Master Subscription Agreement

This Master Subscription and Services Agreement (this "Agreement") is entered into as of the Effective Date set out on the first Order Form executed by the parties, between Hesper PN, Inc., a Delaware corporation doing business as Hesper AI, of 680 2nd Street, San Francisco, CA 94107 ("Hesper"), and the customer identified on that Order Form ("Customer").

Hesper provides an artificial-intelligence platform that assists insurance organisations in triaging, investigating, documenting and resolving insurance claims, including the detection of indicators of potential fraud.

1. Definitions

1.1 "Affiliate" means an entity that controls, is controlled by, or is under common control with a party, where control means ownership of more than 50% of the voting interests.

1.2 "Authorised User" means an employee, or a contractor acting solely on Customer's behalf and bound by written obligations no less protective than this Agreement, whom Customer authorises to access the Services.

1.3 "Claim File Data" means Customer Data comprising claim submissions, supporting documents, photographs, recorded statements, medical and billing records, adjuster notes, policy data and related materials submitted to the Services.

1.4 "Customer Data" means all data, content, documents and materials Customer or its Authorised Users submit to, or that are generated for Customer within, the Services, including Claim File Data and Output. It excludes Service Data.

1.5 "Investigation Output" or "Output" means the reports, findings, fraud indicators, risk scores, narratives, evidence summaries, referral packages and recommendations generated by the Services from Claim File Data.

1.6 "Nonpublic Information" has the meaning given in the applicable state insurance data security law modelled on the NAIC Insurance Data Security Model Law (#668), and includes nonpublic personal information under the Gramm-Leach-Bliley Act.

1.7 "Order Form" means an ordering document executed by both parties that references this Agreement and specifies the Services, volumes, fees, Subscription Term and any negotiated variations.

1.8 "Security Incident" means confirmed unauthorised access to, or unauthorised acquisition, use, disclosure, alteration or destruction of, Customer Data in Hesper's possession or control. It excludes unsuccessful access attempts, pings, port scans and similar events that do not compromise Customer Data.

1.9 "Service Data" means configuration, performance, telemetry, security and aggregated usage data generated by Hesper's operation of the Services, excluding Claim File Data, Output, Personal Data and Customer's Confidential Information.

1.10 "Services" means the Hesper AI platform, applications, APIs and any professional or support services identified on an Order Form. 1.11 "Subscription Term" means the period stated on an Order Form.

2.1 This Agreement comprises this document and the following, each incorporated by reference:

2.2 Precedence. On conflict, the following order controls, most authoritative first: (a) the BAA, as to Protected Health Information only; (b) the DPA, as to Personal Data only; (c) the applicable Order Form; (d) the Insurance Regulatory Rider; (e) this Agreement; (f) the remaining Exhibits; (g) the Documentation. An Order Form supersedes this Agreement only where it expressly identifies the section it modifies.

2.3 No purchase order terms. Any preprinted or click-through terms on a Customer purchase order, vendor portal or procurement system are void and of no effect, even if Hesper acknowledges the purchase order.

3.1 Hesper will make the Services available during the Subscription Term in accordance with the Documentation, the Service Level Agreement and applicable law.

3.2 Licence. Hesper grants Customer a limited, non-exclusive, non-transferable, non-sublicensable right during the Subscription Term to access and use the Services and Documentation for Customer's internal business purposes in the administration, investigation and resolution of insurance claims.

3.3 Affiliates. Customer Affiliates identified on an Order Form may use the Services. Customer is jointly and severally liable for their compliance.

3.4 Third-party administrators. Customer may permit a TPA, independent adjuster, MGA or SIU vendor acting on its behalf to access the Services as an Authorised User, provided that party uses the Services solely for Customer's claims, is bound by obligations no less protective than this Agreement, and Customer remains fully responsible for its acts and omissions. Customer may not provide claims investigation services to unaffiliated third parties on a service-bureau or resale basis without Hesper's prior written consent.

3.5 Modifications. Hesper may enhance or modify the Services provided it does not materially degrade the core functionality Customer has subscribed to. Hesper will give at least 60 days' prior written notice of any API deprecation, material Output schema change, or removal of a materially used feature. If such a change materially and adversely affects Customer's use and Hesper does not remedy it within 30 days of written notice, Customer may terminate the affected Order Form and receive a pro-rata refund of prepaid, unused fees.

3.6 Suspension. Hesper may suspend access only where required to prevent a material and imminent security threat, required by law or regulatory directive, Customer's use materially violates the AUP, or fees are more than 30 days overdue and unpaid 10 days after written notice. Except in an emergency or where law requires, Hesper will give advance notice and a reasonable opportunity to cure, will limit any suspension to the narrowest scope and shortest duration reasonably necessary, and will restore access promptly on resolution. Suspension does not relieve Hesper of its obligation to preserve Customer Data.

3.7 Beta features. Features designated beta, preview, pilot or evaluation are provided AS IS, are excluded from the Service Level Agreement and from §§ 9.1 and 13.2, and may be discontinued at any time.

4.1 Account security. Customer is responsible for credential confidentiality, for enabling multi-factor authentication for all Authorised Users, and for promptly notifying Hesper of suspected unauthorised use.

4.2 Rights in data. Customer represents that it has all rights, consents, authorisations and lawful bases necessary to submit Claim File Data and to permit Hesper's processing of it, including under insurance information privacy statutes, state medical confidentiality laws and, where applicable, HIPAA.

4.3 Acceptable use. Customer will comply, and ensure its Authorised Users comply, with the AUP.

4.5 Third-party data sources. Where the Services interoperate with industry databases or third-party data sources, including ISO ClaimSearch, NICB, motor vehicle records or NMVTIS, Customer is responsible for obtaining and maintaining its own licence, membership, credentials and permissible-purpose determination for each source. Hesper does not resell, sublicense or provide access to any such source, and Hesper's use of Customer's credentials is solely as Customer's agent at Customer's direction. Customer will not direct the Services to access any source for which Customer lacks a permissible purpose.

4.6 Cooperation. Customer will provide reasonable cooperation and access necessary for Hesper to perform, including designating a technical and a compliance point of contact.

Customer will not, and will not permit any third party to:

1. reverse engineer, decompile or disassemble the Services, or attempt to derive source code, model weights, model architecture or training methodology, except where this restriction is unenforceable under applicable law;
2. use the Services or Output to develop, train, fine-tune, benchmark for publication, or improve any competing product or machine-learning model;
3. circumvent or exceed usage limits, rate limits or access controls;
4. remove or obscure proprietary notices;
5. conduct penetration testing, vulnerability scanning or load testing without Hesper's prior written consent, not to be unreasonably withheld, and subject to a mutually agreed scope and window;
6. submit malicious code;
7. use the Services in violation of applicable law, including export control, sanctions and anti-discrimination law; or
8. sublicense, rent, lease, timeshare or operate the Services as a service bureau except as permitted by § 3.4.

6.1 As between the parties, Customer owns and retains all right, title and interest in Customer Data, including Claim File Data.

6.2 Ownership of Output. As between the parties, Customer owns all right, title and interest in the Investigation Output generated from its Claim File Data, and may use, reproduce, modify and disclose it without restriction, including in claim files, denial letters, litigation, regulatory filings, examinations and referrals to law enforcement or fraud bureaus. Hesper assigns to Customer any interest it may acquire in such Output. This does not transfer any right in the Services, Hesper's models, or any template, heuristic or component of general applicability embodied in Output.

6.3 Licence to Hesper. Customer grants Hesper a non-exclusive, worldwide, royalty-free licence to host, copy, transmit, display and process Customer Data solely as necessary to provide, secure and support the Services for Customer, to address technical or security problems, and to comply with law. It terminates on deletion under § 6.7.

6.5 Customer-specific tuning. Any tuning artefacts created for Customer are logically segregated to Customer's tenant, are not exposed to or used for any other customer, and are deleted under § 6.7.

6.6 Service Data. Hesper may use Service Data to operate, secure, troubleshoot and improve the Services and to produce aggregated statistics, provided it is stripped of all direct and indirect identifiers of Customer and of any claimant, insured, provider or other natural person, and of any claim or policy number; aggregated with data from other customers so Customer is not identifiable; and never used in a manner that discloses Customer's Confidential Information. Hesper will not publish statistics identifying Customer without prior written consent.

6.7 Retention, return and deletion. Hesper will retain Customer Data for the duration of the Subscription Term, unless Customer instructs otherwise in writing. Customer may at any time instruct Hesper in writing to apply a shorter retention period, to delete identified Customer Data, or to extend retention beyond the Subscription Term, and Hesper will give effect to that instruction within 30 days, subject only to a legal requirement or litigation hold. During the Subscription Term and for 30 days after its expiration or termination, Customer may export Customer Data in a structured, machine-readable format at no charge. Within 60 days after expiration or termination Hesper will securely delete Customer Data from production systems, and within a further 90 days from backups, except where retention is required by law or a litigation hold, in which case the retained data remains subject to §§ 6.4 and 12 until deleted. Hesper will certify deletion in writing on request.

6.8 System of record. Customer acknowledges that claim records may be subject to statutory retention requirements, regulatory examination and litigation preservation obligations, and that Customer, not Hesper, is the system of record. Customer is responsible for maintaining its own copies sufficient to satisfy those obligations. Hesper will not delete Customer Data during the Subscription Term except on Customer's written instruction or as required by law.

6.9 Hesper IP. Hesper owns and retains all right, title and interest in the Services, the underlying software, models, model weights, algorithms, know-how, Documentation and all improvements. No rights are granted except as expressly stated. 6.10 Feedback. Customer grants Hesper a perpetual, irrevocable, royalty-free licence to use suggestions and feedback, provided it is used in de-identified, non-confidential form and does not incorporate Customer Data or Customer's Confidential Information.

7.1 Customer will pay the fees stated on each Order Form. Except as provided in §§ 3.5, 11.3 and 14.2, fees are non-cancellable and non-refundable. 7.2 Undisputed invoices are payable within the period stated on the Order Form. Overdue amounts accrue interest at the lesser of 1.0% per month or the maximum permitted by law.

7.3 Disputed amounts. Customer may withhold an amount disputed in good faith if it notifies Hesper in writing within 20 days of the invoice date, describes the basis, and pays all undisputed amounts. Withheld amounts do not accrue interest and are not grounds for suspension while the dispute is pending.

7.4 Overages. Volumes above those on the Order Form are billed at the stated overage rate. Hesper will notify Customer at 80% and 100% of contracted volume. 7.5 Price changes. Fees are fixed for the Initial Term. On renewal Hesper may increase fees by no more than the percentage stated on the Order Form, on at least 60 days' notice before the renewal date. 7.6 Taxes. Fees exclude taxes; Customer is responsible for sales, use, VAT, GST and similar taxes, excluding taxes on Hesper's net income.

8.1 The Data Processing Addendum governs Hesper's processing of Personal Data. 8.2 Hesper will implement and maintain the safeguards in the Information Security Exhibit, designed to meet the requirements applicable to a third-party service provider under the GLBA Safeguards Rule, state insurance data security laws modelled on NAIC Model #668, and 23 NYCRR § 500.11 where applicable, including multi-factor authentication and encryption of Nonpublic Information in transit and at rest.

8.3 Security Incident notification. Hesper will notify Customer of a Security Incident affecting Customer Data without unreasonable delay and in any event within 48 hours of confirmation, and will provide the information reasonably required for Customer to meet its own notification obligations, including under NAIC Model #668 and 23 NYCRR § 500.17. Hesper will cooperate in Customer's investigation, will not make any public statement identifying Customer without prior written consent except as law requires, and will bear its own remediation costs. Customer controls the content and timing of notifications to regulators and affected individuals.

8.4 Certifications and audit. Hesper will provide its then-current third-party examination report and a completed security questionnaire, including a standardised industry questionnaire such as SIG Lite or CAIQ, annually on request under NDA. Audit and regulatory examination rights are set out in the Insurance Regulatory Rider and the DPA.

8.5 Protected Health Information. If and to the extent Customer is, or acts on behalf of, a HIPAA Covered Entity or another Business Associate such that Hesper's processing makes Hesper a Business Associate, the BAA is automatically incorporated and takes effect as of the first such processing. Customer will notify Hesper in writing before submitting PHI subject to HIPAA. The parties acknowledge that workers' compensation carriers and property-and-casualty insurers are generally not health plans under 45 C.F.R. § 160.103 and that disclosures to them are generally permitted under 45 C.F.R. § 164.512(l), so the BAA may not be triggered in a pure workers' compensation or P&C engagement. Regardless, Hesper will treat all medical, health, mental-health, substance-use, genetic and biometric information within Customer Data as Sensitive Data under the DPA, and Customer remains responsible for compliance with state medical confidentiality and insurance information privacy statutes.

8.6 Compliance with laws. Hesper is responsible for compliance of the Services as a technology offering; Customer is responsible for compliance of its claims-handling, underwriting, referral and adverse-action practices and for its obligations as a licensed insurer, administrator or adjuster. 8.7 Personnel. Hesper will conduct background checks where law permits, require confidentiality obligations, provide annual security and privacy training, apply least-privilege access, and log production access to unmasked Claim File Data. 8.8 Data location. Customer Data will be stored and processed in the location stated on the Order Form, default United States. Hesper will give at least 30 days' notice of a new subprocessor and Customer may object on reasonable data-protection grounds under the DPA.

9.1 Service warranty. Hesper warrants that during the Subscription Term (a) the Services will perform materially in accordance with the Documentation; (b) Hesper will provide the Services in a professional and workmanlike manner using qualified personnel; (c) Hesper will not materially decrease the security protections in the Information Security Exhibit; and (d) the Services will not contain any virus, worm, time bomb or other malicious code knowingly introduced by Hesper.

9.2 Remedy. For breach of § 9.1(a) Hesper will use commercially reasonable efforts to correct the non-conformity. If it fails to do so within 30 days of written notice, Customer may terminate the affected Order Form and receive a pro-rata refund of prepaid, unused fees. This is Customer's exclusive remedy for breach of § 9.1(a), without limiting its rights under §§ 13 and 14.

9.3 Each party warrants that it is duly organised, has authority to enter this Agreement, and that this Agreement is enforceable against it. 9.4 Hesper warrants that it maintains a written information security programme consistent with the Information Security Exhibit, that it is not subject to any pending regulatory enforcement action concerning data security or privacy that would materially affect performance, and that it will maintain the insurance required by § 15.

9.6 DISCLAIMER. EXCEPT AS EXPRESSLY SET OUT IN THIS § 9, THE SERVICES ARE PROVIDED "AS IS," AND HESPER DISCLAIMS ALL OTHER WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, INCLUDING IMPLIED WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, TITLE, NON-INFRINGEMENT AND ACCURACY. HESPER DOES NOT WARRANT THAT THE SERVICES WILL BE UNINTERRUPTED OR ERROR-FREE.

10.1 Not a consumer reporting agency. Hesper does not assemble or evaluate consumer information for the purpose of furnishing consumer reports to third parties and is not a consumer reporting agency under the Fair Credit Reporting Act or any state analogue. Investigation Output is generated for Customer from Customer's own claim records and is not a consumer report. Customer will not use the Services or Output as a consumer report or investigative consumer report, or for any FCRA-permissible-purpose determination, including underwriting eligibility, rate-setting, employment or tenant screening, without notifying Hesper in advance and executing a separate written agreement. Customer is responsible for any adverse action notice required by law.

10.2 Not an insurer, adjuster or licensed investigator. Hesper is not an insurer, reinsurer, producer, third-party administrator, public or independent adjuster, or licensed private investigator, and does not adjust claims, negotiate settlements, make coverage determinations or conduct licensed investigative activity. Where an activity Customer directs through the Services would, if performed by a person, require an adjuster or private investigator licence in a jurisdiction, Customer is responsible for ensuring it is performed or supervised by its own appropriately licensed personnel. Hesper does not conduct physical surveillance, pretexting or in-person interviews unless expressly agreed in a separate written statement of work.

10.3 No legal advice. Nothing provided by Hesper, including Output, denial rationales, referral packages or templates, constitutes legal advice or creates an attorney-client relationship.

10.4 Fraud referrals. Where Output supports a referral to a state fraud bureau, the NICB or law enforcement, Customer remains the referring party. The Services are designed to produce objective, documented and reproducible referral criteria and a complete audit trail, intended to support Customer's reliance on the good-faith immunity available under the NAIC Insurance Fraud Prevention Model Act and its state analogues; Hesper makes no representation that immunity will apply in any particular case. Customer is responsible for the good faith and factual basis of every referral.

10.5 Regulatory change. If a change in law materially affects either party's ability to perform, the parties will negotiate in good faith for 60 days to amend. Failing agreement, either party may terminate the affected Order Form on 30 days' notice with a pro-rata refund of prepaid, unused fees.

11.1 Term. This Agreement continues until all Order Forms have expired or been terminated. Each Order Form runs for its Initial Term and renews for successive 12-month periods unless either party gives written notice of non-renewal within the period stated on the Order Form.

11.2 Termination for cause. Either party may terminate this Agreement or an Order Form on material breach not cured within 30 days of written notice, or immediately if the breach is incurable; and immediately on the other's insolvency, assignment for the benefit of creditors, or bankruptcy filing not dismissed within 60 days.

11.3 Termination for convenience. Customer may terminate an Order Form for convenience on the notice period stated there. Prepaid fees are non-refundable on a convenience termination unless the Order Form states otherwise.

11.4 Regulatory termination. Customer may terminate an Order Form immediately on written notice if a governmental or regulatory authority with jurisdiction over Customer directs Customer to cease using the Services or determines that Customer's use is not permitted, with a pro-rata refund of prepaid, unused fees.

11.5 Effect. On expiration or termination all licences to Customer terminate and Customer will cease use, except that Customer may retain and continue to use Output previously generated under § 6.2; Customer will pay fees accrued through the effective date; Hesper will make Customer Data available for export and delete it under § 6.7; and each party will return or destroy the other's Confidential Information, subject to routine backup retention and legal hold.

11.6 Transition assistance. On Customer's request made before, or within 30 days after, expiration or termination for any reason other than Hesper's termination for Customer's non-payment, Hesper will continue to provide the Services for up to 90 days at the then-current rates and provide reasonable transition and data export assistance, to permit an orderly migration and avoid disruption to Customer's claims operations and regulatory obligations.

11.7 Survival. §§ 1, 2.2, 4.4, 5, 6.1, 6.2, 6.4, 6.6–6.9, 7 as to accrued amounts, 8.3 as to incidents occurring during the term, 9.5, 9.6, 10, 11.5–11.7, 12, 13, 14, 15, 16 and 17 survive termination.

12.1 Confidential Information means non-public information disclosed by one party to the other that is designated confidential or that a reasonable person would understand to be confidential. Customer Data is Customer's Confidential Information. The Services, Documentation, models, security architecture and pricing are Hesper's. The existence and terms of this Agreement are the Confidential Information of both parties.

12.2 The recipient will use Confidential Information only to perform under this Agreement, protect it with at least the degree of care it uses for its own and no less than reasonable care, and limit disclosure to employees, Affiliates, contractors, advisors and subprocessors who need it and who are bound by obligations no less protective. The recipient is liable for their breach. 12.3 Exclusions: information that is or becomes public through no fault of the recipient, was rightfully known without restriction before disclosure, is rightfully received from a third party without restriction, or is independently developed without use of or reference to the discloser's Confidential Information. 12.4 Compelled disclosure is permitted with prompt written notice, unless legally prohibited, and reasonable cooperation to seek protective treatment.

12.6 Confidentiality obligations continue for five years after disclosure, and indefinitely for trade secrets and for Claim File Data and Personal Data.

13.1 By Customer. Customer will defend Hesper and its officers, directors and employees against any third-party claim arising from Customer Data, including a claim that Customer lacked the right or lawful basis to submit it; Customer's use of the Services in violation of the AUP, § 4.4, § 4.5, § 5 or applicable law; Customer's claim determinations, denials, referrals, adverse actions or settlement practices; or Customer's breach of § 10.1 or § 10.2; and will indemnify Hesper for damages, costs and reasonable attorneys' fees finally awarded or paid in settlement.

13.2 By Hesper - intellectual property. Hesper will defend Customer and its officers, directors and employees against any third-party claim that the Services, as provided and used in accordance with this Agreement, infringe or misappropriate a patent, copyright, trademark or trade secret, and will indemnify for damages, costs and reasonable attorneys' fees finally awarded or paid in settlement. This indemnity expressly extends to claims that Investigation Output infringes or misappropriates a third party's intellectual property rights. It does not apply to the extent the claim arises from Customer Data; combination with items not provided by Hesper where the claim would not have arisen but for the combination; Customer's use in breach of this Agreement; or continued use after Hesper notifies Customer to stop and provides a non-infringing alternative at no additional cost.

13.3 Remedies. Hesper may, at its option and expense, procure the right for Customer to continue use, replace or modify the Services to be non-infringing without material loss of functionality, or, if neither is commercially reasonable, terminate the affected Order Form and refund prepaid, unused fees. §§ 13.2 and 13.3 state Hesper's entire liability for intellectual property infringement.

13.4 By Hesper - security and privacy. Hesper will defend Customer against, and indemnify for damages, costs and reasonable attorneys' fees finally awarded or paid in settlement in connection with, any third-party claim or regulatory proceeding to the extent arising from a Security Incident caused by Hesper's breach of the Information Security Exhibit or the DPA, including the reasonable and documented costs of legally required notification to affected individuals and regulators, credit monitoring and identity restoration where required by law or reasonably necessary, forensic investigation, and regulatory fines and penalties assessed against Customer to the extent legally permitted to be indemnified.

13.5 Procedure. The indemnified party will promptly notify the indemnifying party in writing, delay excusing the indemnifying party only to the extent prejudiced; give it sole control of the defence and settlement, provided no settlement imposing a non-monetary obligation, admission of liability or unindemnified payment may be made without the indemnified party's prior written consent; and provide reasonable cooperation at the indemnifying party's expense. The indemnified party may participate with its own counsel at its own expense.

14.1 EXCLUSION OF INDIRECT DAMAGES. NEITHER PARTY WILL BE LIABLE FOR ANY INDIRECT, INCIDENTAL, SPECIAL, CONSEQUENTIAL, EXEMPLARY OR PUNITIVE DAMAGES, OR FOR LOST PROFITS, LOST REVENUE, LOST BUSINESS OPPORTUNITY OR LOSS OF GOODWILL, HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, EVEN IF ADVISED OF THE POSSIBILITY. This does not apply to the Excluded Claims in § 14.4 and does not limit either party's obligation to indemnify a third-party claim under § 13.

14.2 GENERAL CAP. EXCEPT AS PROVIDED IN §§ 14.3 AND 14.4, EACH PARTY'S TOTAL AGGREGATE LIABILITY ARISING OUT OF OR RELATED TO THIS AGREEMENT WILL NOT EXCEED THE TOTAL FEES PAID OR PAYABLE BY CUSTOMER UNDER THE APPLICABLE ORDER FORM IN THE TWELVE MONTHS IMMEDIATELY PRECEDING THE EVENT GIVING RISE TO THE CLAIM.

14.3 SUPERCAP. FOR CLAIMS ARISING FROM (a) A SECURITY INCIDENT CAUSED BY HESPER'S BREACH OF THE INFORMATION SECURITY EXHIBIT OR THE DPA, (b) BREACH OF § 12, (c) BREACH OF § 6.4, OR (d) HESPER'S INDEMNIFICATION OBLIGATIONS UNDER §§ 13.2 AND 13.4, THE LIABLE PARTY'S TOTAL AGGREGATE LIABILITY WILL NOT EXCEED THREE TIMES THE TOTAL FEES PAID OR PAYABLE BY CUSTOMER UNDER THE APPLICABLE ORDER FORM IN THE TWELVE MONTHS IMMEDIATELY PRECEDING THE EVENT, unless a different multiple is stated on the Order Form. The supercap is inclusive of, and not in addition to, the general cap.

14.4 EXCLUDED CLAIMS. THE CAPS DO NOT APPLY TO (a) CUSTOMER'S OBLIGATION TO PAY FEES DUE; (b) EITHER PARTY'S FRAUD, WILFUL MISCONDUCT OR GROSS NEGLIGENCE; (c) CUSTOMER'S INDEMNIFICATION OBLIGATIONS UNDER § 13.1; (d) CUSTOMER'S BREACH OF § 5 OR INFRINGEMENT OF HESPER'S INTELLECTUAL PROPERTY; OR (e) LIABILITY THAT CANNOT BE LIMITED UNDER APPLICABLE LAW.

14.5 Minimum floor. Where fees paid in the preceding twelve months are less than the fees payable for a full twelve-month period, the caps are calculated using the annualised fees stated on the Order Form. 14.6 Basis of the bargain. The limitations in this § 14 are an essential basis of the bargain, reflect the allocation of risk, and apply notwithstanding the failure of essential purpose of any limited remedy. The fees reflect this allocation and would be materially higher without it.

Hesper will maintain insurance coverage as specified on the applicable Order Form. Where coverage is specified, Hesper will provide certificates on request and 30 days' notice of cancellation or material reduction. Neither the maintenance nor the absence of insurance limits Hesper's liability under this Agreement.

16.1 Governing law. This Agreement is governed by the laws of the State of Delaware, without regard to conflict-of-laws rules. The UN Convention on Contracts for the International Sale of Goods does not apply. 16.2 Venue. The parties submit to the exclusive jurisdiction of the state and federal courts located in Wilmington, Delaware, and waive any objection to venue or forum non conveniens. Each party irrevocably waives any right to a trial by jury. Either party may seek injunctive relief in any court of competent jurisdiction to protect its intellectual property or Confidential Information. 16.3 Escalation. Before filing suit, other than for injunctive relief or non-payment, the parties will escalate to an executive of each party for good-faith resolution for 30 days.

16.4 Assignment. Neither party may assign without the other's prior written consent, not to be unreasonably withheld, except to a successor in a merger, acquisition or sale of substantially all assets on written notice. Customer may withhold consent to an assignment by Hesper to a direct competitor of Customer in the business of insurance, or to an entity subject to sanctions or in a jurisdiction from which Customer's regulator restricts data access, and may in that case terminate on 30 days' notice with a pro-rata refund. 16.5 Hesper will notify Customer within 10 business days of a change of control. 16.6 Hesper may engage subcontractors and subprocessors under the DPA and remains fully responsible for their performance.

16.7 Force majeure. Neither party is liable for delay or failure caused by events beyond its reasonable control, excluding payment obligations. If it continues more than 30 days either party may terminate the affected Order Form with a pro-rata refund. 16.8 Publicity. Neither party will use the other's name, logo or trademarks in any press release, customer list, case study or marketing material without the other's prior written consent, which may be withheld in its sole discretion. Consent may be given on an Order Form.

16.9 Notices. Notices must be in writing and sent to the addresses on the Order Form by personal delivery, nationally recognised overnight courier or certified mail, effective on receipt, and copied to legal@gethesperai.com. Routine operational and security notices may be given by email to the designated contacts and are effective on transmission. 16.10 The parties are independent contractors. 16.11 There are no third-party beneficiaries. 16.12 An unenforceable provision will be modified to the minimum extent necessary and the remainder continues in effect. 16.13 No waiver is effective unless in writing.

16.15 Entire agreement; non-reliance. This Agreement, including the Order Forms and Exhibits, is the entire agreement on its subject matter and supersedes all prior and contemporaneous proposals, agreements and communications. Each party acknowledges that it has not relied on, and will have no remedy in respect of, any statement, representation, benchmark, performance figure, case study, roadmap item or assurance not expressly set out in this Agreement, including any contained in Hesper's website, blog, research reports, marketing materials, demonstrations or proposals. Nothing here limits liability for fraudulent misrepresentation. 16.16 This Agreement may be executed in counterparts and by electronic signature.

The version currently published here is dated 12 July 2026. Hesper maintains prior versions and will provide the version applicable to any Order Form on request to legal@gethesperai.com.

Where Customer requires this Agreement as an executed attachment rather than by reference, Hesper will provide a signable copy of the applicable version on request.