Cloud Services Agreement

Document: iCenna Cloud Services Agreement (CSA)

Version: 1.0

Effective Date: 14 August 2026

This Cloud Services Agreement (this “Agreement”) is entered into between iCenna Company, a company incorporated in the Kingdom of Saudi Arabia with commercial registration number 4030497928 and registered address at 8125 Prince Sultan Street, 2086 Ar Rawdah District, Jeddah 23435, Kingdom of Saudi Arabia (“iCenna”, “we”, “us” or “our”) and the customer identified in the applicable Sales Order (“Customer”, “You” or “Your”). This Agreement governs all Sales Orders for iCenna cloud services placed under it.

1. Definitions

“Sales Order” means the ordering document or online order agreed between the parties that identifies the Services purchased, the fees, the Services Period, and any service-specific terms, and that is governed by this Agreement.

“Services” means the iCenna cloud services described in Your Sales Order.

“Services Period” means the subscription period for the Services stated in Your Sales Order, unless earlier terminated in accordance with this Agreement.

“Service Specifications” means the iCenna Cloud Service Policy (available at https://iCenna.com/cloud-service-policy), the DPA, the iCenna Privacy Policy (available at https://iCenna.com/privacy-policy), the service documentation, and any other documents referenced in Your Sales Order, each as updated from time to time in accordance with this Agreement and incorporated herein by reference.

“DPA” means the iCenna Data Processing Agreement, available at https://iCenna.com/data-processing-agreement, incorporated into this Agreement by reference. The version in effect at the start of Your Sales Order remains in force during its Services Period.

“PDPL” means the Personal Data Protection Law of the Kingdom of Saudi Arabia and its Implementing Regulations, as amended. “Personal Data”, “Controller” and “Processor” have the meanings given in the PDPL.

“Users” means Your employees, practitioners, contractors and — where the Services are designed for it — Your patients and other third parties authorised by You to use the Services under this Agreement and Your Sales Order.

“Your Content” means all data, records, text, images and other material (including Patient Data and other Personal Data) submitted to the Services by You or Your Users. The Services, iCenna software, documentation and iCenna intellectual property do not constitute Your Content.

“Patient Data” means Personal Data relating to patients, including health data, contained in Your Content.

“Third Party Services” means third-party platforms, content, products and services that the Services may interoperate with or enable You to access, including national health platforms, payer and insurance systems, and messaging or payment providers.

“Service Analyses” means aggregated and de-identified statistical data compiled by iCenna regarding the performance, operation and use of the Services, which does not identify You, Your Users or any patient and does not include Personal Data.

“Confidential Information” has the meaning given in Section 5.1.

2. The Services

2.1. We will make the Services available to You during the Services Period. You have a non-exclusive, non-transferable, limited right to access and use the Services during the Services Period solely for Your internal business and clinical operations, in accordance with this Agreement, Your Sales Order and the Service Specifications.

2.2. You may permit Your Users to use the Services and You are responsible for their compliance with this Agreement and Your Sales Order.

2.3. We may update the Services and Service Specifications from time to time to reflect changes in law, regulation, technology and industry practice, provided such updates do not materially reduce the performance, functionality, security or availability of the Services during the Services Period. Current versions of the Service Specifications are posted at the URLs stated in Section 1.

2.4. Acceptable use. You may not, and may not permit others to: (a) use the Services in violation of applicable law or to store or transmit unlawful, defamatory or infringing material; (b) attempt to gain unauthorised access to, or disrupt, the Services or their related systems; (c) perform or disclose penetration, vulnerability or benchmarking testing of the Services without our prior written approval; (d) copy, modify, reverse engineer or create derivative works of the Services except as permitted by mandatory law; (e) sublicense, resell or make the Services available to any third party except Users; or (f) use the Services to build a competing product. We may take reasonable remedial action, including removing or disabling access to material, if this Section is violated.

3. Fees and Payment

3.1. You will pay the fees stated in Your Sales Order. Unless the Sales Order states otherwise, invoices are due within thirty (30) days of the invoice date. Sales Orders are non-cancellable and fees paid are non-refundable, except as expressly provided in this Agreement.

3.2. Fees are exclusive of value-added tax (VAT) and any other applicable taxes, which You will pay in addition, except taxes based on our income. If You exceed the usage quantities in Your Sales Order, You will promptly purchase and pay for the excess quantity at the rates in Your Sales Order.

3.3. We may charge late payment on overdue undisputed amounts as permitted by applicable law, and may suspend the Services under Section 9.3 for non-payment.

4. Ownership Rights

4.1. You or Your licensors retain all rights, title and interest in and to Your Content. We and our licensors retain all rights, title and interest in and to the Services, the underlying software, documentation, and all derivative works and improvements thereof.

4.2. You grant us the right to host, process, transmit and display Your Content solely as necessary to provide the Services in accordance with this Agreement, the DPA and Your Sales Order. You are responsible for the accuracy, legality and appropriateness of Your Content and for obtaining all rights, consents and authorisations required for us to process it (including patient notices and consents required under applicable health and data protection laws).

4.3. We may compile and use Service Analyses for security, operations management, and improvement of our products.

5. Confidentiality

5.1. Each party may receive information of the other that is confidential (“Confidential Information”), including the terms and pricing of this Agreement and each Sales Order, Your Content, and information identified as confidential or that ought reasonably to be treated as confidential. Confidential Information excludes information that is or becomes public through no fault of the recipient, was lawfully known to the recipient without restriction, is received from a third party without breach of an obligation, or is independently developed.

5.2. The recipient will protect the discloser’s Confidential Information with at least the same care it uses for its own (and no less than reasonable care), use it only to perform this Agreement, and disclose it only to employees, advisers and subcontractors who need to know it and are bound by obligations no less protective. These obligations apply for five (5) years after disclosure; for Your Content, they apply for as long as Your Content resides in the Services. A party may disclose Confidential Information where required by law, regulation or a competent authority, giving prior notice where lawfully permitted.

6. Data Protection and Security

6.1. We will implement and maintain the administrative, physical and technical safeguards described in the iCenna Cloud Service Policy, and will not materially diminish the overall security of the Services during the Services Period.

6.2. To the extent Your Content includes Personal Data, the parties will comply with the DPA. For the purposes of the PDPL, You act as the Controller and iCenna acts as the Processor of Personal Data in Your Content. In the event of conflict between this Agreement and the DPA with respect to the processing of Personal Data, the DPA prevails.

6.3. The Services are designed to support customers subject to healthcare regulation in the Kingdom of Saudi Arabia. You remain solely responsible for Your own regulatory compliance, including obligations under the PDPL, Ministry of Health requirements, and any licensing, records-retention or reporting obligations that apply to You as a healthcare provider. Prior to placing a Sales Order, You are responsible for determining that the Services meet Your technical, business and regulatory requirements.

6.4. You are responsible for: (a) the security and confidentiality of User credentials and for all activities under User accounts; (b) any required notices to and consents from patients and other data subjects; and (c) any vulnerabilities or harmful code introduced through Your Content or Your systems. Where You export or transmit Your Content outside the Services, we are not responsible for its security or confidentiality outside our control.

7. Warranties, Disclaimers and Exclusive Remedies

7.1. Each party represents that it has validly entered into this Agreement and has the power and authority to do so. We warrant that during the Services Period we will perform the Services with commercially reasonable care and skill and in all material respects as described in the Service Specifications (the “Services Warranty”). You must notify us in writing of any breach of the Services Warranty, describing the deficiency, promptly after becoming aware of it.

7.2. WE DO NOT WARRANT THAT THE SERVICES WILL BE ERROR-FREE OR UNINTERRUPTED, THAT ALL ERRORS WILL BE CORRECTED, OR THAT THE SERVICES WILL MEET ALL OF YOUR REQUIREMENTS. WE ARE NOT RESPONSIBLE FOR ISSUES ARISING FROM YOUR CONTENT, YOUR SYSTEMS, THIRD PARTY CONTENT OR THIRD PARTY SERVICES. THE SERVICES ARE AN ADMINISTRATIVE AND INFORMATION-MANAGEMENT TOOL AND DO NOT PROVIDE MEDICAL ADVICE; ALL CLINICAL DECISIONS REMAIN THE SOLE RESPONSIBILITY OF YOU AND YOUR QUALIFIED PRACTITIONERS.

7.3. FOR ANY BREACH OF THE SERVICES WARRANTY, YOUR EXCLUSIVE REMEDY AND OUR ENTIRE LIABILITY SHALL BE THE CORRECTION OF THE DEFICIENT SERVICES, OR, IF WE CANNOT SUBSTANTIALLY CORRECT THE DEFICIENCY IN A COMMERCIALLY REASONABLE MANNER, YOU MAY TERMINATE THE DEFICIENT SERVICES AND RECEIVE A REFUND OF PREPAID FEES FOR THE PERIOD FOLLOWING THE EFFECTIVE DATE OF TERMINATION.

7.4. TO THE MAXIMUM EXTENT PERMITTED BY LAW, THE WARRANTIES IN THIS SECTION ARE EXCLUSIVE AND ALL OTHER WARRANTIES OR CONDITIONS, EXPRESS OR IMPLIED, INCLUDING MERCHANTABILITY, SATISFACTORY QUALITY AND FITNESS FOR A PARTICULAR PURPOSE, ARE EXCLUDED.

8. Limitation of Liability

8.1. Nothing in this Agreement excludes or limits either party’s liability for death or personal injury caused by its negligence, for fraud or fraudulent misrepresentation, or for any other liability that cannot be excluded or limited under applicable law.

8.2. SUBJECT TO SECTION 8.1, NEITHER PARTY WILL BE LIABLE FOR ANY INDIRECT, CONSEQUENTIAL, INCIDENTAL, SPECIAL, PUNITIVE OR EXEMPLARY DAMAGES, OR FOR ANY LOSS OF REVENUE, PROFITS, DATA, DATA USE, GOODWILL OR REPUTATION, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGES.

8.3. SUBJECT TO SECTION 8.1, THE AGGREGATE LIABILITY OF EACH PARTY ARISING OUT OF OR RELATED TO THIS AGREEMENT OR A SALES ORDER, WHETHER IN CONTRACT, TORT OR OTHERWISE, SHALL NOT EXCEED THE TOTAL AMOUNTS ACTUALLY PAID OR PAYABLE UNDER THE RELEVANT SALES ORDER FOR THE SERVICES GIVING RISE TO THE LIABILITY DURING THE TWELVE (12) MONTHS PRECEDING THE EVENT GIVING RISE TO THE LIABILITY.

9. Term, Suspension and Termination

9.1. This Agreement applies to each Sales Order placed under it and continues for as long as any Services Period is in effect. Each Sales Order renews as stated in the Sales Order.

9.2. Either party may terminate this Agreement or an affected Sales Order if the other party materially breaches it and fails to cure the breach within thirty (30) days of written notice describing the breach. If we terminate for Your uncured breach, You will pay all fees accrued and all sums remaining unpaid for the terminated Sales Order.

9.3. We may suspend Your or Your Users’ access to the Services if we reasonably believe that: (a) there is a significant threat to the security, integrity or availability of the Services or any data in them; (b) the Services are being used for an illegal act or in breach of Section 2.4; or (c) undisputed fees are overdue by more than thirty (30) days. Where reasonably practicable and lawful, we will give advance notice, limit the suspension to the affected portion of the Services, and restore the Services promptly once the issue is resolved. Suspension does not relieve You of Your payment obligations.

9.4. Data retrieval and deletion. For sixty (60) days following the end of the Services Period, we will make Your Content available for retrieval in a commonly used, machine-readable format. Following the retrieval period, and except where retention is required by applicable law, we will delete Your Content from the Services in accordance with the Cloud Service Policy and the DPA. Given the health-records retention obligations that may apply to You under Saudi law, You are responsible for retrieving and retaining Your Content as required by those obligations.

9.5. Provisions relating to confidentiality, ownership, payment, limitation of liability, indemnification and any others that by their nature should survive, survive termination or expiry of this Agreement.

10. Indemnification

10.1. We will defend You against any third-party claim that the Services, as provided by us and used in accordance with this Agreement, infringe that third party’s intellectual property rights, and will indemnify You against damages, costs and expenses finally awarded or agreed in settlement, provided You: (a) notify us promptly in writing; (b) give us sole control of the defence and settlement; and (c) provide reasonable cooperation.

10.2. If such a claim arises or is likely, we may, at our option and expense: modify the Services to be non-infringing while substantially preserving functionality; obtain a licence for continued use; or, if neither is commercially reasonable, terminate the affected Services and refund any prepaid, unused fees. We have no obligation for claims arising from Your Content, Third Party Services or Third Party Content, combinations with materials not provided by us, or use in breach of this Agreement.

10.3. You will defend and indemnify us against third-party claims arising from Your Content or Your use of the Services in violation of law or this Agreement, on the same conditions as Section 10.1 applied mutatis mutandis.

10.4. This Section 10 states each party’s exclusive remedy for the third-party claims it describes.

11. Third Party Services

11.1. Third Party Services are governed by their own terms; we do not control them and, to the maximum extent permitted by law, are not responsible for them. Changes to or unavailability of Third Party Services or their APIs do not affect Your obligations under this Agreement or a Sales Order, though we will use reasonable efforts to adapt the Services where practicable.

12. Force Majeure

Neither party is responsible for failure or delay in performance caused by events beyond its reasonable control, including acts of God, war, hostility, sabotage, pandemic, government restrictions, or electrical, internet or telecommunications outages not caused by the obligated party. Both parties will use reasonable efforts to mitigate the effects. If such an event continues for more than thirty (30) days, either party may cancel unperformed Services upon written notice. This Section does not excuse Your obligation to pay for Services performed.

13. Governing Law and Disputes

This Agreement is governed by the laws and regulations of the Kingdom of Saudi Arabia. Any dispute arising out of or relating to this Agreement that is not resolved amicably within thirty (30) days of written notice of the dispute shall be finally settled by the competent courts of the Kingdom of Saudi Arabia.

14. Notices

Notices under this Agreement must be in writing. Legal notices to iCenna shall be sent to iCenna Company, 8125 Prince Sultan Street, 2086 Ar Rawdah District, Jeddah 23435, Kingdom of Saudi Arabia, Attention: Legal, with a copy to Legal@iCenna.com. We may give notices to You by email to Your address on record, through the Services portal, or by post to Your registered address. Notices are deemed given on confirmed receipt.

15. General

15.1. The parties are independent contractors; no partnership, joint venture or agency is created. You may not assign this Agreement without our prior written consent, except to an affiliate or a successor in connection with a merger or sale of substantially all assets, upon written notice. We may use subcontractors, and remain responsible for their performance.

15.2. Each party will comply with applicable export control, sanctions and anti-bribery laws in connection with this Agreement.

15.3. If any provision is held invalid or unenforceable, the remainder remains in effect and the provision will be replaced with a valid provision closest to the parties’ intent. Failure to enforce a provision is not a waiver.

15.4. Entire agreement; order of precedence. This Agreement, together with the Service Specifications and the applicable Sales Order, is the entire agreement between the parties regarding the Services and supersedes all prior or contemporaneous agreements and representations. In the event of conflict, the following order of precedence applies: (1) the DPA (as to Personal Data); (2) the Sales Order; (3) this Agreement; (4) the other Service Specifications. Terms in any Customer purchase order or procurement portal are of no effect. Amendments must be in writing signed or accepted online by authorised representatives of both parties, except that we may update the Service Specifications as provided in Section 2.3.