AWS Marketplace End User License Agreement

Last Updated: September 24, 2026 Effective Date: Upon subscription through AWS Marketplace Version: mDecide Platform AWS Marketplace EULA (incorporating DPA v4.3)

This page reproduces the agreement for reading and reference. The version published on the Legal tab of our AWS Marketplace listing is the authoritative one; if the two ever differ, the Marketplace version governs.

This AWS Marketplace End User License Agreement (this “EULA”) is a binding agreement between metricsIQ, LLC, a Colorado limited liability company (“metricsIQ,” “we,” or “us”), and the customer that subscribes to the mDecide Platform through AWS Marketplace (“Customer” or “you”). It governs Customer’s access to and use of the mDecide Platform — metricsIQ’s agentic AI decision operations, security, and governance platform — and any related professional services (including any Proof of Value engagement), in each case ordered through AWS Marketplace by private offer or public offer (each, an “Order”). The mDecide Platform is provided as single-tenant software-as-a-service hosted by metricsIQ.

BY SUBSCRIBING TO, ACCESSING, OR USING THE MDECIDE PLATFORM THROUGH AWS MARKETPLACE, CUSTOMER ACKNOWLEDGES THAT IT HAS READ, UNDERSTOOD, AND AGREES TO BE BOUND BY THIS EULA AS OF THE DATE OF SUBSCRIPTION (THE “EFFECTIVE DATE”). THE INDIVIDUAL ACCEPTING THIS EULA REPRESENTS AND WARRANTS THAT THEY ARE AUTHORIZED TO BIND CUSTOMER. IF CUSTOMER DOES NOT AGREE, CUSTOMER MUST NOT SUBSCRIBE TO, ACCESS, OR USE THE MDECIDE PLATFORM.

Neither Amazon Web Services, Inc. nor any of its affiliates (collectively, “AWS”) is a party to this EULA, and AWS has no obligations or liability under it.

1. Definitions

Capitalized terms have the meanings given where they first appear or as set forth below.

“Adaptive Ontology” — metricsIQ’s proprietary methodology and technology for establishing shared business context across data sources, systems, AI agents, and Decision Materials, enabling contextual decision-making within the mDecide Platform.

“Agent” — an autonomous or semi-autonomous AI software component deployed on the mDecide Platform that performs tasks, generates analysis, produces recommendations, or executes actions within a Decision Value Loop and its supporting Workstreams using specified tools and data sources.

“Authorized Users” — Customer’s employees, contractors, and agents who are authorized by Customer to access the mDecide Platform under this EULA and who are bound by obligations of confidentiality and data protection no less restrictive than those in this EULA.

“AWS Marketplace” — the online store operated by AWS through which Customer subscribes to the mDecide Platform and related services.

“AWS Marketplace Terms” — the AWS Customer Agreement, AWS Marketplace terms, and related AWS policies that govern the transaction, billing, and payment for the Order between Customer and AWS.

“Confidential Information” – any non-public information disclosed by one Party (the “Disclosing Party”) to the other (the “Receiving Party”), including but not limited to technical data, business information, customer lists, pricing, and trade secrets, whether disclosed orally, in writing, or by any other means. Confidential Information does not include information that: (a) is or becomes publicly available through no breach of this Agreement; (b) was rightfully received by the Receiving Party without confidentiality obligations prior to disclosure; or (c) is independently developed without use of the Disclosing Party’s Confidential Information.

“Customer Data” — electronic data and content submitted by or on behalf of Customer or its Authorized Users to the mDecide Platform, and any Decision Data and Decision Materials derived from such data.

“Decision Data” — data generated, processed, or output by the mDecide Platform in the course of executing Decision Value Loops for Customer, including decision recommendations, analyses, and workflow outputs.

“Decision Materials” — configurations, decision workflows, Decision Value Loops, Agent configurations, and other artifacts created by or for Customer within the mDecide Platform using its standard configuration capabilities.

“Decision Packs” — pre-defined combinations of Decision Value Loops, Workstreams, Agents, tools, and AI models provided within the mDecide Platform for common, vertical-specific, high-impact, recurring decisions.

“Decision Value Loop” — a repeatable cycle of Sense → Analyze → Decide → Act → Learn, executed through the coordination of Agents and human decision-makers on the mDecide Platform. “Documentation” — the user guides, technical manuals, API documentation, release notes, and other materials made available by metricsIQ describing the features, functions, and use of the mDecide Platform, including any materials referenced in the AWS Marketplace product listing. “Elected Model” — any third-party AI model that metricsIQ makes available through the mDecide Platform as an optional feature that operates only if Customer elects to enable or use it, and that the applicable model provider conditions on acceptance of that provider’s own terms. Elected Models include models made available by Anthropic, PBC, including but not limited to Fable 5. No Elected Model is enabled by default, and Elected Models are identified as such in the Documentation or in the mDecide Platform.

“Elected Model Terms” — the terms of service, acceptable use policy, usage policies, and other terms that the provider of an Elected Model requires users of that Elected Model to accept, as identified by metricsIQ in the Documentation or in the mDecide Platform at or before the point of enablement, in each case as they may be updated by that provider from time to time.

“Highly Sensitive Information” — (a) special categories of personal data or sensitive personal data as defined under applicable Data Protection Law, including Article 9 of EU Regulation 2016/679 (GDPR); (b) protected health information regulated by the Health Insurance Portability and Accountability Act (HIPAA); (c) payment card data subject to PCI-DSS; and (d) information subject to the Children’s Online Privacy Protection Act (COPPA) or the Gramm-Leach-Bliley Act (GLBA). “mDecide Platform” — metricsIQ’s hosted agentic AI decision operations, security, and governance platform, including all Platform Components, Decision Packs, and Documentation, as ordered through AWS Marketplace.

“metricsIQ Materials” — all materials, methodologies, know-how, templates, and other proprietary items made available by metricsIQ in connection with the mDecide Platform, other than Customer Data.

“Order” — a private offer or public offer for the mDecide Platform or related professional services accepted by Customer through AWS Marketplace, including the associated product listing, pricing dimensions, subscription term, and usage limits.

“Platform Components” — all software, code, container images, configuration files, AI models, agent architectures, prompt templates, orchestration logic, APIs, user interfaces, and other technical components comprising the mDecide Platform.

“Data Protection Law” — all laws and regulations applicable to the processing of personal data under this EULA, including GDPR, the UK GDPR, and the California Consumer Privacy Act (CCPA) as amended.

“Workstream” — a coordinated sequence of tasks performed by Agents and human decision-makers in support of a Decision Value Loop.

2. License Grant

2.1 Grant

Subject to Customer’s compliance with this EULA and payment of all applicable fees through AWS Marketplace, metricsIQ grants Customer a non-exclusive, non-transferable (except as permitted in Section 15.5), non-sublicensable, revocable, limited right during the subscription term to access and use the mDecide Platform, and to permit its Authorized Users to do so, solely for Customer’s internal business purposes and within the scope, usage limits, and managed-entity counts specified in the applicable Order.

Customer may use the mDecide Platform only: (a) in support of the internal operations of Customer and its affiliates; (b) in connection with Customer’s and its affiliates’ products and services, but not as a stand-alone product or service offered to third parties; and (c) in connection with Customer’s interactions with its own users.

2.2 Delivery Model

The mDecide Platform is provided as single-tenant SaaS hosted and operated by metricsIQ in metricsIQ’s cloud environment on AWS. metricsIQ is responsible for provisioning, maintaining, and making the mDecide Platform available, and will provide the access credentials, keys, and endpoints necessary for Customer to access the mDecide Platform following subscription.

2.3 Authorized Users

Customer may permit its Authorized Users to access the mDecide Platform, provided Customer ensures each Authorized User complies with this EULA. Customer is responsible for all acts and omissions of its Authorized Users, affiliates, and contractors as if they were Customer’s own, and any breach by them is deemed a breach by Customer. The number of Authorized Users and the managed-entity counts shall not exceed the limits specified in the applicable Order or Documentation.

2.4 Reservation of Rights

metricsIQ retains all right, title, and interest in and to the mDecide Platform and metricsIQ Materials. All rights not expressly granted in this EULA are reserved by metricsIQ. No title or ownership is transferred to Customer under this EULA.

3. License Restrictions

Customer shall not, and shall not permit any Authorized User or third party to:

• (a) copy, modify, adapt, translate, or create derivative works of the mDecide Platform or any Platform Components;
• (b) reverse engineer, decompile, disassemble, or otherwise attempt to derive the source code, algorithms, data structures, or underlying ideas of the mDecide Platform, except to the extent this restriction is prohibited by applicable law;
• (c) access, inspect, copy, or extract container images, configuration files, prompt templates, agent architectures, orchestration logic, or other Platform Components beyond the authorized user interfaces and APIs;
• (d) sublicense, sell, resell, lease, rent, loan, distribute, or otherwise make the mDecide Platform available to any third party, or use it as a service bureau or application service provider;
• (e) use the mDecide Platform to build, develop, train, or enhance a competing product or service, or to perform competitive benchmarking or analysis;
• (f) remove, alter, or obscure any proprietary notices, labels, trademarks, or branding on the mDecide Platform or Documentation, except through documented configuration capabilities;
• (g) exceed the authorized number of users, managed-entity counts, usage limits, or scope of use specified in the applicable Order;
• (h) circumvent or attempt to circumvent any security measures, access controls, or usage limitations of the mDecide Platform, or perform penetration, vulnerability, or other security testing on the mDecide Platform or metricsIQ’s systems without metricsIQ’s prior written consent;
• (i) use the mDecide Platform in violation of applicable laws or regulations or the terms of this EULA or the applicable Order; or
• (j) input or process data that violates applicable laws, infringes third-party rights, or constitutes Highly Sensitive Information except as expressly permitted under Section 6.2.

4. Intellectual Property

4.1 metricsIQ Ownership

The mDecide Platform — including all Platform Components; the Adaptive Ontology, Decision Value Loop, and Workstream frameworks; Agent architectures; AI models; algorithms; user interfaces; APIs; Documentation; and all related intellectual property — and all metricsIQ Materials are and remain the exclusive property of metricsIQ. The mDecide Platform and metricsIQ Materials are metricsIQ’s Confidential Information.

4.2 Customer Data

As between the parties, Customer owns all right, title, and interest in and to Customer Data, including Decision Data and Decision Materials. Customer grants metricsIQ a non-exclusive, worldwide, royalty-free right to host, copy, process, transmit, and display Customer Data solely to provide, secure, and support the mDecide Platform and related services and to comply with law. Customer represents that it has all rights, consents, and notices necessary to provide Customer Data to metricsIQ for these purposes.

4.3 Decision Data, Decision Materials, and Aggregated Data

As between the parties, Customer owns all intellectual property rights in and to Decision Data and Decision Materials generated through Customer’s use of the mDecide Platform, and metricsIQ retains no ownership interest in Decision Materials specific to Customer. Customer grants metricsIQ a non-exclusive, perpetual, irrevocable, royalty-free, worldwide license to use Decision Data and Decision Materials in aggregated, anonymized, and de-identified form to operate, maintain, improve, benchmark, and develop the mDecide Platform and metricsIQ’s methodologies, services, and products, provided that such use does not identify Customer or disclose Customer’s Confidential Information.

metricsIQ may also collect and use configuration, performance, usage, telemetry, and operational data relating to the mDecide Platform for the same purposes. This Section 4.3 is subject to the DPA (Exhibit A) and applicable Data Protection Law with respect to any personal data, including metricsIQ’s obligations as a Service Provider under the CCPA.

4.4 Feedback

Any feedback, suggestions, or ideas Customer provides regarding the mDecide Platform are non-confidential and may be used by metricsIQ without restriction or compensation, provided metricsIQ does not identify Customer as the source. metricsIQ has no obligation to implement any feedback.

4.5 Open Standards

The mDecide Platform may include interoperability support through emerging open standards, potentially including MCP (Model Context Protocol), A2A (Agent-to-Agent), and OASF (Open Agent Service Framework). Customer’s use of open-standard interfaces does not grant Customer any rights to metricsIQ’s proprietary implementations of those standards.

4.6 Third-Party and Open Source Components

The mDecide Platform includes third-party software components, including open source software, which are licensed under their own terms. metricsIQ will make available on request a current list of those components and their licenses. Those terms govern Customer’s use of the components and, to the extent they conflict with this EULA as to a component, they control for that component. Third-party and open source components that metricsIQ has incorporated into the mDecide Platform are part of the mDecide Platform for the purposes of Sections 12.1 and 13.1, and are not “third-party products” within the meaning of Sections 12.1, 13.1 or 13.2.

5. AI-Specific Terms

Customer acknowledges that the mDecide Platform incorporates AI systems, including Agents and third-party AI models (for example, models accessed through Amazon Bedrock and, where Customer so elects, Elected Models), and that AI is an evolving field whose outputs cannot be fully predicted.

The mDecide Platform generates recommendations, analyses, and other outputs (“Outputs”) to assist human and Agent decision-making. Customer is solely responsible for evaluating Outputs and for all decisions and actions taken based on Outputs. Customer shall maintain appropriate human oversight and review of AI-driven processes and shall not rely on the mDecide Platform to make automated decisions that produce legal or similarly significant effects on individuals without appropriate safeguards and human oversight.

Outputs may be inaccurate, incomplete, or non-unique, and similar or identical Outputs may be generated for other customers. metricsIQ does not warrant the accuracy, reliability, or fitness of Outputs or of any third-party AI model, and Customer’s use of Outputs is at Customer’s own risk. metricsIQ will not use Customer Data or Customer’s Confidential Information to train or fine-tune AI models without Customer’s express prior written authorization. metricsIQ’s use of aggregated, anonymized, and de-identified data as permitted under Section 4.3 is not restricted by the foregoing. Elected Third-Party Models; Customer Opt-In. Certain AI models are made available through the mDecide Platform only if Customer elects to use them, including models made available by Anthropic, PBC, including but not limited to Fable 5 (each, an “Elected Model”). The provider of an Elected Model requires that users of that model accept the Elected Model Terms as a condition of access. Accordingly, if Customer or any Authorized User enables or uses an Elected Model, Customer thereby accepts the applicable Elected Model Terms, agrees to comply with them, and agrees to cause its Authorized Users to comply with them, in each case with respect to that Elected Model. Continued use of an Elected Model constitutes Customer’s ongoing acceptance of the Elected Model Terms then in effect. If Customer does not agree to the applicable Elected Model Terms, Customer must not enable or use, and must ensure that its Authorized Users do not enable or use, that Elected Model. Customer is not required to use any Elected Model, and the core functionality of the mDecide Platform does not depend on Customer doing so.

The Elected Model Terms are between Customer and the applicable model provider. metricsIQ is not a party to the Elected Model Terms, does not control them, and makes no representation or warranty regarding them or the provider’s performance under them. Use of an Elected Model may require that prompts, inputs, and associated Customer Data be transmitted to and processed by the applicable model provider or its designated infrastructure, which may be outside the environment described in Section 2.2 and in Annex III to the DPA. By enabling or using an Elected Model, Customer instructs and authorizes metricsIQ to transmit such data to that provider for that purpose, authorizes that provider as a Sub-processor under Section 5.1 of the DPA solely as to that Elected Model, and waives the advance-notice and objection periods in Section 5.3 of the DPA solely as to that provider. metricsIQ’s commitment in the preceding paragraph regarding training and fine-tuning applies to metricsIQ’s own use of Customer Data and does not govern the provider’s processing of data submitted through an Elected Model, which is governed by the Elected Model Terms.

Elected Models are third-party products used at Customer’s election and risk. Notwithstanding Section 12.1, Elected Models and their Outputs are provided “AS IS,” and metricsIQ makes no warranty of any kind with respect to them. Claims arising from an Elected Model, its Outputs, or Customer’s or an Authorized User’s use of an Elected Model are excluded from metricsIQ’s obligations under Section 13.1 in accordance with Section 13.2, and Customer’s indemnification obligations under Section 13.3 extend to third-party claims arising from Customer’s or an Authorized User’s use of an Elected Model or breach of the applicable Elected Model Terms. metricsIQ may suspend, modify, or discontinue the availability of any Elected Model at any time, including where the provider changes, suspends, or terminates the Elected Model or the Elected Model Terms, and no such change constitutes a material degradation of the core functionality of the mDecide Platform for purposes of Section 8.

6. Customer Obligations

6.1 Acceptable Use

Customer shall use the mDecide Platform only for lawful purposes and in compliance with all applicable laws and the applicable Order. Customer shall not use the mDecide Platform to: (a) store or transmit infringing, illegal, or harmful content, or any malware; (b) engage in phishing, spamming, denial-of-service attacks, or fraudulent activity; or (c) interfere with or disrupt the integrity or performance of the mDecide Platform or metricsIQ’s systems.

6.2 Highly Sensitive Information

Customer shall not submit Highly Sensitive Information to the mDecide Platform unless the applicable Order expressly provides that the mDecide Platform is approved for such use. metricsIQ has no responsibility or liability for Highly Sensitive Information submitted where the mDecide Platform is not approved for it.

6.3 Account Security

Customer is responsible for maintaining the security and confidentiality of all access credentials, API keys, and authentication tokens associated with the mDecide Platform, and for all activity occurring under its accounts. Customer shall promptly notify metricsIQ of any suspected unauthorized access or security breach.

6.4 Export and Sanctions Compliance

Customer shall comply with all applicable export control laws, sanctions, and regulations, including the U.S. Export Administration Regulations and sanctions administered by OFAC. Customer represents that it is not located in, and will not access or use the mDecide Platform from, any country or territory subject to comprehensive U.S. sanctions, and that it is not a person with whom U.S. persons are prohibited from dealing.

6.5 High-Risk Activities

The mDecide Platform is not designed or developed for use in high-risk or hazardous environments requiring fail-safe performance, including the operation of nuclear facilities, aircraft navigation or control systems, air traffic control, life support or other medical systems, or weapons systems, or for any other use in which failure of the mDecide Platform or reliance on an Output could lead to death, personal injury, or severe physical or environmental damage (“High-Risk Activities”). Customer will not use the mDecide Platform for High-Risk Activities. metricsIQ disclaims any express or implied warranty of fitness for High-Risk Activities.

7. Service Availability and Support

7.1 Availability

metricsIQ will use commercially reasonable efforts to make the mDecide Platform available and to maintain its performance, excluding scheduled maintenance, emergency maintenance, and events beyond metricsIQ’s reasonable control. metricsIQ does not currently offer a committed uptime service level or service credits for the mDecide Platform. If the parties agree to a defined service level, it will be set forth in a separate written service level agreement or the applicable Order, which will control over this Section 7.1 to the extent of any conflict.

7.2 Support

metricsIQ will provide technical support for the mDecide Platform through the support channels published in the AWS Marketplace product listing (currently a support email and support portal), during metricsIQ’s standard business hours. Additional support terms, if any, may be described in the applicable Order.

7.3 Maintenance

metricsIQ will use reasonable efforts to provide advance notice of scheduled maintenance.

Emergency maintenance may be performed without advance notice to address critical security or stability issues.

8. Updates and Platform Changes

metricsIQ may release updates, patches, enhancements, or new versions of the mDecide Platform from time to time, which will be applied automatically to the hosted environment. metricsIQ may modify features of the mDecide Platform, provided it will not materially degrade the core functionality of the mDecide Platform during the subscription term. metricsIQ may discontinue a materially degraded or end-of-life feature upon reasonable notice.

9. Data Handling and Data Protection

9.1 Use of Customer Data

metricsIQ will access and use Customer Data only as necessary to provide, secure, and support the mDecide Platform and related services, to comply with law, and as otherwise permitted by this EULA (including Section 4.3). metricsIQ will not sell Customer Data.

9.2 Data Protection Addendum

To the extent metricsIQ processes personal data on Customer’s behalf in connection with the mDecide Platform, such processing is governed by the metricsIQ Data Processing Addendum (v4.3) attached as Exhibit A (the “DPA”), which is incorporated into and forms part of this EULA. In the event of a conflict between the DPA and this EULA regarding the processing of personal data, the DPA controls.

9.3 Security

metricsIQ will implement and maintain commercially reasonable and industry-standard technical and organizational security measures designed to protect the mDecide Platform and Customer Data against unauthorized access, disclosure, alteration, and loss, including encryption in transit and at rest, access controls, audit logging of security-relevant events, and incident detection and response. metricsIQ will make available, on Customer’s reasonable request, summary information regarding its security practices (for example, third-party audit attestations or security overviews).

9.4 Security Incident Notification

metricsIQ will notify Customer without undue delay after becoming aware of a confirmed unauthorized access to, or unauthorized loss, use, or disclosure of, Customer Data in metricsIQ’s possession or control (a “Security Incident”), will investigate the Security Incident, and will take reasonable steps to mitigate it. metricsIQ’s notification is not an acknowledgement of fault or liability.

9.5 Data Portability

During the active subscription term and for thirty (30) days following expiration or termination, metricsIQ will make Decision Data and Decision Materials available for export in a commercially standard, machine-readable format, and will provide reasonable assistance with export. Customer should request assisted export no later than thirty (30) days before the effective date of expiration or termination.

9.6 Data Deletion

Following expiration or termination and completion of export (or expiration of the thirty (30) day post-termination export period), metricsIQ will delete Customer Data, Decision Data, and Decision Materials from the mDecide Platform within thirty (30) days, except to the extent retention is required by law or the data cannot reasonably be deleted (in which case it remains subject to the confidentiality and security terms of this EULA). metricsIQ will certify deletion in writing on Customer’s request.

10. Fees, Billing, and Taxes

10.1 Fees and Billing Through AWS Marketplace

Fees for the mDecide Platform and any related services are set forth in the applicable Order and are billed and collected by AWS through AWS Marketplace under the AWS Marketplace Terms.

Customer pays AWS, and AWS remits to metricsIQ. metricsIQ does not separately invoice or collect payment for amounts transacted through AWS Marketplace, and Customer shall not be offered or use any alternative means of payment for those amounts. Fees are billed on a monthly basis and are non-refundable, including upon termination or cancellation and for any unused portion of a subscription month, except as required by the AWS Marketplace Terms.

10.2 Taxes

Fees are exclusive of taxes. Responsibility for calculating, collecting, and remitting taxes on the transaction is allocated between Customer, AWS, and metricsIQ in accordance with the AWS Marketplace Terms and applicable law. Customer is responsible for any applicable taxes other than taxes based on metricsIQ’s net income.

10.3 No Refunds

The mDecide Platform is provided on a non-refundable basis. metricsIQ does not provide refunds, credits, or pro-rated fees for terminated or cancelled subscriptions, for the month in which a cancellation takes effect, or for any unused portion of a subscription month. Customer may cancel its subscription at any time as described in Section 11.2. Correction of billing errors and any adjustments required by the AWS Marketplace Terms will be processed through AWS Marketplace. Customer should direct billing questions regarding AWS-processed charges to AWS in the first instance, and should notify metricsIQ in writing of any billing dispute within thirty (30) days of the relevant charge.

11. Term and Termination

11.1 Term

This EULA takes effect on the Effective Date and continues on a month-to-month basis until terminated. The subscription renews automatically for successive one-month periods, each billed through AWS Marketplace, unless and until terminated in accordance with Section 11.2 or 11.3.

11.2 Termination for Convenience

Customer may terminate its subscription for convenience at any time, through AWS Marketplace or its account settings. Termination for convenience takes effect on the last day of the calendar month in which Customer terminates, and the subscription and this EULA remain in effect through that date. Customer remains responsible for the fees for that final month, and, consistent with Section 10.3, no refunds, credits, or pro-rated fees apply.

11.3 Termination for Cause

Either party may terminate this EULA if the other party materially breaches it and fails to cure the breach within thirty (30) days after written notice. Without limiting the foregoing, metricsIQ may terminate this EULA upon fifteen (15) days’ written notice if Customer breaches the license restrictions in Section 3 and fails to cure the breach within that fifteen (15) day period, and may terminate this EULA immediately upon written notice for a breach of Section 3 that is not capable of cure.

11.4 Suspension

metricsIQ may suspend Customer’s or an Authorized User’s access to the mDecide Platform, in whole or in part, immediately upon notice if metricsIQ reasonably determines that (a) such use poses a material risk to the security or operation of the mDecide Platform or the data of any other customer; (b) such use violates Section 3 or Section 6 or is illegal or fraudulent; (c) Customer has submitted Highly Sensitive Information to a non-approved environment; or (d) AWS has notified metricsIQ of non-payment of undisputed amounts more than thirty (30) days past due. metricsIQ will limit any suspension as reasonably necessary and will restore access promptly upon resolution.

11.5 Continuity of Support

If metricsIQ removes the mDecide Platform from AWS Marketplace, or AWS disables metricsIQ as a seller, metricsIQ will continue to make the mDecide Platform available to existing subscribers and to provide support during any wind-down or post-removal period required by the AWS Marketplace Terms (currently at least ninety (90) days), on terms at least as favorable as those in effect immediately before removal.

11.6 Effect of Termination

Upon expiration or termination: (a) Customer’s right to access and use the mDecide Platform ceases and access may be disabled; (b) Customer shall cease all use of the mDecide Platform and retain no copies of Platform Components or metricsIQ Materials; and (c) export and deletion of Customer Data, Decision Data, and Decision Materials are governed by Sections 9.5 and 9.6.

11.7 Survival

Sections 1 (Definitions), 3 (License Restrictions), 4 (Intellectual Property), 5 (AI-Specific Terms), 9.4–9.6 (Security Incident, Portability, Deletion), 10 (Fees, Billing, and Taxes) as to accrued amounts, 11.6–11.7, 12 (Warranties and Disclaimers), 13 (Indemnification), 14 (Limitation of Liability), and 15 (General Provisions) survive expiration or termination of this EULA.

12. Warranties and Disclaimers

12.1 Limited Warranty

metricsIQ warrants that, during the subscription term, the mDecide Platform will perform substantially in accordance with the Documentation, and that metricsIQ will provide the mDecide Platform and any related services using commercially reasonable skill and care. metricsIQ further warrants that, to its knowledge, the mDecide Platform (excluding Customer Data, third-party products, and Customer modifications or configurations) does not infringe any third-party intellectual property right. Customer must notify metricsIQ of any warranty claim within thirty (30) days of discovery. Customer’s exclusive remedy, and metricsIQ’s entire liability, for breach of the performance warranty is for metricsIQ to use commercially reasonable efforts to correct the non-conformity (or re-perform the affected services) and, if metricsIQ fails to do so within a reasonable time, for Customer to terminate its subscription in accordance with Section 11. Consistent with Section 10.3, no refunds or pro-rated fees apply.

12.2 Warranty Exclusions

The warranties in Section 12.1 do not apply to non-conformities arising from (a) use of the mDecide Platform in violation of this EULA or applicable law; (b) modifications not made by metricsIQ; (c) combination of the mDecide Platform with products, services, data, or methods not provided by metricsIQ; or (d) Customer Data or Customer’s configurations, specifications, or instructions.

12.3 Disclaimer

EXCEPT AS EXPRESSLY SET FORTH IN SECTION 12.1, THE MDECIDE PLATFORM AND ALL RELATED SERVICES AND OUTPUTS ARE PROVIDED “AS IS” AND “AS AVAILABLE.” METRICSIQ DISCLAIMS ALL OTHER WARRANTIES, EXPRESS OR IMPLIED, INCLUDING IMPLIED WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, AND NON-INFRINGEMENT, AND ANY WARRANTIES ARISING FROM COURSE OF DEALING OR USAGE OF TRADE. METRICSIQ DOES NOT WARRANT THAT THE MDECIDE PLATFORM WILL BE UNINTERRUPTED, SECURE, OR ERROR-FREE, THAT IT WILL MEET CUSTOMER’S REQUIREMENTS, OR THAT DEFECTS WILL BE CORRECTED. METRICSIQ DOES NOT WARRANT THE PERFORMANCE, ACCURACY, OR RELIABILITY OF ANY THIRD-PARTY AI MODEL OR SERVICE OR OF ANY OUTPUT.

13. Indemnification

13.1 metricsIQ Indemnification

METRICSIQ SHALL DEFEND CUSTOMER AGAINST ANY THIRD-PARTY CLAIM ALLEGING THAT THE MDECIDE PLATFORM (EXCLUDING CUSTOMER DATA, THIRD-PARTY PRODUCTS, AND ANY MODIFICATIONS OR COMBINATIONS NOT PROVIDED BY METRICSIQ) INFRINGES SUCH THIRD PARTY’S INTELLECTUAL PROPERTY RIGHTS, AND WILL INDEMNIFY CUSTOMER FOR AMOUNTS FINALLY AWARDED OR AGREED IN SETTLEMENT, PROVIDED CUSTOMER (A) PROMPTLY NOTIFIES METRICSIQ IN WRITING; (B) GRANTS METRICSIQ SOLE CONTROL OF THE DEFENSE AND SETTLEMENT; AND (C) PROVIDES REASONABLE COOPERATION. IF THE MDECIDE PLATFORM IS, OR IN METRICSIQ’S OPINION IS LIKELY TO BE, HELD INFRINGING, METRICSIQ MAY, AT ITS OPTION AND EXPENSE: (I) PROCURE THE RIGHT FOR CUSTOMER TO CONTINUE USING IT; (II) MODIFY OR REPLACE IT TO BE NON-INFRINGING WHILE REASONABLY COMPARABLE IN FUNCTIONALITY; OR (III) TERMINATE THE AFFECTED SUBSCRIPTION IN ACCORDANCE WITH SECTION 11 (WITH NO REFUND OR PRO-RATED FEES, CONSISTENT WITH SECTION 10.3). THIS SECTION 13.1 STATES METRICSIQ’S ENTIRE LIABILITY FOR INTELLECTUAL PROPERTY INFRINGEMENT.

13.2 Indemnification Exclusions

METRICSIQ HAS NO OBLIGATION UNDER SECTION 13.1 FOR CLAIMS ARISING FROM (A) CUSTOMER DATA, THIRD-PARTY PRODUCTS, OR CUSTOMER MATERIALS; (B) MODIFICATIONS TO THE MDECIDE PLATFORM NOT MADE BY METRICSIQ; (C) CUSTOMER’S SPECIFICATIONS, CONFIGURATIONS, OR INSTRUCTIONS; (D) COMBINATION OF THE MDECIDE PLATFORM WITH PRODUCTS, SERVICES, DATA, OR METHODS NOT PROVIDED BY METRICSIQ; OR (E) CUSTOMER’S CONTINUED USE AFTER NOTICE OF A POTENTIAL INFRINGEMENT OR AFTER A NON-INFRINGING ALTERNATIVE IS MADE AVAILABLE.

13.3 Customer Indemnification

CUSTOMER SHALL DEFEND AND INDEMNIFY METRICSIQ AGAINST THIRD-PARTY CLAIMS ARISING FROM (A) CUSTOMER’S BREACH OF SECTION 3 (LICENSE RESTRICTIONS) OR SECTION 6 (CUSTOMER OBLIGATIONS); (B) CUSTOMER DATA OR CUSTOMER’S MISUSE OF THE MDECIDE PLATFORM; (C) CUSTOMER’S PROVISION OF HIGHLY SENSITIVE INFORMATION TO A NON-APPROVED ENVIRONMENT; (D) CUSTOMER’S COMBINATION OF THE MDECIDE PLATFORM WITH NON-METRICSIQ PRODUCTS, SERVICES, DATA, OR METHODS; (E) CUSTOMER’S FAILURE TO MAINTAIN HUMAN OVERSIGHT OF AI-DRIVEN PROCESSES; OR (F) DECISIONS OR ACTIONS TAKEN BY CUSTOMER, ITS AUTHORIZED USERS, OR THIRD PARTIES BASED ON OUTPUTS OR THE MDECIDE PLATFORM.

13.4 Procedure

The indemnified party will give the indemnifying party prompt written notice of the claim (though delay excuses the indemnifying party only to the extent prejudiced), sole control of the defense and settlement (provided no settlement imposing liability or admission on the indemnified party is made without its consent), and reasonable cooperation at the indemnifying party’s expense.

13.5 Indemnification Cap

METRICSIQ’S TOTAL LIABILITY AND INDEMNIFICATION OBLIGATIONS UNDER SECTION 13.1 WILL NOT EXCEED THE FEES PAID OR PAYABLE FOR THE MDECIDE PLATFORM UNDER THE APPLICABLE ORDER DURING THE TWELVE (12) MONTHS PRECEDING THE CLAIM.

14. Limitation of Liability

14.1 Exclusion of Damages

EXCEPT FOR CUSTOMER’S PAYMENT OBLIGATIONS AND CUSTOMER’S INDEMNIFICATION OBLIGATIONS UNDER SECTION 13.3, AND TO THE MAXIMUM EXTENT PERMITTED BY LAW, NEITHER PARTY WILL BE LIABLE FOR ANY INDIRECT, INCIDENTAL, SPECIAL, CONSEQUENTIAL, OR PUNITIVE DAMAGES, OR FOR ANY LOSS OF PROFITS, REVENUE, DATA, GOODWILL, OR BUSINESS OPPORTUNITY, HOWEVER CAUSED AND UNDER ANY THEORY OF LIABILITY, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGES. IN NO EVENT WILL METRICSIQ BE LIABLE FOR DAMAGES ARISING FROM CUSTOMER’S RELIANCE ON OUTPUTS, DECISIONS MADE USING OUTPUTS, OR CUSTOMER’S FAILURE TO MAINTAIN HUMAN OVERSIGHT OF AI-DRIVEN PROCESSES.

14.2 Aggregate Cap

EXCEPT FOR CUSTOMER’S PAYMENT OBLIGATIONS AND CUSTOMER’S INDEMNIFICATION OBLIGATIONS UNDER SECTION 13.3, EACH PARTY’S TOTAL CUMULATIVE LIABILITY ARISING OUT OF OR RELATED TO THIS EULA WILL NOT EXCEED THE FEES PAID OR PAYABLE FOR THE MDECIDE PLATFORM UNDER THE APPLICABLE ORDER DURING THE TWELVE (12) MONTHS PRECEDING THE EVENT GIVING RISE TO THE LIABILITY. metricsIQ’S INTELLECTUAL-PROPERTY INDEMNIFICATION UNDER SECTION 13.1 IS SUBJECT TO THE CAP IN SECTION 13.5.

14.3 Exceptions

THE EXCLUSION OF DAMAGES IN SECTION 14.1 AND THE CAP IN SECTION 14.2 (INCLUDING THE INDEMNIFICATION CAP IN SECTION 13.5) DO NOT APPLY TO A PARTY’S FRAUD OR WILLFUL MISCONDUCT, FOR WHICH LIABILITY IS UNLIMITED TO THE EXTENT PERMITTED BY APPLICABLE LAW.

15. General Provisions

15.1 Relationship to AWS and Order of Precedence

This EULA is solely between metricsIQ and Customer. AWS is not a party to this EULA and has no liability or obligation under it; AWS’s sole role is as the marketplace and payment processor under the AWS Marketplace Terms. In the event of a conflict, the following order of precedence applies: (a) the DPA (as to processing of personal data); (b) the applicable Order; and (c) this EULA. The AWS Marketplace Terms govern the transaction, billing, and payment as between Customer and AWS.

15.2 Confidentiality

Each party will protect the other’s Confidential Information (including the mDecide Platform and metricsIQ Materials, and Customer Data) using at least reasonable care, will use it only to exercise rights and perform obligations under this EULA, and will not disclose it except to representatives with a need to know who are bound by confidentiality obligations at least as protective as those here. This obligation continues for three (3) years after termination, and for as long as the information remains a trade secret.

15.3 Governing Law, Dispute Resolution, and Venue

This EULA is governed by the laws of the State of Colorado, without regard to conflict-of-laws principles, and the United Nations Convention on Contracts for the International Sale of Goods does not apply. Before initiating legal proceedings, the parties will attempt in good faith to resolve any dispute through negotiation for thirty (30) days. If the dispute is not resolved, the state and federal courts located in Denver, Colorado have exclusive jurisdiction, and each party consents to that jurisdiction and venue.

15.4 Modifications

metricsIQ may update this EULA from time to time to reflect changes in the mDecide Platform, applicable law, or industry practice, and will provide at least sixty (60) days’ notice of material changes (for example, by posting an updated EULA to the AWS Marketplace product listing or the metricsIQ website). If Customer does not agree to a material change, Customer may terminate the affected Order before the change takes effect. Continued use after the effective date constitutes acceptance.

15.5 Assignment

Neither party may assign this EULA without the other party’s prior written consent (not to be unreasonably withheld), except that either party may assign it in its entirety, without consent, to an affiliate or in connection with a merger, acquisition, or sale of all or substantially all of its assets. Any other attempted assignment is void.

15.6 Export Compliance

Each party will comply with all applicable export control and sanctions laws, including the U.S. Export Administration Regulations and OFAC-administered sanctions, in connection with this EULA.

15.7 U.S. Government Users

The mDecide Platform is “commercial computer software” and its Documentation is “commercial computer software documentation” under FAR 12.212 and DFARS 227.7202. Use, duplication, and disclosure by U.S. Government end users are subject solely to the rights in this EULA.

15.8 Force Majeure

Neither party is liable for any delay or failure to perform (other than payment obligations) due to causes beyond its reasonable control, including acts of God, natural disasters, war, terrorism, civil unrest, labor disputes, governmental action, internet or utility failures, and failures of third-party hosting or AI service providers.

15.9 Publicity

Neither party will use the other’s name or marks in publicity without prior written consent.

15.10 Notices

Notices to metricsIQ must be sent to metricsIQ, LLC at its registered address. Notices to Customer may be sent to the email or account contact associated with the Order. Notices are effective on receipt.

15.11 No Third-Party Beneficiaries

This EULA creates no third-party beneficiary rights, except that the indemnified parties in Section 13 are intended beneficiaries of the applicable indemnity.

15.12 Severability; Waiver

If any provision is held unenforceable, it will be modified to the minimum extent necessary, and the remaining provisions remain in effect. A party’s failure to enforce any provision is not a waiver.

15.13 Entire Agreement

This EULA, together with the DPA and the applicable Order, is the entire agreement between the parties regarding the mDecide Platform and supersedes all prior or contemporaneous agreements, representations, and understandings regarding its subject matter. Any conflicting or additional terms in a Customer purchase order or similar document are rejected and of no effect.

15.14 Insurance

Each party will maintain, throughout the subscription term, insurance appropriate to its obligations under this EULA and to the nature and scale of its business, with insurers of good standing, including commercial general liability, professional liability or errors and omissions, and cyber liability cover. Each party will provide the other with a certificate of insurance on reasonable written request. This Section does not increase either party’s liability beyond the limits in Section 14.

15.15 Acceptance

This EULA is accepted electronically. By subscribing to the mDecide Platform through AWS Marketplace, Customer agrees to this EULA (including the Data Processing Addendum in Exhibit A) as of the Effective Date, and the individual accepting represents that they are authorized to bind Customer. No physical signature is required.

Exhibit A — Data Processing Addendum

metricsIQ Data Processing Addendum, Version 4.3 Incorporation note. This DPA is incorporated into and forms part of the EULA under Section 9.2. As used in this Exhibit A, references to “the Agreement” mean the EULA; references to a “SOW” mean the applicable Order; and references to the “Services” mean the mDecide Platform and any related services ordered through AWS Marketplace. In the event of a conflict between this DPA and the body of the EULA regarding the Processing of Personal Data, this DPA controls.

This Data Processing Addendum (“DPA”) applies when metricsIQ processes Personal Data on behalf of Customer in connection with the Services. metricsIQ, LLC is “metricsIQ” or “Processor” and Customer is “Customer” or “Controller.”

1. Definitions

“CCPA” means the California Consumer Privacy Act of 2018, as amended by the California Privacy Rights Act.

“Controller” means the entity that determines the purposes and means of Processing Personal Data. “Data Protection Laws” means all applicable laws relating to data protection and privacy, including GDPR, UK GDPR, CCPA, and other national implementing laws.

“Data Subject” means an identified or identifiable natural person to whom Personal Data relates. “GDPR” means the General Data Protection Regulation (EU) 2016/679.

“Personal Data” means any information relating to an identified or identifiable natural person that is processed by metricsIQ on behalf of Customer under the Agreement.

“Personal Data Breach” means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Personal Data.

“Processing” means any operation performed on Personal Data, including collection, recording, organization, storage, adaptation, retrieval, consultation, use, disclosure, combination, restriction, erasure, or destruction.

“Processor” means the entity that processes Personal Data on behalf of the Controller.

“Standard Contractual Clauses” or “SCCs” means the standard contractual clauses for the transfer of personal data to third countries approved by the European Commission.

“Sub-processor” means any third party engaged by metricsIQ to process Personal Data on behalf of Customer.

“UK GDPR” means the GDPR as incorporated into UK law by the Data Protection Act 2018.

2. Scope and Roles

2.1 Processing Scope

This DPA applies to the Processing of Personal Data as described in Annex I (Details of Processing).

2.2 Role of Parties

• (a) Customer is the Controller of Personal Data.
• (b) metricsIQ is the Processor of Personal Data, processing only on behalf of and under the instructions of Customer.
• (c) For purposes of the CCPA, metricsIQ is a “Service Provider” and Customer is a “Business.”

2.3 Customer Obligations

Customer represents and warrants that:

• (a) It has provided all necessary notices and obtained all necessary consents and authorizations required under Data Protection Laws for metricsIQ to process Personal Data as contemplated by this DPA;
• (b) It has the right to transfer Personal Data to metricsIQ for Processing;
• (c) Its instructions to metricsIQ will comply with Data Protection Laws; and
• (d) It has implemented appropriate technical and organizational measures to protect Personal Data under its control.

3. Processing Obligations

3.1 Processing Instructions

metricsIQ shall:

• (a) Process Personal Data only in accordance with Customer’s documented instructions, unless required by applicable law;
• (b) Inform Customer if, in metricsIQ’s opinion, an instruction infringes Data Protection Laws;
• (c) Not process Personal Data for any purpose other than providing the Services; and
• (d) Not sell Personal Data or use it for purposes other than the Services.

3.2 Processing Details

The subject matter, duration, nature, purpose, types of Personal Data, and categories of Data Subjects are described in Annex I.

3.3 Personnel

metricsIQ shall ensure that personnel authorized to process Personal Data: (a) are bound by confidentiality obligations; (b) process Personal Data only as instructed; and (c) receive appropriate training on data protection requirements.

4. Security Measures

4.1 Technical and Organizational Measures

metricsIQ shall implement appropriate technical and organizational measures to protect Personal Data, as described in Annex II (Security Measures). These measures include: (a) encryption of Personal Data in transit and at rest; (b) access controls and authentication measures; (c) regular security assessments and testing; (d) incident detection and response procedures; (e) business continuity and disaster recovery capabilities; and (f) employee security training.

4.2 Security Updates

metricsIQ may update security measures from time to time, provided that such updates do not materially decrease the overall security of the Services.

5. Sub-Processing

5.1 Authorization

Customer grants metricsIQ general authorization to engage Sub-processors to process Personal Data, subject to the requirements of this Section 5.

5.2 Current Sub-processors

Current Sub-processors are listed in Annex III to this DPA. metricsIQ shall keep Annex III current and provide Customer with an updated Annex III within three (3) days of updating.

5.3 New Sub-processors

• (a) metricsIQ shall notify Customer at least thirty (30) days before engaging a new Sub-processor or replacing an existing Sub-processor.
• (b) Customer may object to a new Sub-processor on reasonable grounds by notifying metricsIQ in writing within fifteen (15) days of receiving notice.
• (c) If Customer objects, the Parties shall work in good faith to resolve the objection. If no resolution is reached within thirty (30) days, Customer may terminate the affected Services.

5.4 Sub-processor Agreements

metricsIQ shall ensure that each Sub-processor is bound by data protection obligations no less protective than those in this DPA.

5.5 Liability

metricsIQ remains fully liable for the acts and omissions of its Sub-processors.

6. Data Subject Rights

6.1 Assistance

metricsIQ shall assist Customer in responding to requests from Data Subjects exercising their rights under Data Protection Laws, including rights of access, rectification, erasure, restriction, portability, and objection.

6.2 Notification

metricsIQ shall promptly notify Customer if it receives a request directly from a Data Subject, unless prohibited by law. metricsIQ shall not respond to such requests except as instructed by Customer.

6.3 Costs

Customer shall reimburse metricsIQ for reasonable costs incurred in providing assistance beyond what is required by law.

7. Personal Data Breach

7.1 Notification

metricsIQ shall notify Customer without undue delay (and in no event later than 72 hours) after becoming aware of a Personal Data Breach affecting Customer’s Personal Data, to the extent metricsIQ has sufficient information to provide a meaningful notification. metricsIQ may provide initial notification with available information and supplement as additional details become known.

7.2 Breach Information

The notification shall include, to the extent available: (a) a description of the nature of the breach, including categories and approximate number of Data Subjects and Personal Data records affected; (b) the name and contact details of metricsIQ’s data protection contact; (c) a description of the likely consequences of the breach; and (d) a description of measures taken or proposed to address the breach and mitigate its effects.

7.3 Cooperation

metricsIQ shall cooperate with Customer in investigating the breach, mitigating its effects, and complying with notification obligations under Data Protection Laws.

7.4 No Acknowledgment

metricsIQ’s notification of a Personal Data Breach shall not be construed as an acknowledgment of fault or liability.

8. Data Protection Impact Assessments

8.1 Assistance

Upon Customer’s request, metricsIQ shall provide reasonable assistance to Customer in conducting data protection impact assessments and prior consultations with supervisory authorities, taking into account the nature of the Processing and information available to metricsIQ.

9. International Data Transfers

9.1 Transfer Mechanisms

metricsIQ shall not transfer Personal Data outside the European Economic Area (“EEA”), United Kingdom, or Switzerland unless: (a) the transfer is to a country with an adequacy decision; (b) appropriate safeguards are in place, including Standard Contractual Clauses; (c) the transfer is subject to a derogation under Data Protection Laws; or (d) Customer provides prior written authorization in conjunction with an applicable Article 49 derogation or other lawful transfer mechanism under applicable Data Protection Laws.

By executing this DPA, Customer authorizes (i) metricsIQ’s engagement of the Sub-processors listed in Annex III under Section 5.1; (ii) the transfer of Personal Data to the Sub-processors and data locations identified in Annex III; and (iii) the Standard Contractual Clauses and, where applicable, the UK International Data Transfer Addendum referenced in Section 9.2 as the transfer mechanism for such transfers. This authorization constitutes Customer’s prior written authorization under Section 9.1(d). For Sub-processors or data locations not listed in Annex III, the notice and objection procedures in Section 5.3 (New Sub-processors) and the mechanisms in Sections 9.1(a)– (c) shall apply.

9.2 Standard Contractual Clauses

Where required, the Parties agree to the Standard Contractual Clauses (Module Two: Controller to Processor) as approved by the European Commission, which are incorporated by reference. For transfers from the UK, the UK International Data Transfer Addendum shall apply.

9.3 Supplementary Measures

metricsIQ shall implement supplementary technical and organizational measures as necessary to ensure the effectiveness of the transfer mechanism.

10. Audit and Compliance

10.1 Information

metricsIQ shall make available to Customer all information reasonably necessary to demonstrate compliance with this DPA.

10.2 Audit Rights

• (a) Customer may conduct audits of metricsIQ’s Processing activities, upon reasonable notice and during normal business hours, no more than once per year unless required by a supervisory authority or following a Personal Data Breach.
• (b) Customer may use an independent third-party auditor, subject to confidentiality obligations.
• (c) Customer shall bear the costs of any audit, except where the audit reveals material non-compliance by metricsIQ.

10.3 Certifications

metricsIQ may satisfy audit requests by providing relevant certifications, audit reports (e.g., SOC 2), or attestations from independent auditors.

11. Data Retention and Deletion

11.1 Retention

metricsIQ shall retain Personal Data only for as long as necessary to provide the Services and comply with legal obligations.

11.2 Return or Deletion

Customer may request export of Personal Data by providing written notice to metricsIQ at least sixty (60) days prior to the expiration or effective date of termination of the Agreement or applicable SOW. metricsIQ shall make Personal Data available for export in a commercially standard, machine-readable, general-purpose format during the active term and for thirty (30) days following expiration or termination. Upon expiration of the export period, metricsIQ shall, at Customer’s election: (a) return all Personal Data to Customer in a commonly used format; and/or (b) delete all Personal Data within thirty (30) days, except as required by applicable law. metricsIQ shall certify such deletion in writing upon Customer’s request.

11.3 Certification

Upon request, metricsIQ shall certify in writing that it has deleted Personal Data in accordance with this Section 11.

12. AI and Personal Data

12.1 AI Processing Disclosure

Where metricsIQ uses AI Systems to process Personal Data, metricsIQ shall: (a) disclose such use in the applicable SOW or upon Customer’s request; (b) ensure AI Systems process Personal Data only as necessary to perform the Services; (c) not use Personal Data to train third-party AI models unless authorized by Customer; and (d) implement appropriate safeguards to protect Personal Data processed by AI Systems.

12.2 Automated Decision-Making

metricsIQ shall not use Personal Data for automated decision-making that produces legal effects or significantly affects Data Subjects without Customer’s prior written authorization and appropriate safeguards.

13. CCPA-Specific Provisions

13.1 Service Provider Status

For purposes of the CCPA, metricsIQ is a “Service Provider” and shall not: (a) sell or share Personal Data; (b) retain, use, or disclose Personal Data for purposes other than performing the Services; (c) retain, use, or disclose Personal Data outside the direct business relationship with Customer; or (d) combine Personal Data with data from other sources, except as permitted by the CCPA.

13.2 Certification

metricsIQ certifies that it understands and will comply with the restrictions in Section 13.1.

14. Term and Survival

14.1 Term

This DPA shall remain in effect for the duration of the Agreement.

14.2 Survival

Sections 1, 3.1, 3.3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14.2, and 15 shall survive termination or expiration of this DPA or the Agreement. Confidentiality obligations shall survive for the longer of three (3) years from the date of disclosure or three (3) years after termination of this DPA, except that obligations with respect to Personal Data shall continue for as long as metricsIQ retains any Personal Data.

15. General

15.1 Conflict

In the event of conflict between this DPA and the Agreement, this DPA shall prevail with respect to the Processing of Personal Data.

15.2 Amendments

This DPA may be amended by metricsIQ to ensure compliance with Data Protection Laws, with at least thirty (30) days’ written notice to Customer. All other amendments to this DPA shall require the written agreement of both Parties.

15.3 Governing Law

This DPA shall be governed by the same law governing the Agreement. Any disputes shall be resolved in accordance with the dispute resolution provisions of the Agreement.

15.4 Liability

Each party’s liability arising out of or related to this DPA, whether in contract, tort (including negligence), strict liability, or otherwise, is subject to the exclusions of damages and limitations of liability set forth in Section 14 of the Agreement. Section 15.1 of this DPA applies to the interpretation of substantive Processing obligations only and does not displace, expand, or otherwise modify Section 14 of the Agreement. Without limiting the foregoing, metricsIQ’s liability under Section 5.5 of this DPA for the acts and omissions of its Sub-processors is subject to Section 14 of the Agreement.

Annex I: Details of Processing

Annex II: Security Measures

metricsIQ implements the following technical and organizational security measures:

A. Access Controls

• Role-based access control with principle of least privilege
• Multi-factor authentication for all systems containing Personal Data
• Regular access reviews and prompt deprovisioning

B. Encryption

• Encryption in transit using TLS 1.2 or higher
• Encryption at rest using AES-256 or equivalent
• Secure key management practices

C. Network Security

• Firewalls and intrusion detection/prevention systems
• Network segmentation
• Regular vulnerability scanning and penetration testing

D. Physical Security

• Data center security controls (where applicable)
• Secure facilities with access controls
• Environmental protections

E. Personnel Security

• Background checks for personnel with access to Personal Data
• Confidentiality agreements
• Regular security awareness training

F. Incident Response

• Documented incident response procedures
• Regular testing of incident response plans
• Post-incident review and improvement

G. Business Continuity

• Regular data backups
• Disaster recovery procedures
• Business continuity planning

H. Vendor Management

• Due diligence for Sub-processors
• Contractual data protection requirements
• Ongoing monitoring of Sub-processor compliance

Annex III: Current Sub-processors

The following third parties are engaged by metricsIQ to process Personal Data on behalf of Customer:

• Amazon Web Services, Inc. — Cloud infrastructure (compute, storage, and hosting) for data processing and artifact generation. Data location: US East (N. Virginia — us-east-1). Data processed: Personal Data contained within Customer Materials, Decision Data, Decision Materials, and metricsIQ Materials.
• Amazon Web Services, Inc. — Amazon Bedrock (managed foundation model inference) for Agent reasoning and Output generation, including models of the Anthropic Claude family. Data location: the AWS region identified in the applicable Order, provided that where cross-region inference is enabled for Customer’s deployment, inference requests may be routed to and processed in other AWS regions within the configured routing scope. Data processed: Personal Data contained within prompts, context, Customer Materials, Decision Data, and Decision Materials submitted for inference.
• Snowflake Inc. — Cloud data platform (data warehousing, analytics, and query processing) for data processing and artifact generation. Data location: US East (AWS us-east-1 region). Data processed: Personal Data contained within Customer Materials, Decision Data, Decision Materials, and metricsIQ Materials.
• GitHub, Inc. — Source code management and software development platform (version control, code repository hosting, and CI/CD pipeline services) supporting the development and deployment of the metricsIQ platform. Data location: United States. Data processed: Limited Personal Data only to the extent incidentally contained in work-in-progress decision materials and activity descriptions created and consumed by agents and tools.
• Freshworks Inc. (Freshdesk) — Customer support ticketing and case management platform used for support case and ticketing context. Data location: United States. Data processed: Personal Data contained within support cases, case metadata, and related Customer Materials.

Note on Sub-Processor Data Locations. The data locations identified above reflect each Sub-processor’s standard deployment for Customer’s selected region as of the Effective Date of this DPA. Sub-processors may be required by applicable law or by a binding order of a governmental body to alter data location or to access, disclose, or transfer Personal Data outside the stated location. Where any such change is made by a Sub-processor, metricsIQ shall provide Customer with prompt written notice of the change (to the extent not prohibited by law) and shall work with Customer in good faith to implement any additional safeguards reasonably required under this DPA and applicable Data Protection Laws.

Note on Model Providers. Foundation models made available through Amazon Bedrock, including the Claude model family developed by Anthropic, PBC, are hosted and operated by AWS within the AWS environment identified above. Model developers do not receive Customer Data or Personal Data processed through Amazon Bedrock, are not engaged by metricsIQ to process Personal Data, and are not Sub-processors under this DPA. Where metricsIQ engages a model provider directly rather than through Amazon Bedrock, that provider will be added to Annex III in accordance with Section 5.3.