Terms of Service

1. The DownStream Service

DownStream provides contractual intelligence and assurance software designed to help organizations:

• analyze contracts and related documents;
• identify contractual obligations;
• organize and review contractual commitments;
• compare obligations against organizational baselines;
• connect obligations to frameworks and internal controls;
• maintain evidence related to contractual commitments;
• evaluate evidence coverage;
• generate assurance-related outputs; and
• search and query structured contractual and assurance information.

DownStream may include artificial intelligence, machine learning, automated analysis, and rule-based processing.

Features may vary by subscription plan, pilot, trial, organization, or deployment.

2. Business-to-Business Service

DownStream is intended for use by businesses, healthcare organizations, professional users, and other organizational customers.

It is not intended primarily for personal, family, or household use.

You must be at least 18 years old and legally capable of entering into a binding agreement to use DownStream.

3. Accounts

You may be required to create an account to use certain portions of DownStream.

You agree to:

• provide accurate and complete registration information;
• maintain accurate account information;
• keep your login credentials confidential;
• use reasonable safeguards to protect your account;
• promptly notify us of suspected unauthorized access; and
• remain responsible for activity performed through your account unless prohibited by applicable law.

You may not share individual user credentials with unauthorized persons.

Organization administrators may invite, remove, suspend, or change the permissions of users within their organization.

4. Organization Administrators

If you are an organization administrator, you may have authority to:

• invite and remove users;
• assign roles;
• manage organizational settings;
• configure frameworks and baselines;
• control certain evidence or sharing settings;
• manage billing or subscription information; and
• access information associated with users in your organization.

Your organization is responsible for determining which individuals should receive access and what permissions they should have.

5. Customer Content

“Customer Content” means information submitted, uploaded, created, stored, or processed by or on behalf of a customer through DownStream.

Customer Content may include:

• contracts;
• business associate agreements;
• security addenda;
• statements of work;
• policies;
• procedures;
• internal controls;
• reports;
• certifications;
• audit materials;
• penetration testing reports;
• security assessments;
• evidence;
• comments;
• organizational settings;
• mappings; and
• related business information.

As between you and DownStream, you retain ownership of your Customer Content.

You grant DownStream a limited, non-exclusive right to host, process, transmit, reproduce, analyze, and otherwise use Customer Content solely as necessary to:

6. Protected Health Information

Although DownStream is designed for organizations operating in healthcare, the service is not currently intended to receive, store, or process Protected Health Information (“PHI”) regulated by HIPAA unless DownStream expressly agrees in writing to such use.

You must not upload PHI unless:

• DownStream has expressly approved that use in writing; and
• any legally required agreement, including a Business Associate Agreement where applicable, has been executed.

Use of DownStream for healthcare contractual intelligence, HIPAA-related contract analysis, or healthcare compliance mapping does not by itself mean DownStream is authorized to process PHI.

Questions concerning permitted information may be directed to privacy@downstream.co or compliance@downstream.co.

7. Sensitive and Restricted Information

Unless expressly authorized by DownStream in writing, you should not submit:

• PHI;
• payment card numbers;
• highly sensitive authentication credentials;
• government identification numbers;
• financial account credentials;
• classified information;
• export-controlled information;
• unlawful content; or
• information you are prohibited from providing to a third-party service provider.

You are responsible for reviewing documents before uploading them to DownStream.

8. Artificial Intelligence and Automated Analysis

Certain DownStream functionality uses artificial intelligence and automated systems.

AI-assisted features may be used to:

• extract document metadata;
• identify contractual obligations;
• categorize requirements;
• suggest framework mappings;
• summarize information;
• assist with search and question answering; and
• perform related analysis.

AI and automated outputs may contain errors, omissions, incomplete analysis, or incorrect interpretations.

Accordingly:

9. No Legal Advice

DownStream does not provide legal advice.

The service may identify contractual language, organize obligations, compare terms, map requirements, or provide structured information, but those functions do not constitute legal interpretation or legal advice.

Use of DownStream does not create an attorney-client relationship.

You should consult qualified legal counsel regarding:

• contract interpretation;
• legal obligations;
• enforceability;
• regulatory applicability;
• legal deadlines;
• statutory requirements; or
• other legal matters.

10. No Compliance Certification

DownStream does not certify that you are compliant with:

• HIPAA;
• HITECH;
• HITRUST;
• SOC 2;
• ISO standards;
• NIST frameworks;
• privacy laws;
• contractual obligations; or
• any other legal, regulatory, contractual, or industry requirement.

Framework mappings, control relationships, coverage determinations, and assurance outputs are informational and operational tools.

A status such as “covered,” “partially covered,” “verified,” or similar terminology does not constitute a legal or regulatory certification of compliance.

11. Contractual Intelligence Limitations

DownStream is designed to assist with identification and management of contractual commitments.

However:

• not every obligation may be identified;
• document formatting may affect extraction;
• scanned or image-based documents may not be supported unless explicitly indicated;
• complex clauses may require human interpretation;
• conflicting provisions may require legal review;
• amendments or referenced documents may change meaning; and
• extracted metadata may require confirmation.

You are responsible for reviewing original source documents before relying on DownStream outputs for material decisions.

12. Framework and Regulatory Mappings

DownStream may suggest relationships between contractual obligations and regulatory, security, privacy, compliance, or industry frameworks.

These mappings are intended to help users organize and understand requirements.

A mapping does not mean:

• the framework itself created the contractual obligation;
• a contractual deadline is a regulatory deadline;
• the mapped requirement applies to your organization as a matter of law;
• the mapping is complete; or
• compliance has been established.

Human review is recommended.

13. Controls and Evidence

DownStream may enable customers to associate contractual obligations or framework requirements with internal controls and evidence.

Evidence may include policies, procedures, reports, certifications, assessments, screenshots, attestations, test results, and other records.

DownStream does not independently verify the truth, authenticity, sufficiency, or completeness of Customer Content unless expressly stated otherwise.

The existence of a policy, report, certification, or other document does not necessarily demonstrate operational effectiveness or compliance.

14. Assurance Outputs

DownStream may generate assurance-related outputs, including evidence coverage views, summaries, packages, exports, or customer-facing materials.

These outputs are based on:

• information provided by the customer;
• user-reviewed relationships;
• configured controls;
• evidence status;
• product logic; and
• applicable automated analysis.

Assurance outputs are not independent audits, legal opinions, attestations, certifications, or guarantees.

Customers remain responsible for reviewing assurance outputs before sharing or relying upon them.

15. External Sharing

If DownStream provides external sharing functionality, you are responsible for:

• deciding whether content is appropriate to share;
• ensuring the recipient is authorized;
• complying with contractual confidentiality obligations;
• properly classifying documents;
• observing NDA requirements;
• managing link expiration and revocation; and
• ensuring Customer Content does not contain information that should not be disclosed.

DownStream may provide technical controls such as access tokens, expiration, revocation, and sharing classifications, but those controls do not replace your responsibility to determine whether disclosure is permitted.

16. Subscription Plans

DownStream may offer multiple subscription plans, including plans such as:

• Essentials;
• Professional; and
• Enterprise.

Features, usage limits, user limits, contract limits, evidence limits, support levels, and other entitlements may differ by plan.

Current pricing and plan terms may be displayed on the DownStream website or included in an order form.

Enterprise arrangements may be subject to separate negotiated terms.

17. Trials

DownStream may offer free or paid trials.

Trial terms may include:

• limited duration;
• limited users;
• limited contract volume;
• restricted evidence usage;
• restricted Assurance functionality;
• disabled external sharing; and
• other limitations.

Unless otherwise stated, a trial does not guarantee continued access after the trial period.

DownStream may modify, suspend, or terminate trial access at any time where reasonably necessary to prevent abuse or protect the service.

18. Fees and Payment

If you purchase a paid subscription or service, you agree to pay the fees stated at the time of purchase or in the applicable order form.

Fees may be:

• monthly;
• annual;
• pilot-based;
• usage-based; or
• otherwise agreed in writing.

Unless otherwise stated:

19. Automatic Renewal

If your subscription is designated as automatically renewing, it will renew for the stated renewal period unless canceled in accordance with the applicable order terms before the renewal date.

DownStream may provide renewal notices where required by law or contract.

Enterprise and negotiated agreements may have different renewal terms.

20. Taxes

Fees do not include applicable sales, use, value-added, withholding, or similar taxes unless expressly stated otherwise.

You are responsible for applicable taxes other than taxes based on DownStream's net income.

DownStream may collect taxes where required.

21. Payment Processing

DownStream may use third-party payment processors, including Stripe.

Payment information may be submitted directly to the payment processor and subject to that provider's terms.

Billing questions may be sent to billing@downstream.co.

22. Late or Failed Payments

If payment is overdue or fails, DownStream may:

• retry payment;
• notify account administrators;
• restrict certain features;
• place the account into a limited or read-only state;
• suspend access; or
• terminate the applicable subscription after reasonable notice.

DownStream may provide a grace period at its discretion or pursuant to an applicable agreement.

23. Cancellation

Customers may cancel subscriptions in accordance with the applicable purchase terms.

Cancellation generally prevents future renewal but does not automatically entitle the customer to a refund for the current subscription term.

Separate pilot, Enterprise, or negotiated agreements may establish different cancellation rights.

24. Acceptable Use

You may not use DownStream to:

• violate applicable law;
• infringe intellectual property or privacy rights;
• gain unauthorized access to systems or accounts;
• distribute malware or malicious code;
• conduct unlawful surveillance;
• interfere with DownStream's operation;
• bypass access restrictions or usage limits;
• probe or test security without authorization;
• misuse another customer's data;
• upload content you do not have authority to process;
• use automated tools to overload or scrape the service;
• impersonate another person or organization; or
• use DownStream for unlawful, fraudulent, or abusive purposes.

25. Security Research

Good-faith security reports may be submitted to security@downstream.co.

You must not:

• access data belonging to another customer;
• disrupt production systems;
• exfiltrate information;
• perform denial-of-service testing;
• exploit vulnerabilities beyond what is necessary to demonstrate the issue; or
• publicly disclose vulnerabilities before DownStream has a reasonable opportunity to investigate and remediate them.

26. Intellectual Property

DownStream and its licensors retain all rights, title, and interest in:

• the DownStream software;
• platform architecture;
• algorithms;
• interfaces;
• product designs;
• documentation;
• trademarks;
• logos;
• proprietary models;
• product logic;
• improvements; and
• related intellectual property.

Except for rights expressly granted under these Terms, no license or ownership rights are transferred to you.

27. Feedback

If you provide suggestions, ideas, enhancement requests, recommendations, or other feedback concerning DownStream, you grant us a worldwide, perpetual, irrevocable, royalty-free right to use that feedback without restriction or compensation.

This does not give DownStream ownership of your Customer Content.

28. Confidentiality

Each party may receive non-public information from the other that is identified as confidential or that reasonably should be understood to be confidential.

The receiving party will use reasonable measures to protect such information and will use it only as necessary to perform under the applicable relationship.

Confidential information does not include information that:

• is publicly available without breach;
• was lawfully known before disclosure;
• is received lawfully from a third party without confidentiality obligations; or
• is independently developed without use of the confidential information.

Separate confidentiality agreements may supplement this section.

29. Data Protection

DownStream will process personal information in accordance with its Privacy Policy and applicable contractual commitments.

The Privacy Policy is available at downstream.co/privacy.

Customers requiring a Data Processing Agreement may contact privacy@downstream.co or legal@downstream.co.

30. Security

DownStream uses administrative, technical, and organizational safeguards designed to protect the service and Customer Content.

However, no system is completely secure.

You are responsible for:

• maintaining secure credentials;
• controlling user access;
• promptly removing departed users;
• configuring permissions appropriately; and
• notifying DownStream of suspected unauthorized activity.

Security questions may be sent to security@downstream.co.

31. Third-Party Services

DownStream may rely on third-party services for:

• hosting;
• authentication;
• artificial intelligence;
• email;
• payments;
• analytics;
• monitoring; and
• other functions.

Use of certain third-party integrations may be subject to additional terms.

DownStream is not responsible for third-party services that you independently choose to connect to or use.

A current list of subprocessors is available at downstream.co/subprocessors.

32. Availability and Changes

DownStream may modify, improve, replace, or discontinue portions of the service.

We may perform:

• maintenance;
• security updates;
• feature changes;
• infrastructure changes; and
• emergency maintenance.

We do not guarantee uninterrupted or error-free availability unless expressly stated in a separate service-level agreement.

33. Beta and Preview Features

DownStream may provide beta, preview, early-access, or experimental features.

Such features may:

• contain defects;
• change without notice;
• be discontinued;
• have limited support; or
• be subject to different usage restrictions.

Beta and preview features should not be relied upon for critical operations unless expressly agreed in writing.

34. Suspension

DownStream may suspend access where reasonably necessary to:

• prevent security harm;
• address unlawful activity;
• protect customer data;
• respond to non-payment;
• enforce usage restrictions;
• investigate suspected abuse; or
• comply with legal obligations.

Where reasonable, we will attempt to provide notice.

35. Termination

Either party may terminate the relationship in accordance with applicable subscription or order terms.

DownStream may terminate or suspend access for material breach of these Terms if the breach is not cured within a reasonable period after notice, where cure is appropriate.

We may terminate immediately for severe security abuse, unlawful activity, fraud, or unauthorized access.

36. Effect of Termination

Upon termination:

• your right to access the service ends;
• unpaid fees remain due;
• certain provisions of these Terms survive;
• Customer Content may be retained or deleted according to the applicable agreement and retention practices.

Customers should export necessary information before termination where export functionality is available.

37. Disclaimers

TO THE MAXIMUM EXTENT PERMITTED BY LAW, DOWNSTREAM AND ITS SERVICES ARE PROVIDED “AS IS” AND “AS AVAILABLE.”

DOWNSTREAM DISCLAIMS ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING IMPLIED WARRANTIES OF:

• MERCHANTABILITY;
• FITNESS FOR A PARTICULAR PURPOSE;
• NON-INFRINGEMENT;
• ACCURACY;
• COMPLETENESS; AND
• UNINTERRUPTED AVAILABILITY.

DOWNSTREAM DOES NOT WARRANT THAT:

38. Limitation of Liability

TO THE MAXIMUM EXTENT PERMITTED BY LAW, DOWNSTREAM HEALTH TECHNOLOGIES, INC. AND ITS OFFICERS, EMPLOYEES, AFFILIATES, AND SERVICE PROVIDERS WILL NOT BE LIABLE FOR INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, CONSEQUENTIAL, OR PUNITIVE DAMAGES, INCLUDING DAMAGES FOR:

• LOST PROFITS;
• LOST REVENUE;
• LOSS OF DATA;
• LOSS OF GOODWILL;
• BUSINESS INTERRUPTION; OR
• PROCUREMENT OF SUBSTITUTE SERVICES.

EXCEPT FOR LIABILITY THAT CANNOT LAWFULLY BE LIMITED, DOWNSTREAM'S TOTAL AGGREGATE LIABILITY ARISING OUT OF OR RELATING TO THE SERVICE OR THESE TERMS WILL NOT EXCEED THE AMOUNTS PAID OR PAYABLE BY YOU TO DOWNSTREAM DURING THE TWELVE MONTHS IMMEDIATELY PRECEDING THE EVENT GIVING RISE TO THE CLAIM.

If you are using DownStream under a separate signed agreement, that agreement may establish different liability terms.

39. Indemnification

To the extent permitted by law, you agree to defend, indemnify, and hold harmless DownStream Health Technologies, Inc. and its officers, directors, employees, and affiliates from claims, damages, liabilities, losses, costs, and expenses arising from:

• your unlawful use of DownStream;
• Customer Content you do not have the right to provide;
• your violation of these Terms;
• your violation of third-party rights; or
• your misuse of shared or assurance materials.

This section may be modified by an applicable negotiated agreement.

40. Governing Law

These Terms are governed by the laws of the State of Delaware, without regard to conflict-of-law principles.

Any dispute that is not subject to an agreed alternative dispute process will be brought in a state or federal court with appropriate jurisdiction in Delaware, unless applicable law requires otherwise.

41. Dispute Resolution

Before commencing formal litigation, the parties agree to make reasonable good-faith efforts to resolve disputes through business discussions.

DownStream may later adopt additional dispute resolution procedures, including arbitration, through updated Terms or a separately agreed contract.

For material Enterprise relationships, dispute provisions may be addressed in a negotiated agreement.

42. Export Controls and Sanctions

You may not use DownStream in violation of applicable U.S. export control or sanctions laws.

You represent that you are not prohibited from using the service under applicable trade restrictions.

43. U.S. Government Use

If DownStream is acquired or used by a U.S. government entity, additional contractual terms may apply.

Unless otherwise agreed, DownStream is commercial computer software and documentation.

44. Assignment

You may not assign these Terms without DownStream's prior written consent, except in connection with a merger, acquisition, reorganization, or sale of substantially all assets, provided the successor assumes the applicable obligations.

DownStream may assign these Terms in connection with a corporate transaction or reorganization.

45. Force Majeure

Neither party will be liable for delay or failure caused by circumstances beyond its reasonable control, including:

• natural disasters;
• internet or infrastructure outages;
• cloud provider failures;
• government actions;
• labor disruptions;
• war;
• terrorism; or
• widespread cybersecurity events.

This does not excuse payment obligations already due.

46. Changes to These Terms

We may update these Terms from time to time.

If changes are material, we may provide notice through:

• the website;
• the DownStream application;
• email; or
• another reasonable method.

Continued use after updated Terms become effective constitutes acceptance where permitted by law.

For customers operating under a signed order form or negotiated agreement, changes may be governed by that agreement.

47. Order of Precedence

If you have a separately signed agreement with DownStream and there is a conflict between that agreement and these Terms, the signed agreement will control to the extent of the conflict.

An applicable order form may also establish specific pricing, plan, subscription term, limits, or service terms.

48. Entire Agreement

These Terms, together with any applicable:

• order form;
• Privacy Policy;
• Data Processing Agreement;
• Business Associate Agreement;
• service-level agreement; and
• other signed agreement,

constitute the agreement between you and DownStream regarding the applicable services.

49. Severability

If any provision of these Terms is found unenforceable, the remaining provisions will remain in effect.

The unenforceable provision will be interpreted as closely as possible to its intended lawful effect.

50. No Waiver

Failure to enforce a provision of these Terms does not waive the right to enforce it later.

51. Contact Information