Exhibit G__Supplemental__Data_Rights.pdf

PWS Exhibit G | Supplemental Data Rights to PWS Paragraph 1.13 (EULA OVERRIDE)

Ex. G-1 INCORPORATION AND ORDER OF PRECEDENCE

(a) Incorporation of Commercial Terms: Any commercial End User License Agreement (EULA), Terms of Service (ToS), Cloud Services Agreement (CSA), Master Services Agreement (MSA), Software Support Policy, or equivalent commercial software/cloud agreement(s) provided by the Contractor or its suppliers/licensors (hereinafter collectively referred to as “Commercial Supplier Agreements”) attached to or referenced in this contract are incorporated solely to the extent they do not conflict with Federal law, Federal acquisition regulations, or the terms of this contract.

(b) Order of Precedence: Pursuant to FAR 52.212-4(s) (for commercial acquisitions) or FAR 52.215-8 (for non-commercial acquisitions), in the event of any conflict, ambiguity, or inconsistency between the terms and conditions of this contract (including this Section H Addendum) and any Commercial Supplier Agreement or referenced vendor policy, the conflict shall be resolved by giving precedence in the following descending order:

1. The Schedule of Supplies/Services (including contract line item numbers, performance work statements, and statement of objectives);

2. The mandatory terms of FAR 52.212-4 / FAR 52.212-4 Alternate I (specifically including the Disputes, Payments, Invoice, Compliance with Laws Unique to Government Contracts, and Unauthorized Obligations paragraphs);

3. This Section H Addendum (Commercial Software and Cloud Override);

4. Other Federal Acquisition Regulation (FAR), Defense Federal Acquisition Regulation Supplement (DFARS), and Agency-specific contract clauses incorporated into the solicitation or contract;

5. Agency Data Sharing Agreements, Business Associate Agreements (BAAs), or specialized Security Agreements;

6. Addenda to this solicitation or contract;

7. Other documents, exhibits, and attachments in Section J (including the Contractor’s Commercial Supplier Agreements); and

8. The Contractor’s technical proposal or commercial specifications.

(c) Supremacy of Federal Law: Under no circumstances shall any term, condition, or limitation in a Commercial Supplier Agreement supersede, negate, or alter any requirement, right, or remedy established under United States Federal Law or this contract. *(Authorities:

FAR 52.212-4(s); FAR 52.215-8; 41 U.S.C. §§ 7101–7109).*

Ex. G-2 SCOPE OF LICENSE RIGHTS AND AUTHORIZED USERS

(a) Enterprise License Rights: The Government’s license rights granted under this contract shall include the right for authorized Government personnel, military service members, PWS Exhibit G | Supplementing PWS Paragraph 1.13 (EULA OVERRIDE) civilian employees, and authorized third-party support contractors, systems integrators, and Federally Funded Research and Development Centers (FFRDCs) acting in support of the Government’s mission to access, configure, administer, operate, and utilize the software and cloud services across any operational, development, testing, disaster recovery, and staging environments without additional per-user, third-party, or inter-agency fees.

(b) Inter-Agency Transferability: The Government shall have the unfettered right to reassign, reallocate, or transfer licenses and cloud service subscriptions acquired under this contract to any other organizational component, agency, field activity, or successor support contractor within the Federal Government without additional cost, penalty, fee, or prior Contractor consent. *(Authorities: DFARS 227.7202-3; DFARS 227.7103-5; 41 U.S.C. § 6305).*

(c) Third-Party Contractor Access: The Contractor expressly consents to the Government allowing third-party technical support contractors to access and use the software and cloud services in performance of their official Government support duties, subject to standard non-disclosure obligations. Any provision in the Contractor’s commercial terms prohibiting third-party outsourcing, service bureau operations, or non-employee use is hereby rendered null and void.

Ex. G-3 GOVERNMENT DATA OWNERSHIP, PRIVACY, AND AI TRAINING

RESTRICTIONS

(a) Unqualified Ownership of Government Data: The Government retains sole and exclusive ownership of, and all intellectual property rights, title, and interest in and to, all data, metadata, database schemas, electronic health records, Protected Health Information (PHI), Personally Identifiable Information (PII), Controlled Unclassified Information (CUI), configurations, log files, reports, and digital artifacts uploaded, entered, transmitted, generated, or stored by the Government or on behalf of the Government in connection with the software or cloud services (“Government Data”).

(b) Limited Contractor License: The Contractor acquires no property, copyright, patent, trade secret, or proprietary interest in Government Data. The Contractor is granted only a strictly limited, non-exclusive, non-transferable, revocable license to temporarily host, store, and process Government Data solely and strictly as necessary to deliver the services required under this contract.

(c) Prohibition on Data Monetization, AI/ML Training, and Secondary Uses: The Contractor, its affiliates, subcontractors, and cloud infrastructure partners are strictly prohibited from:

1. Selling, licensing, renting, sharing, transferring, or commercializing Government Data, whether identifiable, aggregated, or de-identified;

2. De-identifying, parsing, mining, or using Government Data (including PHI and PII) for Contractor product enhancement, marketing, analytics, benchmarking, software optimization, or internal commercial development, unless specifically authorized by an explicit, bilateral written modification signed by the Contracting Officer; and

3. Using Government Data, prompts, workflows, clinical/operational inputs, or system interactions to train, fine-tune, validate, or improve any Artificial Intelligence (AI), Machine Learning (ML), Large Language Model (LLM), or automated reasoning tools (whether owned by the Contractor or a third party) without the prior express written authorization of the Contracting Officer and the Agency Senior Privacy/AI Official.

(d) Statutory Privacy Compliance: All processing of Government Data must comply with the Privacy Act of 1974 (5 U.S.C. § 552a), the Health Insurance Portability and Accountability Act of 1996 (HIPAA) Privacy and Security Rules (45 C.F.R. Parts 160 and 164), and DoD Manual 6025.18. In the event of any conflict between a commercial privacy policy and the incorporated Business Associate Agreement (BAA), the BAA shall control.

*(Authorities: 10 U.S.C. § 3771 et seq.; 5 U.S.C. § 552a; 45 C.F.R. § 164.514; DFARS

252.227-7013; DFARS 252.227-7020).*

Ex. G-4 NULLIFICATION OF CLICK-WRAP, BROWSE-WRAP, AND EMBEDDED TERMS

(a) Nullification of End-User Agreements: The terms and conditions of this Government contract and this Section H Addendum strictly supersede and render null, void, and unenforceable any “click-wrap,” “click-through,” “browse-wrap,” “shrink-wrap,” online splash screen, terms of service update, or end-user agreement that any individual user, system administrator, or Contracting Officer Representative is prompted to accept in order to install, configure, access, update, or operate the software or cloud service.

(b) Lack of Authority: Individual users lack the legal and constitutional authority to obligate the Government or alter the contractual relationship between the Contractor and the United States Government. Only a warranted Contracting Officer acting within the scope of their delegated warrant may execute contract modifications. *(Authorities: FAR 43.102(a);

FAR 52.212-4(u); Anti-Deficiency Act, 31 U.S.C. § 1341).*

Ex. G-5 UNENFORCEABLE AND PROHIBITED COMMERCIAL TERMS

Notwithstanding any statement, clause, or term to the contrary contained in any Contractor Commercial Supplier Agreement, the following commercial provisions are explicitly rejected, excised, and declared null and void as against the United States Government:

1. Government Indemnification: Any clause requiring the United States Government, its agencies, officers, or employees to indemnify, defend, hold harmless, or release the Contractor or any third party from any liability, claim, loss, damage, or expense is void ab initio as a violation of the Anti-Deficiency Act. *(Authorities: 31 U.S.C. § 1341; 28 U.S.C. § 2517; FAR 52.212-4(u)).*

2. Automatic Renewals and Evergreen Clauses: Any provision providing for the automatic extension, renewal, or evergreen rollover of software licenses, cloud subscriptions, maintenance periods, or support fees without an affirmative, formal written option exercise by the Contracting Officer is stricken. *(Authorities: 31 U.S.C. § 1341; FAR 17.207).*

3. Choice of State/Foreign Law and Venue: Any provision subjecting the Government to the laws, statutes, courts, or dispute resolution mechanisms of any U.S. State, local municipality, or foreign jurisdiction is stricken. This contract is governed strictly and exclusively by United States Federal Law, and any dispute shall be resolved exclusively in accordance with the Contract Disputes Act of 1978. *(Authorities: 41 U.S.C. §§ 7101–7109;

FAR 52.233-1).*

4. Binding Commercial Arbitration: Any clause requiring the Government to submit to binding commercial arbitration, mediation, or alternative dispute resolution outside the mechanisms established by Federal statute and FAR Part 33 is stricken.

5. Unilateral Service Suspension and Self-Help: Any clause reserving the right of the Contractor to unilaterally suspend, throttle, terminate, lock out, or disable software functionality or cloud access, or to withhold Government Data without a prior final decision or formal written authorization from the Contracting Officer, is stricken. The Contractor shall proceed diligently with performance in accordance with FAR 52.233-1(i) (Disputes).

6. Unilateral Modifications via Hyperlinks: Any clause asserting that external URLs, hyperlinked documents, service level agreements (SLAs), or security policies may be modified unilaterally by the Contractor during the term of performance is stricken.

7. Vendor Audits and Unescorted Physical/System Access: Any provision granting the Contractor the unilateral right to physically inspect Government facilities or remotely access, scan, or audit Government networks/records without prior written consent and security clearances is stricken. Any audit shall be conducted exclusively via formal request to the Contracting Officer and in compliance with Federal security regulations. *(Authorities: 18 U.S.C. § 1030; DoDI 8500.01).*

8. State and Local Taxes / Surcharges: Any clause assessing state, local, or municipal sales, excise, or property taxes is stricken. The Federal Government is constitutionally immune from state and local taxation. *(Authorities: U.S. Const. art. VI, cl. 2; FAR 52.229- 3).*

9. Payment Upon Access/Delivery: Any clause stating that payment is due immediately upon software download, activation, or deployment is superseded. Payments shall be made exclusively in accordance with the Prompt Payment Act and FAR 52.212-4(i), following formal Government inspection and acceptance. *(Authorities: 31 U.S.C. § 3901 et seq.).*

Ex. G-6 CYBERSECURITY, PENETRATION TESTING, AND GOVERNMENT

VULNERABILITY ASSESSMENTS

(a) Government Right to Test: The Government, through its military, civilian, or authorized third-party cyber assessment teams, retains the unilateral right to perform vulnerability scanning, security configuration checks, architectural reviews, penetration testing, and red-team/blue-team assessments on the software, applications, hosting environments, and cloud infrastructure at any time without requiring prior vendor authorization, consent, or scheduling approvals, subject only to operational de-confliction.

(b) Voiding of Vendor Restrictions: Any term in the Contractor’s EULA or cloud policies prohibiting, conditioning, or penalizing security research, vulnerability disclosure, port scanning, or penetration testing is hereby null, void, and unenforceable.

(c) Cyber Incident Reporting: The Contractor shall report any confirmed or suspected cybersecurity incident, unauthorized data access, or data spill affecting Government Data or systems to the Contracting Officer, the Contracting Officer’s Representative (COR), and the designated Agency Cyber Security Service Provider (CSSP) / US-CERT within one (1) hour of discovery. *(Authorities: 44 U.S.C. § 3554; DFARS 252.204-7012; DoDI 8500.01;

Committee on National Security Systems Instruction (CNSSI) 4009).*

Ex. G-7 LIMITATION OF LIABILITY CARVE-OUTS AND SPECIFIC BREACH REMEDIES

(a) Mandatory Carve-Outs from Liability Limitations: Any clause in a Commercial Supplier Agreement that purports to cap, limit, or exclude the Contractor’s liability for damages shall NOT apply to:

1. Breaches of data confidentiality, privacy, cybersecurity, or data protection obligations (including unauthorized access to or disclosure of PHI, PII, CUI, or classified information);

2. The Contractor’s intellectual property infringement defense and indemnification obligations;

3. Damages resulting from the gross negligence, willful misconduct, intentional torts, bad faith, or fraud of the Contractor, its employees, subcontractors, or agents;

4. Death, personal injury, or tangible property damage caused by the Contractor’s acts or omissions; and

5. Statutory fines, civil monetary penalties, and mandatory remediation costs assessed against the Government resulting from the Contractor’s non-compliance.

(b) Preservation of Enhanced Vendor Remedies: Where the Contractor’s commercial terms provide specific, heightened liability limits or remedies that are more favorable to the Government than the standard contract terms (such as multi-multiplier caps for data breaches, extended credit monitoring obligations, or dedicated forensic investigation funding), such enhanced remedies are expressly preserved and shall apply in favor of the Government.

(c) Direct Damages Classification: The reasonable costs of mandatory breach notification, forensics, credit monitoring and identity restoration services for affected individuals, and regulatory fines payable due to Contractor security failures shall be deemed direct damages recoverable by the Government. *(Authorities: FAR 52.212-4(p); 28 U.S.C. § 1498; FAR 33.205).*

Ex. G-8 VENDOR REMOTE ACCESS, SECURITY, AND SYSTEM RESIDENCY

(a) Security Protocol Compliance: Any remote access to Government information systems or hosting environments by Contractor personnel shall be conducted exclusively using Government-Furnished Equipment (GFE) (or Government-approved, hardened virtual desktop infrastructure), multi-factor authentication (MFA/2FA), Common Access Card (CAC) / Personal Identity Verification (PIV) credentials, and Government-approved secure VPN/Zero Trust gateways.

(b) Data Residency and Sovereignty: All Government Data, including active data, backup data, archives, logs, and disaster recovery environments, must reside exclusively within the contiguous United States (CONUS) in FedRAMP-authorized and DoD Impact Level (IL-4 / IL-5 / IL-6, as specified in the Schedule) certified data centers. Contractor personnel supporting the system must be U.S. citizens holding appropriate security clearances or background investigations. *(Authorities: DoDI 8500.01; NIST SP 800-53; NIST SP 800- 171).*

Ex. G-9 THIRD-PARTY AND OPEN-SOURCE SOFTWARE PASS-THROUGH

(a) Contractor Responsibility: The Contractor warrants that all third-party software, sublicensed components, open-source libraries, and commercial tools bundled with, embedded in, or delivered alongside the software or cloud services comply with all applicable license requirements and do not impose viral licensing conditions (e.g., GPL copyleft requirements) upon Government systems or data.

(b) Government Immunity from Pass-Through Liabilities: The Government is not a party to, and shall not be bound by, any third-party pass-through terms, shrink-wrap licenses, or supplier agreements that conflict with Federal law, the FAR, or this contract.

(c) Third-Party IP Indemnification: The Contractor shall defend, indemnify, and hold harmless the United States Government, its officers, employees, and agents from any third-party claims, lawsuits, royalties, or expenses resulting from the Contractor’s integration or use of third-party or open-source software. *(Authorities: DFARS 252.227-7014; 28 U.S.C. § 1498).*

Ex. G-10 STATIC INCORPORATION OF REFERENCED POLICIES (DYNAMIC URLS

VOID)

(a) Static Baseline: Any policy, technical specification, support guideline, or standard referenced in a Commercial Supplier Agreement via website URL or hyperlink shall be binding on the Government only in the static form physically attached to this contract as an exhibit in Section J as of the date of contract award.

(b) Prohibition on Unilateral Online Alterations: Any modification, addition, deletion, or update made by the Contractor to online URLs, policies, or SLAs after the date of award shall have no legal force or effect on this contract unless and until incorporated into the contract through a formal, bilateral written modification executed by the Contracting Officer.

*(Authorities: FAR 12.302(a); FAR 43.102; FAR 52.212-4(c)).*

Ex. G-11 SOFTWARE AND CLOUD FUNCTIONALITY WARRANTIES

(a) Continuous Functionality Warranty: The Contractor warrants that the software, cloud services, and all associated modules will perform in all material respects in accordance with the functional specifications, documentation, and performance work statements throughout the entire period of performance (and throughout all paid sustainment and support periods).

(b) Supersession of "As-Is" Disclaimers: Any commercial disclaimer asserting that software or cloud services are provided “AS-IS,” “AS-AVAILABLE,” or “WITH ALL FAULTS,” or disclaiming the implied warranties of merchantability, fitness for a particular purpose, or non-infringement, is hereby superseded and replaced by the express functionality warranties contained in this contract.

(c) Remedies for Breach of Warranty: In the event of a software or cloud service defect, failure, or warranty non-conformance, the Contractor shall, at its sole expense:

1. Promptly correct, repair, or replace the non-conforming software/service within the timelines established in the Service Level Agreement (SLA); or

2. If the Contractor cannot correct the defect within thirty (30) days of notice, the Government may terminate the affected software license, subscription, or service for cause and receive a full, pro-rata refund of all prepaid, unused fees, alongside the unamortized portion of license fees. *(Authorities: FAR 52.212-4(o); FAR 52.212-4(m);

FAR 52.246-17; U.C.C. § 2-313).*

Ex. G-12 INTELLECTUAL PROPERTY AND PRESERVATION OF RIGHTS

(a) Federal IP Jurisdiction: Intellectual property rights, technical data rights, and commercial software rights under this contract shall be governed exclusively by United States Federal statutes, Title 10 of the United States Code, Title 35 (Patents), Title 17 (Copyrights), and the applicable FAR/DFARS clauses.

(b) Government Commercial Computer Software Rights: The Government’s rights in commercial computer software, documentation, and technical data shall not be restricted beyond the standard commercial terms explicitly agreed to in writing by the Contracting Officer and consistent with DFARS 227.7202-3. *(Authorities: 28 U.S.C. § 1338; 28 U.S.C.

§ 1498; DFARS 227.7202).*

Ex. G-13 PUBLICITY, ADVERTISING, AND NON-ENDORSEMENT

The Contractor, its parent companies, subsidiaries, and marketing affiliates shall not use the name, seal, logo, or acronym of the United States Government, the Department of Defense, the Military Services, or any civilian agency, nor refer to any contract award or software deployment in commercial advertising, press releases, case studies, marketing presentations, or customer lists without the prior express written approval of the Contracting Officer and the designated Agency Public Affairs Office. *(Authorities: 5 C.F.R. § 2635.702; DoD Directive 5535.09).*

Ex. G-14 CONTRACT DISENTANGLEMENT, DATA PORTABILITY, AND TRANSITION

SUPPORT

(a) Transition and Extraction Assistance: Upon the expiration, termination (for convenience or cause), or transition of this contract to a successor vendor, the Contractor shall provide all reasonable and necessary technical assistance to ensure the orderly, secure, and uninterrupted transition of services and Government Data to the Government or its designated successor contractor for a period of up to twenty-four (24) months following notice.

(b) Data Export Standards: The Contractor shall provide the Government with a complete, verifiable export of all Government Data, configurations, and transactional histories in a standard, non-proprietary, machine-readable format (e.g., JSON, CSV, XML, standard SQL/PostgreSQL database dumps) at no additional charge.

(c) Certified Data Destruction: Following Government verification and acceptance of the complete data export and upon written direction from the Contracting Officer, the Contractor shall permanently erase, sanitize, and destroy all residual copies of Government Data, metadata, backups, and caching within its environments in accordance with NIST Special Publication 800-88 Revision 1 (Guidelines for Media Sanitization) and provide a formal Certificate of Sanitization to the Contracting Officer within thirty (30) days. *(Authorities:

FAR 52.237-3; NIST SP 800-88 Rev. 1; DoDM 5200.01).*

[END OF Ex. G]