2.1 Description. The Service ingests query and status data from Customer’s or a sponsor’s EDC and related systems and automatically compiles items requiring site attention (which may include source data verification and source data review findings, delegation-log discrepancies, and similar items) into a pre-visit checklist for delivery to the applicable clinical site. Authorized UsersCustomer’s employees and contractors, including clinical research coordinators and Customer’s clinical research associates, whom Customer authorizes to access the Service. (§1) at the site may resolve or upload responses to checklist items. For remaining items, an Authorized User may join a recorded session with the Service’s automated monitoring assistant (the “AI Assistant”), which explains outstanding items and the steps to resolve them. The Service generates recordings, transcripts, and draft monitoring trip reports from these sessions.

2.2 Escalation to Customer Personnel. Where an item cannot be addressed through the AI Assistant, an Authorized User may request escalation to a human clinical research associate. The human clinical research associate is provided, employed or engaged, supervised, and directed solely by Customer. Thoreon does not provide, employ, supervise, or direct any clinical research associate, monitor, investigator, or other clinical or regulatory personnel. The Service may facilitate scheduling of, record, transcribe, and update draft trip reports from escalation sessions, but all monitoring activity, judgment, and sign-off in those sessions are performed by Customer’s personnel.

2.3 Updates. Thoreon may modify, enhance, or update the Service and DocumentationThoreon’s then-current user and technical documentation for the Service, as updated from time to time. (§1) from time to time, provided that Thoreon will not materially decrease the core functionality of the Service ordered during a paid subscription term.

3.1 Order Forms. Customer orders the Service under one or more Order Forms. Each Order FormAn ordering document or statement of work executed by the Parties that references these Terms and specifies the Service ordered, fees, and commercial terms. (§1) is incorporated into and forms part of this Agreement. Commercial terms — including the Service ordered, subscription term, fees, payment terms, volume commitments, any pilot or “Phase 0” arrangement and associated success criteria, and acceptance criteria applicable to success-based billing (including the definition of an accepted trip report, if applicable) — are as set forth in the applicable Order FormAn ordering document or statement of work executed by the Parties that references these Terms and specifies the Service ordered, fees, and commercial terms. (§1).

3.2 Order of Precedence. In the event of a conflict, the documents control in the following order: (a) with respect to PHI, Exhibit B (Business Associate Agreement); (b) with respect to Personal Data subject to Data Protection Laws, Exhibit C (Data Processing Addendum); (c) the applicable Order Form (as to commercial terms and any expressly negotiated deviations); (d) these Customer Service Terms; and (e) Exhibit A (Service Level Agreement) and the DocumentationThoreon’s then-current user and technical documentation for the Service, as updated from time to time. (§1). A deviation in an Order FormAn ordering document or statement of work executed by the Parties that references these Terms and specifies the Service ordered, fees, and commercial terms. (§1) controls over these Terms only where it expressly references the provision it modifies.

4.1 License. Subject to this Agreement, Thoreon grants Customer a non-exclusive, non-transferable, non-sublicensable right during the applicable subscription term to access and use the Service and DocumentationThoreon’s then-current user and technical documentation for the Service, as updated from time to time. (§1) solely for Customer’s internal business purposes in connection with clinical trials for which Customer or its sponsor client is responsible.

4.2 Authorized Users; Accounts. Customer is responsible for its Authorized UsersCustomer’s employees and contractors, including clinical research coordinators and Customer’s clinical research associates, whom Customer authorizes to access the Service. (§1)’ compliance with this Agreement, for maintaining the confidentiality of account credentials, and for all activity under its accounts. Customer will promptly notify Thoreon of any unauthorized access or use.

4.3 Reservation. As between the Parties, Thoreon and its licensors retain all right, title, and interest in and to the Service, the AI FeaturesThe machine-learning capabilities of the Service used to generate Output. (§1), the underlying models, software, and all improvements thereto. No rights are granted except as expressly stated.

Customer is responsible for, and represents and warrants that it will:

Customer will not, and will not permit any Authorized User or third party to: (a) copy, modify, translate, or create derivative works of the Service; (b) reverse engineer, decompile, or attempt to derive the source code, models, or underlying structure of the Service, except to the extent this restriction is prohibited by applicable law; (c) resell, sublicense, or provide the Service to third parties on a service-bureau basis except to clinical sites and sponsors in connection with Customer’s permitted use; (d) access the Service to build a competing product or model, or to benchmark against a competing product; (e) introduce malicious code, or interfere with or disrupt the integrity or performance of the Service; (f) circumvent or attempt to circumvent any usage limits, security, or access controls; or (g) use the Service in violation of applicable law or the rights of any third party.

7.1 Customer and sponsor retain regulatory responsibility. Customer (and, as applicable, the trial sponsor and any contract research organization for which Customer acts) is and remains solely and ultimately responsible for the design, conduct, oversight, quality, and regulatory compliance of each clinical trial, including all monitoring obligations and determinations under ICH E6, applicable Good Clinical Practice requirements, 21 C.F.R. and other regulations of the U.S. Food and Drug Administration, and all other applicable laws, regulations, and guidance. Nothing in this Agreement transfers any of those responsibilities to Thoreon.

7.2 The Service is a tool, not a sponsor, CRO, or monitor. The Service is a software tool that provides workflow automation and decision support. Thoreon is not a contract research organization, sponsor, clinical investigator, or monitor of record, does not perform regulated monitoring services, and does not assume, and expressly disclaims, any of Customer’s or any sponsor’s regulatory or monitoring obligations. The human clinical research associate who participates in any escalation is Customer’s personnel, and all monitoring determinations and sign-offs are made by Customer’s qualified personnel.

7.3 Not a system of record. The Service is not the official system of record for any clinical trial or regulatory purpose. The TMF, EDC, CTMS, and other regulated systems of record remain Customer’s responsibility. OutputPre-visit checklists, task lists, call recordings, transcripts, monitoring trip reports, and other materials generated by the Service from Customer Data, including materials generated by the AI Features. (§1) is draft work product that Customer must review and, where required, verify, finalize, and file within its own systems of record. Customer is responsible for ensuring that records required to be retained are exported from the Service and maintained in Customer’s systems for the applicable retention periods.

7.4 No regulatory advice. The Service and the AI FeaturesThe machine-learning capabilities of the Service used to generate Output. (§1) do not provide clinical, medical, legal, or regulatory advice, and no OutputPre-visit checklists, task lists, call recordings, transcripts, monitoring trip reports, and other materials generated by the Service from Customer Data, including materials generated by the AI Features. (§1) constitutes such advice. Customer is solely responsible for determining whether and how to use any Output in a manner that satisfies Customer’s regulatory obligations, including any independent source data verification, source data review, and quality control that Customer determines is required.

8.1 Nature of AI Output. The AI FeaturesThe machine-learning capabilities of the Service used to generate Output. (§1) generate Output using automated systems, including machine-learning models. Such Output is probabilistic and may contain errors, omissions, or inaccuracies, and may be incomplete or not up to date. Thoreon does not warrant, and Customer must not assume, that any Output is accurate, complete, or fit for any particular purpose.

8.2 Human verification required. Output is provided “AS IS” as decision support only. Customer will apply qualified human review to all Output before relying on it or acting on it, and remains responsible for the final content and accuracy of all trip reports and other records. Customer’s reliance on any Output without such review is at Customer’s sole risk.

9.1 HIPAA. To the extent Thoreon creates, receives, maintains, or transmits PHIProtected Health Information as defined in 45 C.F.R. § 160.103, limited to information Thoreon creates, receives, maintains, or transmits for or on behalf of Customer. (§1) for or on behalf of Customer, the Parties’ Business Associate Agreement at Exhibit B governs such PHIProtected Health Information as defined in 45 C.F.R. § 160.103, limited to information Thoreon creates, receives, maintains, or transmits for or on behalf of Customer. (§1) and is incorporated by reference. Where Customer is itself a business associate of a covered entity, Thoreon acts as Customer’s subcontractor and Exhibit B applies accordingly.

9.2 SOC 2. Thoreon maintains a SOC 2 [CONFIRM: Type I or Type II] examination of the Service. Upon Customer’s written request (no more than once per year, and subject to a confidentiality obligation at least as protective as Section 12), Thoreon will make available its then-current SOC 2 report. [Note: do not state “Type II” in the executed version unless the current report is a Type II report.]

9.3 21 C.F.R. Part 11. The Service provides controls designed to support compliance with 21 C.F.R. Part 11 for the electronic records it generates (including trip reports and transcripts), such as audit trails, access controls, and record-integrity measures, and, where enabled, electronic-signature functionality. Customer is responsible for the elements of Part 11 compliance within Customer’s control, including standard operating procedures, personnel qualification and training, identity and credential management for its Authorized UsersCustomer’s employees and contractors, including clinical research coordinators and Customer’s clinical research associates, whom Customer authorizes to access the Service. (§1), and determining whether Customer’s overall use of the Service satisfies Customer’s Part 11 obligations.

9.4 Good Clinical Practice. As stated in Section 7, responsibility for Good Clinical Practice compliance rests with Customer and the applicable sponsor.

10.1 Ownership of Customer Data and Output. As between the Parties, Customer owns all right, title, and interest in and to Customer DataData, records, documents, and other content that Customer or its Authorized Users submit to, or that is generated at Customer’s direction through, the Service — including inputs drawn from EDC and other clinical systems, and any PHI and Personal Data contained therein. (§1) and the Output. Customer grants Thoreon a non-exclusive, worldwide right to host, copy, process, transmit, and display Customer DataData, records, documents, and other content that Customer or its Authorized Users submit to, or that is generated at Customer’s direction through, the Service — including inputs drawn from EDC and other clinical systems, and any PHI and Personal Data contained therein. (§1) and Output as necessary to provide, secure, and support the Service and as otherwise permitted by this Agreement.

10.2 Use limited to providing the Service. Thoreon will access and use Customer Data (including PHI and Personal DataInformation relating to an identified or identifiable natural person that is subject to Data Protection Laws. (§1) in identifiable form) only to provide, maintain, secure, and support the Service, as instructed by Customer, and as permitted by Exhibits B and C and applicable law. Thoreon does not use identifiable Customer Data to train or improve its models.

10.3 De-Identified and Aggregated Data. Thoreon may create De-Identified DataData de-identified so it does not identify, and cannot reasonably be used to identify, any individual, per 45 C.F.R. § 164.514(b) and applicable Data Protection Laws. (§1) and Aggregated Data from Customer Data and use of the Service, and may use such De-Identified DataData de-identified so it does not identify, and cannot reasonably be used to identify, any individual, per 45 C.F.R. § 164.514(b) and applicable Data Protection Laws. (§1) and Aggregated Data to develop, train, test, and improve its products, services, and models, and for analytics, benchmarking, and other lawful business purposes, during and after the Term. De-identification will be performed in accordance with 45 C.F.R. § 164.514(b) and applicable Data Protection Laws, as permitted by Exhibit B. De-Identified DataData de-identified so it does not identify, and cannot reasonably be used to identify, any individual, per 45 C.F.R. § 164.514(b) and applicable Data Protection Laws. (§1) and Aggregated DataAggregated and/or statistical data derived from use of the Service that does not identify Customer, any individual, or any clinical trial. (§1) are not Customer Data, Output, or Confidential Information, and Thoreon may retain and use them without restriction, provided Thoreon does not attempt to re-identify individuals and does not disclose De-Identified Data or Aggregated DataAggregated and/or statistical data derived from use of the Service that does not identify Customer, any individual, or any clinical trial. (§1) in a manner that identifies Customer or any individual.

11.1 Hosting. The Service is hosted on Google Cloud Platform in data center region(s) located in the United States [confirm region(s)]. Google LLC acts as Thoreon’s infrastructure subprocessor.

11.2 Subprocessors. Thoreon may engage subprocessors to support the Service and will remain responsible for their performance. Thoreon will maintain a list of subprocessors [URL or on request] and will provide notice of new subprocessors as set forth in Exhibit C, along with a right to object as provided there.

11.3 Retention and deletion. During the subscription term, Thoreon retains Customer Data as needed to provide the Service. Following expiration or termination, Customer may export Customer Data and Output for a period of [30] days, after which Thoreon will delete or de-identify Customer Data within [60] days, except (a) De-Identified Data and Aggregated DataAggregated and/or statistical data derived from use of the Service that does not identify Customer, any individual, or any clinical trial. (§1), (b) copies in routine backups deleted on Thoreon’s standard rotation, and (c) as required by law. Customer is responsible for exporting and retaining any records it is required to retain for regulatory purposes prior to deletion.

12.1 Definition. “Confidential Information” means non-public information disclosed by one Party (“Discloser”) to the other (“Recipient”) that is designated as confidential or that reasonably should be understood to be confidential given its nature and the circumstances. Customer Data and Output are Customer’s Confidential Information. The Service, Documentation, and Thoreon’s non-public technical and pricing information are Thoreon’s Confidential Information.

12.2 Obligations. Recipient will (a) use Confidential Information only to perform under this Agreement, (b) protect it using at least reasonable care, and (c) not disclose it except to its personnel and advisors who need to know and are bound by confidentiality obligations at least as protective as this Section. Confidential Information does not include information that is or becomes public through no fault of Recipient, was rightfully known without duty of confidentiality, is independently developed, or is rightfully received from a third party. Recipient may disclose Confidential Information if required by law, provided it gives reasonable prior notice where permitted.

Thoreon will maintain a written information security program with administrative, physical, and technical safeguards designed to protect the confidentiality, integrity, and availability of Customer Data, consistent with its SOC 2 examination (Section 9.2), the HIPAA Security Rule safeguards set out in Exhibit B, and the security measures described in Exhibit C. Thoreon will notify Customer of Security Incidents and Breaches as and within the timeframes set out in Exhibits B and C.

Thoreon will provide the availability commitment and technical support described in Exhibit A (Service Level Agreement). The service credits set forth in Exhibit A are Customer’s sole and exclusive remedy for failure to meet the availability commitment.

Fees, billing units, invoicing, payment terms, currency, taxes, and any late-payment charges are as set forth in the applicable Order Form. Except as expressly stated in this Agreement or an Order Form, fees are non-refundable and payment obligations are non-cancelable. Amounts not disputed in good faith and not paid when due may accrue interest and, following notice and a cure period, may result in suspension under Section 16.3. Fees are exclusive of taxes, which are Customer’s responsibility other than taxes on Thoreon’s net income.

16.1 Term. This Agreement begins on the Effective Date and continues while any Order Form is in effect. The subscription term, renewals, and any pilot term and associated walk-away rights are as set forth in the applicable Order Form.

16.2 Termination for cause. Either Party may terminate this Agreement or an affected Order Form if the other Party materially breaches this Agreement and fails to cure within thirty (30) days after written notice, or immediately if the other Party becomes insolvent or subject to bankruptcy proceedings not dismissed within sixty (60) days.

16.3 Suspension. Thoreon may suspend Customer’s access, in whole or in part, if (a) required by law, (b) Customer’s use poses a material security risk or violates Section 6, or (c) fees are overdue and remain unpaid after notice and a cure period. Thoreon will limit any suspension in scope and duration to the extent reasonably practicable and will restore access promptly once the cause is resolved.

16.4 Effect of termination. Upon expiration or termination, Customer’s right to access the Service ceases, and each Party will return or destroy the other’s Confidential Information on request (subject to Section 10.3, Exhibit B, Exhibit C, and legal-retention requirements). Data export and deletion are governed by Section 11.3. The following survive: Sections 1, 4.3, 6, 7, 8, 10, 12, 15 (for accrued amounts), 16.4, 17.4, 18, 19, 20 (for the period stated), 21, 22, 23, and 24, together with the survival provisions of the Exhibits.

17.1 Mutual. Each Party represents and warrants that it has the authority to enter into this Agreement.

17.2 Service warranty. Thoreon warrants that, during the subscription term, the Service will perform materially in accordance with the Documentation. Customer’s exclusive remedy, and Thoreon’s sole obligation, for breach of this warranty is that Thoreon will use commercially reasonable efforts to correct the non-conformity and, if Thoreon cannot do so within a reasonable time, Customer may terminate the affected Order Form and receive a pro-rata refund of prepaid, unused fees for the affected Service.

17.3 Compliance. Thoreon warrants that it will maintain the HIPAA safeguards described in Exhibit B and the SOC 2 examination described in Section 9.2 during the subscription term.

18.1 By Thoreon. Thoreon will defend Customer against any third-party claim alleging that the Service, as provided by Thoreon and used in accordance with this Agreement, infringes or misappropriates such third party’s patent, copyright, trademark, or trade secret, and will indemnify Customer for damages and reasonable costs finally awarded or agreed in settlement. This obligation does not apply to claims arising from (a) Customer Data or Output content, (b) modifications not made by Thoreon, (c) combination of the Service with items not provided by Thoreon where the claim would not have arisen but for the combination, or (d) use of the Service in violation of this Agreement. If the Service becomes, or Thoreon believes it may become, subject to an infringement claim, Thoreon may procure the right for Customer to continue using it, modify or replace it to be non-infringing, or, if neither is commercially reasonable, terminate the affected Service and refund prepaid, unused fees. This Section states Thoreon’s entire liability for infringement claims.

18.2 By Customer. Customer will defend Thoreon against any third-party claim arising from (a) Customer Data, including any allegation that it infringes or violates the rights of a third party or applicable law; (b) Customer’s or its Authorized Users’ use of the Service or any Output, including monitoring, regulatory, or clinical decisions and the finalization or filing of records; (c) Customer’s failure to obtain any consent, authorization, or notice required under Section 5, including recording consents; or (d) Customer’s violation of applicable law; and will indemnify Thoreon for damages and reasonable costs finally awarded or agreed in settlement.

18.3 Procedure. The indemnified Party will give prompt written notice of the claim, grant the indemnifying Party sole control of the defense and settlement (provided no settlement imposing a non-monetary obligation on the indemnified Party is made without its consent), and provide reasonable cooperation at the indemnifying Party’s expense.

19.2 Cap. EXCEPT FOR THE EXCLUDED CLAIMS, EACH PARTY’S TOTAL AGGREGATE LIABILITY ARISING OUT OF OR RELATED TO THIS AGREEMENT WILL NOT EXCEED [PLACEHOLDER FOR COUNSEL — e.g., the fees paid or payable by Customer under the applicable Order Form in the twelve (12) months preceding the event giving rise to liability].

19.3 Excluded Claims. The exclusion in Section 19.1 and the cap in Section 19.2 do not apply to [PLACEHOLDER FOR COUNSEL — commonly: (a) a Party’s indemnification obligations; (b) breach of confidentiality (Section 12); (c) breach of Exhibit B (BAA) or Exhibit C (DPA); (d) infringement or misappropriation of intellectual property; (e) a Party’s gross negligence or willful misconduct; and (f) Customer’s payment obligations]. Consider whether a separate, higher super-cap should apply to certain Excluded Claims (for example, data-protection and BAA breaches).

During the subscription term, Thoreon will maintain, at its own expense, insurance with the following minimum coverages:

Upon written request, Thoreon will provide certificates of insurance. Coverage amounts do not limit Thoreon’s liability under this Agreement. [Confirm all amounts with counsel and insurer.]

Neither Party will use the other Party’s name, logo, or trademarks in any public statement or marketing material without the other Party’s prior written consent. For clarity, Thoreon may identify Customer as a customer, and use Customer’s name and logo, only with Customer’s prior written consent (which may be given by Customer’s authorized representative and may be scoped or revoked by Customer).

If Customer or its Authorized Users provide suggestions, enhancement requests, or other feedback regarding the Service (“Feedback”), Thoreon may use the Feedback without restriction or obligation. Feedback is provided voluntarily and does not include Customer Data or Customer’s Confidential Information. All rights not expressly granted are reserved.

23.1 Governing law. This Agreement is governed by the laws of the State of [Delaware — CONFIRM], without regard to its conflict-of-laws rules, and excluding the U.N. Convention on Contracts for the International Sale of Goods.

23.2 Dispute resolution and venue. [PLACEHOLDER FOR COUNSEL — select one: (a) exclusive jurisdiction and venue in the state and federal courts located in [county/state]; or (b) final and binding arbitration administered by [JAMS/AAA] under its commercial rules, seated in [city, state], before [one/three] arbitrator(s)].

23.3 Jury trial waiver. [PLACEHOLDER FOR COUNSEL — if litigation is selected, consider a mutual waiver of jury trial].

24.1 Assignment. Neither Party may assign this Agreement without the other Party’s prior written consent, except that either Party may assign it, on notice, to an affiliate or to a successor in connection with a merger, acquisition, or sale of all or substantially all of its assets. Any other attempted assignment is void.

24.2 Subcontractors. Thoreon may use subcontractors and subprocessors to provide the Service and remains responsible for their performance, subject to Sections 11 and 12 and Exhibits B and C.

24.3 Force majeure. Neither Party is liable for any delay or failure to perform (other than payment obligations) due to causes beyond its reasonable control, including acts of God, natural disasters, labor disputes, internet or utility failures, and governmental actions.

24.4 Notices. Legal notices must be in writing and sent to the addresses on the Order Form or to [legal notice address / email], and, for Thoreon security or privacy notices, to [security/privacy contact]. Notices are effective upon receipt.

24.5 Export and sanctions. Each Party will comply with applicable export control and economic sanctions laws. Customer represents that it and its Authorized Users are not subject to sanctions or located in an embargoed jurisdiction, and will not use the Service in violation of such laws.

24.6 Independent contractors. The Parties are independent contractors. This Agreement creates no partnership, joint venture, agency, or employment relationship, and neither Party may bind the other.

24.7 No third-party beneficiaries. This Agreement is for the benefit of the Parties only and confers no rights on any third party, except as expressly stated in the Exhibits.

24.8 Severability; waiver. If any provision is held unenforceable, it will be modified to the minimum extent necessary and the remainder will remain in effect. A Party’s failure to enforce a provision is not a waiver.

24.9 Amendment. This Agreement may be amended only by a written instrument signed by both Parties, except that Thoreon may update the Documentation and operational policies from time to time consistent with Section 2.3.

24.10 Entire agreement. This Agreement, including all Order Forms and Exhibits, is the entire agreement between the Parties regarding the Service and supersedes all prior or contemporaneous agreements and understandings on that subject. Terms in any Customer purchase order or similar document are of no effect.

24.11 Counterparts; electronic signatures. Order Forms may be executed in counterparts and by electronic signature, each of which is an original and all of which together constitute one instrument.

This Business Associate Agreement (“BAA”) is part of the Agreement and applies to PHIProtected Health Information as defined in 45 C.F.R. § 160.103, limited to information Thoreon creates, receives, maintains, or transmits for or on behalf of Customer. (§1) that Thoreon (“Business Associate”) creates, receives, maintains, or transmits for or on behalf of Customer (“Covered Entity,” or, where Customer is itself a business associate, the applicable business associate for whom Business Associate acts as subcontractor). Terms used but not defined have the meanings in HIPAA (45 C.F.R. Parts 160 and 164) and the HITECH Act. If there is a conflict between this BAA and the rest of the Agreement regarding PHI, this BAA controls. This is a template; counsel should confirm it against Customer’s form and applicable state law.

This Data Processing Addendum (“DPA”) is part of the Agreement and applies where Thoreon processes Personal DataInformation relating to an identified or identifiable natural person that is subject to Data Protection Laws. (§1) on Customer’s behalf that is subject to Data Protection Laws. “Data Protection Laws” means applicable data protection and privacy laws, including the EU General Data Protection Regulation 2016/679 (“GDPR”), the UK GDPR and Data Protection Act 2018, and U.S. state privacy laws including the California Consumer Privacy Act as amended (“CCPA”). If there is a conflict between this DPA and the rest of the Agreement regarding Personal Data, this DPA controls; with respect to PHI, Exhibit B (BAA) controls. This is a template; counsel should confirm scope and attach the official transfer-mechanism annexes.