Hosting Master Service Agreement

This Master Service Agreement is between PATIENT DATA PROTECTION, LLC, a Florida limited liability company (“PATIENT DATA PROTECTION, LLC”), and the organization or individual whose name appears on the signature line of the Service Agreement or on any document that incorporates this Master Service Agreement by reference (“Client”). This Master Service Agreement is effective on the Effective Date.

Defined Terms. Capitalized terms have the following meanings or the meanings assigned to them elsewhere in the Agreement:

“Agreement” means the Client’s personalized Service Agreement, any written addendum accepted by both parties, this Master Service Agreement, and the Acceptable Use Policy (“AUP”), collectively. Unless a document expressly states otherwise, conflicts shall be resolved in the following order of precedence: the applicable written addendum, the personalized Service Agreement, this Master Service Agreement, and the AUP. Any applicable Business Associate Agreement (“BAA”) shall control over conflicting provisions concerning protected health information.

“Service Agreement” means the personalized Patient Data Protection HIPAA Service Agreement or other written service order accepted by Client and PATIENT DATA PROTECTION, LLC, identifying the Services, Fees, and any additional terms applicable to Client.

“AUP” means PATIENT DATA PROTECTION, LLC’s Acceptable Use Policy, as stated below and as updated in accordance with this paragraph.

Services may be used only for lawful purposes consistent with the healthcare-related business identified in the Service Agreement. Client may not change the primary industry or business purpose of its hosted website or advertising to an unrelated industry without PATIENT DATA PROTECTION, LLC’s prior written consent.

PATIENT DATA PROTECTION, LLC may update the AUP by providing Client with at least thirty (30) days’ written notice. Changes reasonably necessary to address legal requirements or urgent security threats may take effect sooner, with notice as soon as reasonably practicable. An AUP update does not change the agreed service term, Fees, or payment obligations.

“Business Day” means Monday through Friday, 8:00 a.m. to 5:00 p.m., Eastern Time, excluding United States federal holidays.

“Effective Date” means the effective date stated in the Service Agreement or, if none is stated, the date Client accepts the Agreement by signing it or by another documented method of acceptance. Use of the Services constitutes acceptance only if the Agreement has been provided or made available to Client before such use.

“Service Commencement Date” means the commencement date stated in the Service Agreement or, if none is stated, the date PATIENT DATA PROTECTION, LLC first makes the contracted Services available to Client, including publishing Client’s website, installing accessibility software, or activating hosting, email, or other contracted Services.

“Service” or “Services” means the hosting services and any additional or supplemental services provided by PATIENT DATA PROTECTION, LLC to Client under the Agreement.

Term and Cancellation.

Initial Six-Month Commitment. Unless the personalized Service Agreement expressly provides otherwise, the initial service term begins on the Service Commencement Date and continues for six (6) months (“Initial Term”). Client commits to the full Initial Term and remains responsible for the agreed recurring Fees throughout that period.

Month-to-Month Renewal. After the Initial Term, the Services automatically continue on a month-to-month basis. Renewal does not create another six-month commitment.

Cancellation Notice. Either party may cancel the Services by providing at least thirty (30) days’ written notice to the other party at the contact email address designated in the Service Agreement or subsequently designated in writing. Ordinary cancellation cannot take effect before the Initial Term expires. After the Initial Term, cancellation takes effect at the end of the monthly service period in which the thirty-day notice period expires. Client remains responsible for Fees through the effective cancellation date.

Early Cancellation. If Client requests cancellation before the Initial Term expires, the request does not release Client from the recurring Fees payable for the remainder of the Initial Term. Unless otherwise agreed in writing, those Fees remain payable on their regular monthly due dates. This paragraph does not override an express right to terminate for PATIENT DATA PROTECTION, LLC’s uncured material breach, any applicable BAA provision, or a right or remedy that cannot lawfully be waived.

Any additional Service Agreement shall specify whether it establishes a separate Initial Term or changes the existing term. Purchasing an additional Service does not, by itself, restart the Initial Term for existing Services.

Payments.

(a) Agreement to Provide Services and Pay Fees; Fee Adjustments. PATIENT DATA PROTECTION, LLC agrees to provide the Services identified in the Service Agreement, and Client agrees to pay the corresponding fees (“Fees”).

Unless otherwise stated in the Service Agreement, PATIENT DATA PROTECTION, LLC may adjust recurring service Fees after the first twelve (12) months of service and no more than once in any subsequent twelve-month period. Such adjustments shall not exceed the percentage increase, if any, in the U.S. Consumer Price Index for All Urban Consumers (CPI-U), All Items, over the preceding twelve-month period, plus two percent (2%). PATIENT DATA PROTECTION, LLC shall provide at least thirty (30) days’ written notice before an adjustment takes effect.

Separately, third-party software license Fees may be adjusted to reflect documented increases charged by the software provider, including during the Initial Term, provided PATIENT DATA PROTECTION, LLC gives Client at least thirty (30) days’ written notice before the adjustment takes effect.

Client may purchase additional Services on terms and at prices agreed upon in writing before those Services are provided.

(b) Payment of Fees; Due Date; Late Charge; Default Interest. Client agrees to pay the monthly, setup, and other Fees stated in the Service Agreement, together with charges for any additional Services authorized by Client.

PATIENT DATA PROTECTION, LLC may require payment in full of its first invoice before beginning the Services. Unless otherwise stated in the Service Agreement, recurring monthly Fees are due in advance on the first (1st) day of each month (“Due Date”). The Service Agreement shall specify any prorated charge for a partial first month.

Payments shall be made in United States dollars and in cleared funds, without offset, deduction, or credit except for credits approved by PATIENT DATA PROTECTION, LLC or otherwise required by the Agreement or applicable law.

If Fees are not paid by the Due Date, PATIENT DATA PROTECTION, LLC may assess a one-time administrative late charge equal to five percent (5%) of the overdue Fees, to the extent permitted by applicable law. The late charge shall not be assessed repeatedly on the same overdue Fees.

PATIENT DATA PROTECTION, LLC may also charge simple interest on overdue Fees at the lesser of one and one-half percent (1.5%) per month or the maximum rate permitted by applicable law, until paid. Interest shall not be compounded. Any late charges and interest shall be reduced or waived to the extent necessary to comply with applicable law.

To the extent permitted by applicable law, Client shall reimburse PATIENT DATA PROTECTION, LLC for reasonable collection costs, including reasonable attorneys’ fees and court costs incurred in collecting amounts properly due under the Agreement. Obligations to pay accrued Fees, lawful late charges, interest, and collection costs survive expiration or termination of the Agreement.

If Client requests Services not included in the Service Agreement, the scope and applicable charges must be agreed upon in writing before those Services are provided. Unless otherwise agreed in writing, invoices for authorized supplemental Services, excess data transfer, reinstatement, switching, upgrades, and other nonrecurring charges are due upon receipt.

Client is responsible for excess data transfer charges only to the extent the applicable rates and Client’s responsibility for those charges are disclosed in the Service Agreement. Any charges arising from a denial-of-service or other attack are subject to those agreed terms.

Credits due under the Agreement may be applied to the invoice for the month in which the relevant event occurred or to the following month’s invoice. If no further invoice will be issued, any remaining credit shall be refunded or applied against outstanding amounts due, as appropriate.

Subject to applicable law, any applicable BAA, and any notice requirements elsewhere in the Agreement, PATIENT DATA PROTECTION, LLC may suspend Services if payment is overdue. A reinstatement Fee of seventy-five dollars ($75.00) may be assessed following a suspension for nonpayment and must be paid with the overdue amounts before the account is reinstated. Suspension for nonpayment does not, by itself, release Client from Fees payable during the Initial Term.

Client shall notify PATIENT DATA PROTECTION, LLC in writing of any invoice dispute within sixty (60) days after the invoice Due Date and identify the disputed amount and reason. Client shall timely pay undisputed amounts. This provision does not waive rights that cannot lawfully be waived.

(n) Entire Agreement. The personalized Service Agreement, this Master Service Agreement, the AUP, and any written addendum accepted by both parties are incorporated by reference and collectively constitute the Agreement. Any applicable BAA is incorporated with respect to the Services involving protected health information. The Agreement constitutes the complete and exclusive agreement between the parties regarding its subject matter and supersedes and replaces any prior agreement, understanding, or communication, written or oral, regarding that subject matter.

Unless the personalized Service Agreement expressly states otherwise, Client commits to an initial six-month service term, followed by month-to-month service subject to thirty (30) days’ written cancellation notice as described above.

Revised: 09/30/26