Subscription Services Agreement

1. Introduction

This Subscription Services Agreement (the “Agreement”) is a binding agreement between Rithma Inc, d/b/a Rithma (“Company”) and the individual or organization that registers for a subscription (“Subscriber”) for access to or use of Rithma (the “Services”) and states the terms upon which Company provides the Services. “Website signup” means account registration at dashboard.rithma.ai (or successor URL), selection of a plan on our pricing page, and completion of Stripe Checkout (or equivalent in-app subscription flow), or other document signed or agreed to by Subscriber. In the event of any inconsistency among the documents in the Entire Agreement section, the order of precedence stated there controls. Subscriber and Company are each a “Party.”

This Agreement was built with our data-privacy vendor, Enzuzo, and has been reviewed and corrected for Rithma’s home care software platform, subscription billing, and agency and consumer subscriber roles.

By completing website signup or clicking to accept, Subscriber agrees to this Agreement, the Terms of Service, the Privacy Policy, and the Cookie Policy. Subscriber represents that it is at least 18 years old (or that a parent or guardian is entering this Agreement for a senior-linked account) and has authority to bind the entity it represents.

2. Services

Subject to this Agreement, Company grants Subscriber a limited, non-exclusive, non-transferable, non-sublicensable right to access and use Company’s software-as-a-service product and related services set forth in the website signup (the “Services”). Rithma provides home care coordination software — scheduling, documentation, messaging, billing integration, and AI-assisted features — for caregivers, agencies, families, and seniors. Company is not a medical provider, insurer, or employer of caregivers.

3. Trial Services and Consumer Auto-Renewal

If Subscriber registers for a free trial, Company will make Trial Services available free of charge until the earlier of the end of the trial period or the date in the website signup. TRIAL SERVICES ARE PROVIDED “AS IS,” ARE NOT “SERVICES” HEREUNDER, AND CARRY NO WARRANTY, INDEMNITY, OR LIABILITY. Company may discontinue Trial Services at any time.

Consumer auto-renewal notice. Where Subscriber is an individual consumer (for example, a senior, family member, or solo caregiver), Company will disclose the trial length, the amount and frequency of the automatically-renewing charge, and how to cancel, before charging, and will send a reminder before a trial converts to a paid subscription, consistent with California’s Automatic Renewal Law (Bus. & Prof. Code § 17600 et seq.) and similar laws. Subscriber may cancel at any time in the billing portal; cancellation stops the next renewal.

4. Modification of the Services

Company may modify the features and functionality of the Services and will provide thirty (30) days’ notice of any deprecation of a material feature. Company will not materially decrease the overall functionality purchased during the applicable Term.

5. Subscriber’s Account

Subscriber shall create an account and is responsible for accurate registration information and the security of its credentials. For agency and organization accounts, Subscriber shall designate at least one authorized administrator to manage users, roles, and subscription settings. For individual consumer accounts (seniors, family members, or solo caregivers), the account holder is responsible for their own credentials and activity. The Services may be used only by Subscriber’s authorized users — employees, agents, contractors, family members, or the individual account holder — in connection with Subscriber’s permitted use. Subscriber shall notify Company immediately of any unauthorized use or suspected breach and is solely responsible for activity within its account.

6. Restrictions

Subscriber shall not: (a) copy the Services except as permitted; (b) create derivative works; (c) reverse engineer or attempt to access source code; (d) remove proprietary notices; (e) license, sublicense, sell, rent, lease, transfer, distribute, time-share, or otherwise commercially exploit or resell the Services to any third party other than authorized users for Subscriber’s internal purposes; (f) access the Services for competitive purposes; or (g) circumvent security or rights-management features. Subscriber is responsible for its authorized users’ compliance and for ensuring its use complies with all applicable laws and its own obligations to those users.

7. Term

Unless terminated under this Agreement, the term is month-to-month, beginning when Subscriber completes website signup and continuing through each successive monthly billing period (each, a “Term”). The subscription automatically renews for an additional monthly period at the end of each Term unless Subscriber cancels through the Stripe billing portal (or equivalent in-app billing controls) before the end of the current billing period, in which case cancellation takes effect at the end of that paid period. No advance non-renewal notice is required beyond cancellation in the billing portal.

8. Termination

A Party may terminate for cause on thirty (30) days’ uncured material breach, or immediately upon the other’s bankruptcy or insolvency. Company may suspend access immediately for breach until cured, and may terminate if the breach is uncurable or uncured within thirty (30) business days.

If Company terminates for cause, Subscriber must pay unpaid Fees accrued through the end of the current paid billing period (or the termination date, if earlier), but not Fees for future billing periods. No refunds or credits are provided if Subscriber terminates before the end of a Term. Sections that by their nature should survive (ownership, confidentiality, data-use grant, disclaimers, limitation of liability, dispute resolution, and payment obligations accrued before termination) survive termination.

9. Fees, Payment, and Taxes

Subscriber shall pay all Fees in the applicable website signup. Except as otherwise specified: (a) Fees are based on Services purchased, regardless of usage; (b) payment obligations are non-cancelable and Fees paid are non-refundable; (c) Services are deemed accepted on delivery; and (d) Subscriber may increase or decrease seat counts or change plans through Stripe or in-app billing controls, subject to proration and plan rules shown at checkout. Refunds, if any, follow Stripe and our support policies unless applicable law requires otherwise.

Fees are billed monthly. On late payment, Company may suspend the Services on thirty (30) days’ notice and charge interest at the lesser of 1.5% per month or the maximum permitted by law, plus reasonable collection costs. Fees exclude taxes; Subscriber is responsible for all applicable taxes other than taxes on Company’s net income.

10. Confidential Information

Each Party will protect the other’s Confidential Information with no less than reasonable care and use it solely to exercise rights and perform obligations under this Agreement, disclosing it only to personnel and contractors bound by confidentiality, or as required by law or valid legal process. Confidential Information excludes information that is public through no fault of the receiving Party, previously and lawfully possessed, lawfully received from a third party, or independently developed. Subscriber’s Confidential Information includes Subscriber Data; Company’s includes the Services and pricing.

11. Security

Company will maintain a security program with administrative, physical, and technical safeguards appropriate to the nature of the data, consistent with prevailing industry standards, to protect the Services and Subscriber Data. Company will access and use Subscriber Data solely to perform its obligations under this Agreement and as permitted by the Data Processing section below.

12. Privacy

In performing the Services, Company will comply with our Privacy Policy and Cookie Policy, located at https://www.rithma.ai/privacy and https://www.rithma.ai/cookies, incorporated by reference.

13. Intellectual Property

All rights, title, and interest in and to the Services (including all intellectual property rights and all modifications, customizations, scripts, and derivative works developed by Company) are owned exclusively by Company or its licensors. The rights granted to Subscriber convey no ownership in the Services. Company’s marks may not be used without Company’s prior written permission.

14. Subscriber Data

“Subscriber Data” means content, data, information, and materials submitted by Subscriber or an authorized user to the Services. Subscriber Data excludes Statistical Usage Data and Feedback (each defined below) and content from publicly available sources. Subscriber Data and Subscriber’s Confidential Information remain owned exclusively by Subscriber or its authorized users. Subscriber grants Company, its affiliates, and its subprocessors a worldwide license to access, host, display, process, analyze, transmit, reproduce, and otherwise use Subscriber Data to provide and support the Services in accordance with this Agreement. Company will not use Subscriber Data for advertising and will not sell or share Subscriber Data. Subprocessors may access Subscriber Data only to perform services for Company under written confidentiality and data-protection obligations consistent with this Agreement and our Privacy Policy.

14.1 Statistical Usage Data and De-Identified Data

“Statistical Usage Data” means data that is de-identified and/or aggregated so that it does not identify, and cannot reasonably be used to identify, Subscriber, any authorized user, or any individual. Company may create Statistical Usage Data from Subscriber Data and from use of the Services, and may use, retain, and disclose Statistical Usage Data during and after the Term for any lawful business purpose, including operating, securing, analyzing, benchmarking, and improving the Services and Company’s artificial-intelligence models, and developing new products and features.

Company will maintain and use Statistical Usage Data only in de-identified and/or aggregated form, will not attempt to re-identify it, and will require any recipient to honor the same restrictions. Company will not use Subscriber Data that identifies an individual, or any protected health information, to train generalized artificial-intelligence models. Consistent with 11 CCR § 7050(a)(3), any use of identifiable Subscriber Data to improve the Services is limited to improving the Services provided to Subscriber and will not be used to perform services for another customer. This Section survives termination.

14.2 Feedback

“Feedback” means suggestions, enhancement requests, or other feedback about the Services. Subscriber grants Company a perpetual, irrevocable, royalty-free license to use Feedback for any purpose, including to improve and develop the Services, without obligation or attribution. Feedback is not Subscriber Data or Subscriber’s Confidential Information.

15. Data Processing — CCPA Service Provider Terms

This Section applies to “personal information” (as defined by the California Consumer Privacy Act, as amended, and its regulations, the “CCPA”) that Company processes on Subscriber’s behalf, and satisfies the service-provider contract requirements of 11 CCR § 7051. With respect to such personal information, Subscriber is the business and Company is a service provider. This Section is intended to make a separate data processing addendum unnecessary for U.S. subscribers; where Subscriber requires its own data processing addendum, the parties may execute one, and it will control over this Section to the extent of any conflict.

Specific business purposes. Company processes personal information solely to provide the Services to Subscriber, namely: (i) hosting and operating Subscriber’s account and data; (ii) enabling scheduling, visit documentation, and care coordination; (iii) enabling messaging and notifications among Subscriber’s authorized users; (iv) processing subscription billing; (v) providing AI-assisted features such as transcription, summaries, and drafting at Subscriber’s direction; (vi) providing customer and technical support; (vii) securing the Services and preventing fraud, abuse, and security incidents; and (viii) creating and using Statistical Usage Data as permitted in Section 14.1. Personal information is disclosed to Company only for these limited and specified business purposes.

Company’s obligations. Company shall:

• not sell or share personal information it collects under this Agreement;
• not retain, use, or disclose that personal information for any purpose — including any commercial purpose — other than the specific business purposes above, or as otherwise permitted by the CCPA;
• not retain, use, or disclose that personal information outside the direct business relationship between the Parties, and not combine it with personal information received from another source or from Company’s own interactions, except as the CCPA permits;
• comply with the applicable obligations of the CCPA and provide the same level of privacy protection as the CCPA requires of businesses;
• notify Subscriber promptly after determining that it can no longer meet its obligations under the CCPA;
• grant Subscriber the right, on notice, to take reasonable steps to stop and remediate any unauthorized use of personal information; and
• permit Subscriber to take reasonable and appropriate steps — including assessments, audits, or other technical and operational testing no more than once every twelve (12) months on reasonable notice — to confirm Company’s use of personal information is consistent with Subscriber’s CCPA obligations.

Assistance. Taking into account the nature of the processing, Company will provide reasonable assistance to Subscriber in: responding to verified consumer requests to know, delete, correct, or opt out; honoring opt-out preference signals passed through to Company; meeting Subscriber’s risk-assessment and cybersecurity-audit obligations; and meeting Subscriber’s automated-decision-making technology (ADMT) obligations, including pre-use notice, access, and appeal support, to the extent the Services are used for a decision that significantly affects a consumer.

Cross-context behavioral advertising. Company does not, and the Parties do not by this Agreement contract to, provide cross-context behavioral advertising.

De-identified data. If Company receives or creates de-identified data, Company will maintain and use it only in de-identified form, will not attempt to re-identify it, and will require recipients to do the same, consistent with the CCPA.

Other state privacy laws. Where Subscriber is subject to the Virginia, Colorado, Connecticut, Utah, Texas, or other U.S. state privacy laws, Company acts as Subscriber’s “processor” and will process personal data only on Subscriber’s documented instructions, maintain confidentiality, assist with data-subject requests and assessments, and delete or return personal data at the end of the engagement, as those laws require.

16. Subprocessors

Company uses the following subprocessors to provide the Services, each bound by written obligations consistent with this Agreement:

• Amazon Web Services (AWS) — cloud hosting, database, storage, email/SMS delivery, AI inference, document text extraction, and logging
• Anthropic — foundation models (e.g. Claude) for AI-assisted features; invoked only through Amazon Bedrock (AWS), not via direct API calls to Anthropic, under terms that prohibit training on customer data
• Amazon SNS (AWS) — transactional SMS delivery (e.g. two-factor authentication codes)
• Stripe — subscription billing and payment processing
• Checkr — caregiver background-screening status, when an agency orders a check
• Google Cloud Translation — translation of content when translation features are enabled
• Intuit QuickBooks; Xero — optional accounting integrations, per agency configuration
• Stedi / Waystar and EVV or clearinghouse partners — optional billing/EVV integrations, per agency configuration

Subprocessor changes. The current list appears in this Section 16. Company will provide notice (for example, by email or by updating this Agreement) before adding a subprocessor that processes Subscriber Data. If Subscriber reasonably objects to a new subprocessor on data-protection grounds, Subscriber may notify Company within the notice period; if the Parties cannot resolve the objection, Subscriber’s exclusive remedy is to terminate the affected Services and receive a prorated refund of prepaid Fees for the unused period.

17. Data Retention, Return, and Deletion

Retention. Company retains Subscriber Data for the term of the Agreement and as needed to provide the Services. Retention periods by category are described in our Privacy Policy and internal retention schedule and generally are: account information, for the life of the account and up to thirty (30) days after closure (export window before de-identification); voice recordings, deleted after transcription and quality review (the transcript becomes the record); transcripts, visit logs, and care records, for the Term; after termination, Subscriber Data is de-identified after a thirty (30) day export window unless Subscriber or applicable law requires a different period; consent and compliance records, up to four (4) years (security-incident records longer) as required by law; and encrypted backups cycled out within thirty (30) days; recruiting and automated-decision-system records — applications, screening inputs and outputs, rankings, and related automated-decision data: retained a minimum of four (4) years, as required by California's employment recordkeeping rules for automated-decision systems.

Return and deletion on termination. On termination or expiration, Subscriber may export its Subscriber Data through the Services or by written request for a period of thirty (30) days. After that period, Company will delete or de-identify Subscriber Data within a commercially reasonable time, except (i) Statistical Usage Data, which is retained as permitted in Section 14.1; (ii) data Subscriber’s agency or applicable law requires to be retained; and (iii) routine backups that are deleted on the ordinary cycle. On Subscriber’s written request, Company will confirm deletion.

18. Healthcare, AI, and HIPAA

18.1 Healthcare Disclaimer

RITHMA IS NOT A MEDICAL PROVIDER, INSURER, OR EMPLOYER OF CAREGIVERS. THE SERVICES DO NOT PROVIDE MEDICAL ADVICE, DIAGNOSIS, TREATMENT, OR EMERGENCY RESPONSE. SUBSCRIBER IS SOLELY RESPONSIBLE FOR CLINICAL AND CARE DECISIONS AND FOR COMPLYING WITH APPLICABLE HEALTHCARE LAWS.

18.2 AI-Assisted Features

Some features use cloud AI services to tidy voice notes, draft summaries, or assist with in-app chat from data you provide. AI outputs may contain errors and are aids for documentation and communication only — not clinical records or professional advice. Subscriber is responsible for reviewing outputs before relying on them, and will not rely on AI output for medical, legal, or emergency decisions. In an emergency, call 911. Company does not guarantee accuracy, completeness, or suitability for a particular purpose. AI requests are processed through Amazon Web Services (including Anthropic models invoked via Amazon Bedrock); we do not send data directly to Anthropic.

18.3 HIPAA and Business Associate Agreement

Where Subscriber is a covered entity or business associate under HIPAA and processes protected health information (PHI) in the Services, the parties’ use and disclosure of PHI is governed by a separate Business Associate Agreement (BAA) executed between the parties. If no BAA is in effect, Subscriber must not submit PHI requiring a BAA unless and until a BAA is signed.

Any creation of de-identified data from PHI will use a HIPAA de-identification method (Safe Harbor or Expert Determination), and any data-aggregation services involving PHI will be performed only as the BAA permits.

18.4 Recruiting and Automated Employment Decisions

Where Subscriber uses the Services to post jobs, receive applications, or screen or rank applicants, Subscriber remains the employer and the sole decision-maker for all employment decisions. The Services provide decision support only: AI-generated rankings, summaries, or recommendations are advisory, and a human must review them before any employment decision is made. Company does not screen, score, rank, or filter applicants on the basis of any characteristic protected by the California Fair Employment and Housing Act or comparable law, or on proxies for such characteristics; does not administer tests, puzzles, games, or assessments that measure reaction time, dexterity, personality, or "culture fit"; does not analyze facial expressions, voice characteristics, or physical behavior of applicants; and does not inquire into criminal history through the Services before a conditional offer of employment has been made. Subscriber is responsible for providing reasonable accommodations to applicants who request them, and for its own compliance with applicable anti-discrimination laws. Company will retain automated-decision-system data generated through the Services for at least four (4) years and will make it available to Subscriber as needed for Subscriber's recordkeeping obligations. On Subscriber's reasonable request, Company will provide available information about how the Services generate recruiting recommendations.

19. Warranties and Disclaimers

Each Party warrants it has authority to enter this Agreement. Company warrants that its documentation accurately describes its security safeguards and that the Services will perform materially in accordance with the documentation; Subscriber’s exclusive remedy for breach of this warranty is as described herein. EXCEPT AS EXPRESSLY STATED, THE SERVICES ARE PROVIDED “AS IS” AND “AS AVAILABLE,” WITHOUT WARRANTIES OF ANY KIND, INCLUDING IMPLIED WARRANTIES OF MERCHANTABILITY, TITLE, FITNESS FOR A PARTICULAR PURPOSE, AND NON-INFRINGEMENT. COMPANY DOES NOT WARRANT THAT THE SERVICES WILL BE UNINTERRUPTED, TIMELY, SECURE, OR ERROR-FREE.

20. Indemnification

Company will defend Subscriber against third-party claims that the Services, as authorized here, infringe a valid patent, copyright, or registered trademark, or misappropriate a trade secret, and will pay resulting damages or settlement, subject to Company’s standard remedies (procure rights, modify, replace, or terminate and refund prepaid Fees). Standard exclusions apply.

Subscriber will defend Company against third-party claims relating to Subscriber Data (if used by Company in accordance with this Agreement) or Subscriber-built third-party applications, except to the extent caused by Company’s gross negligence or willful misconduct.

Indemnification is conditioned on prompt notice, sole control of the defense by the indemnifying Party, and reasonable cooperation; no settlement imposing obligations on the indemnified Party without its consent.

21. Limitation of Liability

UNDER NO LEGAL THEORY WILL EITHER PARTY BE LIABLE FOR LOST PROFITS, LOST DATA (LOST IN TRANSMISSION THROUGH NO FAULT OF COMPANY), BUSINESS INTERRUPTION, LOSS OF GOODWILL, OR ANY INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, CONSEQUENTIAL, OR PUNITIVE DAMAGES.

NOTWITHSTANDING ANYTHING TO THE CONTRARY, COMPANY’S AGGREGATE LIABILITY ARISING OUT OF THIS AGREEMENT OR THE SERVICES WILL NOT EXCEED THE GREATER OF (A) THE FEES PAID BY SUBSCRIBER IN THE TWELVE (12) MONTHS BEFORE THE EVENT GIVING RISE TO LIABILITY OR (B) ONE HUNDRED U.S. DOLLARS ($100). These limits do not apply to Company’s IP-indemnity obligations. In jurisdictions that do not allow certain limitations, liability is limited to the greatest extent permitted by law.

22. Dispute Resolution; Arbitration; Class-Action Waiver

Informal resolution first. Before starting a formal proceeding, the Parties will try to resolve any dispute informally: the complaining Party will send a written description to the other (to [email protected] for notices to Company) and allow thirty (30) days to resolve it.

Binding arbitration. Except as stated below, any dispute arising out of or relating to this Agreement or the Services that is not resolved informally will be settled by binding individual arbitration administered by JAMS under its applicable rules, in Santa Clara County, California or by video. Judgment on the award may be entered in any court of competent jurisdiction.

CLASS-ACTION WAIVER. THE PARTIES MAY BRING CLAIMS ONLY IN AN INDIVIDUAL CAPACITY, AND NOT AS A PLAINTIFF OR CLASS MEMBER IN ANY CLASS OR REPRESENTATIVE PROCEEDING.

Exceptions and opt-out. Either Party may bring an individual claim in small-claims court, and either Party may seek injunctive relief in court to protect intellectual property or Confidential Information. Subscriber may opt out of this arbitration and class-action-waiver Section by emailing [email protected] within thirty (30) days of first accepting this Agreement; if Subscriber opts out, or for any dispute not subject to arbitration, the courts described in Section 23 have exclusive jurisdiction. Company will not apply a material change to this Section to a dispute of which it has notice, and will seek Subscriber’s affirmative agreement to material changes to this Section rather than relying on continued use.

23. Governing Law and Venue

This Agreement is governed by the laws of the State of California, without regard to conflict-of-laws rules. Subject to Section 22 (Dispute Resolution; Arbitration), any action arising out of or relating to the Services will be instituted exclusively in the state or federal courts located in Santa Clara County, California, and each Party submits to the exclusive jurisdiction of those courts. The U.N. Convention on Contracts for the International Sale of Goods and the UCITA do not apply.

24. Export, Government Use, and General Terms

Export and sanctions. Subscriber will comply with U.S. and other applicable export-control and sanctions laws, will not access the Services from an embargoed or sanctioned region, and represents it is not on a restricted-party list. Government use. The Services are “Commercial Products” under 48 C.F.R. § 2.101, licensed with only the rights in this Agreement. Assignment. Subscriber may not assign without Company’s consent; Company may assign to an affiliate or in a change of control. Severability, waiver, and force majeure apply as customary. This Agreement, the Terms of Service, the Privacy and Cookie Policies, any applicable BAA, and the Stripe checkout terms are the entire agreement.

25. Entire Agreement and Order of Precedence

In the event of conflict, the order of precedence is: (1) a signed Business Associate Agreement (BAA), if applicable, to the extent it governs PHI; (2) the Stripe subscription and checkout terms applicable to Subscriber’s plan, as to billing; (3) this Agreement (including the Data Processing and Dispute Resolution Sections); (4) the Terms of Service at https://www.rithma.ai/terms; and (5) the Privacy Policy and Cookie Policy at https://www.rithma.ai/privacy and https://www.rithma.ai/cookies. Any amendment takes precedence over the document it amends.

26. Notices

Notices to Company: 251 Main St, Los Altos, CA 94022 and by email to [email protected]; Company may also give notice by email to the address associated with Subscriber’s account.