TERMS OF USE

Effective Date: October 1, 2026

Last Updated: September 17, 2026

PLEASE READ THESE TERMS OF USE CAREFULLY.

These Terms of Use (these “Terms”) are a binding agreement between you (“Customer,” “you,” or “your”) and Aesto, LLC dba Aesto Health and its affiliates (“Aesto Health,” “we,” “us,” or “our”) governing your access to and use of the Aesto Health platform, applications, websites, and related services (collectively, the “Services”). By creating or accessing an account, or otherwise accessing or using the Services, you acknowledge that you have read, understand, and agree to be bound by these Terms and by our Privacy Policy. If you do not agree to these Terms, you must not access or use the Services.

If these Terms conflict with a separately executed order form, master subscription agreement, statement of work, or Business Associate Agreement between Customer and Aesto Health (collectively, “Order Documents”), the Order Documents control as to their specific subject matter, and these Terms control as to all other matters.

1. Definitions; Interpretation

The following capitalized terms have the meanings set out below wherever used in these Terms. Terms not defined here have the meanings given in the applicable Order Documents.

“Access” or “Accessing” means to create, collect, receive, view, use, process, store, retrieve, transmit, disclose, or otherwise interact with data or systems through the Services.

“Applicable Law(s)” means all privacy, data security, and data protection laws, directives, regulations, and rules applicable to the Services, including, without limitation, the Health Insurance Portability and Accountability Act of 1996 and its implementing regulations (“HIPAA”), the California Consumer Privacy Act of 2018 as amended (“CCPA”), and other applicable U.S. state and federal privacy laws, each as amended from time to time.

“Authorized User” means an employee, contractor, or other individual whom Customer has authorized to access the Services on the Customer’s behalf and for whom Customer has obtained or activated a user account.

“Customer Data” means any data, content, or information that Customer or an Authorized User submits to, or that is generated within, the Services, including Personal Information and, where applicable, Protected Health Information.

“Order Documents” refers to the separately executed order form, master subscription agreement, statement of work, or Business Associate Agreement between Customer and Aesto Health. “Personal Information” means any information relating to an identified or identifiable natural person, including names, contact details, government identification numbers, financial account information, biometric information, IP addresses, device identifiers, and geolocation information, and any other information deemed “personal information” or “personal data” under Applicable Law.

“Protected Health Information” or “PHI” has the meaning given under HIPAA.

“Security Incident” means an actual or reasonably suspected unauthorized Access to, or loss, disclosure, alteration, or destruction of, Customer Data within Aesto Health’s custody or control.

“Services” means the Aesto Health software platform, applications, websites, APIs, and related support services made available to Customer, as further described in Section 2 and the applicable Order Documents.

“Includes” or “Including” means “including, without limitation.”

Any examples used in these Terms are illustrative and not the sole examples of a particular concept. Section headings are for convenience only and do not affect interpretation.

2. Description of the Services

Aesto Health is a data lifecycle management (DLM) vendor that provides a SaaS platform to transform, archive, and access HIPAA-compliant data from disparate healthcare IT systems.  The specific modules, features, service tier, and any professional or technical services purchased by Customer will be identified in the applicable Order Documents, which are incorporated into these Terms by reference.

Aesto Health may update, enhance, or modify features of the Services from time to time to improve functionality, security, or performance, provided that any such change will not materially reduce the core functionality for which Customer has paid during the then-current subscription term.

3. Eligibility, Account Registration, and Access Authorization

3.1 Eligibility. You must be at least 18 years old and have the legal capacity to enter into these Terms to create an account or use the Services.

3.2 Account Registration. The customer will designate one or more account administrators who may create, modify, and deactivate accounts for Authorized Users. Customer is responsible for ensuring that only individuals with a legitimate business or clinical need are granted Authorized User accounts, and for promptly deactivating accounts for individuals who no longer require access, including upon termination of employment or change in role.

3.3 Credentials. Each Authorized User must maintain unique login credentials and must not share credentials with any other person. Customer is responsible for all activity occurring under its Authorized Users’ accounts and must promptly notify Aesto Health at privacy@aestohealth.com of any known or suspected unauthorized use of an account or credential.

3.4 Permitted Access Methods. The Services may be accessed only through the interfaces, application programming interfaces, and authentication methods that Aesto Health makes available for that purpose (e.g., single sign-on, multi-factor authentication, or API keys issued by Aesto Health). Customer will not attempt to access the Services through any undocumented, unauthorized, or circumvented method, and will safeguard all unique identifiers, tokens, and API keys issued to it as Confidential Information.

3.5 All Unauthorized Access Is Forbidden. Access to the Services is limited strictly to Authorized Users acting within the scope of authorization granted by Customer and Aesto Health. Any Access to, or use of, the Services that has not been expressly authorized under these Terms or the Order Documents is prohibited, regardless of whether such Access was technically possible.

4. Aesto Health’s Right to Monitor, Suspend, and Revoke Access

Aesto Health reserves the right, at its discretion and without liability to Customer, to: (a) monitor use of the Services for compliance with these Terms, security, and quality-assurance purposes; (b) log and review Access to the Services, including login activity, administrative actions, and data queries; (c) immediately suspend or restrict any Authorized User’s or Customer’s Access to the Services if Aesto Health reasonably believes such Access poses a security risk, violates these Terms or Applicable Law, or is being used in a manner that could harm Aesto Health, other customers, or third parties; and (d) revoke or terminate Access as described in Section 15 (Term; Suspension; Termination). Where reasonably practicable and not otherwise prohibited by Applicable Law or an active security investigation, Aesto Health will provide Customer with notice of any suspension and the reason for it.

5. Permitted Use; Restrictions on Copying and Disclosure

5.1 License Grant. Subject to these Terms and full payment of applicable fees, Aesto Health grants Customer a limited, non-exclusive, non-transferable, non-sublicensable right to access and use the Services during the subscription term solely for Customer’s internal business operations, in accordance with the applicable Order Documents and any user documentation Aesto Health provides.

5.2 Restrictions. Customer will not, and will not permit any Authorized User or third party to:

• copy, reproduce, distribute, sell, resell, lease, sublicense, or otherwise make the Services available to any third party outside of Customer’s own organization, except as expressly permitted under the Order Documents;
• disclose Customer Data obtained through the Services to any unauthorized person, or use such data for any purpose other than the Customer’s permitted use of the Services;
• reverse engineer, decompile, or attempt to derive the source code of the Services, except to the extent such restriction is prohibited by Applicable Law;
• use the Services to develop a competing product or service, or use automated means (bots, scrapers) to access the Services except through supported APIs;
• remove, alter, or obscure any proprietary notices on or within the Services; or
• introduce viruses, malware, or other harmful code into the Services, or attempt to probe, scan, or test the vulnerability of the Services except through a coordinated security assessment approved in writing by Aesto Health under Section 9.4.

6. Customer Data; Data Integrity

6.1 Ownership. As between the parties, Customer retains all right, title, and interest in and to Customer Data. Aesto Health will Access and use Customer Data solely to provide, support, and improve the Services, to comply with Applicable Law, and as otherwise instructed by Customer or permitted under the applicable Business Associate Agreement.

6.2 Accuracy and Integrity. Aesto Health maintains reasonable technical controls, including checksums, access logging, versioning, and audit trails where applicable, designed to preserve the accuracy, consistency, and completeness of Customer Data for the period it resides within the Services. Customer remains responsible for the accuracy of Customer Data submitted to the Services and for maintaining independent backups of any data critical to its operations.

6.3 Reporting Inaccuracies. If either party becomes aware of a material inaccuracy, corruption, or integrity issue affecting Customer Data within the Services, that party will notify the other promptly (and, for issues identified by Aesto Health, no later than the timeframes described in Section 9) and the parties will cooperate in good faith to investigate and correct the issue.

7. Security Safeguards; Protection of Assets

Aesto Health maintains a written information security program with administrative, technical, and physical safeguards designed to protect the confidentiality, integrity, and availability of Customer Data, consistent with industry standards (including, as applicable, HITRUST CSF) and Applicable Law. These safeguards include, without limitation:

• Physical and environmental controls over the data centers and cloud infrastructure hosting the Services;
• Access controls and authentication requirements (including role-based access and, where applicable, multi-factor authentication) governing Aesto Health personnel and system access to Customer Data;
• Background screening of Aesto Health personnel with Access to Customer Data, consistent with Applicable Law;
• Logging and monitoring of Access to systems containing Customer Data, with applicable log retention
• Malware and endpoint protection controls across networks, systems, and devices used to provide the Services;
• A patch- and vulnerability-management program, including prompt application of critical security patches; and
• Encryption of Customer Data in transit and at rest using industry-standard methods.

Aesto Health will not materially diminish these safeguards during Customer’s subscription term. Additional detail regarding Aesto Health’s security program is available upon request and, where applicable, in Aesto Health’s completed security questionnaires, SOC 2 report, or HITRUST certification.

8. Security Assessments

Upon reasonable prior written request, and no more than once per twelve (12)-month period (or following a material change to the Services or a Security Incident), Aesto Health will provide Customer with reasonably requested information regarding its security and privacy practices, which may include a current SOC 2 report, HITRUST validated assessment or certification, or completed security questionnaire, subject to confidentiality obligations no less protective than those in these Terms. All information can be requested via our trust center at https//trust.aestohealth.com.  Aesto Health does not permit Customer or third parties to perform unannounced or unauthorized penetration testing against the Services; any such testing must be requested in advance and approved in writing by Aesto Health under Section 9.4.

9. Security Incident Detection, Reporting, Notification, and Investigation

9.1 Detection. Aesto Health maintains monitoring and detection controls designed to identify anomalous Access to, or use of, Customer Data within the Services, and maintains an incident response program that meets or exceeds prevailing industry standards for the healthcare technology sector.

9.2 Notification to Customer. If Aesto Health determines that a Security Incident has occurred, Aesto Health will notify the affected Customer without unreasonable delay and, in any event, within the timeframe required under the applicable Business Associate Agreement or Applicable Law (and in no event later than 60 days after confirming the impacted Customers and data), providing a description of the nature of the incident and the Customer Data reasonably believed to be affected, to the extent known at the time of notice.

9.3 Investigation and Remediation. Following a Security Incident, Aesto Health will promptly investigate the incident, take reasonable steps to contain and remediate it, and provide the Customer with updates as material new information becomes available. Aesto Health will reasonably cooperate with Customer’s own investigation and, where legally required, with notifications to regulators, provided that Customer remains responsible for determining impacted patients and whether and how it will notify its own patients, members, or regulators, except where Applicable Law assigns that obligation to Aesto Health directly.

9.4 Reporting Channel. Customers should report suspected Security Incidents, inaccuracies, or other security concerns to privacy@aestohealth.com, which is monitored twenty-four (24) hours a day, seven (7) days a week.

10. Reasons for Access; Use Limitation

Customer and its Authorized Users are granted Access to the Services in order to obtain the operational, clinical, administrative, or analytical benefits described in the applicable Order Documents (for example, legacy records archiving, release of information, patient pay balances). Access is granted solely for those purposes and solely for the duration of the Customer’s active subscription.

11. Intellectual Property Rights

11.1 Aesto Health IP. Aesto Health and its licensors retain all right, title, and interest in and to the Services, including all software, algorithms, user interfaces, documentation, and all intellectual property rights therein. No rights are granted to Customer except the limited access rights expressly set out in Section 5.

11.2 Customer IP. Customer retains all right, title, and interest in Customer Data and any trademarks, logos, or content it provides to Aesto Health, subject to the license Customer grants Aesto Health to Access and use Customer Data solely to provide the Services.

11.3 Feedback. If Customer provides suggestions or feedback regarding the Services, Aesto Health may use that feedback without restriction or obligation to Customer, provided that Aesto Health will not publicly attribute the feedback to Customer without consent.

12. Confidentiality

Each party may receive information from the other that is marked confidential, or that a reasonable person would understand to be confidential given the nature of the information and circumstances of disclosure (“Confidential Information”). Each party will use the other party’s Confidential Information solely to perform its obligations or exercise its rights under these Terms, will protect it using at least the same degree of care it uses to protect its own confidential information (and no less than a reasonable degree of care), and will not disclose it to third parties except to personnel, contractors, or advisors with a need to know and who are bound by confidentiality obligations at least as protective as those in this Section. This Section does not restrict disclosures required by Applicable Law, provided the disclosing party gives the other party reasonable advance notice where legally permitted.

13. HIPAA and Protected Health Information

The parties will execute a Business Associate Agreement (“BAA”) governing Aesto Health’s use and disclosure of PHI, which is incorporated into and forms part of these Terms with respect to PHI. In the event of a conflict between these Terms and the BAA regarding the treatment of PHI, the BAA controls. Customer represents that it has, and will maintain, all rights, consents, and authorizations necessary to submit PHI and other Personal Information to the Services in compliance with Applicable Law.

14. Fees and Payment

Fees for the Services, billing frequency, and payment terms are set out in the applicable Order Documents. Except as expressly stated in the Order Documents, fees are non-refundable. Aesto Health may suspend Access to the Services for contractual amounts that remain unpaid for more than [30] days after the due date, upon prior written notice to the Customer.

15. Term; Suspension; Termination

15.1 Term. These Terms remain in effect for as long as Customer maintains an active subscription to the Services or otherwise accesses the Services, and will survive with respect to any obligations that by their nature should survive (including Sections 6, 12, 13, 17, 18, 19, and 20).

15.2 Suspension. In addition to the rights described in Section 4, Aesto Health may suspend Customer’s or an Authorized User’s Access if Aesto Health reasonably believes Customer has materially breached these Terms, poses a security or legal risk, or has failed to pay contractual fees when due, in each case with notice to Customer where reasonably practicable.

15.3 Termination. Either party may terminate these Terms and the applicable Order Documents for the other party’s uncured material breach following thirty (30) days’ written notice describing the breach, or immediately if the other party becomes insolvent. Aesto Health may also terminate or decline to renew Customer’s subscription as permitted under the applicable Order Documents.

16. Data Return and Destruction

Upon Customer’s written request made within thirty (30) days after termination or expiration of Customer’s subscription, Aesto Health will make available to Customer, in a commercially reasonable format, an export of Customer Data then held within the Services, as long as Customer is current on contractual payments owed.  Except as required for a limited transition period, backups, or audit, legal, or regulatory purposes, Aesto Health will delete or de-identify remaining Customer Data within a commercially reasonable period after the request period lapses, consistent with the applicable Business Associate Agreement, Applicable Law and Aesto Health Data Retention policies. If Applicable Law requires Aesto Health to retain Customer Data beyond that period, Aesto Health will notify Customer of the retention requirement and applicable timeline, and will limit any further use of the retained data to the purpose of that retention requirement.

17. Warranties and Disclaimers

17.1 Mutual Warranties. Each party represents that it has the authority to enter into these Terms and that its performance will comply with Applicable Law.

17.2 Disclaimer. EXCEPT AS EXPRESSLY STATED IN THESE TERMS OR THE ORDER DOCUMENTS, THE SERVICES ARE PROVIDED “AS IS,” AND AESTO HEALTH DISCLAIMS ALL OTHER WARRANTIES, WHETHER EXPRESS, IMPLIED, OR STATUTORY, INCLUDING WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, AND NON-INFRINGEMENT. THE SERVICES ARE NOT INTENDED TO REPLACE PROFESSIONAL CLINICAL JUDGMENT, AND AESTO HEALTH DOES NOT WARRANT THAT THE SERVICES WILL BE UNINTERRUPTED OR ERROR-FREE.

18. Subcontractors and Third-Party Service Providers

Aesto Health may engage third-party subcontractors, vendors, or service providers (“Subcontractors”) to perform certain functions in connection with the Services, including hosting, storage, customer support, and analytics. Before granting a Subcontractor access to Customer Data or Protected Information, Aesto Health will: (a) conduct appropriate due diligence on the Subcontractor’s information security and privacy practices; (b) enter into a written agreement with the Subcontractor imposing confidentiality, data protection, and security obligations materially consistent with those set forth in these Terms, and, where the Subcontractor will access PHI, a business associate agreement consistent with HIPAA; and (c) remain responsible for the Subcontractor’s acts and omissions in connection with the Services to the same extent Aesto Health would be responsible if performing the services itself. Aesto Health will maintain a list of Subcontractors that access Customer Data.

19. Legal Responsibilities; Compliance with Applicable Law

Each party is responsible for complying with Applicable Law in connection with its own performance under these Terms. Customer is responsible for determining that its intended use of the Services is appropriate for, and permitted under, Applicable Law governing its own industry and jurisdiction, including obtaining any patient or member consents required for Customer to submit Personal Information or PHI to the Services. Aesto Health is responsible for maintaining the safeguards described in Section 7 and for complying with Applicable Law in its role in providing the Services.

20. Governing Law; Dispute Resolution

These Terms are governed by the laws of the State of DE and controlling United States federal law, without regard to conflict-of-laws principles. Any dispute arising out of or relating to these Terms that the parties cannot resolve informally within thirty (30) days will be resolved in the state or federal courts located in Birmingham, AL, and each party consents to the exclusive jurisdiction and venue of such forum. Each party waives any right to a jury trial in connection with any action or litigation arising out of or related to these Terms.

21. General Provisions

21.1 Entire Agreement. These Terms, together with the Order Documents, the Privacy Policy, and any Business Associate Agreement, constitute the entire agreement between the parties regarding the Services and supersede all prior or contemporaneous agreements on that subject.

21.2 Questions. Questions about these Terms may be directed to legal@aestohealth.com.