HDx Cognition SaaS Agreement

Last Updated: 27/05/2026

Software as a Service Agreement

Head Diagnostics Limited, whose registered office is at Suite 3, One Earlsfort Centre, Lower Hatch Street, Dublin 2, Ireland ("Head Diagnostics") has all necessary rights to and in the software, which it proposes to make available, on a platform accessible via the internet, as a service, to you and/or your organisation ("Customer")(each a "Party", and together the "Parties"), subject to the terms and conditions contained in this Agreement, and as described in the Order Form. By clicking 'Accept' Customer agrees to all terms and conditions of this Agreement including all Related Documents and Schedules regarding the use of, payment for, and access to, the software subject to the terms and conditions of this Agreement. The terms and conditions of this Agreement are subject to change. Head Diagnostics will inform you of any changes prior to their implementation. By continuing to use the Head Diagnostics software as a service you agree and accept any changes or amendments to this Agreement.

Definitions
The following terms, when capitalised in this Agreement, shall have the meanings assigned to them hereunder:
1. "Acceptance" means the date of the delivery of the first installation of HDx Cognition as evidenced by Head Diagnostics. Alternatively, HDx Cognition will be deemed accepted upon Customer's continued use of it after a period of 30 calendar days has expired after the first installation of HDx Cognition.
2. "Affiliate(s)" shall mean, in relation to either Party, any legal entity which is directly or indirectly: (i) owned, or controlled, by that Party, (ii) owning, or controlling, that Party, or (iii) owned, or controlled, by the legal entity owning, or controlling, that Party, but any such legal entity shall only be considered an Affiliate for as long as such ownership, or control, exists. For the purpose of this definition, a legal entity shall be deemed to be controlled if: (i) more than 50% (fifty per cent) of its voting interest is owned by the controlling entity, or (ii) the controlling entity has the ability to direct the business activities or appoint the majority of the directors of such legal entity.
3. "Agreement" means this Software as a Service Agreement including all Related Documents and Schedules as well as any Order Form(s) entered into by the Parties, under this Agreement, from time to time.
4. "Applicable Law(s)" means all applicable laws in force from time to time, and all implementing, national, and other legislation in force from time to time, which relate to the design, installation, marketing, sale and supply of HDx Cognition, and/or the Services, under any Order Form(s), and/or Service Level Agreement(s) between the Parties, in any relevant jurisdiction, in accordance with this Agreement.
5. "Business Day" means a day (other than a Saturday, Sunday, or public holiday in Ireland), when banks in Dublin are open for business.
6. "Confidential Information" means all information in any form maintained in confidence by a Party, and (i) which is marked as such; or (ii) that under the circumstances by its nature would be understood to be confidential and/or proprietary information by a reasonable person. For the avoidance of doubt, information relating to this Agreement, quotations, the pricing and fees that differ from those advertised and provided particularly to Customer associated therewith and Head Diagnostics' business, products, Customers, business associates, IT operations, processes, Intellectual Property Rights and/or trade secrets is Confidential Information of Head Diagnostics.
7. "Customer Content" means any information, in digital or other form processed by Customer under this Agreement in relation to HDx Cognition, including but not limited to data, documents, patient reports, emails and pictures.
8. "Data Protection Law" means: (i) Regulation 2016/679 of the European Parliament and of the Council on the protection of natural persons with regard to the processing of Personal Data and on the free movement of such data (General Data Protection Regulation) (the "GDPR"), (ii) the EU e-Privacy Directive (Directive 2002/58/EC), (iii) the Irish Data Protection Acts 1988 – 2018, and (iv) any and all applicable national data protection laws made under, pursuant to, or that apply in conjunction with, any of (i), (ii), or (iii); in each case as may be amended or superseded from time to time.
9. "Data Subject Request" means any exercise of the rights of a data subject as such rights are set out under Data Protection Law, in particular rights exercised pursuant to Articles 15 – 22 GDPR (to the extent applicable).
10. "Documentation" means any and all technical and functional specifications of HDx Cognition such as user guides, manuals, and other instructional materials provided by Head Diagnostics relating to the operation and functions of HDx Cognition, as may be updated from time to time by Head Diagnostics.
11. "Effective Date" means the date on which Customer accepts the Agreement by clicking 'Accept'.
12. "Fee(s)" means the fees payable by Customer in consideration for the use of HDx Cognition and the Technical Support Services as set forth in the Order Form(s).
13. "General Industry Standards" means the behavioural attributes, use of technology, techniques, and/or methodologies that a supplier of services, similar to the Services, would use in the performance of the Services.
14. "HDx Cognition" means the online, web-based application, hosted, and provided by Head Diagnostics, as described in the Documentation, and as specified in the Order Form(s), including all Upgrades and Updates.
15. "Implementation" means the configuration and preparation of HDx Cognition for use by Customer.
16. "Infringement Claim" means any claim brought by a third party against Customer alleging that HDx Cognition infringes any patent, trade secret, trademark, copyright, or other Intellectual Property Rights, of that third party.
17. "Insolvency Event" means: (i) entering into liquidation or being dissolved (other than pursuant to a members' voluntary liquidation for the purpose of reconstruction or amalgamation), (ii) a receiver or an examiner being appointed over company assets, (iii) ceasing or suspending payment of debts, or being deemed to be unable to, or admitting inability to, pay debts as they fall due (within the meaning of section 570 of the Companies Act 2014), (iv) proposing, or making, a general assignment, arrangement or composition with, or for, the benefit of creditors, and/or (v) proceedings being commenced under any law, regulation, or procedure relating to reconstruction or adjustment of debts.
18. "Installation" means connecting or downloading HDx Cognition.
19. "Intellectual Property Rights" means all intellectual and/or industrial property rights, including (but not limited to) any patents, utility models, rights to inventions, supplementary protection certificates, copyright and neighbouring and related rights, moral rights, trade marks, service marks, business names, and domain names, rights in get-up, goodwill, and the right to sue for passing off or unfair competition, rights in designs, database rights, rights to use, and protect the confidentiality of, Confidential Information, and all other intellectual property rights, in each case whether registered or unregistered, and including all applications and rights to apply for, and be granted, renewals or extensions of, and rights to claim priority from, such rights and all similar, or equivalent rights, or forms of protection which subsist, or will subsist now, or in the future in any part of the world.
20. "Maintenance" means the tracing or repairing of defects with respect to HDx Cognition and the development of Updates/Upgrades from time to time at the discretion of Head Diagnostics.
21. "Order Form(s)" means Head Diagnostics' ordering documents for Customer's purchases from Head Diagnostics which are executed by Customer, and which refer to this Agreement. This includes the Order Form(s) completed during digital registration to use HDx Cognition (or otherwise), any subsequent Order Form(s) completed by Customer, or any quote, or offer, from Head Diagnostics for the provision of HDx Cognition. Order Form(s) referring to this Agreement shall be deemed incorporated herein. Order Form(s) will take the form provided by Head Diagnostics to Customer.
22. "Privacy and Data Protection Agreement" means the Privacy and Data Protection Agreement attached at Schedule 2 hereto.
23. "Related Documents" means any Order Form(s), terms and conditions, Schedules, annexes and any other document(s), including (without limitation) any additional Order Form(s), that the Parties may agree from time to time, which shall be part of this Agreement.
24. "Schedule(s)" means any of the schedules or related agreements annexed to this Agreement.
25. "Screening" means the tests offered in HDx Cognition labelled as such.
26. "Services" means HDx Cognition, the Technical Support Services, and Maintenance, and any other services provided by Head Diagnostics relating to HDx Cognition to Customer.
27. "Service Level Agreement" means the applicable Service Level Agreement as attached at Schedule 1 hereto.
28. "Standard Contractual Clauses" means the contractual clauses annexed to the European Commission's Implementing Decision (EU) 2021/914 of 4 June 2021 ("SCCs") as applicable in accordance with Schedule 2.
29. "Technical Support Services" means the Technical Support Services and Maintenance provided by Head Diagnostics for HDx Cognition as specified in Service Level Agreement.
30. "Term" means the term of this Agreement as specified in clause 12, including any extensions thereof as specified therein.
31. "Third Party Products and Services" means any hardware, software, peripherals, or other equipment, or services, other than HDx Cognition, that Customer has acquired, or may acquire, the right to use from a party other than Head Diagnostics.
32. "Update(s)" means a release, or phase, of HDx Cognition consisting of technical, and/or functional, alterations, corrections, or fixes, that are compatible with the previous release of HDx Cognition.
33. "Upgrade(s)" means: (i) any new version of HDx Cognition which, from time to time, is publicly marketed and offered for purchase by Head Diagnostics in the course of its normal business, being a version which contains such significant differences from the previous versions as to be generally accepted in the marketplace as constituting a new service.
34. "User(s)" means any person who is authorised by Customer to use and access HDx Cognition, for whom access to HDx Cognition has been granted, and who have been supplied user identifications and passwords by Customer (or by Head Diagnostics at Customer's request).

Access to HDx Cognition
1. Subject to the terms and conditions of this Agreement, including (without limitation): (a) Acceptance of HDx Cognition, (b) full and timely payment of Fees, and (c) Customer's use of the Services in accordance with this Agreement, Head Diagnostics shall make the Services available to Customer for the Term on a non-exclusive basis.
2. Customer agrees that its entering into this Agreement is neither contingent upon the delivery of any future functionality, Updates, Upgrades, or features of HDx Cognition, nor dependent upon any oral or written comments made by Head Diagnostics with respect to future functionality, Updates, Upgrades, or features of HDx Cognition. HDx Cognition, and associated Documentation, specifications, and features are subject to change by Head Diagnostics at any time, provided that Head Diagnostics notifies Customer in advance of any material changes.

Responsibilities of the Parties
1. Head Diagnostics shall use commercially reasonable efforts to: (i) maintain the security and integrity of HDx Cognition, (ii) provide Technical Support Services in accordance with the Order Form(s), and (iii) make HDx Cognition available in accordance with any Service Level Agreement.
2. Customer shall use HDx Cognition solely as described in this Agreement and shall not: (i) licence, sublicence, sell, resell, rent, lease, transfer, assign, distribute, time share, or otherwise commercially exploit, or make available, HDx Cognition to any third party, other than to Users, (ii) send spam, malicious data, code, program, or other unsolicited messages, in violation of Applicable Laws, (iii) use the Services to violate the rights of others, including to send or store infringing, or otherwise unlawful material, and/or material that violates third party privacy rights, (iv) interfere with, or disrupt, the integrity or performance of HDx Cognition, or Customer Content contained therein, (v) attempt to gain unauthorised access to HDx Cognition, or its related systems, servers, equipment, or networks, and/or (viii) use the Services in a way that could harm HDx Cognition, the Services, or impair anyone else's use of same.
3. In addition to those prohibitions contained elsewhere in this Agreement, Customer shall not: (i) modify, alter, copy, or create derivative works which are based on, or similar to, HDx Cognition, (ii) frame, or mirror any Confidential Information, Documentation, Intellectual Property Rights and/or any other content forming part of HDx Cognition, (iii) reverse engineer HDx Cognition, (iv) access HDx Cognition in order to: (a) build a competitive product or service, and/or (b) copy any ideas, features, functions, Update(s), Upgrade(s) and/or graphics of HDx Cognition, (v) use HDx Cognition for any purposes, except as expressly provided for in this Agreement, and/or (vi) exceed the licenced use of HDx Cognition as specified in this Agreement and its Schedules and/or the Order Form(s) agreed between the Parties.
4. If Customer uses HDx Cognition solely to view results of Screening tests, Customer may use up to 25 Screening tests per calendar month, free of charge. Access and use of additional Screening tests are available upon request at Head Diagnostics discretion. Such a restriction shall not apply to the use of Screening tests in combination with any other tests offered as part of the Services, or when a report is being generated for Screening tests, as in both of these cases, Customer will be charged.
5. Customer is responsible for Customer's systems, including (but not limited to) the set-up, servers, equipment, and (network) connectivity, as well as the maintenance of same. Customer must employ industry standard virus protection, software, and methods, including (but not limited to) firewalls, malware protection, access controls, and other cybersecurity protections (where appropriate) which are proportionate to the level of risk posed by any accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, the information which being processed by Customer, and Customer is responsible for the consequences of any virus, malware, hacking (including ethical hacking), breaches (including Personal Data Breaches), cybersecurity attack on, and/or security breach of, its operating systems, servers, networks, or data, on its instance of HDx Cognition.
6. Customer shall provide full and timely cooperation with the installation and use of any Upgrades and Updates upon the first request of Head Diagnostics.
7. Customer shall insure and backup all Customer Content provided to Head Diagnostics under this Agreement (e.g. by exporting the reports) against loss or damages, including but not limited to loss or damage resulting from transportation, outages, fire, theft, cybersecurity, or Personal Data, breach. In no event shall Head Diagnostics be liable for any loss of, loss of use of, or damage to, Customer Content.
8. Customer is responsible for all activities that occur in User accounts and for Users' compliance with this Agreement. Customer shall: (i) have sole responsibility for the accuracy, quality, integrity, legality, reliability, and appropriateness of all Customer Content on HDx Cognition, (ii) use all commercially reasonable efforts to prevent unauthorised access to, or use of, HDx Cognition, and notify Head Diagnostics promptly of any such unauthorised access, or use, and then promptly furnish full details of such access or use, and cooperate with Head Diagnostics in any litigation against third parties which is deemed necessary by Head Diagnostics to protect Head Diagnostics' proprietary and contractual rights, and (iii) shall ensure the proper configuring, updating, programming, and operating of Customer's hardware, software, websites, Content, telephone, and/or internet connections to allow access to, and use of, HDx Cognition, and (iv) comply with all Applicable Laws.
9. If Customer requests Head Diagnostics to undertake services, or access Customer Content outside of the normal use of HDx Cognition, or the Services, as set out in this Agreement, Head Diagnostics may charge a reasonable fee for the administrative costs of fulfilling Customer's request. Head Diagnostics is under no obligation to fulfil such a request and any fulfilment of a request, and any associated fee(s) charged to Customer, shall be at the sole discretion of Head Diagnostics.

Ownership and Intellectual Property Rights
1. Head Diagnostics and its Affiliates has all necessary rights, title, and interest in, and to, the Services, Documentation, Confidential Information, and all other Updates, Upgrades, modifications, and/or derivative works of each of the foregoing, and all Intellectual Property Rights.
2. Customer shall not remove, or alter, any copyright notices, proprietary information notices, trademarks, service marks, graphical elements, or other legends, or markings contained in HDx Cognition, the Documentation, and other Confidential Information, and shall reproduce on all media, containing a copy of HDx Cognition, the Documentation, and/or other Confidential Information, without any amendments, updates, modifications, or changes to them, and with all copyright notices, proprietary information notices, service marks, graphical elements, and other legends and markings as were affixed to the original media in HDx Cognition.
3. Head Diagnostics, and its Affiliates, shall have the right to use any feedback provided by Customer to Head Diagnostics relating to the Services, the Documentation and the Confidential Information in any manner they see fit (including in order to produce and sell Head Diagnostics' own marketing materials to current and prospective customers).
4. Head Diagnostics is entitled to use the trade name(s), business names, and/or trade mark(s) of Customer on its website, and in other (promotional) publications for the purpose of communicating that Customer uses HDx Cognition, and any related services, provided by Head Diagnostics. Customer will not be entitled to use Head Diagnostics' name, trade name, business name, logo, Confidential Information, Documents, or any adaptation thereof, for any purpose without Head Diagnostics' prior written consent, which consent may be granted, or withheld, at Head Diagnostics' sole discretion.
5. Customer will not give interviews to the media, or publish any articles in connection with their use of HDx Cognition or the Services, unless Customer has obtained Head Diagnostics' prior written consent for such interview or publication, such consent to be granted or withheld at Head Diagnostics' sole discretion.

IP Infringement and Indemnifications
1. Subject to clause 5.3, Head Diagnostics shall, at its sole cost and expense, defend and settle any Infringement Claim, provided that: (i) Customer has given prompt written and detailed notice to Head Diagnostics of any such Infringement Claim, (ii) Customer gives Head Diagnostics sole control of the defence of such Infringement Claim, and any related settlement negotiations, and (iii) Customer gives Head Diagnostics relevant information and assistance to defend against or settle the Infringement Claim (where requested by Head Diagnostics).
2. Subject to clause 5.3, Head Diagnostics shall have the sole and exclusive right to defend and settle any Infringement Claim. In the event of an Infringement Claim, Head Diagnostics shall also have the right, at its sole cost and expense, to: (i) repair, Update/Upgrade or replace HDx Cognition so that it is non-infringing (providing the repaired or replaced software has the same, or substantially similar, functionality as HDx Cognition), or (ii) acquire a licence for Customer to continue to use HDx Cognition. Head Diagnostics is unable, after using commercially reasonable efforts, to either repair, Update/Upgrade, or replace HDx Cognition so that it is non-infringing, or acquire a licence for Customer to continue to use HDx Cognition, either Party may terminate this Agreement upon written notice to the other Party. This clause states Customer's sole and exclusive remedy, and Head Diagnostics' sole and exclusive obligation, with respect to an Infringement Claim.
3. Head Diagnostics shall have no obligations under this clause, to the extent the Infringement Claim arises as a result of: (i) modifications of HDx Cognition by Customer, or third parties authorised by Customer, (ii) the use of HDx Cognition in connection with any software, hardware, or other technology not provided for, or authorised by Head Diagnostics, or (iii) use of HDx Cognition, by or on behalf of Customer, contrary to this Agreement.
4. This clause 5 states the entire liability of Head Diagnostics to Customer with respect to the violation and infringement of Intellectual Property Rights.
5. Customer shall indemnify, and hold harmless, Head Diagnostics, against any loss, damage, liability, or costs (including reasonable legal fees) incurred by Head Diagnostics, as a result of any claims, demands, suits, or any other causes of action made, or brought, against Head Diagnostics, or any of its Affiliates, and each of their respective officers, directors, employees, and agents, or any of them, by a third party arising out of, or related to: (i) Customer's use of HDx Cognition, (ii) Customer's breach of any of its representations, warranties, undertakings, or commitments in this Agreement, and/or (iii) Customer's negligence or wilful misconduct, or that of any User(s).
6. Head Diagnostics shall promptly give written notice of any claim, demand, suit or other cause of action, within the scope of clause 5.5 (above), to Customer, give Customer sole control of the defence and settlement of the claim, demand, suit or other cause of action, provided that Customer may not settle or defend any such claim, demand, suit or cause of action unless it unconditionally releases Head Diagnostics of all liability, and provide Customer, at Customer's cost, all reasonable assistance in defending, and settling any such claim, demand, suit or cause of action.

Confidentiality
1. Each Party shall, for the duration of this Agreement, and for a period of 5 (five) years thereafter:
  1. keep all Confidential Information confidential and not disclose it, other than to such of its employees, or authorised subcontractors, as will of necessity require it as a consequence of this Agreement (in which case the relevant Party shall ensure that each such employee or subcontractor shall comply with all obligations in this clause 6);
  2. use Confidential Information only in connection with this Agreement; and
  3. protect the other Party's Confidential Information against disclosure in the same manner, and with the same degree of care, but no less than a reasonable degree of care, with which the receiving Party protects its own Confidential Information.
2. Notwithstanding the foregoing, in the case of encrypted Confidential Information, or Confidential Information marked as a "trade secret", the Parties shall comply with their obligations under this clause 6 in perpetuity.
3. The foregoing shall not preclude either Party from complying with a judicial or governmental order requiring disclosure of Confidential Information, provided that the receiving party, promptly after learning of such action, notifies the disclosing party in order to give disclosing party the opportunity to seek legal remedies to preserve the confidential nature thereof (unless such notification would be contrary to Applicable Laws).
4. The obligations of confidentiality shall not apply to information that:
  1. was known, and on record with, the receiving party prior to the disclosure by the disclosing party, as demonstrated by written evidence;
  2. is, or becomes, a part of the public domain without violation of this Agreement;
  3. is lawfully obtained by the receiving party from a third party without any breach of confidentiality, or violation of Applicable Laws, by such third party; or
  4. is developed by the receiving party independent from any disclosure by the disclosing party under this Agreement, as demonstrated by written evidence.
5. The Parties further agree that:
  1. upon the written request of the disclosing party, the receiving party shall either securely return, or securely destroy, all Confidential Information received in written, or other tangible form, including all copies thereof, at the request of the other party, and shall certify such destruction in writing within 30 calendar days of such request; and
  2. the receiving party may retain 1 (one) copy of any Confidential Information that is legally required to be retained, provided that such Confidential Information is retained in accordance with the terms of this Agreement, and Applicable Laws.

Audit Rights and Licence Management
1. For the duration of this Agreement and for a period of 6 (six) months after its termination (except where a longer period is required by Applicable Laws, then such longer period shall apply), Customer shall allow Head Diagnostics to carry out audits, including (without limitation) electronic audits, of Customer's use of HDx Cognition Platform in order to verify Customer's compliance with the terms of this Agreement and/or Applicable Laws.
2. The audit shall be conducted at Head Diagnostics' expense, unless the results of such an audit establish that Customer's use of HDx Cognition is not in compliance with the terms of this Agreement and/or Applicable Laws. If any audit by Head Diagnostics yields any deficiency in the Fees paid to Head Diagnostics, Customer shall promptly remit payment to Head Diagnostics of such amounts, plus interest calculated at the maximum rate allowed under Applicable Laws.
3. HDx Cognition incorporates licence management tools and technology to ensure Customer complies with this Agreement, and to allow Head Diagnostics to exercise self-help remedies in the event that Customer breaches this Agreement, including the ability of Head Diagnostics to temporarily, or permanently, suspend Customer's use of HDx Cognition. Head Diagnostics will not exercise any such self-help remedies without prior written notice to Customer, unless such prior written notice is reasonably not possible, for instance with regard to the protection of the security of HDx Cognition, or where the provision of such notice would violate Applicable Laws. Customer consents to such licence management tools and technology, and authorises Head Diagnostics to exercise any, or all, of the capabilities thereof in the event Customer breaches any provision of this Agreement and/or fails to cure such breach within 30 calendar days.

Representations and Warranties
1. Each party represents that it has the legal power and authority to enter into this Agreement.
2. Head Diagnostics warrants that: (i) it will provide the Services in accordance with General Industry Standards, (ii) HDx Cognition shall perform materially in accordance with the Documentation, and (iii) it has sufficient rights in HDx Cognition to grant Customer the rights granted herein.
3. If the warranty described in clause 8.2 (ii) is breached, Customer must promptly notify Head Diagnostics in writing. If Head Diagnostics receives such notice promptly after the failure occurred, Head Diagnostics shall use commercially reasonable efforts to repair or replace Customer's instance of HDx Cognition to make it perform in accordance with the Documentation. If, after using commercially reasonable efforts, Head Diagnostics is not able to replace or repair Customer's instance of HDx Cognition, Customer may terminate this Agreement upon written notice to Head Diagnostics. The foregoing are Customer's sole and exclusive remedies for breach of this warranty.
4. The warranties set forth in clause 8.1 and clause 8.2:
  1. shall not apply if: (i) HDx Cognition, Updates, and Upgrades, have not been properly and timely installed by Customer, and used at all times in accordance with the Agreement, Documentation, Applicable Laws, and supported platforms, (ii) Customer (either itself, or via a third party on its behalf) has modified HDx Cognition, (iii) Customer has combined HDx Cognition with other software, or hardware, that is not in accordance with the Documentation, or (iv) Customer did not provide prompt notice to Head Diagnostics as set forth in clause 8.3;
  2. shall not apply to Third Party Products and Services (regardless of whether obtained from Head Diagnostics or another source). Warranties for Third Party Products and Services may (if any) be supplied directly by the manufacturers thereof and Customer shall only seek any remedies against such manufacturers;
  3. are made to and for the benefit of Customer only.
5. Except as specifically set forth in this Agreement, and except to the extent that any warranties implied by law cannot be validly waived, Head Diagnostics makes no representations and warranties, express or implied, relating to the Services, including, but not limited to, any warranty that HDx Cognition will meet Customer's requirements, or will operate error free, or uninterrupted. Head Diagnostics specifically disclaims all implied warranties of merchantability, fitness for a particular purpose, non-infringement of third-party rights, or any warranties regarding the quality of Customer Content.

Technical Support Services
1. Technical Support Services shall be provided by Head Diagnostics to Customer according to the terms and conditions set forth in the Order Form(s), and the Service Level Agreement.
2. Head Diagnostics is not responsible, nor liable, for support of or interruption to the Services, nor for any problems due to: (1) the infrastructure, hardware, virtual machines, network (connectors), information, content, software, scripts, data, files, application programming, web servers or service materials, or equipment, (2) the acts or omissions of Customer or its agents, (3) any virus or hacker (including ethical hacker) attacks, (4) circumstances beyond Head Diagnostics' reasonable control, (5) intentional shutdown for emergency intervention, or security incidents, (6) Customer's configuration changes, (7) Customer's failure to comply with the Agreement, Head Diagnostics' Documentation, and security and upgrade policies, (8) Internet or other connectivity between Customer's network, servers, and/or equipment and HDx Cognition or Head Diagnostics' network, or any other network unavailability outside of the Head Diagnostics network, (9) Customer's use of HDx Cognition, and (10) the acts or omissions of a party other than Head Diagnostics.
3. Customer is entitled to request more, or different, services from Head Diagnostics at any time. If Customer desires to receive additional support services in addition to the Technical Support Services described in the Order Form(s), such services may be arranged and separately agreed between Head Diagnostics and Customer in additional Order Form(s), subject to their availability at, and feasibility for, Head Diagnostics.
4. Head Diagnostics is not obliged to provide any Technical Support Services for Third Party Products and Services (regardless of whether obtained from Head Diagnostics or another source), including (without limitation) Customer's networks or installation of networks.

Fees and Payment
1. Customer shall pay all Fees. All Fees are non-cancellable and non-refundable. Customer acknowledges that Fees are dependent on a number of variables as set forth in the Order Form(s). All Fees are due and payable within 10 calendar days from the date of any invoice. Fees are payable in accordance with the payment mechanism(s) as notified by Head Diagnostics and may be amended from time to time. Any payment not made when due will bear interest from the date due until paid at the statutory rate. Customer will also be liable for all reasonable costs incurred by Head Diagnostics to collect any past due payments, including (extra) judicial and other legal (attorney's) fees. Customer may not offset an obligation to pay any charges, costs or Fees provided for in this Agreement against any claim it may have against Head Diagnostics.
2. If Customer's account is due for more than 30 calendar days from the invoice date (except with respect to charges then under reasonable and good faith dispute), in addition to any of its other rights or remedies, Head Diagnostics reserves the right to suspend the Services provided to Customer, without liability to Customer, until such amounts are paid in full, provided that Head Diagnostics will provide prior written notice to Customer of its intent to suspend the Services.
3. If either Party terminates this agreement under clause 12.2, Customer must pay the Fees for the calendar month of termination. Head Diagnostics will not charge any Fees for the following month, and Customer will only have access to HDx Cognition until the end of the calendar month of termination.
4. Any time after 1 (one) year following the Effective Date, and not more frequently than once annually thereafter, Head Diagnostics may increase the Fees upon 30 calendar days written notice to Customer, and Customer agrees to pay any the Fees as so increased.
5. All on-site Technical Support Services will be billable according to the Fees set out in the Order Form(s), or, if no such fee is set out in the same, to Head Diagnostics' then-current rates, plus reasonable travel and lodging expenses.
6. The assessments that are purchased via the Order Form(s) are valid for 1 (one) month after the moment of purchase.
7. All prices are exclusive of VAT and other taxes, if any, on the Services, all sales, use, and other taxes and charges required to be remitted by Head Diagnostics shall be payable by Customer upon invoice by Head Diagnostics.

Limitation of Liability
1. To the maximum extent permitted by Applicable Laws, the total aggregate liability of Head Diagnostics, its employees, officers, and Affiliates, for all loss and damage whatsoever and howsoever arising related to this Agreement, Schedules, Order Form(s) and Related Documents shall be limited to the total of HDx Cognition Fee paid by Customer during the 12 calendar months immediately preceding the date on which the claim arose.
2. Head Diagnostics, its employees, officers, and Affiliates, shall have no liability for special, indirect, consequential, exemplary, or incidental damages, or for any damages whatsoever, or howsoever, including (without limitation) loss of use, loss of data, loss of profits, loss of goodwill, additional employee hours, or loss of anticipated savings arising out of, or in connection with this Agreement, or the performance thereof, even if Head Diagnostics has been advised of the possibility of such losses or damages.
3. Nothing herein shall operate, or be construed so as to operate to exclude or limit the liability of a Party in respect of death, fraud, or gross negligence, or for any liability which cannot, by Applicable Laws, be so excluded, or limited.
4. Customer understands and agrees that Head Diagnostics is not engaged in the practice of medicine and that HDx Cognition is an information tool only and is not a substitute for professional judgment of healthcare providers in diagnosing and treating patients. Customer shall indemnify Head Diagnostics fully, and shall hold Head Diagnostics harmless against any losses, or liability, in connection with any claim arising due to Customer's use of HDx Cognition in reliance solely upon the Services, or its output, for purposes of diagnosis or treatment.

Term and Termination
1. This Agreement enters into effect on the Effective Date and shall remain in effect by way of being automatically extended on a monthly basis, subject to Customer paying the then-current Fees, unless earlier terminated as provided for in this Agreement.
2. Either Party may terminate this Agreement by providing the other Party with a written notice stating it does not wish to extend the Term beyond the calendar month. Customer acknowledges that its use of HDx Cognition is not business critical, and if either Party terminates this Agreement in accordance with this clause 12.2 it shall have no liability to the other Party (other than that set out under clause 12.1 above) as a result of such termination.
3. Without prejudice to any other rights and obligations under this Agreement, or at law, Head Diagnostics may terminate this Agreement immediately by notifying Customer if any of the following events occur: (i) Customer directly, or indirectly, discloses, or provides, HDx Cognition to any third party not authorised under the terms of this Agreement, (ii) Customer has ceased to exist, or has been dissolved, (iii) Customer suffers an Insolvency Event, (iv) Customer's business has been discontinued, (v) a person other than Customer's current (ultimate) parent company has become holder of more than 50% (fifty per cent) of the shares in Customer's share capital, or is actually capable, whether or not pursuant to an agreement with other persons with voting rights, of determining the outcome of votes in the general shareholders' meeting of Customer, or has legally merged with Customer, and (vi) Customer fails to comply with its obligations under clause 3.
4. Furthermore, in addition to any of its other rights or remedies, Head Diagnostics may, at its sole discretion, suspend the Services, if Customer has failed to perform any obligation under this Agreement, where such failure is irremediable, or if such failure is remediable, fails to remedy it within 30 calendar days after being notified in writing to do so.
5. Upon termination or expiration of this Agreement, Customer shall immediately cease using HDx Cognition and return all Confidential Information to Head Diagnostics, certify to Head Diagnostics that Customer has retained no copies thereof, and acknowledge that it may no longer use HDx Cognition. In the event of termination through Customer's breach, all Fees or charges due for the remaining period of the then-current Term shall immediately become due and payable. Upon termination of the licence, Head Diagnostics' obligations under this Agreement shall cease. The provisions of clauses 3, 5, 6, 7, 9, 10, 11, 12.5, 12.6, 13 and 14 shall survive any termination, or expiration, of this Agreement.
6. Upon the effective date of termination, or expiration, of this Agreement, Head Diagnostics shall have no obligation to maintain or provide any Customer Content and shall have the right, unless legally prohibited, to delete all such Customer Content in its systems, or otherwise in its possession, or under its control.

Export Control
1. Customer understands that certain transactions of Head Diagnostics are subject to export control laws and regulations, such as but not limited to the UN, EU and the USA export control laws and regulations, ("Export Regulations") which prohibit export or diversion of certain products and technology to certain countries. Any and all obligations of Head Diagnostics to export, re-export or transfer HDx Cognition, the Services as well as any Documentation, technical assistance, training, investments, financial assistance, financing and brokering will be subject in all respects to such Export Regulations and will from time to time govern the licence and delivery of HDx Cognition, the Services, Documentation and technology abroad by persons subject to the jurisdiction of the relevant authorities responsible for such Export Regulations. If the delivery of HDx Cognition, the Services and/or Documentation is subject to the granting of an export or import licence by certain governmental authorities, or otherwise restricted, or prohibited due to export/import control regulations, Head Diagnostics may suspend its obligations and Customer's or end-user's rights until such licence is granted, or for the duration of such restrictions or prohibitions. Furthermore, Head Diagnostics may even terminate the relevant order in all cases without incurring any liability towards Customer or end-users.
2. Customer warrants that it will comply in all respects with the export, re-export, and transfer restrictions set forth in such Export Regulations or in export licences (if any) for HDx Cognition, the Services and Documentation supplied to Customer. Customer accepts the responsibility to impose all export control restrictions on any third party if the items are transferred, or re-exported to third parties. Customer shall take all actions that may be reasonably necessary to ensure that no third parties (including its customers and end-users) contravene such Export Regulations. Customer shall indemnify Head Diagnostics against any and all direct, indirect, and punitive damages, loss, costs (including attorney's fees and costs) and other liability arising from claims resulting from Customer's, or its customers' breach, or non-compliance with this clause 13.

Miscellaneous
1. This Agreement, all transactions contemplated by it, and any non-contractual obligations arising out of, or in connection with, it shall be governed by the laws of Ireland, and the courts of Ireland shall have non-exclusive jurisdiction to determine any dispute arising out of, or in connection, with this Agreement (including without limitation in relation to any non-contractual obligations).
2. This Agreement, including all Schedules and annexes that refer to this Agreement, and are agreed to by both Parties, constitutes the entire agreement between the Parties, superseding all prior oral or written representations, agreements, or understandings with respect to the subject matter hereof and thereof. There are no representations, warranties, conditions, guarantees or agreements relating to such subject matter except those expressly stated in this Agreement. If there is any conflict between the provisions of the Schedules, or annexes to this Agreement, the following order of precedence applies:
  1. the Privacy and Data Protection Schedule to this Agreement;
  2. HDx Cognition terms and conditions;
  3. the Service Level Agreement Schedule to this Agreement;
  4. any Order Form(s), except for any explicit exclusions contained therein.
3. Customer's general terms and conditions shall not apply to the Agreement and are hereby expressly rejected, regardless of whether Customer refers to those terms and conditions in a request for a quotation or other communication addressed to Head Diagnostics.
4. Customer shall not sell, transfer, assign or otherwise convey this Agreement, or any of Customer's rights or obligations hereunder without the prior written consent of Head Diagnostics, including without limitation by operation of law to a successor in interest in connection with a merger, consolidation, sale of shares or assets or other change of control transaction involving Customer. The purported transferee shall first be required to agree in writing with Head Diagnostics to assume and perform all Customer's obligations under this Agreement. Any attempt to assign this Agreement without Head Diagnostics' prior written consent shall be void. This Agreement shall be binding upon, and inure to the benefit of, Customer and its successors and permitted assigns.
5. All formal and/or legal notices required, or permitted, under this Agreement shall be in writing and shall be mailed by certified, or registered mail (postage prepaid), delivered either by hand or by messenger, or emailed at the addresses described in the Order Form, or at such other address as either Party shall have furnished to the other in writing. All such notices shall be effective: (i) if posted, 7 calendar days after the date of the registered post, (ii) if delivered by hand, upon delivery, or (iii) if emailed, upon confirmation of receipt of the email by the other Party.
6. Head Diagnostics will not be in breach of this Agreement if its performance is prevented or delayed for circumstances beyond its control. Head Diagnostics is excused from performing under this Agreement when Head Diagnostics' delay or failure to perform is caused by events beyond Head Diagnostics reasonable control including, but not limited to, acts of God, acts or omissions of third parties, acts or omissions of Customer, acts of any civil or military authority, fire, floods, war, terrorism, embargoes, labour disputes, acts of sabotage, riots, accidents, delays of carriers, epidemics or pandemics, subcontractors or suppliers, non-availability of any permits, licences and/or authorisations required, voluntary or mandatory compliance with any government act, regulation or request, shortage of labour, materials or manufacturing facilities.
7. Unless expressly agreed upon between Parties in writing, any hours and dates specified in the Order Form(s), including (without limitation) with regard to Services, and milestones, are estimates only and are solely intended for Head Diagnostics' budgeting purposes and resource scheduling purposes, and the exceeding of any estimate does not constitute a breach of this Agreement by Head Diagnostics.
8. Upon prior notice to Customer, Head Diagnostics is entitled to transfer, assign, or otherwise convey this Agreement, or any its rights or obligations hereunder to its Affiliate(s), which Customer hereby accepts.
9. Customer agrees that certain breaches of this Agreement by it may result in irreparable harm to Head Diagnostics, the extent of which would be difficult and/or impracticable to assess, and where money damages would not be an adequate remedy for such breach. Accordingly, Head Diagnostics shall be entitled to seek any and all remedies available at law, or in equity, including without limitation injunctive relief or specific performance.
10. Head Diagnostics is Customer's independent contractor. Head Diagnostics' employees are under Head Diagnostics' exclusive direction and control. Head Diagnostics' subcontractor's employees are under Head Diagnostics' subcontractor's exclusive direction and control. Nothing in this Agreement will be construed to designate Head Diagnostics or any of Head Diagnostics' employees or Head Diagnostics' subcontractors or any of their employees as Customer's employees, agents, joint venturers, or partners.
11. This Agreement will not be construed as creating an agency, partnership, joint venture or any other form of association between the Parties, and both Parties will be and remain independent entities.
12. Head Diagnostics may subcontract to contractors of Head Diagnostics' choice any of its obligations towards Customer, or other activities performed by Head Diagnostics under this Agreement. No such subcontract will release Head Diagnostics from those obligations to Customer.

Annex A – Customer Requirements

In order to use HDx Cognition, Customer must supply versions of:

Apple iPad Pro
Model	Release date	Minimum version of iOS	Minimum capacity
iPad Pro (3rd Generation) 12.9 inch, Wi-Fi (+ optionally cellular)	November 7, 2018	16	64 GB
iPad Pro (4th Generation) 12.9 inch, Wi-Fi (+ optionally cellular)	March 25, 2020	16	128 GB
iPad Pro (5th Generation) 12.9 inch, Wi-Fi (+ optionally cellular)	March 25, 2021	16	128 GB
iPad Pro (6th Generation) 12.9 inch, Wi-Fi (+ optionally cellular)	October 26, 2022	17.5	128 GB
iPad Pro (7th Generation) 13 inch, Wi-Fi (+ optionally cellular)	May 15, 2024	17.5	256 GB
iPad Air (6th Generation) 13 inch, WiFi (+ optionally Cellular)	May 15, 2024	18.3	128 GB
iPad Air (7th Generation) 13 inch, WiFi (+ optionally Cellular)	March 12, 2025	18.3	128 GB

Apple Pencil
Model	Release Date
Apple Pencil (2nd Generation)	November 7, 2018
Apple Pencil Pro	May 7, 2024
Apple Pencil USB-C	November 1, 2023

Laptop or desktop with browser
Platform	Operating System	Browser
Windows	Windows 10, Windows 11	Chrome
Mac	OSX 13.0 or higher	Chrome preferred, Safari

Recommended specifications of the laptop or desktop
Hardware	Recommended
Processor	2.5 GHz
Screen Resolution	Minimum: 1024 x 768
RAM	8 GB

IT infrastructure requirements
Type	Requirement
Internet Speed	Each connected iPad Pro and computer requires a stable Wi-Fi and internet connection of at least 5 Mbps
Ports	Port 443 of the Philips cloud should be accessible from the iPad Pro and computer
App Store	The iPad Pro should be able to download and install the TestFlight and HDx Cognition application from the Apple App Store

Annex B – Functional and Technical Specification of the Application(s)/Solution

HDx Cognition is intended to be used and operated only in accordance with its safety procedures and operating instructions for use, and for the purposes for which it was designed. The purpose for which the product is intended is given below. However, nothing stated below or in the instructions for use reduces the Users' responsibilities for sound clinical judgment and best clinical procedure.

HDx Cognition tool is intended to be used as an adjunctive tool in the assessment of an adults' level of cognitive functioning.
HDx Cognition tool provides healthcare professionals with an overview of specific cognitive domains.
HDx Cognition tool provides healthcare professionals with a method to compare a person's cognitive performance over different assessments (moments in time).
The results from HDx Cognition tool are intended to be used by healthcare professionals who have participated in HDx Cognition training programme.
The data collected by HDx Cognition is intended to be collected under the supervision of a healthcare professional.
HDx Cognition tool is not intended as a stand-alone diagnostic device.
HDx Cognition tool does not identify the presence or absence of clinical diagnoses.
The assessments provided via HDx Cognition tool may be used for a wide variety of patient groups, as well as healthy individuals when a healthcare professional wishes to gain more insight into cognitive performance.

Schedule 1 – Service Level Agreement

Customer Responsibilities
1. Primary User Support. Customer is responsible for first line-support ("Primary User Support") by providing local support personnel, processes, and structure to accommodate and resolve User issues/problems by:
  1. Appointing a Key User who is the "go-to person" within Customer's own organisation for HDx Cognition.
  2. Collecting all the reasonably necessary information as requested by Head Diagnostics to assist Head Diagnostics in providing the Technical Support Services.
  3. Coordinating support requirements with Head Diagnostics and working directly with Users on all matters pertaining to the Users' needs.
  4. Interacting directly with Users, including responding to technical questions (of the nature and type which should be answerable by a technical support person who is familiar with HDx Cognition including, but not limited to, issue assessment in respect of hardware, servers, networks and training) and which could include tasks such as power check, configuration check, network check, etc.
2. Technical contact. Customer shall appoint a point of contact for Head Diagnostics (may be the same as the Key User) who pre-warns and instructs Users with regard to planned Upgrades and the associated unavailability of HDx Cognition Platform (scheduled downtime) and who shall ensure that Head Diagnostics will have access to the hospital site and network, as applicable, as well as provide to Head Diagnostics the necessary support, such as but not limited to IP addresses and network protocols. Customer contact shall also be responsible for organizing any necessary training, in conjunction with Head Diagnostics, for new or existing versions of HDx Cognition.
Technical Support Services
1. Scope. The Technical Support Services consist of:
  1. Notification to Customer in writing of upgrades, modifications, and alterations to HDx Cognition (such notices being referred to as "Release Notes"). Head Diagnostics accepts no responsibility, or liability, in respect of any such recommendation where Customer has not carried out all other relevant recommendations contained in other Release Notes received by Customer.
  2. Investigation and identification, where possible, of suspected faults (incidents) associated with HDx Cognition reported by Customer.
  3. Where appropriate, supply of temporary software work-rounds, or software patches, to overcome specific faults or problems reported by Customer.
  4. Technical advice given by telephone or email to Customer only through Head Diagnostics support team in relation to HDx Cognition. Such advice will include:
    1. General advice on system operation and housekeeping;
    2. If requested, and where possible, advice on data which has been accidentally deleted by Customer;
    3. Advisory support associated with Upgrades, Updates, or changes;
    4. Application support via telephone or email from Customer only through Head Diagnostics support team in relation to HDx Cognition;
    5. On-site support (at Head Diagnostics discretion). In the event that telephone assistance, and/or remote problem resolution, is deemed not sufficient to restore system performance;
    6. Notification in writing if a security related patch cannot be deployed within the timeframe specified:
      - Within 30 calendar days for critical vulnerabilities;
      - Within 90 calendar days for important vulnerabilities;
      - Within 6 months for all other vulnerabilities.
  The definitions of vulnerabilities are in line with Head Diagnostics cyber security policy.
2. Accessibility of Technical Support Services. The Technical Support Services are accessible during Coverage Hours as stated in the Service Level Summary.
3. Additional charges. Head Diagnostics reserves the right to make additional charges for any work undertaken, or providing any support services, outside the Coverage Hours. Such charges shall be at the discretion of Head Diagnostics and agreed in writing with Customer before commencing.
4. Downtime of HDx Cognition. Downtime of HDx Cognition shall be kept to a minimum. However, Customer acknowledges that such downtime cannot be avoided and can be significant (days). Head Diagnostics shall inform Customer when downtime will take place, and what the expected downtime will be, to enable Customer to adjust their work-planning accordingly. Head Diagnostics does not provide any guarantee that the estimate of expected downtime will be always accurate and does not accept any liability for direct, indirect, or consequential damages incurred by any such downtime.
Complaint Reporting, Management and Resolution
1. Incident Reporting. For system errors, failures, faults, user problems, relating to HDx Cognition (each termed an "incident"), Customer is responsible for referring each such Incident to Head Diagnostics support team as follows:
  1. By e-mail to the Head Diagnostics email address provided in the Order Form. Customer should provide Head Diagnostics with as much relevant information as possible e.g. the patient file affected, the module and screen being accessed at the time, the action being undertaken, any error message displayed, the frequency, implications, and urgency of the issue etc.
  2. In the case of Level 1 or 2 issues only, also by telephone to Head Diagnostics support team on the designated telephone numbers. All Priority 1 or 2 incidents referred by telephone MUST also be followed up by email to Head Diagnostics support team.
2. Logging. Head Diagnostics shall log all incidents on the incident reporting system used by the Head Diagnostics' support team, and shall issue a unique incident code number for each such incident.
3. Level Classification. Once an incident which requires remedial action has been reported to Head Diagnostics by Customer, Head Diagnostics shall assign a level to such incident using the following classification scheme:
  Level Definitions
  - Level 1 (Patient/User harm) – Potential Safety Event (PSE)
  - Level 2 (Potential Patient/User harm) – Potential Safety Alert (PSA)
  - Level 3 (No Patient/User harm)
    - (System down) – Application servers down.
    - (System restricted) – The failure causes workflow problems for Customer or they cannot perform standard functions for the delivery of patient care.
    - (Intermittent problem) – Occasionally occurring or appearing incidents.
4. Incident Management Approach. Head Diagnostics shall manage the reported incidents using the following approach:
  - Working with Customer to understand the problem and agreeing upon the definition of the problem.
  - Understanding the impact of the problem on Customer's operation.
  - Understanding Customer's needs and expectations.
  - Agreeing on an acceptable timeframe for a solution.
  - Communication on a regular basis.
  - Ensuring that Customer understands his responsibilities.
  - Agreeing to criteria for problem resolution.
  - Head Diagnostics shall continually monitor and evaluate all open incident files to ensure problems are resolved as soon as possible.
5. Technical Support Services shall only be instigated by Head Diagnostics following troubleshooting procedures performed by Customer as described in Section 1 above. It is also essential that Customer have someone technically qualified available during Coverage Hours to assist in resolving incidents, where necessary.
Upgrades
1. Software Upgrades of HDx Cognition will occur via an update of the Cloud Service and via the Apple App store.
2. Installation of new versions will be triggered by a message being sent from Head Diagnostics to Customer to install the latest version. Head Diagnostics provides no guarantee that a new release, or version, will become available in any 1 (one) calendar year. Software Upgrades will be accompanied by release notes and user manuals if applicable. No installation and other upgrade activities are included.
3. Notice of Software Upgrades. Head Diagnostics will give Customer adequate notice of forthcoming Software Upgrades.

5. Service Level Summary

		Coverage Hours
Technical Support Services	Remote Support	7AM–10AM GMT
	Emergency (Level 1, 2)	7AM–5PM GMT
	E-mail response time	24 hrs
Maintenance	Software Updates & Upgrades performed by Customer	✓
Professional Services	On-Site education	Can be purchased as additional service days.

Schedule 2 – Privacy and Data Protection Agreement

Capitalised terms in this Schedule have the meaning as defined in HDx Cognition Terms and Conditions, unless otherwise defined in this Privacy and Data Protection Agreement ("PDPA").

General
1. For the purposes of this PDPA, the terms "Controller", "Processor", "Personal Data", "Special Categories of Personal Data", "Personal Data Breach", "supervisory authority", and "processing" shall each have the meanings given to them in Data Protection Law and "process" will be construed accordingly.
2. Customer represents and warrants to Head Diagnostics that: (i) Customer has the right and the authority to provide the Personal Data to Head Diagnostics for Head Diagnostics' processing of Personal Data pursuant to this Agreement, including transfers as set out in section 4 (below), (ii) Customer has provided any required fair processing notices, and obtained any required consents, from data subjects for the purposes of Head Diagnostics' processing of their Personal Data (as required by Data Protection Law), including, but not limited to, their medical and health data, (iii) Customer is fully and solely responsible for the accuracy, legality, and consistency of the Personal Data which it provides to Head Diagnostics, and (iv) Customer's provision to Head Diagnostics of the Personal Data for the purposes of the Agreement, and Head Diagnostics' processing of the Personal Data pursuant to the Agreement, will not violate any Applicable Laws and/or Data Protection Law.
Obligations with respect to the Personal Data
1. Notwithstanding the other provisions of this Schedule 2, to the extent that Head Diagnostics, in the provision of the Services under this Agreement, acts as a Processor in respect of certain Personal Data, Head Diagnostics acknowledges and agrees that it shall:
  1. Process Personal Data only on the documented instruction of Customer, as set out in the Agreement, and/or other written communications made by Customer to Head Diagnostics ("Instruction"), including with regard to the transfer of such Personal Data to a third country, or international organisation, unless otherwise required to do so by Applicable Laws to which Head Diagnostics is subject, and in such a case, Head Diagnostics shall inform Customer of that legal requirement before undertaking any such processing, unless Applicable Law prohibits such information on important grounds of public interest.
    - Customer warrants that any Instructions given in accordance with this section 1.3.1: (a) will comply with Applicable Law, including Data Protection Law, and (b) will not cause Head Diagnostics to violate either Applicable Law, and/or Data Protection Law.
    - Further, for the avoidance of doubt, and without prejudice to other Instructions, Customer hereby instructs Head Diagnostics to process Personal Data for, or in relation to, performing the Services and other obligations under the Agreement, including, without limitation, as specified in the Agreement, and any applicable Order Form(s) and/or Service Level Agreements, and as necessary to comply with other reasonable instructions provided by Customer, where such instructions are consistent with the terms of the Agreement.
  2. Inform Customer if, in Head Diagnostics reasonable opinion, an Instruction given by Customer infringes Data Protection Law, or other European Union, or Member State data protection provisions.
  3. Seek to ensure that any employees, agents, directors, consultants, professional advisors, contractors and sub-contractors it authorises to Process Personal Data under this PDPA are required to maintain the confidentiality of that Personal Data (by a statutory or contractual duty), and that they process any Personal Data only for the purpose of facilitating the performance of the Services.
  4. Implement appropriate commercially reasonable technical and organisational measures to ensure a level of security appropriate to the risk to the security of the Personal Data processed pursuant to the Agreement, to protect any such Personal Data from any accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, the Personal Data in accordance with Head Diagnostics obligations under Data Protection Law.
  5. Taking into account the nature of the processing, assist Customer, including by implementing appropriate technical and organisational measures, to enable Customer to comply with its obligations under Articles 33–36 GDPR, including without limitation, to notify Customer without undue delay after becoming aware that a Personal Data Breach has occurred (unless otherwise prohibited by Applicable Law).
  6. Notify and forward to Customer any complaint, notice, or communication from a supervisory authority, data subject, or other third party, which relates to the processing of the Personal Data pursuant to the Agreement, or a potential failure to comply with Data Protection Law, and provide Customer, reasonable information, cooperation, and assistance in relation to same (unless otherwise prohibited by Applicable Law).
  7. Provide such reasonable assistance as Customer may require to assist Customer to fulfil its obligations under Data Protection Law to respond to: (i) Data Subject Requests received directly from data subjects in relation to the Processing of Personal Data on behalf of Customer, and (ii) any requests for information, complaint, assessment, or other notice of investigation, or inquiry, and/or assistance from competent supervisory authorities under Data Protection Law (unless otherwise prohibited by Applicable Law). Unless otherwise instructed in writing by Customer within 24 (twenty-four) hours of such notice by Head Diagnostics, Head Diagnostics will not reply directly to the data subject, but will seek to provide Customer with reasonable assistance in meeting the data subject's request in a timely manner.
Subprocessors
1. For the purposes of any processing of Personal Data to be carried out by Head Diagnostics under this Agreement, Customer provides a general written authorisation that Head Diagnostics may engage further processors (including Affiliates, or other third party processors) to process the Personal Data on behalf of Customer (the "Subprocessors"). The Subprocessors currently engaged by Head Diagnostics to carry out specific processing in respect of the Personal Data processed for the purposes of the Agreement will be maintained in a key list of subprocessors.
2. Notwithstanding the general written authorisation under section 3.1 above, Head Diagnostics will provide Customer with 5 (five) Business Days advance notice of any intended changes concerning the addition, or replacement of any Subprocessor so that Customer may object to this addition, or replacement, by providing objective justifiable grounds related to the ability of such Subprocessor to protect the Personal Data processed for the purposes of the Agreement, or to comply with Data Protection Law.
3. In the event that any such objection by Customer is not unreasonable, the Parties will work together in good faith to find a solution to address such objection, including, but not limited to reviewing additional documentation supporting the Subprocessors' compliance, or trying to make the Services available, without the involvement of such Subprocessor.
4. Head Diagnostics shall impose, on each Subprocessor, by means of a written contract, equivalent data protection obligations as those set out in this PDPA. Head Diagnostics shall remain liable to Customer for processing by any Subprocessor as if the processing were being conducted by Head Diagnostics.
International Transfers of Personal Data
1. Head Diagnostics shall process the Personal Data pursuant to the Agreement at its offices in Ireland. However, Head Diagnostics also relies on the support of Affiliates, and/or Subprocessors, located in both the European Economic Area ("EEA") and the United Kingdom ("UK").
2. Where Head Diagnostics needs to transfer the Personal Data processed pursuant to the Agreement to the UK for the purposes of providing the Services under the Agreement, Head Diagnostics will do so in reliance on the European Commission's Implementing Decision on the adequate protection of personal data by the UK (Decision (EU) 2021/1772 of 28 June 2021).
3. As part of the Services, Head Diagnostics may also require the support of Affiliates and/or Subprocessors located outside of the EEA, or otherwise transfer the Personal Data outside the EEA, to a country which is not subject to an adequacy decision by the European Commission (a "Restricted Transfer"). In such a case, Head Diagnostics warrants that such a Restricted Transfer shall be effected in compliance with Data Protection Law, including the provisions of Chapter V of the GDPR.
4. The Parties agree that, where the transfer of the Personal Data for the purposes of providing the Services under the Agreement, constitutes a Restricted Transfer, it shall be governed by the SCCs, which are hereby incorporated into this PDPA as Annex 1 (below). In the event that any provision of this PDPA contradicts, directly, or indirectly, the SCCs, the SCCs shall prevail.
5. If Head Diagnostics adopts an alternative lawful data transfer mechanism for the transfer of Personal Data not described in this PDPA ("Alternative Transfer Mechanism"), the Alternative Transfer Mechanism shall apply instead of any applicable transfer mechanism described in this PDPA (but only to the extent such Alternative Transfer Mechanism complies with Data Protection Law and extends to the territories to which the relevant Personal Data is transferred).
6. Customer will: (i) ensure that data subjects are adequately informed that their Personal Data may be transferred to Head Diagnostics, and its Affiliates and/or Subprocessors (as appropriate), including to countries located outside the EEA.
Audits and Inspections
1. Head Diagnostics will, at Head Diagnostics' option, and upon reasonable notice from Customer make available the facilities it uses for the processing of Personal Data for an audit and/or inspection by a qualified independent third-party assessor at Head Diagnostics' selection, and provided such auditor has executed a written confidentiality agreement reasonably acceptable to Head Diagnostics before conducting the audit.
2. Audits and/or inspections will be conducted regularly, but no more than once per year, during regular business hours, and with minimal disruption to Head Diagnostics' business, and will be subject to: (i) a written request submitted to Head Diagnostics at least 6 (six) weeks in advance of the proposed audit and/or inspection date, (ii) a detailed written audit plan reviewed and approved by Head Diagnostics, (iii) Head Diagnostics' policies, including in relation to onsite health and safety, security, and confidentiality, and (iv) Data Protection Law.
3. As soon as reasonably possible after completion of any audit and/or inspection, Head Diagnostics will (at Head Diagnostics sole discretion) choose to: (i) provide Customer with a copy of the audit report, which will be treated as confidential information pursuant to the terms of the Agreement, or (ii) provide to Customer a certification issued by a qualified independent third-party assessor that the Head Diagnostics business processes, and the procedures that involve the Processing of Personal Data, comply with this PDPA.
4. The costs of any such audits, inspections, and/or certifications conducted by Customer pursuant to this section 5 shall be at Customer's sole expense.
Liability and Indemnity
1. For the avoidance of doubt, the Parties confirm and agree that the liability provisions, including the limitation of liability provision, as agreed by the Parties under clause 11 of the Agreement will apply to this PDPA.
HIPAA Specific Provisions
1. To the extent the Personal Data processed by Head Diagnostics includes Protected Health Information ("PHI"), this section 7 applies. In case of any conflict with this section 7 and other provisions of this PDPA, the terms of this section 7 shall prevail with respect to PHI.
2. Definitions: Where not defined in this PDPA, capitalised terms in this section 7 shall have the same meaning as those terms have in the Health Insurance Portability and Accountability Act of 1996 ("HIPAA"), and/or the Privacy Rule (45 CFR, parts 160 and 164, subparts A and E), the Security Rule (45 CFR, parts 160 and part 164, subparts A and C), the Breach Notification Rule (45 CFR, part 164, subpart D) and the enforcement rules promulgated by U.S. Department of Health and Human Services.
3. Head Diagnostics' obligations: Head Diagnostics shall:
  1. Not use or disclose PHI other than as permitted or required by the Agreement or Applicable Law;
  2. Implement and maintain appropriate administrative, physical and technical safeguards in compliance with the requirements of the HIPAA Security Rule to prevent use, or disclosure of, PHI other than as provided for by the Agreement.
  3. Report to Customer any: (i) Security Incident affecting PHI of which it becomes aware, including Breaches of ePHI if and as required at 45 CFR 164.410, and (ii) Use or Disclosure of PHI not provided for by this Agreement of which it becomes aware.
  4. Ensure that any agent of Head Diagnostics, including Subprocessors, to whom Head Diagnostics provides PHI, agrees in writing to the same restrictions and conditions that apply to Head Diagnostics, in its capacity as the Business Associate, with respect to such PHI, including implementation of reasonable and appropriate safeguards to protect the PHI.
4. Permitted uses and disclosures: Head Diagnostics may:
  1. Use or disclose PHI as it deems necessary to perform its obligations under the Agreement or as otherwise permitted or required by Applicable Law. Such Use, Disclosure or request of PHI shall utilize a limited dataset if practicable, or otherwise, the minimum necessary PHI to accomplish the intended results of the Use, Disclosure or request.
  2. Use and/or Disclose the PHI in its possession for its proper management and administration, or to carry out the legal responsibilities of Head Diagnostics, provided Disclosure is Required By Law, or Head Diagnostics obtains reasonable assurances from the third party to whom the PHI is disclosed that: (A) it will be held confidentially and used and further disclosed only as Required By Law or for the purpose for which it was disclosed to that third party, and (B) that third party notifies Head Diagnostics of any instances of which it is aware in which the confidentiality of the information has been breached.
  3. Provide Data Aggregation services relating to the health care operations of Customer as permitted by Applicable Law.
  4. De-identify any PHI and Use and disclose such de-identified data, all in accordance with the de-identification requirements of the Privacy Rule.
5. Compliance with law: To the extent Head Diagnostics is to carry out one or more of Customer's obligation(s) under the Privacy Rule, Head Diagnostics shall comply with the requirements of the Privacy Rule that apply to Customer in the performance of such obligation(s).
6. Designated Record Sets: Head Diagnostics shall:
  1. Within 20 (twenty) days of receiving a written request from Customer, make PHI available to Customer as necessary for Customer to comply with its obligations under 45 CFR §164.524;
  2. Within 40 (forty) days of receiving a written request from Customer, make available to Customer PHI for amendment, and incorporate any amendments to the PHI as necessary for Customer to comply with its obligations under 45 CFR §164.526.
7. Accounting: Head Diagnostics shall, within 40 (forty) days of receiving a written request from Customer in response to a request from an Individual, make available to Customer the information required for Customer to provide an accounting of Disclosures as necessary for Customer to comply with its obligations as a Covered Entity under 45 CFR § 164.528.
8. Inspection by Secretary: In accordance with 45 C.F.R. §160.310, Head Diagnostics shall make its internal practices, books and records relating to the use and disclosure of PHI available to the Secretary for purposes of determining Head Diagnostics' compliance with the Privacy Rule.
9. Obligations of Head Diagnostics after termination: Upon expiration or termination of the Agreement, Head Diagnostics shall, with respect to PHI received from Customer, or created, maintained, or received on behalf of Customer:
  1. Retain only PHI that is necessary for Head Diagnostics to continue its proper management and administration or to carry out its legal responsibilities;
  2. Return to Customer, or destroy, the remaining PHI that Head Diagnostics still maintains, if it is feasible to do so;
  3. Continue to use appropriate safeguards, and comply with the Security Rule with respect to ePHI, to prevent Use or Disclosure of the PHI other than as provided for in this section, for as long as Head Diagnostics retains the PHI;
  4. Not use or disclose the PHI retained by Head Diagnostics other than for the purposes for which such PHI was retained and subject to the continued applicability of this PDPA; and
  5. Return to Customer or destroy the PHI retained by Head Diagnostics when it is no longer needed by Head Diagnostics for its proper management and administration or to carry out its legal responsibilities.
10. The obligations of Head Diagnostics under section 7.9 shall survive expiration or termination of the Agreement.
Termination of this PDPA
1. Each Party may terminate this PDPA in accordance with the rights and procedures set out in the Agreement.
2. Upon termination of the Agreement, Head Diagnostics will, at the option of Customer: (i) securely delete the Personal Data processed for the purposes of the Agreement, or (ii) securely return the Personal Data processed for the purposes of the Agreement, and any copies thereof, in accordance with Head Diagnostics' policies including on data exporting, except to the extent Head Diagnostics is authorised, or required by the Agreement, or Applicable Laws, to retain and process that Personal Data at Customer's sole expense.
3. In the event of any conflicts or inconsistencies between the terms of the Agreement (including its other Schedules) and the terms of this PDPA, the terms of this PDPA shall prevail with regard to the Processing of Personal Data, irrespective of any indication to the contrary in the main body of the Agreement.

Annex 1 – SCCs Addendum

This SCCs Addendum (the "Addendum") is appended to and made a part of the Agreement between the Parties subject to the European Union requirement for SCCs for the purposes of facilitating Restricted Transfers of Personal Data under the Agreement and/or PDPA. Any capitalized terms used, but not defined, in the Addendum shall have the meanings ascribed to them in the Agreement.

The Parties hereby agree to the following:

Incorporation of the SCCs: To the extent that Head Diagnostics transfers any of the Personal Data processed pursuant to the Agreement to its Affiliates and/or Subprocessors located outside of the EEA, or otherwise transfers the Personal Data outside the EEA as part of a Restricted Transfer, the Parties agree that the SCCs are incorporated herein by reference.

Selection of Modules: Notwithstanding the foregoing, the Parties agree that the following modules of the SCCs are incorporated into the Agreement:

Module Two: Transfer controller to processor.

Options in the SCCs: The following optional provisions of the SCCs are brought into effect for the purposes of this Addendum:

Clause	Module 2 – Selection
Clause 7 (Docking Clause)	Not applicable
Clause 11 (Redress)	Not applicable
Clause 9a (Prior Authorisation or General Authorisation)	Option 2 – General Authorisation
Clause 9a (Time period)	5 business days
Clause 17	Option 1 – The laws of the Member State of Ireland
Clause 18	The Member State is Ireland

Order of Precedence: Except as modified by this Addendum, the terms of the Agreement, and the PDPA, shall remain in full force and effect. In the event of any inconsistencies between this Addendum and the remainder of the Agreement, this Addendum shall control with respect to Restricted Transfers of the Personal Data processed pursuant to the Agreement.
No Waiver: Except as expressly set out herein, the execution and delivery of this Addendum shall in no way affect any of the respective rights, powers, or remedies of either Party nor constitute a waiver of any provision of the Agreement, except to the extent that any such rights, powers, or remedies conflict with this Addendum. All provisions of the Agreement, including attachments thereto, not addressed by this Addendum, remain in full force and effect.
Counterparts: This Addendum may be executed in any number of counterparts and by different parties on separate counterparts, each of which counterparts, when so executed and delivered, shall be deemed to be an original and all which counterparts, taken together, shall constitute one and the same Addendum.

SCCs – Annex I.A

For Customer	For Head Diagnostics
Signature	Signature
Printed Name	Printed Name
Address	Address Suite 3, One Earlsfort Centre, Lower Hatch Street, Dublin 2, Ireland
Position	Position
Contact person's contact details	Contact person's contact details
Date	Date
Role ☒ Controller ☐ Processor	Role ☐ Controller ☒ Processor
Data Exporter / Data Protection Officer Details	Data Importer / Data Protection Officer Details Head Diagnostics
Activities relevant to the data transferred under these Clauses: Processing of Personal Data in connection with the provision of the Services under the Agreement.

SCCs – Annex I.B – Description of Transfer

Module Two: Transfer controller to processor

*Categories of data subjects whose personal data is transferred:*	☒ Customers and clients ☒ Customer's employees, partners and vendors ☒ Customer's clients, employees, vendors, and other data subjects where relevant and/or required in the provision of professional services to Customer
*Categories of personal data transferred:*	☐ Advertising/Marketing Data ☒ Contact Data (including Names, Address, Email, Phone, etc.) ☐ Demographic Data ☐ Device Data ☒ User Data ☐ Coarse Location (Zip Code or Higher) ☐ Online or Other Account Data ☒ Professional, School, or Work Data ☐ Public Data (from governmental public records) ☒ User Input Data (Information inputted or uploaded by users) ☐ Other Data (Describe):________________________________
Sensitive data transferred (if applicable) and applied restrictions or safeguards that fully take into consideration the nature of the data and the risks involved, such as for instance strict purpose limitation, access restrictions (including access only for staff having followed specialised training), keeping a record of access to the data, restrictions for onward transfers or additional security measures:	Is sensitive data transferred? ☒ Yes ☐ No If yes, please complete – what type of sensitive information? ☐ Biometric Data ☐ Non-Public Criminal History ☐ Financial Data ☐ Governmental Identifiers ☒ Health and Medical Data ☐ Data about Children ☐ Precise Geo-Location ☐ Political, Religious, Union Beliefs ☐ Race / Ethnic Origin ☐ Sexual Orientation In relation to the safeguards implemented to protect such sensitive data please see Exhibit A above.
*The frequency of the transfer (e.g. whether the data is transferred on a one-off or continuous basis):*	☐ One-off ☒ Continuous
*Nature of the processing:*	As set out in this Agreement.
*Purpose(s) of the data transfer and further processing:*	To provide the Services pursuant to the Agreement As further specified in the Order Form(s) and/or Service Level Agreement between the Parties As further instructed by Customer ☐ Other (Describe):____________________
*The period for which the personal data will be retained, or, if that is not possible, the criteria used to determine that period:*
*For transfers to (sub-) processors, also specify subject matter, nature and duration of the processing:*	Same as above.

SCCs – Annex I.C

Module Two: Transfer controller to processor

The competent supervisory authority for the purposes of these SCCs will be the Irish Data Protection Commission.

Schedule 3 – Security Measures

Head Diagnostics Product & Services Security Policy Framework

Products and Product-related Services, such as Connected / Remote Service Infrastructure, Hosted Solutions and platforms, Customer services applications are vital assets, which are essential to Head Diagnostics business and its customers. The Head Diagnostics Product & Services Security Policy Framework contains a set of defined policies, standards, guidelines, procedures, and processes that ensures Security by Design and operational excellence. Each Head Diagnostics product or service integrates the appropriate controls applicable for the intended use and management of the product or service.

Data and System Security
Appropriate technical and organisational security controls are implemented in line with internal Head Diagnostics information security standards to ensure a level of security appropriate to the risk, taking into account the costs of implementation, the nature, scope and context of data processing and risks for the product or service. The following provides an overview of those policies, procedures and processes that comprise the technical, physical and organisational measures employed by Head Diagnostics to protect Business Customer's Individuals Personal Data (BCI Data) from misuse or accidental, unlawful or unauthorised destruction, loss, alteration, disclosure, acquisition, or access.

Human Resources Security
All Head Diagnostics Staff with access to BCI Data are trained on roles and responsibilities applicable to the extent necessary to perform their job functions and processing according to the Head Diagnostics General Business Principals. Head Diagnostics imposes confidentiality obligations on Head Diagnostics Staff that has access to BCI Data.

Risk Assessment and Management
Head Diagnostics maintains a comprehensive risk management strategy that includes a holistic risk assessment process to prevent, mitigate, and/or remediate security risks and periodically check the level of security throughout the lifecycle of the product or service. Head Diagnostics has established categorised security requirements (e.g. access controls, encryption, system hardening, patching requirements, malware protection, vulnerability management, code reviews, security training and monitoring) to ensure adequate mitigation and protection of system and information assets.

Access Controls
Role based access controls exist to restrict access to systems and data to management authorised individuals for valid business purposes only. Head Diagnostics Staff and Third Parties processing BCI Data are trained and accountable for the protection of that information and the applicable assets per defined roles.

Business Continuity
Product Security requirements ensure the ongoing integrity, availability and resilience of processing systems and services to ensure that Head Diagnostics products and services have adequate backup and restore procedures in line with the system criticality. Systems are able to continue operations at a minimum level and restore full functionality in the event of a major disruption of operations. Contingency plans and procedures are tested and verified.

Activity Logging
Head Diagnostics Security and Privacy Policies controls require appropriate logging and monitoring to enable recording of IT security-relevant actions and access to systems. Security control features, service levels and management requirements of all network services must be identified and included in any network services agreement, whether these services are provided in-house or outsourced. Also, formal procedures are required for authorizing access to systems or applications, and all user access rights and privileges must be reviewed at regular intervals.

Security Incidents and Breach Notification
All employees, contractors, and third-party users of information systems and services are required to note and report any observed or suspected security weaknesses in systems or services, through management channels, to Head Diagnostics PSIRT (Product Security Incident Response Team) for investigation and follow-up, as appropriate. Product & Services Security incidents that involve personal data or that may have privacy implications shall also be reported to the applicable Privacy Officer.

Head Diagnostics shall notify the Business Customer of a Personal Data Breach as required by law or as soon as reasonably possible, following discovery of such breach, unless a law enforcement official or supervisory authority determines that notification would impede a (criminal) investigation or cause damage to national security or the trust in the relevant industry sector. In this case, notification shall be delayed as instructed by such law enforcement official or supervisory authority. Head Diagnostics shall respond promptly to inquiries of the Business Customer relating to such a Personal Data Breach.

Compliance
Head Diagnostics has a standing security officer that regularly monitors the implemented security measures and implementation of new security requirements. Compliance with Head Diagnostics Product & Services Security Policies is accomplished through annual training, periodic reviews of local and organisation-wide policies and procedures, and audits.

Head Diagnostics Remote Service Network
The Head Diagnostics Remote Services operating environment implements security controls that meet the internationally recognized ISO 27001 information security management systems standard and is audited annually by an independent third party.

Leave us a little info, and we’ll be in touch.

Contact
info@headdiagnostics.com

Assistance hours:
Monday – Friday
9 am to 6 pm CET

Post Address
Nova UCD, Belfield Innovation Park, Stillorgan, Dublin, Ireland.

HDx Cognition
hdxcognition@headdiagnostics.com