Service Subscription Agreement (Healthcare)

Thanks for using our phone service. We built it to be a reliable business phone system, and we want the terms you agree to to be just as straightforward. This agreement is the contract between you and us. We've written it in plain language, but it is a real, binding legal contract, so please read it, especially the parts about emergency (911) calling, what you can't do on the network, the limits on our liability, and, because this version is for healthcare customers, the Business Associate Agreement in Exhibit A.

Who "we" and "you" are. When we say "we," "us," or "our" (also called the "Provider" in places where a legal label is needed), we mean DialStack, Inc., a Delaware corporation. We are the licensed carrier behind your phone service. You may have signed up through another company's product, your "Platform Partner," which may present this service under its own brand. That's expected: the Platform Partner runs your account experience and billing, and we are the carrier underneath. When we say "you" or "your," we mean the business that owns this account and everyone who uses the service under it.

How you accept. By clicking "I Agree," or by using the service, you agree to this contract on behalf of your business. When you accept, you represent, warrant, and agree to four things: (1) you're at least 18 and have the authority to bind your business; (2) you have been informed by us of, and have read and understood, the 911 emergency-calling limitations in Section 7, including the reasons to keep at least one backup way to reach 911 at each location, and you agree to the release and waiver in that section; (3) your organization is a Covered Entity or Business Associate under HIPAA, the person accepting is authorized to enter into the Business Associate Agreement in Exhibit A on your organization's behalf, and you acknowledge that these terms include that Business Associate Agreement between your organization and DialStack, Inc.; and (4) you agree to everything below. If you don't agree, don't use the service.

This service is for business use only.

1. The Service

What we provide. We provide a hosted internet phone (VoIP) service: voice calling, phone numbers (DIDs), voicemail, call management features, and related functionality. The specific services on your account are described in Schedule 1 and in your account portal. We operate and maintain the platform and deliver the service over the internet; you provide and maintain the equipment and internet connection needed to use it (see Section 2).

Business use, in the U.S., no international calling. The service is for your internal business use within the United States. International calling is not included today, and outbound international calls are blocked; if we offer international calling in the future, it will be billed per minute. You're responsible for any charges for calls between the continental U.S. and Alaska or Hawaii at the rates in your portal. We can block traffic to or from any international destination, or to number ranges like 900 and 976, when we need to in order to follow the law, protect our network, or stop fraud or abuse.

Your Platform Partner's services are separate. Anything you get from your Platform Partner beyond the phone service itself is governed by your agreement with them, not this one. We're not responsible for the Platform Partner's own products or services.

We may improve or change the service. We may modify the features and functionality of the service over time. If a change will meaningfully degrade the service you rely on, we'll use commercially reasonable efforts to give you advance notice. (Changes to this contract are handled differently, in Section 16.)

2. Your Account

Account setup and accurate information. Before the service is used, an account must be set up (by you, or by your Platform Partner on your behalf). You agree to keep your account information accurate and current, including the physical location of each user (this matters for 911, see Section 7). You sign in with a username and password or through a supported single sign-on (SSO) provider. You're also responsible for securing your own networks and devices against unauthorized access and for backing up your own data, using good computing practices.

Keep your credentials safe. You're responsible for keeping your account credentials confidential and for everything that happens under your account, including anything your users do and any unauthorized use. Don't share your credentials. Tell us right away if you think someone has gained unauthorized access, by emailing support@dialstack.ai (or the support contact your Platform Partner provides).

Your Platform Partner has admin access. Your Platform Partner has its own independent administrative access to your account through our platform, using its own credentials. Actions the Platform Partner takes on your behalf, like provisioning, configuring, or changing your service, are treated as authorized by you.

Fraud protection. If we suspect fraudulent or abusive activity on your account, we can interrupt, restrict, or terminate the service without notice. You agree to cooperate with any fraud investigation and to take reasonable fraud-prevention steps we ask for. You are fully responsible for all charges and will not be excused from paying for service on the basis that some or all of the calls were fraudulent.

3. Using the Service Responsibly

You agree to use the service only as allowed here and under all applicable laws. Because we are the carrier of record, what happens on your account is traffic on our regulated network, so these rules carry real legal and regulatory weight. You agree that you and your users will not:

• Break the law or harm others. No use that is unlawful, fraudulent, criminal, libelous, threatening, harassing, obscene, or that infringes someone else's intellectual property. No using the service to exploit or harm children.
• Run prohibited calling campaigns. No autodialing or predictive dialing, continuous or iterative dialing, fax blasting or junk faxing, robocalls, telemarketing, bulk or unsolicited messages, recorded-message broadcasts, or call-center/bulk call-in operations. In short: no use outside reasonable internal business calling. (If you have a high-volume use case, contact us to discuss whether it can be accommodated; we are not obligated to permit it.)
• Spoof or manipulate traffic. No altering, faking, or stripping caller ID, calling-party numbers, signaling, or other call detail, and no re-originating or re-classifying traffic to disguise where it came from or what type it is. (This protects everyone's compliance with caller-ID authentication rules.)
• Record calls unlawfully. Don't record any communication except in strict compliance with applicable law.
• Abuse or disrupt the service. No interfering with the network, other customers, or our support operations; no introducing malware or corrupted files; no reselling the service or running a service bureau.
• Misuse access or branding. Don't access the service except through the interface we or your Platform Partner provide (no scripts or crawlers), and don't use anyone's trademarks or remove proprietary notices without permission.
• Use it for life-safety or high-risk systems. The service isn't built for uses where a failure could cause death, injury, or serious physical or environmental harm (for example, medical life-support, or monitoring or control of hazardous or critical facilities).

Fair use. Domestic calling included with the service is subject to the Fair Use Policy in Schedule 1.

What happens if you break these rules. We can take any lawful action we think is appropriate, including a warning, suspending or limiting the service, or terminating your account, in our discretion, immediately and without notice. We may take any of these actions without notice and without liability to you or any third party, and we have no obligation to take any of them. We may also cut off voice calls longer than 2 hours and fax calls longer than 1 hour. If we suspend (rather than terminate) your account and you cure the violation, we may turn the service back on and may charge a $100 restoration fee. Either way, you remain responsible for fees for service used up to the date of termination, and this doesn't limit our other remedies.

4. Your Content and Your Users

You own and are responsible for your content. "Your Content" means everything you and your users send, upload, record, or transmit through the service. You keep all the intellectual property rights you have in it, and you're solely responsible for it, including any harm or third-party claims it causes.

The license you give us. So that we can carry and deliver your communications, you give us a non-exclusive, worldwide, royalty-free, sublicensable, transferable, perpetual, irrevocable license to use, store, transmit, reproduce, and deliver Your Content as needed to provide the service. You confirm you have the rights to grant this license. The license is for running the service and for our lawful retention, backup, and de-identified analytics (see Section 9); it survives termination only to that extent, and we don't claim ownership of Your Content.

We don't have to store or screen it. We try to store things like voicemail, call logs, recordings, and messages, but we're not obligated to and aren't responsible if they're lost or deleted. We may (but don't have to) screen, filter, or remove content, at our discretion and without liability.

Your users. We don't control and aren't responsible for what your employees, agents, or other users do on the service, or for the content they create. Content created by your users may be protected by others' intellectual property rights; don't copy or reuse it without permission.

5. Billing and Payment

Who bills you. Your Platform Partner bills you as our billing agent, charging the card or payment method on file. Your specific rates are shown in your account portal. Fees include recurring charges, usage charges, applicable taxes, and regulatory fees (described below and in Schedule 1).

How billing works (advance for recurring, arrears for usage). Recurring fees are billed monthly in advance for the month ahead, starting when your service begins (prorated for a partial first month) and then on the first of each month, based on the resources provisioned (users, phone numbers, and the like) as of the billing date. Usage-based charges, overage charges, and one-time charges are billed monthly in arrears for the prior month. Payment is due on receipt of invoice unless you and your Platform Partner agree otherwise.

Adding and removing resources mid-month. If you add resources mid-month, we prorate the recurring fee for the rest of that month and it appears on your next invoice. If you remove resources mid-month, the change takes effect at the start of the next billing period, and recurring fees already billed in advance for the current month are not refunded (taxes and fees on them have already been assessed and remitted).

Taxes. You're responsible for all applicable taxes, fees, and surcharges imposed on the service or your use of it, except taxes on our income. Many of these are telecom-specific (for example, certain excise, utility, and gross-receipts taxes and government surcharges), vary by jurisdiction, and generally apply even if you're exempt from sales tax. If you give your Platform Partner a valid, current tax-exemption certificate, we'll apply it, to the extent the law allows, to the taxes it actually covers (usually sales and use tax); it doesn't relieve you of other taxes, fees, or surcharges.

Regulatory fees, taxes, and our recovery fees. Your bill includes two distinct categories, and we keep them separate. First, genuine government taxes, fees, and surcharges that we pass through, including Federal and state Universal Service Fund (USF) contributions (the FCC sets the federal rate quarterly), state and local 911 fees, and any other government-chargeable fees, shown as separate line items. Second, our own cost-recovery fees, the Regulatory Recovery Fee and the Emergency E911 Services Fee, which are our charges and not government taxes; these are described, with amounts, in Schedule 1, and more detail is at www.dialstack.ai/regulatory-fees.

Late payments and disputes. We may suspend the service for overdue amounts until they're paid. Overdue amounts accrue a late charge of the greater of 1.5% per month or the maximum the law allows, and you'll reimburse reasonable collection costs and attorneys' fees. Although your Platform Partner is the primary collector, we keep the right to collect directly and enforce your payment obligations. To dispute a charge, you must notify your Platform Partner (our billing agent), in writing, using the billing or support contact your Platform Partner provides, within 30 days of the invoice date, identifying the charge and the basis; a charge is treated as disputed only if submitted this way, and otherwise you waive the dispute. If your card is declined, your Platform Partner will retry up to two more times over the following two days; if it's still declined on the third try, your account may be terminated and we keep all other remedies available under this agreement and the law. If your card is declined within 30 days of opening the account, the account may be canceled immediately and its phone numbers removed.

Credit checks. We or your Platform Partner may require credit approval before or during service and may obtain credit reports. If your financial condition doesn't reasonably justify continued service on these payment terms, we may require advance payment or terminate under Section 15.

6. Service Availability

We may modify, maintain, or repair the network at any time, even if that briefly interrupts the service. We will use commercially reasonable efforts to minimize disruption and to give advance notice of planned maintenance by phone, email, or similar, but failure to give any such notice is not a breach and creates no liability or credit entitlement. We provide the service on an "as is" and "as available" basis (see Section 12 for the full disclaimer). Any service credits are provided solely at our discretion, and no interruption, announced or unannounced, entitles you to a credit, refund, or other remedy except as expressly stated.

7. Emergency Calls (911): Please Read This

This is the most important section to understand. Our 911 service works differently from a traditional landline, and in some situations it may not work at all. You agree to make sure everyone who uses the service knows about these limits.

911 on internet phone service has real limitations. The 911/E911 component of the service does not have the same functionality or reliability as traditional wireline 911. Because it depends on power, internet, and correct location data, it can fail or be delayed in situations a landline wouldn't. You acknowledge and agree that we have advised you of the reasons to maintain at least one backup method of reaching 911 at each location, such as a cell phone or a traditional landline, and you agree to advise all of your users of the 911 limitations described in this section.

Situations where 911 may not work or may be delayed include:

• A power outage, or loss of internet, at the user's location.
• Failure, or improper installation/configuration, of the user's broadband or VoIP hardware or software (including softphones).
• Suspension, disconnection, or termination of the service for any reason, including non-payment.
• The user's registered physical location being missing, wrong, or out of date, or the user calling 911 from a different location than the one registered.
• The local emergency call center not being equipped to receive or keep your number or location, which can mean they don't know who's calling or from where.
• Network congestion or technical factors, which can cause a busy signal or longer-than-normal wait to be answered.

You must register and keep each user's location current. You're required to register the physical location of each user's phone or softphone when you order the service and whenever you add a user, through our portal. The location you register is what gets sent to the emergency call taker, and it's what our system uses to route 911 calls to the right call center. If we detect that a user's network location has changed, our system may prompt them to confirm or update it, but keeping each user's location current is solely your responsibility regardless of whether any prompt is sent, and you're responsible for making sure your users respond promptly and keep their location accurate. If a location is wrong or out of date, a 911 call may go to the wrong place. When a location is updated, there may be a short delay before it's usable for 911 routing.

Multiple lines (MLTS). If your service has two or more lines or seats, you're responsible for configuring and operating that system in line with the law, including designating administrators, managing line assignments and locations, and designating a phone number, email, or location where notice of 911 calls placed on your system should be delivered.

Release and indemnity for 911.

8. Phone Numbers and Special Dialing

Phone numbers (DIDs). When numbers are available, we'll offer you a list to choose from. You don't own the numbers assigned to you, and you can't transfer them except by porting out (below). We can change, cancel, withdraw, or move a number in our sole discretion, immediately upon notice to you. When the service ends, you may port a number out within 10 days (see Porting out); if you don't, the number reverts to us and may be reassigned, and we aren't liable for that reassignment. Don't advertise a number until it's active on your account.

Porting in. You can port an existing number to us. While the port is in progress, you'll use a temporary number we provide. We'll support valid port-in requests and cooperate with you, but we aren't responsible for delays or rejections caused by you, your prior provider, or another third party. When you ask us to port a number in, you confirm you're authorized to transfer it and that your request is accurate and complete.

Porting out. You (or a provider acting for you) can request to port a number away from us. We'll support and promptly cooperate with valid port-out requests. Until the port-out is complete and you terminate service for that number, you stay bound by this agreement for it and keep paying the monthly fees. Porting out and terminating this agreement doesn't end any separate agreement you have with your Platform Partner. If this agreement or the service ends and you don't port a number out within 10 days, that number becomes ours and you have no further claim to it.

711 (relay services). You can dial 711 to reach Telecommunications Relay Services. If a user's registered location isn't their actual location, 711 calls may not route to the correct relay center.

What's not included. The service doesn't include operator or directory assistance and doesn't support 900 or 976 calls. It may not support 311, 411, 511, or other X11 dialing (other than 911 and 711) in all areas.

9. Privacy and Your Data

Our Privacy Policy governs. Our handling of your data and personal information is governed by our Privacy Policy at www.dialstack.ai/privacy, which you confirm you've reviewed and agree to.

Sharing needed to run the service. To provide, support, bill, and maintain the service, we may share your data with (a) your Platform Partner, including call metadata, usage data, call recordings and transcripts, and related analytics made available through our platform for use in the Platform Partner's products, and (b) our infrastructure providers, as needed to deliver the service.

CPNI (your calling records). As a carrier, we collect Customer Proprietary Network Information, the kinds of service you buy, how you use it (like your calling records), and related billing information. (Your name, number, and address aren't CPNI.) We don't sell or share your CPNI with anyone outside of us and those authorized to represent us or perform functions on our behalf related to the service (including your Platform Partner who provides the service to you), except as the law requires or you authorize. You authorize us to share CPNI with your Platform Partner to provision, support, bill, and maintain the service and the Platform Partner's integrated products, including making call metadata, usage data, and analytics available through our platform. Federal law lets us and our agents use CPNI to provide, bill, and collect for your service, and we may use or disclose it for legal reasons such as responding to a court order, investigating fraud, or protecting our rights, our network, or other users. Neither we nor your Platform Partner will use or disclose CPNI for marketing. This doesn't cover information you give your Platform Partner directly under a separate agreement.

De-identified and aggregated data. We may collect, use, and keep de-identified, aggregated data from your use of the service (like call metadata, usage patterns, and performance metrics) to improve, develop, and train our products, services, and technology, including machine-learning models. This data won't identify you or any user, and we won't try to re-identify it. It does not include the contents of your communications (call audio, voicemail content, message text) unless you've separately opted into a program that expressly allows it. This limit applies only to using your communications content to develop or train our models. It does not limit our processing of your content to provide the service and the features you use, such as voicemail, call recording, transcription, and AI call summaries, which is covered by the license in Section 4.

Protected Health Information. Where your account is subject to the Business Associate Agreement in Exhibit A, any Protected Health Information is governed by Exhibit A, not by this Section's content-for-training option. We will not use Protected Health Information to train, develop, or improve our models, and the opt-in program described above is not available for Protected Health Information. We may use data that has been de-identified in accordance with HIPAA (45 CFR 164.514) to operate and improve the service, as described in Exhibit A, Section A-3.

10. Our Intellectual Property and Software

We own the service. We and our licensors own all rights in the service, our software, our content, and the platform and interfaces used to access it, including anything we develop while providing the service (even if it grew out of your input), which you assign to us to the extent it would otherwise be yours. You don't get any ownership rights by using the service. Don't copy, modify, sell, distribute, or create derivative works from the service or our content, and don't remove proprietary notices or use our names, logos, or branding without permission.

Your license to use our software. We grant you a limited, non-exclusive, revocable, non-transferable, non-sublicensable license to use the software we provide as part of the service, within the United States, for your provisioned users and services, for as long as your subscription lasts.

Updates. If we provide downloadable or installable software as part of the service, it may automatically download and install updates (bug fixes, improvements, new features), and as a condition of using that software you agree to allow these updates to install.

11. Confidentiality

Our business and technical information, pricing, discounts, and other business data, whether marked confidential or identified as confidential (verbal information qualifies if designated confidential at the time and summarized to you in writing within 30 days), is our "Confidential Information." You agree to keep it strictly confidential, protect it with at least reasonable care, and not use or disclose it except as allowed here or to perform your obligations. This doesn't cover information that is public through no fault of yours, that you lawfully received from a third party free to share it, that you can show you already knew, or that you independently developed. If you're legally compelled to disclose it, you may, but only to the extent required and, where allowed, after promptly notifying us so we can seek a protective order (and you'll reasonably help us do so). Your confidentiality obligations survive indefinitely after this agreement ends. When the agreement ends, you'll stop using our Confidential Information and promptly return or destroy it (and certify that on request).

12. Warranties and Disclaimers

Mutual basics. Each of us represents that we're properly organized and in good standing, have the authority to enter into and perform this agreement, won't violate any law or other agreement by doing so, and that this agreement is binding and enforceable.

Everything else is "as is." Except for the basic representations just above:

We're not responsible for damage to your devices or loss of data from using the service, and we have no obligation to retain your information, content, or communications beyond what the law requires for call detail records. Any equipment warranty is only what's stated in Schedule 1.

13. Limitation of Liability

(The 911 release and indemnity in Section 7 is a separate allocation of risk and is not subject to this cap. Liability under the Business Associate Agreement in Exhibit A is governed by this Section 13, as stated in Exhibit A, Section A-8.2.)

14. Your Indemnification of Us

You agree to indemnify, defend, and hold us harmless, along with our affiliates, officers, directors, employees, consultants, agents, licensors, suppliers, providers, resellers, and your Platform Partner, from any third-party claims, and the resulting liabilities, damages, losses, costs, and reasonable attorneys' fees, that arise out of or relate to:

• your use of the service in any way other than strictly as allowed by this agreement;
• your breach of this agreement, including your representations and warranties;
• your violation of any law or regulation, including fraudulent or illegal use of the service by you or your users (for example, illegal robocalls, caller-ID spoofing, telemarketing or messaging that violates the TCPA, or unlawful call recording);
• your negligence or willful misconduct; or
• any claim that Your Content or your users' content infringes or misappropriates someone's intellectual property or other rights.

This indemnity applies to the fullest extent permitted by law and regardless of the indemnified parties' concurrent negligence, but it does not cover a claim to the extent it is caused by our own gross negligence, willful misconduct, or fraud. It is in addition to the separate 911 indemnity in Section 7.

How this works. We'll notify you reasonably promptly of any claim we want covered (a delay only reduces your obligation to the extent it actually prejudices you). You control the defense and settlement using qualified counsel, except that you can't settle in a way that imposes any obligation or liability on us, admits our fault, or doesn't fully release us, without our prior written consent. We may join with our own counsel at our own expense, and you'll reasonably cooperate.

Plain-language note, illustrative only and not limiting the scope above: this indemnity runs one way, from you to us. That is deliberate and standard for a regulated carrier. Because we carry your traffic on our licensed network, conduct on your account can expose us to regulators and third parties even though the conduct is yours.

15. Term and Termination

Term. The agreement starts on your effective date and continues until you cancel it or it is terminated as described below. There is no fixed term.

Reducing or canceling your service. There is no minimum commitment and no early-termination fee. You can reduce or remove resources, or cancel entirely, at any time; billing runs month-to-month. Whenever you reduce or remove resources, including reducing them to zero, the billing rules in Section 5 and Schedule 1 apply: the change takes effect at the start of the next billing period, recurring fees already billed in advance for the current month are not refunded, and usage is billed in arrears. Reducing your resources to zero has the same effect as canceling.

Termination for breach. Either of us may terminate if the other materially breaches and doesn't cure within 30 days of written notice (if the breach can be cured). We may suspend or terminate immediately on written notice if you (i) don't pay undisputed amounts within 15 days after notice that payment is past due, or (ii) violate the scope-of-use or prohibited-use rules in Section 3.

What happens when it ends. When the agreement ends for any reason: you'll stop using the service and software and destroy any copies of end-user software you can; all licenses and subscriptions end; we may deactivate or delete your account and its contents and cut off access; you'll lose access to your assigned numbers unless you ported them out first; you'll return any equipment not paid for in full; and you'll promptly pay everything you owe.

What survives. Any provision that by its nature should continue after termination does, and this is in addition to (not limited by) the following, which expressly survive: the enforcement and no-liability provisions of Section 3; Section 4 (your content and the license to us); Section 5 (amounts owed, billing, and collection); Section 9 (privacy, CPNI, and de-identified data); the 911 release and indemnity in Section 7; Section 10 (intellectual property); Section 11 (confidentiality); Section 12 (disclaimers); Section 13 (limitation of liability); Section 14 (your indemnification of us); this Section 15; all of Section 16 (including governing law, dispute resolution, and the time limit on claims); the number-surrender terms in Section 8; and the survival terms of the Business Associate Agreement in Exhibit A. Listing these does not mean any unlisted provision fails to survive where its nature requires it.

16. General Terms

Governing law and venue. This agreement, and any dispute arising out of it, is governed by California law (without its conflict-of-laws rules and excluding the UN Convention on Contracts for the International Sale of Goods). Disputes will be heard in the state or federal courts for the County of San Diego, California, and both of us waive objections to that venue and jurisdiction.

Injunctive relief. If you breach or threaten to breach this agreement, we can seek injunctive relief (without posting a bond) from any court with jurisdiction, on top of our other remedies.

Time limit on claims. Any claim must be brought within one year after the cause of action arises, or one year after the party bringing it actually knew of the claim, whichever is later, regardless of any longer statute of limitations.

Changes to these terms. We may update these terms by posting a revised version and giving you at least 30 days' notice of material changes. Notice may be by email to the address on your account or through your Platform Partner's product or portal, where you actually use the service. If a change is required sooner by law or a regulator, we'll give as much notice as practical. Continuing to use the service after the effective date means you accept the new terms; if you don't agree, you can terminate by giving written notice before the change takes effect.

Entire agreement. This agreement, with its Schedules, Exhibit A (the Business Associate Agreement), and your service orders, is the entire understanding between us on this subject and supersedes any earlier or contemporaneous communications. If there is a conflict between Exhibit A and the rest of this agreement with respect to Protected Health Information, Exhibit A controls, except that the limitation of liability in Section 13 governs as provided in Exhibit A, Section A-8.2.

Assignment and subcontractors. You can't assign this agreement or your rights or obligations without our prior written approval, and any attempt to do so is void. We may partner with others (including your Platform Partner) and subcontract any of our obligations.

Force majeure. We're not liable for delays or failures caused by events beyond our control, such as fire, flood, acts of God, war, strikes, government action, civil disturbance, epidemic or pandemic, or inability to get materials, underlying services, or transportation.

Notices. We may give you any notice under this agreement by email to the address on your account, or through the service or your Platform Partner's product or portal; that notice is effective when sent. You may give us notice by email to legal@dialstack.ai, effective when we receive it. Keep the email address on your account current, a notice we send to the address on file is effective even if you failed to update it.

Other standard terms. If any provision is found unenforceable, the rest stays in effect and the provision is narrowed to the minimum needed to be enforceable. A waiver only counts if it's in writing, and not enforcing a right once doesn't waive it. This agreement creates no third-party beneficiaries, except that your Platform Partner may enforce its right to collect fees on our behalf and the releases, disclaimers, limitations, and indemnities in Sections 7, 12, and 13 that run in its favor. Electronic acceptance is as valid as a handwritten signature. Headings are for convenience only. We and you are independent contractors, neither is the other's agent, and you handle your own taxes, benefits, and employment matters for your personnel. Both of us will follow applicable laws and regulations, including export laws, when using the service.

Schedule 1: Services and Fair Use

Your subscription rates, the per-User license fee, the per-phone-number (DID) fee, and the per-location VoiceAI fee, are shown in your account portal, because those are the charges that scale as you add services. The other charges in this Schedule are stated here.

1. What the service includes

We provide hosted VoIP communications: voice calling, direct inward dialing (DID) phone numbers, voicemail, call-management features, and related functionality, delivered through our platform. You can access the service through your Platform Partner's product, a web portal and desktop or mobile apps, or the phones and devices you use with the service.

2. Service components

Your account may include user licenses, local and toll-free phone numbers, and VoiceAI locations, among other components. The components on your account and their per-User, per-number, and per-location rates are shown in your portal. Recurring fees are billed monthly in advance based on the resources provisioned as of each billing date (see Section 5).

3. Regulatory recovery fees

We charge the following fees to recover costs we incur as a carrier. These are our charges, not government taxes, and they are not mandated by any government. Genuine government taxes, fees, and surcharges (such as USF and state and local taxes) are separate and are passed through as described in Section 5 of the agreement.

• Regulatory Recovery Fee: $1.45 per User per month. Offsets our regulatory compliance costs (state PUC filings, USF administration, TCPA and other compliance systems, and related overhead).
• Emergency E911 Services Fee: $0.50 per phone number per month. Offsets our cost of delivering E911 (PSAP connectivity, location-database provisioning, and upstream E911 provider costs).

These fees may change as our costs change; we'll use commercially reasonable efforts to give at least 10 business days' notice of a change to the email on file.

4. Fair Use Policy

The service includes unlimited domestic calling (excluding international, toll-free, and per-minute-rated calls), subject to a fair use limit. Your account receives a pooled allowance of 2,000 minutes per User per month, calculated as 2,000 times the average daily User count for the billing period. Total domestic minutes used by the account are measured against this pool, and minutes over the pooled allowance are billed at $0.015 per minute, rounded up.

Overage billing. Fair use overage appears as a one-time charge on the following month's bill.

Exclusions. Calls to toll-free numbers aren't included in the fair use allowance and are billed separately per minute. International calling is currently blocked; if we offer it in the future, it will be billed per minute and will not count toward the fair use allowance.

VoiceAI. VoiceAI locations include inbound VoiceAI minutes under a separate fair use policy from the unlimited domestic calling above, and are measured separately, not in the User fair use pool. Each VoiceAI location receives 500 minutes per month, prorated for the part of the month it was provisioned, pooled across all VoiceAI locations on the account. Minutes over the pooled VoiceAI allowance are billed at $0.05 per minute, rounded up. VoiceAI overage appears as a one-time charge on the following month's bill.

5. Usage-based and one-time charges

Usage-based charges are billed monthly in arrears based on actual usage. They include fair-use overage (rates and billing timing are in Section 4) and per-minute charges for inbound calls to your toll-free numbers, billed at the rate stated in your service order. One-time charges include a one-time account activation fee of $10.00 per account. Any other one-time charges are stated in your service order.

6. Billing mechanics

Recurring fees are billed monthly in advance; usage, overage, and one-time charges are billed monthly in arrears for the prior month. On each billing date, recurring fees are calculated on the resources provisioned (Users, phone numbers, VoiceAI locations) as of that date and cover the month then beginning. Resources added mid-month are charged a prorated recurring fee for the rest of the month, on the following invoice. Resources removed mid-month stop incurring recurring fees from the next billing date; recurring fees already billed in advance for the current month are not refunded or credited.

7. Equipment

Any equipment you buy in connection with the service is obtained through your Platform Partner and governed by your terms with them.

Exhibit A: Business Associate Agreement

This Business Associate Agreement ("BAA") is part of, and incorporated into, the Service Subscription Agreement between you and DialStack, Inc. ("DialStack") that you accept when you set up your account (the "SSA"). As used in this Exhibit A, the "SSA" (and "this agreement," where the context is the main terms) means the Service Subscription Agreement set out above, of which this Exhibit A is a part. Capitalized terms used but not defined here have the meaning given in the SSA. Terms in Section A-1 that come from HIPAA have the meaning HIPAA gives them.

In this BAA, "you" or "Customer" is the business that owns the account, and where this BAA applies you are the "Covered Entity" (or, if you are yourself a business associate of another covered entity, the "Business Associate" whose subcontractor DialStack is). "DialStack," "we," "us," and "our" refer to DialStack, Inc., and where this BAA applies we are your "Business Associate." We agree to this BAA to support your compliance with HIPAA in connection with the phone service we provide as your carrier of record.

How this BAA is entered into. When you accept the SSA terms on this page, you also accept this BAA, and you represent and warrant that: (a) the person accepting is authorized to bind Customer; (b) Customer is a Covered Entity or a Business Associate under HIPAA; and (c) you understand that these terms include this Business Associate Agreement between Customer and DialStack, Inc. This is a representation and warranty, not just a notice.

A-1. Definitions

HIPAA terms. The following terms have the same meaning as in the HIPAA Rules: Breach, Data Aggregation, Designated Record Set, Disclosure, Health Care Operations, Individual, Minimum Necessary, Protected Health Information, Required By Law, Secretary, Security Incident, Subcontractor, Unsecured Protected Health Information, and Use.

Specific terms.

• HIPAA or the HIPAA Rules means the Privacy, Security, Breach Notification, and Enforcement Rules at 45 CFR Part 160 and Part 164, as in effect or amended, together with applicable requirements of the HITECH Act.
• PHI means Protected Health Information that DialStack creates, receives, maintains, or transmits for or on behalf of Customer in connection with the Services. It does not include information in our records that is not Protected Health Information.
• Services has the meaning given in the SSA (our hosted VoIP phone service and related functionality).

A-2. Scope: when this BAA applies, and the conduit line

This BAA applies only where, and to the extent, Customer is a Covered Entity or Business Associate under HIPAA and DialStack creates, receives, maintains, or transmits PHI for or on behalf of Customer in providing the Services.

To the extent we only transmit communications in real time and do not access their contents other than on a random or infrequent basis, we act as a mere conduit and not as a Business Associate, consistent with the HIPAA Rules. The obligations in this BAA attach to PHI that we store or process in providing the Services, such as voicemail and voicemail transcriptions, call recordings and their transcriptions, call detail records, and VoiceAI inputs and outputs, where those contain PHI.

Nothing in this BAA requires you to route PHI through the Services, and you are responsible for how your users use the Services (SSA §4).

A-3. Artificial intelligence, model training, and de-identified data

We will not use PHI to train, develop, fine-tune, or improve any artificial-intelligence or machine-learning model. We process PHI only to provide the Services and the features you use (for example, voicemail, transcription, call recording, and VoiceAI call handling and summaries), and for the other purposes permitted in Section A-5.

We may de-identify PHI in accordance with 45 CFR 164.514(a)-(c), and we may use and disclose that de-identified data for our own proper management and administration and to operate and improve the Services. Once de-identified in accordance with the HIPAA Rules, that data is no longer PHI, and we will not attempt to re-identify it.

For the avoidance of doubt, the content-for-training provision in SSA §9 does not apply to PHI. Where this BAA applies, this Section A-3 governs any use of communications content that is PHI.

A-4. Our obligations as Business Associate

A-4.1 Use and disclosure only as permitted. We will not use or disclose PHI other than as permitted or required by this BAA or as Required By Law. We will not use or disclose PHI in a manner that would violate Subpart E of 45 CFR Part 164 if done by Customer, except for the specific uses and disclosures permitted in Section A-5.

A-4.2 Safeguards. We will use appropriate administrative, physical, and technical safeguards, and, with respect to electronic PHI, comply with Subpart C of 45 CFR Part 164 (the Security Rule), to prevent use or disclosure of PHI other than as provided for by this BAA.

A-4.3 Reporting of breaches and security incidents. We will report to Customer:

• any use or disclosure of PHI not provided for by this BAA of which we become aware;
• any Breach of Unsecured PHI, without unreasonable delay and in no event later than thirty (30) calendar days after we Discover it (Discovery has the meaning in 45 CFR 164.410); and
• any Security Incident of which we become aware, on the same 30-day outside timeline.

To the extent known at the time of the report, we will describe what happened, the dates involved, the types of PHI affected, and the steps we are taking, and we will provide further information reasonably promptly as it becomes available. Customer is responsible for notifying affected Individuals, the Secretary, and (where applicable) the media under 45 CFR 164.404-408; we will cooperate and provide the information reasonably necessary for Customer to do so. The parties agree that this Section serves as notice of, and no separate report is required for, routine unsuccessful Security Incidents (such as pings, port scans, denial-of-service attempts, and malware that does not result in unauthorized access to or acquisition of PHI).

A-4.4 Subcontractors. In accordance with 45 CFR 164.502(e)(1)(ii) and 164.308(b)(2), we will require any Subcontractor that creates, receives, maintains, or transmits PHI on our behalf to agree in writing to restrictions and conditions at least as protective as those that apply to us under this BAA. We maintain business associate agreements with our infrastructure and communications vendors that handle PHI on our behalf.

A-4.5 Access. We do not maintain a Designated Record Set in the sense a health care provider does; our records are communications records (for example, voicemail, recordings, transcripts, and call detail). To the extent we hold PHI in a Designated Record Set, we will make it available to Customer as necessary for Customer to meet its obligations under 45 CFR 164.524, and if we receive a request for access directly from an Individual, we will forward it to Customer rather than respond to it and provide the underlying PHI to Customer within 10 business days of Customer's request.

A-4.6 Amendment. As with access under Section A-4.5, we do not maintain a Designated Record Set in the sense a health care provider does. To the extent we hold PHI in a Designated Record Set, we will make amendments to it as directed or agreed to by Customer under 45 CFR 164.526, or take other measures necessary for Customer to meet its obligations, within 10 business days of Customer's request, and we will forward to Customer any amendment request we receive directly from an Individual.

A-4.7 Accounting of disclosures. We will maintain and make available to Customer the information required for Customer to provide an accounting of disclosures under 45 CFR 164.528, within 10 business days of Customer's request. We will forward to Customer any accounting request we receive directly from an Individual.

A-4.8 Performing Customer's Privacy Rule obligations. To the extent we agree to carry out any of Customer's obligations under Subpart E of 45 CFR Part 164, we will comply with the requirements of Subpart E that apply to Customer in performing that obligation.

A-4.9 Availability to the Secretary. We will make our internal practices, books, and records relating to the use and disclosure of PHI available to the Secretary for purposes of determining Customer's compliance with the HIPAA Rules.

A-4.10 Where PHI is stored and accessed. PHI is stored and hosted only within the United States. Authorized members of our workforce located outside the United States may access it through those US-based systems, using secure access controls and limited to the Minimum Necessary, solely to provide and support the Services. We do not store PHI outside the United States. Wherever PHI is accessed, we maintain the safeguards required by the Security Rule (Section A-4.2) and hold our workforce to the obligations of this BAA.

A-5. Permitted uses and disclosures

We may use and disclose PHI:

• (a) To provide the Services. As necessary to perform, support, bill for, and maintain the Services under the SSA, including sharing PHI with your Platform Partner and our infrastructure providers as needed to deliver the Services (see SSA §9), each of which is bound to protect it.
• (b) As Required By Law.
• (c) For our management and administration, and legal responsibilities. For our own proper management and administration and to carry out our legal responsibilities, provided that any disclosure for those purposes is Required By Law, or we obtain reasonable written assurances from the recipient that the information will be held confidentially and used or further disclosed only as Required By Law or for the purpose for which it was disclosed, and that the recipient will notify us of any breach of confidentiality.
• (d) To de-identify data, as described in Section A-3.

We will make reasonable efforts to limit our use, disclosure, and requests of PHI to the Minimum Necessary to accomplish the purpose, consistent with Customer's minimum-necessary policies where you make them known to us.

A-6. Customer's obligations

A-6.1 Authorizations and permissions. Customer represents that it has obtained any consents, authorizations, and permissions necessary for us to use and disclose PHI as contemplated by this BAA and the Services.

A-6.2 Notice of limits and restrictions. Customer will notify us of any limitation in its notice of privacy practices (45 CFR 164.520), any change in or revocation of an Individual's permission to use or disclose PHI, and any restriction on use or disclosure that Customer has agreed to or must abide by under 45 CFR 164.522, in each case to the extent it may affect our use or disclosure of PHI. Customer acknowledges that, given the automated and high-volume nature of the Services, some restrictions may not be technically supportable, and Customer will not agree to a restriction that would require us to do something the Services are not built to do without confirming with us first.

A-6.3 Permissible requests. Customer will not request that we use or disclose PHI in any manner that would not be permissible under Subpart E of 45 CFR Part 164 if done by Customer, except as expressly permitted under Section A-5.

A-6.4 Appropriate use of the Services. Customer is responsible for how it and its users configure and use the Services, including what PHI they choose to route through, record, or store on the Services, consistent with SSA §3 and §4.

A-7. Term and termination

A-7.1 Term. This BAA takes effect when you accept the SSA terms (or, if earlier, when we first create, receive, maintain, or transmit PHI for you) and continues for as long as we hold PHI or the SSA remains in effect, whichever is longer.

A-7.2 Termination for cause. If Customer determines that we have materially breached this BAA, Customer may notify us and, if the breach is curable and we do not cure it within thirty (30) days (consistent with SSA §15), Customer may terminate this BAA and the SSA. Termination of this BAA for cause is a basis to terminate the SSA; termination of the SSA terminates this BAA.

A-7.3 Return or destruction of PHI. On termination, we will, within thirty (30) days and if feasible, return to Customer or destroy the PHI we still maintain that we received from, or created or received for, Customer. If return or destruction is not feasible, we will extend the protections of this BAA to that PHI and limit further use or disclosure to the purposes that make return or destruction infeasible, for as long as we retain it. We may retain PHI that we are Required By Law to retain, including call detail records and other communications records we must keep as a carrier (which may also be Customer Proprietary Network Information under SSA §9), and we may retain de-identified data. This Section survives termination.

A-8. Relationship to the SSA, and liability

A-8.1 Precedence. This BAA is part of the SSA. If there is a conflict between this BAA and the rest of the SSA with respect to PHI or a matter governed by the HIPAA Rules, this BAA controls, except as stated in Section A-8.2. Any ambiguity in this BAA will be interpreted to permit compliance with the HIPAA Rules.

A-8.2 Liability is governed by the SSA cap. All liability arising out of or relating to this BAA is subject to, and does not enlarge, the limitation of liability in SSA §13, including its two-month aggregate cap and its exclusion of indirect and consequential damages, and including the carve-outs in SSA §13 for our own gross negligence, willful misconduct, and fraud, and for liability that cannot be limited under applicable law. Nothing in this BAA creates any separate, higher, or uncapped liability, and this BAA creates no new indemnification obligation. The one-way customer indemnity in SSA §14 and the separate 911 release and indemnity in SSA §7 are unaffected.

A-8.3 No expansion of the parties' relationship. Except as this BAA requires for HIPAA compliance, nothing here changes the allocation of responsibility in the SSA, including that we are the carrier of record and your Platform Partner runs your account experience and billing.

A-9. Miscellaneous

A-9.1 Amendment. The parties will take such action as is necessary to amend this BAA from time to time for compliance with the HIPAA Rules. We may update this BAA in the same manner the SSA allows us to change its terms (SSA §16), including notice and, where appropriate, re-presentation for acceptance; if a change is required by the HIPAA Rules, it takes effect as needed for compliance.

A-9.2 Regulatory references. A reference to a section of the HIPAA Rules means that section as in effect or as amended, and any corresponding successor provision.

A-9.3 Survival. The obligations that by their nature should survive termination do, including Sections A-4.3 (as to incidents before termination), A-7.3, A-8, and this Section A-9.

A-9.4 No third-party beneficiaries. This BAA does not create any third-party beneficiary rights except as the HIPAA Rules require.

A-9.5 Governing law, notices, and electronic acceptance. Governing law, venue, notices, and the validity of electronic acceptance are as stated in SSA §16. Notices to us regarding this BAA may be sent to legal@dialstack.ai.