IntelaMetrix Holdings, Inc.

Master End User License Agreement (EULA) · v3.0 · Effective Date: July 21, 2026 · Issuing Entity: IntelaMetrix Holdings, Inc., a Delaware corporation

This Agreement is a single global document. No separate geographic versions exist. Acceptance is made by affirmative click-wrap at point of purchase and at Platform activation.

1. Scope, Acceptance, and Precedence

1.1 Integrated Platform

This Master End User License Agreement ("Agreement" or "EULA") governs Customer's access to and use of the IntelaMetrix integrated platform, comprising hardware device(s), firmware, software, cloud services, analytics, updates, and support services (collectively, the "Platform"). The Platform is provided only as an integrated system. The Device requires an active SaaS Subscription to operate and cannot function independently.

Any distributor, reseller, or third party that accesses, activates, demonstrates, supports, or otherwise uses the Platform shall be deemed a "Customer" solely with respect to that use, subject to the terms of any applicable distribution or reseller agreement and the limitations set forth in Section 16.

1.2 Acceptance — Click-Wrap and Electronic Signature

This Agreement is accepted by Customer's affirmative, unchecked-box click-through acknowledgment at the point of purchase and again at the point of Platform activation. By clicking to accept, Customer:

confirms that they have read, understood, and agree to be bound by this Agreement in its entirety
represents that they are at least eighteen (18) years of age and have the legal capacity to enter into a binding contract
if accepting on behalf of an entity, represents and warrants that they have full authority to bind that entity to this Agreement
represents that they are acquiring the Platform for commercial or professional purposes and not as a consumer for personal household use
agrees that their click-through constitutes a legally binding electronic signature under the Electronic Signatures in Global and National Commerce Act (E-SIGN Act, 15 U.S.C. § 7001 et seq.) and, where applicable, the EU eIDAS Regulation (EU) No 910/2014
self-identifies their applicable regulatory environment by selecting, at the point of activation, all regulatory frameworks that govern their use of the Platform and the data they submit, including without limitation: HIPAA (US Healthcare); FERPA (US Education); COPPA or CIPA (minors under 13); International Data Protection Laws (including without limitation the GDPR (EU or EEA), the UK GDPR, PIPEDA (Canada), the LGPD (Brazil), or equivalent laws); or Does Not Apply. A selection of HIPAA constitutes a representation that Customer is a Covered Entity or Business Associate under HIPAA and triggers the automatic activation of Schedule D of this Agreement. A selection of International Data Protection Laws confirms acknowledgment of Schedule C. A selection of COPPA or CIPA constitutes a representation that Customer has complied with Section 6.4 of this Agreement. Customer's self-identification is a material representation and a condition of Platform access

IntelaMetrix shall log the timestamp, IP address, Customer account identifier, and EULA version number at each acceptance event. These records constitute conclusive evidence of acceptance.

If Customer does not agree to this Agreement, Customer must not activate or use the Platform and must contact IntelaMetrix to arrange return of the Device within the thirty (30)-day return window.

1.3 Order of Precedence

In the event of conflict between documents, the following order governs, highest to lowest:

This Master EULA
Exhibit A — SaaS Service Level Agreement
Exhibit B — Standard Hardware Warranty
Exhibit C — Enhanced Lifetime Warranty
Any written Enterprise Agreement expressly approved in writing by IntelaMetrix's Chief Executive Officer

No reseller, distributor, or third party has authority to modify this Agreement or expand any obligation of IntelaMetrix beyond its express terms.

2. Definitions

The following terms have the meanings set forth below when used in this Agreement:

Defined Term	Definition
Active Subscription	A Subscription for which all fees are current, the Subscription Term has not expired or been terminated, and no Lapse has occurred beyond the Payment Retry Period.
Aggregated Data	Data derived from Platform use that has been combined with data from other customers or sources such that no individual Customer or End User can be identified, directly or indirectly.
AI/ML Training Data	Any data, including Customer Data, Aggregated Data, De-Identified Data, Derived Data, telemetry, and usage data, used to train, fine-tune, validate, benchmark, or improve artificial intelligence or machine learning models, algorithms, or systems.
Customer	The entity or individual that accepts this Agreement and purchases or uses the Platform, as further described in Section 1.1.
Customer Data	Identifiable raw data submitted by or on behalf of Customer through the Platform, including body composition measurements, End User records, and assessment results.
De-Identified Data	Data that has been processed such that it cannot reasonably be used to identify any natural person, consistent with applicable de-identification standards including 45 C.F.R. § 164.514 (HIPAA Safe Harbor) and GDPR Recital 26.
Derived Data	Insights, benchmarks, scores, analytical outputs, models, and other data generated by IntelaMetrix from processing Customer Data, Aggregated Data, or De-Identified Data.
Device	The IntelaMetrix-branded BX2K or other hardware device purchased by Customer and operated as part of the Platform.
Device Lifecycle	Five (5) years from the date of initial Device activation, unless earlier modified by IntelaMetrix with notice to Customer. The Device Lifecycle is a commercial warranty framework period and does not represent a maximum operational lifespan or quality ceiling for the Device.
Effective Date	The date Customer first accepts this Agreement pursuant to Section 1.2.
End User	Any individual whose body composition data is collected, assessed, or stored through the Platform by or on behalf of Customer.
Enterprise Agreement (EA)	A written agreement expressly approved in writing by IntelaMetrix's Chief Executive Officer that modifies specific terms of this Agreement for a particular Customer.
Feedback	Any feature requests, bug reports, product suggestions, survey responses, support communications, or other input submitted by Customer or End Users to IntelaMetrix regarding the Platform.
Lapse	The condition that occurs when a Subscription fee is not received by IntelaMetrix at the scheduled renewal date and has not been cured within the Payment Retry Period.
Lifecycle End Date	The date on which a Device's Device Lifecycle concludes, calculated from the Device activation date.
North America	The United States of America and Canada.
OEM Device	Any non-IntelaMetrix-branded or white-label hardware, or any hardware manufactured by a party other than IntelaMetrix Holdings, Inc. Devices manufactured by an authorized regional production licensee of IntelaMetrix Holdings, Inc. under a current and valid Production License Agreement, using IntelaMetrix-assigned serial numbers and IntelaMetrix-supplied ultrasound transducers, and bearing IntelaMetrix quality certification, are not OEM Devices for purposes of this Agreement and are eligible for all warranty coverage applicable to their subscription status.
Payment Retry Period	The ten (10)-day period following a failed Subscription renewal payment during which IntelaMetrix will attempt to process payment before declaring a Lapse.
Platform	IntelaMetrix's integrated hardware, firmware, software, cloud services, analytics, updates, and support services, as further described in Section 1.1.
Rest of World (RoW)	All countries and territories outside of North America.
Subscription	Customer's paid right to access and use the Platform under a specific subscription tier, as described in the then-current published pricing policy.
Subscription Term	The period for which Customer has paid for access to the Platform, commencing on the activation date and renewing annually unless cancelled, as described in Section 13.
Suspension	A temporary condition in which Customer's Device functionality and Platform access are disabled but Customer's account and data remain intact and are eligible for Reinstatement.
Termination	A permanent condition in which this Agreement and all rights granted hereunder are extinguished, data export obligations are triggered, and the Enhanced Lifetime Warranty is permanently voided.
Track 1 Customer	A Customer with an Active Subscription, entitled to Enhanced Lifetime Warranty coverage under Exhibit C.
Track 2 Customer	A Customer without an Active Subscription, entitled only to the Standard Hardware Warranty under Exhibit B for the applicable warranty period.

3. License and Platform Use

3.1 License Grant

Subject to this Agreement and timely payment of applicable Subscription fees, IntelaMetrix grants Customer a limited, non-exclusive, non-transferable, non-sublicensable license to access and use the Platform during the applicable Subscription Term, solely for Customer's internal commercial or professional purposes. The scope of this license, including the number of Devices, sites, and administrative users, is defined exclusively by the subscription tier Customer has purchased. Use of the Platform beyond the licensed scope is a material breach of this Agreement.

3.2 Use Restrictions

Customer shall not, and shall not permit any third party to:

circumvent, disable, or interfere with SaaS authentication, licensing, activation, or enforcement controls
reverse engineer, decompile, disassemble, or attempt to derive source code from the Platform
permit unauthorized access to the Platform or share credentials with unauthorized parties
use the Platform for unlawful, safety-critical, emergency, or life-sustaining purposes
use the Platform in violation of applicable law, export controls, or sanctions
remove, obscure, or alter any proprietary notices, marks, or labels on the Platform or Device

3.3 SaaS Dependency and Remote Enforcement

An Active Subscription is required for Device operation at all times. Customer expressly acknowledges and consents to the following:

IntelaMetrix may remotely monitor Device subscription status through an automated phone-home architecture as part of normal Platform operations
upon a Lapse or Termination, IntelaMetrix is authorized to remotely disable Device functionality without further notice beyond the notices prescribed in Section 13
such remote monitoring and disablement is a licensed feature of the Platform and does not constitute unauthorized access under the Computer Fraud and Abuse Act (18 U.S.C. § 1030), the California Computer Data Access and Fraud Act, or any analogous applicable law

Customer's express consent to remote monitoring and enforcement is a material condition of this Agreement and of the warranty and subscription benefits provided hereunder.

3.4 Subscription Tier Compliance

Customer's license rights are limited to the specific subscription tier purchased. Activation or use of Devices, sites, or administrative seats beyond the purchased tier constitutes unauthorized use and a material breach of this Agreement. IntelaMetrix reserves the right to audit Customer's use and to invoice Customer for unauthorized use at the then-current published rates.

3.5 Feedback and Suggestions

Customer and its End Users may submit Feedback to IntelaMetrix. Customer hereby irrevocably assigns to IntelaMetrix all right, title, and interest in and to all Feedback, including all intellectual property rights therein, without compensation or obligation of any kind. IntelaMetrix may use Feedback for any purpose, including incorporation into the Platform, AI/ML model development, and product roadmap planning.

4. Data Rights and Intellectual Property

4.1 Customer Data Ownership

Customer retains ownership of Customer Data. Nothing in this Agreement transfers ownership of Customer Data to IntelaMetrix.

4.2 License to IntelaMetrix

Customer grants IntelaMetrix a perpetual, irrevocable, royalty-free, sublicensable, worldwide license to access, use, copy, process, transmit, store, and analyze Customer Data for the following purposes:

operating, supporting, maintaining, and improving the Platform
generating Aggregated Data, De-Identified Data, and Derived Data
training, fine-tuning, validating, and improving artificial intelligence and machine learning models as further described in Section 5
conducting internal analytics and product development
enforcing this Agreement and detecting abuse or unauthorized use
complying with applicable legal obligations
any other purpose expressly set forth in this Agreement

This license survives termination of this Agreement with respect to Customer Data already processed or incorporated into IntelaMetrix systems, models, or datasets prior to termination.

4.3 Ownership of Aggregated, De-Identified, and Derived Data

IntelaMetrix exclusively owns all right, title, and interest in and to all Aggregated Data, De-Identified Data, and Derived Data. Customer hereby irrevocably assigns to IntelaMetrix any and all rights Customer may have in such data. This assignment is absolute, unconditional, perpetual, and survives termination of this Agreement. IntelaMetrix may use, license, sell, or otherwise commercialize Aggregated Data, De-Identified Data, and Derived Data without restriction and without compensation to Customer.

4.4 Opt-Out of External Commercialization

Customer may submit a written opt-out request to IntelaMetrix to exclude Customer-identifiable data from external commercialization (meaning the licensing or sale of data in a form that identifies Customer by name or unique identifier to third parties outside the IntelaMetrix corporate family).

The opt-out right described in this Section does not apply to, and Customer expressly acknowledges that Customer cannot opt out of, any of the following:

AI/ML Training Data use as described in Section 5
generation and use of Aggregated Data, De-Identified Data, or Derived Data
internal analytics, product development, or Platform improvement activities
data already processed, aggregated, or incorporated into IntelaMetrix models or datasets prior to the opt-out request
any use required for legal compliance, security, or abuse prevention

An opt-out does not entitle Customer to any refund, credit, or modification of subscription pricing.

4.5 IntelaMetrix Intellectual Property

IntelaMetrix retains all right, title, and interest in and to the Platform, including all software, firmware, algorithms, models, methodologies, documentation, trademarks, and trade secrets. No rights are granted to Customer except the limited license expressly set forth in Section 3.1. Customer shall not challenge IntelaMetrix's ownership of any intellectual property embodied in the Platform.

4.6 Data Access and Export on Termination

Upon Termination, Customer may export Customer Data for thirty (30) days following the Termination date. After such period, IntelaMetrix has no obligation to retain or provide access to Customer Data. IntelaMetrix's rights under Section 4.2 and Section 4.3 survive Termination.

4.7 Publicity and Reference Rights

IntelaMetrix may identify Customer as a customer of the Platform in marketing materials, case studies, press releases, and investor presentations, using Customer's name and logo in a factually accurate manner. Customer may opt out of this right by submitting a written request to IntelaMetrix. Opt-out takes effect within thirty (30) days of receipt and applies to new materials only; it does not require removal of previously published references.

4.8 Data Retention

IntelaMetrix retains Customer Data for the duration of the active Subscription Term and for a period of thirty (30) days following Termination, consistent with the data export window set forth in Section 4.6. After the expiration of such thirty (30)-day period, IntelaMetrix has no obligation to retain Customer Data in identifiable form and may delete or render it irretrievable, subject to IntelaMetrix's rights under Sections 4.2, 4.3, and 5 with respect to data already processed, aggregated, de-identified, or incorporated into IntelaMetrix systems or models prior to deletion. Aggregated Data, De-Identified Data, and Derived Data are retained indefinitely as IntelaMetrix's owned assets under Section 4.3 and are not subject to any Customer-requested deletion or retention limitation. For Customers subject to Schedule D (HIPAA BAA), IntelaMetrix retains documentation related to its Business Associate obligations for a minimum of six (6) years from the date of creation or the date it was last in effect, whichever is later, consistent with 45 C.F.R. § 164.530(j).

5. Artificial Intelligence and Machine Learning Rights

5.1 Strategic Asset Statement

IntelaMetrix's primary enterprise value is the proprietary data platform, AI models, and machine learning systems it develops from Platform use across its global install base. The rights established in this Section are fundamental to IntelaMetrix's business and are a material basis on which IntelaMetrix provides the Platform, warranty benefits, and subscription pricing to Customer.

5.2 Explicit AI/ML Training Rights

Customer expressly and irrevocably grants IntelaMetrix the right to use Customer Data, and all data generated through Customer's and End Users' use of the Platform, as AI/ML Training Data. These rights include without limitation:

training, fine-tuning, and validating machine learning and artificial intelligence models
developing foundation models, specialized models, and derived model architectures
generating synthetic data derived from Customer Data for model training and validation purposes
benchmarking and evaluating model performance using Platform-generated data
incorporating learned model weights, parameters, and outputs derived from Customer Data into Platform services and IntelaMetrix's proprietary AI systems

5.3 Ownership of AI/ML Models and Outputs

IntelaMetrix exclusively owns all AI/ML models, model weights, parameters, architectures, training datasets, validation datasets, and analytical outputs developed using AI/ML Training Data. This ownership is absolute, unconditional, and survives termination of this Agreement. No portion of a trained model that incorporates AI/ML Training Data constitutes Customer Data or is subject to Customer's export rights under Section 4.6.

5.4 Non-Optable

The AI/ML rights granted under this Section 5 are not subject to Customer's opt-out right under Section 4.4 or any other opt-out mechanism. Customer's acceptance of this Agreement constitutes an unconditional, irrevocable grant of AI/ML training rights as a condition of Platform access. Where applicable law, including the EU General Data Protection Regulation, grants individuals a right to erasure of personal data, IntelaMetrix will de-identify and suppress the underlying source Customer Data and will not make further use of it in identifiable form. To the extent that erasure of individual data points from trained model weights or aggregated datasets is not technically feasible, such infeasibility constitutes a legitimate limitation on the right to erasure consistent with applicable regulatory guidance, including guidance issued by the European Data Protection Board. IntelaMetrix's ongoing use of previously trained models does not constitute continued processing of the individual's identifiable personal data.

5.5 Survival

The rights granted under this Section 5 are perpetual and irrevocable and survive expiration, cancellation, or termination of this Agreement and of any Subscription. IntelaMetrix's right to use AI/ML Training Data already collected, and to use models already trained on such data, is not affected by any subsequent termination, opt-out, or modification of this Agreement.

6. Safety and Medical Disclaimers

6.1 No Medical Diagnosis

The Platform provides body composition assessment and analytical tools only. It is not intended for, and must not be used for, medical diagnosis, treatment decisions, or clinical medical decision-making. IntelaMetrix makes no representations regarding the clinical accuracy of Platform outputs for diagnostic purposes.

6.2 No Safety-Critical Use

The Platform is not designed or validated for life-sustaining, emergency, or safety-critical applications. Customer assumes all risk arising from reliance on Platform outputs in any context. IntelaMetrix expressly disclaims all liability for harm arising from any safety-critical, diagnostic, or treatment-related use of the Platform.

6.3 Professional Responsibility

Customer is solely responsible for ensuring that its use of the Platform, and the use by its End Users, complies with all applicable professional, regulatory, and ethical standards governing Customer's field of practice.

6.4 Minor Data and Youth Sports Compliance

Where Customer uses the Platform in connection with individuals under the age of eighteen (18), including in Youth Sports Compliance deployments, Customer represents, warrants, and agrees that:

to the extent the Platform is used to collect personal information from children under the age of thirteen (13), Customer has complied with all applicable requirements of the Children's Online Privacy Protection Act (COPPA) and, where applicable, the Children's Internet Protection Act (CIPA), including obtaining all required verifiable parental or guardian consents prior to data collection
to the extent the Platform is used in connection with student education records at institutions subject to the Family Educational Rights and Privacy Act (FERPA), Customer holds all required authorizations and has satisfied all FERPA obligations prior to submitting student data to the Platform
Customer has provided all notices required by applicable federal and state law to individuals, parents, and guardians regarding the collection, use, and disclosure of minor data through the Platform
Customer will promptly notify IntelaMetrix if Customer becomes aware of any legal restriction or regulatory requirement that would prohibit or limit the collection, transfer, or processing of minor data through the Platform

IntelaMetrix does not knowingly collect personal information directly from children under the age of thirteen (13). Compliance with applicable child data protection laws in connection with the Platform is the sole responsibility of Customer as the data controller for End User data.

7. Support, Telemetry, and Audit Rights

7.1 Support

Support is provided in accordance with the SLA set forth in Exhibit A, subject to Customer maintaining an Active Subscription.

7.2 Telemetry

Customer authorizes IntelaMetrix to collect Device telemetry and usage data, including subscription status, device activity, error logs, and performance data, to enforce licensing, detect abuse, investigate security incidents, ensure compliance, operate the Platform, and generate AI/ML Training Data. Telemetry collection is continuous and cannot be disabled by Customer.

7.3 Audit Rights

IntelaMetrix may, upon reasonable prior written notice of no fewer than five (5) business days, audit Customer's use of the Platform to verify compliance with the license scope and Subscription tier. Audits shall be conducted during normal business hours and shall not unreasonably disrupt Customer's operations. If an audit reveals unauthorized use, Customer shall pay IntelaMetrix's reasonable audit costs plus the fees for unauthorized use at then-current published rates.

7.4 Data Breach Notification

IntelaMetrix will use commercially reasonable efforts to notify Customer of a confirmed security breach affecting Customer Data within a timeframe consistent with applicable law. Notification obligations for HIPAA-covered PHI are governed by Schedule D. Notification obligations for GDPR and UK GDPR personal data are governed by Schedule C. Breach notification is a best-effort obligation and does not create a warranty or guarantee of notification within any specific timeframe.

8. Confidentiality

8.1 IntelaMetrix Confidential Information

Customer acknowledges that the Platform, its pricing, architecture, algorithms, roadmap, trade secrets, and all non-public information disclosed by IntelaMetrix in connection with this Agreement constitute IntelaMetrix's confidential information. Customer shall: (a) hold such information in strict confidence; (b) not disclose it to any third party without IntelaMetrix's prior written consent; and (c) use it solely in connection with Customer's authorized use of the Platform.

8.2 Customer Confidential Information

IntelaMetrix shall hold Customer Data in confidence and shall not disclose Customer Data to third parties except as expressly permitted by this Agreement, including disclosure to authorized subprocessors, professional advisors, and regulatory authorities as required by law.

8.3 Exceptions

Confidentiality obligations do not apply to information that: (a) is or becomes publicly available through no fault of the receiving party; (b) was rightfully known to the receiving party before disclosure; (c) is independently developed without use of confidential information; or (d) is required to be disclosed by law or court order, provided the receiving party gives reasonable prior notice to the disclosing party.

8.4 Survival

Confidentiality obligations survive termination of this Agreement for a period of five (5) years, except with respect to trade secrets, which shall be protected for as long as they constitute trade secrets under applicable law.

9. Indemnification

9.1 Customer Indemnification of IntelaMetrix

Customer shall indemnify, defend, and hold harmless IntelaMetrix and its officers, directors, employees, agents, successors, and assigns from and against any claims, damages, liabilities, costs, and expenses (including reasonable attorneys' fees) arising out of or relating to: (a) Customer's or any End User's use or misuse of the Platform; (b) Customer's violation of this Agreement or applicable law; (c) any third-party claim arising from Customer Data or End User data; or (d) Customer's negligence or willful misconduct.

9.2 IntelaMetrix Indemnification of Customer

IntelaMetrix shall indemnify, defend, and hold harmless Customer and its officers, directors, employees, agents, successors, and assigns from and against any third-party claim that the Platform, as delivered by IntelaMetrix and used by Customer in accordance with this Agreement, infringes any United States patent, copyright, or trademark. IntelaMetrix's indemnification obligation does not apply to claims arising from: (a) modification of the Platform by Customer; (b) combination with third-party products not provided by IntelaMetrix; (c) use of the Platform outside the scope of the license; or (d) Customer Data.

9.3 Indemnification Cap

Each party's indemnification obligation is subject to the liability cap set forth in Section 12.2. Neither party's indemnification obligation applies to claims arising from the other party's gross negligence or willful misconduct.

9.4 Indemnification Procedure

The indemnified party shall: (a) promptly notify the indemnifying party of the claim; (b) grant the indemnifying party sole control of the defense and settlement; and (c) provide reasonable cooperation. The indemnifying party shall not settle any claim that imposes liability on or adversely affects the indemnified party without prior written consent.

10. Warranties and Disclaimers

10.1 Hardware Warranties

Hardware warranties are governed exclusively by Exhibit B (Standard Hardware Warranty) and Exhibit C (Enhanced Lifetime Warranty). The applicable warranty depends on Customer's subscription status at the time of a warranty claim, as set forth in those Exhibits.

10.2 Platform Disclaimer

EXCEPT AS EXPRESSLY SET FORTH IN THIS AGREEMENT, THE PLATFORM IS PROVIDED "AS IS" AND "AS AVAILABLE." INTELAMETRIX DISCLAIMS ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, NON-INFRINGEMENT, ACCURACY, RELIABILITY, AND UNINTERRUPTED AVAILABILITY. INTELAMETRIX DOES NOT WARRANT THAT THE PLATFORM WILL MEET CUSTOMER'S REQUIREMENTS OR THAT IT WILL BE ERROR-FREE.

10.3 No Warranty Through Distributors or Resellers

No distributor, reseller, or third party is authorized to make any warranty, representation, or guarantee on behalf of IntelaMetrix. Any such representation is made solely by the distributor or reseller and is not binding on IntelaMetrix. Customer's recourse for distributor or reseller misrepresentation is against the distributor or reseller, not IntelaMetrix.

10.4 Compliance Disclaimer

IntelaMetrix endeavors to maintain commercially reasonable, good-faith compliance with applicable data protection and privacy laws in the jurisdictions where it operates. Compliance is a best-effort obligation and does not constitute a warranty or guarantee of compliance with any specific law, regulation, or standard. IntelaMetrix will update its practices as its compliance program matures and as applicable law evolves.

11. Remedies, Refunds, and Chargebacks

11.1 Thirty-Day Money-Back Guarantee

Within thirty (30) days of Device activation, Customer may request a full refund by returning the Device in original condition and terminating the account. This remedy is available for Provider and Youth Sports Compliance subscription tiers only and requires return shipment at Customer's expense. Refunds are processed within fourteen (14) business days of Device receipt and account closure confirmation.

11.2 Post-Thirty-Day Remedies

After thirty (30) days from activation: (a) no cash refunds are available; (b) no service credits are issued; and (c) any exception requires prior written approval by IntelaMetrix's CEO or COO. The SLA remedies set forth in Exhibit A are the sole remedies for service availability failures.

11.3 Chargebacks

Customer agrees not to initiate chargebacks, payment reversals, or credit card disputes outside the remedies expressly set forth in this Agreement. Customer acknowledges that initiating an unauthorized chargeback constitutes a material breach of this Agreement and may result in immediate Suspension or Termination of the Customer's account.

11.4 Device Return on Warranty Replacement

Upon receipt of a replacement Device under Exhibit B or Exhibit C, Customer must return the defective Device to IntelaMetrix within thirty (30) days. Failure to return the defective Device entitles IntelaMetrix to invoice Customer for the full replacement Device price at then-current published rates.

12. Limitation of Liability

12.1 Exclusion of Consequential Damages

TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW, NEITHER PARTY SHALL BE LIABLE TO THE OTHER FOR ANY INDIRECT, INCIDENTAL, SPECIAL, CONSEQUENTIAL, PUNITIVE, OR EXEMPLARY DAMAGES, INCLUDING LOSS OF PROFITS, LOSS OF DATA, LOSS OF GOODWILL, BUSINESS INTERRUPTION, OR COST OF SUBSTITUTE GOODS OR SERVICES, ARISING OUT OF OR IN CONNECTION WITH THIS AGREEMENT, REGARDLESS OF THE THEORY OF LIABILITY AND EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGES.

12.2 Aggregate Liability Cap

TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW, EACH PARTY'S TOTAL AGGREGATE LIABILITY TO THE OTHER PARTY ARISING OUT OF OR IN CONNECTION WITH THIS AGREEMENT SHALL NOT EXCEED THE TOTAL FEES PAID OR PAYABLE BY CUSTOMER IN THE TWELVE (12) MONTHS IMMEDIATELY PRECEDING THE CLAIM GIVING RISE TO LIABILITY.

12.3 Exceptions

The exclusions and limitations in Sections 12.1 and 12.2 do not apply to: (a) a party's indemnification obligations under Section 9 for third-party claims; (b) breach of confidentiality obligations under Section 8; (c) a party's gross negligence or willful misconduct; or (d) Customer's obligation to pay fees owed under this Agreement.

12.4 Injunctive Relief

Each party acknowledges that breach of the intellectual property, data rights, AI/ML rights, or confidentiality provisions of this Agreement would cause irreparable harm for which monetary damages would be inadequate. Each party is therefore entitled to seek injunctive or other equitable relief to prevent or remedy such breach, without the requirement to post a bond, prove actual damages, or satisfy the pre-dispute resolution requirements of Section 18.

13. Term, Termination, Lapse, and Reinstatement

13.1 Subscription Term and Auto-Renewal

The Subscription Term commences on the date of Device activation and continues for a period of one (1) year (for annual subscriptions) or one (1) month (for monthly subscriptions, where available). Subscriptions renew automatically at the end of each Subscription Term at the then-current published rate unless Customer cancels before the renewal date.

IntelaMetrix will provide Customer with written notice of the upcoming renewal no fewer than thirty (30) days prior to the renewal date. For Legacy Connect subscribers, the notice will include the scheduled step-up to Provider pricing at the Year 3 renewal.

13.2 Payment Failure and Lapse

If a Subscription renewal payment fails, IntelaMetrix will attempt to process payment for a period of ten (10) days (the "Payment Retry Period"). If payment is not received by the end of the Payment Retry Period, a Lapse is declared and the following framework applies:

Window	Status	Device Functionality	Enhanced Lifetime Warranty	Action Required
Days 1–10 post-due-date	Payment Retry Period	Active	Active	IntelaMetrix retries payment automatically
Days 11–40 post-Lapse	Automatic Grace Period	Active	Active	Self-serve renewal via account portal
Days 41–100 post-Lapse	Suspension — Reinstatement Eligible	Suspended	Coverage gap noted; reinstatement available	Customer must contact IntelaMetrix to reinstate
Day 101+ post-Lapse	Termination Eligible	Suspended; Termination pending	Permanently terminated — does not reinstate under any circumstances	Management approval required to reinstate account

The Enhanced Lifetime Warranty does not reinstate after a Lapse exceeding one hundred (100) days under any circumstances, regardless of the reason for Lapse.

13.3 Suspension

During Suspension, Customer's Device is non-functional and Platform access is disabled. Customer's account, data, and subscription history are preserved. Reinstatement restores Device functionality and Platform access from the date of Reinstatement forward. A coverage gap will be noted on Customer's account for the period of Suspension.

13.4 Reinstatement

Customer may reinstate an account in Suspension by paying all overdue fees plus any applicable reinstatement fee at IntelaMetrix's then-current published rates. Reinstatement after Day 100 requires written approval from IntelaMetrix's CEO or COO and may be subject to additional conditions. Reinstatement does not restore Enhanced Lifetime Warranty coverage for any period of Suspension.

13.5 Termination by Customer

Customer may terminate this Agreement at any time by providing written notice to IntelaMetrix. Termination does not entitle Customer to a refund of prepaid fees. Annual subscriptions cancelled mid-term are not prorated.

13.6 Termination by IntelaMetrix

IntelaMetrix may terminate this Agreement immediately upon written notice if: (a) Customer commits a material breach and fails to cure within thirty (30) days of written notice; (b) Customer becomes insolvent or makes an assignment for the benefit of creditors; or (c) Customer violates Section 3.2 (Use Restrictions) or Schedule A (Acceptable Use Policy).

13.7 Effect of Termination

Upon Termination: (a) all license rights granted under this Agreement immediately cease; (b) Device functionality is permanently disabled; (c) the Enhanced Lifetime Warranty is permanently and irrevocably terminated; (d) the data export window under Section 4.6 is triggered; and (e) all accrued payment obligations survive. IntelaMetrix's rights under Sections 4.2, 4.3, 5, 8, and 17 survive Termination.

14. Payment Terms

14.1 Fees and Payment

Customer shall pay all Subscription fees and Device purchase prices at the rates published by IntelaMetrix at the time of purchase. All fees are quoted in United States dollars and are non-refundable except as expressly set forth in Section 11.

14.2 Taxes

Customer is responsible for all applicable sales, use, value-added, goods and services, and other taxes associated with the purchase of the Platform, excluding taxes on IntelaMetrix's net income. If IntelaMetrix is required by law to collect taxes, IntelaMetrix will add such taxes to the invoice and Customer shall pay them.

14.3 Price Changes

IntelaMetrix may modify Subscription pricing with thirty (30) days' advance written notice to Customer. Price changes take effect at the next renewal following the notice period. Legacy Connect step-up pricing is governed by the pricing schedule in effect at enrollment and is not subject to general price change notices.

14.4 Mid-Tier Replacement Fee

For Track 2 Customers (non-subscribers), a Device replacement fee of five hundred dollars (US $500) applies to replacement requests made between the end of the standard twenty-four (24)-month hardware warranty period and the Lifecycle End Date (months 25 through 60 from activation), as further set forth in Exhibit B.

15. EULA Amendment and Notices

15.1 Right to Amend

IntelaMetrix may amend this Agreement at any time by providing Customer with thirty (30) days' advance written notice of the amended terms. Material changes to warranty terms or pricing require separate affirmative acceptance by Customer at the next login or checkout following the notice period. Customer's continued use of the Platform after the notice period constitutes acceptance of the amended Agreement.

15.2 Version Tracking

Each version of this Agreement is identified by a version number displayed on the document face and logged in IntelaMetrix's acceptance records. Customer may request the version of the Agreement they accepted by contacting IntelaMetrix support.

15.3 Notices

All formal notices under this Agreement shall be delivered by email to Customer's account email address on file and to legal@BodyMetrix.com for notices to IntelaMetrix. Notices are deemed received upon transmission, provided no bounce or delivery failure is returned. Customer is responsible for maintaining a current account email address.

16. OEM Devices

16.1 IntelaMetrix-Manufactured OEM Devices

OEM Devices manufactured by IntelaMetrix Holdings, Inc. are entitled to the Standard Hardware Warranty under Exhibit B only. No other warranty, SLA, Enhanced Lifetime Warranty, support entitlement, or cloud access is available for OEM Devices unless expressly provided in a written Enterprise Agreement approved by IntelaMetrix's CEO.

16.2 Third-Party Manufactured OEM Devices

OEM Devices manufactured by any party other than IntelaMetrix Holdings, Inc. are excluded from all warranties, SLAs, and support entitlements under this Agreement. Coverage for such devices, if any, is governed solely by the terms of the applicable Enterprise Agreement.

16.3 No Warranty Expansion Through Resellers

No distributor, reseller, or OEM partner has authority to expand warranty coverage for OEM Devices beyond the terms expressly set forth in this Agreement or an approved Enterprise Agreement.

17. Distributor and Reseller Limitations

17.1 Distributor Representations

IntelaMetrix makes no representations to End Customers through distributors or resellers. No distributor or reseller has authority to: (a) expand or modify warranty coverage; (b) alter support entitlements; (c) make representations about Platform capabilities beyond published specifications; or (d) bind IntelaMetrix to any commitment not expressly set forth in this Agreement.

17.2 Customer Recourse

Customer's recourse for representations made by a distributor or reseller that exceed the terms of this Agreement is against the distributor or reseller, not IntelaMetrix. IntelaMetrix is not liable for distributor or reseller misrepresentation.

17.3 RoW Distribution

All sales and distribution of the Platform outside North America are conducted through authorized distributors and resellers. IntelaMetrix's warranty and support obligations to RoW customers are fulfilled through the authorized distributor or reseller in the applicable territory, as set forth in Exhibits B and C.

18. Dispute Resolution

18.1 Informal Resolution

Before initiating any formal proceeding, the parties shall attempt to resolve any dispute in good faith through direct negotiation. The complaining party shall provide written notice of the dispute to the other party, and the parties shall have thirty (30) days to reach resolution before either party may initiate arbitration.

18.2 Binding Arbitration

Except as provided in Section 18.5, any dispute, claim, or controversy arising out of or relating to this Agreement, or the breach, termination, enforcement, or validity thereof, shall be resolved by binding arbitration administered by the American Arbitration Association (AAA) under its Commercial Arbitration Rules, as amended from time to time. The arbitration seat is Wilmington, Delaware. The language of the arbitration is English. The arbitrator's decision shall be final and binding and may be entered as a judgment in any court of competent jurisdiction.

18.3 Class Action Waiver

EACH PARTY WAIVES ANY RIGHT TO BRING OR PARTICIPATE IN A CLASS ACTION, COLLECTIVE ACTION, OR REPRESENTATIVE ACTION ARISING OUT OF OR RELATING TO THIS AGREEMENT. ALL CLAIMS MUST BE BROUGHT SOLELY IN THE PARTY'S INDIVIDUAL CAPACITY. THE PARTIES AGREE THAT THE ARBITRATOR DOES NOT HAVE AUTHORITY TO CONDUCT CLASS ARBITRATION.

18.4 Jury Trial Waiver

TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW, EACH PARTY IRREVOCABLY WAIVES ALL RIGHTS TO A TRIAL BY JURY IN ANY ACTION, PROCEEDING, OR CLAIM ARISING OUT OF OR RELATING TO THIS AGREEMENT.

18.5 Exceptions — Court Proceedings

Notwithstanding Section 18.2, either party may seek injunctive or other equitable relief from a court of competent jurisdiction without prior arbitration to protect intellectual property rights, AI/ML rights, confidential information, or data rights where irreparable harm is threatened. Venue for any such court proceeding is exclusively in the state or federal courts located in Wilmington, Delaware.

18.6 EU and UK Customers

Notwithstanding Sections 18.2 through 18.4, customers located in the European Union or United Kingdom retain the right to bring claims before competent courts in their jurisdiction of residence to the extent required by applicable mandatory consumer or data protection law. This carve-out does not apply to business customers that have represented that they are acquiring the Platform for commercial or professional purposes pursuant to Section 1.2.

19. Export Controls

The Platform, Device, and all related technology are subject to United States export control laws and regulations, including the Export Administration Regulations (EAR) and the International Traffic in Arms Regulations (ITAR) where applicable. Customer shall not export, re-export, transfer, or release the Platform or Device to any country, entity, or individual in violation of applicable US export laws, or to any jurisdiction subject to US sanctions administered by the Office of Foreign Assets Control (OFAC). Customer represents that neither Customer nor any of its principals is a Specially Designated National or otherwise subject to OFAC sanctions.

20. Assignment

Customer may not assign, transfer, sublicense, or delegate this Agreement or any rights or obligations hereunder without IntelaMetrix's prior written consent, which may be withheld in IntelaMetrix's sole discretion. IntelaMetrix may assign this Agreement freely, including in connection with a merger, acquisition, corporate restructuring, or sale of all or substantially all of its assets, without Customer's consent. Any purported assignment by Customer in violation of this Section is void.

21. Governing Law and Mandatory Law Carve-Out

21.1 Governing Law

This Agreement is governed by and construed in accordance with the laws of the State of Delaware, without regard to its conflict-of-law principles. The United Nations Convention on Contracts for the International Sale of Goods (CISG) does not apply.

21.2 EU and UK Mandatory Law

Notwithstanding Section 21.1, where Customer is located in the European Union or United Kingdom, nothing in this Agreement excludes, restricts, or modifies any right or remedy, or any guarantee, warranty, or other term or condition, implied or imposed by applicable mandatory EU or UK law that cannot lawfully be excluded or limited. To the extent any provision of this Agreement conflicts with such mandatory law, the mandatory law provision prevails solely to the extent of the conflict.

21.3 Device Lifecycle — EU Consumer Disclosure

For customers located in the European Union, the following disclosure applies: The Device Lifecycle of five (5) years is a commercial warranty framework period that defines the duration of Enhanced Lifetime Warranty coverage for Active Subscription customers. It does not represent the maximum operational lifespan of the Device, and IntelaMetrix does not represent that the Device will cease to function at the Lifecycle End Date. This disclosure is made in compliance with EU consumer protection principles and applicable national implementing legislation.

22. General Provisions

22.1 Entire Agreement

This Agreement, together with all Exhibits and Schedules incorporated herein, constitutes the entire agreement between the parties with respect to the Platform and supersedes all prior and contemporaneous agreements, representations, and understandings, whether written or oral, relating to the Platform.

22.2 Severability

If any provision of this Agreement is found by a court or arbitrator to be invalid, illegal, or unenforceable, that provision shall be modified to the minimum extent necessary to make it enforceable, and the remaining provisions of this Agreement shall continue in full force and effect.

22.3 Waiver

No failure or delay by either party in exercising any right, power, or remedy under this Agreement constitutes a waiver of that right, power, or remedy. No waiver is effective unless in writing. A waiver of any breach does not constitute a waiver of any subsequent breach.

22.4 Force Majeure

IntelaMetrix is not liable for any delay or failure in performance resulting from causes beyond its reasonable control, including natural disasters, acts of war, terrorism, labor disputes, component shortages, carrier delays, customs delays, government actions, cyberattacks, or trade restrictions. IntelaMetrix will use commercially reasonable efforts to minimize the impact of any force majeure event.

22.5 Electronic Acceptance and Counterparts

This Agreement may be accepted by electronic means as described in Section 1.2. Electronic acceptance is legally binding and has the same effect as a written, physically signed agreement. The parties agree that click-through acceptance at checkout or Platform activation constitutes a valid counterpart to this Agreement.

22.6 Relationship of the Parties

The parties are independent contractors. Nothing in this Agreement creates a partnership, joint venture, agency, franchise, or employment relationship between the parties.

22.7 Survival

The following Sections survive expiration or termination of this Agreement: 3.5 (Feedback), 4.2 (License to IntelaMetrix), 4.3 (Aggregated and Derived Data Ownership), 4.6 (Data Export), 5 (AI/ML Rights), 8 (Confidentiality), 9 (Indemnification), 10.2 (Disclaimer), 12 (Limitation of Liability), 14 (Payment Terms), 18 (Dispute Resolution), 19 (Export Controls), 21 (Governing Law), and this Section 22.

Exhibit A — SaaS Service Level Agreement (SLA)

A1. Availability

Uptime Commitment: 99.5% monthly, measured over calendar month
Support Hours: 8x5 Pacific Time, Monday through Friday, excluding US federal holidays
Exclusions: Planned maintenance windows (with 48-hour advance notice), force majeure events, and outages caused by Customer's network, power, or third-party dependencies

A2. Severity Levels and Response Times

Severity	Description	Responsible Party	Initial Response
P1 — Critical	Platform unavailable; Device inoperable	IntelaMetrix	4 business hours
P1 — Critical (Enterprise)	Same as above for Enterprise tier	IntelaMetrix	2 business hours
P2 — High	Core functionality materially degraded	IntelaMetrix	8 business hours
P3 — Medium	Non-core impairment; workaround exists	IntelaMetrix / Reseller	1 business day
P4 — Low	Minor or cosmetic issue	IntelaMetrix / Reseller	2 business days
P5 — Informational	Usage questions or feature requests	Customer / Reseller	Best effort

Customer is responsible for network connectivity, power supply, and all third-party dependencies. IntelaMetrix's SLA obligations are limited to Platform-level issues and do not include reseller-managed infrastructure, customer-specific configurations, or third-party integrations.

A3. SLA Remedies

First 30 days: Full refund per Section 11.1 of the EULA
After 30 days: No refunds or credits without CEO or COO written approval
SLA credits, if any, are the sole remedy for availability failures and do not constitute a waiver of the limitation of liability under Section 12

Exhibit B — Standard Hardware Warranty

Applies to: Customers without an Active Subscription and to OEM Devices manufactured by IntelaMetrix Holdings, Inc.

B1. Warranty Term

Twenty-four (24) months from the date of Device activation.

B2. Scope

IntelaMetrix warrants that the Device will be free from manufacturing defects in materials and workmanship under normal use during the warranty term.

B3. Warranty Claim Process

To submit a warranty claim, Customer must:

contact IntelaMetrix support through the designated support channel
provide proof of purchase, Device serial number, and a description of the defect
follow IntelaMetrix's return merchandise authorization (RMA) process

IntelaMetrix will acknowledge warranty claims within five (5) business days of receipt of a complete claim submission.

B4. Remedy

IntelaMetrix's sole obligation under this warranty is to repair or replace the defective Device with a new Device of equal or greater specification, at IntelaMetrix's sole discretion. Replacement Devices are new units. No refurbished replacements will be provided under this warranty.

B5. Mid-Tier Replacement Fee (Months 25–60)

For Track 2 Customers (non-subscribers) who submit a replacement request after the expiration of the 24-month warranty term but before the Lifecycle End Date (months 25 through 60 from activation), IntelaMetrix will provide a replacement Device at a fee of five hundred dollars (US $500). This mid-tier replacement is not a warranty obligation and is provided solely at IntelaMetrix's discretion.

B6. Post-Lifecycle (Month 61+)

After the Lifecycle End Date, no warranty or mid-tier replacement is available for Track 2 Customers. Customer may purchase a new Device at IntelaMetrix's then-current published price.

B7. Shipping

North America: IntelaMetrix covers inbound and outbound shipping for warranty replacements
Rest of World: The authorized distributor or reseller is responsible for all shipping, customs duties, and last-mile delivery costs
Where no distributor or reseller exists for a RoW customer, Customer is responsible for shipping costs

B8. Exclusions

This warranty does not cover:

damage caused by misuse, abuse, accident, unauthorized modification, or unauthorized repair
environmental damage including liquid intrusion, extreme temperatures, or physical impact
cosmetic damage that does not affect functionality
damage caused by operation outside the permitted use described in this Agreement
software, firmware, or SaaS platform issues (which are governed by the SLA)
OEM Devices not manufactured by IntelaMetrix Holdings, Inc.

B9. OEM Applicability

This Exhibit B applies to OEM Devices manufactured by IntelaMetrix Holdings, Inc. only. It does not apply to OEM Devices manufactured by third parties. No other warranty, including Exhibit C, applies to OEM Devices regardless of subscription status.

Exhibit C — Enhanced Lifetime Warranty

Applies to: Customers with an Active Subscription. Does not apply to OEM Devices.

C1. Eligibility

The Enhanced Lifetime Warranty is available exclusively to Track 1 Customers who maintain a continuous Active Subscription. Coverage is contingent on Active Subscription status at the time of any warranty claim. This warranty is not available for OEM Devices.

C2. Duration

The Enhanced Lifetime Warranty is in effect for the full Device Lifecycle (five (5) years from the date of initial Device activation), provided Customer maintains a continuous Active Subscription throughout the Device Lifecycle.

C3. New Device Replacement Standard

Under this warranty, IntelaMetrix will replace a defective Device with a new Device of equal or greater specification. "New Device" means a Device manufactured from new components that has not been previously sold, activated, or used as a customer unit. No refurbished, reconditioned, or previously-activated Devices will be provided as replacements under this warranty. If IntelaMetrix elects to provide a Device of greater specification than the defective Device, no additional fee is charged to Customer.

C4. Warranty Claim Process

To submit a claim under this warranty, Customer must:

maintain an Active Subscription at the time of claim submission
contact IntelaMetrix support through the designated support channel
provide proof of Active Subscription, Device serial number, and a description of the defect
follow IntelaMetrix's return merchandise authorization (RMA) process

IntelaMetrix will acknowledge warranty claims within five (5) business days of receipt of a complete claim submission.

C5. Device Return

Upon receipt of the replacement Device, Customer must return the defective Device to IntelaMetrix within thirty (30) days. Failure to return the defective Device entitles IntelaMetrix to invoice Customer for the full replacement Device price at then-current published rates.

C6. Shipping

North America: IntelaMetrix covers inbound and outbound shipping for warranty replacements
Rest of World: IntelaMetrix's obligation is fulfilled by providing the replacement Device to the authorized distributor or reseller in the applicable territory. The authorized distributor or reseller is responsible for all shipping, customs duties, import fees, and last-mile delivery costs to Customer. Where no authorized distributor or reseller exists, Customer is responsible for return shipping costs to IntelaMetrix, and IntelaMetrix will cover outbound shipping of the replacement to Customer's registered address

C7. Lapse, Suspension, and Termination

Enhanced Lifetime Warranty coverage terminates immediately and permanently upon any of the following events:

a Lapse exceeding one hundred (100) days, as set forth in Section 13.2
Termination of the Agreement by either party
cancellation of the Subscription by Customer

Coverage does not reinstate after termination under any circumstances. A coverage gap is noted on Customer's account during any period of Suspension within the first one hundred (100) days of a Lapse, but coverage resumes upon Reinstatement for the remainder of the Device Lifecycle.

C8. Abuse Protection

All replacement claims are subject to IntelaMetrix inspection of the returned Device. Claims involving apparent misuse, abuse, physical damage, unauthorized modification, or environmental damage are not covered. Repeated warranty claims that IntelaMetrix reasonably determines to reflect patterns of misuse may result in termination of Enhanced Lifetime Warranty coverage after written notice to Customer.

Schedule A — Acceptable Use Policy (AUP)

A1. Purpose

This Acceptable Use Policy governs use of the Platform and is intended to protect the security, integrity, availability, and lawful operation of the Platform and IntelaMetrix's data assets.

A2. Prohibited Conduct

Customer shall not, and shall not permit any third party to:

attempt to bypass, disable, interfere with, or circumvent SaaS authentication, licensing, activation, enforcement, or compliance mechanisms
access, probe, or test the vulnerability of the Platform or any related system without IntelaMetrix's prior written authorization
misuse, improperly disclose, or unlawfully process personal data or protected health information in connection with Platform use
use the Platform in violation of applicable law, regulation, export controls, or sanctions
introduce malware, malicious code, ransomware, or automated scraping mechanisms into or through the Platform
impersonate another user or misrepresent authorization to access the Platform
use the Platform for safety-critical, emergency, or life-sustaining purposes
attempt to access, collect, or harvest data from the Platform beyond the scope of Customer's licensed use, including any attempt to access Aggregated Data, De-Identified Data, Derived Data, or AI/ML Training Data owned by IntelaMetrix

A3. Enforcement

Violation of this AUP constitutes a material breach of the EULA and may result in immediate Suspension or Termination of access without refund, and may subject Customer to legal action under applicable law.

Schedule B — Privacy Notice

B1. Scope

This Privacy Notice describes IntelaMetrix's data handling practices in connection with the Platform. It is provided for transparency and does not create independent contractual obligations beyond those set forth in the EULA.

B2. Categories of Data Processed

Customer Data submitted through the Platform, including End User body composition records
Device telemetry and usage data
Account, billing, and support data
Log, security, and audit data
AI/ML Training Data derived from the foregoing

B3. Purposes of Processing

Operating, supporting, maintaining, and improving the Platform
Generating Aggregated Data, De-Identified Data, and Derived Data
Training and improving AI/ML models
Enforcing this Agreement and detecting abuse
Complying with applicable legal obligations

B4. Data Sharing

Data may be shared with: (a) authorized subprocessors engaged to assist in Platform delivery, subject to confidentiality and data protection obligations; (b) professional advisors under confidentiality obligations; and (c) regulatory authorities or law enforcement where required by applicable law. IntelaMetrix uses third-party infrastructure providers (including cloud hosting, payment processors, and analytics tools) to deliver the Platform. These providers are authorized subprocessors and are subject to appropriate data protection agreements.

B5. Cross-Border Transfers

Customer Data may be transferred to and processed in the United States and other jurisdictions outside Customer's country of residence. IntelaMetrix applies commercially reasonable safeguards to such transfers, including where applicable the use of Standard Contractual Clauses for transfers from the EU or UK.

B6. Data Subject Rights

Where required by applicable law, individuals may exercise data subject rights including access, correction, deletion, portability, and objection to processing. Requests must be submitted through bodymetrix.com/pages/privacy-request or by emailing privacy@BodyMetrix.com. IntelaMetrix will respond to valid requests within the timeframe required by applicable law on a best-effort basis. The exercise of data subject rights does not affect IntelaMetrix's rights under Sections 4.3 and 5 of the EULA with respect to Aggregated Data, De-Identified Data, Derived Data, and AI/ML Training Data.

B7. State Biometric and Health Data

Body composition data collected through the Platform, including ultrasound-derived measurements, may constitute biometric information, biometric identifiers, or health data under applicable US state privacy laws, including without limitation the Illinois Biometric Information Privacy Act (BIPA) and analogous statutes in other states. Customer, as the data controller for End User data, is solely responsible for compliance with applicable state biometric and health data laws governing the collection, storage, use, and disclosure of such data, including obtaining all required consents and providing all required notices. IntelaMetrix makes no representation that the Platform, standing alone, satisfies state biometric or health data compliance obligations on behalf of Customer.

Schedule C — Data Processing Addendum (DPA)

Applies automatically where Customer is subject to the EU GDPR, UK GDPR, Canada's PIPEDA, or Quebec Law 25, and IntelaMetrix processes personal data on Customer's behalf.

C1. Applicability and Best-Effort Standard

This DPA applies to IntelaMetrix's processing of personal data on behalf of Customer where Customer is subject to the EU General Data Protection Regulation (GDPR), the UK General Data Protection Regulation (UK GDPR), Canada's Personal Information Protection and Electronic Documents Act (PIPEDA), or Quebec's Act Respecting the Protection of Personal Information in the Private Sector (Law 25). IntelaMetrix's obligations under this DPA are best-effort obligations reflecting IntelaMetrix's commitment to good-faith compliance. They do not constitute a warranty or guarantee of full technical compliance with any specific regulatory requirement.

C2. Roles

Customer acts as Controller of Customer Data
IntelaMetrix acts as Processor for Customer Data processed on Customer's behalf
IntelaMetrix acts as Controller for Aggregated Data, De-Identified Data, Derived Data, and AI/ML Training Data

C3. Processing Obligations

IntelaMetrix shall, on a best-effort basis:

process Customer Data only for the purposes set forth in this Agreement
implement commercially reasonable technical and organizational safeguards appropriate to the risk
assist Customer with valid data subject requests to the extent technically feasible
notify Customer of a confirmed personal data breach within a commercially reasonable timeframe consistent with applicable law
upon termination, handle Customer Data in accordance with Section 4.6 of the EULA

C4. Subprocessors

Customer authorizes IntelaMetrix's use of subprocessors to deliver the Platform. IntelaMetrix remains responsible for subprocessors' compliance with this DPA to the extent within IntelaMetrix's reasonable control. A current list of subprocessors may be provided upon written request.

C5. International Transfers

Where required by applicable law, IntelaMetrix will implement appropriate safeguards for international transfers of personal data, including Standard Contractual Clauses (SCCs) for EU and UK transfers, on a best-effort basis.

C6. Canada — PIPEDA and Quebec Law 25

For Canadian customers, IntelaMetrix endeavors to process personal data in a manner consistent with PIPEDA's accountability, consent, and accuracy principles and with Quebec Law 25's transparency and privacy impact assessment requirements. IntelaMetrix's Canadian compliance obligations are best-effort and will be updated as IntelaMetrix's compliance program matures and as Canadian privacy law enforcement guidance develops.

C7. Limitation

This DPA does not expand IntelaMetrix's obligations under Sections 4.3 and 5 of the EULA with respect to Aggregated Data, De-Identified Data, Derived Data, or AI/ML Training Data, which IntelaMetrix owns and controls exclusively.

Schedule D — HIPAA Business Associate Addendum (BAA)

This Schedule D constitutes the Business Associate Addendum between IntelaMetrix Holdings, Inc. ("Business Associate") and Customer ("Covered Entity" or "Business Associate," as applicable), where Customer is a Covered Entity or Business Associate under the Health Insurance Portability and Accountability Act of 1996 and its implementing regulations at 45 C.F.R. Parts 160 and 164 (collectively, "HIPAA"). This Schedule D is incorporated into and forms part of the Master EULA. Capitalized terms used but not defined in this Schedule D have the meanings given in the Master EULA or, where applicable, in HIPAA.

This Schedule D activates automatically where Customer self-identifies as a Covered Entity or Business Associate under HIPAA pursuant to Section 1.2 of this Agreement, or where Customer otherwise represents at any time during the Subscription Term that it is subject to HIPAA. Activation of this Schedule D does not modify any other term of the Master EULA except as expressly set forth herein.

D1. Definitions

The following terms, when used in this Schedule D, have the meanings assigned under HIPAA unless otherwise specified: "Breach" (45 C.F.R. § 164.402); "Business Associate" means IntelaMetrix Holdings, Inc. in its capacity as a business associate to Customer under HIPAA; "Covered Entity" means Customer in its capacity as a covered entity or business associate under HIPAA, as applicable; "Data Aggregation" (45 C.F.R. § 164.501); "Designated Record Set" (45 C.F.R. § 164.501); "Electronic Protected Health Information" or "ePHI" means PHI transmitted by or maintained in electronic media as defined at 45 C.F.R. § 160.103; "HITECH Act" means the Health Information Technology for Economic and Clinical Health Act; "Minimum Necessary" (45 C.F.R. § 164.502(b)); "Privacy Rule" means 45 C.F.R. Part 164, Subparts A and E; "Protected Health Information" or "PHI" (45 C.F.R. § 160.103), limited to the PHI that IntelaMetrix creates, receives, maintains, or transmits on behalf of Covered Entity in connection with the Platform; "Required by Law" (45 C.F.R. § 164.103); "Secretary" means the Secretary of the U.S. Department of Health and Human Services; "Security Rule" means 45 C.F.R. Part 164, Subparts A and C; "Subcontractor" means any subprocessor engaged by IntelaMetrix that creates, receives, maintains, or transmits PHI on behalf of IntelaMetrix in connection with the Platform; "Unsecured PHI" (45 C.F.R. § 164.402).

D2. Permitted Uses and Disclosures of PHI

D2.1 Permitted Uses. IntelaMetrix may use PHI solely to the extent necessary to: provide, operate, support, maintain, and improve the Platform on behalf of Covered Entity; perform Data Aggregation services relating to the healthcare operations of Covered Entity, as permitted under 45 C.F.R. § 164.504(e)(2)(i)(B); carry out the legal responsibilities of IntelaMetrix as Business Associate under this Schedule D; and de-identify PHI in accordance with 45 C.F.R. § 164.514(b), after which the resulting data is no longer PHI and is subject to IntelaMetrix's data rights under Sections 4.3 and 5 of the Master EULA.

D2.2 Permitted Disclosures. IntelaMetrix may disclose PHI: to Subcontractors engaged in Platform delivery, subject to Section D5; as Required by Law; to the Secretary, for purposes of investigating or determining compliance with HIPAA; and as otherwise permitted or required under this Schedule D.

D2.3 Prohibited Uses and Disclosures. IntelaMetrix shall not use or disclose PHI in any manner that would violate HIPAA if done by Covered Entity, except to the extent that this Schedule D permits a use or disclosure that HIPAA allows for a Business Associate. IntelaMetrix shall not use or disclose PHI for any purpose not expressly authorized under this Schedule D, including for marketing purposes or in exchange for direct or indirect remuneration, without prior written authorization from Covered Entity.

D2.4 Minimum Necessary Standard. IntelaMetrix shall make reasonable efforts to use, disclose, and request only the Minimum Necessary PHI to accomplish the intended purpose of each use, disclosure, or request. Customer, as the Covered Entity and data controller for End User data, is responsible for ensuring that the scope of PHI submitted to the Platform is consistent with the Minimum Necessary standard applicable to Customer's operations.

D3. Safeguards

D3.1 Administrative, Physical, and Technical Safeguards. IntelaMetrix shall implement and maintain commercially reasonable administrative, physical, and technical safeguards that protect the confidentiality, integrity, and availability of PHI and ePHI that IntelaMetrix creates, receives, maintains, or transmits on behalf of Covered Entity, consistent with the requirements of the Security Rule at 45 C.F.R. §§ 164.308, 164.310, and 164.312.

D3.2 Policies and Procedures. IntelaMetrix shall maintain written policies and procedures governing its use and disclosure of PHI under this Schedule D, consistent with the requirements of 45 C.F.R. § 164.316, and shall make such policies available to the Secretary upon request as required by law.

D4. Breach Notification

D4.1 Discovery and Notification. IntelaMetrix shall notify Covered Entity without unreasonable delay and in no case later than thirty (30) calendar days after IntelaMetrix discovers a Breach of Unsecured PHI, as required under 45 C.F.R. § 164.410. A Breach is deemed discovered on the first day on which any employee, officer, or agent of IntelaMetrix, other than the individual committing the Breach, knows or reasonably should have known of the Breach.

D4.2 Notice Content. Breach notification shall include, to the extent available at the time of notification: identification of each individual whose Unsecured PHI has been, or is reasonably believed to have been, accessed, acquired, used, or disclosed; a brief description of the Breach, including the date of the Breach and the date of discovery; a description of the types of Unsecured PHI involved; the steps IntelaMetrix has taken or is taking to investigate, mitigate, and prevent further occurrences; and contact information for IntelaMetrix's designated privacy contact. IntelaMetrix shall supplement the initial notification with additional information as it becomes available.

D4.3 Security Incidents. IntelaMetrix shall report to Covered Entity any Security Incident of which IntelaMetrix becomes aware, as required under 45 C.F.R. § 164.314(a)(2)(i)(C). Unsuccessful Security Incidents (such as routine pings, port scans, and unsuccessful login attempts) are deemed reported on an ongoing basis through IntelaMetrix's standard security monitoring practices, without separate individual notification.

D5. Subcontractors

IntelaMetrix shall ensure that any Subcontractor that creates, receives, maintains, or transmits PHI on behalf of IntelaMetrix agrees to the same restrictions, conditions, and requirements that apply to IntelaMetrix under this Schedule D, by written agreement consistent with 45 C.F.R. § 164.504(e)(2)(ii)(D). IntelaMetrix shall remain responsible for its Subcontractors' compliance with this Schedule D to the extent within IntelaMetrix's reasonable control.

D6. Individual Rights

D6.1 Access to PHI. Upon request from Covered Entity, IntelaMetrix shall make available to Covered Entity PHI maintained by IntelaMetrix in a Designated Record Set, to the extent necessary for Covered Entity to fulfill its obligations under 45 C.F.R. § 164.524, within thirty (30) calendar days of the request.

D6.2 Amendment of PHI. Upon request from Covered Entity, IntelaMetrix shall make available PHI maintained in a Designated Record Set for amendment and shall incorporate any amendments directed by Covered Entity, consistent with 45 C.F.R. § 164.526.

D6.3 Accounting of Disclosures. IntelaMetrix shall maintain a record of disclosures of PHI made by IntelaMetrix that are required to be included in an accounting of disclosures under 45 C.F.R. § 164.528, and shall make such records available to Covered Entity within thirty (30) calendar days of a written request to support Covered Entity's compliance with that section.

D6.4 Access for HHS. IntelaMetrix shall make its internal practices, books, and records relating to the use and disclosure of PHI available to the Secretary for purposes of determining IntelaMetrix's compliance with HIPAA, as required under 45 C.F.R. § 164.504(e)(2)(ii)(H).

D7. Covered Entity Obligations

Covered Entity represents, warrants, and agrees that:

Covered Entity has obtained and will maintain all required authorizations, consents, and notices necessary to permit IntelaMetrix to use and disclose PHI as contemplated by this Schedule D and the Master EULA
Covered Entity will notify IntelaMetrix of any restriction on the use or disclosure of PHI that Covered Entity has agreed to with an individual, to the extent such restriction affects IntelaMetrix's use or disclosure of that PHI
Covered Entity will not request that IntelaMetrix use or disclose PHI in any manner that would violate HIPAA
Covered Entity is solely responsible for ensuring that its use of the Platform complies with all applicable professional, clinical, and regulatory standards governing Covered Entity's field of practice
Covered Entity will promptly notify IntelaMetrix if Covered Entity becomes aware of any pattern of activity or practice of IntelaMetrix that constitutes a material breach of this Schedule D

D8. Term and Termination

D8.1 Term. This Schedule D is effective upon the activation of the Platform by a Customer who self-identifies as a Covered Entity or Business Associate under HIPAA pursuant to Section 1.2 of this Agreement, and continues for the duration of the Subscription Term under the Master EULA, unless earlier terminated under this Section D8.

D8.2 Termination for Cause. Either party may terminate this Schedule D, and the Master EULA, upon written notice if the other party has materially breached this Schedule D and failed to cure the breach within thirty (30) calendar days of written notice specifying the nature of the breach.

D8.3 Effect of Termination — Return or Destruction of PHI. Upon termination or expiration of the Master EULA, IntelaMetrix shall, to the extent feasible, return or destroy all PHI received from, or created or received by IntelaMetrix on behalf of, Covered Entity that IntelaMetrix still maintains in any form, and shall retain no copies, consistent with 45 C.F.R. § 164.504(e)(2)(ii)(J). If return or destruction is not feasible, IntelaMetrix shall notify Covered Entity of the conditions that make return or destruction infeasible and shall extend the protections of this Schedule D to such PHI and limit further uses and disclosures to those purposes that make return or destruction infeasible, for as long as IntelaMetrix retains such PHI.

D8.4 Survival. Sections D2.3, D3, D4, D6.4, D8.3, and D9 survive termination or expiration of this Schedule D.

D9. Relationship to Master EULA

D9.1 Precedence. In the event of a conflict between this Schedule D and any other provision of the Master EULA with respect to the use or disclosure of PHI or the rights and obligations of the parties under HIPAA, this Schedule D controls.

D9.2 AI/ML and De-Identified Data. This Schedule D does not restrict IntelaMetrix's rights under Sections 4.3 and 5 of the Master EULA with respect to data that has been de-identified in accordance with 45 C.F.R. § 164.514(b). Once PHI has been validly de-identified, it is no longer PHI and is subject to IntelaMetrix's full data and AI/ML rights under the Master EULA without restriction.

D9.3 No Limitation on Liability Cap. Nothing in this Schedule D expands IntelaMetrix's aggregate liability beyond the cap set forth in Section 12.2 of the Master EULA, except to the extent that applicable law prohibits such limitation with respect to HIPAA violations enforced by the U.S. Department of Health and Human Services.

D9.4 Amendment. IntelaMetrix may amend this Schedule D to comply with changes in HIPAA, the HITECH Act, or implementing regulations by providing Covered Entity with thirty (30) days written notice. Continued use of the Platform following the notice period constitutes acceptance of the amended Schedule D.

Contact

IntelaMetrix Holdings, Inc.
2010 Elkins Way, Suite 2, Brentwood, CA 94513
legal@BodyMetrix.com
916-840-0096

EULA & Warranty