; supply-chain interruption; distributed denial-of-service attack; malicious cyberattack not caused by BSI’s failure to use commercially reasonable safeguards; or widespread network or infrastructure outage (each, a "Force Majeure Event").

BSI will use commercially reasonable efforts to mitigate the effect and resume performance. A Force Majeure Event does not excuse Subscriber’s obligation to pay amounts already due or charges for Services made available or used. If an affected material Service remains substantially unavailable for more than 30 consecutive days because of a Force Majeure Event, either party may terminate that affected Service on written notice, and Subscriber’s sole remedy is a prorated credit of prepaid recurring fees, if any, for the period after termination.

32. Individual Binding Arbitration and Class Action Waiver

Informal resolution. Before commencing arbitration, a party must send the other a written notice describing the claimant, the facts and legal basis of the dispute, the relief sought, and a good-faith settlement demand. The parties will attempt in good faith to resolve the dispute for 30 days after receipt. This requirement does not prevent a party from seeking temporary injunctive relief to protect Confidential Information, data, security, or intellectual-property rights.

Binding arbitration. Except for a qualifying small-claims matter or a request for temporary or injunctive relief described above, any dispute, claim, or controversy arising out of or relating to the Agreement, the Services, or the relationship between the parties, including formation, interpretation, scope, enforceability, performance, breach, or termination, will be resolved by binding arbitration administered by the American Arbitration Association under its Commercial Arbitration Rules then in effect. The Federal Arbitration Act governs this Section. The arbitration will be conducted by one arbitrator in Fresno County, California, or by remote video if the arbitrator directs or the parties agree. Judgment on the award may be entered in any court with jurisdiction.

INDIVIDUAL PROCEEDINGS ONLY. EACH PARTY WAIVES THE RIGHT TO A JURY TRIAL AND AGREES THAT EACH CLAIM MAY BE BROUGHT ONLY IN THAT PARTY’S INDIVIDUAL CAPACITY, NOT AS A PLAINTIFF OR CLASS MEMBER IN A CLASS, COLLECTIVE, CONSOLIDATED, COORDINATED, MASS, REPRESENTATIVE, OR PRIVATE-ATTORNEY-GENERAL PROCEEDING. THE ARBITRATOR MAY NOT CONSOLIDATE CLAIMS OR PRESIDE OVER A REPRESENTATIVE PROCEEDING WITHOUT BOTH PARTIES’ WRITTEN CONSENT. If a court finds a particular part of this waiver unenforceable for a specific claim, only that claim will proceed in court after all arbitrable matters are completed, and the remainder of this Section remains effective.

Small claims. Either party may bring an individual claim in a small-claims court of competent jurisdiction if the claim remains solely in that court and within its jurisdiction. AAA rules and filing forms are available at www.adr.org. A party initiating arbitration must also send the demand to the notice address in Section 33.

33. Notices

Notices must be in writing. Notices to BSI, including termination notices and arbitration notices, must be sent by email to support@bflowsolutions.com and, for arbitration or a material-breach notice, by nationally recognized overnight courier or certified mail to BFLOW Solutions, Inc., 8050 North Palm Avenue, Suite 300, Fresno, California 93711, or to a replacement address BSI designates in writing. A Subscriber termination notice must identify the Subscriber’s legal name, account administrator, account email, affected Services, and requested termination date.

BSI may send notices to the email address associated with Subscriber’s account, through an in-product message, or by conspicuous posting on the Platform when the notice is generally applicable. Email notice is deemed received on the first business day after transmission unless the sender receives an automated delivery-failure message. Courier or certified-mail notice is deemed received on documented delivery. Subscriber is responsible for maintaining current contact information.

34. Changes to Services, Fees, and Terms

BSI may change fees, Usage Limits, Subscription Tiers, or these Terms by providing at least 30 days’ notice of a material change, and the change will take effect no earlier than Subscriber’s next Renewal Term beginning after the notice period. Subscriber may avoid a material change by giving a termination notice under Section 21, but the Agreement remains in effect during the 30-day notice period.

BSI may make a nonmaterial, clarifying, security-related, provider-required, or legally required change immediately. BSI will not retroactively expand its right to use identifiable Customer Data or PHI for a materially different purpose without any consent required by Applicable Law or the Business Associate Agreement. Continued use after a change takes effect constitutes acceptance. No BSI employee or agent may orally modify the Agreement.

35. General Provisions

Governing law and courts. California law governs the Agreement without regard to conflict-of-law principles, except that the Federal Arbitration Act governs Section 32. Subject to Section 32, the state and federal courts located in Fresno County, California have exclusive jurisdiction, and each party consents to personal jurisdiction and venue there.

Assignment. Subscriber may not assign, delegate, transfer, or sublicense the Agreement or any right or obligation, whether voluntarily, by merger, change of control, operation of law, or otherwise, without BSI’s prior written consent. Any prohibited assignment is void. BSI may assign the Agreement in whole or in part to an affiliate or in connection with a financing, merger, reorganization, sale of assets, or change of control and may use subcontractors to perform the Services. BSI remains responsible for its subcontractors to the extent stated in the Agreement.

Severability; waiver; remedies. If a provision is unenforceable, it will be modified to the minimum extent necessary to make it enforceable or severed, and the remaining provisions continue in effect. Failure or delay to exercise a right is not a waiver. A waiver must be written and applies only to the specific instance. Rights and remedies are cumulative unless the Agreement expressly states an exclusive remedy.

Independent contractors; no third-party beneficiaries. The parties are independent contractors. The Agreement does not create an agency, partnership, fiduciary, franchise, joint venture, employment, or exclusive relationship. There are no third-party beneficiaries except BSI’s indemnified parties and licensors where expressly stated.

Interpretation; counterparts; electronic signatures. Headings are for convenience only. "Including" means "including without limitation." The singular includes the plural where appropriate. The Agreement may be executed in counterparts and through electronic signatures, click acceptance, or electronic records, each of which is deemed an original. A handwritten or electronic signature and an authorized online acceptance have the same effect.

36. Entire Agreement

The Agreement is the complete and exclusive agreement between the parties regarding its subject matter and supersedes all prior and contemporaneous proposals, communications, representations, promises, and agreements, whether written or oral. Subscriber acknowledges that it has not relied on any statement not expressly included in the Agreement.

Acknowledgment and Signatures

BY SIGNING BELOW, EACH PARTY ACKNOWLEDGES THAT IT HAS READ, UNDERSTANDS, AND AGREES TO THE AGREEMENT, INCLUDING THE 30-DAY INITIAL TERM, AUTOMATIC 30-DAY RENEWAL, 30-DAY TERMINATION NOTICE, IMMEDIATE SUSPENSION AND TERMINATION RIGHTS, ARBITRATION REQUIREMENT, AND CLASS ACTION WAIVER.

Execution of these Terms of Service is completed within your BFLOW Solutions proposal at the time of contract signing, and is binding on both parties as of the date of signature recorded in the audit trail of this agreement.

Exhibit D — Digital Ops Wallet

The Digital Ops Wallet bundles usage-based operational services into a monthly credit allocation. Credits are deducted according to the activity and billing unit below. Activity exceeding the included allocation is billed at the rate stated in the applicable Fee Schedule or Order Form. If this Exhibit conflicts with a later signed Order Form, the later signed Order Form controls.