Terms of Service | Privacy Policy

NeuroTrace Terms and Conditions, Software License, and Limited Warranty

 

1. Important - Read Carefully

These Terms and Conditions, Software License, and Limited Warranty (the "Agreement") govern your access to and use of NeuroTrace-branded devices, software applications, related services, and documentation provided by Medeia Inc ("Medeia," "we," "us," or "our") (collectively, the "Product"). NeuroTrace is a brand and trademark used by Medeia; references to "NeuroTrace" in this Agreement refer to the applicable Medeia-branded Product or service, not to a separate contracting entity.

By installing, accessing, activating, or using the Product after this Agreement has been made available to you, or by accepting a Sales Order that incorporates this Agreement, the person or entity purchasing or licensing the Product ("Customer" or "you") agrees to be bound by this Agreement. An individual accepting on behalf of an organization represents that the individual has authority to bind that organization. These terms are intended for business, clinical, research, educational, and other professional purchases and uses, without excluding mandatory rights applicable to a particular transaction. The Agreement becomes effective for Customer upon its first acceptance. If you do not agree, do not install, access, activate, or use the Product. Subject to any applicable return rights and legally required record retention, you must uninstall and destroy copies of Software and Documentation in your possession and contact Medeia or your authorized distributor regarding return of any hardware.

A quotation, proposal, purchase order accepted by Medeia, sales order, service agreement, subscription agreement, contract research agreement, product-specific license, or other written commercial agreement between the parties may supplement this Agreement (each, a "Sales Order"). A Sales Order becomes binding on Medeia only when accepted in writing or electronically by an authorized Medeia representative. If there is a conflict, the following order applies only within the subject matter concerned: (a) a Business Associate Agreement ("BAA") controls with respect to protected health information ("PHI") and HIPAA matters; (b) an applicable data processing agreement or addendum ("DPA") controls processing of the personal data it covers, without displacing the BAA for PHI; (c) a Sales Order controls product-specific pricing, quantities, license scope, service levels, and other expressly stated commercial terms; and (d) this Agreement controls in all other respects. A negotiated amendment to legal terms must expressly identify the deviation and be signed or affirmatively electronically accepted by authorized representatives of both parties. A Sales Order may extend, but may not shorten, the minimum warranty periods in Section 20.3. Applicable regulatory labeling and instructions for use always control safe, authorized, and intended clinical use; neither a Sales Order nor a marketing statement expands that use.

Additional or conflicting terms in Customer's purchase order, procurement portal, vendor-registration document, or similar administrative record do not amend this Agreement unless an authorized Medeia representative expressly accepts the deviation in the manner stated above. Acceptance of order quantities, shipping particulars, or other administrative information does not itself accept additional legal terms.

IMPORTANT: SECTIONS 19, 20, 21, 22, AND 23 CONTAIN LICENSE RESTRICTIONS, WARRANTY DISCLAIMERS, EXCLUSIVE REMEDIES, LIABILITY LIMITS, AND CUSTOMER INDEMNITY. CUSTOMER SHOULD REVIEW THESE PROVISIONS BEFORE ACCEPTANCE.

2. Definitions

"Authorized User" means an employee, contractor, clinician, researcher, or other individual whom Customer authorizes to use the Product within the scope of the Sales Order and who is bound by obligations consistent with this Agreement. References to a "User" mean an Authorized User, not a separate contracting entity unless that individual is also Customer.

"Customer Data" means data, records, files, measurements, images, patient-specific reports, account information, and other content submitted to, collected through, stored in, or generated for Customer through the Product. Customer Data excludes Software, Documentation, and Medeia's underlying algorithms, non-patient-specific report templates, interfaces, and other technology. Any permitted use of de-identified data remains subject to Section 15.

"Documentation" means the applicable labeling, instructions for use, user manuals, technical specifications, safety information, release notes, and other Product documentation supplied or made available by Medeia. "Software" means object-code software, firmware, desktop or mobile applications, hosted software, and updates supplied by Medeia for use with the Product.

"Services" means hosted functionality, maintenance, implementation, training, support, or other professional services provided by or for Medeia under a Sales Order. "Third-Party Product" means hardware, software, websites, data sources, interfaces, or services supplied by a party other than Medeia. The express warranty for a Medeia-supplied laptop in Section 20.3 applies notwithstanding that classification.

3. Prescription Use; Clinical Responsibility

The Product is intended for use only as permitted by its applicable labeling, instructions for use, regulatory authorization or clearance, Sales Order, and applicable law. Where a Product is labeled or restricted for prescription use, it may be used only by, on the order of, or under the supervision of a duly licensed healthcare professional, as applicable, and only in authorized healthcare settings and jurisdictions.

The healthcare professional or other authorized provider using the Product remains responsible for professional judgment, diagnosis, interpretation, treatment decisions, medical necessity, documentation, coding, and compliance with the provider's scope of practice and applicable law. Product outputs are not a substitute for professional judgment and must be interpreted in the context of the patient, the Product labeling, and other clinically relevant information.

Medeia, its affiliates, agents, and independent distributors do not assume responsibility for a provider's acts or omissions in rendering care, except to the extent such responsibility cannot lawfully be excluded. This allocation does not exclude Medeia's responsibility for its own breach, Product defects, or conduct for which it is responsible under this Agreement or applicable law, subject to Section 21.

Customer will permit use only by Authorized Users with the training, credentials, supervision, and legal authority required for their activities. Customer will follow applicable installation, calibration, inspection, cleaning, infection-control, preventive-maintenance, and environmental requirements in the Documentation. Unless the applicable labeling expressly permits the use, the Product must not be relied upon as the sole basis for diagnosis or treatment, for continuous life-sustaining monitoring, or in an emergency where delayed or unavailable information could cause death or serious injury.

Research-use-only functions must not be used for clinical diagnosis or treatment. Investigational use is permitted only within a lawfully authorized investigation and in accordance with the applicable protocol, labeling, required approvals, informed consent, and law. Evaluation use is limited to the purposes and conditions expressly authorized in the applicable Sales Order and labeling. Customer is responsible for the ethics review, consent, institutional permissions, and other approvals required for its research activities.

4. Product Complaints; Safety Events; Recalls

Customer will promptly notify Medeia through the safety, complaint, or support channel identified in the Documentation or Sales Order of suspected Product malfunctions, serious injuries, adverse events, cybersecurity vulnerabilities, and other Product safety issues. If no specific channel has been identified, Customer should contact the Technical Support number in Section 45 to obtain reporting instructions. Customer will preserve relevant equipment, records, and logs, subject to patient-care needs, safety requirements, and applicable law, and will not transmit PHI through an unapproved channel.

Customer will keep Product and safety-notice contacts current and reasonably cooperate with investigations, recalls, field corrections, safety notices, device quarantines, returns, and required safety updates. Customer will promptly communicate applicable safety instructions to affected Authorized Users and downstream recipients under its control and stop affected use when instructed by Medeia or a competent regulator. Each party remains responsible for its own legally required reports and regulatory obligations; neither party must await the other's approval before making a required report. To the extent an investigation, field correction, or recall is caused by Customer's breach, unauthorized modification, or failure to follow required safety instructions, Customer will reimburse Medeia's reasonable, documented incremental costs attributable to that conduct, subject to applicable law and without double recovery under Section 23. Such reimbursement is not a condition to a mandatory safety action.

5. Electronic Updates

Periodic Software, firmware, security, compatibility, and system updates may be required to maintain safe, secure, or supported operation of the Product. You authorize Medeia to provide and, where the Product is technically configured to do so, install minor, maintenance, security, or compatibility updates. Material upgrades or changes may be subject to additional notices, instructions, fees, or terms. Customer will install required safety and security updates within the period reasonably specified in the applicable notice. Remote installation will occur only through an authorized and technically configured process, taking account of safe clinical operation. Charges and access restrictions do not displace any mandatory safety-correction or regulatory obligation.

Compatible hardware, operating systems, network access, third-party software, and other technical requirements may be necessary to install or use updates. Unless expressly included in a Sales Order, obtaining and maintaining those requirements is your responsibility. Medeia will use reasonable efforts to give advance notice of a material requirements change that requires replacement of significant supported infrastructure. Changes to paid functionality and end of support are also subject to Sections 18 and 24.

6. The Product

Medeia provides the Product for authorized end-user use under this Agreement. Software is licensed, not sold, except to the extent applicable law provides otherwise. Hardware ownership, if any, is governed by the applicable Sales Order, invoice, and applicable law.

Delivery, freight, customs, and importer responsibilities will be stated in the Sales Order. Unless the Sales Order expressly allocates transit risk differently, risk of loss for purchased hardware passes on delivery to Customer's designated location. Title to purchased hardware is governed by the express Sales Order terms and applicable law; this Agreement does not itself create a security interest. Loaned, leased, or demonstration equipment remains the property of its owner. Customer will inspect deliveries promptly and report shortages or visible transit damage without undue delay; this requirement does not shorten the express warranty or exclude claims for latent defects.

Medeia may use authorized distributors, service providers, licensors, and other contractors in connection with sales, delivery, support, hosting, or operation of the Product. Where an authorized distributor is the seller, its accepted order governs payment and delivery obligations between Customer and that distributor, subject to any express Medeia commitment. Medeia remains the licensor of Medeia Software and the warrantor to the extent stated in this Agreement. A distributor may not amend this Agreement, expand regulatory claims, or make additional warranties or support commitments on Medeia's behalf without Medeia's express written authorization. Medeia remains responsible for its contractors and subprocessors to the extent required by its express contractual obligations or applicable law.

7. Requirements for Use of The Product

Use of the Product may require compatible devices, Internet or network access, supported operating systems, certain third-party software, valid user credentials, and periodic updates. Fees from Internet, telecommunications, or third-party providers may apply. Product performance may depend on these factors.

You are responsible for maintaining a supported technical environment and for implementing reasonable security controls for systems that connect to the Product, including access controls, password practices, malware protection, backups, and network security appropriate to your environment.

The Product, or particular features, may be available only in countries, territories, healthcare settings, or user categories where Medeia or an authorized distributor makes them available and where use is lawful. You may not use the Product in a jurisdiction or manner that would violate applicable law, regulatory restrictions, export controls, sanctions, labeling, or a Sales Order. Medeia may use reasonable technical measures to enforce availability and licensing restrictions.

8. Content and Feature Availability

Medeia may change, add, suspend, or remove Product content, features, interfaces, integrations, or eligibility requirements from time to time, subject to this Agreement. For material changes to a paid service during a committed term, the applicable Sales Order and Sections 14 and 24 apply. A general availability or change provision does not override those paid-term protections.

Medeia does not guarantee that every feature, integration, language, or third-party service will be available in every location or with every Product configuration.

9. Use of Software; Security Technology

The Product may include access controls, license-management systems, encryption, digital-rights controls, device pairing, or other security technology. You must use the Product in accordance with this Agreement, the applicable Documentation, and any product-specific usage rules made available by Medeia (the "Usage Rules"). Usage Rules must be made available before they apply and may not amend an accepted Sales Order or this Agreement except as permitted by Section 14.

Except to the extent a restriction is prohibited by applicable law or an applicable open-source license, you may not, and may not assist another person to: (a) circumvent or disable Product security or licensing controls; (b) reverse engineer, decompile, disassemble, or attempt to derive source code, algorithms, or nonpublic protocols from the Software; (c) modify or create derivative works of the Software; (d) access the Product through unauthorized software or interfaces; (e) obtain unauthorized access to accounts, systems, or data; or (f) interfere with or burden Product networks or systems.

Violations of system or network security may result in suspension or termination and may also result in civil or criminal liability under applicable law.

Customer will reasonably cooperate with a proportionate inquiry into a suspected security, safety, or license violation. Medeia will conduct the inquiry in a manner reasonably designed to minimize disruption and protect Customer Data.

10. Usage Rules

You may use the Product only for the authorized clinical, research, educational, or other use stated in the applicable Product labeling, Documentation, and Sales Order. Where the Product is prescription-only, the prescription-use restrictions above apply.

Your rights are nontransferable except as expressly permitted in a Sales Order or by Medeia in writing. You may not rent, lease, lend, sell, sublicense, distribute, host for third parties, or otherwise commercially exploit the Software or Product access rights unless expressly authorized. Authorized use includes providing Customer's licensed clinical or professional services to its patients or clients within the scope of the Sales Order. This permission does not authorize resale or sublicensing of Software, service-bureau hosting, or direct Product access by third parties beyond the authorized license scope. Authorized contractors may use the Product on Customer's behalf within that scope.

If Medeia changes or discontinues a feature on which continued use depends, functionality may change. Customer's rights concerning a paid service that is discontinued or materially reduced during a committed term are governed by Section 24.

11. Intellectual Property

The Product and Software, including user interfaces, graphics, audiovisual materials, text, Documentation, software code, scripts, algorithms, models, databases, compilations, and other proprietary materials, are owned by Medeia and/or its licensors and are protected by intellectual-property and other laws. Except for the limited rights expressly granted by this Agreement, no ownership right is transferred to you. This ownership provision excludes Customer Data and does not transfer patient or third-party rights to Medeia. Customer's rights in patient-specific reports are stated in Section 12. Customer receives only the use rights expressly included in the Sales Order and this Agreement.

You may not reproduce, publish, distribute, sell, rent, lease, loan, modify, or create derivative works from the Product or proprietary materials except as expressly permitted by this Agreement, a Sales Order, an applicable open-source license, or applicable law.

NeuroTrace, the NeuroTrace logo, and other Medeia or NeuroTrace names, logos, product names, service marks, graphics, and trade dress are trademarks or service marks of Medeia and/or its licensors. No trademark license is granted except for nominative use necessary to identify the Product in accordance with this Agreement. Other trademarks belong to their respective owners.

Reports and graphs generated by the Product may be used by Customer as provided in Section 12, including the continuing rights stated there.

If Customer voluntarily provides suggestions or feedback that excludes Customer Data, PHI, personal information, and Customer's Confidential Information, Customer grants Medeia a worldwide, perpetual, irrevocable, royalty-free, transferable, sublicensable right to use, reproduce, modify, distribute, commercialize, and incorporate that feedback in its products and services. Medeia will not publicly identify Customer as the source without Customer's permission.

12. Customer Data and Reports

Ownership and reports. As between the parties, Customer retains its rights in Customer Data, subject to applicable patient and third-party rights. Medeia does not acquire ownership of patient-specific measurements, records, or reports merely because the Product processes or stores them. Customer may access, print, reproduce, retain, and lawfully share reports and graphs generated for it for patient care, medical records, quality assurance, reimbursement, authorized research, regulatory compliance, and its professional business operations, including after termination. Medeia retains its rights in the underlying Software, algorithms, and non-patient-specific templates. These report-use rights do not authorize reverse engineering or misrepresentation of the source or meaning of results.

Limited processing permission. Customer authorizes Medeia and its permitted service providers to host, copy, transmit, display, and otherwise process Customer Data only as reasonably necessary to provide, secure, support, and maintain the contracted Product, comply with applicable law, and carry out other purposes expressly permitted by the applicable Sales Order, BAA, or DPA and law. This permission does not authorize unrelated advertising, sale of personal information, or secondary use inconsistent with those documents. Any de-identification, analytics, research, or model-development use is additionally governed by Section 15.

Customer authority. Customer is responsible for the rights, notices, consents, authorizations, and institutional approvals legally required to provide Customer Data and instruct its processing. Customer is responsible for the accuracy and clinical appropriateness of data it supplies and for configuring access according to its authorized workflows and the principle of least privilege. Medeia remains responsible for processing under its control as required by the applicable agreements and law.

Records continuity and transition. Customer will maintain the medical records and independent exports required for its practice; the Product is not a substitute for Customer's legal recordkeeping system unless the Sales Order expressly says otherwise. During the service term, Customer may use available standard pdf export functions. For thirty (30) days after expiration or termination, Medeia will provide a reasonable secure opportunity to retrieve Customer Data without an additional charge for that standard retrieval.

13. Termination and Suspension

This Agreement and each Software license remain effective for the applicable term unless terminated in accordance with this Agreement or the Sales Order. A subscription ends at the end of its stated term unless renewed under Section 33. A fully paid perpetual license does not expire merely because maintenance or support ends.

Suspension. Medeia may suspend affected Product access to the extent reasonably necessary to address an urgent safety or security risk, prevent unlawful use or material harm, comply with law or regulatory direction, or address a material breach. For undisputed nonpayment, Medeia may suspend only after the payment is overdue and Customer has failed to pay within ten (10) days after written notice specifying the overdue amount and intended suspension. For another remediable breach without an urgent risk, Medeia will first provide the cure period below. Medeia will limit a suspension to what is reasonably necessary, give advance notice where practicable, and restore access promptly after the cause is resolved. Sections 12 and 15 continue to govern data access and protection.

Termination for cause. For undisputed nonpayment, Medeia may terminate after the ten (10) day payment-cure period stated above, without a second cure period, if the notice also warns of termination. Medeia may terminate or suspend affected rights immediately on written notice for an incurable material breach, material misappropriation of its intellectual property, or use whose continuation would be unlawful or pose a serious safety or security risk that cannot reasonably be addressed.

Consequences and charges. A lawful suspension or termination caused by Customer's breach does not entitle Customer to a refund; accrued fees and otherwise enforceable noncancelable commitments remain payable, subject to applicable law, required mitigation, and no double recovery.

Upon termination of a Software license, you must stop using the affected Software and destroy or uninstall copies in your possession or control, except for archival copies that applicable law requires you to retain and any limited access expressly permitted under Section 12. Customer may retain Documentation reasonably needed to interpret existing reports, satisfy record-retention requirements, or safely decommission hardware, subject to continuing confidentiality and intellectual-property restrictions. Termination does not eliminate payment obligations that accrued before termination or the data-protection rights and duties in this Agreement. On Medeia's reasonable written request, Customer will provide an authorized representative's written certification of discontinuance and deletion, identifying any copies lawfully retained.

Sections that by their nature should survive termination-including accrued payment obligations, Intellectual Property, Customer Data and Reports, applicable health-information and data-security duties, Confidential Information, warranty rights for timely claims and warranty limitations, Disclaimers, Limitation of Liability, Indemnity, Governing Law, and Miscellaneous-survive to the extent applicable. Survival does not extend a paid service term or Software license except as expressly stated.

14. Changes to this Agreement

Medeia may update this Agreement prospectively to reflect changes in the Product, law, security requirements, business practices, or regulatory obligations. Updated terms apply to new Sales Orders and renewals accepted on or after their stated effective date after the updated terms have been made available to Customer. An online posting alone does not amend an accepted fixed-term Sales Order, completed one-time purchase, or fully paid perpetual license.

During an existing committed term, material changes require the parties' express agreement unless a change is reasonably necessary to comply with law or address a material safety, security, or regulatory requirement.

15. Business Associate Agreement; HIPAA; Health Information; Data Security

Each party is responsible for determining and complying with the legal requirements that apply to its own activities, including HIPAA, the HITECH Act, state health-privacy laws, consumer privacy laws, breach-notification laws, and professional or regulatory obligations.

15.1. Integrated BAA; parties; effectiveness; precedence

This Section 15 constitutes the Business Associate Agreement ("BAA") between Medeia Inc ("Medeia" or "Business Associate") and the Customer identified in the Agreement or applicable Sales Order when Medeia creates, receives, maintains, or transmits PHI on Customer's behalf. Customer acts as a Covered Entity or, where Customer is itself a Business Associate, as the upstream Business Associate and Medeia acts as its subcontractor Business Associate. Customer must have authority under its upstream arrangements to engage Medeia and authorize the processing described here. The parties' regulatory status depends on their actual activities and applicable law.

This BAA becomes effective when both parties have validly accepted the Agreement incorporating Section 15, through authorized signatures or affirmative electronic acceptance, including acceptance of an incorporating Sales Order, and must be effective before Medeia begins the covered processing. No separately titled or separately signed BAA is required between these parties when this Section is effective and applicable.

References elsewhere in the Agreement to a BAA include this Section. This BAA controls over conflicting provisions of the Agreement, Sales Order, Documentation, or Privacy Policy concerning PHI and HIPAA obligations. A separately executed BAA expressly covering the same services controls instead to the extent of conflict.

15.2. Definitions

"HIPAA" means the Health Insurance Portability and Accountability Act of 1996, the HITECH Act, and their implementing Privacy, Security, Breach Notification, and Enforcement Rules at 45 C.F.R. Parts 160 and 164, as amended and applicable. "PHI" means Protected Health Information, including electronic PHI ("ePHI"), that Medeia creates, receives, maintains, or transmits on behalf of Customer. Breach, Business Associate, Covered Entity, Designated Record Set, Individual, Required by Law, Secretary, Security Incident, Subcontractor, and Unsecured PHI have their applicable HIPAA meanings. "Secretary" includes the Secretary of the U.S. Department of Health and Human Services or the Secretary's designee. "Business Day" means a day other than Saturday, Sunday, or a U.S. federal holiday. Other capitalized terms retain their meanings in the Agreement.

15.3. Permitted processing; cloud patient-data storage

Customer authorizes Medeia to create, receive, maintain, use, and disclose PHI only as necessary to provide the contracted Product and services, as expressly permitted by this BAA, or as Required by Law. Covered services include cloud-based storage and hosting of patient data, measurements, records, and reports; authorized processing and report generation; secure retrieval, transmission, export, backup, and disaster recovery; and support, maintenance, and security reasonably necessary for those services. Support access to PHI must be limited to authorized personnel with a legitimate service need.

Medeia will not use or disclose PHI in a manner that would violate the HIPAA Privacy Rule if performed by Customer or the applicable Covered Entity, except for the permitted management, administration, and legal-responsibility activities described below. Medeia will limit uses, disclosures, and requests to the minimum necessary where HIPAA requires, consistently with applicable Customer policies communicated to Medeia.

Medeia may use PHI for its proper management and administration or to discharge its legal responsibilities. Disclosure for those purposes is permitted only if Required by Law or if Medeia obtains reasonable written assurances that the recipient will preserve confidentiality, use or further disclose PHI only for the stated purpose or as Required by Law, and notify Medeia of any breach of confidentiality of which the recipient becomes aware. This permission does not authorize Medeia's independent research, advertising, sale of PHI, or generalized product development using identifiable patient information. De-identification and subsequent permitted uses are governed by Sections 15.10-15.12.

15.4. Safeguards and cloud-security responsibilities

Medeia will comply with the applicable requirements of the HIPAA Security Rule, 45 C.F.R. Part 164, Subpart C, for ePHI and will maintain appropriate administrative, physical, and technical safeguards against impermissible use or disclosure of PHI. Its security program will include documented risk analysis and risk management, workforce training and access authorization, authentication and audit controls, incident response, backup and disaster recovery, transmission security, and secure disposal, as applicable to its systems and HIPAA obligations. Medeia will encrypt ePHI in transit and at rest in Medeia-managed cloud systems, including backups, and protect the associated encryption keys.

Maintaining encrypted ePHI remains covered processing even where Medeia or a cloud provider lacks the decryption key. Customer's responsibility for its own systems, credentials, and access configuration does not relieve Medeia of its obligations for the services and systems under its control. Medeia will maintain reasonable safeguards for other Customer Data in its possession or control, appropriate to the data and risks and subject to applicable law and agreed security commitments. No security program can eliminate all risk; this statement does not reduce either party's express obligations or liability under applicable law.

15.5. Subcontractors and cloud providers

Before a Subcontractor, including a cloud hosting, storage, backup, support, or de-identification provider, creates, receives, maintains, or transmits PHI on Medeia's behalf, Medeia will enter into a written agreement meeting 45 C.F.R. ## 164.502(e), 164.504(e), and 164.314(a), as applicable. The agreement will impose the same applicable restrictions, conditions, and requirements concerning PHI as this BAA, require compliance with the applicable Security Rule requirements, and require incident reporting sufficiently prompt to enable Medeia to meet its own deadlines. Equivalent obligations must flow down to further Subcontractors.

Medeia will take reasonable steps to cure a known material violation by a Subcontractor or end the violation and, if those steps fail, terminate the affected arrangement when feasible, as required by HIPAA. Medeia remains responsible for performing its obligations under this BAA and applicable law despite using Subcontractors. A provider's inability to decrypt stored PHI does not remove the subcontractor-BAA requirement. Medeia will identify relevant Subcontractors and processing locations on reasonable request and comply with additional approval or notice requirements in an applicable DPA or Sales Order.

15.6. Customer responsibilities and authorized channels

Customer will provide PHI and instructions only where lawfully permitted and will obtain any required notices, permissions, authorizations, and institutional approvals. Customer will notify Medeia of limitations in its notice of privacy practices, changes or revocations of Individual permissions, agreed or mandatory restrictions under 45 C.F.R. # 164.522, and applicable upstream contractual restrictions, to the extent they affect Medeia's processing. Customer will not request processing that is unlawful or outside its authority. The parties will promptly address instructions or restrictions that cannot lawfully be implemented.

Customer will not submit PHI or other regulated health information to a Product or feature that Medeia has not designated or contractually agreed may receive that information. Customer is responsible for configuring its users, access rights, integrations, and workflows consistently with applicable privacy and security requirements. Customer will use only designated secure channels and will not include PHI in general email or support submissions unless that channel is specifically approved for the purpose. This BAA does not designate every feature or channel as suitable for PHI. PHI inadvertently received through an unapproved channel remains protected under this BAA while Medeia holds it; the parties will cooperate in secure transfer, return, or deletion. Customer is responsible for promptly identifying specially regulated data or legally binding restrictions that require processing measures beyond the agreed configuration, and for obtaining an appropriate written addendum before knowingly submitting such data to a feature not approved for it. This allocation does not relieve Medeia of requirements applicable to information it actually receives or permit unprotected handling of inadvertently received PHI.

15.7. Security Incidents; Breaches; reporting and cooperation

Medeia will report to Customer any use or disclosure of PHI not permitted by this BAA, any Breach of Unsecured PHI, and any Security Incident affecting Customer's PHI or related processing systems of which Medeia becomes aware. Except for routine unsuccessful incidents reported as described below, initial written notice will be given without unreasonable delay and no later than five (5) Business Days after discovery or awareness, as applicable, or sooner where applicable law or an agreed shorter deadline requires. Medeia will also give prompt preliminary notice of a reasonably suspected unauthorized access, use, or disclosure affecting Customer's PHI without waiting for a final Breach determination.

For a Breach, discovery has the meaning in 45 C.F.R. # 164.410(a)(2), including actual or constructive knowledge through reasonable diligence by an employee, officer, or other agent, other than the person committing the Breach. The shorter contractual deadline above does not extend the deadline under 45 C.F.R. # 164.410. A notification delay required by law enforcement under 45 C.F.R. # 164.412 applies only to the extent permitted by that provision.

Initial notice will include the facts then known, incident and discovery dates, affected systems and types of information, containment measures, and a contact for follow-up. For a Breach, Medeia will identify affected or reasonably believed affected Individuals to the extent possible and provide information needed for notices under 45 C.F.R. # 164.404(c). Medeia will promptly supplement incomplete information, investigate, preserve relevant evidence, mitigate known harmful effects to the extent practicable, and reasonably cooperate in risk assessment, remediation, restoration, and required notifications. An impermissible use or disclosure will be assessed under 45 C.F.R. # 164.402, including its Breach presumption and applicable exceptions; the investigation will not postpone required reporting.

For routine unsuccessful attempts, such as blocked scans or failed logins, that do not result in unauthorized access, use, disclosure, alteration, or destruction of PHI or material interference with systems, the parties agree to quarterly summary reporting instead of incident-by-incident notice. Medeia will provide such summaries to Customer. This reporting arrangement does not cover a Breach, successful compromise, or other event requiring earlier notice.

Customer will notify Medeia without undue delay of an actual or reasonably suspected incident under Customer's control affecting the services or Customer Data. For incidents affecting other Customer Data under either party's control, that party will notify the other without undue delay and meet any earlier deadline in the applicable DPA, security addendum, or law. Customer or the responsible Covered Entity will determine and issue notices to Individuals, regulators, and the media unless Medeia is legally required, or separately agrees in writing, to do so. Neither party may prevent the other from making a legally required report.

15.8. Individual rights; delegated obligations

Medeia will make PHI in a Designated Record Set available to Customer, or as Customer lawfully directs, as necessary to satisfy 45 C.F.R. # 164.524. For electronic records, Medeia will support the requested electronic format where readily producible, or a mutually agreed readable electronic format consistent with HIPAA. Medeia will make PHI available for amendment and incorporate, append, or link amendments as Customer directs or agrees, and otherwise assist as necessary under 45 C.F.R. # 164.526.

Medeia will document disclosures subject to accounting and maintain and provide the information necessary for Customer or the relevant Covered Entity to comply with 45 C.F.R. # 164.528, including the applicable six-year lookback. Medeia will perform the requested assistance under this subsection without undue delay and within ten (10) Business Days after Customer's request, or sooner as necessary to meet an applicable legal deadline communicated by Customer. A request received directly from an Individual will be forwarded to Customer within five (5) Business Days, or sooner as required, unless Medeia is lawfully responsible for responding directly.

Customer retains responsibility for decisions on Individual requests unless expressly delegated. Where Customer is an upstream Business Associate, Medeia will provide the same assistance through Customer for the relevant Covered Entity. To the extent Medeia performs any Covered Entity obligation under the Privacy Rule, Medeia will comply with the requirements applicable to that obligation. These duties depend on the records and legal requirements, not solely on whether an Order labels the data a Designated Record Set.

15.9. Regulatory access and compliance information

Medeia will make its internal practices, books, and records relating to the use and disclosure of PHI received from, or created or received on behalf of, Customer available to the Secretary for determining compliance with HIPAA. Medeia will retain required HIPAA compliance documentation for the applicable legal period. On reasonable request, Medeia will provide Customer with information reasonably necessary to assess compliance with this BAA, subject to reasonable confidentiality and security protections for other customers and systems. Those protections will not restrict access required by the Secretary or applicable law.

15.10. Express authorization to create De-identified Data

To the extent Customer may lawfully authorize it, Customer expressly authorizes Medeia and its permitted Subcontractors to use PHI processed under this BAA to create data that satisfies 45 C.F.R. # 164.514(a)-(b) ("De-identified Data"). This BAA itself supplies the parties' contractual authorization for that de-identification; a separate de-identification agreement is not required, subject to Section 15.1 and applicable law. Source PHI and the de-identification process remain subject to this BAA until the applicable standard is met.

Medeia will use either: (a) Safe Harbor under 45 C.F.R. # 164.514(b)(2), removing all required identifiers concerning the Individual and the Individual's relatives, employers, and household members, with no actual knowledge that the remaining information could identify the Individual alone or with other information; or (b) Expert Determination under 45 C.F.R. # 164.514(b)(1), with a qualified expert documenting the methods and results supporting a very small identification risk for anticipated recipients, considering other reasonably available information. Medeia will maintain evidence of the method used and any required expert determination.

Removing patient names alone, aggregation alone, or pseudonymization alone is not sufficient. A HIPAA limited data set remains PHI and is not De-identified Data under this permission. Any record code must meet applicable requirements of 45 C.F.R. # 164.514(c), and no re-identification key or mechanism may be shared with recipients. For information subject to another privacy law, the applicable de-identification or anonymization standard and lawful basis for the original processing must also be satisfied.

15.11. Product improvement; research; permitted sharing and retention

Subject to Sections 15.10 and 15.12, Customer grants Medeia a nonexclusive, royalty-free right to retain, combine, analyze, and use De-identified Data for product improvement and development, performance and quality analysis, machine-learning, security, scientific and clinical validation, regulatory compliance, lawful scientific or medical research, and related business analytics. This permission does not transfer ownership of source PHI or patient-specific records. This includes research relating to the safety, effectiveness, accuracy, reliability, and usability of Medeia products. Medeia may use De-identified Data across customer datasets, provided the combined data and proposed uses continue to satisfy the applicable de-identification requirements.

Medeia may disclose De-identified Data to service providers, research institutions, and collaborators only for those purposes under written terms restricting use, requiring reasonable safeguards, prohibiting re-identification and contacting Individuals, and limiting further disclosure on equivalent terms. Public research findings or publications must be aggregated or otherwise non-identifying and must not disclose Customer's Confidential Information or identify Customer without its written consent. This permission does not authorize unrestricted publication of patient-level datasets, standalone sale or licensing of datasets to unrelated third parties, or targeted advertising.

Medeia will not attempt to re-identify De-identified Data or link it to identified patient records. It will assess identification risk before a materially different combination, use, or disclosure and stop the affected use or disclosure if the data no longer meets the applicable standard, treating identifiable information as PHI or other protected data as applicable. Research remains subject to any legally required ethics review, consent, authorization, or other approval; this BAA does not itself supply those approvals.

The permission to retain and use De-identified Data lawfully created during the service term survives termination, subject to these continuing purpose, confidentiality, and no-reidentification restrictions, applicable law, and controlling written restrictions under Section 15.1. Ordinary PHI return/deletion obligations do not require deletion of that qualifying De-identified Data. Medeia may not retain PHI after termination merely to create further research or product-improvement datasets. Uses expressly permitted here do not require separate project-by-project Customer approval, except as required by Section 15.12, a controlling agreement, or law.

15.12. Termination; return or destruction; continuing access

This BAA continues while Medeia or its Subcontractors hold PHI on Customer's behalf. Customer may terminate this BAA and the affected services if Medeia violates a material term and fails to cure the violation within thirty (30) calendar days after written notice, or within a shorter reasonable period required to address a serious privacy or security risk. Customer may terminate immediately if cure is not possible or continued processing would be unlawful. Medeia may suspend unlawful processing instructions, subject to its continuing protection and lawful data-access obligations.

Upon termination of the affected services, Medeia will return PHI to Customer or its authorized designee or, at Customer's written direction, securely destroy it, including copies held by Subcontractors, if feasible. The transition and deletion procedure in Section 12 applies only insofar as consistent with this BAA and applicable law. Medeia will provide a reasonable secure opportunity to receive usable records before destruction and retain no copies after completion except as permitted below. Customer's silence does not waive a required return or authorize indefinite retention.

Where return or destruction is infeasible, including because of a legal preservation requirement or technically inseparable backup, Medeia will notify Customer in writing of the affected information, reasons, and anticipated retention period. Medeia will continue all applicable safeguards and BAA protections, limit further uses and disclosures to the purposes making return or destruction infeasible, isolate retained backups from ordinary use, and return or securely destroy the PHI when feasible. Restoration from backup will not authorize renewed use beyond those purposes. On reasonable request, Medeia will confirm completion or explain continuing permitted retention.

Medeia will not withhold PHI or block lawful access to PHI to resolve a payment dispute. Where ordinary access must be restricted for a genuine security or legal reason, Medeia will provide an appropriate secure alternative where lawful. Termination of paid functionality does not extinguish record-access or return obligations. The obligations applicable to retained PHI and the continuing restrictions on De-identified Data survive termination.

15.13. Other privacy laws and international processing

Where Medeia processes personal data for Customer in a role requiring a DPA or equivalent written terms, the parties will enter into those terms before the relevant processing begins. They will address instructions, confidentiality, security, authorized subprocessors, assistance with individual rights, incidents, deletion, audits, and international transfers to the extent required by law. Medeia will impose the required written obligations on relevant subprocessors and remain responsible to the extent required by its agreements and law. Processing locations and any required transfer safeguards will be identified in the applicable DPA, Sales Order, or Privacy Policy. These terms do not themselves authorize a transfer or processing purpose prohibited by those documents or law.

This BAA does not supply an Individual's HIPAA authorization or override more protective health-privacy laws, consent requirements, or restrictions applicable to specially protected records. HIPAA de-identification alone does not establish compliance with every other applicable law. Where Customer or the relevant information is outside HIPAA, other applicable contractual and legal protections remain in force.

15.14. Notices; amendments; interpretation

Security and privacy contacts must be kept current. Notices under this BAA will be directed to Customer's designated privacy/security contact, or its account administrator if no such contact is supplied, and to Medeia's designated privacy/security contact. Customer may use the Technical Support contact in Section 45 to obtain secure reporting instructions, without including PHI in an unapproved channel. Initial incident notice need not contain PHI; any necessary PHI will be transmitted through an approved secure channel. An incident notice sent within the required period to the current designated contact is not delayed by a requirement for email acknowledgment in Section 32; the sender will retain transmission evidence and promptly use an alternative channel if delivery fails.

An amendment to this BAA requires written or affirmative electronic agreement by authorized representatives of both parties; a general website update or continued use alone will not expand PHI or De-identified Data permissions. The parties will make amendments necessary to comply with applicable law. References to HIPAA provisions include applicable amendments. Ambiguities will be interpreted to permit compliance with HIPAA, and no disclaimer, limitation, or commercial dispute excuses a mandatory duty under HIPAA or prevents regulatory enforcement.

16. Fees

Customer will pay all fees, charges, taxes, shipping costs, and other amounts required by the applicable Sales Order or other written agreement between the parties to Medeia or the seller identified in the Sales Order. Amounts are due according to the Sales Order, or the invoice where the Sales Order does not specify payment terms. If neither states a due date, payment is due ten (10) days after the invoice date. An invoice does not independently change agreed pricing or other Sales Order terms.

Any undisputed amount remaining unpaid more than ten (10) days after its due date may accrue simple interest, without compounding, from the thirty-first day after the due date at the lesser of two percent (2%) per month or the maximum rate permitted by applicable law. Interest does not accrue retroactively during that thirty-day grace period. Customer will also reimburse reasonable, documented costs of collection, including court costs and reasonable attorneys' fees, to the extent permitted by law. All amounts legally treated as interest are included in that lawful maximum; any excess collected will be applied to principal or refunded, and no provision requires payment of unlawful interest.

Billing disputes; no setoff. Customer will identify any good-faith billing dispute promptly in writing, with the invoice, disputed amount, and reasonable supporting detail, and pay all undisputed amounts when due. The parties will work in good faith to resolve the dispute. Unless the Sales Order states otherwise, fees exclude sales, use, value-added, and similar transaction taxes and duties. Customer is responsible for such taxes arising from its purchase or use, other than taxes based on Medeia's net income, and will provide valid exemption documentation where applicable. Where withholding is required by law, Customer will provide appropriate documentation, and the parties will reasonably cooperate in obtaining available relief. No tax gross-up is imposed unless expressly agreed in the Sales Order.

Unless a Sales Order states otherwise, Medeia may change pricing for future renewals, new orders, or uncommitted services on at least thirty (30) days' direct written notice. For an automatic renewal, notice of an increased price must also be provided before the last date on which Customer may decline that renewal. A pricing change does not alter an already accepted fixed-price Sales Order unless the Sales Order expressly permits it or the parties agree in writing.

17. Statutory Exceptions for Public Institutions

If Customer is a qualified public educational or governmental institution and a provision of this Agreement-including an indemnity, governing-law, venue, or damages provision-is invalid or unenforceable against Customer because of applicable federal, state, or local law, that provision will be enforced only to the maximum extent permitted and otherwise construed consistently with applicable law. If Texas governing law or venue cannot lawfully apply to such an institution, the Agreement will be construed under the law that applicable law requires.

18. Product Maintenance and Support

Medeia is responsible for maintenance and support for NeuroTrace Products only to the extent stated in the applicable Sales Order, Product Documentation, support policy, warranty, or applicable law. Support for third-party products is the responsibility of the applicable third-party provider unless Medeia expressly agrees otherwise in writing. This third-party allocation does not limit the express warranty for a Medeia-supplied laptop or Medeia's obligations for contractors or subprocessors used to perform its own commitments.

Support may require remote diagnostics, logs, configuration information, device identifiers, screenshots, backup/restore steps, software updates, or return of hardware. Support access must use an agreed secure process with access limited to what is reasonably necessary. Temporary credentials, supervised sessions, or de-identified diagnostic examples will be used where reasonably practicable. Any handling of personal information or PHI in connection with support is subject to the applicable BAA, DPA, Privacy Policy, and law, and to the approved-channel requirements in Section 15.

The Sales Order or an identified support policy will state applicable support hours, channels, included Services, charges, exclusions, and any response or restoration targets. Targets are not service-level guarantees unless expressly agreed in writing. Scheduled maintenance notices and reasonably practicable efforts to minimize avoidable disruption apply to hosted Services. No perpetual support, loan equipment, free optional upgrade, or fixed service-response time is promised unless expressly stated. Assistance with Customer-caused faults, unsupported environments, unauthorized integrations, training beyond the purchased scope, or changes requested by Customer is chargeable only under agreed rates or an approved change order, unless included in an express warranty or other existing obligation. Voluntary assistance on one occasion does not create an ongoing service commitment or expand warranty coverage.

End of support does not itself terminate a fully paid perpetual license, shorten an unexpired express warranty, or displace mandatory safety or regulatory duties. Continued use may nevertheless be restricted where reasonably required for safety, security, or law under Section 13.

19. Licensed Application End User License Agreement

The Software and each NeuroTrace software application made available by Medeia (each, a "Licensed Application") are licensed, not sold. Medeia is the "Licensor" of Medeia-supplied Software and reserves all rights not expressly granted. A Third-Party Product is licensed by its identified provider under the applicable third-party license made available to Customer; references to that provider do not reduce Medeia's separate obligations under this Agreement.

a. Scope of License. Subject to Customer's compliance with this Agreement, and the applicable Sales Order, Licensor grants Customer a limited, nonexclusive, nontransferable except as expressly permitted, nonsublicensable license to install and use the Licensed Application in object-code form on supported devices that Customer owns or controls, solely for Customer's own authorized clinical, research, educational, or other professional operations, including the permitted patient/client services in Section 10. The Sales Order will identify the license type and term, including whether perpetual, subscription, trial, or usage-based, and the applicable device, user, location, test-volume, or other limits. Hosted access is provided only for the applicable service term. You may not make the Licensed Application available over a network for simultaneous use by multiple devices or users beyond the number or scope licensed to you. You may not rent, lease, lend, sell, redistribute, transfer, or sublicense the Licensed Application except as expressly permitted. Authorized fee-paid clinical or professional services are permitted within the scope of Section 10. An enterprise, affiliate-wide, multi-site, pooled, concurrent, virtualized, or unlimited-use license requires an express written grant. Customer may not multiply access through shared credentials, multiplexing, virtual machines, containers, or remote-access arrangements to evade licensed limits; those technologies are otherwise permitted only within the agreed scope and supported environment. Customer is responsible for the acts and omissions of its Authorized Users and contractors in using the Product on its behalf as if they were Customer's own, except to the extent caused by Medeia's breach.

Replacement and transfer. Customer must follow the documented license-reallocation process when replacing a failed device, reinstalling on a supported replacement computer, or moving to a different licensed site. Medeia will reasonably cooperate with reactivation on a supported replacement device within the existing license scope; additional license charges apply only for an expressly agreed scope increase. Transfer of hardware does not automatically transfer a Software license, account, support entitlement, or contractual warranty. Customer will remove or securely transfer Software and regulated data as authorized before disposing of a device and comply with record-retention duties and Section 36.

b. Copies; Reverse Engineering. Protection of Technology. You may make a reasonable number of backup or archival copies of downloadable Software where technically permitted, retaining proprietary notices and not using the copies concurrently beyond the licensed scope. Other copying is permitted only by the license, Usage Rules, or applicable law. Except to the extent prohibited by law or permitted by an applicable open-source license, you may not decompile, reverse engineer, disassemble, attempt to derive source code, modify, or create derivative works of the Licensed Application or updates. Applicable open-source terms control for the component concerned to the extent of a conflict. Customer must not, and must not permit or facilitate another person to: (i) remove or obscure proprietary, license, regulatory, or safety notices; (ii) use unauthorized keys, defeat metering, alter identifiers, or evade test-volume, device, user, or location limits; (iii) scrape, probe, or systematically extract nonpublic algorithms, model parameters, reference databases, or proprietary content; (iv) use the Licensed Application, its nonpublic outputs, or Medeia's Confidential Information to train, fine-tune, validate, or build software or a model intended to reproduce its proprietary functionality or compete with the Licensed Application; (v) conduct penetration, load, or destructive testing of Medeia systems without prior written authorization; or (vi) combine or distribute Software in a manner that requires disclosure, licensing, or distribution of Medeia proprietary code under third-party terms. No publication may disclose Medeia's Confidential Information except as lawfully permitted under Section 29.

c. Updates. This license applies to updates that replace or supplement the original Licensed Application unless separate terms are validly agreed under Section 14. Sections 5 and 18 govern installation, charges, and support. An update does not expand the number of licenses or permit separate simultaneous use of the replaced and replacement versions beyond the licensed scope. Customer will not continue a version after a required safety withdrawal, subject to lawful records access and a safe transition.

d. Technical, Clinical, and Diagnostic Data. Licensor may collect and use technical, diagnostic, usage, device, system, application, peripheral, and support information only to the extent permitted by Sections 12 and 15, the applicable Privacy Policy, BAA, DPA, Sales Order, and law, including for authorized license verification, updates, support, and security. Clinical or other Customer Data may be de-identified and used for Product improvement, analytics, model development, or research only as expressly authorized in Sections 15.10–15.13 and any controlling agreement.

e. Termination. The affected license terminates or expires only in accordance with Section 13 and its applicable term. Upon termination, you must stop using and delete the Licensed Application, subject to the permitted transition access and lawful archival and record-retention requirements in Sections 12 and 13. Expiration of a trial, subscription, or usage-based entitlement may disable affected paid functionality, but does not authorize disabling an unaffected fully paid perpetual license or withholding records required to be accessible under Sections 12 and 15.

f. Third-Party Services and Materials. The Licensed Application may provide access to third-party software, websites, content, interfaces, data, or services ("Third-Party Services"). Third-Party Services may require Internet access and separate terms. Medeia does not control and is not responsible for Third-Party Services except to the extent expressly stated in a Sales Order or required by law. You are responsible for reviewing and complying with third-party terms and privacy notices. The foregoing does not exclude Medeia's responsibility under this Agreement, a BAA, DPA, express warranty, or law for third-party components or subprocessors that Medeia selects to perform its own obligations.

g. No Warranty for Licensed Application. EXCEPT FOR ANY EXPRESS WARRANTY IN THIS AGREEMENT, A SALES ORDER, OR PRODUCT-SPECIFIC DOCUMENT, AND TO THE MAXIMUM EXTENT PERMITTED BY LAW, THE LICENSED APPLICATION IS PROVIDED "AS IS" AND "AS AVAILABLE," WITH ALL FAULTS. LICENSOR DISCLAIMS IMPLIED WARRANTIES AND CONDITIONS, INCLUDING MERCHANTABILITY, SATISFACTORY QUALITY, FITNESS FOR A PARTICULAR PURPOSE, ACCURACY, QUIET ENJOYMENT, AND NON-INFRINGEMENT, TO THE EXTENT THOSE WARRANTIES MAY LAWFULLY BE DISCLAIMED. LICENSOR DOES NOT WARRANT THAT OPERATION WILL BE UNINTERRUPTED OR ERROR-FREE OR THAT ALL DEFECTS WILL BE CORRECTED. SOME JURISDICTIONS DO NOT ALLOW CERTAIN DISCLAIMERS, SO THESE LIMITATIONS MAY NOT APPLY TO YOU. WITHOUT LIMITING EXPRESS PRODUCT SPECIFICATIONS OR REGULATORY LABELING, LICENSOR DOES NOT WARRANT A PARTICULAR PATIENT OUTCOME, DIAGNOSTIC YIELD, REIMBURSEMENT, RESEARCH RESULT, OR COMPATIBILITY WITH UNAPPROVED SYSTEMS. NO ORAL ADVICE, DEMONSTRATION, PROJECTION, OR INFORMAL SUPPORT COMMUNICATION CREATES AN ADDITIONAL WARRANTY. THIS DISCLAIMER DOES NOT DISCLAIM Medeia's AUTHORITY TO GRANT THE EXPRESS LICENSE, REPLACE AN EXPRESS HARDWARE WARRANTY, OR LIMIT A MANDATORY DUTY UNDER SECTION 15 OR APPLICABLE LAW.

h. Liability. Liability arising out of the Licensed Application, including claims involving Software together with hardware or Services, is governed by the integrated exclusions, caps, and exceptions in Section 21. No separate application-specific cap is created by this license, and claims may not be multiplied by characterizing the same loss as arising under both this license and another part of the Agreement.

i. Export and Sanctions Compliance. You may not export, reexport, transfer, release, or use the Licensed Application or related technology in violation of U.S. export-control or sanctions laws, including applicable requirements administered by the U.S. Department of Commerce and U.S. Department of the Treasury, or applicable laws of another jurisdiction. You represent that you are not prohibited from receiving the Product under applicable sanctions or restricted-party rules and will not use the Product for prohibited end uses.

j. Governing Law. Section 31 governs the Licensed Application license, including its mandatory-rights qualifications.

k. Trial, Evaluation, and Preview Features. A trial, evaluation, beta, or preview feature may be used only for the stated evaluation term and permitted purposes. It is not a promise of future availability or production functionality and may be withdrawn at the end of that term. Clinical use or production reliance requires express authorization in the applicable labeling and Sales Order. PHI submission additionally requires an approved feature and an effective BAA where legally required. Such features are provided subject to Sections 19(g), 21, and 22, without included support or a service-level commitment unless expressly agreed. No trial converts to a paid subscription without the acceptance required by Section 33. Withdrawal does not remove mandatory safety, data-protection, or record-return duties.

20. Limited Hardware Warranty

IMPORTANT: BY USING A NeuroTrace-BRANDED HARDWARE PRODUCT, YOU AGREE TO THE TERMS OF THIS LIMITED WARRANTY TO THE EXTENT PERMITTED BY LAW. IF YOU DO NOT AGREE, DO NOT USE THE HARDWARE AND CONTACT THE SELLER REGARDING ANY AVAILABLE RETURN RIGHTS.

This limited warranty applies to NeuroTrace-branded hardware and accessories supplied by Medeia or an authorized distributor and identified in the applicable Sales Order or proof of purchase (the "NeuroTrace Hardware"). It does not apply to Software, other Third-Party Products, consumable wear, or Services except as expressly stated.

20.1. How consumer law relates to this warranty

This warranty gives you specific legal rights. You may also have other rights that vary by state, country, or province. Medeia does not exclude, limit, or suspend rights that cannot lawfully be excluded, limited, or suspended. Where mandatory consumer, medical-device, or product-warranty law applies, that law controls to the extent of any conflict.

20.2. Warranty limitations subject to consumer law

TO THE EXTENT PERMITTED BY LAW, THIS LIMITED WARRANTY AND THE REMEDIES STATED BELOW ARE EXCLUSIVE AND IN LIEU OF OTHER WARRANTIES, REMEDIES, AND CONDITIONS, WHETHER ORAL, WRITTEN, STATUTORY, EXPRESS, OR IMPLIED. TO THE EXTENT PERMITTED BY LAW, Medeia DISCLAIMS IMPLIED WARRANTIES, INCLUDING MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, AND WARRANTIES AGAINST HIDDEN OR LATENT DEFECTS. WHERE AN IMPLIED WARRANTY CANNOT BE DISCLAIMED, ITS DURATION AND REMEDIES ARE LIMITED TO THE DURATION OF THIS EXPRESS WARRANTY AND THE REMEDIES BELOW TO THE EXTENT PERMITTED BY LAW. THESE DISCLAIMERS DO NOT EXCLUDE AN EXPRESS WARRANTY CREATED BY THIS AGREEMENT, A VALIDLY AGREED SALES ORDER, OR APPLICABLE LAW. IF APPLICABLE CONSUMER-WARRANTY LAW PROHIBITS DISCLAIMER OF AN IMPLIED WARRANTY BECAUSE Medeia PROVIDES A WRITTEN WARRANTY, ONLY A DURATION OR REMEDY LIMIT THAT THE LAW PERMITS WILL APPLY.

20.3. What is covered by this warranty?

Medeia warrants NeuroTrace Hardware, and the Medeia-supplied laptop expressly covered below, against defects in materials and workmanship when used normally in accordance with Medeia/NeuroTrace published guidelines for the applicable warranty period set forth below, measured from the date of original retail purchase by the end-user purchaser (each, the "Warranty Period"):

(a) NeuroTrace Hardware: two (2) years;

(b) Cables: six (6) months; and

(c) Laptop computer, if provided by Medeia as part of the NeuroTrace system: one (1) year.

The foregoing warranty periods apply unless a product-specific written warranty or Sales Order expressly states a longer warranty period. Any separate warranty provided by the original manufacturer of a laptop or other third-party hardware is governed by that manufacturer's terms and may provide additional rights or coverage. These minimum periods may not be shortened by an invoice, general order-precedence provision, or reseller statement. Proof of the original end-user purchase may include an invoice or receipt from Medeia or an authorized distributor identifying the item and purchase date. The laptop coverage stated here is Medeia's express warranty and is not replaced by any separate manufacturer warranty.

Published guidelines include applicable technical specifications, user manuals, instructions for use, safety information, and authorized software communications.

This warranty applies only to defects that arise during normal, authorized use within the applicable Warranty Period.

20.4. What is not covered by this warranty?

Except for a laptop expressly provided by Medeia as part of the NeuroTrace system and covered by the one (1) year warranty stated above, this warranty does not apply to non-NeuroTrace-branded hardware or to Software, even if packaged or sold with NeuroTrace Hardware. Third-party manufacturers, suppliers, or publishers may provide their own warranties. NeuroTrace Software is governed by the applicable license terms and any express software warranty stated in a Sales Order.

Medeia does not warrant that operation of the Product will be uninterrupted or error-free, and Medeia is not responsible for damage caused by failure to follow applicable instructions or published guidelines.

This warranty does not cover: (a) ordinary depletion or wear of consumable parts or protective coatings, but this exclusion does not remove the express six (6) month cable warranty or coverage for a defect in materials or workmanship in an otherwise covered part; (b) cosmetic damage that does not materially affect operation and is not caused by a covered defect; (c) damage caused by incompatible or unauthorized products; (d) damage caused by accident, abuse, misuse, liquid contact, fire, earthquake, power events, or other external causes; (e) damage caused by use outside published guidelines or authorized environmental conditions; (f) defects caused by service, repair, upgrades, or modifications performed by someone other than Medeia or an authorized service provider; (g) defects caused by an unauthorized modification of functionality or capability; (h) normal wear and tear or normal aging; (i) a removed, altered, or defaced serial number where that condition prevents verification of coverage or is connected to the claimed issue; or (j) defects caused by failure to perform cleaning, inspection, calibration, maintenance, or required safety updates specified in the Documentation. Unrelated conduct does not by itself void coverage for an otherwise covered defect, and all exclusions remain subject to mandatory law.

Medeia may limit warranty service for hardware to the country or territory where Medeia or an authorized distributor originally sold the device, subject to mandatory law.

20.5. Your responsibilities for warranty service

You should maintain periodic backups of information stored on or used with the Product and follow applicable retention, privacy, and security requirements. Before warranty service, Medeia or its authorized service provider may require proof of purchase, device information, diagnostic information, and reasonable troubleshooting steps.

Before submitting hardware for warranty service, obtain return authorization and follow the agreed secure service-access process. Back up data where feasible and remove Customer Data and credentials only where lawful, technically practicable, and consistent with evidence-preservation and record-retention duties. Use temporary credentials, supervised access, or another appropriately protected method where practicable; do not disclose passwords or disable security controls through an unapproved channel. Service may require deletion, replacement, or reformatting of storage media, and Medeia will provide notice where reasonably practicable. Data and media received by Medeia or its service provider remain subject to the applicable BAA, DPA, privacy and security obligations, and law. Data-loss liability is governed by Section 21; this section does not exclude liability for breach of Medeia's express data-protection obligations.

After service, the device may be returned with current system Software and may not support reversion to an earlier version. You are responsible for reinstalling applications, data, and configuration not included in the warranty service.

Do not open, repair, or modify NeuroTrace hardware except as expressly permitted in the Documentation or by Medeia. Unauthorized opening or service may cause damage not covered by this warranty.

20.6. What will Medeia do if the warranty is breached?

If you submit a valid warranty claim during the Warranty Period, Medeia will, at its option and subject to applicable law: (i) repair the NeuroTrace Hardware using new or previously used parts equivalent to new in performance and reliability; or (ii) replace the NeuroTrace Hardware with a device that is new or formed from new and/or previously used parts and is at least functionally equivalent to the replaced hardware.

If Medeia cannot provide an effective repair or functionally equivalent replacement within a reasonable period after receiving the information and equipment reasonably required for service, Medeia will accept return of the affected covered item and refund the pro rata purchase price actually paid for that item, including tax adjustments required by law, under Section 33. Medeia may elect that return-and-refund remedy instead of repair or replacement where lawful and reasonable. The remedy applies to the affected item rather than automatically to the entire system, unless the Sales Order or mandatory law requires otherwise. These remedies are the exclusive contractual remedies for breach of this limited hardware warranty, without limiting nonwaivable rights. A refund for the affected item ends its contractual warranty coverage and any Software license included solely with, and refunded as part of, that returned item, without extinguishing accrued nonwaivable rights or access to retained reports. Refunded amounts cannot also be recovered as damages for the same purchase price.

A replacement part or device assumes the remaining Warranty Period or ninety (90) days from the date of repair or replacement, whichever provides longer coverage, unless mandatory law requires more. When a device or part is replaced, the replacement becomes your property and the replaced item becomes Medeia's property, subject to applicable law.

20.7. How to obtain warranty service

Review applicable online help and troubleshooting resources before seeking warranty service. If the Product still does not function properly, contact Medeia or an authorized distributor. Medeia or its authorized distributor will determine eligibility and the available service method. Obtain a return-material authorization before shipment and provide reasonably requested proof of purchase. Any paid diagnostic or out-of-warranty work requires Customer's advance approval of the applicable charges.

Technical Support: +1 800 433 4609. Current contact information is available on Medeia and NeuroTrace official websites.

20.8. Warranty service options

Medeia may provide warranty service by one or more methods, depending on Product, location, parts availability, regulatory requirements, and logistics:

(i) Carry-in service through an authorized service location or distributor.

(ii) Mail-in service using the shipping instructions and any prepaid label specified in the return authorization.

(iii) Advance replacement or user-installable parts, where offered. Medeia may require a reasonable payment-card authorization or other security for replacement equipment that must be returned. If the replaced item is not returned as instructed or is ineligible for coverage, Medeia may charge the authorized amount to the extent permitted by law. The authorization must identify the amount, return deadline, applicable return instructions, and conditions for any charge before Customer agrees to advance replacement. Medeia may charge only an agreed amount and will promptly release any unused authorization after the return obligation is satisfied.

Unless the Sales Order, return authorization, or mandatory law provides otherwise, Customer pays standard shipping to the designated service location, and Medeia pays reasonable standard shipping back to Customer for a valid warranty claim. Customer is responsible for unauthorized expedited shipping, inadequate packaging, and applicable international duties, taxes, and import requirements unless otherwise agreed or required by law. Medeia is not responsible for labor costs associated with user-installable parts unless expressly agreed. Service options, response times, and parts availability may vary by country. Where international service is available, replacement parts or devices may be comparable products that comply with local standards.

21. Limitation of Liability

21.1. Scope; mandatory exceptions. Some jurisdictions do not allow certain exclusions or limitations of liability. This Section 21 applies only to the maximum extent permitted by applicable law and does not exclude or limit liability that cannot lawfully be excluded or limited. It also governs all claims arising out of or relating to the Product, Software, Services, any Sales Order, this Agreement, or any incorporated license, BAA, or DPA, subject to an expressly agreed deviation under Sections 1 and 21.5.

Medeia will use reasonable skill and care in providing Services it has expressly agreed to provide. Nothing in this Agreement excludes or limits liability for fraud or willful misconduct, gross negligence where it cannot lawfully be limited, death or personal injury to the extent applicable law prohibits the limitation, or any other non-excludable or non-limitable liability. No commercial allocation restricts a regulator's authority, excuses a mandatory safety, privacy, or healthcare duty.

21.2. Excluded damages. SUBJECT TO SECTION 21.1 AND THE EXPRESS DIRECT-COST EXCEPTION IN SECTION 21.3, Medeia AND ITS AFFILIATES, OFFICERS, DIRECTORS, EMPLOYEES, AGENTS, CONTRACTORS, DISTRIBUTORS, PARTNERS, AND LICENSORS (COLLECTIVELY, THE "Medeia PROTECTED PARTIES") WILL NOT BE LIABLE FOR: (A) INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, PUNITIVE, OR CONSEQUENTIAL DAMAGES; OR (B) LOSS OF PROFITS, REVENUE, REIMBURSEMENT, GOODWILL, DATA, BUSINESS OPPORTUNITY, ANTICIPATED SAVINGS, OR USE; BUSINESS INTERRUPTION; OR COSTS OF SUBSTITUTE EQUIPMENT OR SERVICES, REPROCUREMENT, REPROGRAMMING, RESTORATION, OR REPRODUCTION, WHETHER ANY LOSS IN THIS CLAUSE (B) IS CHARACTERIZED AS DIRECT OR INDIRECT. THESE EXCLUSIONS APPLY EVEN IF A PARTY WAS ADVISED OF, OR COULD REASONABLY FORESEE, THE POSSIBILITY OF THE LOSS.

21.3. Limited direct incident-response costs. Section 21.2 does not exclude reasonable, necessary, documented direct costs actually incurred to investigate, contain, and remediate a security incident, provide legally required notices, or restore affected Customer Data, but only to the extent proximately caused by Medeia's breach of an express confidentiality, data-security, or data-protection obligation. Recoverable costs exclude duplicate work, unrelated system improvements, voluntary compensation, discretionary monitoring, and public-relations programs unless legally required or expressly approved by Medeia in writing. Customer will mitigate loss and give Medeia a reasonable opportunity to participate in response and vendor selection where practicable; neither participation nor approval is a condition to timely mandatory or reasonably necessary emergency action. These costs count toward, and do not increase, the applicable aggregate cap under Sections 21.4 and 21.5. This paragraph is not a strict-liability undertaking or an indemnity for all incidents.

21.4. General aggregate cap. SUBJECT TO SECTION 21.1, THE COMBINED AGGREGATE LIABILITY OF ALL Medeia PROTECTED PARTIES WILL NOT EXCEED: (A) FOR SUBSCRIPTIONS, HOSTED ACCESS, MAINTENANCE, AND OTHER RECURRING SERVICES, THE FEES ACTUALLY PAID BY CUSTOMER TO Medeia OR ITS AUTHORIZED SELLER AND ATTRIBUTABLE TO THE AFFECTED PRODUCT OR SERVICE FOR THE SIX (6) MONTHS IMMEDIATELY BEFORE THE FIRST EVENT GIVING RISE TO ANY CLAIM INVOLVING THAT AFFECTED ITEM; (B) FOR A ONE-TIME HARDWARE, PERPETUAL-SOFTWARE, OR NONRECURRING-SERVICE PURCHASE, THE PURCHASE, LICENSE, OR SERVICE PRICE ACTUALLY PAID FOR THE AFFECTED ITEM OR DELIVERABLE, WITHOUT APPLYING THE SIX-MONTH LOOKBACK TO THAT ONE-TIME PRICE; AND (C) FOR A PRODUCT OR FEATURE SUPPLIED ENTIRELY WITHOUT CHARGE, ONE HUNDRED U.S. DOLLARS (US$100). PREPAID RECURRING FEES ARE ALLOCATED RATABLY OVER THE PREPAID PERIOD; TAXES, DUTIES, FREIGHT, INTEREST, AND FEES FOR UNAFFECTED ITEMS ARE EXCLUDED. THE APPLICABLE AMOUNTS ARE COMBINED ONLY FOR DISTINCT AFFECTED ITEMS WITHOUT DOUBLE COUNTING. A FREE COMPONENT OF A PAID PRODUCT IS NOT TREATED AS A SEPARATE NO-CHARGE PRODUCT TO REDUCE THE PAID PRODUCT'S CAP.

21.5. Confidentiality, data protection, and negotiated exceptions. THE GENERAL CAP IN SECTION 21.4 ALSO APPLIES TO BREACHES OF EXPRESS CONFIDENTIALITY, DATA-SECURITY, OR DATA-PROTECTION OBLIGATIONS UNDER THIS AGREEMENT OR AN APPLICABLE BAA OR DPA, INCLUDING COSTS UNDER SECTION 21.3, WILL NOT EXCEED TWO (2) TIMES THE GENERAL CAP, UNLESS AN AUTHORIZED WRITTEN AGREEMENT EXPRESSLY IDENTIFIES THE CLAIMS AND STATES A DIFFERENT CAP OR UNCAPPED LIABILITY. NO AUTOMATIC MULTIPLIER OR SEPARATE DATA-PROTECTION CAP APPLIES. A DIFFERENT EXPRESSLY AGREED CAP REPLACES, AND IS NOT ADDED TO, THE GENERAL CAP FOR THE CLAIMS IT COVERS. RECOVERIES UNDER A LOWER CAP COUNT TOWARD ANY APPLICABLE HIGHER AGGREGATE LIMIT, AND CLAIMS SUBJECT TO THE LOWER CAP REMAIN SUBJECT TO THAT SUBLIMIT. A BAA'S OR DPA'S MANDATORY PROCESSING DUTIES REMAIN IN FORCE REGARDLESS OF THE MONETARY CAP; NO SILENT CAP IS INFERRED TO OVERRIDE A CONTROLLING DOCUMENT THAT EXPRESSLY PROVIDES OTHERWISE.

21.6. Aggregation; Customer obligations. The cap applies in the aggregate, not separately to each Medeia Protected Party, Customer affiliate, Authorized User, patient record, device, claim, claimant, legal theory, or proceeding. Claims involving the same affected item share one aggregate limit, and claims arising from the same or related events are treated as one claim dated at the earliest event; a renewal, amendment, additional claimant, or later-discovered consequence of those events does not reset the cap. Multiple Sales Orders for the same entitlement or loss do not create additional limits. No cap or exclusion expressed to protect Medeia limits Customer's payment obligations, Customer's obligations under Section 23, or Medeia's remedies for Customer's infringement or misappropriation of Medeia intellectual property or breach of confidentiality. Any separate written Medeia indemnity follows its express allocation and, if silent, is subject to the applicable cap and exclusions in this Section to the extent lawful.

21.7. Express remedies; no double recovery. The caps do not reduce an express obligation to provide a refund, credit, repair, replacement, or reperformance required by this Agreement or an applicable Sales Order. Such remedies do not create additional damages entitlements, and amounts or benefits provided for a loss will be credited against any other recovery for the same loss. Any legally permitted contractual attorneys' fee, investigation-cost, or expense award against a Medeia Protected Party counts toward the applicable cap unless mandatory law or an express negotiated deviation requires otherwise. A party may seek appropriate nonmonetary relief subject to applicable law. These commercial limits do not reduce either party's duty to comply with applicable law.

21.8. Independent allocation of risk. THESE EXCLUSIONS AND CAPS APPLY TO CONTRACT, WARRANTY, TORT (INCLUDING A Medeia PROTECTED PARTY'S ORDINARY NEGLIGENCE), STRICT LIABILITY, STATUTORY, RESTITUTION, AND OTHER CLAIMS TO THE EXTENT LAWFUL. EACH EXCLUSION AND CAP IS AN INDEPENDENT ALLOCATION OF RISK AND APPLIES EVEN IF ANOTHER PROVISION IS UNENFORCEABLE OR A LIMITED REMEDY FAILS OF ITS ESSENTIAL PURPOSE, EXCEPT WHERE APPLICABLE LAW REQUIRES OTHERWISE. IF, DESPITE SECTION 21.2, DAMAGES SOLELY FOR LOST PROFITS, LOST DATA, OR BUSINESS INTERRUPTION ARE LEGALLY RECOVERABLE BUT MAY LAWFULLY BE CAPPED, THOSE DAMAGES ARE SUBJECT TO THE LESSER OF US$100 IN THE AGGREGATE AND THE OTHERWISE APPLICABLE CAP. THAT FALLBACK DOES NOT APPLY TO THE DIRECT COSTS IN SECTION 21.3, AN EXPRESS REMEDY UNDER SECTION 21.7, OR LIABILITY PRESERVED BY SECTION 21.1. IT DOES NOT CREATE A RIGHT TO RECOVER AN OTHERWISE EXCLUDED LOSS. THE PARTIES ACKNOWLEDGE THAT THE PRICING AND SCOPE OF THE PRODUCT REFLECT THESE RISK ALLOCATIONS.

22. Disclaimer of Warranties

EXCEPT FOR AN EXPRESS LIMITED WARRANTY, SERVICE LEVEL, OR OTHER WRITTEN WARRANTY IN THIS AGREEMENT, A VALIDLY AGREED SALES ORDER, OR PRODUCT-SPECIFIC DOCUMENTATION, AND TO THE MAXIMUM EXTENT PERMITTED BY LAW, THE PRODUCT, SOFTWARE, AND SERVICES ARE PROVIDED "AS IS" AND "AS AVAILABLE," WITH ALL FAULTS. Medeia DISCLAIMS IMPLIED WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, AND NON-INFRINGEMENT, AND WARRANTIES ARISING FROM COURSE OF DEALING, USAGE OF TRADE, OR COURSE OF PERFORMANCE, TO THE EXTENT LAWFULLY DISCLAIMABLE. Medeia DOES NOT GUARANTEE UNINTERRUPTED ACCESS, CORRECTION OF EVERY ERROR OR VULNERABILITY, IMMUNITY FROM ATTACKS, MALWARE, INTERFERENCE, UNAUTHORIZED ACCESS, OR DATA LOSS, OR ANY PARTICULAR CLINICAL, FINANCIAL, OR RESEARCH RESULT. THESE DISCLAIMERS DO NOT NEGATE EXPRESS SPECIFICATIONS OR REGULATORY LABELING, Medeia's AUTHORITY TO GRANT THE LICENSE, A MANDATORY DUTY UNDER SECTION 15, OR RIGHTS PRESERVED BY SECTIONS 20.1, 20.2, AND 21.1.

You are responsible for securing systems under your control, protecting credentials, maintaining appropriate backups, and using the Product in accordance with instructions, applicable law, and your organization's policies. Customer's purchase is not contingent on an uncommitted roadmap, future feature, projected reimbursement, or informal statement. No distributor, salesperson, or support representative may create an additional commitment except through the authorized written process in Section 1. Nothing in this paragraph waives liability for fraud or another nonwaivable claim.

23. Waiver and Indemnity

23.1. Customer indemnity. TO THE MAXIMUM EXTENT PERMITTED BY LAW, CUSTOMER WILL DEFEND, INDEMNIFY, AND HOLD HARMLESS THE Medeia PROTECTED PARTIES FROM THIRD-PARTY CLAIMS, DEMANDS, ACTIONS, AND PROCEEDINGS, INCLUDING PATIENT, EMPLOYEE, PAYER, AND GOVERNMENTAL CLAIMS, AND RESULTING DAMAGES, LOSSES, LIABILITIES, JUDGMENTS, LAWFULLY INDEMNIFIABLE PENALTIES, SETTLEMENTS PERMITTED UNDER THIS SECTION, REASONABLE DEFENSE COSTS, AND REASONABLE ATTORNEYS' AND EXPERTS' FEES, TO THE EXTENT ARISING OUT OF OR CAUSED BY: (A) CUSTOMER'S OR ITS AUTHORIZED USERS' OR CONTRACTORS' BREACH OF THIS AGREEMENT; (B) THEIR CLINICAL, DIAGNOSTIC, TREATMENT, RESEARCH, BILLING, CODING, REIMBURSEMENT, OR OTHER PROFESSIONAL ACTS OR OMISSIONS IN CONNECTION WITH THE PRODUCT; (C) THEIR UNLAWFUL, NEGLIGENT, MISLEADING, OR UNAUTHORIZED OR IMPROPER USE, REPRESENTATION, PROMOTION, RESALE, MODIFICATION, OR COMBINATION OF THE PRODUCT; (D) THEIR FAILURE TO OBTAIN REQUIRED CREDENTIALS, CONSENTS, AUTHORIZATIONS, APPROVALS, OR RIGHTS IN CUSTOMER DATA OR OTHER MATERIALS; (E) THEIR INFRINGEMENT, MISAPPROPRIATION, OR VIOLATION OF THIRD-PARTY RIGHTS; OR (F) A SECURITY INCIDENT OR UNAUTHORIZED ACCESS CAUSED BY THEIR FAILURE TO PROTECT SYSTEMS OR CREDENTIALS UNDER THEIR CONTROL OR COMPLY WITH THEIR EXPRESS SECURITY AND SAFETY OBLIGATIONS. THIS OBLIGATION IS SUBJECT TO THE ALLOCATION AND EXCEPTIONS IN SECTION 23.2 AND THE DEFENSE PROCEDURES BELOW.

23.2. Proportionate allocation; no indemnity for Medeia's own fault. THIS INDEMNITY DOES NOT REQUIRE CUSTOMER TO INDEMNIFY A Medeia PROTECTED PARTY FOR THE PORTION OF A LOSS CAUSED BY THAT PARTY'S OWN NEGLIGENCE, FRAUD, WILLFUL MISCONDUCT, BREACH OF THIS AGREEMENT, OR A PRODUCT DEFECT FOR WHICH THAT PARTY IS LEGALLY RESPONSIBLE, OR FOR LIABILITY THAT CANNOT LAWFULLY BE SHIFTED. WHERE BOTH CUSTOMER-SIDE CONDUCT AND Medeia-SIDE CONDUCT CONTRIBUTE TO A CLAIM, CUSTOMER REMAINS RESPONSIBLE FOR THE PORTION ATTRIBUTABLE TO THE MATTERS IN SECTION 23.1. NAMING A Medeia PROTECTED PARTY AS A CO-DEFENDANT, OR ALLEGING ITS FAULT, DOES NOT ALONE ELIMINATE CUSTOMER'S OBLIGATIONS FOR THE CUSTOMER-ATTRIBUTABLE PORTION. THIS IS A PROPORTIONATE CONTRACTUAL INDEMNITY.

23.3. Notice and defense. Medeia will promptly notify Customer of a claim for which indemnity is sought; delay relieves Customer only to the extent materially prejudiced. Upon tender of a claim whose allegations, if established, would fall within Section 23.1, Customer will promptly undertake the defense of the covered matters, at its expense, using qualified counsel reasonably acceptable to Medeia. Customer will confirm its defense arrangements within ten (10) Business Days after tender, or sooner as reasonably necessary to meet a legal deadline. The defense obligation for potentially covered matters is not postponed until a final determination of liability. Medeia will reasonably cooperate at Customer's expense, subject to privilege, confidentiality, PHI protections, and applicable law, and may participate through its own counsel at its own expense except as provided below.

23.4. Mixed claims; conflicts; failure to defend. For mixed covered and uncovered matters, the parties will reasonably allocate defense work and costs based on the matters asserted and known facts, subject to final adjustment by agreement or adjudication so that Customer does not ultimately bear costs attributable to excluded Medeia-side liability. If a material conflict of interest prevents joint representation, the covered claim seeks material nonmonetary relief affecting Medeia or its intellectual property, a regulator requires separate representation, or Customer fails timely to undertake and diligently conduct the defense, Medeia may control the affected defense with reasonably selected separate counsel and recover reasonable, documented costs attributable to covered matters. Medeia may take reasonably necessary emergency protective steps before Customer assumes the defense. Neither party must surrender a privilege, a legally required regulatory response, or control of its own license, professional practice, or statutory duties.

23.5. Settlement controls. Customer may not settle a claim without Medeia's prior written consent unless the settlement provides each affected Medeia Protected Party an unconditional release, requires only money fully paid by Customer, includes no admission of fault or unlawful conduct by a Medeia Protected Party, and imposes no injunction, operational restriction, license, data-use obligation, or other nonmonetary requirement on it. Consent will not be unreasonably withheld, conditioned, or delayed for a settlement meeting those protections. Medeia will not charge Customer for a settlement without Customer's prior written consent, not unreasonably withheld, conditioned, or delayed, except that after Customer fails to meet its defense obligations and receives reasonable notice and an opportunity to respond, Medeia may enter a reasonable good-faith settlement of a potentially covered claim. Recovery remains subject to proof of the claim's coverage, the settlement's reasonableness, and the proportionate allocation in Section 23.2. Neither party may agree to an unlawful payment or prevent a legally required report.

24. Changing or Discontinuing the Product and Software

Medeia may modify, replace, suspend, or discontinue all or part of the Product, subject to the protections in this Agreement. For a planned material change to a paid Product or Service, Medeia will provide notice where reasonably practicable. Shorter notice is permitted where reasonably necessary for law, safety, security, regulatory compliance, or circumstances outside Medeia's reasonable control, with notice as soon as practicable. During a committed paid service term, Medeia will not materially reduce core paid functionality identified in the Sales Order except where reasonably necessary for those purposes or where a substantially equivalent alternative is provided.

If Medeia permanently discontinues an affected prepaid Service or materially reduces its core paid functionality during the committed product life period term, paid service term without a substantially equivalent alternative, Customer may terminate the affected Service and receive a pro rata refund of unused prepaid fees. For a material reduction that can be remedied, Medeia first has thirty (30) days after Customer's written notice to restore the functionality or provide the equivalent alternative, unless immediate termination is required by law. The refund right also applies to a permanent discontinuation required for safety, security, law, or regulatory compliance, but not to a suspension or termination properly caused by Customer's breach or undisputed nonpayment. A prolonged force-majeure interruption is addressed in Section 30.

Customer will not owe future recurring fees for a Service terminated under this section. The refund covers only the unused portion of fees attributable to the affected Service, calculated pro rata over the relevant prepaid period; a credit may be substituted only with Customer's agreement. Section 33 governs payment of refunds. This section does not promise continued use contrary to law or safety instructions, grant a new hardware or perpetual-license refund beyond an express warranty or Sales Order, or remove accrued remedies for a separate breach. Sections 12 and 15 continue to govern records and transition. For a change or discontinuation expressly permitted by this Section, the affected-Service termination and pro rata refund are Customer's exclusive contractual remedies for that permitted change itself, without limiting mandatory rights or remedies for a separate breach. No indefinite "product life" service commitment is implied.

25. No Medical Advice - Website and General Information

General information on Medeia/NeuroTrace websites, marketing materials, educational pages, blogs, or non-device informational resources is provided for general informational and educational purposes and is not, by itself, individualized medical advice, diagnosis, or treatment. Such content does not replace consultation with a qualified healthcare professional.

This section does not change the intended use, indications, contraindications, warnings, precautions, or clinical functionality of a regulated Product as stated in its labeling and instructions for use. Product outputs must be used and interpreted by authorized users in accordance with those materials and independent professional judgment.

Medeia does not endorse third-party clinicians, products, procedures, opinions, or services merely because they are mentioned or linked from a website.

26. Availability of the Product

The Product or a feature may not be available in all languages, countries, regions, healthcare settings, or configurations. You are responsible for ensuring that your access and use comply with local law, regulatory requirements, professional rules, and Product labeling.

27. Limitations on Use

You may use the Product only for purposes permitted by this Agreement, the applicable Sales Order, Product labeling and Documentation, and applicable law. You may not use the Product in a manner that creates a material safety or security risk, violates another person's rights, or exceeds the scope of your license or professional authorization.

28. Billing and Coding Reference Guide Disclaimer

Providers, not Medeia, are solely responsible for compliance with Medicare, Medicaid, commercial payer, and other third-party payer requirements, including coding, documentation, coverage, medical necessity, and claim submission. Before submitting claims, providers should confirm current payer-specific requirements and coverage policies.

Any reimbursement, billing, coding, or coverage information that Medeia provides is general reference information only and is not legal, billing, coding, or reimbursement advice. Third-party source information and payer rules can change without notice, and information may become outdated after publication. Medeia does not promise or guarantee coverage, coding acceptance, or payment and disclaims responsibility, to the extent permitted by law, for actions taken in reliance on general reimbursement information. Customer may not represent that Medeia guarantees reimbursement, approves a particular claim, or has assumed Customer's payer-compliance obligations. Customer will not submit a claim it knows to be false or misleading.

29. Confidential Information

Each party (the "Receiving Party") may receive nonpublic business, technical, clinical, financial, customer, product, security, or other information of the other party (the "Disclosing Party") that is identified as confidential or that a reasonable person would understand to be confidential given its nature and the circumstances ("Confidential Information"). Confidential Information may include source code, trade secrets, inventions, patent materials, algorithms, know-how, processes, designs, interfaces, databases, security information, product plans, pricing, forecasts, customer and supplier information, and nonpublic business strategies. Customer Data is Customer's Confidential Information, subject to the permitted de-identified-data uses in Section 15; PHI and other personal data are also subject to the applicable BAA, DPA, and law.

The Receiving Party will: (a) protect Confidential Information using at least reasonable care and no less than the care it uses for similar information of its own; (b) use Confidential Information only as necessary to exercise rights or perform obligations under the parties' agreements; and (c) disclose Confidential Information only to personnel, affiliates, professional advisers, contractors, or subprocessors who have a need to know and are bound by confidentiality obligations appropriate to the information. The Receiving Party remains responsible for disclosures by recipients it authorizes to the extent required by its contractual obligations and applicable law. Customer will promptly notify Medeia of any known unauthorized use or disclosure of Medeia's Confidential Information and reasonably cooperate in containment and recovery. No residual-memory, implied-license, or general-knowledge exception permits use or disclosure of Medeia's trade secrets or other Confidential Information; lawful independent development and the express exclusions below remain available. Security or privacy incidents involving Customer Data remain governed by Section 15 and any DPA.

Confidential Information does not include information that the Receiving Party can document: (i) is or becomes public through no breach by the Receiving Party; (ii) was lawfully known without confidentiality restriction before disclosure; (iii) is lawfully received from a third party without breach of duty; (iv) is independently developed without use of the Disclosing Party's Confidential Information; or (v) is released from confidentiality by the Disclosing Party in writing.

A Receiving Party may disclose Confidential Information to the extent required by law, subpoena, court order, or governmental demand, provided that, where legally permitted, it gives prompt notice and reasonable assistance so the Disclosing Party may seek confidential treatment or other protection. The Receiving Party will disclose only the portion legally required.

Return and destruction. Upon written request or termination, the Receiving Party will return or securely destroy the Disclosing Party's Confidential Information as reasonably practicable, subject to legally required retention, permitted archival copies, secure backup cycles, and the applicable BAA, DPA, and Customer Data provisions. Retained information remains protected and may be used only for the permitted retention purpose. A party may retain a copy of contractual and compliance records reasonably required to establish or defend its rights, to the extent permitted by applicable data-protection obligations.

Duration and relief. Confidentiality obligations survive for as long as the information remains Confidential Information under this section; trade secrets remain protected while they qualify as trade secrets. PHI and personal data remain protected for the period required by the applicable BAA, DPA, and law. Unauthorized use or disclosure may cause harm not adequately remedied by money damages, and the Disclosing Party may seek appropriate injunctive or equitable relief, subject to applicable law and available defenses.

30. Miscellaneous

Entire Agreement. This Agreement, together with applicable Sales Orders, BAAs, DPAs, expressly agreed service-level or security addenda, product-specific licenses, and specifically incorporated policies, constitutes the agreement between the parties concerning the Product and supersedes prior agreements on the same subject to the extent of a conflict, subject to Section 1.

Severability. If any provision is held invalid or unenforceable, it will be enforced to the maximum extent permitted and the remaining provisions will remain in effect.

No Waiver. Failure to enforce a provision is not a waiver of that provision or any other provision. A waiver must be specific, in writing, and authorized by the party granting it. An agreed extension, isolated accommodation, partial enforcement, or acceptance of a late payment does not waive future compliance.

Force Majeure. Neither party is responsible for delay or failure caused by events beyond its reasonable control, provided it gives prompt notice where practicable, uses reasonable efforts to mitigate the effects, and resumes performance promptly. Force majeure does not excuse payment obligations for Products already delivered or Services already performed and does not limit obligations that applicable law makes nonwaivable. If a force-majeure event prevents material performance of an affected prepaid Service for more than sixty (60) consecutive days, either party may terminate that Service on written notice. Medeia will refund unused prepaid fees attributable to the unprovided Service, including the unprovided portion of the interruption, and no future recurring fees for that terminated Service will be due, without duplicate recovery.

Assignment. You may not assign or transfer this Agreement or a Product license without Medeia's prior written consent, except where a Sales Order or applicable law permits. Medeia may assign this Agreement in connection with a merger, reorganization, sale of substantially all relevant assets, or by operation of law, subject to applicable privacy, regulatory, and contractual obligations. A permitted assignee must assume the applicable contractual obligations; assignment does not reduce the protections for Customer Data or eliminate obligations accrued before the transfer. Customer may not use an assignment, merger, change of control, asset transfer, or affiliate reorganization to transfer a license to another entity or enlarge its scope without the consent required by this paragraph. A prohibited transfer is ineffective to the extent permitted by law. Medeia's consent does not release accrued Customer obligations unless expressly agreed.

No Third-Party Beneficiaries. Except for the Medeia Protected Parties, who may enforce Sections 19(h), 21, and 23 as applicable, and licensors where expressly stated, this Agreement does not create third-party beneficiary rights.

Independent Contractors. The parties are independent contractors. This Agreement does not create a partnership, joint venture, employment, fiduciary, franchise, or agency relationship, and neither party may bind the other except as expressly authorized.

Amendments and Interpretation. Except as expressly permitted by Section 14, amendments must be signed or affirmatively electronically accepted by authorized representatives of both parties. Headings and section numbers are for convenience and do not alter the operative text. "Including" means "including without limitation." An agreed Order or amendment may be executed in counterparts and by electronic signature to the extent permitted by law.

Protection and enforcement. Subject to Section 31 and applicable law, Medeia may seek appropriate injunctive or other equitable relief for actual or threatened infringement, license circumvention, or unauthorized use or disclosure of its Confidential Information. Nothing eliminates the court's required findings or any legally required security or bond. To the extent Medeia prevails in enforcing Customer's payment, license-scope, intellectual-property, or confidentiality obligations, Customer will reimburse reasonable, documented enforcement costs and attorneys' fees to the extent permitted by law, without double recovery. Contractual remedies are cumulative except where this Agreement expressly makes a remedy exclusive.

31. Governing Law; Venue; Mandatory Rights

Except where applicable law requires otherwise, this Agreement and transactions under it are governed by the laws of the State of Texas, without regard to conflict-of-law rules. Subject to mandatory law and the public-institution exception above, the parties agree to exclusive jurisdiction and venue in state or federal courts located in Texas for disputes arising out of or relating to this Agreement or the Product. The parties consent to personal jurisdiction in those courts and waive objections based solely on inconvenient forum to the extent legally permitted.

Nothing in this section limits mandatory consumer, warranty, medical-device, privacy, healthcare, public-entity, or other statutory rights that cannot lawfully be waived or displaced by contract.

32. Notices; Legal Process

Operational notices. Medeia may provide routine operational notices by email to the address associated with Customer's account, by in-Product notice, or by another agreed method. Material changes, renewal-price changes, suspension for nonpayment, termination, breach notices, and other formal legal notices must be sent directly in writing under the following paragraph and may not rely solely on website posting. Each party is responsible for maintaining accurate notice information.

Formal legal notices. Either party may give formal notice by personal delivery, a recognized courier with delivery confirmation, or email with acknowledgment of receipt other than an automatic reply. Notices to Medeia must be addressed to Medeia Inc, Attn: Legal, at the postal address or email in Section 45. Notices to Customer must be sent to the legal or administrative contact in the Sales Order or account records. Notice is effective on documented delivery or acknowledged email receipt, subject to mandatory law. A party may update its notice details by notice under this section. Incident and safety reports must also follow the designated channels and deadlines in the applicable BAA, DPA, Documentation, and law. Notices of safety events and privacy/security incidents remain subject to their separate delivery and timing rules, including Section 15.14. This section does not authorize service of a summons or other judicial process by a method that applicable procedural law does not permit.

Medeia may preserve or disclose account, registration, transaction, security, or other information where required by law, legal process, regulatory obligation, or a valid governmental request, or where otherwise permitted by applicable law to protect rights, safety, security, or the integrity of the Product. Any disclosure of PHI is also subject to the applicable BAA and HIPAA where applicable. Processing or disclosure of other Customer Data remains subject to the applicable DPA, confidentiality obligations, and law. Where legally permitted, Medeia will give Customer notice of a demand for its Confidential Information and disclose only what is legally required or otherwise specifically permitted.

33. Cancellations and Refunds

Fees and charges are nonrefundable except as expressly provided in a Sales Order, this Agreement (including warranty, termination-for-breach, material-change, discontinuation, and prolonged-interruption remedies), an identified applicable return policy, or applicable law. A general nonrefundability provision does not override an express refund right.

If a Sales Order provides a cancellation right, trial period, return window, restocking fee, or subscription-renewal rule, it controls for the applicable purchase subject to mandatory law and the minimum warranty periods. The Sales Order must state the subscription term, any automatic-renewal period, the cancellation deadline and method, and any trial-to-paid conversion. Unless automatic renewal is expressly agreed in the Sales Order or a separately accepted subscription authorization, a subscription expires at the end of its stated term and does not automatically renew.

Approved refunds will be made to the original payer using the original payment method where reasonably practicable, within sixty (60) days after the refund entitlement and amount are established and any expressly required hardware return is completed, or sooner if law requires. Applicable tax adjustments will be made as required by law. For a purchase through an authorized distributor, Medeia may arrange the refund through that distributor but remains responsible for an express refund obligation it undertakes in this Agreement. A credit may replace a required refund only with Customer's agreement.

34. User Profiles and Account Security

If the Product requires a user profile or account, you are responsible for maintaining the confidentiality of credentials and for activity under your account to the extent within your control. Do not share individual credentials. Notify Medeia promptly of suspected unauthorized access or a security incident involving the Product. Customer is responsible for its Authorized Users' and contractors' use of the Product on its behalf and their compliance with this Agreement as if their acts and omissions were Customer's own, except to the extent caused by Medeia's breach. Customer is not made strictly liable for an unrelated attacker's conduct merely because an account was targeted. Customer will use reasonable account safeguards, including multifactor authentication where available and appropriate, and promptly revoke access when no longer required. Customer will maintain current role-based access permissions, promptly disable departing users, and not knowingly permit shared individual credentials or unauthorized administrative access.

You must provide accurate, current, and complete registration and billing information and keep it updated. Medeia may suspend or terminate an account where materially inaccurate information, unauthorized use, security concerns, nonpayment, or legal requirements justify doing so. Any suspension or termination under this section is subject to the notice, proportionality, cure, and data-access requirements in Section 13.

Accounts and licenses are nontransferable except as expressly permitted. An organization may replace its authorized account administrator on reasonable verification of authority without transferring the organization's license to a different Customer. If an individual Customer dies or becomes unable to administer the account, Medeia may require appropriate legal documentation before closing, transferring, preserving, or deleting the account or content, subject to applicable law, organizational ownership rights, record-retention duties, and the applicable BAA, DPA, and Privacy Policy.

35. Additional Terms of Use

Particular Product components, integrations, datasets, third-party services, or features may be subject to additional license terms, usage rules, BAAs, data-processing terms, or third-party terms. Where acceptance of those terms is required for the feature, you must accept them before using that feature. Additional terms must be made available before acceptance and are subject to the order of precedence and Section 14; feature-specific terms do not silently amend unrelated existing commitments or expand the permitted use of PHI or Customer Data.

36. No Conveyance; No Resale

Nothing in this Agreement conveys ownership of the Software, Product intellectual property, trademarks, or nonpublic technology. You may not reproduce, duplicate, rent, sell, resell, sublicense, trade, or distribute Software or Product access rights except as expressly authorized by a Sales Order, Medeia in writing, or applicable law. Transfer of lawfully owned hardware is distinct from transfer of a Software license, account, support entitlement, or contractual warranty and remains subject to applicable regulatory, safety, and privacy obligations. Before transferring a regulated Product, Customer will notify Medeia so that licensing, safety contacts, service records, and any legally required device tracking can be addressed. These restrictions do not prohibit authorized fee-paid clinical or professional use under Section 10, or transfers that applicable law does not permit the parties to restrict.

37. Privacy Policy

Medeia will process personal information in accordance with its applicable Privacy Policy and applicable law. The Privacy Policy describes categories of information collected, purposes of processing, disclosures, retention, rights, transfers, and contact information as applicable to the relevant Product and user. The applicable notice will be provided or identified before the relevant personal information is collected. Customer may request a copy through Section 45. A general Privacy Policy does not amend the BAA, DPA, Customer Data permissions, or agreed commercial terms.

To the extent the Product processes PHI on behalf of a covered entity or business associate, the applicable BAA-not a general Privacy Policy-governs uses and disclosures of PHI for the contracted services where HIPAA requires it.

Privacy notices and settings may vary by Product and jurisdiction. A statement about a particular legal role (for example, controller, joint controller, processor, covered entity, or business associate) applies only where the facts and applicable law support that role.

38. Location-Based Features

Some Product features may use device-based location information if the feature is offered, enabled, and permitted by the user or Customer configuration. Depending on the feature and device, location information may be derived from GPS, Wi-Fi, network, IP address, or other signals. Any collection and use of location information is subject to the applicable Privacy Policy, permissions, Product configuration, and law.

Where supported, you may control location permissions through device, operating-system, browser, or Product settings. Disabling location may affect features that require it.

Unless a Product is specifically labeled and authorized for a location-dependent safety function, location data is not intended to be relied upon where inaccurate, delayed, or incomplete location information could cause death, personal injury, property damage, or environmental harm.

39. Content and Your Conduct

If the Product allows you to upload, transmit, store, or share content or data, you may not use those features to: (a) forge headers or source information to mislead recipients; (b) transmit malware, malicious code, or files designed to disrupt systems; (c) interfere with or disrupt the Product, servers, networks, security controls, or authorized monitoring; (d) engage in unlawful activity; or (e) unlawfully collect, store, use, or disclose personal information about another person.

You are responsible for content and data you submit and for having the rights, permissions, and legal basis necessary to use that content with the Product. These responsibilities do not expand Medeia's rights to process Customer Data beyond Sections 12 and 15.

40. Removal or Restriction of Content

Where the Product supports user-submitted content, Medeia may restrict, quarantine, remove, or disable access to content when reasonably necessary to address a violation of this Agreement, law, security risk, infringement claim, regulatory requirement, or technical harm. Medeia is not obligated to pre-screen user content unless applicable law or a Sales Order requires it. Restrictions will be proportionate to the issue and notified to Customer where lawful and practicable. Required clinical records, evidence, and Customer Data will be handled under Sections 12 and 15; a content restriction does not authorize unlawful destruction or withholding of PHI.

41. Back Up Your Content

You are responsible for maintaining backups of important documents, images, records, configurations, and other content stored on or accessed through the Product, except to the extent a Sales Order expressly includes backup or retention services. Medeia does not guarantee that content will never be damaged, corrupted, deleted, or lost. This allocation does not reduce backup, availability, restoration, or retention duties expressly undertaken by Medeia in a BAA, DPA, Sales Order, or security addendum, or imposed by law. Access, export, and deletion remain subject to Section 12.

42. General Warranty Provisions

No reseller, distributor, agent, or employee may modify, extend, or add to the limited warranty unless Medeia expressly authorizes the change in a signed writing or a product-specific warranty document. An authorized extension may not shorten the minimum warranty periods or waive mandatory rights.

If a warranty term is held illegal or unenforceable, the remaining warranty terms remain effective. Mandatory law in the place of purchase or use may provide additional rights that this Agreement does not limit.

43. Electronic Contracting

The Product may allow you to accept agreements, place orders, approve transactions, receive notices, or otherwise act electronically. To the extent permitted by law, your electronic submissions and affirmative electronic actions constitute your agreement and intent to be bound by the applicable transaction and records. Medeia will make the applicable terms available before acceptance and retain records reasonably sufficient to identify the accepted version, transaction, accepting account or representative, and acceptance date. Either party may request a copy of the relevant agreement record, subject to lawful confidentiality and security restrictions.

You are responsible for maintaining hardware, software, network access, and an email address or other means reasonably necessary to access and retain electronic records, unless applicable law requires Medeia to provide another method.

44. Customer Insurance

During its use of the Product, is recommended Customer to maintain insurance with reputable insurers authorized to provide the coverage, appropriate to its activities and sufficient to support its obligations, including commercial general liability; professional or medical-malpractice liability for clinical or professional use; and cyber/privacy liability where Customer processes patient or other regulated personal data.

45. Contact Information

Medeia Inc
7 W. Figueroa Street, Suite 215
Santa Barbara, CA 93101, USA
Technical Support: +1 800 433 4609
General information: info@Medeia.com
NeuroTrace information/support: info@neurotrace.com

• About us
• Become Our Distributor
• Contact us