Schedule of Services

Managed Services

The Services to be performed for Client by Provider are set forth in the Order. Additional Services may be added only by entering into a new Order including those Services.

Server Monitoring and Management — Provider will perform server monitoring and management including, alert monitoring and management of servers, periodic reporting and performance tuning, and prioritization of alerts to identify high-priority incidents. Provider will also perform remote remediation services as needed, and backup software monitoring and management. The Service Fee does not include major hardware / software upgrades or replacements or new server installations.

Desktop Monitoring and Management — Provider will perform desktop monitoring and management including, alert monitoring & management of desktops, prioritization of alerts to identify high-priority incidents, remote remediation services as needed, quarterly configuration backups, quarterly firmware updates as required by manufacturer, and quarterly reporting and performance tuning. The Service Fee does not include hardware replacement or new hardware installations.

Help Desk Services — Provider will provide help desk support via client portal, e-mail, and phone. Provider has the ability to remotely control desktops to support employees. Unless otherwise included in an order, all help desk services will include unlimited remote support as required.

On-site Support — Upon request and subject to the limitations identified in the Order, for Services that are within the scope of this Service Attachment, Provider will also deliver support Services on-site at your location during normal business hours. For on-site support that is not included in the Order, Client will pay Provider’s then-prevailing hourly rate.

Core Security Services — Provider will include in its services monthly Microsoft patch management, antivirus software and management, and remote software installations. Core Security Services also includes new / terminated employee setup and configuration.

Problem Management Services — Provider will undertake problem management as soon as the Provider’s monitoring staff becomes aware of an incident. All incidents, with status or resolution, will be documented by posting updates to the Problem (Incident) Ticket Tracking System assigned to Client (“Problem Tickets”).

Managed Security Services

Provider, through its Third-Party Services Providers will make its best effort to ensure the security of Client’s information through third-party security software (“Security Software”). Client designates Provider as its agent to provide the Service to Client, and to enter into any third-party relationship to provide the Service to Client. Use of this Service is subject to the applicable Third-party Service Providers agreements regarding terms of use, which Client and Provider agree has been provided by Provider to Client. Client acknowledges that Third-Party Service Providers and their licensors own all intellectual property rights in and to the Security Software. Client will not engage in or authorize any activity that is inconsistent with such ownership. Client acknowledges and agrees to be bound by any applicable Third-Party Service Provider agreements regarding terms or use or end user licensing terms, and Client understands that any applicable agreement regarding terms of use or end user licensing is subject to change without notice.

Firewall, Anti-malware, and Intrusion Detection — Provider will install and configure of firewall traffic policies, apply updated firmware when applicable, and configure changes when needed. With respect to the firewall, Provider will include the following:

• Intrusion Prevention — provides real-time protection against network threats, including spyware, SQL injections, cross-site scripting, and buffer overflows.
• URL Filtering — blocks known malicious sites, and delivers granular content and URL filtering tools to block inappropriate content.
• Gateway Antivirus — continuously updated signatures, identify and block known spyware, viruses, trojans, worms, rogueware and blended threats — including new variants of known viruses.

Security Risk Assessment

• Malware and Vulnerability Review — Using one or more tools to determine the existence of malware or vulnerabilities.
• Personally Identifiable Information (“PII”) — Review practices related to PII, including location, treatment, and risk mitigation.
• Report — Provider’s findings will be included in a Risk Assessment Report.

Network Discovery — generates a visual map of all nodes on your network, making it easy to see where you may be at risk.

Reputation-Based Threat Prevention — Cloud-based web reputation service that aggregates data from multiple feeds to provide real-time protection from malicious sites and botnets, while dramatically improving web processing overhead.

Spam Prevention — Real-time, continuous, and highly reliable protection from spam and phishing attempts.

Application Control — Provides the ability to allow, block, or restrict access to applications based on a user’s department, job function, and time of day.

APT Blocker — detects and stops the most sophisticated attacks including ransomware, zero-day threats, and other advanced malware designed to evade traditional network security defenses.

Data Loss Prevention — works to enforce compliance by scanning text and files to detect sensitive information attempting to exit your network, whether it is transferred via email, web, or FTP.

Threat Detection & Response — Security data collected from the firewall is correlated by enterprise-grade threat intelligence to detect, prioritize and enable immediate action against malware attack.

Intelligent Antivirus — leverages signature-less anti-malware solution that relies on artificial intelligence to automate malware discovery.

DNS Filtering — detects and blocks malicious DNS requests, redirecting users to a safe page with information to reinforce security best practices.

Anti-malware — Provider will provide and install anti-malware software of Provider’s choosing for each Device covered by the Order. While Provider will make reasonable effort to ensure Client Devices and Client’s network are safe from viruses, malware, bugs, hacking, phishing schemes or defective or malicious files, programs or links (“Harmful Content”), of any kind whether now known or hereinafter invented, Provider does not guarantee that Client computers or network cannot be infected by Harmful Content. Where this does happen, Provider will provide commercially reasonable Services to mitigate the Harmful Content. Additional Services will be available upon mutual agreement of the parties.

Remote Access — Provider will install remote access and remote monitoring and management software on Client’s Devices possibly other equipment at Client’s office. Client grants permission to Provider to install any remote access or remote monitoring and management software deemed necessary by Provider.

Client-Side DNS Filtering — Provider will acquire and will assign an appropriate number of licenses to support the deployment of client-side DNS Filtering on all laptop systems. The DNS filtering is designed to detect and block malicious DNS requests, redirecting users to a safe page with information to reinforce security best practices and to protect laptops while away from the corporate network.

Security Awareness Training & Phishing Simulations — Provider will acquire and will assign an appropriate number of licenses to support the client environment. The Service will schedule phishing campaigns to send at random times during a specified period. The campaigns are trackable and fully customizable designed to keep track of every user’s participation, making all cybersecurity education accountable and measurable.

Multi-Factor Authentication Services / Password Credential Management Services — Provider will configure two-factor authentication for compatible software applications, institute single sign-on services for compatible software applications and customized security policies and procedures. After performing a security assessment and assessing the state of Client’s existing policies and procedures pertaining to network security (if any), Provider will work with Client to prepare a new or revised set of policies and procedures that incorporate cutting edge best practices and that take advantage of the other Services delivered by Provider.

Security Operations Center — The Services include:

• Advanced Malware Protection supported by Security Operations Center (SOC).
• Deployment of advanced malware protection applications to all Windows based devices on customer network.
• 24x7 SOC service analyzes quarantined applications and files, reducing false positives.
• Immediate risk identification — Provides rapid recognition of thousands of viruses and malware attack variants, including cryptomining attacks, as well as the root causes of these malicious behaviors, by quickly identifying and diagnosing corrupt source processes and system settings.
• Ransomware rollback — quickly rollback files to previous safe versions through tracking changes in your devices and restoring them to an acceptable risk state.
• Response commitments — for confirmed Security Incidents within the scope of the Order, the SOC acknowledges within thirty (30) minutes and begins containment within one (1) hour, 24x7x365, with containment authority, first-24-hour scope, service credits, and exclusions as set out under “Security Incident Response” in the Service Attachment for Managed Services.

Security Log Management — Provider will configure log sources to capture and retain information without creating excessive logging, limit user access to log files, avoid logging sensitive or protected information, secure the processes that generate logs, identify and resolve logging errors, and analyze log entries, prioritize entries, and respond to those requiring action.

Security Incident Event Management (SIEM) Services supported by SOC — Provider will deploy SIEM monitoring probes to monitor all critical network devices including; domain controller, firewalls, network switches and routers. When meeting compliance requirement deployment will include all Windows devices as well.

Incident Response — Provider will assist Client in the hours immediately following a data breach to identify the likely source of the breach and to begin formulating an appropriate response to the breach. However, any assistance with data breach-remediation efforts past the first twenty-four (24) hours following a breach — including but not limited to breach-notification planning, in-depth forensic examinations of the source of a breach, and significant, post-breach systems reconfiguration — are not within the scope of this Service Attachment. If Client requests Provider’s assistance with such activities, Provider will prepare a separate Service Attachment for Project Services that will specify what the charges will be for such assistance.

Data Backup and Disaster Recovery Service

The Services to be performed for Client by Provider are set forth in the Order. Additional Services may be added only by entering into a separate Order including those Services.

Local Backups — Using customer provider hardware and software (backup software), backups will be performed on the basis specified in the Order. Client owns the hardware and software agents (backup software) used to perform the backups. If Client subscribes to periodic Server Maintenance, Provider will review the backups during Maintenance and notify Client of backup failures. Client will notify the Provider of any failures, and upon request, perform simple on-site tasks (e.g., powering down and rebooting hardware).

Remote Backups — Provider, through its Third-Party Service Providers will make its best effort to ensure the protection and recovery of Client’s information. Data files are backed up via a third-party client-side desktop/server software application (the “Application”), encrypted, and then sent to a storage server at third-party vendor’s data center facility. There is no local copy of the backed-up data. Data files can be restored from the cloud but the server itself cannot be recovered or “booted” in the cloud. Therefore, this service is not considered a disaster recovery solution. All data is backed up via a third-party client-side desktop/server software application (the “Application”). Provider will monitor the backups daily, notify Client of any failures, and work with third-party to resolve backup failures.

Cloud Backup — Provider, through its Third-Party Service Providers will make its best effort to ensure the protection and recovery of Client’s information. Data is backed up via a third-party client-side desktop/server application, encrypted, stored locally on a Provider-owned storage device (“Provider Owned Storage”), and then sent to a third-party owned storage server at the Third-Party Services Provider’s data center facility. Provider will monitor the status of all scheduled backup jobs, notify Client of Provider-owned storage failures and corrective actions. Provider will also provide remote administrative services of Data Backup Service as requested by Client. Offsite Backup copies will have one-year retention unless specified in Order. Upon termination of these Services, Provider will request return of the backup hardware and remove the Application from Client systems.

Disaster Recovery — Provider will work with Client to develop a comprehensive disaster-recovery plan that incorporates the Services to be delivered under this Service Attachment.

If Client experiences an event precipitating a major, multi-user loss of data, Client may notify Provider that a data loss event has occurred.

File Backup and Recovery

Provider will create, monitor, and modify up to the number of file backup jobs listed in the Order. Provider will also notify Client by email of backup drive failures and corrective actions.

Upon request, Provider will remotely restore files, subject to the number of operations listed in the Order.

Cloud and Hosting Services

Public Cloud — Provider will move all Client’s data to a cloud computing platform, allow Client to have access to data via virtual desktop from Client’s own devices or device provided by Provider, and manage the cloud environment for Client.

Hybrid Cloud — Provider will move some of Client’s data to a cloud computing platform, and upon Client’s request, place a server on premises at Client’s location. Any Client data being moved shall be agreed to by the parties in writing prior to moving with specific instructions as to identify which data will be moved, managed or unmanaged by Provider. Any Client data being moved or managed shall be specifically identified as to the location of the data on a particular server. Any Client data not being moved, or that is not specifically identified by Client will be considered not managed. Provider shall not be responsible for the identification, classification, or location of the data. Client is solely responsible for its data up to the outermost point of Provider’s firewall with the public internet (the “Demarcation Point”). Once data has been identified, classified, its final location determined, and moved past the Demarcation Point, Provider shall then become responsible for Client data. Provider will also manage the cloud environment for client and provide hardware that will be owned by Provider and will be licensed using an appropriate license agreement.

Private Cloud or Software Subscriptions — Provider will maintain all Client’s data on premise at Client’s location, manage the cloud environment and software subscriptions for Client, provide unmanaged cloud environment and software subscriptions for Client, and provide hardware that will be owned by Provider and will be licensed using an appropriate license agreement.

Third-Party Cloud & SaaS Vendors — Provider will provide, install, and support the Third-Party Cloud or software-as-a-service vendors listed on the Order, including but not limited to Microsoft. Client designates Provider as its agent to provide the Service to Client, and to enter into any third-party relationship to provide the Service to Client. Use of this software is subject to the applicable third-party cloud or software-as-a-service vendor’s agreement regarding terms of use, which Client and Provider agree has been provided by Provider to Client. Client agrees to be bound by any applicable third-party cloud or software-as-a-service vendor’s agreements regarding terms or use or end user licensing, and Client understands that any applicable agreement regarding terms of user or end user licensing is subject to change by any Third-Party vendor or software-as-a-service provider without notice.

BoomTalk™ Communications Services

The BoomTalk™ Services described in this section are provided only where identified in an Order. Quantities, plan tiers, per-user rates, minimum line commitments, and any Client-specific concessions are set forth exclusively in the Order.

Applicable terms — BoomTalk™ VoIP is additionally governed by the BoomTalk™ VoIP Terms of Service and the 911/E911 Notification and Disclosures, each posted at legal.theboomcoinc.com and incorporated by reference into every Order that includes BoomTalk™ VoIP. BoomTalk™ Live is governed by the Master Services Agreement, the Service Attachment for BoomTalk™ Live, this Schedule, the Schedule of Third-Party Services, and, where the Order references HIPAA or another regulation, the Data Processing Agreement. The BoomTalk™ VoIP Terms of Service and the 911/E911 Notification and Disclosures do not apply to BoomTalk™ Live except with respect to any voice or telephone-network feature separately identified in the Order as BoomTalk™ VoIP.

BoomTalk™ VoIP — Hosted Voice and Unified Communications

Service Description — Provider will deliver hosted, cloud-based voice-over-IP telephone service and associated unified-communications features (extensions, direct-inward-dial numbers, voicemail, auto-attendant / IVR, ring groups, call queues, business-hours routing, and, where ordered, call recording) for the number of user lines specified in the Order. Provider will provision, manage, monitor, and provide first-line troubleshooting of the BoomTalk™ VoIP environment for the Term.

Implementation — Prior to provisioning, Provider will prepare a VoIP Implementation Document describing the initial configuration of Client’s environment, including extensions, direct-dial numbers, IVR / auto-attendant menus, call flows, ring groups, queues, greetings, business-hours routing, and voicemail structure. Client will review and approve the Implementation Document in writing. Onboarding, where included in the Order, covers one (1) complete build of the environment as specified in the approved Implementation Document. The approved Implementation Document defines the entire scope of onboarding; Provider will incorporate Client’s revisions during the review period prior to approval. Once Client approves the Implementation Document and Provider completes provisioning and launch in accordance with it, onboarding is complete and accepted. Where Provider has, at Client’s request, built and placed the environment into production before the Implementation Document is formally approved, the environment as built and in production constitutes the Implementation Document and is deemed approved, subject to Client’s right to identify configuration discrepancies in writing within fifteen (15) business days following launch, which Provider will correct at no charge.

Included Ongoing Management — Throughout the Term the fully managed BoomTalk™ VoIP Service includes: user adds, removes, and changes coordinated through Client’s user-lifecycle process; extension and voicemail administration; first-line troubleshooting of BoomTalk™ extensions and features; and minor configuration adjustments (for example, updating a greeting recording, adjusting holiday hours, re-pointing an existing menu option, or modifying the members of an existing ring group or queue). Any allowance of minor IVR or call-flow modifications at no charge is as stated in the Order.

Post-Launch Design Changes — Requests that materially revise the approved design — including restructuring IVR or auto-attendant menu trees, re-architecting call flows or queue strategies, adding new departments or locations to the routing design, or re-implementing configurations previously approved and delivered — are Supplemental Services or Project Services under the Master Services Agreement. Provider will scope the request, provide a written quote, and obtain Client’s written approval before any billable work begins.

Equipment — Desk phones, conference phones, headsets, analog adapters, and other endpoint devices are Client’s responsibility unless the Order identifies Provider-supplied equipment. Provider will assist with provisioning and configuration of supported endpoint devices. Physical repair or replacement of endpoint devices is not included; hardware procurement is available as described in the Order. Client is responsible for providing broadband Internet access, local network quality of service, and power sufficient for reliable voice service.

Telephone Numbers and Porting — Provider will assign direct-inward-dial numbers as provided in the Order and will support porting of Client’s existing numbers into and out of the Service in accordance with the BoomTalk™ VoIP Terms of Service. Provider is not responsible for delay or rejection of a port attributable to Client, Client’s prior carrier, or any third party. Numbers not ported out before termination may be released for reassignment.

Call Recording — Where the Order includes call recording, Provider will enable and retain recordings in accordance with the retention period stated in the Order or, if none is stated, Provider’s then-current default. Client is solely responsible for determining whether and how it may lawfully record calls, for obtaining all consents and providing all notices required by applicable federal and state law (including, in California, the all-party consent requirements of the Invasion of Privacy Act, Cal. Penal Code § 630 et seq.), and for its own retention, retrieval, and disclosure practices. Provider does not monitor the content of recordings.

911 / E911 — BoomTalk™ VoIP 911 dialing differs from traditional 911 service and has limitations described in the 911/E911 Notification and Disclosures. Client is responsible for providing and keeping current a Registered Location for every line, for distributing the 911/E911 disclosures to all users, and for affixing any required warning labels to endpoint devices.

Charges, Taxes, and Billing Commencement — Per-user rates in the Order are exclusive of taxes, regulatory fees, Universal Service Fund contributions, E911 fees, and any regulatory recovery fee, all of which are charged in addition. Recurring charges for each line begin on the date calls begin to be routed through the BoomTalk™ Service for that line. Where an Order describes quantities as estimated or subject to change, the final quantities will be reflected on the monthly invoice.

Exclusions — Unless separately scoped in an Order, the following are not included: PBX dial-plan programming or system re-design beyond the approved Implementation Document; physical repair or replacement of endpoint hardware; carrier-level or Internet-service-provider issues outside the BoomTalk™ platform (Provider will identify and escalate such issues to the appropriate party); integration with third-party CRM, EHR, or contact-center applications; contact-center analytics and workforce-management tooling; directory listings and operator or directory assistance; and end-user training beyond the launch orientation described in the Implementation Document.

BoomTalk™ Live — Managed Telehealth and Virtual Care Platform

Service Description — BoomTalk™ Live is a managed, cloud-hosted virtual-care and unified-communications platform providing secure video consultations, waiting-room and appointment queuing, secure in-session chat and file exchange, and related collaboration features for the number of users specified in the Order. Provider will provision, configure, host, monitor, and provide first-line support for Client’s BoomTalk™ Live environment for the Term. BoomTalk™ Live is delivered on infrastructure managed by Provider and, in part, through Third-Party Service Providers identified on the Schedule of Third-Party Services. The binding terms specific to BoomTalk™ Live — including regulated-data preconditions, the allocation of professional-compliance responsibility, and the prohibition on emergency use — are set out in the Service Attachment for BoomTalk™ Live.

Implementation — Provider will configure Client’s BoomTalk™ Live tenant, including organization branding within the platform, user roles, provider and patient / participant workflows, waiting-room and queue configuration, notification templates, and, where identified in the Order, single-sign-on integration. Client will review and approve the initial configuration in writing; the approved configuration defines the scope of any onboarding included in the Order. Material changes to the approved configuration after launch are Supplemental Services or Project Services.

Included Ongoing Management — User adds, removes, and role changes; tenant configuration adjustments within the platform’s standard administrative controls; platform updates and maintenance releases; availability monitoring; and first-line troubleshooting for Client’s administrators and users.

Client Responsibilities — Client is solely responsible for:

• Regulated data. Client will not transmit, store, or process Protected Health Information or other regulated data through BoomTalk™ Live unless the Order references the applicable regulation and the Parties have executed the Data Processing Agreement and, for HIPAA, a Business Associate Agreement. Provider’s obligations with respect to such data are those stated in the Data Processing Agreement and Business Associate Agreement and no others.
• Practice of medicine and professional compliance. BoomTalk™ Live is a communications platform. Provider does not practice medicine or any licensed profession, does not render clinical advice, and is not responsible for the content, quality, or outcome of any consultation. Client is responsible for compliance with all laws governing its practice, including professional licensure, telehealth-specific requirements (including, in California, Cal. Bus. & Prof. Code § 2290.5), patient informed consent to telehealth, standard-of-care, prescribing, and reimbursement rules, and for the conduct of its practitioners and staff.
• Consents and recording. Where Client elects to record sessions or retain session chat, Client is solely responsible for obtaining all consents and providing all notices required by applicable federal and state law and its own professional obligations, and for its retention and disclosure practices.
• Participants. Client is responsible for verifying the identity and eligibility of participants it admits to sessions, for obtaining any consent required for the participation of minors or other individuals lacking capacity, and for the conduct of its users.
• Environment. Client and its participants are responsible for supported devices, browsers, cameras, microphones, and Internet connectivity meeting Provider’s then-current minimum requirements.

No Emergency Use — BoomTalk™ Live is not a telephone service, does not connect to the public switched telephone network, and does not provide 911, E911, or any emergency-calling capability. Client will not use BoomTalk™ Live for emergency or urgent care where delay could result in harm, will instruct its practitioners and participants to use a telephone to reach emergency services, and will display in its own patient-facing materials a notice to that effect.

Availability — Provider will use commercially reasonable efforts to maintain platform availability consistent with the Service Level Commitments in the Master Services Agreement. Session quality depends on participant devices, networks, and Internet connectivity outside Provider’s control, and Provider does not warrant the quality of any individual session.

Exclusions — Unless separately scoped in an Order, the following are not included: integration with EHR, practice-management, scheduling, or billing systems; custom development, custom workflows, or API work; clinical templates, forms, or documentation content; end-user or practitioner training beyond launch orientation; participant-facing (patient) support; procurement or support of participant devices; and interpretation, transcription, or medical-scribe services.

Cyber Training Services

Provider will implement and managed a managed cybersecurity awareness training platform ordered through a third party on Client’s behalf. The program features:

• Enrolling all technology-facing workforce members in the program
• Access to a curriculum of industry-leading cybersecurity awareness education which can be customized to meet the unique needs and regulatory requirements of Client
• Management reporting and visibility into workforce participation and progress in the training
• Regular campaigns to test each workforce member’s ability to recognize and effectively respond to cyberattacks which typically target individuals
• Automated enrollment in remedial training for individual workforce members, when appropriate
• Management reporting and visibility into workforce performance on testing campaigns
• Management reporting and visibility into the improvement in workforce awareness and performance over time
• Lowered risk to Client from cyberattacks which target unaware and untrained individuals

THESE DESCRIPTIONS ARE SUBJECT TO CHANGE ANY TIME WITHOUT NOTICE.