Peppermint Master Subscription Agreement — Terms and Conditions

Last updated: October 7, 2026

These Master Subscription Agreement Terms and Conditions (these “Terms and Conditions”) are entered into by and between Peppermint, Inc., a Delaware corporation (“Peppermint”), and the counterparty identified as the customer in the applicable Order Form (“Customer”). These Terms and Conditions, together with all Order Forms (each as defined below), constitute this “Agreement”. If you are accepting these Terms and Conditions or an Order Form on behalf of your employer or another entity (which will be deemed to the case if you sign up for a Peppermint Product (as defined below) using an email address from your employer or such entity), then the “Customer” under this Agreement will be such employer or other entity, and you represent and warrant that (a) you have read and understand this Agreement, (b) you have full legal authority to bind your employer or such entity to this Agreement and (c) you agree to this Agreement on behalf of your employer or such entity.

1. Definitions

The following terms, when used in this Agreement will have the following meanings:

“Affiliate” means an entity that directly or indirectly Controls, is Controlled by, or is under common Control with another entity, so long as such Control exists, wherein “Control” means beneficial ownership of 50% or more of the voting power or equity in an entity or power to direct an entity’s management.

“Peppermint Product” means the SaaS-based financial operations and automated reconciliation platform developed by Peppermint, as further described in the applicable Order Form.

“Confidential Information” means any information disclosed by either party that is marked or otherwise designated as confidential or proprietary or that should otherwise be reasonably understood to be confidential considering the nature of the information and the circumstances surrounding disclosure. The existence and terms of any Order Form, the Peppermint Product, Documentation, System Data, AI Output of a No-Charge Product (“Pilot Output”) and Customer Materials are considered Confidential Information. However, “Confidential Information” will not include any information that (a) is in the public domain through no fault of the receiving party; (b) was properly known to the receiving party, without restriction, prior to disclosure by the disclosing party; (c) was properly disclosed to the receiving party, without restriction, by another person with the legal authority to do so; or (d) is independently developed by the receiving party without use of or reference to the disclosing party’s Confidential Information.

“Customer Materials” means any data, including personal data, documents, content or materials such as but not limited to, protocols, CTAs, budgets, informed consent forms, amendments, CTMS records and other information or oral instructions that Customer (including its Users), submits, uploads, or discloses to Peppermint or its Peppermint Product accounts.

“Documentation” means Peppermint’s standard usage documentation for the Peppermint Product.

“Order Form” means an order form, quote or other similar document that sets forth the specific Peppermint Product to which Customer is subscribing, pricing therefor (including in relation to overages), permitted number of users and subscription term, and that references this Agreement and is mutually executed by the parties.

“Third-Party Platform” means any product, service or platform not provided by Peppermint that Customer elects to use with the Peppermint Product.

“User” means anyone that Customer allows to use its accounts for the Peppermint Product, consisting of (a) Customer’s employees and contractors (solely for purposes of providing services to Customer) and (b) others if permitted in the Documentation or an Order Form.

2. Peppermint Product

2.1 Provision of Peppermint Product.

Subject to this Agreement, Peppermint will make the Peppermint Product available to Customer pursuant to this Agreement and the applicable Order Form and hereby grants Customer a non-exclusive right to access and use the Peppermint Product for its internal business purposes during the applicable subscription term. Customer may permit Users to use the Peppermint Product on its behalf. Customer is responsible for provisioning and managing its User accounts, for actions conducted under any such User accounts through the Peppermint Product and for their compliance with this Agreement.

2.2 Data Security.

a. Peppermint will process Customer Materials in accordance with Data Processing Addendum (“DPA”) and maintain a security program materially consistent with industry standards that is designed to protect the security and integrity of Customer Materials and guard against unauthorized access, use, disclosure, alteration, or destruction.

b. To the extent that Peppermint processes any Personal Data contained in Customer Materials that is subject to data protection laws), on Customer’s behalf, in the provision of the Peppermint Product such processing shall be governed by the DPA, which is incorporated herein by reference.

c. To the extent that Peppermint creates, receives, maintains, or transmits any Protected Health Information (as defined under the Health Insurance Portability and Accountability Act of 1996, as amended, and its implementing regulations, collectively, “HIPAA”) on behalf of Customer or Customer’s Affiliates in the provision of the Peppermint Product, the parties will enter into Peppermint’s standard Business Associate Agreement (“BAA”) currently available at: [https://www.getpeppermint.ai/baa], which is hereby deemed part of this Agreement and incorporated herein by reference upon execution. In the event of any conflict between the BAA and any other provision of this Agreement with respect to Protected Health Information, the BAA will control.

2.3 Customer Responsibilities.

a. Customer acknowledges that Peppermint’s provision of the Peppermint Product is dependent on Customer providing all reasonably required cooperation (including the prompt provision of access to Customer’s systems, personnel, cooperation and materials as reasonably required and any other access as may be specified in the applicable Order Form), and Customer will provide all such cooperation in a diligent and timely manner.

b. Customer will (i) use commercially reasonable efforts to prevent unauthorized access to or use of the Peppermint Product and notify Peppermint promptly of any such unauthorized access or use or any other known or suspected breach of security or misuse of the Peppermint Product and (ii) be responsible for obtaining and maintaining any equipment, software and ancillary services needed to connect to, access or otherwise use the Peppermint Product, including as set forth in the Documentation. Customer will be solely responsible for its failure to maintain such equipment, software and services, and Peppermint will have no liability for such failure (including under any service level agreement). As between the parties, Customer is responsible for the content and accuracy of Customer Materials.

2.4 Third-Party Platforms.

The Peppermint Product may interface with Third Party Platforms. Customer has the discretion to utilize these Third Party Platforms in conjunction with the Peppermint Product. If required for integration of the Peppermint Product with any Third-Party Platform, Customer will be responsible for providing its login information to Peppermint solely for the purpose of enabling Peppermint to provide the Peppermint Product. Where the applicable Third Party Platform supports authentication via API keys, OAuth tokens, service-account credentials or similar delegated credentials, Customer will use such delegated credentials in lieu of individual user login credentials. Customer will promptly (i) revoke and rotate all credentials provided to Peppermint upon expiration or termination of the applicable Order Form or upon any known or suspected compromise thereof, and (ii) notify Peppermint of any change or rotation of such credentials that may affect the operation of the Peppermint Product. Customer affirms that it has the authority to provide such information without violating any terms and conditions governing use of the Third Party Platform. Peppermint does not endorse any Third-Party Platforms. Customer acknowledges that this Agreement does not cover the use of Third-Party Platforms, and Customer enters into separate agreements with the providers of these Third-Party Platforms. Peppermint expressly disclaims all representations and warranties concerning Third-Party Platforms. Customer must direct any warranty claims or other disputes directly to the providers of the Third-Party Platforms. The use of Third Party Platforms is at Customer’s own risk. Peppermint shall not be liable for any issues arising from the use or inability to use Third Party Platforms.

2.5 Affiliates.

Any Affiliate of Customer will have the right to enter into an Order Form executed by such Affiliate and Peppermint and this Agreement will apply to each such Order Form as if such Affiliate were a signatory to this Agreement. With respect to such Order Forms, such Affiliate becomes a party to this Agreement and references to Customer in this Agreement are deemed to be references to such Affiliate. Each Order Form is a separate obligation of the Customer entity that executes such Order Form, and no other Customer entity has any liability or obligation under such Order Form.

2.6 AI Features.

The Peppermint Product includes features that generate, classify, extract, summarize or otherwise transform information using artificial intelligence (each, an “AI Feature”). Customer’s use of AI Features is governed by the AI Output Rider currently available at: [https://www.getpeppermint.ai/ai-output-rider] (the “AI Output Rider”), which is hereby deemed part of this Agreement and incorporated herein by reference. Peppermint may modify the AI Output Rider from time to time in accordance with its terms. In the event of any conflict between the AI Output Rider and any other provision of this Agreement with respect to AI Features or the outputs generated by AI Features, the AI Output Rider will control.

3. Fees

3.1 Fees.

Customer will pay Peppermint the fees set forth in the applicable Order Form. Customer will pay those amounts due and not disputed in good faith within thirty (30) days of the date of receipt of the applicable invoice (the “Payment Period”), unless a specific date for payment is set forth in such Order Form, in which case payment will be due on the date specified. Except as otherwise specified herein or in such Order Form, payment obligations are non-cancelable and non-pro-ratable for partial months, and fees paid are non-refundable. If Customer disputes an invoice in good faith, it will notify Peppermint within the Payment Period, Customer’s approval of any output, including the use of any output for subsequent billing, constitutes final acceptance of that output and the associated fees, and Customer may not thereafter dispute those fees. The parties will seek to resolve the timely dispute as soon as reasonably practicable. Peppermint may provide Customer with written notice of a change or increase in pricing for such Order Form at least sixty (60) days prior to the end of the then-current subscription term, and such modified pricing will become effective thereafter at the time of the renewal.

3.2 Late Payment.

Peppermint may suspend access to the Peppermint Product immediately upon notice if Customer fails to pay any amounts hereunder at least five (5) days past the applicable due date. If Peppermint has not received payment within five (5) days after the applicable due date, interest will accrue on past due amounts at the rate of one percent (1%) per month, but in no event greater than the highest rate of interest allowed by law, calculated from the date such amount was due until the date that payment is received by Peppermint.

3.3 Taxes.

All amounts payable hereunder are exclusive of any sales, use and other taxes or duties, however designated (collectively, “Taxes”). Customer will be solely responsible for payment of all Taxes, except for those taxes based on the income of Peppermint. Customer will not withhold any Taxes from any amounts due to Peppermint.

4. Proprietary Rights

4.1 Proprietary Rights.

As between the parties, Peppermint exclusively owns all right, title and interest in and to the Peppermint Product, System Data and Peppermint’s Confidential Information, and Customer exclusively owns all right, title and interest in and to the Customer Materials, output produced specifically for Customer via the use of the Peppermint Product by Customer (which will constitute Customer Materials for purposes hereof) and Customer’s Confidential Information. “System Data” means data collected by Peppermint regarding the Peppermint Product that may be used to generate logs, statistics or reports regarding the performance, availability, usage, integrity or security of the Peppermint Product.

4.2 Feedback.

Customer may from time to time provide Peppermint suggestions or comments for enhancements or improvements, new features or functionality or other feedback (“Feedback”) with respect to the Peppermint Product. Peppermint will have full discretion to determine whether or not to proceed with the development of any requested enhancements, new features or functionality. Peppermint will have the full, unencumbered right, without any obligation to compensate or reimburse Customer, to use, incorporate and otherwise fully exercise and exploit any such Feedback in connection with its products and services. All Feedback is provided “AS IS” and Peppermint will not publicly identify Customer as the source of Feedback without Customer’s permission.

4.3 Product Improvement and Aggregated Statistics.

Customer further agrees that, notwithstanding anything herein, Peppermint is hereby granted the right to aggregate, collect, retain and analyze information relating to the performance of the Peppermint Product and will be free (during and after the term hereof) to (a) use such data and other information to provide and improve Peppermint’s products and services, including using aggregated, anonymized and de-identified data to train, develop, validate and improve machine learning models and other artificial intelligence functionality used in or provided as part of Peppermint’s products and services, and (b) disclose such data and other information solely in an aggregated and anonymized format that does not identify Customer or any individual. .

5. Confidentiality; Restrictions

5.1 Confidentiality.

Each receiving party agrees that it will use the Confidential Information of the disclosing party solely in accordance with the provisions of this Agreement and it will not disclose the same to any third party without the disclosing party’s prior written consent, except as otherwise permitted hereunder. However, the receiving party may disclose such Confidential Information (a) to its employees and other representatives who have a need to know and are legally bound to keep such information confidential by confidentiality obligations consistent with those of this Agreement; and (b) as required by law (in which case the receiving party will provide the disclosing party with prior written notification thereof, will provide the disclosing party with the opportunity to contest such disclosure, and will use its reasonable efforts to minimize such disclosure to the extent permitted by applicable law). Neither party will disclose the terms of this Agreement to any third party, except that either party may confidentially disclose such terms to actual or potential lenders, investors or acquirers.

5.2 Technology Restrictions.

Customer will not directly or indirectly: (a) reverse engineer, decompile, disassemble, modify, create derivative works of or otherwise create, attempt to create or derive, or permit or assist any third party to create or derive, the source code underlying the Peppermint Product; (b) attempt to probe, scan or test the vulnerability of the Peppermint Product, breach the security or authentication measures of the Peppermint Product without proper authorization or willfully render any part of the Peppermint Product unusable; (c) use or access the Peppermint Product to develop a product or service that is competitive with Peppermint’s products or services or engage in competitive analysis or benchmarking; (d) transfer, distribute, resell, lease, license, or assign the Peppermint Product or otherwise offer the Peppermint Product on a standalone basis; or (e) otherwise use the Peppermint Product in violation of applicable law (including any export law) or outside the scope expressly permitted hereunder and in the applicable Order Form.

5.3 Injunctive Relief.

In the event of actual or threatened breach of the provisions of this Section, the non-breaching party will be entitled to seek immediate injunctive and other equitable relief, without waiving any other rights or remedies available to it.

6. Warranties and Disclaimers

6.1 Mutual.

Each party warrants that (a) it has the legal power and authority to enter into this Agreement and (b) it will use industry-standard measures to avoid introducing viruses or other malicious code into the Peppermint Product.

6.2 Peppermint.

Peppermint represents and warrants that the Peppermint Product will perform materially as described in the Documentation and Peppermint will not materially decrease the overall functionality of the Peppermint Product during the applicable subscription term (the “Performance Warranty”). Peppermint will make reasonable efforts to correct a verifiable breach of the Performance Warranty reported by Customer. If Peppermint fails to do so within 30 days after Customer’s warranty report, then either party may terminate the applicable Order Form as it relates to the non-conforming Peppermint Product, in which case Peppermint will provide Customer a pro rata refund of any prepaid subscription fees corresponding to the terminated portion of the applicable subscription term. To receive these remedies, Customer must report a breach of warranty in reasonable detail within 30 days after discovering the issue in the Peppermint Product. Customer should report such breach of Performance Warranty to hello@getpeppermint.ai. These procedures are Customer’s exclusive remedies and Peppermint’s sole liability for breach of the Performance Warranty.

6.3 Customer.

Customer represents and warrants that it has all necessary rights, consents, authorizations, IRB approvals and permissions required to provide or disclose to Peppermint Customer Materials, any information, data, Personal Data, Protected Health Information, if applicable, or other documents and materials and to permit Peppermint to use the same as contemplated in this Agreement and that such disclosure to Peppermint will not violate any applicable law, regulation, contractual restriction, ethical requirement or contain errors. To the extent that any such information includes Protected Health Information (as defined under HIPAA), the parties’ rights and obligations with respect thereto will be governed by the Business Associate Agreement referenced in the Terms and Conditions.

6.4 DISCLAIMERS.

EXCEPT AS EXPRESSLY SET FORTH HEREIN, EACH PARTY DISCLAIMS ANY AND ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING WARRANTIES OF MERCHANTABILITY, TITLE, NON-INFRINGEMENT, AND FITNESS FOR A PARTICULAR PURPOSE. CUSTOMER ACKNOWLEDGES THAT THE PEPPERMINT PRODUCT IS INTENDED TO AUGMENT THE EFFICIENCY OF, BUT NOT REPLACE, CUSTOMER’S MODELING SYSTEMS AND PROCESSES. PEPPERMINT DOES NOT REPRESENT OR WARRANT THAT THE PEPPERMINT PRODUCT WILL BE ERROR-FREE AND CUSTOMER ACKNOWLEDGES THAT THE INSIGHTS PROVIDED BY THE PEPPERMINT PRODUCT DO NOT CONSTITUTE PROFESSIONAL ADVICE OR COUNSEL. PEPPERMINT IS NOT RESPONSIBLE OR LIABLE FOR ANY THIRD PARTY PLATFORMS AND DOES NOT GUARANTEE THE CONTINUED AVAILABILITY THEREOF.

6.5 NO-CHARGE PRODUCTS.

From time to time, Customer may have access to free accounts or trial use, pre-release, alpha or beta versions or features, or to pilot, proof-of-concept, evaluation or other similar limited-scope engagements (whether or not a fee is charged for such use) (collectively, “No-Charge Products”) offered by Peppermint. Customer’s use of No-Charge Products is subject to any additional terms that Peppermint may specify, including any Order Form or statement of work applicable to a pilot or proof-of-concept engagement. Except as otherwise set forth in this Section, this Agreement applies to No-Charge Products. Peppermint may modify or terminate Customer’s right to use No-Charge Products at any time. NOTWITHSTANDING ANYTHING TO THE CONTRARY, TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW, PEPPERMINT DISCLAIMS ALL OBLIGATIONS, WARRANTIES AND LIABILITIES WITH RESPECT TO NO-CHARGE PRODUCTS (INCLUDING ANY PILOT, PROOF-OF-CONCEPT OR EVALUATION USE), INCLUDING ANY SERVICE LEVEL, PERFORMANCE WARRANTY OR INDEMNITY OBLIGATIONS, AND ALL NO-CHARGE PRODUCTS ARE PROVIDED “AS IS” AND “AS AVAILABLE”.

7. Indemnification

7.1 Indemnity by Peppermint.

Peppermint will defend Customer against any claim, demand, suit, or proceeding (“Claim”) made or brought against Customer by a third party alleging that the use of the Peppermint Product as permitted hereunder infringes or misappropriates a United States patent, copyright or trade secret and will indemnify Customer for any damages finally awarded against Customer (or any settlement approved by Peppermint) in connection with any such Claim; provided that (a) Customer will promptly notify Peppermint of such Claim, (b) Peppermint will have the sole and exclusive authority to defend and/or settle any such Claim (provided that Peppermint may not settle any Claim without Customer’s prior written consent, which will not be unreasonably withheld, unless it unconditionally releases Customer of all related liability) and (c) Customer reasonably cooperates with Peppermint in connection therewith. If the use of the Peppermint Product by Customer has become, or in Peppermint’s opinion is likely to become, the subject of any claim of infringement, Peppermint may at its option and expense (i) procure for Customer the right to continue using and receiving the Peppermint Product as set forth hereunder; (ii) replace or modify the Peppermint Product to make it non-infringing (with comparable functionality); or (iii) if the options in clauses (i) or (ii) are not reasonably practicable, terminate the applicable Order Form and provide Customer a pro rata refund of any prepaid subscription fees corresponding to the terminated portion of the applicable subscription term. Peppermint will have no liability or obligation with respect to any Claim if such Claim is caused in whole or in part by (A) designs, guidelines, configurations, plans, specifications or instructions (oral or written) provided by Customer; (B) use of the Peppermint Product by Customer not in accordance with this Agreement; (C) modification of the Peppermint Product by or on behalf of Customer; (D) Customer Materials, or (E) the combination, operation or use of the Peppermint Product with other products or services where the Peppermint Product would not by itself be infringing (clauses (A) through (E), “Excluded Claims”). For the avoidance of doubt, Peppermint’s obligations under this Section 7.1 do not extend to, and Peppermint has no liability or obligation with respect to, any claim of infringement or misappropriation of any patent, copyright, trade secret, trademark, database right, moral right or other intellectual property or proprietary right arising under the laws of any jurisdiction other than the United States of America. This Section states Peppermint’s sole and exclusive liability and obligation, and Customer’s exclusive remedy, for any claim of any nature related to infringement or misappropriation of intellectual property.

7.2 Indemnification by Customer.

Customer will defend Peppermint against any Claim made or brought against Peppermint by a third party arising out of (i) a breach of Customer warranties; or (ii) any Excluded Claims, and Customer will indemnify Peppermint for any damages finally awarded against Peppermint (or any settlement approved by Customer) in connection with any such Claim, including reasonable attorneys’ fees; provided that (a) Peppermint will promptly notify Customer of such Claim, (b) Customer will have the sole and exclusive authority to defend and/or settle any such Claim (provided that Customer may not settle any Claim without Peppermint’s prior written consent, which will not be unreasonably withheld, unless it unconditionally releases Peppermint of all liability) and (c) Peppermint reasonably cooperates with Customer in connection therewith.

8. Limitation of Liability

EXCEPT FOR A PARTY’S INDEMNIFICATION OBLIGATIONS, BREACH OF SECTION 5, GROSS NEGLIGENCE, WILLFUL MISCONDUCT OR INFRINGEMENT OR MISAPPROPRIATION OF THE OTHER PARTY’S INTELLECTUAL PROPERTY RIGHTS, TO THE MAXIMUM EXTENT PERMITTED UNDER APPLICABLE LAW, UNDER NO LEGAL THEORY, WHETHER IN TORT, CONTRACT, OR OTHERWISE, WILL EITHER PARTY BE LIABLE TO THE OTHER UNDER THIS AGREEMENT FOR (A) ANY INDIRECT, SPECIAL, INCIDENTAL, CONSEQUENTIAL OR PUNITIVE DAMAGES, INCLUDING DAMAGES FOR LOSS OF USE, LOST PROFITS OR INTERRUPTION OF BUSINESS, EVEN IF INFORMED OF THEIR POSSIBILITY IN ADVANCE; (B) EXCLUDING CUSTOMER’S PAYMENT OBLIGATIONS, ANY AGGREGATE LIABILITY IN EXCESS OF THE GREATER OF (I) THE AMOUNTS PAID BY CUSTOMER UNDER THE APPLICABLE ORDER FORM DURING THE TWELVE (12) MONTHS PRECEDING THE CLAIM OR (II) FIFTY THOUSAND U.S. DOLLARS (US$50,000); THE “ORDINARY CAP”). NOTWITHSTANDING THE FOREGOING, (X) PEPPERMINT WILL HAVE NO LIABILITY IN THE EVENT ANY THIRD-PARTY DECLINES TO PAY OR REQUESTS A REFUND FOR AMOUNTS INVOICED BY PEPPERMINT ON BEHALF OF CUSTOMER USING CUSTOMER MATERIALS; (Y) PEPPERMINT’S AGGREGATE LIABILITY FOR BREACH OF SECTION 2.2 (INCLUDING THE DPA AND, WHERE APPLICABLE, THE BAA) AND/OR SECTION 5.1 IN RELATION TO CUSTOMER MATERIALS WILL NOT EXCEED TWO TIMES (2X) THE ORDINARY CAP; AND (C)NOTWITHSTANDING ANYTHING TO THE CONTRARY, WITH RESPECT TO ANY NO-CHARGE PRODUCTS OR ANY PILOT, TRIAL, PROOF-OF-CONCEPT OR EVALUATION USE OF THE PEPPERMINT PRODUCT (COLLECTIVELY, “EVALUATION USE”): (I) THE US$50,000 FLOOR IN CLAUSE (B)(II) SHALL NOT APPLY, AND THE ORDINARY CAP SHALL BE LIMITED TO THE AMOUNTS ACTUALLY PAID BY CUSTOMER, IF ANY, FOR SUCH EVALUATION USE; AND (II) THE 2X SUPER-CAP SHALL NOT APPLY, AND PEPPERMINT’S AGGREGATE LIABILITY FOR ANY EVALUATION USE (INCLUDING FOR BREACH OF SECTION 2.2 AND/OR SECTION 5.1) SHALL NOT EXCEED THE AMOUNTS SO PAID, IF ANY.

9. Termination

9.1 Term.

The term of this Agreement will commence on the date of the initial Order Form and continue until terminated as set forth below. The initial term of each Order Form will begin on the Order Form start date indicated in such Order Form and will continue for the subscription term set forth therein. Except as set forth in such Order Form, the term of such Order Form will automatically renew for successive renewal terms equal to the length of the initial term of such Order Form, unless either party provides the other party with written notice of non-renewal at least thirty (30) days prior to the end of the then-current term.

9.2 Termination.

Each party may terminate this Agreement upon written notice to the other party if there are no Order Forms then in effect. Each party may also terminate this Agreement or the applicable Order Form upon written notice (a) in the event the other party commits any material breach of this Agreement or the applicable Order Form and fails to remedy such breach within thirty (30) days after written notice of such breach or (b) subject to applicable law, upon the other party’s liquidation, commencement of dissolution proceedings or assignment of substantially all its assets for the benefit of creditors, or if the other party becomes the subject of bankruptcy or similar proceeding that is not dismissed within sixty (60) days.

9.3 Survival.

Upon expiration or termination of this Agreement (a) all rights and obligations will immediately terminate except that any terms or conditions that by their nature should survive such expiration or termination will survive, including the terms and conditions relating to payment, proprietary rights and confidentiality, technology restrictions, disclaimers, indemnification, limitations of liability and termination and the general provisions below, and (b) each receiving party will return or destroy, at the disclosing party’s option, any Confidential Information of such disclosing party in the receiving party’s possession or control.

9.4 Customer Materials Retrieval.

Upon Customer’s written request made on or prior to expiration or termination of the applicable Order Form, Peppermint will give Customer limited access to the Peppermint Product for a period of up to thirty (30) days after such expiration or termination, at no additional cost, solely for purposes of retrieving Customer Materials. Subject to such retrieval period and Peppermint’s legal obligations, Peppermint has no obligation to maintain or provide any Customer Materials and will, unless legally prohibited, delete Customer Materials after such expiration or termination; provided, however, that Peppermint will not be required to remove copies of the Customer Materials from its backup media and servers until such time as the backup copies are scheduled to be deleted, provided further that in all cases Peppermint will continue to protect the Customer Materials in accordance with this Agreement. For clarity, during the term of the applicable Order Form, Customer may extract Customer Materials using Peppermint’s standard web services as described in the Documentation. Notwithstanding the foregoing, the parties’ rights and obligations with respect to any Protected Health Information will be governed by the BAA, which will control over this Section 9.4 with respect to such Protected Health Information.

10. Insurance.

During the term of this Agreement and for a period of two (2) years thereafter, each Party, at its own expense, will maintain the following insurance coverage with insurers rated A- VII or better by A.M. Best (or a comparable rating agency):

a. Commercial General Liability insurance, written on an occurrence form, with limits of not less than $1,000,000 per occurrence and $2,000,000 in the aggregate, covering bodily injury, property damage, personal and advertising injury, and products and completed operations;

b. Workers’ Compensation insurance at statutory limits in each jurisdiction in which the Party has employees, and Employer’s Liability insurance with limits of not less than $1,000,000 per accident for bodily injury by accident, $1,000,000 per employee for bodily injury by disease, and $1,000,000 policy limit for bodily injury by disease;

c. Umbrella or Excess Liability insurance, on a following-form basis over the policies in paragraphs (a) and (b) and, where applicable, (d), with limits of not less than $5,000,000 per occurrence and in the aggregate; and

d. Cyber Liability insurance (which may be written on a claims-made basis), with limits of not less than $5,000,000 per claim and in the aggregate, covering (i) unauthorized access to, acquisition of, or disclosure of confidential, personal, or protected information, (ii) network security and privacy liability, (iii) regulatory investigations, fines, and penalties to the extent insurable under applicable law, (iv) breach response, notification, and credit-monitoring costs, (v) business interruption and dependent business interruption, and (vi) media and content liability. Claims-made policies will be maintained for the term of this Agreement and for at least two (2) years following termination, whether through continuous renewal or an extended reporting period.

e. Errors and Omissions insurance covering liabilities arising from a Party’s performance of this Agreement, with limits of not less than $1,000,000 per claim and in the aggregate during the Term.

The Parties may agree to alternative coverages, limits, or other terms in an applicable Order Form, which will control over this Section as to the Parties to that Order Form. Each Party will, upon the other’s written request, provide a certificate of insurance evidencing the coverages required by this Section. Each Party will use commercially reasonable efforts to provide the other with at least thirty (30) days’ prior written notice of cancellation or material reduction of the coverages required by this Section (ten (10) days for cancellation due to non-payment of premium). The insurance required by this Section is primary and non-contributing with any insurance maintained by the other Party. The maintenance of the insurance required by this Section does not limit, waive, release, or reduce either Party’s indemnification obligations, liability, or other obligations under this Agreement.

11. General

11.1 Publicity.

Neither party will use the other party’s name, logo or trademarks in any publicity or marketing materials (including press releases, customer references, case studies, website customer lists or investor materials) without the other party’s prior written consent (which may be by email). Consent for a particular use may be revoked by written notice, and the requesting party will cease such use within a reasonable period after receiving the revocation notice. Notwithstanding the foregoing, either party may identify the other as a customer or vendor in confidential communications with its actual or potential lenders, investors or acquirers.

11.2 Assignment.

Neither party hereto may assign this Agreement without the other party’s prior written consent, except that either party may assign this Agreement without consent to a successor to all or substantially all of its assets or business related to this Agreement. Any attempted assignment by either party in violation hereof will be null and void. Subject to the foregoing, this Agreement will be binding on the parties and their successors and assigns.

11.3 Amendment; Waiver.

Peppermint reserves the right in its sole discretion and at any time and for any reason to modify these Terms and Conditions. With respect to each Order Form, any modifications to these Terms and Conditions shall become effective upon the date of Customer’s next renewal of such Order Form. It is Customer’s responsibility to review these Terms and Conditions from time to time for any changes or modifications. If Customer does not agree to the modified Terms and Conditions, Customer may provide notice of Customer’s non-renewal at any point prior to the Customer’s next renewal. No waiver by either party of any breach or default hereunder shall be deemed to be a waiver of any preceding or subsequent breach or default. Any such waiver will be only to the specific provision and under the specific circumstances for which it was given, and will not apply with respect to any repeated or continued violation of the same provision or any other provision. Failure or delay by either party to enforce any provision of this Agreement will not be deemed a waiver of future enforcement of that or any other provision. The section headings used herein are for convenience only and shall not be given any legal import.

11.4 Relationship.

Nothing contained herein will in any way constitute any association, partnership, agency, employment or joint venture between the parties hereto, or be construed to evidence the intention of the parties to establish any such relationship. Neither party will have the authority to obligate or bind the other in any manner, and nothing herein contained will give rise or is intended to give rise to any rights of any kind to any third parties.

11.5 Unenforceability.

If a court of competent jurisdiction determines that any provision of this Agreement is invalid, illegal, or otherwise unenforceable, such provision will be enforced as nearly as possible in accordance with the stated intention of the parties, while the remainder of this Agreement will remain in full force and effect and bind the parties according to its terms.

11.6 Governing Law.

This Agreement is governed by and construed in accordance with the laws of the State of Delaware, without regard to its conflicts of laws principles. The United Nations Convention on Contracts for the International Sale of Goods does not apply to this Agreement.

11.7 Dispute Resolution; Venue.

The Parties will attempt in good faith to resolve any dispute, claim, or controversy arising out of or relating to this Agreement through negotiations between authorized representatives of each Party for a period of at least thirty (30) days before initiating litigation, except that either Party may seek temporary, preliminary, or permanent injunctive relief or other equitable remedies at any time to protect its rights. If the Parties are unable to resolve the dispute through such negotiations, any action or proceeding arising out of or relating to this Agreement must be brought exclusively in the state courts located in Santa Clara County, California, or the United States District Court for the Northern District of California. Each Party irrevocably submits to the personal jurisdiction of such courts and waives any objection based on improper venue or forum non conveniens.

11.8 Notices.

Any notice required or permitted to be given hereunder will be given in writing by personal delivery, certified mail, return receipt requested, or by overnight delivery. Notices to the Customer must be sent to the respective address set forth in the signature blocks listed on the Customer’s applicable Order Form, or such other email address provided by Customer when Customer creates its Peppermint account. Notices to Peppermint must be sent to the following: 455 Market St Ste 1940 PMB 490882 San Francisco, California 94105-2448 US

11.9 Entire Agreement.

This Agreement comprises the entire agreement between Customer and Peppermint with respect to its subject matter, and supersedes all prior and contemporaneous proposals, statements, sales materials or presentations and agreements (oral and written). No oral or written information or advice given by Peppermint, its agents or employees will create a warranty or in any way increase the scope of the warranties in this Agreement.

11.10 Force Majeure.

Neither party will be deemed in breach hereunder for any cessation, interruption or delay in the performance of its obligations (excluding payment obligations) due to causes beyond its reasonable control (“Force Majeure Event”), including earthquake, flood, or other natural disaster, act of God, labor controversy, civil disturbance, terrorism, war (whether or not officially declared), cyber attacks (e.g., denial of service attacks), or the inability to obtain sufficient supplies, transportation, or other essential commodity or service required in the conduct of its business, or any change in or the adoption of any law, regulation, judgment or decree.

11.11 Interpretation.

For purposes hereof, “including” means “including without limitation”.

11.12 Export Controls; Sanctions; Anti-Corruption.

Customer represents, warrants and covenants that (a) neither Customer nor any of its Affiliates, directors, officers, employees or Users using the Peppermint Product is (i) located in, ordinarily resident in, or organized under the laws of any country or region that is the subject of comprehensive economic sanctions administered by the United States, the United Nations, the United Kingdom or the European Union (currently including Cuba, Iran, North Korea, Syria and the Crimea, Donetsk, Luhansk, Kherson and Zaporizhzhia regions of Ukraine), or (ii) identified on any list of restricted or prohibited parties maintained by any of the foregoing authorities (including the U.S. Treasury Department’s Specially Designated Nationals and Blocked Persons List, the U.S. Commerce Department’s Denied Persons and Entity Lists and the U.S. State Department’s Debarred List); (b) Customer will not, and will not permit any User to, access, use, export, re-export or transfer the Peppermint Product in violation of any applicable export control, sanctions or anti-boycott law or regulation; and (c) in performing its obligations under this Agreement, Customer has complied and will comply with the U.S. Foreign Corrupt Practices Act, the U.K. Bribery Act 2010 and all other applicable anti-corruption and anti-bribery laws. Customer’s breach of this Section 10.11 will be deemed a material breach of this Agreement, and Peppermint may suspend or terminate this Agreement and any Order Form immediately upon written notice for any such breach.

Data Processing Addendum

Last updated October 2, 2026

This Data Processing Addendum (this DPA) forms part of the agreement between Peppermint, Inc., a Delaware corporation (Peppermint), and the customer identified in the Order Form (Customer; each of Peppermint and Customer, a Party and together, the Parties) under which Peppermint provides its services to Customer (the Agreement). This DPA applies to Peppermint’s Processing of Personal Data on behalf of Customer in connection with the Agreement.

Capitalized terms used but not defined in this DPA have the meanings given to them in the Agreement.

ARTICLE I - Definitions

In this DPA:

Applicable Data Protection Laws means all laws and regulations applicable to the Processing of Personal Data under this DPA, including (as applicable) the EU General Data Protection Regulation (Regulation (EU) 2016/679) (GDPR), the UK Data Protection Act 2018 together with the UK General Data Protection Regulation (UK GDPR), the Swiss Federal Act on Data Protection (FADP), the California Consumer Privacy Act of 2018 as amended by the California Privacy Rights Act (CCPA), and comparable comprehensive data protection laws of other U.S. states.

Controller, Processor, Data Subject, Personal Data, Processing, Supervisory Authority, and Service Provider have the meanings given in the Applicable Data Protection Laws. Business has the meaning given in the CCPA.

Customer Personal Data means Personal Data that Peppermint Processes on behalf of Customer under the Agreement.

Standard Contractual Clauses or SCCs means the standard contractual clauses for the transfer of personal data to third countries adopted by the European Commission on 4 June 2021 (Commission Implementing Decision (EU) 2021/914).

Subprocessor means any Processor engaged by Peppermint to Process Customer Personal Data.

UK Addendum means the International Data Transfer Addendum to the EU Commission Standard Contractual Clauses issued by the UK Information Commissioner (version B1.0, in force 21 March 2022).

ARTICLE II - Roles and Scope of Processing

With respect to Customer Personal Data, Customer is the Controller (or a Processor acting on behalf of a Controller) and Peppermint is the Processor. Where the CCPA applies, Peppermint is a Service Provider to Customer.

Peppermint will Process Customer Personal Data only on the documented instructions of Customer, including as set out in the Agreement, this DPA, and any additional written instructions acknowledged by Peppermint. Peppermint will notify Customer if, in its opinion, an instruction infringes Applicable Data Protection Laws.

The subject matter, duration, nature, purpose, categories of Personal Data, and categories of Data Subjects of the Processing are set out in Annex A.

ARTICLE III - Peppermint Processing Obligations

Peppermint will ensure that personnel authorized to Process Customer Personal Data are bound by appropriate obligations of confidentiality.

Peppermint will implement and maintain the technical and organizational measures set out in Annex B, taking into account the state of the art, the costs of implementation, and the nature, scope, context, and purposes of Processing, as required under GDPR Article 32 and comparable provisions of other Applicable Data Protection Laws.

Peppermint will not use Customer Personal Data to train, develop, or improve any generalized artificial intelligence or machine learning model and will not permit any Subprocessor (including any artificial intelligence service provider) to retain Customer Personal Data after Processing or to use it to train, develop, or improve any such model.

ARTICLE IV - CCPA Service Provider Terms

Where the CCPA applies, Peppermint acknowledges that it understands the restrictions in Cal. Civ. Code § 1798.140(ag) and 11 CCR § 7051, and will:

(a) not sell or share Customer Personal Data, as those terms are defined in the CCPA;

(b) not retain, use, or disclose Customer Personal Data outside the direct business relationship between the Parties or for any purpose other than the business purposes specified in the Agreement and this DPA;

(c) not combine Customer Personal Data with Personal Data that Peppermint receives from or on behalf of any other person, or that Peppermint collects from its own interaction with any individual, except as permitted under 11 CCR § 7050(b); and

(d) promptly notify Customer if Peppermint determines that it can no longer meet its obligations under the CCPA.

ARTICLE V - Subprocessors

Customer provides general written authorization for Peppermint to engage the Subprocessors listed in Annex C to Process Customer Personal Data.

Peppermint will give Customer at least 30 days’ prior notice of the appointment or replacement of any Subprocessor, by posting an updated list on its website or by email. Customer may object to the appointment on reasonable data-protection grounds by notifying Peppermint in writing before the end of the notice period; if the Parties cannot agree on a resolution, Customer may terminate the affected part of the Agreement without penalty.

Peppermint will enter into a written agreement with each Subprocessor that imposes data-protection obligations substantially equivalent to those in this DPA. Peppermint remains fully liable to Customer for the acts and omissions of its Subprocessors.

ARTICLE VI - Data Subject Rights and Cooperation

Taking into account the nature of the Processing, Peppermint will provide Customer with reasonable assistance by appropriate technical and organizational measures in responding to requests from Data Subjects to exercise their rights under Applicable Data Protection Laws, insofar as this is possible.

If Peppermint receives a request directly from a Data Subject in respect of Customer Personal Data, Peppermint will promptly forward the request to Customer and will not respond to the Data Subject except on Customer’s documented instructions or as required by law.

Peppermint will provide Customer with reasonable assistance in meeting its obligations under GDPR Articles 32 through 36 and comparable provisions of other Applicable Data Protection Laws, including data protection impact assessments and prior consultation with Supervisory Authorities.

ARTICLE VII - Security Incidents

Peppermint will notify Customer without undue delay, and in any event within 72 hours of becoming aware, of any confirmed breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to Customer Personal Data (a Security Incident).

The notification will include, to the extent known at the time and updated as further information becomes available, a description of the nature of the Security Incident, the categories and approximate number of Data Subjects and records affected, the likely consequences, the measures taken or proposed to address the incident, and a point of contact for further information.

Peppermint’s notification of or response to a Security Incident is not an acknowledgment of fault or liability.

ARTICLE VIII - International Data Transfers

Where Peppermint Processes Customer Personal Data that is subject to the GDPR, UK GDPR, or FADP in a country that has not been the subject of an adequacy decision, the Parties agree that:

(a) the Module Two (Controller-to-Processor) SCCs are incorporated into and form part of this DPA, with the parameters set out in Annex D;

(b) for transfers from the United Kingdom, the UK Addendum is incorporated into this DPA, with the tables completed as set out in Annex D; and

(c) for transfers from Switzerland, the SCCs apply with the modifications identified by the Swiss Federal Data Protection and Information Commissioner, including that references to the GDPR are read as references to the FADP.

Where a Subprocessor hosts Customer Personal Data pursuant to a certification under the EU-U.S. Data Privacy Framework, UK Extension, or Swiss-U.S. Data Privacy Framework, the Parties may rely on that certification as the transfer mechanism for the relevant Processing in lieu of the SCCs, for so long as the certification remains valid.

ARTICLE IX - Audits and Information Rights

Peppermint will, upon Customer’s reasonable request and subject to appropriate confidentiality obligations, make available information necessary to demonstrate compliance with this DPA, including (when available) copies of the most recent SOC 2 report or equivalent third-party audit summary.

Where the information made available under this clause does not reasonably enable Customer to verify Peppermint’s compliance, Customer may, no more than once in any 12-month period and on at least 30 days’ prior written notice, conduct an audit of Peppermint’s Processing of Customer Personal Data. The audit will be conducted during Peppermint’s regular business hours, at Customer’s expense, and in a manner that does not unreasonably disrupt Peppermint’s operations. A Supervisory Authority may conduct an audit at any time required by law.

ARTICLE X - Return or Deletion of Customer Personal Data

On termination or expiry of the Agreement, Peppermint will, at Customer’s choice, return or delete all Customer Personal Data (including existing copies) within 90 days, except to the extent retention is required by Applicable Data Protection Laws or other applicable law. Encrypted backups will be overwritten in accordance with Peppermint’s standard backup retention schedule.

ARTICLE XI - HIPAA

This DPA does not create a Business Associate relationship under the Health Insurance Portability and Accountability Act of 1996 and its implementing regulations (HIPAA). Customer will not route Protected Health Information to Peppermint under the Agreement unless the Parties have entered into a separate Business Associate Agreement. Peppermint maintains a standard Business Associate Agreement and will enter into either its standard form or Customer’s reasonable form upon request.

ARTICLE XII - General

Order of precedence. In the event of any conflict between this DPA and the Agreement with respect to the Processing of Personal Data, this DPA controls. In the event of any conflict between this DPA and the SCCs or UK Addendum with respect to Processing to which they apply, the SCCs or UK Addendum control.

Liability. Each Party’s liability under this DPA is subject to the limitations of liability set out in the Agreement.

Term. This DPA takes effect on the effective date of the Agreement and remains in force for the duration of the Agreement and for so long as Peppermint Processes Customer Personal Data.

Governing law. This DPA is governed by the law specified in the Agreement, except that the SCCs and UK Addendum are governed by the laws specified in them.

Severability and assignment. If any provision of this DPA is held invalid or unenforceable, the remainder will continue in effect. This DPA may not be assigned except as permitted by the Agreement.

Annex A — Details of Processing

Subject matter. Provision of the Peppermint services to Customer under the Agreement.

Duration. The term of the Agreement and the period during which Peppermint retains Customer Personal Data in accordance with its retention policies and legal obligations.

Nature and purpose. Processing of Personal Data to reconcile sponsor payments, validate and generate invoices, identify unbilled or underpaid amounts, provide support, secure the service, and comply with legal obligations.

Categories of Personal Data. Identifiers (name, email address, account ID, IP address); customer records (contact and billing information); commercial information (invoices, remittances, payment records); internet or other electronic network activity (log data, usage events, device and browser information); professional information (company and job title); and content Customer authorizes Peppermint to access through Google Workspace APIs (Gmail message headers, bodies, and attachments).

Categories of Data Subjects. Customer’s personnel and authorized users; Customer’s counterparties (including sponsors, clinical research organizations, and sites); and other individuals whose Personal Data appears in content Customer uploads to or routes through the Peppermint services.

Sensitive data. Peppermint does not request sensitive Personal Data or special categories of Personal Data. Any sensitive Personal Data that appears in content Customer uploads to or routes through the Peppermint services is incidental to the services.

Frequency. Continuous for the duration of the Agreement.

Annex B — Technical and Organizational Measures

Peppermint implements the technical and organizational measures set out in its Security Policy, as updated from time to time, which include at minimum:

Hosting. Production data is hosted on Google Cloud in the United States only (Oregon region) under a company-wide location-restriction policy.

Encryption at rest. AES-256 encryption of all customer data; additional encryption of the production database and stored email using keys managed in Google Cloud KMS and rotated every 90 days; additional application-layer encryption of sensitive credentials.

Encryption in transit. TLS 1.2 or higher; plain HTTP is not served; database connections are restricted to a private network and accept only encrypted connections.

Access controls. Customer sign-in via Google or Microsoft single sign-on with the customer’s own multi-factor authentication; least-privilege staff access requiring multi-factor authentication, reviewed quarterly, and removed within 24 hours of a staff member leaving.

Logging and monitoring. All administrative and data-access activity is audit-logged, with logs retained for one year.

Backups. Backups run daily, are encrypted, and are retained for 30 days.

Certifications. SOC 2 is in progress; Peppermint will provide the report on request when available.

Annex C — Approved Subprocessors

Subprocessor: Google LLC (Google Cloud)
Service: Hosting, database, storage, and sign-in
Processing location: United States

Subprocessor: Google LLC (Google Workspace)
Service: Document storage
Processing location: United States

Subprocessor: Anthropic, PBC
Service: AI processing of documents and emails
Processing location: United States

Subprocessor: Temporal Technologies, Inc. (Temporal Cloud)
Service: Background job orchestration (job metadata only; no document content)
Processing location: United States

Subprocessor: GitHub, Inc.
Service: Source code and internal operations records
Processing location: United States

Subprocessor: Cloudflare, Inc.
Service: Website hosting and DNS
Processing location: United States

Annex D — Cross-Border Transfer Mechanism Parameters

Standard Contractual Clauses — Module Two (Controller to Processor).

Clause 7 (Docking clause): does not apply.

Clause 9 (Use of sub-processors): Option 2 (general written authorization). Peppermint will provide at least 30 days’ prior notice of changes to the list of Subprocessors.

Clause 11 (Redress): the optional independent dispute resolution body language does not apply.

Clause 17 (Governing law): the laws of Ireland.

Clause 18 (Choice of forum and jurisdiction): the courts of Ireland.

Annex I.A (List of Parties): the data exporter is Customer; the data importer is Peppermint. Contact details and signatures are those set out in the Agreement and the signature block of this DPA.

Annex I.B (Description of transfer): as set out in Annex A to this DPA.

Annex I.C (Competent supervisory authority): the Irish Data Protection Commission.

Annex II (Technical and organizational measures): as set out in Annex B to this DPA.

Annex III (List of sub-processors): as set out in Annex C to this DPA.

UK International Data Transfer Addendum. Table 1 (Parties): as set out in the Agreement and the signature block of this DPA. Table 2 (Selected SCCs, Modules and Selected Clauses): the Module Two SCCs incorporated under this DPA. Table 3 (Appendix Information): as set out in Annexes A, B, and C to this DPA. Table 4 (Ending this Addendum when the Approved Addendum Changes): neither Party may end the Addendum under Section 19 of the Approved Addendum.

AI Output Rider to the Peppermint Master Subscription Agreement

Last updated October 7, 2026

This AI Output Rider (this “Rider”) is published by Peppermint, Inc. (“Peppermint”) and forms part of the Peppermint Master Subscription Agreement between Peppermint and each customer that has entered into an Order Form with Peppermint (“Customer”) (such agreement, as amended, restated or supplemented from time to time, together with the Terms and Conditions, all Order Forms and other addenda or riders thereto, the “Agreement”). This Rider is incorporated by reference into the Agreement pursuant to Section 2.6 of the Terms and Conditions and applies to Customer’s use of any AI Feature. Capitalized terms used but not defined herein have the meanings given in the Agreement.

1. Definitions.

For purposes of this Rider: (a) “AI Feature” means any functionality of the Peppermint Product that generates, classifies, extracts, summarizes, ranks or otherwise transforms information using machine learning, large language models, generative AI or other artificial intelligence techniques, whether developed by Peppermint or licensed from a Third-Party Model Provider; (b) “AI Output” means any content, classification, recommendation, extraction, prediction, score, summary or other result generated by an AI Feature in response to Inputs, including any Inputs from a Pilot; (c) “Input” means any Customer Materials, prompt, instruction, data, document or other material submitted by Customer or its Users to an AI Feature; and (d) “Third-Party Model Provider” means any third party whose foundation model, hosted inference service or other AI technology is used by Peppermint to provide any AI Feature.

2. Nature of AI Features; No Guarantee of Accuracy.

Customer acknowledges and agrees that AI Features are probabilistic and non-deterministic in nature. AI Output may (a) contain errors, omissions, biases or so-called “hallucinations” (content that appears authoritative but is inaccurate or fabricated), (b) vary between requests even where the Input is identical, (c) reflect limitations or biases of underlying training data or Third-Party Model Providers, and (d) become outdated as the underlying models are retrained, replaced or deprecated. Peppermint does not guarantee, and expressly disclaims any representation or warranty regarding, the accuracy, reliability, completeness, currency, non-infringement or fitness for any particular purpose of any AI Output.

3. Human Review; Customer Responsibility.

Customer will (a) treat AI Output as decision-support material and not as the sole basis for any decision, (b) independently verify AI Output through qualified human review before taking any action or making any statement in reliance on it, in particular where the action or statement may affect (i) invoicing, coding, billing, reimbursement, tax or accounting matters, (ii) regulatory or compliance filings, (iii) clinical, medical or patient-safety determinations, (iv) legal rights or obligations of any person, or (v) any employment, credit or benefits decision, and (c) remain solely responsible for all decisions, actions and omissions taken on the basis of AI Output. AI Output does not constitute legal, medical, tax, financial, regulatory, clinical or other professional advice.

4. Restrictions on Use.

Customer will not, and will not permit any User or third party to: (a) use any AI Feature or AI Output for any purpose prohibited under the Agreement or applicable law, including any purpose that would violate HIPAA, applicable data-protection laws or applicable AI-specific laws or regulations (including the EU AI Act, where applicable); (b) use any AI Feature or AI Output to develop, train, benchmark or improve any competing artificial intelligence model, product or service; (c) circumvent, disable or interfere with any technical or contractual limitations of AI Features, including rate limits, content filters or safety systems; (d) submit as Input any Protected Health Information, personal data, Confidential Information or other sensitive information in a manner not authorized under the Agreement, the DPA or (as applicable) the BAA; or (e) represent AI Output as human-generated where doing so is misleading in context or prohibited by applicable law.

5. Customer Materials; Model Training.

Peppermint will not use any personally identifiable information contained in Customer Materials, Inputs, Protected Health Information , to train, fine-tune, validate or improve any machine learning model that is generally available to third parties. Peppermint will not disclose such materials to any Third-Party Model Provider except as strictly necessary to provide the AI Feature to Customer and subject to appropriate contractual protections, including confidentiality obligations and commitments that the Third-Party Model Provider will not use such materials to train its own models. As further described in Section 4.3 of the Terms and Conditions, Peppermint may use aggregated, anonymized and de-identified data derived from use of AI Features to train, develop, validate and improve its own machine learning models and other AI functionality.

6. Third-Party Model Providers.

Peppermint may use Third-Party Model Providers to power all or part of certain AI Features. Peppermint will impose confidentiality and data-protection obligations on each Third-Party Model Provider that are, taken as a whole, consistent with Peppermint’s corresponding obligations to Customer under the Agreement. Each Third-Party Model Provider imposes its own acceptable-use policies and technical limitations, and Peppermint is not responsible for changes made by Third-Party Model Providers, including deprecation of models, changes to safety filters or changes to output quality. Peppermint may substitute Third-Party Model Providers or models from time to time without notice, provided that the substitution does not materially degrade the functionality of the Peppermint Product taken as a whole.

7. Regulatory Compliance; Prohibited Deployments.

Customer is solely responsible for determining whether any use of AI Features or AI Output complies with applicable laws, regulations, industry standards, sponsor requirements, IRB requirements and contractual obligations, including HIPAA, applicable state privacy laws and applicable AI-specific laws and regulations. Customer will not deploy any AI Feature or AI Output as, or as a component of, any “high-risk” AI system under the EU AI Act, or in any use case classified as unacceptable-risk thereunder, without Peppermint’s prior written consent. Customer will comply with all Peppermint acceptable-use, safety and transparency guidelines applicable to AI Features that are made available to Customer.

8. Disclaimer; Sole and Exclusive Remedy.

TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW, PEPPERMINT AND ITS LICENSORS DISCLAIM ALL REPRESENTATIONS, WARRANTIES AND CONDITIONS, WHETHER EXPRESS, IMPLIED OR STATUTORY, WITH RESPECT TO AI FEATURES AND AI OUTPUT, INCLUDING ANY WARRANTIES OF ACCURACY, MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, NON-INFRINGEMENT, QUIET ENJOYMENT AND ANY WARRANTIES ARISING FROM COURSE OF DEALING OR USAGE OF TRADE. AI FEATURES AND AI OUTPUT ARE PROVIDED “AS IS” AND “AS AVAILABLE”. NEITHER THE PEPPERMINT PERFORMANCE WARRANTY UNDER SECTION 6.2 OF THE TERMS AND CONDITIONS NOR THE PEPPERMINT IP INDEMNITY UNDER SECTION 7.1 THEREOF APPLIES TO ANY CLAIM ARISING OUT OF, OR TO THE EXTENT ATTRIBUTABLE TO, AN AI FEATURE OR AI OUTPUT, INCLUDING ANY CLAIM THAT AI OUTPUT INFRINGES OR MISAPPROPRIATES ANY INTELLECTUAL PROPERTY OR OTHER RIGHT OF ANY THIRD PARTY. CUSTOMER’S SOLE AND EXCLUSIVE REMEDY FOR ANY DISSATISFACTION WITH AI FEATURES OR AI OUTPUT IS TO DISCONTINUE USE OF THE AFFECTED AI FEATURE.

9. Indemnity by Customer.

Customer will defend, indemnify and hold harmless Peppermint and its affiliates, and their respective directors, officers, employees and agents, from and against any and all third-party claims, damages, losses, liabilities, costs and expenses (including reasonable attorneys’ fees) arising out of or relating to (a) Inputs submitted by Customer or its Users, (b) Customer’s or any User’s use of, or reliance on, any AI Output, (c) any decision, action or omission taken on the basis of AI Output, and (d) any breach by Customer of Section 3, Section 4 or Section 7 of this Rider.

10. Modification of this Rider.

Peppermint reserves the right, in its sole discretion and at any time, to modify this Rider by publishing an updated version at the URL referenced in the Agreement (or at such successor URL as Peppermint may designate) and providing Customer with notice of the modifications at least thirty (30) days before they take effect. Such notice may be given by email to Customer’s designated administrative contact, by posting a notice within the Peppermint Product, or by such other reasonable means as Peppermint may elect. It is Customer’s responsibility to review the modified Rider prior to its effective date. Customer’s continued use of any AI Feature on or after the effective date of the modifications will constitute Customer’s acceptance of the modified Rider. If Customer does not agree to the modifications, Customer’s sole remedy is to cease using the affected AI Feature.

11. Precedence.

This Rider forms an integral part of the Agreement. In the event of any conflict or inconsistency between this Rider and any other part of the Agreement (including the Terms and Conditions and any Order Form) with respect to AI Features or AI Output, this Rider will control. In all other respects, the Agreement remains in full force and effect.