Institutional License Agreement

Effective Date: 2026-05-18 Version: 1.0

This Institutional License Agreement ("Agreement") governs the licensing of AIClinica to a residency program, medical school, hospital, or other institution ("Institution"). It supplements (and where it conflicts, supersedes) the Terms of Service for institutional usage.

Summary: A signed order form + this Agreement bind the Institution. NET-30 payment, 99.9% uptime target, 4-hour incident-notification SLA, breach-notification 72 hours, no data sales, audit rights on reasonable notice. Bespoke contracts may modify these defaults.

1. Parties

• AIClinica: AIClinica, Inc., a Delaware corporation ("AIClinica", "we", "us")
• Institution: the entity that signs the order form referencing this Agreement
• Authorized Users: the named individuals (faculty, residents, students, fellows) the Institution provisions to access the Service

2. License grant

Subject to payment of fees and compliance with this Agreement, AIClinica grants the Institution a non-exclusive, non-transferable, non-sublicensable, revocable license to permit Authorized Users to access and use the Service for the term and within the seat counts specified on the order form.

2.1 Seat counts

The order form specifies the number of seats. A "seat" is one Authorized User account.

• Seats may be reassigned between individuals not more than once every 30 days per seat (to prevent shared-account abuse).
• The Institution may add seats mid-term at the per-seat rate, pro-rated to the end of the current period.
• Unused seats do not roll over.

2.2 What's included by default

• Full access to all 12 specialty apps + Medical Student Tutor for each Authorized User
• Institution admin dashboard (/institutions/admin) with roster management, assignment tools, program-wide analytics
• Bulk code generation (INST-XXXX-XXXX) for invitee onboarding
• Standard support (see Section 8)

2.3 Optional add-ons (priced per order form)

• SSO via SAML 2.0 or OIDC
• Roster sync via SCIM or sFTP
• Custom branding (white-label CSS)
• Dedicated customer-success engineer
• On-premises hosted deployment (separate agreement)

3. Term and renewal

3.1 Initial term

Specified on the order form; minimum 12 months unless otherwise agreed.

3.2 Auto-renewal

This Agreement automatically renews for successive 12-month terms at the then-current rate unless either party gives written notice of non-renewal at least 60 days before the current term ends.

3.3 Price increases

We may increase the per-seat rate at renewal by no more than CPI + 5% without the Institution's express consent. Any larger increase requires a new order form.

3.4 Mid-term cancellation

The Institution may terminate mid-term only for cause under Section 11.2 (Institution's right to terminate) — no refund is owed for mere change of preference once seats are provisioned.

4. Fees and payment

4.1 Fees

As specified on the order form. Stated in USD unless otherwise agreed.

4.2 Payment terms

NET-30 from invoice date. Invoices are issued on the first business day of each billing cycle (or as specified on the order form).

4.3 Late payment

Past-due balances accrue interest at 1.5% per month (or the maximum allowed by law, whichever is lower). After 60 days past due, we may suspend access for all Authorized Users until the balance is paid.

4.4 Taxes

Fees exclude all taxes. The Institution is responsible for sales / use / VAT / GST taxes applicable in its jurisdiction. If we are required to collect such taxes, they will be added to the invoice.

4.5 Disputed invoices

The Institution must notify us in writing within 15 days of an invoice if any portion is disputed. The undisputed portion remains payable on the original schedule.

5. Service Level Agreement (SLA)

5.1 Uptime target

AIClinica targets 99.9% uptime measured monthly, excluding:

• Scheduled maintenance announced ≥48 hours in advance (capped at 4 hours per month)
• Force majeure events
• Failures caused by Institution-side network, browser, or device issues
• Failures caused by Authorized Users' misuse

5.2 Service credits

If uptime falls below 99.9% in any calendar month, the Institution is entitled to a service credit:

Credits must be requested in writing within 30 days of the affected month. Credits are the Institution's exclusive remedy for SLA failures.

5.3 Incident notification

We will notify the Institution's primary admin email of any P0 or P1 incident affecting >10% of seats within 4 hours of detection, with regular updates until resolution.

6. Data ownership, processing, and residency

6.1 Institution Data

"Institution Data" means all data submitted to or generated within the Service by Authorized Users of the Institution, including practice transcripts, scores, and analytics.

• The Institution retains ownership of Institution Data.
• AIClinica processes Institution Data solely to operate the Service, generate aggregated analytics, and improve the Service (de-identified). We do not sell Institution Data.
• The Institution grants AIClinica a license to use Institution Data only as needed to deliver the Service.

6.2 Data residency

Default storage: USA (Supabase). Where regulatory requirements demand alternate residency (e.g., EEA, UAE), we will discuss options under a separate written agreement. Cross-border transfers occur under Standard Contractual Clauses.

6.3 No PHI

The Service is not designed to handle Protected Health Information ("PHI") under HIPAA or equivalent regulations. The Institution agrees not to permit Authorized Users to submit real patient data and is responsible for training them accordingly. AIClinica is not a Business Associate under HIPAA absent a separately executed Business Associate Agreement ("BAA"). A BAA is available at additional cost for institutions that require it.

6.4 Data Processing Addendum

For institutions subject to GDPR, UK GDPR, or comparable regimes, a Data Processing Addendum ("DPA") is available on request. Signed DPAs override conflicting terms in this Agreement.

7. Security commitments

We maintain a written information security program including:

• TLS 1.2+ for all data in transit
• AES-256 at rest
• Row-level security enforced at the database layer
• MFA mandatory for all AIClinica staff with production access
• Annual third-party penetration tests (executive summary available under NDA)
• Quarterly internal security reviews
• Documented incident response procedures
• Background checks on all employees with production access

7.1 Breach notification

In the event of a confirmed personal-data breach affecting Institution Data, AIClinica will notify the Institution's designated security contact within 72 hours of confirmation, with:

• A summary of what is known about the breach
• Categories and approximate volume of records affected
• Mitigation steps taken
• Recommended next steps for the Institution

7.2 Sub-processors

Our current sub-processor list is in our Privacy Policy Section 4. We will provide 30 days' notice before adding a new sub-processor that materially changes the data flow; the Institution may terminate this Agreement without penalty if it reasonably objects.

8. Support

Business hours: 9:00 to 18:00 Eastern Time, Monday-Friday, excluding US federal holidays.

Institutions with custom support tiers (e.g., dedicated CSM, named-engineer support) are governed by the support exhibit on their order form.

9. Audit rights

On 30 days' written notice, no more than once per 12-month period, the Institution may engage an independent auditor (subject to a customary NDA) to verify our compliance with this Agreement, limited to:

• Security controls listed in Section 7
• Seat-count and usage records billed to the Institution
• Sub-processor list

Audits are conducted at the Institution's expense unless they uncover a material breach by AIClinica.

10. Confidentiality

Each party agrees to keep the other's Confidential Information confidential, use it only to perform under this Agreement, and apply the same protection it applies to its own confidential information (and not less than reasonable care). "Confidential Information" excludes information that:

• Is or becomes publicly available through no fault of the receiver
• Was lawfully known to the receiver before disclosure
• Is independently developed without use of the disclosing party's Confidential Information
• Is required to be disclosed by law (with prompt notice to the disclosing party where lawful)

This obligation survives for 5 years after termination of this Agreement.

11. Termination

11.1 For convenience

This Agreement may be terminated for convenience only at renewal under Section 3.2.

11.2 For cause

Either party may terminate immediately by written notice if the other party:

• Materially breaches this Agreement and fails to cure within 30 days of written notice
• Becomes insolvent or files for bankruptcy
• Ceases operations

11.3 Effect of termination

Upon termination:

• All Authorized User access is suspended within 5 business days
• The Institution may request, within 30 days of termination, a one-time export of Institution Data in CSV or JSON format
• Both parties return or destroy the other's Confidential Information at the other's choice
• All accrued payment obligations survive
• Sections by their nature intended to survive (IP, confidentiality, indemnification, limitations of liability, dispute resolution) survive

11.4 Refunds on termination

• If AIClinica terminates for cause (Section 11.2), the Institution receives a pro-rated refund of unused, paid-in-advance fees
• If the Institution terminates for cause, the same pro-rated refund applies
• If AIClinica terminates for the Institution's breach, no refund is owed

12. Warranties

12.1 Mutual

Each party warrants that it has the authority to enter this Agreement.

12.2 AIClinica

We warrant that the Service will perform materially as described in our published documentation. Our sole obligation for any breach of this warranty is to use commercially reasonable efforts to correct the non-conforming portion of the Service. If we cannot do so within 60 days, the Institution may terminate and receive a pro-rated refund of fees for the affected period.

12.3 Disclaimer

EXCEPT AS EXPRESSLY SET FORTH HERE, THE SERVICE IS PROVIDED "AS IS". WE DISCLAIM ALL OTHER WARRANTIES, EXPRESS OR IMPLIED, INCLUDING MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, AND NON-INFRINGEMENT. THE SERVICE IS NOT WARRANTED FOR ANY CLINICAL USE.

13. Indemnification

13.1 AIClinica indemnification

AIClinica will defend the Institution against any third-party claim alleging that the Service, as provided by AIClinica, infringes a US patent, copyright, or trademark, and will pay damages finally awarded by a court (or settlement agreed to by AIClinica). The Institution must promptly notify us of any such claim, give us sole control of the defense, and reasonably cooperate.

Excluded: claims arising from (a) Institution Data, (b) combination of the Service with anything not provided by AIClinica, (c) modifications to the Service not made by AIClinica, (d) use of the Service after notice to discontinue.

13.2 Institution indemnification

The Institution will defend AIClinica against any third-party claim arising from (i) Institution Data, (ii) breach of this Agreement by the Institution or its Authorized Users, (iii) clinical decisions or outcomes purportedly informed by the Service, and pay damages finally awarded.

14. Limitation of liability

Subject to Section 14.2 below:

• IN NO EVENT WILL EITHER PARTY BE LIABLE FOR ANY INDIRECT, INCIDENTAL, SPECIAL, CONSEQUENTIAL, OR PUNITIVE DAMAGES.
• EACH PARTY'S TOTAL CUMULATIVE LIABILITY ARISING OUT OF OR RELATING TO THIS AGREEMENT WILL NOT EXCEED THE FEES PAID BY THE INSTITUTION TO AIClinica IN THE 12 MONTHS PRECEDING THE EVENT.

14.1 Exceptions

The limitations in Section 14 do not apply to:

• Each party's indemnification obligations under Section 13
• Breach of confidentiality under Section 10
• The Institution's payment obligations
• Gross negligence or willful misconduct

15. Force majeure

Neither party is liable for delay or failure to perform due to events beyond its reasonable control, including acts of God, war, terrorism, pandemic, governmental order, or major internet outages. The affected party must give prompt notice and use reasonable efforts to mitigate.

16. Governing law and dispute resolution

This Agreement is governed by the laws of the State of Delaware, USA, without regard to conflict-of-law principles. Disputes are first subject to good-faith negotiation between authorized executives of each party (30 days). If unresolved, disputes are submitted to binding arbitration administered by JAMS under its Comprehensive Arbitration Rules, held in Wilmington, Delaware, in English, with three arbitrators (one selected by each party, the third by the two arbitrators). The arbitrators' decision is final.

Notwithstanding the above, either party may seek injunctive relief in any court of competent jurisdiction to protect IP or confidential information.

17. General provisions

17.1 Notices

Notices must be in writing, addressed to:

• AIClinica: legal@aiclinica.com (with copy to the named account executive)
• Institution: the address and email on the order form

Notices are effective on the next business day after sending by email or 3 business days after posting by registered mail.

17.2 Assignment

Neither party may assign this Agreement without the other's prior written consent, except that either party may assign to a successor in connection with a merger, acquisition, or sale of substantially all assets. Any unpermitted assignment is void.

17.3 Independent contractors

The parties are independent contractors. Nothing in this Agreement creates a partnership, joint venture, agency, or employment relationship.

17.4 No third-party beneficiaries

Authorized Users are not third-party beneficiaries of this Agreement.

17.5 Severability

If any provision is found unenforceable, the rest remain in effect.

17.6 No waiver

A waiver in one instance is not a waiver in any other.

17.7 Entire agreement

This Agreement, the executed order form, and any signed addenda (DPA, BAA, SOW) constitute the entire agreement between the parties for the institutional license, superseding all prior discussions.

17.8 Order of precedence

Where conflict exists: (1) executed addendum (DPA, BAA), (2) executed order form, (3) this Agreement, (4) general Terms of Service.

18. Contact