The data processing agreement.

1Parties, formation and scope

1.1 This Data Processing Agreement, including its standard Schedules A through D (the DPA), is between Zoe Diagnostics Inc. (Zoe) and the legal entity identified as Data Provider in the signature or electronic acceptance record. It becomes binding when the Data Provider’s authorized representative accepts it and Zoe countersigns or accepts through its designated process. The standard schedules apply without separate completion or countersignature. The Engagement Records described in section 2.2 identify the particular service and instructions. This DPA governs Zoe’s processing on the Data Provider’s behalf; an instruction or procedural failure does not release Zoe from its applicable protective duties.

If the Data Provider purchases services, the Customer Agreement means the Terms of Service and applicable Order, or a separately negotiated agreement. An Order identifies the service, price, term and limits. A Read means one paid diligence run on one Company, and the signed document received at its end. A Company is the business a Read examines. A non-purchasing Data Provider enters this DPA directly without becoming a paying Customer. Both parties will receive a durable copy of the accepted DPA, schedules and acceptance record.

1.2 A Data Provider may be either: (a) a purchasing customer, for data it supplies or otherwise lawfully instructs Zoe to process; or (b) a Company being evaluated, for data in its authorized systems and materials. Each is a separate entity unless the same legal entity performs both roles. Investor payment or an invitation does not bind the Company, authorize access to its credentials or establish authority over its data. Each separate Data Provider must accept this DPA through an authorized representative, or be bound through a person actually authorized to act for it, and give the relevant source and disclosure instructions. That acceptance may cover multiple Reads within its scope and term. Ordinary service selections and requests record those instructions; a new agreement or separately signed form is not required for each Read.

1.3 This DPA governs Service Personal Data, meaning personal data contained in the Data Provider’s authorized uploads, connected-source information, interview materials, requests, and the personal-data portions of analyses, reports, embeddings, indexes and other records derived from them that Zoe processes on the Data Provider’s behalf. It also covers personal data collected from approved sources on the Data Provider’s documented instructions. Personal data remains covered when pseudonymized or embedded if an individual can still be identified under applicable law.

1.3A Provider Materials means all information the Data Provider supplies or authorizes Zoe to collect for the engagement, and confidential information derived from it, including nonpersonal business records and outputs. The Data Provider and its licensors retain their rights in those materials. Zoe receives only the rights needed for the authorized service and permitted return, deletion and retention. Sections 2 through 8 and 12 and Schedules A through D protect Provider Materials, including nonpersonal information, through purpose limits, confidentiality, security, recipient and supplier controls, incident duties and restrictions on training and reuse. Suppliers handling nonpersonal Provider Materials must receive corresponding contractual duties. These protections are owed directly to each Data Provider, whether or not it pays Zoe; statutory personal-data roles and rights remain applicable specifically to personal data.

1.4 For Service Personal Data, the Data Provider is the controller and Zoe is its processor, except where the Engagement Records identify the Data Provider as a processor acting for another identified controller. In that case Zoe is a subprocessor, and the Data Provider represents that it has that controller’s authorization for these instructions and for Zoe’s approved subprocessors. The parties’ legal roles follow their actual activities; this DPA does not make an investor the controller of all target-company data, resolve joint-controller arrangements, or authorize processing for an unstated purpose.

1.5 Zoe may act separately as a controller for necessary business-contact, billing, account-administration, acceptance and security records processed for its own lawful purposes. This does not permit reclassifying source content, prompts, reports, embeddings or diagnostic evidence to avoid this DPA. Such independent processing must be lawful, necessary and proportionate and follow Schedule D. The Privacy Notice provides transparency about Zoe’s practices; it does not supply this DPA’s processing instructions, security specifications, supplier authorization or regional commitments. Cookie choices, notice acknowledgement, customer Terms and this DPA are distinct. Nothing here waives mandatory privacy rights, releases accrued claims or retrospectively changes an applicable earlier commitment or the legal consequences of a representation.

1.6 Applicable Data Protection Law means privacy and data-protection laws applicable to the particular processing, including, where applicable, Regulation (EU) 2016/679 (EU GDPR), the UK GDPR and UK Data Protection Act 2018 as amended, and the California Consumer Privacy Act as amended (CCPA). Controller, processor, personal data, processing and personal data breach have their applicable statutory meanings. Subprocessor means another person appointed by Zoe to process Service Personal Data on the Data Provider’s behalf. A source platform to which the Data Provider subscribes independently is not thereby Zoe’s Subprocessor.

2Instructions and permitted processing

2.1 Zoe will process Provider Materials only for these Read purposes within the Engagement Records: organize evidence and build the Claim Ledger, check claims against authorized sources, prepare and score Company call questions, calculate the Zoe Score and related confidence or coverage indicators, answer questions about the relevant Read, and prepare and deliver its agreed outputs. Necessary supporting processing is limited to operating and securing that engagement, authorized support, fulfilling this DPA, and return or deletion. Source content and Read evidence may not be sent to advertising platforms, analytics vendors or visitor-identification services, or reused for another customer’s engagement or general product development.

2.2 Engagement Records means the applicable Order, authenticated account and source selections, uploads, access and sharing settings, service requests and written communications. The Data Provider’s documented instructions in those records are its Authorization. This DPA, Schedule A and those instructions describe the permitted processing. Instructions are valid only within the instructing entity’s authority and this DPA’s purposes and limits. Zoe will retain records sufficient to identify the instructing entity, authorized person and material scope or changes. An optional form may record instructions, but no separately signed processing-particulars form, supplier register or Authorization form is required for a standard engagement. Account access or investor payment alone does not establish authority over another entity’s data.

2.3 Zoe will process Service Personal Data only on documented instructions, including for international transfers, except where law requires and Applicable Data Protection Law and any mandatory transfer instrument permit the compelled processing. Where EU GDPR Article 28(3)(a) applies, its Union or Member State law limitation governs. Before compelled processing, Zoe will inform the Data Provider of the requirement unless notice is lawfully prohibited on important public-interest grounds. Zoe will immediately inform the Data Provider if, in Zoe’s opinion, an instruction infringes Applicable Data Protection Law, and may suspend the affected processing while the parties resolve the issue. It will not use suspension to delay an otherwise lawful security, return, deletion or assistance obligation.

2.4 The Data Provider is responsible for the lawfulness of its collection, disclosure, instructions and recipient designation, for notices and legal bases required of it, and for providing only data reasonably necessary for the agreed purpose. It must not provide special-category data, criminal-offence data, children’s data, government identifiers, payment-card data or other highly sensitive information unless the parties separately agree in writing to that category, purpose and required safeguards. Zoe will not intentionally request such data under the standard service. If either party discovers unintended restricted data, it will notify the other and cooperate to isolate, minimize, return or delete it as appropriate.

2.5 The recorded source selections and requests identify the authorized accounts, materials, collection scope and frequency or period. Zoe will retrieve only within that authority. Deliberately uploaded documents and call transcripts may be processed in full for the permitted Read functions. Connected systems may return content as well as metadata; provider permissions may be broader than Zoe’s permitted operations. Descriptions used to obtain source authorization must accurately explain the enabled collection and handling. An accessible field, broad technical permission or generic marketing description does not itself authorize retrieval or storage. Recorded source exclusions remain binding.

2.6 Connections authorize reads of source business records and necessary authorization-management and revocation actions, not creation, modification or deletion of those business records. Connection providers and, where the integration requires it, Zoe may process or store access and refresh tokens. Tokens are credentials that must be protected; the Data Provider should enter source passwords only in the source provider’s sign-in flow, and Zoe will not give the investor source passwords or tokens. The Authorization may cover explicitly requested invitations, Company follow-up questions, response links and approved output delivery for the Read. It does not authorize autonomous outreach, public publication, transactions or commitments on another entity’s behalf. Source content and model output cannot expand authority. Material changes to scope or audience require a new recorded instruction before use.

2.7 For the standard Slack connector, Zoe may process authorized channel-message text transiently to derive signals. It will apply redaction for recognized personal-information patterns before text-based signal calculations, using roster names where supplied to that process, and exclude message bodies and raw user-profile fields from persisted Slack connector records. Permitted retained information includes channel identifiers and names, timestamps, thread and activity metadata, and derived signals. Those records are not necessarily anonymous. Direct messages and files are outside the standard connector scope. Recorded source selections identify the authorized channel and data scope.

3Approved recipients and the company being evaluated

3.1 The Data Provider may instruct Zoe to disclose specified outputs to the purchasing investor or customer and other recipients approved in the Engagement Records. Before accepting that disclosure instruction, the authorized representative must be shown the purchasing recipient’s legal identity, the output categories, and any additional named recipients or objectively defined recipient categories and limits. Approved categories may include that customer’s authorized diligence team, investment committee and professional advisers, subject to confidentiality and the agreed purpose. Zoe must identify a specific legal recipient wherever needed for a lawful disclosure or transfer arrangement and maintain access records sufficient to verify that actual recipients fall within the approval. A recipient outside the approved audience requires a new recorded instruction. Disclosure to an investor is not authorized merely because it initiated or paid for the engagement.

3.2 An approved recipient receives the outputs and limited supporting findings identified in the Engagement Records, not source credentials, unrestricted raw target-company records or unrelated personal data. The Data Provider may access or obtain a return of its own materials within its authority. Zoe will apply appropriate access controls and record material sharing actions. An output recipient acting for its own investment or business purposes is responsible for its lawful use, notices, security and retention; it is not Zoe’s Subprocessor merely because it receives a report. Its downstream duties must be addressed in the Customer Agreement or another binding arrangement. This DPA does not bind a non-signatory recipient.

3.3 A Data Provider may withdraw authorization for further source collection or future disclosure through the designated controls or contact. Zoe will promptly stop the affected collection or future disclosure and revoke or disable the affected grants to the extent within its control. The Data Provider may also revoke access at the source. Withdrawal does not automatically erase outputs already lawfully delivered to an independent recipient or override that recipient’s own legal obligations. Zoe will identify the affected recipients and cooperate with lawful deletion, restriction or notification instructions; it will not promise to delete copies it does not control.

3.4 If the buyer and target company give conflicting instructions, Zoe will follow the lawful instructions of the entity with authority over the affected processing. If authority is unclear, Zoe will restrict the disputed processing and disclosure until the parties establish a documented lawful instruction. A buyer cannot defeat the target company’s revocation of source access by changing account settings or giving a contrary instruction.

4Confidentiality and personnel

4.1 Zoe will ensure that persons authorized to process Service Personal Data are subject to enforceable confidentiality duties or an appropriate statutory duty. Access will be limited to personnel who need it for the permitted processing, support or security activities, under appropriate supervision and training. Personnel access and privileges will be removed or adjusted when no longer required.

4.2 Zoe will not disclose Service Personal Data except to its authorized personnel, approved Subprocessors, the recipients designated under section 3, or as legally required under section 2.3. These obligations continue for as long as Zoe or its Subprocessors retain Service Personal Data.

5Security

5.1 Zoe will implement and maintain the measures in Schedule B and other measures appropriate to the risk, considering the nature, scope, context and purposes of processing, the state of the art and implementation costs. Measures must support confidentiality, integrity, availability and resilience and address accidental or unlawful loss, alteration, destruction, disclosure and access. Where the EU GDPR or UK GDPR applies, Zoe will take the measures required by Article 32. A manual or assisted control may be used where it provides effective, timely protection; describing a process does not substitute for performing it.

5.2 Zoe may improve or replace individual measures without materially reducing the overall protection. It will inform the Data Provider before a material reduction and agree a lawful adequate alternative before implementing it. Mandatory security requirements may not be waived. A website revision does not amend Schedule B.

5.3 Security obligations concern the protection actually provided, not a particular certification or infrastructure model. This DPA does not represent that Zoe has independently audited certification, dedicated infrastructure or a separate encryption key or deployment for each Read or customer. Any additional architecture, certification or security commitment must be expressly recorded and supported before the affected processing. No system is guaranteed immune from incidents; that does not excuse the agreed measures or incident duties.

6AI processing and restrictions on reuse

6.1 Zoe may use AI services under section 7 solely for the permitted Read analyses and related functions. The subprocessor information described in Schedule C must identify the actual receiving entities and functions, including model routers and relevant receiving hosts or downstream processors. A model name does not identify every recipient or enlarge its permitted use. The same protections apply to direct and fallback routes.

6.2 Zoe will not use Provider Materials to train or fine-tune models, advertise, supply another customer’s evidence, build cross-customer profiles or benchmarks, develop content-derived scoring datasets, or improve products outside the selected Read functions. Zoe will require corresponding restrictions from its Subprocessors and configure the receiving routes accordingly. A route that cannot meet the required restrictions must not receive the affected data.

6.3 A checkbox, private schedule, de-identification or aggregation does not grant an exception to section 6.2. Zoe may use aggregate, non-content technical telemetry, such as counts, latency and error rates, to operate and improve the service, but not source excerpts, personal content, content-derived features or customer-specific findings under that label. This does not permit sending Provider Materials to an analytics vendor. Zoe will not attempt to reidentify lawfully anonymized information.

6.4 Diagnostic outputs support business review. This DPA does not authorize solely automated decisions about individuals that produce legal or similarly significant effects, or the use of outputs for employment, credit, insurance or other regulated individual eligibility decisions. Any proposed use of that kind requires a separate assessment and written agreement before processing begins.

7Subprocessors

7.1 By accepting this DPA, the Data Provider gives general written authorization for Zoe to engage Subprocessors for the permitted processing, subject to this section. A separate approved register, supplier-by-supplier signature or new authorization for each Read is not required. This authorization does not permit a supplier to use data for its own unrelated purposes or displace Zoe’s duties concerning appropriate providers, binding protections, information, changes and transfers.

7.2 Zoe will select Subprocessors offering sufficient guarantees for the relevant processing and assess them proportionately to its nature and risks. Zoe will bind each Subprocessor by a written contract imposing the applicable data-protection obligations and protections required by this DPA and Applicable Data Protection Law, including confidentiality, security, purpose and reuse restrictions, assistance and return/deletion. Further subcontracting must receive equivalent protection. Zoe remains responsible to the Data Provider for its Subprocessors’ performance of the delegated obligations.

7.3 Zoe will normally give at least 30 days’ advance written notice of a new or replacement Subprocessor, identifying its function, data access, processing and support countries, and relevant transfer safeguards. The Data Provider may object during that period on reasonable data-protection grounds. Zoe will work in good faith to provide an alternative provider, configuration or restriction and will not send the affected data to a disputed Subprocessor while a timely objection remains unresolved. A shorter period requires the Data Provider’s express written authorization for that appointment and must satisfy applicable law; urgency alone does not authorize disclosure.

7.4 If no reasonable solution is available, either party may terminate the affected processing before the proposed change takes effect. A purchasing customer will receive a refund of prepaid charges for the unused affected service, without an early-termination penalty attributable to that change. A target-company Data Provider may terminate its participation without a payment obligation arising solely under this DPA. Existing return, deletion and cooperation duties survive. Urgency does not waive any legally required prior authorization; Zoe may suspend the affected service while an urgent provider change is considered.

7.5 Zoe will proactively supply and keep accessible current information identifying its actual Subprocessors and relevant downstream recipients, as described in Schedule C, and provide information reasonably necessary to assess the processing and safeguards. It may provide the information through account or onboarding communications and an accessible maintained list; the Data Provider need not request a new register for each Read. Changes follow section 7.3. Advertising and visitor-identification tools receive no authority to process Provider Materials from appearing in a general privacy notice.

8Data breaches and confidentiality incidents

8.1 Zoe will notify the Data Provider without undue delay after becoming aware of a personal data breach affecting Service Personal Data. Zoe will not wait for a completed investigation or complete information before giving an initial notification. This processor notification duty is distinct from any deadline the Data Provider has to notify a regulator or affected individuals.

8.2 To the extent reasonably available, the notification will describe the nature of the breach, affected data and approximate numbers of individuals and records, likely consequences, actions taken or proposed to contain and remediate it, and a contact for follow-up. Zoe will provide material updates as information becomes available and reasonable assistance with the Data Provider’s risk assessment, notifications and remediation.

8.3 Zoe will investigate, contain and remediate the breach, preserve proportionate evidence, and document relevant facts and corrective actions. It will notify each affected Data Provider through the designated security contact in the Engagement Records or, if none is designated, the Data Provider’s account or engagement contact. It will not reveal one Data Provider’s confidential information to an investor or another customer merely because they share an engagement. Communications to regulators or individuals on the Data Provider’s behalf require its instructions, except where law independently requires Zoe to notify. Zoe will coordinate legally required communications where permitted.

8.4 Unsuccessful attacks that do not compromise Service Personal Data are not by themselves a personal data breach, but Zoe will handle them under its security procedures and notify the Data Provider where they materially affect the agreed service or otherwise require notice by law.

8.5 Zoe will also notify the Data Provider without undue delay of unauthorized access, acquisition, disclosure, alteration, loss or destruction of confidential nonpersonal Provider Materials. The information, updates, investigation, remediation and coordination duties above apply as appropriate. This contractual protection does not characterize a nonpersonal incident as a statutory personal-data breach or create a regulatory notice duty where none exists.

9Assistance and individual rights

9.1 Taking account of the processing and information available, Zoe will assist the Data Provider with access, correction, deletion, restriction, objection, portability and other applicable individual rights. It will promptly forward a directly received request to the designated Data Provider contact and explain the responsible route to the requester, without deciding the request on the Data Provider’s behalf unless instructed or legally required. Verification must be prompt and proportionate and must not extend a mandatory period. Zoe will provide its response and assistance in time to enable applicable deadlines and explain lawful exceptions or incomplete work. This clause does not reduce any separately applicable obligation Zoe owes to the individual.

9.2 Zoe will provide the information and assistance reasonably necessary for the Data Provider to meet its security, breach-notification, data-protection impact-assessment, regulatory consultation and other processor-related duties. Where applicable, this includes assistance with CCPA cybersecurity audits, risk assessments and automated-decisionmaking requirements. The Data Provider will provide sufficiently specific instructions and relevant deadlines; Zoe will respond in time to enable compliance with legally applicable deadlines, taking account of the information and systems under its control.

9.3 Routine assistance inherent in the agreed service and assistance required because of Zoe’s breach will not carry an additional fee. The parties may agree reasonable charges in advance for exceptional work outside the agreed service, but a fee discussion will not delay legally required action, access to required information, breach response or correction of Zoe’s noncompliance.

10Records, information and audits

10.1 Zoe will maintain records required of it by Applicable Data Protection Law and make available information reasonably necessary to demonstrate compliance with this DPA. This may include relevant policies, technical descriptions, Subprocessor information, test summaries and independent assessment reports, where available. Zoe will not imply that an independent certification or audit exists if it does not.

10.2 Zoe will permit and contribute to audits and inspections by the Data Provider or a qualified independent auditor it appoints. Routine audits may be conducted on reasonable advance notice during normal business hours, ordinarily no more than once in a 12-month period. That frequency limit and notice requirement do not apply where an additional or urgent audit is reasonably needed following a breach, credible evidence of noncompliance, a material unresolved concern or a regulator’s requirement, or where Applicable Data Protection Law requires otherwise.

10.3 The parties will reasonably coordinate scope and methods to protect other customers’ information, confidential security details and service availability. Existing reliable reports may satisfy an issue where they provide sufficient evidence, but Zoe will not rely on a report-only process to prevent a legally required inspection. Reasonable confidentiality undertakings may apply, without restricting lawful disclosure to regulators or exercise of statutory rights. Zoe will promptly address material findings and provide evidence of remediation. Each party bears its own routine audit costs; Zoe bears reasonable additional audit costs resulting from its material noncompliance.

11International transfers

11.1 Zoe will process data only consistently with the documented instructions and Applicable Data Protection Law. Its subprocessor information identifies relevant processing and access locations. A regional restriction applies only when expressly agreed and supportable; this DPA does not promise a dedicated EU, UK or other regional route.

11.2 Zoe will maintain a valid mechanism for any transfer restricted by Applicable Data Protection Law, including relevant onward transfers. Depending on the circumstances, this may be an applicable adequacy arrangement or appropriate standard contractual clauses and any required local instrument. The mechanism must cover the actual recipients and processing throughout reliance on it. A transfer that requires a mechanism may not proceed without one; unrestricted processing does not require a separate transfer instrument merely because this DPA is used.

11.3 Where standard contractual clauses, a UK Addendum, an International Data Transfer Agreement or another contractual instrument is needed, the parties will execute or validly incorporate the applicable instrument with the required details and complete any legally required assessment or supplementary measures. This paragraph alone does not execute those instruments. No separate transfer paperwork is required for every Read where the applicable arrangement already covers it.

11.4 Zoe will notify the Data Provider if it cannot maintain a required safeguard and take appropriate corrective action, including suspending affected transfers and returning or deleting data where required. It will assess binding access demands, notify the Data Provider where permitted, seek reasonable limitations or challenge where warranted and disclose only what is legally required. Mandatory transfer-instrument protections prevail over inconsistent terms, including liability, law and forum provisions.

12Return, deletion and ending processing

12.1 At the end of the relevant processing, Zoe will, at the Data Provider’s choice, return or delete Service Personal Data and delete existing copies. The Data Provider may choose through a service request or written instruction and may require earlier deletion. Where return is not selected, deletion applies after any lawful authorized export period; lack of a further request does not authorize indefinite retention. Zoe will act promptly and complete return and deletion without undue delay, subject to any shorter binding or statutory deadline and the limited required-storage exception in section 12.3. Return is followed by deletion of Zoe’s and its Subprocessors’ copies. Backup deletion follows Schedule D and is not a permanent exception. Zoe will require equivalent action by Subprocessors and provide an accurate completion statement on request, explaining outstanding work, relevant timing and any lawful exception. No separately negotiated numerical retention schedule is required for these duties to apply.

12.2 A disconnect or withdrawal instruction requires stopping affected future collection; it is not by itself an instruction to delete all existing evidence. Termination or deletion must not leave collection running under ended authority. Zoe will promptly stop the relevant synchronization and disable or revoke grants within its control, using automated or assisted procedures as needed. If a control or provider request fails, Zoe will pursue the effective fallback, record and retry outstanding steps, and explain any action required from the Data Provider. A partial result will not be reported as complete. The deletion obligation remains until completed or a lawful exception applies.

12.3 Storage beyond the required deletion point is permitted only to the extent required by law and allowed by Applicable Data Protection Law and any mandatory transfer instrument. Where EU GDPR Article 28(3)(g) applies, its Union or Member State law limitation governs; a foreign-law demand is not by itself an unrestricted exception. Zoe will notify the Data Provider unless legally prohibited, document the basis and affected data, segregate and restrict the records, prohibit other use, review the continuing requirement and delete when it ends. A general audit-trail label, possible future litigation, a customer-held signed output, or service improvement does not justify retaining processor-held source content or copies. A separately instructed continuing service must have a specific lawful purpose and duration; it cannot defeat end-of-processing deletion by relabeling storage.

12.4 This DPA remains effective until the relevant data has been returned or deleted and any permitted retained copies have expired. Confidentiality, limited retained-data protection, assistance, audit rights to verify outstanding duties, transfer safeguards and other provisions intended to survive will continue for the relevant period.

13California and other US state privacy requirements

13.1 This section applies to the extent Zoe processes personal information for the Data Provider in a service-provider, contractor or processor capacity under applicable US state privacy law. The Data Provider discloses that information only for the limited, specific purposes stated in Schedule A. Zoe will comply with the applicable obligations and provide the level of privacy protection required of it under that law.

13.2 Zoe will not sell or share the personal information as those terms are defined by the CCPA; retain, use or disclose it for a commercial purpose other than the specified business purposes; retain, use or disclose it outside the direct business relationship; or combine it with personal information received from another person or collected from Zoe’s own interaction with an individual, except where expressly permitted by applicable law and consistent with this DPA’s narrower instructions. Zoe will not use it for cross-context behavioral advertising. The specific service purposes do not include advertising, data brokering or building profiles for another business.

13.3 Zoe certifies that it understands these restrictions and will comply with them. It will notify the Data Provider without undue delay if it determines that it can no longer meet its applicable obligations. The Data Provider may take reasonable and appropriate steps to verify compliant use, including the reviews, audits and testing contemplated by section 10, and, on notice, to stop and remediate unauthorized use. Zoe will cooperate with such steps and with consumer requests and required assessments under section 9.

13.4 Zoe will bind each relevant subcontractor to a written contract meeting applicable service-provider, contractor and processor requirements, provide the required notice of engagement, and remain responsible as stated in section 7. Neither the name of a vendor nor its inclusion in a privacy notice establishes service-provider status without the required contract and actual practices.

14Liability, precedence and general terms

14.1 If Zoe and the Data Provider have a separately negotiated, signed agreement that expressly specifies the liability allocation applicable to this DPA, that allocation controls to the extent expressly stated and legally permitted, regardless of the labels it uses. A general agreement-precedence clause alone does not change this DPA’s liability allocation, and an investor’s agreement does not amend a separate Data Provider’s rights. Otherwise each party’s total aggregate liability to the other arising out of or relating to this DPA, including its Provider Materials protections, is limited to the greater of twice Relevant Fees and US$5,000, the DPA Cap, for the applicable Read or Liability Period.

For a one-time Read, Relevant Fees means fees paid or payable to Zoe for the Read under the affected Order, and the cap applies in aggregate to claims concerning that Read. For a subscription, each Liability Period is a successive 12-month period beginning on the start date of the affected subscription service. Relevant Fees means fees paid or payable under that Order for the affected service during the applicable Liability Period; this calculation does not create a minimum purchase commitment. All claims allocated to that Order’s Liability Period share one aggregate cap. An independent event first occurring in a later Liability Period has a fresh cap.

Claims from the same incident or causally connected series are allocated to the Liability Period in which the first event causing those claims occurred, including continuing consequences. An independent later incident is not grouped merely because it involves the same service or type of error. A pre-subscription event is allocated to the first Liability Period. Renewal does not restart the 12-month timetable or multiply a cap for the same incident. For related claims involving multiple Orders, Relevant Fees for the affected services in their applicable periods are added without counting a fee twice, and the monetary floor applies once to the group. Unrelated claims under separate Orders have separate caps.

For a non-paying target-company Data Provider, Relevant Fees includes the purchasing customer’s fees for the related Read or service identified in the Engagement Records; the US$5,000 floor applies even if no fees were paid or payable. Where there is no associated Order, the relevant authorized engagement is treated as the affected Order, Relevant Fees is zero if no fees are attributable, and the same floor and grouping rules apply. When the Data Provider is also a Customer under Zoe’s standard Terms of Service, ordinary claims remain subject to those Terms’ General Cap and all ordinary and enhanced-category recoveries under that agreement and this DPA for the same Read, Liability Period or grouped claims count together toward the DPA Cap. The caps are not stacked and the same loss may not be recovered twice. A different legal entity’s claim for its own separate loss does not reduce this Data Provider’s cap.

14.2 Subject to section 14.3, neither party is liable to the other for indirect, special, incidental or consequential damages or lost profits arising out of this DPA. Reasonable, documented costs of investigating, containing and remediating a breach, restoring affected data, and making legally required notifications are not excluded merely because they relate to a third-party incident; to the extent otherwise recoverable, they remain within the applicable cap.

14.3 No limitation or exclusion in this DPA limits fraud, willful misconduct, gross negligence, death or personal injury caused by negligence where liability cannot lawfully be excluded, liability that cannot lawfully be limited, mandatory liability under applicable standard contractual clauses or another mandatory transfer instrument, regulators’ powers, or data subjects’ statutory rights or remedies. Express obligations to pay agreed fees or return/refund fees are payment adjustments outside the damages caps. Contractual allocation between the parties does not displace their duties to individuals or regulators. Any allocation of administrative fines or penalties applies only to the extent legally permissible. The parties do not create a new indemnity obligation by this DPA.

14.4 Mandatory transfer instruments prevail to the extent required. Otherwise this DPA controls conflicting general contractual terms concerning its covered processing and protection. A separately signed agreement between Zoe and the affected Data Provider may expressly amend specified provisions to the extent lawful; an investor’s agreement cannot amend another entity’s rights. Replacement of a customer agreement does not by itself remove this DPA or enlarge data authority. Amendments must preserve mandatory protections and be accepted by the entity entitled to give the instruction. They operate prospectively unless expressly and lawfully agreed otherwise and do not automatically erase earlier duties, accrued claims or rights arising from representations. The Privacy Notice remains a separate transparency notice, not an automatic amendment to this DPA or its schedules.

14.5 Delaware law governs this DPA without regard to its conflict-of-laws rules, and the state courts located in New Castle County, Delaware, and the United States District Court for the District of Delaware, where it has jurisdiction, have exclusive jurisdiction over disputes between the parties, except where Applicable Data Protection Law, data-subject rights or a mandatory transfer instrument requires otherwise. There is no mandatory arbitration requirement. The parties will first try in good faith to resolve a written dispute through representatives authorized to settle it for 30 days, except that either may seek urgent protective relief, act before a limitation period expires or exercise a nonwaivable right without waiting.

14.6 DPA notices go to the designated account or engagement contacts through a durable written channel. Each party will keep its contacts current. Amendments require recorded agreement between authorized representatives. New selections or requests within this DPA may be recorded through the ordinary service flow without a separately signed amendment. Material expansion of purposes, data categories or output recipients, or reduction of protections, requires the affected Data Provider’s recorded agreement and any required notice before the change takes effect. Subprocessor changes follow section 7. Continued use alone does not substitute for required authorization. Neither party may assign this DPA to avoid its obligations; an invalid provision does not affect the remainder unless the essential lawful basis for processing is lost.

Schedule AStandard processing details

This schedule is part of the DPA upon acceptance. The Engagement Records identify the applicable parties, service and selections without a separate processing form. They may cover multiple Reads and are retained as part of the documented instructions. Selecting or supplying data does not authorize a purpose outside this DPA or confer authority the person does not hold.

Zoe will make the accepted DPA and relevant Engagement Records available to the Data Provider. Normal records must identify the organization giving instructions and the material source, purpose and recipient scope; a bare invitation or payment is not permission from a different organization. Nonstandard processing requires appropriate additional documented instructions and safeguards, which may be recorded in an Order or written amendment. It does not require replacing this standard schedule for unchanged services.

Schedule BSecurity measures

Zoe will apply these measures proportionately to the agreed processing and its risks. They describe required protection, not an independent certification, a separate per-Read environment or a statement that every control is automated. Manual or automated processes must be effective and timely. Any expressly agreed additional measures may be recorded in an Order or other written instruction.

1. Responsibility and confidentiality. Assign privacy and security responsibility; maintain workable access, incident, retention and supplier procedures; instruct personnel handling data; and impose confidentiality duties.

2. Access and separation. Authenticate access, restrict it by role and workspace or engagement, separate tenants logically, and use least privilege. Protect privileged access with additional controls appropriate to its risk, review access when roles change and periodically, and remove unnecessary permissions. Apply authorization to exports, shared links and administrative access.

3. Encryption and secrets. Protect data in transit using supported transport encryption and stored Service Personal Data with appropriate storage or application-level encryption. Restrict keys, tokens and secrets, keep them out of public code and routine logs, and protect backup access. Shared infrastructure or a shared encryption key does not remove these duties.

4. Source and data minimization. Enforce the approved source and recipient scope, limit retrieved and AI-transmitted information to the purpose, protect authorization tokens and process revocations. Keep credentials and unnecessary personal content out of prompts and error records. Do not send Read content to advertising, analytics or visitor-identification providers.

5. System maintenance. Maintain supported components, review security-relevant changes, assess vulnerabilities and remediate according to risk. Use synthetic or minimized test data unless authorized otherwise.

6. Records and response. Keep proportionate records of material access, approvals, sharing, exports, deletion and security events. Protect records against unauthorized access and alteration without turning them into an indefinite source-data archive. Maintain a usable incident-response process.

7. Recovery and evaluation. Maintain measures to restore availability and access after incidents, protect recovery copies, evaluate the controls and recovery process at reasonable risk-based intervals, and address material findings. Reapply deletion and restriction instructions after restoration. No specific recovery-time or recovery-point commitment is created unless agreed.

8. Suppliers and deletion. Maintain appropriate oversight of actual recipients and routes and their processing restrictions. Track relevant stores, supplier instructions, deletion attempts and failures; use assisted steps where necessary; and verify results before confirming completion. Maintain the operational information needed to fulfill return and deletion duties.

If the measures cannot adequately protect the agreed processing or meet mandatory law, Zoe must remedy or suspend that processing.

Schedule CSubprocessor information

General authorization is given under section 7 through acceptance of the DPA. Zoe will proactively provide and maintain accessible information identifying its actual Subprocessors and relevant downstream recipients, including their legal names, addresses and appropriate contact details, functions, relevant data access, and processing, storage and remote-access countries. The information must include the actual model router and receiving hosts where those services process Provider Materials; a model name alone is insufficient. It may be supplied through account or onboarding communications and a maintained accessible list, without a separate signature or approval of the list.

Zoe will keep that information current, notify additions or replacements under section 7 and provide reasonably necessary information about the applicable safeguards. The list records actual providers rather than certifying that a particular independent audit has occurred. It does not expand the permitted purposes, override no-training duties or create a general license for data reuse.

Equivalent contractual purpose, confidentiality, security, incident and deletion protections apply to suppliers handling confidential nonpersonal Provider Materials. Independently selected source platforms and authorized output recipients are distinguished from Zoe’s suppliers according to their actual roles. Advertising and visitor-identification tools are not authorized to receive Provider Materials. Questions and requests for further supplier information may be sent to legal@zoediagnostics.ai; this request route does not replace Zoe’s proactive information and change-notice duties.

Schedule DRetention, export and deletion

These standard rules apply without separately completed retention fields or agreed numerical deletion periods. Processing lasts only for the authorized service and the necessary, prompt return/deletion process. Any shorter legal deadline or expressly agreed period controls. Zoe will use effective automated, assisted or manual procedures; a disabled job or failed self-service control does not extend the permitted retention.

A separate Data Provider’s departure applies these rules to its data even if the investor continues using Zoe. A buyer’s subscription does not extend target-company source authority or displace end-of-processing deletion.

Zoe will provide accurate information about completed work, outstanding steps, relevant timing and lawful exceptions. A partial result is not a completed wipe or a destruction certificate. No fixed automatic purge, immutable proof or immediate erasure from every system is represented. Earlier binding obligations and accrued rights remain effective except to the extent expressly and lawfully changed.