Internet Hosted Services Schedule

Version 2026 (10.02.2026)

This Internet Hosted Services Schedule supplements the accepted Proposal, Master Service Terms and applicable AUP. Capitalized terms have the meanings in those documents. An executed Business Associate Agreement controls PHI-related conflicts.

Services Provided

1. CareServ Technologies, LLC (“CareServ”) will provide the Internet Hosted Services expressly identified in the accepted Proposal or SOW. The Proposal must identify the hosted systems, capacity, included administration, third-party dependencies and customer responsibilities. Backup, restoration, migration, e-commerce, transaction processing and end-user support are included only to the extent expressly ordered; this scope provision does not reduce an obligation expressly accepted elsewhere in the Agreement.
2. CareServ will implement reasonable and appropriate safeguards for Customer Content within its control, consistent with applicable law, the executed BAA and the purchased Services. CareServ will maintain a documented disaster-recovery plan for the hosting infrastructure it operates. Customer-specific recovery objectives, application restoration, backup frequency, retention, protected systems and restore-testing commitments must be stated in the accepted Proposal or SOW. A backup configuration does not itself guarantee a particular recovery time or recovery point. CareServ will perform the backup and recovery duties it expressly accepts.
3. Confidentiality, data protection, security-incident reporting and subcontractor obligations in the applicable Master Service Terms and executed BAA apply in addition to this Schedule. No security provision replaces or reduces those obligations. CareServ remains responsible for obligations it delegates to its subcontractors as provided in the Master Service Terms and BAA.

Customer Responsibilities and Warranties

1. Customer will supply accurate service requirements, necessary licenses and lawful instructions; identify authorized administrators and data recipients; and maintain systems, credentials and tasks assigned to Customer in the accepted Proposal. Customer will cooperate reasonably with supported configurations, incident investigation, patching and protective actions. Changes that materially increase fees or reduce purchased Services require the agreement required by the Master Service Terms.
2. Customer retains control of Customer Content and is responsible for its lawfulness and its authority to provide it. Customer will comply with the applicable AUP and notify CareServ promptly of suspected compromise affecting the Services. Customer is not responsible under this allocation for a security or backup duty expressly assigned to CareServ.
3. CareServ may take reasonably necessary, proportionate protective action against an imminent material security threat or unlawful use. CareServ will give prompt notice when legally permitted, limit interruption to what is reasonably necessary, and restore affected Services when the grounds for suspension are resolved. Any reimbursement must be for reasonable, documented costs recoverable under the Agreement and law; it is not an automatic penalty. Required access to PHI must remain available through a lawful and secure method.

License Grants and Restrictions

1. Customer grants CareServ and its authorized subcontractors a nonexclusive, limited license to process Customer Content only as necessary to provide the Services, follow lawful documented instructions, or satisfy applicable law and the BAA. No right to use PHI for collection, advertising, sale, model training or an unrelated purpose is granted by this Schedule.
2. Customer retains ownership of Customer Content. CareServ and third-party licensors retain their respective pre-existing technology, software and intellectual property. Ownership and licenses for commissioned deliverables and embedded background materials are governed by the accepted SOW and the Master Service Terms. Use of CareServ tools does not itself transfer ownership of Customer Content to CareServ or prevent Customer from retrieving and using its own data.
3. Customer may not copy, distribute or exploit CareServ software or third-party software except under the applicable license. These restrictions do not limit Customer’s lawful access to or export of its own data. Neither party may use the other party’s trademarks without permission, except as permitted by law.

Service Level Warranty

1. CareServ will perform the Internet Hosted Services reasonably and professionally. The 99.9% Service Availability commitment, measurement rules, exclusions, claim procedure and service-credit calculation in the accepted Master Service Terms apply to covered Internet Hosted Services, unless an accepted Proposal expressly states a different service-level commitment.
2. Service credits are the exclusive contractual remedy for a failure to meet the Service Availability metric itself, subject to mandatory law. This does not make credits the sole remedy for a separate breach of confidentiality, security, an executed BAA or another obligation merely because the same event also caused downtime. The Master Service Terms’ lawful liability limits and mandatory exceptions apply. Credits and damages for the same loss must be credited to avoid duplicate recovery.

Service Support

1. Unless the accepted Proposal states otherwise, CareServ will provide technical assistance concerning access to and use of the Internet Hosted Services during 7:00 a.m. to 7:00 p.m. Eastern Time, Monday through Friday, excluding holidays. Eastern Time includes daylight saving time where observed. Response will be within a reasonable period unless a specific response commitment is stated in the Proposal. No 24-hour staffed support or fixed response time is implied by infrastructure availability.
2. Customer will perform first-line intake and reasonable troubleshooting for its users. CareServ will provide second-tier support to Customer’s designated contacts for issues concerning the purchased hosting Services. Direct end-user support or Managed Services applies when separately purchased. Security and privacy notices must use the designated contacts and methods in the BAA or Proposal; support hours do not extend a statutory or contractual notification deadline.

Termination, Transition and Customer Data

1. The accepted Master Service Terms govern termination, nonpayment notice and cure, billing disputes, early termination and transition charges. This Schedule does not authorize immediate termination for every breach, automatic collection penalties, or withholding legally required PHI access for nonpayment.
2. Customer may request secure export of Customer Content before termination or within forty-five (45) days after termination. CareServ will provide reasonably usable export or limited retrieval access to Customer or its verified designee and reasonably cooperate in transfer. Failure to make a request within ten days does not forfeit that right. An executed BAA or applicable law requiring earlier access or return controls. Payment disputes must be pursued separately from legally required data access and return.
3. Optional migration, conversion or consulting beyond required data return must be separately described and priced in an accepted transition SOW. No automatic offboarding fee is created by this Schedule. The parties should identify export format, encryption, delivery method, authorized recipient and completion criteria promptly after notice of termination.
4. CareServ will give at least fifteen (15) days’ written notice of a planned deletion date and will not delete Customer Content before the forty-five-day retention period ends or while a timely export request is being reasonably completed. Legal holds, mandatory retention and BAA duties control over that schedule. Following completed return and expiration of applicable retention obligations, active copies will be securely deleted. Routine backup copies remain protected until overwritten under the documented backup cycle; any PHI retention or infeasibility determination must satisfy the executed BAA and law. This is not a waiver of liability for negligent or unlawful deletion.
5. Retained information remains subject to confidentiality, security and use restrictions. No general disclaimer, lien, license termination or suspension provision overrides mandatory PHI availability, return or destruction duties.

Disclaimers and Allocation of Responsibility

1. Except for express commitments in the Agreement and obligations that cannot lawfully be excluded, CareServ does not promise uninterrupted, error-free or completely secure Services. Any exclusion of implied warranties, damages or remedies is governed by the Master Service Terms and applicable law. This Schedule does not separately disclaim all direct damages or negate express warranties.
2. Independent services contracted directly between Customer and another provider remain that provider’s responsibility to the extent stated in the accepted Proposal. This does not excuse CareServ’s own acts, subcontracted obligations or BAA duties. The parties will identify which provider controls each dependency and any separately applicable service level in the Proposal.

Document Priority and Third-Party Rights

1. This Schedule applies only when expressly incorporated into an accepted Proposal or mutual written amendment identifying Version 2026 (10.02.2026). It is intended for use with Master Service Terms Version 2026 (10.02.2026). It does not automatically amend an existing Agreement or replace an earlier accepted version at renewal.
2. Mandatory law and the executed BAA control. Otherwise, document priority follows the accepted Master Service Terms, including its protection of collection-cost limitations, lawful payment disputes, data access and return, confidentiality and statutory rights. The safeguards stated expressly in this Schedule must not be read as authorizing conduct prohibited by a controlling BAA or law.
3. No blanket third-party beneficiary right is created by this Schedule. Expressly identified license beneficiaries or indemnified persons have only the rights specifically granted in the accepted Agreement. A vendor’s rights do not diminish CareServ’s own duties.