Service Attachment for BoomTalk™ Live

This Service Attachment is between Provider (sometimes referred to as “we,” “us,” or “our”), and Client found on the applicable Order (sometimes referred to as “you,” or “your,”) and, together with the Order, Master Services Agreement, Schedule of Services, Schedule of Third-Party Services, and other relevant Service Attachments, forms the Agreement between the parties the terms to which the parties agree to be bound. Capitalized terms not defined here have the meanings given in the Master Services Agreement (“MSA”).

The parties further agree as follows:

Scope; Relationship to the Agreement

Application

This Service Attachment applies to any Order that includes BoomTalk™ Live and is incorporated into that Order by reference.

Precedence

In the event of a conflict, the Order controls over this Service Attachment, and this Service Attachment controls over the Schedule of Services and the Schedule of Third-Party Services with respect to BoomTalk™ Live. The MSA controls over this Service Attachment except where this Service Attachment expressly states otherwise.

BoomTalk™ VoIP Terms Do Not Apply

The BoomTalk™ VoIP Terms of Service and the 911/E911 Notification and Disclosures do not apply to BoomTalk™ Live, except with respect to any voice or telephone-network feature separately identified in the Order as BoomTalk™ VoIP.

Definitions

“BoomTalk™ Live” or the “Platform” means Provider’s managed, cloud-hosted virtual-care and unified-communications platform providing video sessions, waiting-room and appointment queuing, in-session chat and file exchange, and related features, together with any Provider-supplied administrative portal, applications, and documentation.

“Tenant” means Client’s dedicated configuration within the Platform.

“Practitioner” means a Client employee, contractor, or agent who hosts or conducts Sessions.

“Participant” means any individual, other than a Practitioner, who joins a Session, including a patient, client, guardian, interpreter, or observer.

“Session” means any video, audio, or chat interaction conducted through the Platform.

“Session Content” means all audio, video, text, files, recordings, transcripts, and metadata generated by or exchanged in a Session. Session Content is Client Data under the MSA.

The Service

Description

Provider will provision, configure, host, monitor, maintain, and provide first-line support for Client’s Tenant for the number of users identified in the Order, as described in the Schedule of Services.

Delivery

BoomTalk™ Live is delivered on infrastructure managed by Provider and, in part, through Third-Party Service Providers identified on the Schedule of Third-Party Services. Session Content will be hosted in data centers located in the United States unless the Order states otherwise.

Changes to the Platform

Provider may modify, add, or retire Platform features from time to time, and may substitute an underlying Third-Party Service Provider with one that is functionally equivalent, provided that Provider gives Client at least thirty (30) days’ written notice of any change that materially reduces the functionality Client has ordered. Client’s remedy for such a reduction is termination of the affected Service without early-termination fee, exercised by written notice within the notice period.

Implementation and Acceptance

Configuration Document

Prior to launch, Provider will prepare a Tenant configuration document describing branding within the Platform, user roles, Practitioner and Participant workflows, waiting-room and queue configuration, notification templates, and any integration identified in the Order (the “Configuration Document”). Client will review and approve the Configuration Document in writing. Any onboarding included in the Order covers one (1) complete build of the Tenant as specified in the approved Configuration Document.

Acceptance

Once Client approves the Configuration Document and Provider completes provisioning and launch in accordance with it, onboarding is complete and the Tenant is accepted. Where Provider has, at Client’s request, placed the Tenant into production before formal approval, the Tenant as built and in production constitutes the Configuration Document and is deemed approved, subject to Client’s right to identify configuration discrepancies in writing within fifteen (15) business days following launch, which Provider will correct at no charge.

Post-Launch Changes

Requests that materially revise the approved configuration after launch are Supplemental Services or Project Services under the MSA. Provider will scope the request, provide a written quote, and obtain Client’s written approval before any billable work begins.

Regulated Data; HIPAA

Precondition

Client will not transmit, store, or process Protected Health Information (“PHI”) or other data subject to HIPAA, GLBA, CCPA, or any comparable law through the Platform unless (a) the Order references the applicable regulation, (b) the parties have executed the Data Processing Agreement, and (c) for PHI, the parties have executed a Business Associate Agreement (“BAA”). Use of the Platform in breach of this subsection is at Client’s sole risk, and Provider has no obligation with respect to such data beyond those expressly stated in the MSA.

Roles

Where a BAA is in place, Client is the Covered Entity (or a Business Associate of a Covered Entity) and Provider is Client’s Business Associate solely to the extent stated in the BAA. Provider’s obligations with respect to PHI are those stated in the BAA and the Data Processing Agreement, and no others.

Subcontractors

Provider will ensure that any Third-Party Service Provider that creates, receives, maintains, or transmits PHI on Provider’s behalf in delivering BoomTalk™ Live is bound by a written agreement containing restrictions and conditions at least as protective as those in the BAA.

Minimum Necessary

Client is responsible for configuring its Tenant, workflows, and user permissions so that PHI is accessed and disclosed only as permitted by applicable law and Client’s own policies.

Nature of the Platform; No Professional Services

BoomTalk™ Live is a communications platform. Provider is not a healthcare provider, does not practice medicine or any licensed profession, does not render clinical, legal, or other professional advice, and does not participate in, supervise, or review any Session. Provider is not responsible for the content, quality, or outcome of any Session or for any decision made in reliance on it.

Client is solely responsible for compliance with all laws and standards governing its use of the Platform, including without limitation: professional licensure and scope-of-practice requirements in every jurisdiction where a Practitioner or Participant is located; telehealth-specific requirements, including, in California, Cal. Bus. & Prof. Code § 2290.5; patient or client informed consent to telehealth; applicable standards of care; prescribing and controlled-substance rules; medical record creation and retention; and payer, reimbursement, and coding requirements.

Client is responsible for the acts and omissions of its Practitioners and users within the Platform as if they were Client’s own.

No Emergency Use

BOOMTALK™ LIVE IS NOT A TELEPHONE SERVICE, DOES NOT CONNECT TO THE PUBLIC SWITCHED TELEPHONE NETWORK, AND DOES NOT PROVIDE 911, E911, TEXT-TO-911, OR ANY OTHER EMERGENCY-CALLING CAPABILITY. CLIENT WILL NOT USE THE PLATFORM FOR EMERGENCY OR URGENT CARE WHERE DELAY COULD RESULT IN HARM.

Client will instruct all Practitioners and Participants to use a telephone or other emergency-capable service to reach emergency services, will display a notice to that effect in its Participant-facing materials and within the Session experience where the Platform permits, and will maintain its own emergency-escalation procedures for Sessions.

Provider has no liability for any injury, loss, or damage arising from the use of or inability to use the Platform in connection with an emergency.

Consents, Recording, and Session Content

Consents

Client is solely responsible for obtaining all consents and providing all notices required by applicable federal and state law for the conduct of Sessions, including consent to telehealth, consent to the collection and processing of Participant data, and, where Client elects to record Sessions or retain chat transcripts, the all-party consent requirements of the California Invasion of Privacy Act, Cal. Penal Code § 630 et seq., and the recording and confidentiality laws of every other jurisdiction where a Practitioner or Participant is located.

Recording

Where the Order includes Session recording or transcript retention, Provider will enable the feature and retain the resulting Session Content for the period stated in the Order or, if none is stated, Provider’s then-current default. Provider does not monitor, review, or moderate Session Content.

Ownership and License

Session Content is Client Data and remains Client’s exclusive property under the MSA. Client grants Provider and its Third-Party Service Providers a non-exclusive license to host, transmit, store, process, and display Session Content solely as necessary to deliver the Service.

Return and Deletion

On termination, Session Content is subject to the data export and retention provisions of the MSA and, where applicable, the BAA. Client is responsible for exporting any Session Content it is required by law to retain before the end of the retention period.

Participants and Users

Client is responsible for verifying the identity and eligibility of each Participant it admits to a Session, for obtaining any consent required for the participation of a minor or an individual lacking capacity, and for the conduct of all Practitioners, users, and Participants.

Client will protect all administrative and user credentials, will enable multi-factor authentication where the Platform supports it, and is responsible for all activity under its Tenant.

All use of the Platform is subject to the Acceptable Use Policy posted at boomlogic.com/privacy-terms/. Provider may suspend access to the Tenant or any user immediately where Provider reasonably believes continued use presents a security risk, violates applicable law, or violates the Acceptable Use Policy, and will notify Client promptly of any such suspension.

Client Environment and Availability

Client and its Participants are responsible for supported devices, operating systems, browsers, cameras, microphones, and Internet connectivity meeting Provider’s then-current minimum requirements, which Provider may update from time to time.

Provider will use commercially reasonable efforts to maintain Platform availability consistent with the Service Level Commitments in the MSA. Session quality depends on Participant devices, networks, and Internet connectivity outside Provider’s control, and Provider does not warrant the quality or completion of any individual Session.

Provider may perform scheduled maintenance that temporarily suspends the Platform, and will use commercially reasonable efforts to schedule such maintenance outside Client’s business hours and to give Client advance notice.

Security

Provider will maintain the administrative, physical, and technical safeguards for the Platform described in the Data Processing Agreement and, where applicable, the BAA.

Client is responsible for the security of its own devices, networks, and user accounts, and for adopting Provider’s written security recommendations within the period described in the MSA.

Security incident notification is governed by the Data Processing Agreement and, where applicable, the BAA.

Third-Party Platform

BoomTalk™ Live is delivered in part through Third-Party Service Providers identified on the Schedule of Third-Party Services. Client’s use of the Platform is subject to the applicable Third-Party Service Provider’s terms as described in the MSA and the Schedule of Third-Party Services.

Provider’s obligations under “Subcontractors” and “Security” above are not limited by this section.

Fees

Fees are per user, per month, at the rates and minimum user commitments stated in the Order, exclusive of taxes. Any NITEP designation and its effect on the annual escalator are determined as stated in the MSA.

Recurring fees for the Tenant begin on the launch date described under “Acceptance” above.

Fees are not subject to reduction below the minimum stated in the Order, and Client remains responsible for fees for the full Term regardless of usage.

Term and Termination

This Service Attachment is coterminous with the Order that includes BoomTalk™ Live and is subject to the term, renewal, and termination provisions of the MSA.

In addition to Provider’s rights under the MSA, Provider may suspend the Tenant on written notice where Client uses the Platform for PHI or other regulated data without satisfying the precondition under “Regulated Data; HIPAA” above, or for any emergency use prohibited under “No Emergency Use” above, until the condition is cured.

Warranties and Disclaimers

Provider’s service warranty in the MSA applies to BoomTalk™ Live.

EXCEPT AS EXPRESSLY STATED IN THE MSA, THE PLATFORM IS PROVIDED WITHOUT WARRANTY OF ANY KIND. PROVIDER DOES NOT WARRANT THAT USE OF THE PLATFORM WILL RESULT IN COMPLIANCE WITH ANY LAW, LICENSING REQUIREMENT, OR STANDARD OF CARE, THAT ANY SESSION WILL BE UNINTERRUPTED OR ERROR-FREE, OR THAT THE PLATFORM IS SUITABLE FOR ANY PARTICULAR CLINICAL OR PROFESSIONAL PURPOSE.

Indemnification

In addition to Client’s obligations under the MSA, Client will defend, indemnify, and hold Provider harmless from all claims, losses, and expenses (including reasonable attorneys’ fees) arising from: (a) the provision of healthcare or other professional services through the Platform, including any claim of professional negligence, malpractice, or unlicensed practice; (b) any claim by a Participant relating to a Session, other than a claim caused by Provider’s breach of the Agreement; (c) any recording, retention, or disclosure of Session Content without required consent; (d) Client’s transmission of PHI or other regulated data in breach of the precondition under “Regulated Data; HIPAA” above; and (e) any use of the Platform in an emergency in breach of “No Emergency Use” above.

Limitation of Liability

The limitation of liability in the MSA applies to BoomTalk™ Live. Without limiting that provision, Provider is not liable for any claim arising from the matters for which Client is responsible under “Nature of the Platform; No Professional Services,” “No Emergency Use,” “Consents, Recording, and Session Content,” and “Participants and Users” above.

Survival

The sections titled “Regulated Data; HIPAA,” “Nature of the Platform; No Professional Services,” “No Emergency Use,” “Ownership and License,” “Return and Deletion,” “Warranties and Disclaimers,” “Indemnification,” and “Limitation of Liability” survive termination or expiration of the Order.