Terms and Agreements

1. Scope and contractual effect

These Terms and Third-Party Notices (“Terms”) are published by Rigel Networks LLC, a California limited liability company (“Rigel”). CLYNYX is a product brand of Rigel and is not a separate contracting entity. These Terms address permitted use of Rigel’s public website and set forth standard commercial provisions available for incorporation into a duly executed CLYNYX customer agreement.

Commercial deployment of CLYNYX requires a separately executed CLYNYX Customer License and Deployment Agreement or CLYNYX Technology Delivery Partner Agreement, together with the applicable order, schedules and BAA. The standard customer provisions on this page apply only if authorized representatives expressly incorporate this dated version into that signed commercial agreement. They do not independently replace the signed commercial agreement. A website visit, receipt or use of a link, or access to a customer deployment does not constitute execution of a customer agreement or BAA. These Terms do not require separate website acceptance by each employee. Any separate acceptance required by a third-party provider remains applicable.

An existing executed agreement remains controlling unless validly amended by the parties. Publication of a subsequent version does not automatically amend an existing customer’s agreement, fees, rights or obligations. Provisions concerning website use have contractual effect only to the extent validly agreed and enforceable under applicable law. Rigel’s statutory intellectual-property rights and other rights arising independently of contract do not depend upon contractual acceptance.

2. Website use and product information

Public website materials may be accessed and used for lawful evaluation of CLYNYX and ordinary business communications. Except as permitted by applicable law or license, users shall not reproduce or commercially exploit protected materials, remove proprietary notices, misrepresent an affiliation, circumvent access controls, introduce malicious code, interfere with website operation or access information without authorization. Rigel reserves its rights in its proprietary website materials and branding. Third-party names and marks remain the property of their respective owners.

Rigel may revise public website content and restrict unlawful or abusive website activity. Such action does not amend an executed customer agreement or authorize interference with lawful access to health information. Public interoperability documentation and certified application programming interfaces remain subject to their applicable access and use terms. Website restrictions do not supersede permitted security research, non-waivable interoperability rights, patient rights or rights conferred by third-party licenses.

Website content constitutes general product and business information and does not constitute medical, prescribing, legal or emergency-response advice. Communications with Rigel do not establish a clinician-patient relationship. Public contact links and ordinary email are not authorized channels for transmitting patient records or sensitive health information. Care and medical-record inquiries should be directed to the relevant healthcare organization. Emergencies require contact with 911 or the appropriate emergency service.

Product capabilities are subject to the purchased release, configuration, permissions, implementation and approved integrations. Descriptions of planned features, demonstrations or collaboration opportunities do not constitute commitments to deliver a feature or satisfy a delivery date. Binding specifications and service commitments must be included in the executed agreement. Certification is limited to the identified module, version and criteria described in the CLYNYX ONC Certification and Disclosures and does not establish certification of every configuration or integration. These Terms do not supersede those disclosures or the applicable certified-API terms.

Certification does not constitute governmental endorsement of Rigel or CLYNYX, certification of every deployment or optional integration, or a guarantee of payment, incentive eligibility, clinical results or customer compliance. The applicable certified module, version, criteria, relied-upon software and required disclosures are those identified in the official certification materials. Nothing in these Terms limits mandatory disclosures or authorizes removal or disabling of a required certified capability.

To the extent permitted by law, general public website content is provided “as is” and “as available,” without implied warranties of merchantability, fitness for a particular purpose or noninfringement, or any assurance of completeness or uninterrupted availability. This disclaimer does not supersede an express customer warranty, mandatory disclosure or non-waivable legal duty.

3. Customer agreement and priority of documents

For purposes of sections 3 through 20, “Customer” means the organization contracting with Rigel under the separately executed commercial agreement identified in section 1. “Healthcare Organization” means the identified end-user healthcare organization, which is Customer in a direct transaction and a separate organization in an authorized Technology Delivery Partner transaction. “Order” means an executed order, statement of work or deployment schedule under that commercial agreement. “Agreement” means the signed commercial agreement, its applicable Orders and expressly incorporated schedules, including this dated version of these Terms only where expressly incorporated. “Authorized Users” means personnel and other users authorized within the agreed deployment scope.

The Order shall identify the contracting parties, Healthcare Organization, direct or Technology Delivery Partner arrangement, software and modules, permitted organizations and facilities, authorized use, license term, fees, implementation and support scope, hosting operator and applicable schedules. The parties shall document their respective security, data-processing and transition responsibilities. No purchase order, Technology Delivery Partner invoice, marketing representation or unilateral website revision expands the rights or services Rigel has agreed to provide.

Mandatory law shall control. An applicable BAA and substance-use-records addendum prevail over conflicting provisions concerning protected health information (“PHI”) and records subject to 42 CFR Part 2. Third-party licenses govern their respective components and preserve independently granted rights. An Order may modify these commercial provisions only by expressly identifying the modification and bearing the signatures of authorized representatives of both parties. A separately executed master agreement prevails over conflicting provisions of these Terms unless the parties expressly agree otherwise.

4. Software license and permitted deployment

Subject to the Agreement, Rigel grants a direct Customer a limited, nonexclusive, nontransferable license, for the agreed term, to use the ordered CLYNYX software through Authorized Users for the identified Healthcare Organization’s lawful United States healthcare operations, within the agreed entity, facility and license limits. A Technology Delivery Partner receives only the deployment and downstream license rights expressly authorized under section 6. CLYNYX is licensed, not sold. The Order identifies the Base EHR license and each included additional module, together with the authorized organization, deployment, facilities, users and term. Additional modules require a valid Base EHR license and the applicable module entitlement unless expressly agreed otherwise. A license key implements the agreed entitlement; possession, installation, visibility or technical accessibility of a feature does not enlarge the license, confer ownership or establish a perpetual right. Keys may not be shared, transferred or used outside the authorized scope. Third-party permissions, professional credentials and approved data-processing arrangements remain separate prerequisites. Key replacement, expiration and enforcement remain subject to the Agreement’s notice, suspension, continuity and lawful record-access provisions. These controls do not authorize disabling a required certified capability contrary to applicable requirements.

No perpetual license, source-code delivery, source-code escrow, additional deployment, resale, sublicense or service-bureau right is granted unless expressly provided in the Order. Possession of an installation, payment for implementation or control of an Azure subscription does not confer such rights. Patient, clinician, contractor and interoperability access within the authorized implementation is permitted to the extent of the agreed scope and applicable law; the external status of an otherwise permitted user does not itself prohibit that access.

Except as expressly authorized or permitted by mandatory law or an applicable third-party license, Customer shall not copy the software except for its approved deployment and necessary authorized backup; modify the software or create derivative works; extract source code; reverse engineer, decompile or disassemble the software; circumvent license or access controls; remove proprietary notices; make the software available to an unidentified organization; or resell, sublicense or transfer it. These restrictions do not limit open-source rights, lawful interoperability, permitted security research or other activities protected by applicable law.

Customer shall maintain accurate records reasonably sufficient to substantiate the agreed organizations, deployments and license scope. Upon a reasonable, specific request supported by Rigel’s good-faith basis to investigate a material license discrepancy, Customer shall provide relevant evidence that does not contain PHI. This provision does not authorize covert monitoring, unrestricted access to a customer environment, access to patient records or interference with clinical operations.

5. Ownership and customer information

Rigel retains ownership of its proprietary CLYNYX source code, object code, documentation, pre-existing technology, improvements and related intellectual property, except to the extent expressly assigned by a separate writing signed by Rigel. Payment for implementation, configuration or customer-funded work does not itself transfer ownership. The statement of work shall expressly allocate any bespoke deliverables and distinguish pre-existing materials. No additional source-code right or ownership transfer arises by implication.

The foregoing reservation excludes third-party components, independently owned customer materials and Customer Data. “Customer Data” means information supplied by or on behalf of the Healthcare Organization and its patients within the deployment. The Healthcare Organization and individuals retain their respective rights in that information. Software ownership, billing, hosting and support do not transfer ownership of patient records to Rigel or a Technology Delivery Partner. Third-party and open-source rights remain unaffected.

6. Authorized Technology Delivery Partner arrangements

Under a direct arrangement, Rigel contracts with the Healthcare Organization and provides the hosting and other services expressly assigned to Rigel. Under a Technology Delivery Partner arrangement, Rigel contracts with and invoices an authorized Technology Delivery Partner, which contracts with the identified Healthcare Organization and provides its agreed Azure environment and services. Neither arrangement creates a partnership, agency, joint venture, unrestricted resale authorization or guarantee of another party’s performance.

Before providing end-user access, the Technology Delivery Partner shall obtain a binding written downstream agreement containing the Rigel-approved organizational license, intellectual-property, confidentiality, use restrictions and applicable third-party provisions, or obtain the Healthcare Organization’s direct organizational execution of the agreed Rigel end-user license. Acceptance shall be by an authorized organizational representative; these Terms do not require an individual website acceptance checkbox for each staff member. The Technology Delivery Partner shall retain and provide reasonable evidence of the accepted version, scope, organization and representative’s authority.

The Technology Delivery Partner shall obtain the Healthcare Organization’s binding acceptance of the applicable professional-responsibility, user-management, patient-notice, licensing and continuity undertakings and an express clinical-care indemnity benefiting the Rigel Protected Parties on the basis stated in section 14. The downstream agreement shall identify Rigel as an intended beneficiary of its ownership, license-scope, confidentiality and use protections and identify the Rigel Protected Parties as beneficiaries of the indemnity and any liability protections expressly granted to them. Each beneficiary may enforce only the protections expressly accepted for its benefit. Those protections may not be diminished without Rigel’s written consent. The Technology Delivery Partner shall not represent that it provides clinical care unless factually and legally accurate.

The Technology Delivery Partner shall not appoint another reseller, license an unidentified organization, authorize additional deployments, transfer Rigel intellectual property or bind Rigel to additional warranties, service levels, indemnities or commitments without Rigel’s express written authorization. The Technology Delivery Partner is responsible for its own downstream representations, billing and agreed services. Rigel remains responsible for its own acts, services and legal duties. Participation in a Technology Delivery Partner arrangement does not itself transfer either party’s duties to the other.

Rigel’s Technology Delivery Partner authorization does not grant rights to resell, sublicense or host third-party services. Before activation, the actual delivery chain must be permitted under each relevant provider’s executed arrangements. A Technology Delivery Partner’s failure or termination does not automatically assign patient data or customer contracts to Rigel. A direct transition requires appropriate agreements, lawful authority concerning the data and the continuity protections in section 17.

Any exclusivity, territory, protected or registered customer account, referral entitlement, reseller discount, minimum purchase commitment or restriction on direct customer communications shall be expressly identified in the executed Order. The Order shall identify covered product releases and applicable support, upgrade and end-of-support arrangements. Neither party shall make unsupported representations concerning the other party’s services, continued availability or regulatory status. These provisions do not extinguish an existing agreed commitment or authorize unlawful interference with customer relationships.

7. Authorized users and clinical responsibility

Customer shall inform Authorized Users within its control of applicable restrictions, provide training appropriate to assigned roles, safeguard credentials, administer appropriate access, promptly remove unnecessary access and take reasonable measures to prevent unauthorized use. Customer is responsible for its personnel’s use within its authority and control as provided in the Agreement, but not for Rigel’s independent conduct. A Technology Delivery Partner shall require equivalent undertakings from the Healthcare Organization concerning that organization’s users.

As between the parties, the Healthcare Organization retains responsibility for patient care and for ensuring that appropriately qualified and authorized personnel independently review and approve clinical, prescribing, medication-administration, diagnostic, coding and billing decisions. CLYNYX provides supporting technology and does not practice medicine or replace professional judgment. Alerts, calculations, recommendations, reference content and AI-generated outputs are supplemental, may be incomplete, inaccurate or outdated, and do not identify every risk; absence of an alert is not confirmation of safety or appropriateness. The Healthcare Organization shall verify material inputs and outputs against the patient’s circumstances and appropriate current sources, and govern user-controlled settings, overrides and downtime procedures. This allocation does not expand Rigel’s agreed services or warranties, waive applicable contractual limitations, or exclude liability that applicable law prohibits excluding. The Healthcare Organization retains responsibility for clinical record approval, claims submissions, payer requirements and lawful patient notices and permissions within its assigned role.

CLYNYX does not guarantee clinical outcomes, reimbursement, universal interoperability or organizational compliance with every applicable law. These allocations do not excuse Rigel’s software defects, express commitments, security duties or other obligations under the Agreement or applicable law. No provision waives patient rights or limits regulatory authority.

The parties shall apply their agreed escalation procedures to suspected patient-safety defects, materially inaccurate records, misattributed user actions and compromised credentials. The responsible party shall preserve relevant audit and incident evidence as required by law and the Agreement. Clinical-record corrections shall follow authorized procedures that preserve required provenance and audit history. Internal escalation does not restrict access to care or records, lawful communications with regulators or legally protected reporting.

8. Implementation, fees and term

Implementation, migration, validation, training, acceptance criteria, dependencies and milestones shall be as specified in the Order. Each party shall provide the dependencies within its control. Before production use, the Healthcare Organization shall validate migrated records and clinical workflows with the assistance assigned to Rigel or the Technology Delivery Partner. Such validation does not relieve the party performing an agreed migration task of responsibility for that task. Modifications to scope, fees or commitments require written agreement.

The Order governs fees, payment dates, taxes, approved expenses, term, renewal and optional-provider charges. Customer shall pay undisputed amounts when due and promptly provide sufficiently detailed notice of any good-faith dispute. The parties shall cooperate to resolve disputed amounts. Customer is responsible for transaction taxes lawfully imposed on its purchase, excluding taxes on Rigel’s net income. These Terms do not independently establish automatic renewal, late charges, unilateral price increases or acceleration of future fees.

Evaluation access requires written authorization or an Order specifying its scope and duration. Identifiable patient information shall not be used until all necessary PHI agreements, security arrangements and data flows have been approved. An otherwise authorized evaluation may use synthetic or appropriately de-identified information. Production use does not waive a known material defect or establish acceptance criteria not agreed in the Order.

9. Hosting, security and support boundaries

The deployment schedule shall identify the Azure subscriber and hosting operator, United States production and backup regions, authorized support-access locations, and Rigel’s actual service and PHI-access scope. A dedicated application deployment does not imply exclusive dedication of underlying physical cloud resources unless expressly agreed. Optional providers’ locations and data flows require separate assessment. Selection of a United States Azure region does not itself establish the location of every integration or support activity.

The schedule shall allocate responsibility for cloud administration, user and privileged access, application and operating-system updates, encryption and keys, monitoring and logs, vulnerability management, backups and restoration testing, incident handling, support escalation, data export and deletion. Each party shall perform its assigned safeguards and operational tasks and remains responsible for its actual work and independent legal duties. Contractual allocation does not extinguish an obligation imposed by law.

For Technology Delivery Partner-hosted deployments, Rigel does not undertake administration or control of the Technology Delivery Partner’s Azure environment unless the Order expressly assigns that work to Rigel. Customer shall provide the access and cooperation necessary for Rigel’s agreed services through approved, appropriately safeguarded channels. Neither party may require insecure disclosure of credentials or unlawful processing of information by the other.

Support hours, supported releases, maintenance notices, response targets, recovery objectives and service credits are limited to those expressly agreed in the Order. No additional uptime or recovery target is implied. Service credits do not replace statutory remedies or BAA obligations that cannot lawfully be restricted. Material changes to approved hosting locations, support access or providers are subject to the review and approval required by the Agreement and applicable law.

10. Patient information and regulated processing

Customer authorizes Rigel to process Customer Data solely within Customer’s lawful authority and solely to perform the agreed services, comply with lawful documented instructions and fulfill purposes permitted by the applicable BAA and law. These Terms do not authorize the sale of PHI, advertising using patient information or use of that information to train general-purpose AI models. Additional processing requires a separately documented lawful basis and agreement; publication of a revised policy does not provide such authority.

Required BAAs and subcontractor arrangements shall be effective before the relevant party creates, receives, maintains or transmits PHI. In a direct hosted arrangement, the Healthcare Organization and Rigel shall execute the applicable BAA. In a Technology Delivery Partner arrangement, the services actually performed determine the required covered-entity, business-associate and subcontractor agreements. The party engaging a cloud or other PHI-handling provider shall maintain the agreements required for that relationship. Hosting under another party’s account does not eliminate a BAA requirement arising from Rigel’s PHI-handling support, administration, migration or telemetry.

The parties shall address records subject to 42 CFR Part 2 and applicable state confidentiality requirements where relevant. Behavioral-health information is not subject to Part 2 solely by reason of its subject matter. Customer shall identify restrictions affecting the agreed processing, and Rigel shall comply with restrictions applicable to its role. Each party retains its legally required safeguarding, incident-reporting and cooperation obligations. These customer license provisions do not execute the separately incorporated BAA set forth below and do not constitute patient consent or authorization to disclose records.

11. Included and optional integrations, AI and licensed content

Electronic prescribing, Direct messaging, clearinghouse connectivity, AI and other external services, whether included in the purchased package or separately ordered, require the applicable Order and provider arrangements. Before activation, the parties shall identify the provider, approved function, information transmitted, recipients, fees, responsible contracting party and required licenses, BAAs, permissions, enrollment and production approvals. Possession of credentials or registration of an account does not itself establish production authorization.

The Healthcare Organization shall obtain the organizational and end-user rights required for its use of licensed content, including CPT where included, as specified in the Order. A Technology Delivery Partner shall obtain that undertaking and any additional rights required for its own activities. Rigel remains responsible for its required development, integration, hosting and distribution rights. An end-user license does not satisfy another party’s licensing requirements unless the licensor expressly permits that arrangement.

Before licensed terminology or other licensed content is enabled, the parties shall document the applicable product, edition, permitted uses and responsible licensee. The Healthcare Organization shall provide reasonable evidence of the end-user rights assigned to it in the Order. Rigel and the Technology Delivery Partner shall separately maintain the rights required for their respective development, integration, hosting, copying and distribution activities. A customer license, public attribution or availability through a government website does not independently authorize those activities.

Optional AI functionality requires the Healthcare Organization’s documented approval of the provider, model, workflow, information categories, retention and training settings, together with appropriate contractual protections. Provision of an API key does not establish the legal relationship or transfer all responsibility to the key’s owner. Each party shall perform its agreed configuration and security obligations. PHI shall not be transmitted through an unapproved consumer account or endpoint. Audio capture or retention is subject to the agreed configuration and any legally required notice and consent. Licensing or activating an AI module does not itself approve a provider, model, data flow or clinical use. A material change to the approved provider, model, purpose, information categories, retention or training settings requires documented reassessment and any required authorization before the affected processing begins.

AI-generated drafts may contain errors, omissions or unsupported statements and shall be reviewed by an authorized professional before incorporation into an approved clinical record or use in a clinical or billing decision. Rigel may decline or suspend an integration that cannot be operated lawfully or safely within its agreed responsibilities, subject to reasonable notice where practicable, proportionate restrictions and preservation of required record access.

Provider terms and mandatory third-party notices govern their respective services and materials. Customer or the Technology Delivery Partner shall obtain any required organizational or individual acceptance; these standard Terms do not waive that requirement. Publication of a link does not complete provider enrollment. The existence of a link or integration does not itself make Rigel responsible for an external provider’s independent acts. Rigel nevertheless remains responsible for its own selection, integration, contractual and statutory duties. No provision remedies a missing license or authorizes use beyond the applicable license.

These Terms do not amend, waive or supersede Rigel’s obligations under an executed agreement with an external service or content provider, or grant rights not authorized by that provider. Before activation, the applicable Order or provider schedule shall identify required organizational and individual terms, applicable versions or update mechanisms, the party responsible for obtaining acceptance, and the evidence to be retained. Required provider acceptance remains mandatory notwithstanding the absence of a separate Rigel-required employee acceptance checkbox.

The relevant provider must authorize the actual direct or Technology Delivery Partner delivery arrangement. If processing permitted by a provider would exceed the customer’s approved data-processing scope, the parties shall reconcile the requirements before transmitting the affected information. Publication of notices does not resolve conflicting contractual permissions.

12. Confidentiality

Each party shall protect the other party’s nonpublic technical, business and security information that is designated confidential or reasonably understood to be confidential from its nature or the circumstances of disclosure. The receiving party may use such information solely to perform its obligations or exercise its rights under the Agreement and may disclose it only to persons with a legitimate need to know who are subject to appropriate confidentiality obligations. The receiving party shall exercise reasonable care and no less than the care it applies to comparable information of its own.

These restrictions do not apply to information that the receiving party demonstrates was lawfully known without restriction, independently developed without use of the disclosed information, lawfully received from another source without a duty of confidence, or made public without breach. Disclosure compelled by law shall be limited to the information legally required and accompanied by advance notice where legally permitted and reasonable cooperation. PHI and Part 2 records remain subject to their applicable agreements and law; the foregoing business-information exceptions do not diminish those protections.

Confidentiality obligations continue for so long as information remains confidential under this section, and trade secrets remain protected for so long as they legally qualify. No confidentiality obligation prohibits lawful cooperation with regulators, legally protected reporting or exercise of non-waivable rights. Neither party may publish the other party’s name, logo or confidential commercial terms as an endorsement without authorization, except where disclosure is legally required.

13. Warranties and remedies

Upon execution of an Order, each party represents that its signatory is authorized to bind it. Rigel is responsible for holding the rights necessary to grant the software rights expressly granted and for performing its agreed professional services with reasonable skill and care. The Order shall specify product specifications, acceptance requirements, any additional performance warranty and the associated correction or remedy procedure. Customer shall promptly report a material failure and provide information reasonably necessary for investigation, without transmitting PHI through unapproved channels.

Except for express warranties in the Agreement and duties that cannot lawfully be disclaimed, Rigel disclaims implied warranties of merchantability, fitness for a particular purpose and noninfringement to the extent permitted by law. Rigel does not warrant that software or an external service will be entirely error-free, uninterrupted, compatible with every system or independently sufficient to achieve every clinical, financial or regulatory objective.

These disclaimers do not negate Rigel’s express obligations, required licensing rights, data-security or BAA duties, responsibility for its own work, or remedies preserved by mandatory law. A material uncured breach may be addressed under section 17. No product description, disclaimer or remedy provision waives patient rights.

14. Third-party claims and indemnification

For this section, Rigel Protected Parties means Rigel, its affiliates and their respective members, owners, managers, directors, officers, employees, contractors, agents and licensors, solely in relation to activities under the Agreement. CLYNYX is protected as Rigel’s product and brand, not as a separate legal person. To the extent permitted by law, Customer shall defend and indemnify the Rigel Protected Parties against third-party claims, final judgments, Customer-approved settlements and reasonable defense costs to the extent caused by Customer’s unlawful provision or use of information, unauthorized use or distribution, infringement by Customer-supplied materials, unauthorized commitments on Rigel’s behalf, or its or its personnel’s negligent or unlawful clinical care, prescribing, medication administration or material breach of section 7. Clinical-care responsibility applies to a Technology Delivery Partner only to the extent it has agreed responsibility for that conduct; the Healthcare Organization’s separate undertaking must be obtained under section 6. No indemnity applies to the extent caused by a Rigel Protected Party’s breach, negligence, fraud, willful misconduct, unlawful instructions or other conduct for which indemnification is prohibited. No duplicate recovery for the same loss is permitted. Customer does not incur liability merely by selecting a deployment model, supplying credentials or using third-party services.

The protected party shall give reasonably prompt notice; delay relieves Customer only to the extent materially prejudiced. Customer shall control the defense through reasonably acceptable counsel. The protected party may participate at its own cost, except that reasonable separate-counsel costs necessary because of a conflict are borne by Customer to the extent attributable to a covered claim. Mixed-claim costs shall be reasonably allocated and adjusted when responsibility is determined. No settlement may admit a protected party’s wrongdoing, impose nonmonetary duties, impair its rights or omit its unconditional release without that party’s written consent, not unreasonably withheld for a fully funded lawful monetary settlement. Rigel retains control of regulatory communications and its PHI duties. The Rigel Protected Parties may enforce this section in their own names, subject to its limits and applicable law. The foregoing does not create an indemnity against a Healthcare Organization that has not validly accepted it.

Any separate indemnity undertaken by Rigel, provider-specific indemnity, claim exclusion, defense allocation or applicable monetary limit shall be expressly stated in the executed Order or provider terms validly incorporated therein. These standard Terms do not establish an unstated Rigel obligation to defend patent or other intellectual-property claims. This provision does not eliminate Rigel’s liability for its own breach or conduct under otherwise applicable law.

15. Allocation and limits of liability

Subject to the following exceptions and solely to the extent legally enforceable, neither contracting party shall be liable to the other for indirect, incidental, special, exemplary or consequential damages arising from the Agreement, including lost profits or lost business opportunities to the extent constituting such damages. This exclusion applies regardless of legal theory or prior disclosure of the possibility of such damages and does not characterize an otherwise direct loss as indirect.

The exclusion does not apply to amounts payable under an express indemnity, agreed payment obligations, direct reasonable costs of restoring or recovering Customer Data, direct reasonable incident-response and legally required notification costs, or liability for fraud, willful misconduct, gross negligence, violation of law or other matters to the extent limitation is prohibited by applicable law. Any additional exception expressly agreed in the Order shall also control.

The applicable monetary liability cap, its calculation, aggregate treatment, protected parties and exceptions are governed by the separately executed commercial agreement and any expressly applicable signed amendment. These published Terms do not establish a separate or additional monetary cap, reset an agreed aggregate cap, or enlarge recoveries permitted under the signed commercial agreement. Mandatory law and the exceptions expressly preserved in that agreement remain controlling.

No exclusion or cap authorizes prohibited processing, reduces legally required safeguards or breach reporting, limits regulatory authority or individual rights, excuses lawful access to records or extinguishes non-waivable duties. Mandatory law prevails over any conflicting limitation. A claim for injunctive relief remains subject to the applicable judicial standards; reference to such relief does not establish an automatic entitlement.

16. Proportionate suspension

Rigel may temporarily restrict an affected function or access to the extent reasonably necessary to address an imminent security threat, unlawful use, material unauthorized software distribution or a legal requirement. Rigel shall provide advance notice where lawful and practicable, describe the basis sufficiently to support remediation, confine the restriction to the affected activity where reasonably possible, and act in good faith to restore lawful operation promptly upon resolution of the underlying cause.

Suspension does not authorize withholding patient information contrary to law. Neither a payment dispute nor license enforcement permits unlawful obstruction of access to, exchange of or use of electronic health information. The parties shall preserve required access, emergency continuity and legally required cooperation. Suspension for ordinary payment default shall comply with the notice and cure procedure in section 17 or the specifically agreed Order and remains subject to these protections.

17. Termination and data transition

Unless the Order establishes a different lawful cure period, either party may terminate the affected Order for a material breach remaining uncured 30 days after written notice reasonably describing the breach. The applicable BAA or mandatory law may permit or require earlier termination. Urgent restrictions remain subject to section 16. No general right of termination for convenience exists unless expressly provided in the Order.

Upon expiration or lawful termination, the affected license terminates except for expressly agreed transition or surviving rights. Customer shall cease unlicensed use and remove or return Rigel materials as reasonably required by the Agreement, subject to permitted archival copies, third-party rights, lawful data-transition obligations and required retention. Accrued payment obligations remain payable. Noncancelable commitments, refunds and credits are governed by the Order and applicable law; these Terms do not automatically accelerate future fees.

The Order shall specify transition access, supported export formats, available metadata, agreed assistance fees, validation responsibilities and the deletion timetable. Each party shall provide the export and transition functions within its control and the assistance it has agreed to provide. Rigel shall perform its assigned hosting and export obligations for a Rigel-hosted deployment. For a Technology Delivery Partner-hosted deployment, the Technology Delivery Partner shall deliver complete exports and available required metadata to the Healthcare Organization or its lawfully authorized recipient and obtain appropriate confirmation of receipt and integrity. Rigel shall provide its agreed software and export assistance without asserting control over data it cannot access.

A discontinuity between providers shall not defeat a mandatory access obligation. Return, destruction and unavoidable continued retention of PHI are governed by the BAA and applicable law. Retained information remains protected and shall not be used for unrelated purposes. A Technology Delivery Partner’s failure does not automatically transfer patient data, customer contracts or licenses to Rigel; the parties shall arrange any lawful transition with the necessary authorization.

Account closure, license termination, a Technology Delivery Partner’s payment default or expiration of a BAA does not itself constitute an instruction to destroy patient information. Before deleting information within its control, the responsible party shall verify lawful instructions, retention and preservation requirements, and required return or export arrangements. The parties shall document the authorized recipient, delivery method and applicable confirmation of receipt and integrity, or the lawful basis for infeasibility of return. Continued retention remains subject to the BAA and applicable law. This provision does not authorize indefinite retention or continued clinical use without the necessary agreements.

Ownership, accrued payment obligations, confidentiality, applicable indemnities, lawful liability allocations, dispute provisions, and data-protection and transition duties survive to the extent required by their nature or applicable law. Continued protection of retained PHI is not conditional upon payment of disputed fees.

18. Governing law and disputes

An Agreement validly incorporating these customer provisions is governed by California law, without application of choice-of-law rules selecting another jurisdiction’s law, except to the extent mandatory law requires otherwise. Subject to applicable jurisdiction and venue requirements, the contracting parties consent to the state and federal courts in California for disputes arising under that Agreement, unless the executed Order specifies a different forum.

This choice does not displace non-waivable Massachusetts or other applicable protections, individual statutory rights, regulatory powers or a forum required by law. These Terms do not impose mandatory arbitration, waive a jury trial or class procedure, or shorten a statutory limitations period. A party may seek relief from a court of competent jurisdiction where necessary to protect information, intellectual property, patient access or another legally protected interest.

19. General contract provisions

The parties are independent contractors. Neither party has authority to bind the other without express written authorization. Assignment of an Agreement or license requires the other party’s written consent unless the executed Order expressly authorizes a specified succession. No assignment may circumvent third-party restrictions, data-protection obligations or other applicable law.

Neither party is responsible for delay to the extent actually caused by an event beyond its reasonable control that it could not reasonably avoid or overcome, provided it gives prompt notice and undertakes reasonable mitigation and continuity measures. This provision does not excuse failure to implement agreed safeguards or recovery measures, accrued payment obligations, legally required incident reporting, data access or any duty that applicable law requires notwithstanding the event.

Contractual notices shall be delivered to the designated contacts by the means specified in the Order. Amendments and waivers require an authorized written agreement. Failure to enforce a right does not constitute a continuing waiver. An invalid provision shall be severed or limited only to the extent lawful, without creating an unconscionable result or defeating essential protections. The parties’ executed documents constitute their agreement concerning the ordered services; purchase-order boilerplate is not accepted unless expressly agreed.

Except for beneficiaries expressly identified in an applicable executed document, Rigel’s specified downstream enforcement rights under section 6 and rights conferred by applicable law, the contracting parties do not intend to grant contractual enforcement rights to patients, Authorized Users, employees or contractors solely by reason of their use of or benefit from CLYNYX. This provision does not waive independent statutory or tort rights, patient-access rights or legally protected reporting rights. Organizational signatures, electronic signatures and counterparts may be used to the extent permitted by applicable law. The version governing the customer relationship is established by executed incorporation of a dated version, not by a subsequent unilateral website revision.

Unless a person expressly undertakes an individual obligation in writing, a representative executing an Agreement for Rigel or Customer acts solely in a representative capacity. No member, manager, officer or employee becomes a party solely by virtue of that position. This provision does not limit personal liability independently imposed by law or modify a separate written undertaking.

20. Communications and third-party notices

Inquiries concerning these Terms or applicable release notices may be directed to contact@clynyx.com. Ordinary email shall not include patient records, credentials or other sensitive information. Privacy inquiries are addressed in the Privacy Policy. Formal contractual notices remain subject to the customer’s executed agreement.

The accompanying third-party notices identify applicable materials and separate rights. Actual components, versions, datasets and integrations are determined by the release and Order. Required license texts, attribution, notices and any source-code obligations shall accompany the relevant deployment in the locations required by the applicable licenses. Publication of a notice or receipt of a customer acknowledgment does not substitute for a required license, provider authorization or executed agreement.