Data Handling and AI Schedule

Version 1.1 · Form of agreement — incorporated by reference into the Master Subscription Agreement

This Data Handling and Artificial Intelligence Schedule (this "Schedule") is entered into as of the effective date identified in the applicable Order Form or Master Subscription Agreement (the "Effective Date") by and between the customer identified in the applicable Order Form ("Customer") and Flow EHR, Inc., doing business as FlowEHR ("FlowEHR").

This Schedule is incorporated into, and forms part of, the Master Subscription Agreement between the Parties (the "MSA"), together with any applicable Order Form and Business Associate Agreement ("BAA"). Capitalized terms not defined in this Schedule have the meanings given in the MSA or BAA, as applicable.

1. Purpose and Scope

1.1 Purpose

This Schedule describes how FlowEHR handles Customer Data in connection with the Services, including ambient documentation, transcription, artificial-intelligence functionality, automation, analytics, integrations, and related support and security operations.

1.2 Scope

This Schedule applies only to the Services identified in an applicable Order Form and only to the Customer Data processed through those Services. It does not expand the Services, subscription quantities, support obligations, service levels, or fees stated in the applicable Order Form.

1.3 Relationship to Other Agreements

The MSA governs the commercial relationship, including subscription terms, intellectual property, fees, warranties, indemnification, and limitations of liability. The BAA governs PHI and HIPAA obligations. This Schedule governs the data-handling and AI operational details described below.

In the event of a conflict: (a) the BAA controls solely with respect to PHI and HIPAA obligations; (b) an Order Form controls solely to the extent it expressly identifies a provision of this Schedule that it overrides; (c) this Schedule controls with respect to data handling and AI operational details; and (d) the MSA controls in all other respects.

2. Definitions

For purposes of this Schedule:

• "AI Feature" means a Service feature that uses artificial intelligence, machine learning, natural-language processing, speech recognition, transcription, automation, predictive processing, or similar technology to generate, summarize, transcribe, structure, classify, analyze, or otherwise process information.
• "Ambient Documentation" means a Service feature that captures or processes an encounter conversation or other audio input to generate a transcript, draft note, summary, structured data, or related output.
• "Customer Data" has the meaning set forth in the MSA and includes data submitted to, transmitted through, or made available to the Services by or on behalf of Customer.
• "De-Identified Data" means information derived from Customer Data that has been de-identified in accordance with 45 C.F.R. § 164.514(a)–(b), or another applicable de-identification standard expressly agreed by the Parties in writing.
• "Encounter Audio" means audio captured, uploaded, transmitted, or otherwise processed through Ambient Documentation or another AI Feature.
• "Generated Output" means a transcript, draft note, summary, coding suggestion, clinical-support content, structured data, workflow recommendation, communication draft, or other output generated through an AI Feature.
• "Human Review" means review and approval by an appropriately qualified and authorized individual before the applicable Generated Output is used, relied upon, placed in a patient record, submitted for billing, communicated externally, or used to make a clinical, coding, treatment, prescribing, or other material decision.
• "Model Development" means the training, fine-tuning, evaluation, validation, benchmarking, testing, or improvement of machine-learning or artificial-intelligence models, whether proprietary to FlowEHR or made available by a third party for FlowEHR's use.
• "Model Development Setting" means the data-use election selected in an applicable Order Form or Section 8 of this Schedule.
• "Subprocessor" means a FlowEHR affiliate or third party that processes Customer Data to provide, support, secure, or improve the Services, including cloud infrastructure, speech-recognition, AI-model, communications, analytics, interoperability, security, and support providers.
• "Usage Data" has the meaning given in the MSA (Standard Terms Section 13.32, as modified by MSA Modification 4.3). Usage Data is not Customer Data.

3. Data Categories and Processing

3.1 Categories of Customer Data

Depending on the Services purchased and Customer's configuration, FlowEHR may process the following categories of Customer Data:

• Patient demographic and contact information
• Clinical documentation, clinical histories, encounter information, diagnoses, medications, orders, results, and care plans
• Encounter Audio, transcripts, draft notes, final notes, summaries, and other Ambient Documentation artifacts
• Appointment, scheduling, communication, billing, coding, payment, and operational data
• Provider, workforce, user, credentialing, and account-administration information
• Integration, interoperability, and API data, including data exchanged through connected EHRs, FHIR APIs, laboratories, pharmacies, communication services, payment services, and other Customer-authorized Third-Party Services
• Configuration data, workflow rules, templates, preferences, and business rules supplied by Customer
• Technical, device, access, security, and audit data generated through use of the Services, to the extent it is not Usage Data

3.2 Processing Purposes

FlowEHR may process Customer Data only as necessary to:

• (a) provide, operate, configure, host, support, maintain, and secure the Services for Customer, and improve the Services only by using De-Identified Data and Usage Data as permitted in Section 6;
• (b) provide Ambient Documentation, transcription, summaries, workflow automation, interoperability, analytics, communications, and other features ordered or enabled by Customer;
• (c) respond to Customer support requests and investigate suspected misuse, fraud, errors, security events, or service-performance issues;
• (d) comply with applicable law, the MSA, the BAA, and Customer's documented instructions consistent with the Services; and
• (e) create and use De-Identified Data and Usage Data as permitted by the MSA and this Schedule.

3.3 Customer Instructions

Customer instructs FlowEHR to process Customer Data for the purposes identified in this Schedule, the MSA, the BAA, the applicable Order Form, Customer's use and configuration of the Services, and Customer's documented support requests.

Customer is responsible for ensuring that its instructions are lawful and consistent with the MSA, BAA, applicable law, and the technical capabilities of the Services.

4. Ambient Documentation and Recordings

4.1 Customer Controls

Customer may turn Ambient Documentation on or off for its Authorized Users by written request to FlowEHR, as recorded in the applicable Order Form, and clinicians control its use in each encounter through the consent step in the Services. Customer may configure or request configuration changes to applicable retention and deletion settings through the Services' available administrative tools or by written request to FlowEHR.

4.2 Customer Consent and Notice Responsibilities

Customer is solely responsible for obtaining and maintaining all notices, consents, authorizations, permissions, and approvals required by applicable federal, state, local, professional, and payer requirements for the recording, processing, transcription, storage, and use of Encounter Audio and Generated Output.

Without limiting the foregoing, Customer is responsible for determining whether a jurisdiction requires one-party consent, all-party consent, written consent, specific patient notice, or other conditions before recording or processing an encounter.

4.3 Default Retention Settings

Unless otherwise stated in an applicable Order Form, Customer configuration, or written data-retention election:

The retention periods in this Section 4.3 are default commercial settings and may be modified by a Customer configuration, applicable Order Form, or written agreement signed by both Parties.

4.4 Deletion of Encounter Audio

FlowEHR does not store Encounter Audio under the current Services. If a Service later stores Encounter Audio, FlowEHR will give Customer notice before enabling it, and Customer may elect deletion of Encounter Audio following generation of the applicable transcript or draft note through available Service settings or by written request to FlowEHR. Upon deletion, FlowEHR will remove the Encounter Audio from active production systems within a commercially reasonable period, subject to ordinary backup rotation and legal retention requirements.

Deletion of Encounter Audio does not automatically delete an associated transcript, Generated Output, final note, audit record, support record, De-Identified Data, or information exported to a Customer System or Third-Party Service. Customer must separately configure or request deletion of those items where available.

4.5 No Emergency Recording Function

Ambient Documentation is not designed for emergency communications, emergency dispatch, clinical monitoring, or urgent patient response. Customer and Authorized Users must not rely on Ambient Documentation for emergency or time-critical care decisions.

5. Artificial Intelligence Features

5.1 Purpose and Limitations

AI Features may generate or assist with transcripts, draft notes, summaries, coding suggestions, structured data, workflow recommendations, clinical-support content, communication drafts, and other Generated Output.

Generated Output may be incomplete, inaccurate, outdated, biased, inappropriate for a particular patient or circumstance, or otherwise unsuitable for use without Human Review. AI Features do not independently diagnose, prescribe, direct treatment, replace professional judgment, or provide medical advice or emergency services.

5.2 Human Review and Customer Responsibility

Customer must ensure that Generated Output is subject to Human Review before it is used or relied upon for clinical care, treatment, diagnosis, prescribing, coding, billing, reimbursement, patient communication, legal documentation, or another material purpose.

Customer and its Authorized Users remain solely responsible for all clinical, coding, billing, compliance, operational, and professional decisions made through or in connection with the Services.

5.3 Generated Output and Medical Records

Generated Output is not automatically a final medical record. Customer determines whether, when, and how a Generated Output is approved, edited, incorporated into a medical record, transmitted to an EHR, or retained in accordance with Customer's policies and applicable law.

5.4 AI Feature Availability

FlowEHR may use different models, model providers, processing techniques, prompts, guardrails, or configurations to provide AI Features. FlowEHR may update or replace such components in accordance with the MSA, provided that FlowEHR will not materially diminish the core functionality of an AI Feature purchased by Customer during the applicable Subscription Term, subject to the MSA's modification provisions.

6. Data Use and Model Development

6.1 Identifiable Customer Data and PHI

FlowEHR will not use identifiable PHI to train or fine-tune generalized machine-learning or artificial-intelligence models except as expressly authorized in writing by Customer and permitted by applicable law and the BAA.

FlowEHR will not sell identifiable Customer Data or identifiable PHI.

6.2 De-Identified Data and Usage Data

Subject to the MSA, the BAA, this Schedule, and the applicable Model Development Setting, FlowEHR may create and use De-Identified Data and Usage Data to:

• (a) operate, maintain, secure, support, monitor, and improve the Services;
• (b) conduct quality assurance, reliability testing, incident analysis, fraud prevention, and performance analytics;
• (c) develop, test, evaluate, validate, improve, and monitor product features and AI Features;
• (d) generate aggregated benchmarks, analytics, and insights that do not identify Customer, an Authorized User, or an individual; and
• (e) perform other uses expressly permitted in the MSA or an applicable Order Form.

6.3 No Re-Identification

FlowEHR will not attempt to re-identify De-Identified Data. FlowEHR will contractually prohibit any recipient of De-Identified Data from attempting to re-identify it.

6.4 No Customer Identification in External Outputs

FlowEHR will not disclose De-Identified Data, Usage Data, benchmarks, analytics, publications, or external datasets in a manner that identifies Customer, an Authorized User, or an individual, except with Customer's prior written consent or as Required by Law.

6.5 Survival

The rights in this Section 6 survive termination or expiration of the MSA solely with respect to De-Identified Data and Usage Data created or collected before termination in accordance with the MSA, BAA, and this Schedule.

7. Security and Subprocessors

7.1 Safeguards

FlowEHR will maintain administrative, physical, and technical safeguards reasonably designed to protect the confidentiality, integrity, and availability of Customer Data, as described in the MSA and, where applicable, the BAA.

7.2 Encryption and Access Controls

FlowEHR will use encryption in transit and at rest for Customer Data, role-based access controls, authentication controls, audit logging, and other safeguards appropriate to the Services.

7.3 Subprocessors

FlowEHR may use Subprocessors to provide, support, secure, or improve the Services. FlowEHR will require Subprocessors that process Customer Data to be bound by appropriate written confidentiality, security, and data-protection obligations.

FlowEHR will maintain a current list of material Subprocessors that process Customer Data and provide notice of material additions in accordance with the MSA and BAA. Customer may object only on reasonable, documented privacy or security grounds, and the Parties will follow the MSA's Subprocessor objection process.

7.4 Processing Locations

FlowEHR stores Customer Data in the United States. Remote access to PHI from outside the United States is permitted only as described in the BAA. Subprocessors process Customer Data at the locations disclosed at flow-ehr.com/subprocessors, and FlowEHR will not engage a Subprocessor that stores PHI outside the United States.

Customer may request information regarding applicable processing locations or material Subprocessors in accordance with the security-documentation and Subprocessor provisions of the MSA and BAA.

7.5 Security Incidents

FlowEHR will notify Customer of Security Incidents and Breaches of Unsecured PHI in accordance with the MSA and, where applicable, the BAA. The BAA controls with respect to PHI and HIPAA incident-notification obligations.

8. Model Development Settings

8.1 Selection

Customer must select one Model Development Setting in the applicable Order Form, an order configuration, or a written election accepted by FlowEHR. If Customer does not make a selection, Standard Setting applies.

8.2 Scope of Restriction

An Enterprise Restricted Setting or Customer-Specific Setting applies prospectively from the effective date of the applicable election. It does not require FlowEHR to delete, unwind, retrain, or modify models, benchmarks, analytics, product improvements, or De-Identified Data created or used before the effective date of the election.

8.3 Transition Between Settings

Customer may request a change to its Model Development Setting by written notice. A change is effective only when acknowledged in writing by FlowEHR and may be subject to technical feasibility, pricing, implementation work, minimum-commitment terms, and an amended Order Form.

8.4 Customer-Specific Models

If the Parties agree in an Order Form to deploy a customer-specific, private, dedicated, or otherwise isolated model environment, the Order Form will state the applicable data-use limits, technical architecture, permitted model providers, retention settings, security controls, fees, implementation responsibilities, and termination/transition terms.

9. Data Export, Return, and Deletion

9.1 Export

Customer may export Customer Data in accordance with the MSA. Depending on the Services and available integrations, standard export formats may include CSV, JSON, PDF, structured documents, application-native export formats, or FHIR resources where expressly supported by the applicable Service or Order Form.

FlowEHR does not guarantee that every data element, third-party data source, Generated Output, or integration artifact will be available in every format. Custom mapping, migration, data transformation, interface development, bulk export, or transition assistance may be provided under a separate Order Form or Professional Services statement of work.

9.2 Post-Termination Access

Customer's post-termination data-export rights are governed by the MSA, including the applicable post-termination export period. Customer is responsible for requesting and completing its export before the end of that period.

9.3 Deletion

Following the applicable post-termination export period, FlowEHR may delete Customer Data, subject to the MSA, BAA, applicable law, ordinary backup retention, audit and security-log retention, and the retention of De-Identified Data and Usage Data as permitted under the MSA and this Schedule.

Upon reasonable written request, FlowEHR will provide Customer with a confirmation of deletion from active production systems, subject to the foregoing exceptions.

10. Customer Responsibilities

Customer will:

• (a) configure the Services and AI Features in accordance with Customer's own policies, clinical workflows, risk assessment, retention requirements, and legal obligations;
• (b) obtain and maintain all required notices, consents, authorizations, permissions, and approvals for Customer's use of the Services, including Ambient Documentation, Encounter Audio, transcription, AI Features, telehealth, patient communications, and Third-Party Services;
• (c) ensure that all Generated Output receives Human Review before use or reliance for a material purpose;
• (d) ensure that Authorized Users are appropriately trained, licensed, credentialed, supervised, and authorized to use the Services;
• (e) maintain the security of Customer Systems, credentials, and Customer-authorized Third-Party Services;
• (f) determine whether and how Generated Output becomes part of a medical record, billing record, patient communication, or other Customer record; and
• (g) not submit or instruct FlowEHR to process Customer Data in a manner that violates applicable law, the MSA, the BAA, or this Schedule.

11. General Provisions

11.1 No Medical Advice; No Regulatory Guarantee

Nothing in this Schedule changes the allocation of clinical responsibility, professional judgment, medical decision-making, coding, billing, reimbursement, compliance, or patient-consent obligations set forth in the MSA. FlowEHR does not represent that use of AI Features will ensure compliance with any law, professional standard, payer requirement, or certification program.

11.2 No New Warranty or SLA

This Schedule does not create a warranty, service-level agreement, uptime commitment, accuracy guarantee, or regulatory certification beyond the express commitments in the MSA, BAA, or applicable Order Form.

11.3 Changes to Schedule

FlowEHR may update this Schedule from time to time to reflect changes in the Services, security practices, Subprocessors, applicable law, or AI Features, provided that FlowEHR will not materially diminish Customer's protections under this Schedule during an applicable Subscription Term without Customer's consent, except where a change is required by law, necessary to address a material security risk, or reasonably necessary due to a Third-Party Service change.

For a material change, FlowEHR will provide notice through the Services, by email to Customer's designated administrator, or by another reasonable method. If a material change materially diminishes Customer's protections and FlowEHR does not cure the diminution within thirty (30) days after Customer's written notice, Customer may terminate the affected Services and receive a prorated refund of prepaid unused fees for the affected Services.

11.4 Survival

Sections 6, 9.3, 10, and 11 survive termination or expiration of this Schedule to the extent necessary to give effect to their terms.