1.2. Interpretation:

1.2.1. A reference to a statute or statutory provision is a reference to it as amended or re-enacted. A reference to a statute or statutory provision includes any subordinate legislation made under that statute or statutory provision, as amended or re-enacted

1.2.2. Any phrase introduced by the terms including, include, in particular or any similar expression shall be construed as illustrative and shall not limit the sense of the words preceding those terms.

1.2.3. A reference to a clause or schedule is a reference to a clause or schedule of this Agreement.

1.2.4. A reference to writing or written includes email.

2. Basis of agreement

2.1. By entering into the Order Form the Customer (as defined in clause 1.1 of these Terms) and Peppy (as defined in clause 1.1 of these Terms) shall have entered into a separate contract pursuant to clause 2.2 of the MSA. 

2.2. These Terms apply to the agreement between the Customer and Peppy to the exclusion of any other terms that the Customer seeks to impose or incorporate, or which are implied by trade, custom, practice or course of dealing.

2.3. The Customer waives any right it might otherwise have to rely on any term endorsed upon, delivered with or contained in any documents of the Customer that is inconsistent with these Terms.

2.4. Any demos, drawings, descriptive matter or advertising produced by Peppy are produced for the sole purpose of giving an approximate idea of the Peppy Platform. They shall not form part of these Terms nor have any contractual force.

3. Term

3.1. The Order Form shall commence on the Commencement Date and, unless terminated in accordance with Clause 10, shall continue for the Order Form Initial Term and thereafter shall continue for the Order Form Renewal Terms.

4. Supply of Services

4.1. With effect from the Service Start Date in each respective Territory for each Service Type and throughout the Order Form Term, Peppy shall make the Peppy Platform available to the End Users within each respective Territory to access the relevant Services. The Services are provided “as is” and Peppy makes no warranty or guarantee that the Services will be uninterrupted, error free or fit for purpose.

4.2. The Services will be delivered on all Business Days, with the exception of up to two (2) Training Days annually on which Peppy will deliver training to Practitioners. Peppy will ensure that the Training Days fall on Fridays and during days in which Peppy expects lower End User demand for the Services than usual. Peppy will provide the Customer with sixty (60) days’ notice in advance of Training Days.


4.3. Each Employee may be entitled to grant login access to their End User account to their Partner to receive the benefit of the Services. 

4.4. Peppy shall:

4.4.1. provide the Services in accordance with these Terms in all material respects and with reasonable care and skill;

4.4.2. obtain and maintain insurance for the Order Form Term, at its own cost and expense, appropriate professional indemnity insurance with reputable insurers on customary terms and conditions prevailing in the insurance market;

4.4.3. ensure that Practitioners have been vetted to the minimum standards deemed appropriate by the relevant governing professional bodies. This will typically include:

1. Proof of identification;
2. Proof of current accreditation with the relevant professional body;
3. Proof of current professional indemnity insurance;

4.4.4. conduct any Scheduled Maintenance outside of Service Hours, typically between midnight and 6:00am (GMT), and use reasonable endeavours to provide prior notice of any Emergency Maintenance where expected downtime is in excess of one hour; and

4.4.5. comply with all Applicable Laws, provided that Peppy shall not be liable under these Terms if, as a result of such compliance, it is in breach of any of its obligations under these Terms. If there is any change to any Applicable Laws and such change affects Peppy’s ability to comply with these Terms in a material respect, Peppy and the Customer shall negotiate in good faith appropriate changes to the affected provisions of these Terms to the extent necessary to ensure that Peppy’s performance of its obligations under these Terms is in accordance with such Applicable Laws.

4.5. Peppy may temporarily suspend, withdraw or restrict the availability of all or any part of the Peppy Platform, to the extent necessary for operational reasons and Peppy shall use reasonable endeavours to minimise the effects of any such suspension, withdrawal or restriction and to notify the Customer and the End Users of any such suspension, withdrawal or restriction.

4.6. Peppy shall have the right to make any changes to the Services from time to time: (i) to address its customers’ or the End Users’ needs; (ii) to comply with any Applicable Laws; and/or (iii) changes that do not materially affect the nature or quality of the Services.

5. Customer's obligations

5.1. The Customer shall:

5.1.1. co-operate with Peppy in all matters relating to the Order Form and these Terms;

6. Intellectual Property

6.1. Peppy, its Affiliates and its licensors shall retain ownership of all Peppy IPRs.

6.2. Peppy grants the Customer a fully paid-up, non-exclusive, royalty-free, non-transferable licence for the Order Form Term to use the Peppy Logo on any promotional or marketing material. 

6.5.1. any Peppy IPRs acquired during the Order Form Term; and / or 

6.5.2. any inventions, discoveries, whether patentable, procedures or techniques made, developed, or created by the Customer, whether alone or with Peppy, arising out of or in connection with the Parties fulfilling their obligations under these Terms.

6.6. Subject to clause 6.8, Peppy shall indemnify and keep indemnified the Customer and their directors, officers and employees from and against all liabilities, claims, demands, causes of action, damages, loss, costs and expenses (including interest, penalties, and reasonable legal and professional fees) arising out of or in connection with any claim made by a third party alleging that the Peppy IPRs infringe any valid copyright, patent, trade secret, or any other proprietary right of any third party.

6.7. In the event any infringement claim, action or allegation set out in clause 6.6 is brought or threatened, Peppy may, at its sole option and expense and subject to clause 6.8: 

6.7.1. procure for Customer the right to continue use of the Peppy IPRs or infringing part thereof;

6.7.2. modify, amend or replace the Peppy IPRs or infringing part thereof with other Services or software having substantially the same or better capabilities; or,

6.7.3. if neither of the foregoing is in Peppy’s opinion commercially practicable, terminate the Order Form (or the portion of any Services for allegedly infringing materials).

6.8. The obligations set out in clauses 6.6 and 6.7 will not apply to the extent the infringement arises as a result of:

6.8.1. any use of the Peppy IPRs by the Customer or End Users in a manner expressly prohibited by these Terms or the End User Peppy Terms and Conditions; or

6.8.2. any use by Customer or End Users of the Peppy IPRs in combination with other products, equipment, devices, software, systems or data not supplied by Peppy to the extent such claim is directed against such combination; provided that this exclusion shall not be applicable to combinations with hardware, software or other technology required to access and use the Peppy IPRs (e.g. a web browser, an internet connection, a personal computer, the software platforms provided by third parties upon which certain Peppy applications are built).

6.9. Sections 6.6 to 6.8 states the entire liability of Peppy with respect to infringement of any patent, copyright, trade secret or other intellectual property right.   

6.10. The Customer shall indemnify and keep indemnified Peppy, its Group Companies and its and their directors, officers and employees from and against all liabilities, claims, demands, causes of action, damages, loss, costs and expenses (including interest, penalties, and reasonable legal and professional fees) arising out of or in connection with its, its Group Companies’ and its and their directors, officers and employees breach of Peppy IPRs and breach of clause 5.3 of these Terms.

7. Charges and payment

7.1. In consideration for the provision of the Services, the Customer shall pay Peppy the Charges in accordance with this clause 7. 

7.2. Peppy will issue an invoice for the Charges to the Customer initially upon signing the Order Form in respect of the first Billing Period and at the start of each subsequent Billing Period thereafter. 

7.3. The Customer shall pay each invoice in full and in cleared funds, within 30 days of receipt to a bank account nominated in writing by Peppy.

7.4. Unless otherwise specified on the invoice, all amounts payable by the Customer exclude amounts in respect of value added tax (VAT), which the Customer shall additionally be liable to pay to Peppy at the prevailing rate (if applicable), subject to receipt of a valid VAT invoice. 

7.5. Peppy shall submit invoices for the Charges (plus VAT if applicable) to the Customer by email, to an email address provided by the Customer from time to time. The Customer shall notify Peppy as soon as reasonably practicable to hello@peppy.health, or any alternative email address designated by Peppy for this purpose from time to time, of any changes to the email address where Peppy should submit its invoices.

7.6. Each invoice shall include all reasonable supporting information required by the Customer.

7.7. If the Customer fails to make any payment due to Peppy under the Order Form by the due date for payment, then, without limiting Peppy's remedies under clause 10 (Termination):

7.7.1. the Customer shall pay interest on the overdue amount at the rate of 4% per annum above Barclays Bank's base rate from time to time. Such interest shall accrue on a daily basis from the due date specified in clause 7.3 until actual payment of the overdue amount, whether before or after judgement. The Customer shall pay the interest together with the overdue amount; and

7.7.2. Peppy may suspend the availability of the Peppy Platform or reduce the Services until payment has been made in full. In the event of suspension or reduction under this clause 7.7.2, Peppy reserves the right to notify the End Users of such suspension or reduction.

7.8. All amounts due under the Order Form shall be paid by the Customer to Peppy in full without any set-off, counterclaim, deduction or withholding (other than any deduction or withholding of tax as required by law).

7.9. The Charges are subject to indexation to compensate for inflation with reference to the ONS Retail Price Index (RPI) and will increase by the applicable percentage yearly, starting after the first twelve-month period following the Commencement Date.

8. Data Protection and Security

8.1. The parties shall comply with the provisions of Annex 2: Data Protection and Security

9. Limitation of liability

9.1. Nothing in these Terms shall limit or exclude either party's liability: (i) for death or personal injury caused by its negligence, or the negligence of its personnel, agents or subcontractors; (ii) for fraud or fraudulent misrepresentation; and (iii) any other liability which cannot be limited or excluded by Applicable Laws.

10. Termination

10.1. The Order Form shall automatically terminate with immediate effect where the MSA is terminated in accordance with clauses 6.2 or 6.3 of the MSA. 

10.2. Without affecting any other right or remedy available to it, either party may terminate the Order Form with immediate effect by giving written notice to the other party if:

10.2.1. the other party commits a material breach of any term of these Terms, or the terms of the MSA which breach is irremediable or (if such breach is remediable) fails to remedy that breach within a period of 30 days after being notified in writing to do so; 

10.2.2. the other party repeatedly breaches any of these Terms or the terms of the MSA in such a manner to reasonably justify the opinion that its conduct is inconsistent with it having the intention or ability to give effect to these Terms or the MSA;

10.2.3. the other party takes any step or action in connection with its entering administration, provisional liquidation or any composition or arrangement with its creditors (other than in relation to a solvent restructuring), being wound up (whether voluntarily or by order of the court, unless for the purpose of a solvent restructuring), having a receiver appointed to any of its assets or ceasing to carry on business or, if the step or action is taken in another jurisdiction, in connection with any analogous procedure in the relevant jurisdiction; 

10.2.4. the other party suspends, or threatens to suspend, or ceases or threatens to cease to carry on all or a substantial part of its business; or

10.2.5. the other party's financial position deteriorates to such an extent that in the terminating party's reasonable opinion the other party's capability to adequately fulfil its obligations under these Terms or the MSA has been placed in jeopardy.

10.3. Without limiting its other rights or remedies, Peppy may in its sole discretion, immediately upon serving notice to the Customer, terminate the Order Form, or suspend the provision of the Services under the Order Form or any other agreement between Peppy and the Customer, if the Customer becomes subject to any of the events listed in clause 10.2.1 to clause 10.2.5, or in accordance with clauses 5.4.4 and 5.4.5. For the avoidance of doubt, suspension of the provision of the Services (for any reason) by Peppy shall not affect the Customer’s liability to pay the Charges in accordance with the Order Form and these Terms. 

10.4. Without affecting any other right or remedy available to it, Peppy may terminate the Order Form with immediate effect by giving written notice to the Customer if the Customer fails to pay any amount due under the Order Form or these Terms on the due date for payment and remains in default not less than 30 days after being notified in writing to make such payment.

10.5. The Customer may terminate the Order Form at any time by giving Peppy not less than 30 days’ written notice of such termination, with such termination to take effect at the end of the then effective Order Form Initial Term or Order Form Renewal Term.  

10.6. Any notice of termination of the Order Form by the Customer must be delivered to Peppy by email on hello@peppy.health or any alternative email address designated by Peppy for this purpose from time to time. 

10.7. Immediately on provision or receipt of notice to terminate under this Clause 10, the Customer shall issue written communications to the End Users regarding the conclusion of the Services. Peppy will provide reasonable assistance to the Customer in the preparation of such communications. 

11. General

11.1. Force majeure. Other than in respect of Charges payable by the Customer under the Order Form, neither party shall be in breach of these Terms nor liable for delay in performing, or failure to perform, any of its obligations under these Terms due to any circumstance not within a Party's reasonable control, including without limitation, if such delay or failure result from acts of God, flood, earthquake or other natural disaster.

11.2. Assignments and other dealings

11.2.1. Except as permitted by clause 11.2.2, neither party may subcontract, assign, transfer, novate, grant any trust over, or otherwise deal with any of its rights or obligations under the Order Form or these Terms without the prior written consent of the other party, such request not to be unreasonably withheld or delayed, except that Peppy may assign the Order Form and these Terms to a purchaser of all or substantially all of its business or assets to which these Terms relates upon giving notice to the Customer in writing. 

1. to its Affiliates, employees, officers, representatives, subcontractors or advisers who need to know such information for the purposes of carrying out the party's obligations under these Terms. Each party shall ensure that its employees, officers, representatives, subcontractors or advisers to whom it discloses the other party's confidential information comply with this clause 11.3; and
   
2. as may be required by law, a court of competent jurisdiction or any governmental or regulatory authority.

11.3.3. No party shall use any other party's confidential information for any purpose other than to perform its obligations under these Terms.

11.3.4. No party shall make, or permit any person to make, any public announcement concerning the Order Form or these Terms without the prior written consent of the other party (such consent not to be unreasonably withheld or delayed), except as required by law, any governmental or regulatory authority (including, without limitation, any relevant securities exchange), any court or other authority of competent jurisdiction.

11.3.5. This clause shall survive termination or expiry of the Order Form.

11.4. Variation. No variation of these Terms shall be effective unless it is in writing and signed by the parties (or their authorised representatives). 

11.6. No partnership or agency. Nothing in these Terms is intended to or shall operate to create a partnership between the parties, or authorise either party to act as agent for the other, and neither party shall have the authority to act in the name or on behalf of or otherwise to bind the other in any way (including, but not limited to, the making of any representation or warranty, the assumption of any obligation or liability and the exercise of any right or power).

11.7. Severance. If any provision or part-provision of these Terms is or becomes invalid, illegal or unenforceable, it shall be deemed modified to the minimum extent necessary to make it valid, legal and enforceable. If such modification is not possible, the relevant provision or part-provision shall be deemed deleted. Any modification to or deletion of a provision or part-provision under this clause 11.7 shall not affect the validity and enforceability of the rest of these Terms.

Governing law. These Terms and the Order Form, and any dispute or claim (including non-contractual disputes or claims) arising out of or in connection with it or its subject matter or formation, shall be governed by, and construed in accordance with the law of England and Wales.

11.10. Governing law. These Terms and the Order Form, and any dispute or claim (including non-contractual disputes or claims) arising out of or in connection with it or its subject matter or formation, shall be governed by, and construed in accordance with the law of England and Wales.

11.11. Jurisdiction. Each party irrevocably agrees that the courts of England and Wales shall have exclusive jurisdiction to settle any dispute or claim (including non-contractual disputes or claims) arising out of or in connection with these Terms or this Order Form or its subject matter or formation.

SCHEDULE 1 – SERVICES

Peppy shall provide a secure mobile app which Employees and their Partners can download to their smartphones via either the iOS App Store or Google Play Store (the Peppy Platform). To access the Services, Employees and their Partners must initially register using the employer email domain, but will then be asked to provide their personal email address at a later stage in the registration process which will be linked to their account. The Peppy mobile app will check whether the employee email domains fall within the scope of this Agreement, and, if a match occurs, the Employee or their Partner may continue to complete the registration (at which point the Employee or their Partner is considered to be an End User under the definitions in these Terms).  If the Peppy Platform does not recognise the employer email domain, then an error message will be displayed, together with instructions on how to remediate the issue.

Once an Employee or their Partner has successfully registered and has become an End User,  Peppy shall make available the Service Types (as more particularly described in Schedule 1 of the MSA) via the Peppy Platform which the Customer has opted to include as set out in the Order Form.

These services may include, but is not limited to the following to be provided within the relevant Territory:

• Peppy multi-week programmes;
• Peppy vetted resources aligned with recognised healthcare guidance within the relevant Territory (where applicable);
• Peppy webinars with expert practitioners;
• Private 1 to 1 chat with expert practitioners;
• Private telephone or video consultations with expert practitioners; and
• Group video calls with an expert practitioner.

The Service Hours for each Service Type shall be as follows, but are subject to change at any time to enable Peppy to optimise End User access and use of the Services:

• Fertility services: 9am-9pm on Business Days
• Baby services: 9am-6pm on Business Days
• Menopause services: 9am-9pm on Business Days
• Women’s health services: 9am-6pm on Business Days
• Men’s health services: 9am-6pm on Business Days

SCHEDULE 2 - SERVICE LEVEL AGREEMENT

1. Service Level Requirements.

1.1. Service Level Targets (as set out in the below table) shall be measured on a monthly basis.

1.2. Where Peppy fails to adhere to two or more individual Service Level Target on four (4) or more occasions during a six (6) month rolling period, this shall constitute a material breach of the Agreement.

1.3. The following Service Level Targets set out in the below table shall apply as the initial service level targets for the provision of the Services, as may be amended by the Parties in writing from time to time:

ANNEX 2 – DATA PROTECTION AND SECURITY (UK & ROI)
Version 1.0 - last updated 15 December 2022

This Annex 2 as may be amended by Peppy from time to time shall apply to the associated Order Form solely to the extent that Peppy or the Peppy Affiliate provides Premium services in the UK and Republic of Ireland. For all other services in any  other Territory to be provided by Peppy or the Peppy Affiliate, please refer to the separate Applicable Annex.

PART 1 - DATA PROTECTION

1. Interpretation
   1.1. Capitalised words in this Part 1 - Annex 2 shall have the meanings given to them in Annex 1 and the associated Order Form, unless further defined below:

2. The Customer acknowledges that upon activation of an End User Licence by an End User, an independent contractual relationship will arise between Peppy and each End User, and that Peppy will be a separate Data Controller in relation to any Personal Data of each such End User, as Peppy will independently determine the purposes for which and the manner in which Peppy and relevant Third-party Cloud Infrastructure Providers where applicable, will Process such Personal Data, including, but not limited to, the Processing for the purpose of Peppy’s compliance with its contractual obligations to any such End User. 

3. The terms, details and duration of Peppy’s processing of Personal Data as Data Controller shall be set out in its Privacy Policy, including details of Third-party Cloud Infrastructure Providers where these entities act as Processors of Personal Data on behalf of Peppy. 

4. Peppy shall at all times comply with the Data Protection Laws in relation to its Processing of the Personal Data of End Users.

5. Peppy maintains appropriate technical and organisational measures to protect Personal Data against unauthorised or unlawful processing and against accidental loss, destruction, damage, theft, alteration or disclosure. These measures shall be appropriate to the harm which might result from any unauthorised or unlawful processing, accidental loss, destruction, damage or theft of the Personal Data and having regard to the nature of the Personal Data which is to be protected.

6.1  take action immediately to investigate the suspected Personal Data Breach;

6.2 take action immediately to identify, prevent and mitigate the effects of the Personal Data Breach and remedy the Personal Data Breach; and

6.3 comply with all notification obligations with respect to Data Subjects, Supervisory Authorities or any other entity requiring notification under the Data Protection Laws, and provide such information as may be reasonably required by the Customer to respond to complaints or enquiries from Data Subjects relating to the Personal Data Breach, provided that Peppy will not provide Personal Data to the Customer as part of such notification unless instructed to by the Data Subject.

PART 2 – SECURITY

1. Interpretation
   
   

   1.1.  Capitalised words in this Part 2 - Annex 2 shall have the meanings given to them in Annex 1 and the associated Order Form, unless further defined below:

1. Information Security Requirements

Peppy shall maintain and implement appropriate security systems, controls, policies and procedures as least as effective at minimising the risk of an information security breach as required by Good Industry Practice (including an information security risk management framework to record and manage all information security risks which provides for, as a minimum: (i) a clear definition of the scope of information risk assessments; (ii) the performance of business impact assessments to determine impact to the Services; and (iii) all risks identified having a risk owner assigned to them).

2. Security Incident Management

Peppy will implement a process, including where appropriate forensic investigation, for the management and reporting of actual or suspected Incidents which includes: (i) communication to all relevant persons in order to promote prompt reporting and control of any suspected, attempted or actual security breaches; and (ii) notification to Customer with details of the Incident and its potential impact. Peppy will promptly make Customer aware of the remediation being instigated by Peppy in order to resolve any Incident impacting Customer or any Customer Group Company.

3. Access Management

Peppy shall: (a) maintain and implement appropriate security systems, controls, policies and procedures to ensure the secure use of (and protected access to) all applications, databases and devices used to service the Customer Group Companies' businesses; (b) ensure that access to any applications, databases or devices used pursuant to the Agreement is: (i) only granted to those Peppy personnel who reasonably need it for the purposes of the Agreement; and (ii) restricted in accordance with the role or function of the individual; and (c) ensure that adequate procedures are in place so that Peppy personnel access is: (i) added, modified and deleted in a timely manner; and (ii) routinely reviewed for recertification and revalidation purposes.

4. Remote Access Security

Peppy shall ensure that controls are in place to prevent unauthorised remote access, including (but not limited to): (i) using strong authentication (e.g. two-factor authentication) to authenticate Peppy's users; (ii) encryption from the end-point (e.g. laptop) to the network for all data travelling across a remote access mechanism; and (iii) logging of all remote access attempts and reviewing of any suspicious activity.

5. Portable Storage Device Security

Peppy shall not store Customer Data on unencrypted portable storage devices. Where portable devices do hold Customer Data, Peppy shall ensure that: (i) they are locked securely away when not in use; (ii) use in public areas is avoided; (iii) the data stored within the device is no more than the minimum required; and (iv) all devices are adequately encrypted and password protected.

6. Data Transfer Security

Peppy shall ensure that all Customer Data sent over the internet either by e-mail or via other internet protocols (e.g. FTP) is: (i) encrypted using at least a 256 bit encryption mechanism; and (ii) only transferred via pre-configured communications with electronic acknowledgement. 

7. Password Management

Peppy will ensure that: (i) in respect of any passwords used for access to its systems, standard password configuration includes (without limitation): minimum length, complexity, expiry, history, and account lockout following consecutive failed logon attempts; (ii) the aforementioned configuration is implemented at system level and documented within a password management strategy or policy document; (iii) all non-personal IDs are documented (including the purpose of the access); and (iv) all staff are made aware of the importance of keeping their passwords confidential.

8. Network Security

Peppy shall perform (at least monthly): (i) anti-virus and perimeter scanning activities on its IT estate which include firewall and email scanning services; and (ii) patch management activity in accordance with Good Industry Practice.

9. Physical Security Management

Peppy shall ensure that appropriate controls are in place at its premises and any other premises used in the performance of the Agreement to prevent unauthorised physical access to those premises.

10. Data Disposal

Peppy shall ensure that any hardcopy Customer Data is shredded (using a cross-cut shredder or incineration) and securely disposed of via an internal disposal mechanism or by using a third party. For IT assets, Peppy must ensure that any IT assets and electronic media being used to store Customer Data that are no longer required are destroyed by incineration, damaged beyond repair or that the Customer Data is erased using data erasure technology such that Customer Data is erased and not recoverable (and a certificate of destruction provided to Customer as evidence that the foregoing has been done). Upon the expiry or termination of the Agreement, Peppy shall: (a) assist Customer in the return, transfer and/or destruction of all Customer Data from all sources, networks and devices used by Peppy or any of Peppy’s sub-contractors, if requested by the Customer; and (b) ensure that all physical or logical assets, intellectual property and licences are returned, and physical and logical system access to Customer Data or Customer Systems is revoked within timescales agreed with Customer. In the event that Customer Data has to be retained by Peppy due to legal and/or regulatory reasons, Peppy shall ensure that such Customer Data is only retained in accordance with Peppy’s data retention and privacy policy.

11. Public Cloud Services

Peppy will provide adequate assurance of any Public Cloud Services provider’s security controls by allowing Customer access to documentation relating to the Public Cloud Services provider’s security controls and certification status. Peppy reserves the right to change or modify its use of Public Cloud Services at any time.

ANNEX 3 - TERMS AND CONDITIONS FOR PEPPY PREMIUM (USA)
Version 1.1 - last updated 10 March 2023

These terms and conditions shall apply to the associated Order Form solely to the extent that Peppy or the Peppy Affiliate provide Premium services, as further described in the MSA, to the Customer Affiliate in the United States of America. For all other services to be provided by Peppy or the Peppy Affiliate in any other Territory as set out in the associated Order Form, please refer to the separate Applicable Annex.

Capitalized words in these Terms and Conditions shall have the meanings given to them in the MSA or the associated Order Form, unless further defined herein. Where there is a conflict between a defined word in the MSA and a word defined in this Annex, the definition in this Annex shall prevail. In this Annex, “Customer” shall mean the Customer Affiliate and “Peppy” shall mean the Peppy Affiliate set out in the Order Form. 

Whereas, Peppy has developed mobile applications for the provision of certain healthcare services; and 

Whereas, Peppy Health provides management services to the PCs who provide all clinical services in the Peppy Platform;

Whereas, Customer wishes to make the Peppy Platform available to its employees.

Now, therefore, in consideration of the mutual covenants contained herein, the parties hereby agree as follows:

Terms:

1. Services.  Peppy shall provide the Services described in Exhibit A (“Services”) via the www.peppy.health website and any other website, subdomain and/or mobile application used by Peppy from time to time to deliver the Services to the Customer and/or the End Users (as defined in Exhibit A) (the “Peppy Platform”). 

2. Covered Individuals. Peppy will provide the Services to all Customer’s employees, workers and consultants (including any individuals acting in their personal capacity pursuant to a contract for services) who are based in the US (“Employees”), and their spouse, civil partner, or the person with whom they are in an established relationship, whether same sex or not (“Partners”) (together the “Covered Individuals” or “End Users”) as described in Exhibit A. 

3. Fees. 

3.1 Acceptable Payment.  The Parties agree to the payment terms described in Exhibit B. 

3.2 Payment Procedures.  With respect to any amounts owed by Customer pursuant to Exhibit A, Customer must pay such fees within thirty (30) days of receipt of the applicable invoice. If Customer disputes any fees by providing written notice prior to the date such fees are due with reasonable specificity of the grounds for such dispute, the parties will work in good faith to promptly resolve such disputes. 

3.3 Taxes. The fees do not include any taxes, duties or similar assessments that may be imposed on the Services. Customer will be responsible for paying all such amounts associated with Customer’s receipt of the Services (except for taxes based on Peppy’s income).

4. Intellectual Property Rights & Data. 

4.1 Intellectual Property.  Customer retains ownership of all right, title and interest into and to its intellectual property and proprietary rights, including its logos and trademarks.  Peppy retains ownership of all right, title and interest in and to its intellectual property and proprietary rights, including to its software (any modifications and derivative works thereof) and its logos and trademarks.  All rights not expressly granted herein are reserved.  Customer acknowledges all intellectual property rights subsisting in the Peppy Platform, and agrees that any statistical and/or aggregated data generated by the Peppy Platform as a result of the Covered Individuals’ use of the Peppy Platform shall be the intellectual property and proprietary rights of Peppy (the “Peppy IPRs”). Customer further agrees that it shall not (i) license, sublicense, sell, resell, rent, lease, transfer, distribute or otherwise commercially exploit or make the Peppy IPRs available to any third party other than as contemplated by this Agreement; (ii) make derivative works of, disassemble, reverse compile or reverse engineer any part of the Peppy IPR, or access the Peppy IPR in order to build a similar or competitive product or service (or contract with a third party to do so); without prior written consent from Peppy and provided that Peppy agrees to such action(s), Customer shall comply with any reasonable instructions and restrictions imposed by Peppy.

5. Data Privacy and Security

5.1 Peppy and Customer shall comply with Annex 4 – Data Privacy and Security (USA).

6. Publicity.

6.1 Use of Name and Customer Marks.  Peppy agrees that Customer and its specific designees may list Peppy’s name, address and telephone number in any advertising and marketing materials pertaining to this Agreement.  Customer agrees that Peppy may use Customer’s name and logo in any advertising and marketing materials pertaining to this Agreement and the Services without prior approval of Customer.

6.2 Promotion of Peppy’s Services. Customer shall, in accordance with this Agreement, actively promote any of Peppy’s Services listed on Exhibit A to Covered Individuals.  

7. Reports and Recordkeeping. 

7.1 Reports. Peppy will provide reports in the manner set forth in Exhibit A. 

7.2 Service Records.  During the Order Form Term and for the longer of: (1) two years following the termination of this Order Form or (2) as required by applicable law, Peppy shall maintain digital records on services and all charges it provides to each Covered Individual(s) in compliance with Peppy’s data records retention policy.  Peppy will not maintain medical records for more than ten (10) years after the last date of service for a Covered Individual.  Both parties hereto agree to keep all such records as confidential and comply with all applicable state and federal laws and regulations in regard to maintenance of such service records.

8. Representations and Warranties. 

8.1 Peppy Representations and Warranties.  Peppy represents and warrants that it (a) has the right to enter into this Agreement and perform the services contemplated hereunder; (b) will comply with all applicable laws, ordinances or governmental rules or regulations in connection with the Services, including, as applicable, HIPAA; and (c) it will perform the Services in a professional manner consistent with reasonable industry standards. 

8.2 Customer Representations and Warranties. Customer represents and warrants that it (a) has the right to enter into this Agreement; (b) will comply with all applicable laws, ordinances or governmental rules or regulations in connection with the Services, including, as applicable, HIPAA; and (c) has obtained the consent necessary under applicable law, including the Telephone Consumer Protection Act (“TCPA”) to allow Peppy to contact Covered Individuals as contemplated in this Agreement. 

8.3 No Federal Exclusion. Peppy warrants that neither Peppy nor any of its owners, officers, directors, employees, or principals (collectively “Principals”), is an Ineligible Person. An “Ineligible Person” is an individual or entity who:  

(a) is currently excluded, disbarred, suspended, or otherwise ineligible to participate in federal or state health care programs or in federal or state procurement or nonprocurement programs.  This includes persons who are on the List of Excluded Individuals or Entities of the Inspector General, List of Parties excluded from Federal Programs by the General Services Administration or the Medicaid Sanction List; or 

(b) Has been convicted of a criminal offense related to the provision of health care items or services within the rules and regulations of 42 USC §1320a-7(a), but has not yet been excluded, debarred, suspended, or otherwise declared ineligible.  

Peppy agrees to report immediately to Customer if either Peppy or any of its Principals becomes an Ineligible Person during the Order Form Term.  

8.4 Disclaimer. ASIDE FROM THE LIMITED WARRANTY PROVIDED IN SECTION 8.1 PEPPY EXPRESSLY DISCLAIMS ALL WARRANTIES IN CONNECTION WITH THIS AGREEMENT OR THE SERVICES, WHETHER EXPRESS OR IMPLIED, WRITTEN OR ORAL (INCLUDING ANY WARRANTY OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, OR NON-INFRINGEMENT) OR ARISING FROM A COURSE OF DEALING. IN ADDITION, PEPPY DOES NOT WARRANT THAT ANY SERVICES RENDERED HEREUNDER WILL BE UNINTERRUPTED OR ERROR-FREE, OR THAT ALL DEFECTS WILL BE CORRECTED. THIS DISCLAIMER AND EXCLUSION WILL APPLY EVEN IF THE EXPRESS WARRANTY FAILS OF ITS ESSENTIAL PURPOSE.  ANY DEMOS, DRAWINGS, DESCRIPTIVE MATTER OR ADVERTISING PRODUCED BY PEPPY ARE PRODUCED FOR THE SOLE PURPOSE OF GIVING AN APPROXIMATE IDEA OF THE PEPPY PLATFORM.  THEY SHALL NOT FORM PART OF THIS AGREEMENT NOR HAVE ANY CONTRACTUAL FORCE.

9. Limitation of Liability. 

TO THE FULLEST EXTENT PERMISSIBLE UNDER LAW, (I) NEITHER PARTY WILL HAVE ANY LIABILITY TO THE OTHER PARTY WITH RESPECT TO ANY CONSEQUENTIAL, EXEMPLARY, SPECIAL, INCIDENTAL, MULTIPLE, PUNITIVE OR OTHER INDIRECT DAMAGES, ARISING OUT OF THIS AGREEMENT, EVEN IF IT HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES, AND (II) OTHER THAN WITH RESPECT TO INDEMNIFICATION OBLIGATION IN SECTION 10, IN NO EVENT WILL PEPPY’S TOTAL CUMULATIVE LIABILITY IN CONNECTION WITH OR UNDER THIS AGREEMENT (UNDER ANY THEORY OF LIABILITY) EXCEED THE FEES PAID OR PAYABLE BY CLIENT UNDER THIS AGREEMENT IN THE TWELVE (12) MONTHS PRECEDING THE APPLICABLE CLAIM. 

10. Indemnification. Each Party hereby agrees to indemnify, defend and hold harmless the other Party, its affiliates, and their respective directors, employees and agents from and against any and all liabilities, losses, claims, suits, actions, allegations, legal or administrative proceedings, debts, demands, damages, and expenses (including defense costs and attorney fees), interest and costs (collectively, “Losses”) to the extent arising out of or related to this Agreement or the Services performed hereunder, which are in any manner directly or indirectly caused, occasioned, contributed to, or claimed to be due, in whole or in part, to any actual or alleged: (i) claim made by a third party that the Peppy IPRs infringe any valid copyright, patent, trade secret, or any other proprietary right of any third party; (ii) death or personal injury caused by negligence or intentional or willful misconduct of the indemnifying party; or (iii) failure of the indemnifying party to comply with applicable law. The indemnified party shall give the indemnifying party control over the defense and settlement of such claims.

11. Order Form Term and Termination

11.1 This Order Form shall be in full force and effect for the Initial Order Form Term and shall renew for the Order Form Renewal Term (collectively the “Order Form Term”) unless either Party provides written notice of non-renewal ninety (90) days prior to the end of the then current Order Form Initial Term or Order Form Renewal Term. The payment terms for any Order Form Renewal Terms shall be as set forth on Exhibit B unless Peppy provides written notice of any rate increases at least sixty (60) prior to the end of the then current Order Form Renewal Term.

11.2 Termination.  Upon a material breach of these Terms and Conditions by either Party (the “Breaching Party”), the affected Party (the “Non-Breaching Party”) may immediately terminate the Order Form if the Breaching Party does not cure the breach within ninety (90) days of receiving written notice of the breach from the Non-Breaching Party.  For the avoidance of doubt, nonpayment of fees due under the Order Form shall constitute a material breach of these Terms and Conditions.  In the event of a material breach and/or persistent breach by a Covered Individual, Peppy shall have the right, at its sole discretion, to either i) suspend access to the Peppy Platform for such Covered Individual or ii) suspend provision of the Services under this these Terms and Conditions.

11.3 Effects of Termination. Upon the expiration or termination of the Order Form for any reason Sections 2, 3, 5, 6, 8.4, 9, 11, 12 and 13 will survive in accordance with their terms.  Immediately on provision or receipt of notice to terminate under this Section 11, Customer shall issue written communications to the Covered Individuals regarding the conclusion of the Services.  Peppy will provide reasonable assistance to Customer in the preparation of such communications.

12. Confidentiality.  Each Party undertakes that it shall not at any time disclose to any person any confidential information concerning the business, affairs, customers, clients or suppliers of the other Party, except as permitted by section 12.1.

12.1 A Party may disclose the other Party’s confidential information:

(a) to its employees, officers, representatives, subcontractors or advisers who have a need to know such information for the purposes of carrying out the Party’s obligations under these Terms and Conditions.  Each Party shall ensure that its employees, officers, representatives, subcontractors or advisers to whom it discloses the other Party’s confidential information comply with this section 12.1; and

(b) as may be required by law, a court of competent jurisdiction or any governmental or regulatory authority.

No Party shall use the other Party’s confidential information for any purpose other than to perform its obligations under these Terms and Conditions.

13. Insurance.   Peppy shall at all times during the continuance of these Terms and Conditions, and for so long after its termination as may be necessary, properly maintain, at its sole cost and expense, the following coverage with financially reputable insurers that are licensed to do business in all jurisdictions where the Services are performed and that are reasonably acceptable to Customer:  (i) statutory workers’ compensation as required by law and employer’s liability insurance with a minimum coverage of $1,000,000 per accident, including master servant or borrowed servant endorsement; (ii) comprehensive or commercial general liability insurance, written on an occurrence form, including but not limited to premises-operations, broad form property damage, products/completed operations, contractual liability, independent contractors, personal injury and advertising injury and liability assumed under an insured contract. Excess/umbrella liability insurance policies must follow the form of the underlying liability policy(s) of at least $2,000,000; and (iii) cyber liability with a minimum of $1,000,000 in specific and aggregate coverage.  

14. General Terms.

14.1 Notices.  Any notice required to be given under the provisions of these Terms and Conditions shall be in writing and shall be duly served when it shall be hand-delivered to the addressees set out below, or shall have been deposited, duly registered or certified, return receipt requested, in a United States Post Office addressed to the other Party at the following addresses:

If to Peppy:

Peppy Health Corporation

1209 Orange Street

Wilmington, DE 19801 

with a copy to: legal@peppy.health

If to Customer:  

To the registered office address of the Customer Affiliate with a copy to the Customer who has signed the MSA, or to such other address as the Customer may notify in advance to Peppy in writing.

14.2 Governing Law.  These Terms and Conditions shall be construed, interpreted, and governed by the laws of the State of New York.  The parties irrevocably consent to the sole and exclusive forum and venue for any action or litigation under these Terms and Conditions shall be the state and federal courts in New York County, New York.

14.3 Severability. If any provision of these Terms and Conditions is held to be illegal, invalid, or unenforceable under present or future laws effective during the terms hereof, such provision shall be fully severable.  These Terms and Conditions shall be construed and enforced as if such illegal, invalid, or unenforceable provision had never been a part hereof, and the remaining provisions shall remain in full force and effect unaffected by such severance; provided that if the invalid provision is material to the overall purpose and operation of these Terms and Conditions, then these Terms and Conditions shall terminate upon the severance of the illegal, invalid, or unenforceable provision.

14.4 Relationship of the Parties.  It is understood and agreed that Peppy is a separate legal entity from Customer and neither it nor any employees, volunteers, or agents contracted by it shall be deemed for any purposes to be employees or agents of Customer.  Peppy assumes full responsibility for the actions of its personnel and volunteers while performing any services incident to these Terms and Conditions, and shall remain solely responsible for their supervision, daily direction and control, payment of salary (including withholding of income taxes and social security), workers’ compensation, disability benefits and like requirements and obligations. Nothing in these Terms and Conditions shall be deemed or construed to create any third-party beneficiaries or otherwise give any third-party any claim or right of action against any Party to these Terms and Conditions.

14.5 Authorization.  Each Party represents and warrants to the other that the execution of the Order Form has been duly authorized, and that the Order Form and these Terms and Conditions constitutes a valid and enforceable obligation of such Party according to its terms.

14.6 Waiver.  The waiver by either Party of any breach of any provision of these Terms and Conditions or warranty or representation herein set forth shall not be construed as a waiver of any subsequent breach of the same or any other provision.  The failure to exercise any right hereunder shall not operate as a waiver of such right.  All rights and remedies provided for herein are cumulative.

14.7 Assignment.  These Terms and Conditions shall not be assignable by either Party except in connection with the transfer or sale of all or substantially all of its equity, in the event of the merger or consolidation with another corporation, or in connection with the sale of all or substantially all of a Party’s assets to which these Terms and Conditions pertains, and in the case of Customer, provided that such assignee is not a competitor of Peppy. These Terms and Conditions will inure to the benefit of the parties and their successors and permitted assigns.

14.8 Force Majeure. Except for payment obligations, neither Party will be liable to the other Party for a failure to perform its obligations under these Terms and Conditions as a result of actions beyond its reasonable control that cannot be mitigated through the exercise of due care. 

14.9 Section Headings.  The headings of sections contained in these Terms and Conditions are for convenience only, and they shall not, expressly or by implication, limit, define, extend, or construe the terms or provisions of the sections of these Terms and Conditions.

14.10 Entire Agreement.  The Order Form, these Terms and Conditions and the documents referred to in them contains all the terms and conditions agreed upon by the parties hereto regarding the subject matter of the Order Form and supersedes any prior agreements, promises, negotiations or representations, either oral or written, relating to the subject matter of the Order Form. No amendment to these Terms and Conditions shall be valid unless it is in writing and signed by the parties. 

14.11 Counterparts.  The Order Form may be executed in any number of counterparts, by digital signature or by a scanned signature page in a format such as PDF, each of which will be deemed an original, but all of which taken together will constitute one single agreement between the Parties.

Exhibit A: Services

I. Services. During the Order Form Term, Peppy will provide the Services as set out in the Order Form which shall as appropriate include without limitation the services described below: 

Peppy shall provide a secure mobile app which the Customer Employees or their Partners can download to their smartphones via either the iOS App Store or Google Play Store.  To access the services listed below, Employees or their Partners must initially register using the employer email domain, but will then be asked to provide their personal email address at a later stage in the registration process which will be linked to their account. The Peppy mobile app will check whether the employee email domains fall within the scope of these Terms and Conditions, and, if a match occurs, the Employee or the Partner may continue to complete the registration (at which point the Employee or Partner is considered to be a “Covered Individual”).  If the Peppy Platform does not recognize the employer email domain, then an error message will be displayed, together with instructions on how to remediate the issue.

Once an Employee or Partner has successfully registered and has become a Covered Individual, Peppy shall make available the Service Types (as more particularly described in Schedule 1 of the MSA) via the Peppy Platform which the Customer has opted to include as set out in the Order Form.

The Services may include, but are not limited to the following:

• Peppy multi-week programs;
• Peppy vetted resources aligned with recognized healthcare guidance;
• Peppy webinars with expert practitioners;
• Private 1 on 1 chat with expert practitioners;
• Private telephone or video consultations with expert practitioners; 
• Group video calls with an expert practitioner; and
• Prescription fulfillment*.

The Service Hours shall be from 9am to 6pm in all states (except for Hawaii and Alaska where the Services Hours shall be from 6am to 3pm) on Business Days, which is subject to change at any time to enable Peppy to optimize the Covered Individual’s access and use of the Services:

II. Reports. Peppy will provide standard quarterly and annual reports including aggregated and anonymous data. 

III. Customer Cooperation. If requested, Customer will reasonably cooperate with Peppy in the provision of the Services, and will provide Peppy with key clinical, information technology and Covered Individual data support. This support includes, but is not limited to, the following:

(a) Provision of Data: Customer shall provide Peppy, directly or through a third-party, in format(s) and at a frequency agreed to by both parties, with: 

a. Targeted emails following identification, through data analysis, that a potential Covered Individual has received treatment or fulfilled prescription related to certain health issues;

b. Monthly emails designed to notify potential Covered Individuals of the availability of Peppy;

c. Quarterly calls or text messages designed to notify potential Covered Individuals of the availability of Peppy;

d. The inclusion of the Peppy Platform in any plan or wellness program materials describing benefits available to potential Covered Individuals; and

e. Annual all employee announcement notifying potential Covered Individuals of the availability of Peppy. 

iv. Customer shall send a communication to all Employees on the Launch Date notifying them of the availability of Peppy and shall not launch any other benefits on the same day as the Launch Date. Customer shall hold a launch event, to be coordinated with Peppy, within one week of the Launch Date. Customer shall make reasonable efforts to communicate the availability and nature of the Peppy Platform to Employees in settings such as, but not limited to, open enrollment guides, internal benefit intranet sites, email and onsite correspondence about health benefits, and onsite events.

v. Customer shall make its on-site clinic personnel, if any, available for training on the Peppy Platform so as to facilitate recommendations to Covered Individuals of the Peppy Platform by such on-site clinic(s).

* As is customary with service agreements of this type, prescription fulfillment is subject to a third-party service provider and Peppy disclaims all liability for the services of such third-party provider.  

Exhibit B: Compensation

The “Launch Date” in these terms and conditions shall mean the first date that the End Users are able to actively use the Services via the Peppy Platform, such date shall be mutually agreed between the Parties in advance.

A “Billing Period” in these terms and conditions shall mean the initial twelve (12) month period commencing from the first Launch Date of any Service taken by the Customer in the Order Form, and each subsequent twelve (12) month period thereafter, in respect of which Peppy issues invoices for Charges under this Agreement.

Customer shall pay to Peppy the Charges initially upon signing the Order Form in respect of the first Billing Period and at the start of each subsequent Billing Period thereafter.  

Customer shall notify Peppy within thirty (30) days of an increase during the Order Form Term of more than twenty (20) percent of the total number of Employees.  In the event of such increase, Customer acknowledges and agrees that Peppy shall have the right to apply a proportionate increase to the Charges in the subsequent Billing Period.  

The Charges are subject to a five percent (5%) increase per annum during the Order Form Term of this Agreement.

Except where Customer has terminated properly under Section 11.2 of these Terms and Conditions, no refunds shall be due to Customer for any Charges paid to Peppy and/or any other sums paid by Customer to Peppy.  

All prices are exclusive of applicable taxes.

Exhibit C: Service Level Agreement

1. Service Level Requirements

1.1  Service Level Targets shall be measured on a monthly basis. Service Level Targets shall be split into two groups based on the Covered Individual’s residence in either a primary or a secondary state. Primary states shall be: California, Connecticut, Florida,  Illinois, New Jersey, New York, North Carolina and Texas. Secondary states shall be: Alabama, Alaska, Arizona, Arkansas, Colorado, Delaware, Georgia, Hawaii, Idaho, Indiana, Iowa, Kansas, Kentucky, Louisiana, Maine, Maryland, Massachusetts, Michigan, Minnesota, Mississippi, Missouri, Montana, Nebraska, Nevada, New Hampshire, New Mexico, North Dakota, Ohio, Oklahoma, Oregon, Pennsylvania, Rhode Island, South Carolina, South Dakota, Tennessee, Utah, Vermont, Virginia, Washington, West Virginia, Wisconsin, Wyoming, and the District of Columbia.

1.2 Rules and regulations regarding the provision of telemedicine vary by state and may change at any time which may result in modification to the Service.

1.3 Where Peppy fails to adhere to two or more individual Service Level Targets on four (4) or more occasions during a six (6) month rolling period, this shall constitute a material breach of these Terms and Conditions.

1.4 The following Service Levels Targets set out in the below table shall apply as the initial service level targets* for the provision of the Services, as may be amended by the Parties in writing from time to time:

* The Services will be delivered on all business days, with the exception of up to two (2) training days annually on which Peppy will deliver training to its practitioners.  Peppy will ensure that training days fall Fridays and during days in which Peppy expects lower demand for the Services than usual. Peppy will provide Customer with sixty (60) days’ notice in advance of training days.  Peppy may temporarily suspend, withdraw or restrict the availability of all or any part of the Peppy Platform to the extent necessary for operational reasons and Peppy shall use reasonable endeavors to minimize the effects of any such suspension, withdrawal or restriction and to notify the Customer and the Covered Individuals of any such suspension, withdrawal or restriction.

**Scheduled Maintenance is the planned/scheduled/preventative maintenance of the Peppy Platform.  Scheduled Maintenance will be conducted outside of Service Hours, typically between 12:00am and 1:00am EST. 

***Emergency Maintenance is the maintenance in the event of any defects, incidents or lack of uptime due to denial-of-service attacks, network floods and hacking, and any other events that cannot be prevented by reasonable security measures, which Peppy will use commercially reasonable endeavors to resolve.

ANNEX 4 - DATA PRIVACY & SECURITY (globally excluding UK & ROI)
Version 1.0 - last updated 15 December 2022

This Annex 4 – Data Privacy and Security (USA) (this “Annex”) as may be amended by Peppy from time to time shall apply to the associated Order Form solely to the extent that Peppy or the Peppy Affiliate provides Services in all Territories excluding the United Kingdom and Republic of Ireland to the Customer Affiliate. For all other services to be provided by Peppy or the Peppy Affiliate in the United Kingdom or Republic of Ireland as set out in the associated Order Form, please refer to the separate Applicable Annex.

Capitalized words in this Annex 4 shall have the meanings given to them in the MSA and the other Applicable Annexes as set out in the Order Form, unless further defined below.

PART 1 – DATA PRIVACY

1.1 Customer Data. Customer retains ownership of data provided or transmitted by Customer to Peppy (“Customer Data”).  Customer will deliver to Peppy certain Customer Data as described in Exhibit A of Annex 3. Peppy has the right to maintain a de-identified copy of such Customer Data for purposes of improving its Services.  For the avoidance of doubt, Customer Data does not include data provided or transmitted by Covered Individuals.  

1.2 Peppy Data. Peppy retains ownership of any data provided or transmitted by Covered Individuals directly to Peppy in the course of providing the Services.  Client acknowledges that the PCs are Covered Entities under the Health Insurance Portability and Accountability Act and as such have both regulatory as well as insurance requirements to retain Customer Data.

PART 2 - SECURITY

Definitions:

Customer Assets means Employees, Customer Data or Relevant Infrastructure.

Customer Data means any Customer content or information.

Customer Infrastructure means the infrastructure of Customer or any Affiliate to which Peppy or any of Peppy sub-contractors has access in the course of the Agreement.

Customer Systems means the systems of Customer (or those of any Customer Group Company).

Good Industry Practice means the exercise of that degree of skill, care, prudence, efficiency, foresight and timeliness as would be expected from a leading company within the relevant industry or business sector.

Incident means any event where there is, or potentially could be, unauthorized access to, or use of, or interface with any Customer Assets or Customer System.

Public Cloud Services means any data hosting, processing or storage service which is provided to Peppy by a third party, where the service is provided on infrastructure owned and located at the third party’s premises, and the service is made available over the internet using infrastructure shared amongst customers.

Relevant Infrastructure means: (a) Customer Infrastructure; and (b) Peppy Infrastructure.

Peppy Infrastructure means the infrastructure used in the course of the Agreement whether the infrastructure of Peppy or any of Peppy’s sub-contractors.

1. 1. Information Security Requirements

      Peppy shall maintain and implement appropriate security systems, controls, policies and procedures as least as effective at minimizing the risk of an information security breach as required by Good Industry Practice (including an information security risk management framework to record and manage all information security risks which provides for, as a minimum: (i) a clear definition of the scope of information risk assessments; (ii) the performance of business impact assessments to determine impact to the Services; and (iii) all risks identified having a risk owner assigned to them).

   2. Security Incident Management

      Peppy will implement a process, including where appropriate forensic investigation, for the management and reporting of actual or suspected Incidents which includes: (i) communication to all relevant persons in order to promote prompt reporting and control of any suspected, attempted or actual security breaches; and (ii) notification to Customer with details of the Incident and its potential impact. Peppy will promptly make Customer aware of the remediation being instigated by Peppy in order to resolve any Incident impacting Customer or any affiliate.

   3. Access Management

      Peppy shall: (a) maintain and implement appropriate security systems, controls, policies and procedures to ensure the secure use of (and protected access to) all applications, databases and devices used to service the Customer’s or affiliates’ businesses; (b) ensure that access to any applications, databases or devices used pursuant to the Agreement is: (i) only granted to those Peppy personnel who reasonably need it for the purposes of the Agreement; and (ii) restricted in accordance with the role or function of the individual; and (c) ensure that adequate procedures are in place so that Peppy personnel access is: (i) added, modified and deleted in a timely manner; and (ii) routinely reviewed for recertification and revalidation purposes.

   4. Remote Access Security

      Peppy shall ensure that controls are in place to prevent unauthorized remote access, including (but not limited to): (i) using strong authentication (e.g. two-factor authentication) to authenticate Peppy's users; (ii) encryption from the end-point (e.g. laptop) to the network for all data traveling across a remote access mechanism; and (iii) logging of all remote access attempts and reviewing of any suspicious activity.

   5. Portable Storage Device Security

      Peppy shall not store Customer Data on unencrypted portable storage devices. Where portable devices do hold Customer Data, Peppy shall ensure that: (i) they are locked securely away when not in use; (ii) use in public areas is avoided; (iii) the data stored within the device is no more than the minimum required; and (iv) all devices are adequately encrypted and password protected.

   6. Data Transfer Security

      Peppy shall ensure that all Customer Data sent over the internet either by e-mail or via other internet protocols (e.g. FTP) is: (i) encrypted using at least a 256 bit encryption mechanism; and (ii) only transferred via pre-configured communications with electronic acknowledgement. 

   7. Password Management

      Peppy will ensure that: (i) in respect of any passwords used for access to its systems, standard password configuration includes (without limitation): minimum length, complexity, expiry, history, and account lockout following consecutive failed logon attempts; (ii) the aforementioned configuration is implemented at system level and documented within a password management strategy or policy document; (iii) all non-personal IDs are documented (including the purpose of the access); and (iv) all staff are made aware of the importance of keeping their passwords confidential.

   8. Network Security

      Peppy shall perform (at least monthly): (i) anti-virus and perimeter scanning activities on its IT estate which include firewall and email scanning services; and (ii) patch management activity in accordance with Good Industry Practice.

   9. Physical Security Management

      Peppy shall ensure that appropriate controls are in place at its premises and any other premises used in the performance of the Agreement to prevent unauthorized physical access to those premises.

   10. Data Disposal

       Peppy shall ensure that any hardcopy Customer Data is shredded (using a cross-cut shredder or incineration) and securely disposed of via an internal disposal mechanism or by using a third party. For IT assets, Peppy must ensure that any IT assets and electronic media being used to store Customer Data that are no longer required are destroyed by incineration, damaged beyond repair or that the Customer Data is erased using data erasure technology such that Customer Data is erased and not recoverable (and a certificate of destruction provided to Customer as evidence that the foregoing has been done). Upon the expiration or termination of the Agreement, Peppy shall: (a) assist Customer in the return, transfer and/or destruction of all Customer Data from all sources, networks and devices used by Peppy or any of Peppy’s sub-contractors, if requested by the Customer; and (b) ensure that all physical or logical assets, intellectual property and licenses are returned, and physical and logical system access to Customer Data or Customer Systems is revoked within timescales agreed with Customer. In the event that Customer Data has to be retained by Peppy due to legal and/or regulatory reasons, Peppy shall ensure that such Customer Data is only retained in accordance with Peppy’s data retention and privacy policy.

   11. Public Cloud Services

       Peppy will provide adequate assurance of any Public Cloud Services provider’s security controls by allowing Customer access to documentation relating to the Public Cloud Services provider’s security controls and certification status. Peppy reserves the right to change or modify its use of Public Cloud Services at any time.

ANNEX 5 - TERMS AND CONDITIONS FOR PEPPY GLOBAL 
Version 1.0 - last updated 15 December 2022

These terms and conditions (“Terms”) shall apply to the associated Order Form solely to the extent that Peppy or the Peppy Affiliate provides Peppy Global services (as further defined in Schedule 1 of the MSA) in any to country, excluding those where the Peppy Platform is unavailable due to technical, legal or political reasons,  to the Customer Affiliate. For all other Services to be provided by Peppy or the Peppy Affiliate, please refer to the separate Applicable Annex.

Capitalized words in these Terms and Conditions shall have the meanings given to them in the MSA or the associated Order Form, unless further defined herein. Where there is a conflict between a defined word in the MSA and a word defined in this Annex, the definition in this Annex shall prevail. In this Annex, “Customer” shall mean the Customer Affiliate and “Peppy” shall mean the Peppy Affiliate set out in the Order Form. 

Whereas, Peppy has developed mobile applications for the provision of certain healthcare services; and 

Whereas, Peppy Health provides management services to the PCs who provide all clinical services in the Peppy Platform;

Whereas, Customer wishes to make the Peppy Platform available to its employees.

Now, therefore, in consideration of the mutual covenants contained herein, the parties hereby agree as follows:

Terms:

1. Services.  Peppy shall provide the Services described in Exhibit A (“Services”) via the www.peppy.health website and any other website, subdomain and/or mobile application used by Peppy from time to time to deliver the Services to the Customer and/or the End Users (as defined in Exhibit A) (the “Peppy Platform”). 

2. Covered Individuals. Peppy will provide the Services to all Customer’s employees, workers and consultants (including any individuals acting in their personal capacity pursuant to a contract for services) who are based in the US (“Employees”) (together the “Covered Individuals” or “End Users”) as described in Exhibit A.

3. Fees. 

3.1 Acceptable Payment.  The Parties agree to the payment terms described in Exhibit B. 

3.2 Payment Procedures.  With respect to any amounts owed by Customer pursuant to Exhibit A, Customer must pay such fees within thirty (30) days of receipt of the applicable invoice. If Customer disputes any fees by providing written notice prior to the date such fees are due with reasonable specificity of the grounds for such dispute, the parties will work in good faith to promptly resolve such disputes. 

3.3 Taxes. The fees do not include any taxes, duties or similar assessments that may be imposed on the Services. Customer will be responsible for paying all such amounts associated with Customer’s receipt of the Services (except for taxes based on Peppy’s income).

4. Intellectual Property Rights & Data. 

4.1 Intellectual Property.  Customer retains ownership of all right, title and interest into and to its intellectual property and proprietary rights, including its logos and trademarks.  Peppy retains ownership of all right, title and interest in and to its intellectual property and proprietary rights, including to its software (any modifications and derivative works thereof) and its logos and trademarks.  All rights not expressly granted herein are reserved.  Customer acknowledges all intellectual property rights subsisting in the Peppy Platform, and agrees that any statistical and/or aggregated data generated by the Peppy Platform as a result of the Covered Individuals’ use of the Peppy Platform shall be the intellectual property and proprietary rights of Peppy (the “Peppy IPRs”). Customer further agrees that it shall not (i) license, sublicense, sell, resell, rent, lease, transfer, distribute or otherwise commercially exploit or make the Peppy IPRs available to any third party other than as contemplated by this Agreement; (ii) make derivative works of, disassemble, reverse compile or reverse engineer any part of the Peppy IPR, or access the Peppy IPR in order to build a similar or competitive product or service (or contract with a third party to do so); without prior written consent from Peppy and provided that Peppy agrees to such action(s), Customer shall comply with any reasonable instructions and restrictions imposed by Peppy.

5. Data Privacy and Security

5.1 Peppy and Customer shall comply with Annex 4 – Data Privacy and Security (USA).

6. Publicity.

6.1 Use of Name and Customer Marks.  Peppy agrees that Customer and its specific designees may list Peppy’s name, address and telephone number in any advertising and marketing materials pertaining to this Agreement.  Customer agrees that Peppy may use Customer’s name in any advertising and marketing materials pertaining to this Agreement and the Services without prior approval of Customer.

6.2 Promotion of Peppy’s Services.   Customer shall, in accordance with this Agreement, actively promote any of Peppy’s Services listed on Exhibit A to Covered Individuals.  

7. Reports and Recordkeeping. 

7.1 Reports. Peppy will provide reports in the manner set forth in Exhibit A. 

7.2 Service Records.  During the Order Form Term and for the longer of: (1) two years following the termination of this Order Form or (2) as required by applicable law, Peppy shall maintain digital records on services and all charges it provides to each Covered Individual(s) in compliance with Peppy’s data records retention policy.  Peppy will not maintain medical records for more than ten (10) years after the last date of service for a Covered Individual.  Both parties hereto agree to keep all such records as confidential and comply with all applicable state and federal laws and regulations in regard to maintenance of such service records.

8. Representations and Warranties. 

8.1 Peppy Representations and Warranties.  Peppy represents and warrants that it (a) has the right to enter into this Agreement and perform the services contemplated hereunder; (b) will comply with all applicable laws, ordinances or governmental rules or regulations in connection with the Services, including, as applicable, HIPAA; and (c) it will perform the Services in a professional manner consistent with reasonable industry standards. 

8.2 Customer Representations and Warranties. Customer represents and warrants that it (a) has the right to enter into this Agreement; (b) will comply with all applicable laws, ordinances or governmental rules or regulations in connection with the Services, including, as applicable, HIPAA; and (c) has obtained the consent necessary under applicable law, including the Telephone Consumer Protection Act (“TCPA”) to allow Peppy to contact Covered Individuals as contemplated in this Agreement. 

8.3 No Federal Exclusion. Peppy warrants that neither Peppy nor any of its owners, officers, directors, employees, or principals (collectively “Principals”), is an Ineligible Person. An “Ineligible Person” is an individual or entity who:  

(a) is currently excluded, disbarred, suspended, or otherwise ineligible to participate in federal or state health care programs or in federal or state procurement or nonprocurement programs.  This includes persons who are on the List of Excluded Individuals or Entities of the Inspector General, List of Parties excluded from Federal Programs by the General Services Administration or the Medicaid Sanction List; or 

(b) Has been convicted of a criminal offense related to the provision of health care items or services within the rules and regulations of 42 USC §1320a-7(a), but has not yet been excluded, debarred, suspended, or otherwise declared ineligible.  

Peppy agrees to report immediately to Customer if either Peppy or any of its Principals becomes an Ineligible Person during the Order Form Term.  

8.4 Disclaimer. ASIDE FROM THE LIMITED WARRANTY PROVIDED IN SECTION 8.1 PEPPY EXPRESSLY DISCLAIMS ALL WARRANTIES IN CONNECTION WITH THIS AGREEMENT OR THE SERVICES, WHETHER EXPRESS OR IMPLIED, WRITTEN OR ORAL (INCLUDING ANY WARRANTY OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, OR NON-INFRINGEMENT) OR ARISING FROM A COURSE OF DEALING. IN ADDITION, PEPPY DOES NOT WARRANT THAT ANY SERVICES RENDERED HEREUNDER WILL BE UNINTERRUPTED OR ERROR-FREE, OR THAT ALL DEFECTS WILL BE CORRECTED. THIS DISCLAIMER AND EXCLUSION WILL APPLY EVEN IF THE EXPRESS WARRANTY FAILS OF ITS ESSENTIAL PURPOSE.  ANY DEMOS, DRAWINGS, DESCRIPTIVE MATTER OR ADVERTISING PRODUCED BY PEPPY ARE PRODUCED FOR THE SOLE PURPOSE OF GIVING AN APPROXIMATE IDEA OF THE PEPPY PLATFORM.  THEY SHALL NOT FORM PART OF THIS AGREEMENT NOR HAVE ANY CONTRACTUAL FORCE.

9. Limitation of Liability. 

TO THE FULLEST EXTENT PERMISSIBLE UNDER LAW, (I) NEITHER PARTY WILL HAVE ANY LIABILITY TO THE OTHER PARTY WITH RESPECT TO ANY CONSEQUENTIAL, EXEMPLARY, SPECIAL, INCIDENTAL, MULTIPLE, PUNITIVE OR OTHER INDIRECT DAMAGES, ARISING OUT OF THIS AGREEMENT, EVEN IF IT HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES, AND (II) OTHER THAN WITH RESPECT TO INDEMNIFICATION OBLIGATION IN SECTION 10, IN NO EVENT WILL PEPPY’S TOTAL CUMULATIVE LIABILITY IN CONNECTION WITH OR UNDER THIS AGREEMENT (UNDER ANY THEORY OF LIABILITY) EXCEED THE FEES PAID OR PAYABLE BY CLIENT UNDER THIS AGREEMENT IN THE TWELVE (12) MONTHS PRECEDING THE APPLICABLE CLAIM. 

10. Indemnification. Each Party hereby agrees to indemnify, defend and hold harmless the other Party, its affiliates, and their respective directors, employees and agents from and against any and all liabilities, losses, claims, suits, actions, allegations, legal or administrative proceedings, debts, demands, damages, and expenses (including defense costs and attorney fees), interest and costs (collectively, “Losses”) to the extent arising out of or related to this Agreement or the Services performed hereunder, which are in any manner directly or indirectly caused, occasioned, contributed to, or claimed to be due, in whole or in part, to any actual or alleged: (i) claim made by a third party that the Peppy IPRs infringe any valid copyright, patent, trade secret, or any other proprietary right of any third party; (ii) death or personal injury caused by negligence or intentional or willful misconduct of the indemnifying party; or (iii) failure of the indemnifying party to comply with applicable law. The indemnified party shall give the indemnifying party control over the defense and settlement of such claims.

11. Order Form Term and Termination

11.1 This Order Form shall be in full force and effect for the Initial Order Form Term and shall renew for the Order Form Renewal Term (collectively the “Order Form Term”) unless either Party provides written notice of non-renewal ninety (90) days prior to the end of the then current Order Form Initial Term or Order Form Renewal Term. The payment terms for any Order Form Renewal Terms shall be as set forth on Exhibit B unless Peppy provides written notice of any rate increases at least sixty (60) prior to the end of the then current Order Form Renewal Term.

11.2 Termination.  Upon a material breach of these Terms and Conditions by either Party (the “Breaching Party”), the affected Party (the “Non-Breaching Party”) may immediately terminate the Order Form if the Breaching Party does not cure the breach within ninety (90) days of receiving written notice of the breach from the Non-Breaching Party.  For the avoidance of doubt, nonpayment of fees due under the Order Form shall constitute a material breach of these Terms and Conditions.  In the event of a material breach and/or persistent breach by a Covered Individual, Peppy shall have the right, at its sole discretion, to either i) suspend access to the Peppy Platform for such Covered Individual or ii) suspend provision of the Services under this these Terms and Conditions.

11.3 Effects of Termination. Upon the expiration or termination of the Order Form for any reason Sections 2, 3, 5, 6, 8.4, 9, 11, 12 and 13 will survive in accordance with their terms.  Immediately on provision or receipt of notice to terminate under this Section 11, Customer shall issue written communications to the Covered Individuals regarding the conclusion of the Services.  Peppy will provide reasonable assistance to Customer in the preparation of such communications.

12. Confidentiality.  Each Party undertakes that it shall not at any time disclose to any person any confidential information concerning the business, affairs, customers, clients or suppliers of the other Party, except as permitted by section 12.1.

12.1 A Party may disclose the other Party’s confidential information:

(a) to its employees, officers, representatives, subcontractors or advisers who have a need to know such information for the purposes of carrying out the Party’s obligations under these Terms and Conditions.  Each Party shall ensure that its employees, officers, representatives, subcontractors or advisers to whom it discloses the other Party’s confidential information comply with this section 12.1; and

(b) as may be required by law, a court of competent jurisdiction or any governmental or regulatory authority.

12.2 No Party shall use the other Party’s confidential information for any purpose other than to perform its obligations under these Terms and Conditions.

13. Insurance.   Peppy shall at all times during the continuance of these Terms and Conditions, and for so long after its termination as may be necessary, properly maintain, at its sole cost and expense, the following coverage with financially reputable insurers that are licensed to do business in all jurisdictions where the Services are performed and that are reasonably acceptable to Customer:  (i) statutory workers’ compensation as required by law and employer’s liability insurance with a minimum coverage of $1,000,000 per accident, including master servant or borrowed servant endorsement; (ii) comprehensive or commercial general liability insurance, written on an occurrence form, including but not limited to premises-operations, broad form property damage, products/completed operations, contractual liability, independent contractors, personal injury and advertising injury and liability assumed under an insured contract. Excess/umbrella liability insurance policies must follow the form of the underlying liability policy(s) of at least $5,000,000; and (iii) cyber liability with a minimum of $3,000,000 in specific and aggregate coverage.  

14. General Terms.

14.1 Notices.  Any notice required to be given under the provisions of these Terms and Conditions shall be in writing and shall be duly served when it shall be hand-delivered to the addressees set out below, or shall have been deposited, duly registered or certified, return receipt requested, in a United States Post Office addressed to the other Party at the following addresses:

If to Peppy:

Peppy Health Corporation

1209 Orange Street

Wilmington, DE 19801 

with a copy to: legal@peppy.health

If to Customer:

To the registered office address of the Customer Affiliate with a copy to the Customer who has signed the MSA, or to such other address as the Customer may notify in advance to Peppy in writing. 

14.2 Governing Law.  These Terms and Conditions shall be construed, interpreted, and governed by the laws of the State of New York.  The parties irrevocably consent to the sole and exclusive forum and venue for any action or litigation under these Terms and Conditions shall be the state and federal courts in New York County, New York.

14.3 Severability. If any provision of these Terms and Conditions is held to be illegal, invalid, or unenforceable under present or future laws effective during the terms hereof, such provision shall be fully severable.  These Terms and Conditions shall be construed and enforced as if such illegal, invalid, or unenforceable provision had never been a part hereof, and the remaining provisions shall remain in full force and effect unaffected by such severance; provided that if the invalid provision is material to the overall purpose and operation of these Terms and Conditions, then these Terms and Conditions shall terminate upon the severance of the illegal, invalid, or unenforceable provision.

14.4 Relationship of the Parties.  It is understood and agreed that Peppy is a separate legal entity from Customer and neither it nor any employees, volunteers, or agents contracted by it shall be deemed for any purposes to be employees or agents of Customer.  Peppy assumes full responsibility for the actions of its personnel and volunteers while performing any services incident to these Terms and Conditions, and shall remain solely responsible for their supervision, daily direction and control, payment of salary (including withholding of income taxes and social security), workers’ compensation, disability benefits and like requirements and obligations. Nothing in these Terms and Conditions shall be deemed or construed to create any third-party beneficiaries or otherwise give any third-party any claim or right of action against any Party to these Terms and Conditions.

14.5 Authorization.  Each Party represents and warrants to the other that the execution of the Order Form has been duly authorized, and that the Order Form and these Terms and Conditions constitutes a valid and enforceable obligation of such Party according to its terms.

14.6 Waiver.  The waiver by either Party of any breach of any provision of these Terms and Conditions or warranty or representation herein set forth shall not be construed as a waiver of any subsequent breach of the same or any other provision.  The failure to exercise any right hereunder shall not operate as a waiver of such right.  All rights and remedies provided for herein are cumulative.

14.7 Assignment.  These Terms and Conditions shall not be assignable by either Party except in connection with the transfer or sale of all or substantially all of its equity, in the event of the merger or consolidation with another corporation, or in connection with the sale of all or substantial all of a Party’s assets to which these Terms and Conditions pertains, and in the case of Customer, provided that such assignee is not a competitor of Peppy. These Terms and Conditions will inure to the benefit of the parties and their successors and permitted assigns.

14.8 Force Majeure. Except for payment obligations, neither Party will be liable to the other Party for a failure to perform its obligations under these Terms and Conditions as a result of actions beyond its reasonable control that cannot be mitigated through the exercise of due care. 

14.9 Section Headings.  The headings of sections contained in these Terms and Conditions are for convenience only, and they shall not, expressly or by implication, limit, define, extend, or construe the terms or provisions of the sections of these Terms and Conditions.

14.10 Entire Agreement.  The Order Form, these Terms and Conditions and the documents referred to in them contains all the terms and conditions agreed upon by the parties hereto regarding the subject matter of the Order Form and supersedes any prior agreements, promises, negotiations or representations, either oral or written, relating to the subject matter of the Order Form. No amendment to these Terms and Conditions shall be valid unless it is in writing and signed by the parties. 

14.11 Counterparts.  The Order Form may be executed in any number of counterparts, by digital signature or by a scanned signature page in a format such as PDF, each of which will be deemed an original, but all of which taken together will constitute one single agreement between the Parties.

Exhibit A: Services

I.  Services. During the Order Form Term, Peppy will provide the Services as set out in the Order Form which shall as appropriate include without limitation the services described below: 

Peppy shall provide a secure mobile app which the Customer Employees can download to their smartphones via either the iOS App Store or Google Play Store.  To access the services listed below, Employees must initially register using the employer email domain, but will then be asked to provide their personal email address at a later stage in the registration process which will be linked to their account. The Peppy mobile app will check whether the employee email domains fall within the scope of these Terms and Conditions, and, if a match occurs, the Employee may continue to complete the registration (at which point the Employee is considered to be a “Covered Individual”).  If the Peppy Platform does not recognize the employer email domain, then an error message will be displayed, together with instructions on how to remediate the issue.

Once an Employee has successfully registered and has become a Covered Individual, Peppy shall make available the Service Types (as more particularly described in Schedule 1 of the MSA) via the Peppy Platform which the Customer has opted to include as set out in the Order Form. 

The Services may include, but are not limited to the following:

• Peppy multi-week programmes;
• Peppy vetted resources aligned with recognised healthcare guidance within the relevant Territory (where applicable); and
• Peppy webinars with expert practitioners.

The Service Hours shall be from 9am to 6pm in all states (except for Hawaii and Alaska where the Services Hours shall be from 6am to 3pm) on Business Days, which is subject to change at any time to enable Peppy to optimize the Covered Individual’s access and use of the Services:

II. Reports. Peppy will provide standard quarterly and annual reports including aggregated and anonymous data. 

III. Customer Cooperation. If requested, Customer will reasonably cooperate with Peppy in the provision of the Services, and will provide Peppy with key clinical, information technology and Covered Individual data support. This support includes, but is not limited to, the following:

(a) Provision of Data: Customer shall provide Peppy, directly or through a third-party, in format(s) and at a frequency agreed to by both parties, with: 

i. Coverage Eligibility Data: Demographic and benefit eligibility information, plus a unique identifier field, for employees and other beneficiaries, with an updated file provided via secure transfer at least a monthly frequency. Such data shall include historical data for at least the twelve (12) month period prior to the Effective Date. Peppy will use this data to determine employee’s coverage eligibility at such time as the Covered Individual contacts Peppy to apply for enrollment in the Peppy program and provide the best service using the most current data. The provision of accurate and timely coverage ability data is necessary for Peppy to provide accurate reporting pursuant to Section II of this Exhibit A. 

ii. Covered Individual Contact Data: Information including email address, physical address, and phone number, as available, paired with appropriate identifying information, including relationship to the eligible employee (self or dependent). 

(b) Covered Individual Recruitment and Enrollment

i. Customer shall provide Peppy with such information and access to Covered Individual information as may be necessary or appropriate for Peppy to identify and engage Covered Individuals for participation in the Peppy Platform.

ii. Peppy may use Customer’s logos and trademarks in order to recruit and enroll Covered Individuals.

iii. Customer shall work with Peppy to plan and allow Peppy to conduct outreach campaigns to Covered Individuals for the purposes of recruiting and enrolling Covered Individuals onto the Peppy Platform. Customer shall ensure that it has obtained all applicable consents and authorizations required to enable Peppy to conduct such outreach campaigns. Such campaigns shall include:

a. Targeted emails following identification, through data analysis, that a potential Covered Individual has received treatment or fulfilled prescription related to certain health issues;

b. Monthly emails designed to notify potential Covered Individuals of the availability of Peppy;

c. Quarterly calls or text messages designed to notify potential Covered Individuals of the availability of Peppy;

d. The inclusion of the Peppy Platform in any plan or wellness program materials describing benefits available to potential Covered Individuals; and

e. Annual all employee announcement notifying potential Covered Individuals of the availability of Peppy. 

iv. Customer shall make reasonable efforts to communicate the availability and nature of the Peppy Platform to Employees in settings such as, but not limited to, open enrollment guides, internal benefit intranet sites, email and onsite correspondence about health benefits, and onsite events.

v. Customer shall make its on-site clinic personnel, if any, available for training on the Peppy Platform so as to facilitate recommendations to Covered Individuals of the Peppy Platform by such on-site clinic(s). 

* As is customary with service agreements of this type, prescription fulfillment is subject to a third-party service provider and Peppy disclaims all liability for the services of such third-party provider.  

Exhibit B: Compensation

The “Launch Date” in these terms and conditions shall mean the first date that the End Users are able to actively use the Services via the Peppy Platform, such date shall be mutually agreed between the Parties in advance.

A “Billing Period” in these terms and conditions shall mean the initial twelve (12) month period commencing from the first Launch Date of any Service taken by the Customer in the Order Form, and each subsequent twelve (12) month period thereafter, in respect of which Peppy issues invoices for Charges under this Agreement.

Customer shall pay to Peppy the Charges initially upon signing the Order Form in respect of the first Billing Period and at the start of each subsequent Billing Period thereafter.  

The Charges are subject to a five percent (5%) increase per annum during the Order Form Term of this Agreement.

Except where Customer has terminated properly under Section 11.2 of these Terms and Conditions, no refunds shall be due to Customer for any Charges paid to Peppy and/or any other sums paid by Customer to Peppy.  

All prices are exclusive of applicable taxes.

Exhibit C: Service Level Agreement

SCHEDULE 1 – SERVICE LEVEL AGREEMENT

1. Service Level Requirements

1. Service Level Targets shall be measured on a monthly basis. Service Level Targets shall be split into two groups based on the Covered Individual’s residence in either a primary or a secondary state. Primary states shall be: California, Connecticut, Florida, Illinois, New Jersey, New York, North Carolina and Texas. Secondary states shall be: Alabama, Alaska, Arizona, Arkansas, Colorado, Delaware, Georgia, Hawaii, Idaho, Indiana, Iowa, Kansas, Kentucky, Louisiana, Maine, Maryland, Massachusetts, Michigan, Minnesota, Mississippi, Missouri, Montana, Nebraska, Nevada, New Hampshire, New Mexico, North Dakota, Ohio, Oklahoma, Oregon, Pennsylvania, Rhode Island, South Carolina, South Dakota, Tennessee, Utah, Vermont, Virginia, Washington, West Virginia, Wisconsin, Wyoming, and the District of Columbia.

2. Rules and regulations regarding the provision of telemedicine vary by state and may change at any time which may result in modification to the Service.

3. Where Peppy fails to adhere to the individual Service Level Target on four (4) or more occasions during a six (6) month rolling period, this shall constitute a material breach of these Terms and Conditions.

4. The following Service Levels Targets set out in the below table shall apply as the initial service level targets* for the provision of the Services, as may be amended by the Parties in writing from time to time:

* The Services will be delivered on all business days, with the exception of up to two (2) training days annually on which Peppy will deliver training to its practitioners.  Peppy will ensure that training days fall Fridays and during days in which Peppy expects lower demand for the Services than usual. Peppy will provide Customer with sixty (60) days’ notice in advance of training days.  Peppy may temporarily suspend, withdraw or restrict the availability of all or any part of the Peppy Platform to the extent necessary for operational reasons and Peppy shall use reasonable endeavors to minimize the effects of any such suspension, withdrawal or restriction and to notify the Customer and the Covered Individuals of any such suspension, withdrawal or restriction.

**Scheduled Maintenance is the planned/scheduled/preventative maintenance of the Peppy Platform.  Scheduled Maintenance will be conducted outside of Service Hours, typically between 12:00am and 1:00am EST. 

***Emergency Maintenance is the maintenance in the event of any defects, incidents or lack of uptime due to denial-of-service attacks, network floods and hacking, and any other events that cannot be prevented by reasonable security measures, which Peppy will use commercially reasonable endeavors to resolve.

Summary of Changes from USA Terms & Conditions

1. 1. These Terms are the same as set out in Annex 3 – Terms and Conditions for Peppy Premium (USA), save that the following sections are amended:

   
   

   Section Number	Original wording	Amendment
   2	Covered Individuals. Peppy will provide the Services to all Customer’s employees, workers and consultants (including any individuals acting in their personal capacity pursuant to a contract for services) who are based in the US (“Employees”), and their spouse, civil partner, or the person with whom they are in an established relationship, whether same sex or not (“Partners”) (together the “Covered Individuals” or “End Users”) as described in Exhibit A.	Replaced with: “Covered Individuals. Peppy will provide the Services to all Customer’s employees, workers and consultants (including any individuals acting in their personal capacity pursuant to a contract for services) who are based in the US (“Employees”) (together the “Covered Individuals” or “End Users”) as described in Exhibit A.“
   Exhibit A section I	Peppy shall provide a secure mobile app which the Customer Employees or their Partners can download to their smartphones via either the iOS App Store or Google Play Store.  To access the services listed below, Employees or their Partners must initially register using the employer email domain, but will then be asked to provide their personal email address at a later stage in the registration process which will be linked to their account. The Peppy mobile app will check whether the employee email domains fall within the scope of these Terms and Conditions, and, if a match occurs, the Employee or the Partner may continue to complete the registration (at which point the Employee or Partner is considered to be a “Covered Individual”).  If the Peppy Platform does not recognize the employer email domain, then an error message will be displayed, together with instructions on how to remediate the issue. Once an Employee or Partner has successfully registered and has become a Covered Individual, Peppy shall make available the Service Types (as more particularly described in Schedule 1 of the MSA) via the Peppy Platform which the Customer has opted to include as set out in the Order Form.	Replaced with: “Peppy shall provide a secure mobile app which the Customer Employees can download to their smartphones via either the iOS App Store or Google Play Store.  To access the services listed below, Employees must initially register using the employer email domain, but will then be asked to provide their personal email address at a later stage in the registration process which will be linked to their account. The Peppy mobile app will check whether the employee email domains fall within the scope of these Terms and Conditions, and, if a match occurs, the Employee may continue to complete the registration (at which point the Employee is considered to be a “Covered Individual”).  If the Peppy Platform does not recognize the employer email domain, then an error message will be displayed, together with instructions on how to remediate the issue. Once an Employee has successfully registered and has become a Covered Individual, Peppy shall make available the Service Types (as more particularly described in Schedule 1 of the MSA) via the Peppy Platform which the Customer has opted to include as set out in the Order Form.”
   Exhibit A section I	The Services may include, but are not limited to the following: Peppy multi-week programs; Peppy vetted resources aligned with recognized healthcare guidance; Peppy webinars with expert practitioners; Private 1 on 1 chat with expert practitioners; Private telephone or video consultations with expert practitioners;  Group video calls with an expert practitioner; and Prescription fulfilment*	Replaced with: “The Services may include, but are not limited to the following: Peppy multi-week programmes; Peppy vetted resources aligned with recognised healthcare guidance within the relevant Territory (where applicable); and Peppy webinars with expert practitioners.”
   Exhibit B	“Customer shall notify Peppy within thirty (30) days of an increase during the Order Form Term of more than twenty (20) percent of the total number of Employees.  In the event of such increase, Customer acknowledges and agrees that Peppy shall have the right to apply a proportionate increase to the Charges in the subsequent Billing Period.“	Deleted in its entirety.
   Schedule 2	Service Level Agreement	Replaced with Schedule 1 to this Annex 5

ANNEX 6 – DATA PROTECTION AND SECURITY (GLOBAL)
Version 1.0 - last updated 15 December 2022

This Annex 6 – Data Privacy and Security for Peppy Global (this “Annex”) as may be amended by Peppy from time to time shall apply to the associated Order Form solely to the extent that Peppy or the Peppy Affiliate provides Peppy Global Services in any to country, excluding those where the Peppy Platform is unavailable due to technical, legal or political reasons, to the Customer Affiliate. For all other services to be provided by Peppy or the Peppy Affiliate as set out in the associated Order Form, please refer to the separate Applicable Annex.     

PART 1 - DATA PROTECTION

1. 1. Interpretation

1.1 Capitalised words in this Part 1 - Annex 6 shall have the meanings given to them in Annex 1 and the associated Order Form, unless further defined below:

2. The Customer acknowledges that upon activation of an End User Licence by an End User, an independent contractual relationship will arise between Peppy and each End User, and that Peppy will be a separate Data Controller (otherwise referred to as a business to which the Data Protection Laws apply) in relation to any Personal Data of each such End User, as Peppy will independently determine the purposes for which and the manner in which Peppy and relevant Third-party Cloud Infrastructure Providers where applicable, will Process such Personal Data, including, but not limited to, the Processing for the purpose of Peppy’s compliance with its contractual obligations to any such End User.

3. The terms, details and duration of Peppy’s processing of Personal Data as Data Controller shall be set out in its Privacy Policy, including details of Third-party Cloud Infrastructure Providers where these entities act as Processors of Personal Data on behalf of Peppy. 

4. Peppy shall at all times comply with the Data Protection Laws in relation to its Processing of the Personal Data of End Users.

5. Peppy maintains appropriate technical and organisational measures to protect Personal Data against unauthorised or unlawful processing and against accidental loss, destruction, damage, theft, alteration or disclosure. These measures shall be appropriate to the harm which might result from any unauthorised or unlawful processing, accidental loss, destruction, damage or theft of the Personal Data and having regard to the nature of the Personal Data which is to be protected.

6. In the event of a suspected Personal Data Breach, Peppy will:

6.1 take action immediately to investigate the suspected Personal Data Breach;

6.2 take action immediately to identify, prevent and mitigate the effects of the Personal Data Breach and remedy the Personal Data Breach; and

6.3comply with all notification obligations with respect to Data Subjects, Supervisory Authorities or any other entity requiring notification under the Data Protection Laws, and provide such information as may be reasonably required by the Customer to respond to complaints or enquiries from Data Subjects relating to the Personal Data Breach, provided that Peppy will not provide Personal Data to the Customer as part of such notification unless instructed to by the Data Subject.

7. If one party receives any complaint, notice or communication that relates directly or indirectly to the other party's Processing of End User Personal Data pursuant to this Agreement it shall promptly notify the other party and provide full details and copies of any communication. Each party shall use reasonable endeavours to work with the other party to remedy the situation.

8. Any data provided by Peppy to the Customer relating to End Users’ use of the Services, including but not limited to use of the Peppy Platform, will not comprise Personal Data and shall be fully anonymised and aggregated in such a way that no Data Subject is identified or identifiable.

9. The parties do not anticipate that Peppy shall be a Data Processor on behalf of the Customer as a Data Controller under this Agreement. In the event that Peppy is a Data Processor on behalf of the Customer, Peppy and the Customer shall enter into a data processing agreement, in a form specified by the Customer.

PART 2 – SECURITY

1. 1. Interpretation

      1.1 Capitalised words in this Part 2 - Annex 6 shall have the meanings given to them in Annex 5 and the associated Order Form, unless further defined below:

2. Information Security Requirements

Peppy shall maintain and implement appropriate security systems, controls, policies and procedures as least as effective at minimising the risk of an information security breach as required by Good Industry Practice (including an information security risk management framework to record and manage all information security risks which provides for, as a minimum: (i) a clear definition of the scope of information risk assessments; (ii) the performance of business impact assessments to determine impact to the Services; and (iii) all risks identified having a risk owner assigned to them).

3. Security Incident Management

Peppy will implement a process, including where appropriate forensic investigation, for the management and reporting of actual or suspected Incidents which includes: (i) communication to all relevant persons in order to promote prompt reporting and control of any suspected, attempted or actual security breaches; and (ii) notification to Customer with details of the Incident and its potential impact. Peppy will promptly make Customer aware of the remediation being instigated by Peppy in order to resolve any Incident impacting Customer or any Customer Group Company.

4. Access Management

Peppy shall: (a) maintain and implement appropriate security systems, controls, policies and procedures to ensure the secure use of (and protected access to) all applications, databases and devices used to service the Customer Group Companies' businesses; (b) ensure that access to any applications, databases or devices used pursuant to the Agreement is: (i) only granted to those Peppy personnel who reasonably need it for the purposes of the Agreement; and (ii) restricted in accordance with the role or function of the individual; and (c) ensure that adequate procedures are in place so that Peppy personnel access is: (i) added, modified and deleted in a timely manner; and (ii) routinely reviewed for recertification and revalidation purposes.

5. Remote Access Security

Peppy shall ensure that controls are in place to prevent unauthorised remote access, including (but not limited to): (i) using strong authentication (e.g. two-factor authentication) to authenticate Peppy's users; (ii) encryption from the end-point (e.g. laptop) to the network for all data travelling across a remote access mechanism; and (iii) logging of all remote access attempts and reviewing of any suspicious activity.

6. Portable Storage Device Security

Peppy shall not store Customer Data on unencrypted portable storage devices. Where portable devices do hold Customer Data, Peppy shall ensure that: (i) they are locked securely away when not in use; (ii) use in public areas is avoided; (iii) the data stored within the device is no more than the minimum required; and (iv) all devices are adequately encrypted and password protected.

7. Data Transfer Security

Peppy shall ensure that all Customer Data sent over the internet either by e-mail or via other internet protocols (e.g. FTP) is: (i) encrypted using at least a 256 bit encryption mechanism; and (ii) only transferred via pre-configured communications with electronic acknowledgement. 

8. Password Management

Peppy will ensure that: (i) in respect of any passwords used for access to its systems, standard password configuration includes (without limitation): minimum length, complexity, expiry, history, and account lockout following consecutive failed logon attempts; (ii) the aforementioned configuration is implemented at system level and documented within a password management strategy or policy document; (iii) all non-personal IDs are documented (including the purpose of the access); and (iv) all staff are made aware of the importance of keeping their passwords confidential.

9. Network Security

Peppy shall perform (at least monthly): (i) anti-virus and perimeter scanning activities on its IT estate which include firewall and email scanning services; and (ii) patch management activity in accordance with Good Industry Practice.

10. Physical Security Management

Peppy shall ensure that appropriate controls are in place at its premises and any other premises used in the performance of the Agreement to prevent unauthorised physical access to those premises.

11. Data Disposal

Peppy shall ensure that any hardcopy Customer Data is shredded (using a cross-cut shredder or incineration) and securely disposed of via an internal disposal mechanism or by using a third party. For IT assets, Peppy must ensure that any IT assets and electronic media being used to store Customer Data that are no longer required are destroyed by incineration, damaged beyond repair or that the Customer Data is erased using data erasure technology such that Customer Data is erased and not recoverable (and a certificate of destruction provided to Customer as evidence that the foregoing has been done). Upon the expiry or termination of the Agreement, Peppy shall: (a) assist Customer in the return, transfer and/or destruction of all Customer Data from all sources, networks and devices used by Peppy or any of Peppy’s sub-contractors, if requested by the Customer; and (b) ensure that all physical or logical assets, intellectual property and licences are returned, and physical and logical system access to Customer Data or Customer Systems is revoked within timescales agreed with Customer. In the event that Customer Data has to be retained by Peppy due to legal and/or regulatory reasons, Peppy shall ensure that such Customer Data is only retained in accordance with Peppy’s data retention and privacy policy.

12. Public Cloud Services

Peppy will provide adequate assurance of any Public Cloud Services provider’s security controls by allowing Customer access to documentation relating to the Public Cloud Services provider’s security controls and certification status. Peppy reserves the right to change or modify its use of Public Cloud Services at any time.