FinVerified, Inc.

FinVerified Master Service Agreement

Version 2026-09-30

Version: 2026-09-30 Provider: FinVerified, Inc., a Delaware corporation ("FinVerified," "we," "us") Customer: the medical, dental or other healthcare practice identified in the Customer's account (the "Practice," "you")

This Master Service Agreement (the "Agreement") governs the Practice's access to and use of the FinVerified platform. By clicking "Agree and sign," the individual signing confirms that they are authorized to bind the Practice, and the Practice agrees to this Agreement as of the date of that click (the "Effective Date"). This Agreement replaces and supersedes the FinVerified Provider Service Agreement (sometimes called the Platform Services Agreement) for any Practice that previously accepted it, effective on the Practice's acceptance of this Agreement.

1. What FinVerified Is — and Is Not

1.1 The Services. FinVerified provides software that helps the Practice deliver, document and prove the disclosures, acknowledgments and consents that accompany patient payment and financing conversations. This includes the Magic Link patient flow, time-stamped and sealed evidence records, compliance certificates, reminders, training, supplier and partner connections, and related dashboards and reports (together, the "Services"), as described in the platform and the Documentation.

1.2 Compliance and proof layer only. FinVerified is a compliance and documentation service. FinVerified:

(a) is not a lender, creditor, loan broker, credit services organization, or servicer, and does not make, arrange, negotiate, broker, approve, or service any extension of credit;

(b) is not a payment processor, money transmitter, payment facilitator, or merchant of record, and does not receive, hold, control, or transmit patient funds;

(c) does not recommend, rank, or steer patients or the Practice toward any lender, processor, servicer, or product, and lists third parties in a neutral order;

(d) is not a collection agency and does not collect debts; and

(e) does not provide legal, tax, accounting, or medical advice.

1.3 Practice as merchant. Where the Practice accepts card or bank payments through the Services, the Practice does so under its own agreement with its own payment processor (including, where the Practice elects, its own Stripe account). The Practice is the merchant of record. Funds settle directly to the Practice's processor account under that processor's terms. Refunds, chargebacks, disputes, and processor fees are between the Practice, the patient, and the processor.

1.4 Third-party providers. Lenders, processors, servicing firms, PMS/EMR vendors, and other third parties shown in the Services ("Third-Party Providers") are independent of FinVerified. Each Third-Party Provider is solely responsible for its own products, terms, disclosures, decisions, and legal compliance. A "FinVerified" status shown for a Third-Party Provider means only that the provider has completed FinVerified's attestation and verification checks as of the date shown. It is not an endorsement, guarantee, or credit rating.

2. The Practice's Account

2.1 Access. Subject to this Agreement, FinVerified grants the Practice a non-exclusive, non-transferable right, during the Term, for its Authorized Users to access and use the Services for the Practice's internal business purposes.

2.2 Authorized Users. "Authorized Users" are the Practice's owners, employees, and contractors whom the Practice invites. The Practice is responsible for:

(a) who it invites and the role it assigns;

(b) promptly removing access for anyone who leaves or no longer needs it;

(d) all activity under its account.

2.3 Security of credentials. Each Authorized User must use their own login and multi-factor authentication where offered, and must not share credentials. The Practice will notify FinVerified at support@finverified.ai without undue delay after learning of any unauthorized access.

2.4 Accurate information. The Practice will provide accurate, current, and complete information, including its legal name, locations, licenses, NPI, and supplier relationships, and will keep it updated. Verification checks, certificates, and state-specific content depend on this information.

3. The Practice's Responsibilities

3.1 The Practice's own compliance. The Practice remains responsible for its own compliance with laws that apply to its practice and its patient relationships. This includes consumer-credit, disclosure, privacy, telemarketing and messaging, anti-discrimination, and professional-conduct laws. The Services are designed to support that compliance and to create evidence of it. They do not transfer the Practice's legal obligations to FinVerified.

3.2 Treatment plans and estimates. The Practice is responsible for the accuracy of every treatment plan, cost estimate, and balance it enters or sends through the Services. The Services require that a pre-visit Magic Link begin with the patient's review and acknowledgment of the treatment plan and estimate. The Practice will not circumvent that step.

3.3 In-house payment plans. If the Practice offers its own payment plans, the Practice is the creditor for those plans. A plan payable in more than four installments, or with any finance charge, may make the Practice a "creditor" under the Truth in Lending Act and Regulation Z, and may be subject to state licensing, rate, and fee limits. The Practice is solely responsible for the terms and servicing of its own plans, whether it administers them itself or through a servicing firm it chooses.

3.4 Patient contact and consent. The Practice is responsible for obtaining and documenting any consent required before FinVerified sends texts or emails to a patient at the Practice's direction, including reminders. FinVerified applies the built-in quiet-hours, frequency, opt-out, and content limits described in the Documentation. The Practice will not ask FinVerified to contact a patient who has opted out, and will not use the Services to send collection demands.

3.5 Acceptable use. The Practice will not, and will not permit anyone to:

(a) use the Services for any unlawful, deceptive, or discriminatory purpose;

(b) upload content the Practice has no right to use;

(d) reverse engineer the Services except to the extent that restriction is prohibited by law;

(e) resell or provide the Services to third parties; or

(f) use the Services to build a competing product.

4. Fees and Payment

4.1 Fees. The Practice will pay the fees shown in its account at signup, or in any order form or pricing schedule FinVerified provides and the Practice accepts (the "Fees"). Fees are charged to the Practice only. The Practice will not pass FinVerified's Fees on to patients as a separate charge, surcharge, or convenience fee.

4.2 Billing. Unless the order form says otherwise, Fees are billed monthly in arrears to the payment method on file, and are due on receipt. Fees are in U.S. dollars and exclude taxes. The Practice pays all sales, use, and similar taxes other than taxes on FinVerified's net income.

4.3 Late payment. If an undisputed amount remains unpaid 15 days after FinVerified sends written notice of non-payment, FinVerified may suspend new Magic Link sends until it is paid. Existing evidence records remain available to the Practice during any suspension.

4.4 Fee changes. FinVerified may change Fees on at least 30 days' written notice. The change takes effect at the start of the next billing period after the notice period. If the Practice does not agree, it may terminate under Section 10.3 before the change takes effect. A Fee change does not apply to a Commitment Term already in progress (Section 10.2(d)).

4.5 Good-faith disputes. The Practice may dispute an invoice in good faith by notifying FinVerified within 30 days of the invoice date. The parties will work together to resolve the dispute promptly, and the undisputed portion remains payable.

5. Privacy, Security, and Protected Health Information

5.1 Business Associate Agreement. The FinVerified Business Associate Agreement (the "BAA") is incorporated into this Agreement as Exhibit A. It governs all Protected Health Information that FinVerified creates, receives, maintains, or transmits on the Practice's behalf. If this Agreement and the BAA conflict with respect to Protected Health Information, the BAA controls.

5.2 Security program. FinVerified will maintain a written information-security program with administrative, physical, and technical safeguards appropriate to the nature of the data. The program will include:

(a) encryption of Customer Data in transit and at rest;

(b) role-based access controls and multi-factor authentication for FinVerified personnel with production access;

(d) vulnerability management;

(e) workforce training; and

(f) an incident-response plan.

5.3 Customer Data. "Customer Data" means all data the Practice or its Authorized Users or patients submit to the Services, including evidence records. As between the parties, the Practice owns Customer Data. FinVerified uses Customer Data only to provide, secure, support, and improve the Services, as permitted by the BAA and this Agreement, and as required by law.

5.4 De-identified and aggregate data. FinVerified may create data that has been de-identified in accordance with 45 C.F.R. §164.514(a)–(c), and aggregate statistics that do not identify the Practice or any individual. FinVerified may use that data to operate and improve the Services and to publish industry benchmarks. FinVerified will not attempt to re-identify any individual or, without the Practice's consent, publicly identify the Practice.

5.5 Artificial intelligence features. Some features use machine-learning models operated by FinVerified's service providers. FinVerified will:

(a) apply redaction or minimization controls before sending patient information to any model provider, as described in the Documentation;

(b) not permit model providers to train their models on Customer Data; and

5.6 Subprocessors. FinVerified uses the third-party service providers listed at https://finverified.ai/legal/subprocessors to host and deliver the Services. FinVerified is responsible for their performance of its obligations. It will give at least 15 days' notice of a new subprocessor that will process Protected Health Information, by updating that list and notifying account owners. The Practice may object on reasonable data-protection grounds; if the parties cannot resolve the objection, the Practice may terminate without penalty.

6. Evidence Records and Certificates

6.1 Evidence records. The Services generate time-stamped records of disclosures presented, acknowledgments given, consents captured, reminders sent, and related events ("Evidence Records"). Evidence Records are sealed with cryptographic hashes at creation, and FinVerified will not alter a sealed Evidence Record. Corrections are recorded as new, linked entries.

6.2 Retention. FinVerified will retain Evidence Records for the Term plus seven (7) years, or longer if required by law or a legal hold the Practice requests in writing. After that period, FinVerified will delete them in accordance with the BAA.

6.3 What a certificate means. A FinVerified certificate or "FinVerified" status for the Practice means only that the Practice completed onboarding and passed FinVerified's automated checks as of the date shown. It is not a legal opinion, a guarantee of compliance, or a representation to any regulator or third party. The Practice will not represent it as any of those things. FinVerified may suspend or revoke a certificate or status if a check later fails or the information it relied on proves inaccurate.

6.4 State content. The Services present federal baseline content and, where available, state-specific content. State-specific content is shown for a jurisdiction only when FinVerified has marked that jurisdiction ready. FinVerified updates content as laws change, but the Practice acknowledges that laws change and that the Services may not reflect a change on the day it takes effect.

7. Intellectual Property and Feedback

7.1 FinVerified property. FinVerified and its licensors own the Services, the Documentation, all content FinVerified supplies (including disclosure templates, training, and state content), and all improvements to them. Except for the rights expressly granted in this Agreement, no rights are granted to the Practice.

7.2 Practice marks. The Practice grants FinVerified a limited license to display the Practice's name and logo within the Services, in communications to Third-Party Providers the Practice chooses to connect with, and on any public verification page the Practice enables. With the Practice's prior written consent, FinVerified may also identify the Practice as a customer in marketing.

7.3 Feedback. If the Practice gives suggestions or feedback about the Services, FinVerified may use them without obligation to the Practice.

8. Confidentiality

8.1 Definition. "Confidential Information" means non-public information that one party (the "Discloser") discloses to the other (the "Recipient") and that is marked confidential or would reasonably be understood to be confidential. Customer Data is the Practice's Confidential Information. The non-public features, pricing, and security details of the Services are FinVerified's Confidential Information.

8.2 Obligations. The Recipient will:

(a) use the Discloser's Confidential Information only to perform or receive the Services;

(b) protect it with at least reasonable care; and

(c) disclose it only to its employees, contractors, and advisors who need to know it and are bound by confidentiality obligations at least as protective as this Section.

8.3 Exclusions. These obligations do not apply to information that the Recipient can show:

(a) is or becomes public through no fault of the Recipient;

(b) was known to the Recipient without restriction before disclosure;

(d) was independently developed without use of the Discloser's information.

Protected Health Information is governed by the BAA regardless of these exclusions.

8.4 Compelled disclosure. The Recipient may disclose Confidential Information if required by law, provided it gives the Discloser prompt notice (where legally permitted) and reasonable assistance in seeking protective treatment.

9. Warranties and Disclaimers

9.1 Mutual. Each party represents that it has the authority to enter into this Agreement and that doing so does not breach any other agreement it is bound by.

9.2 FinVerified. FinVerified warrants that:

(a) the Services will perform materially as described in the Documentation; and

(b) it will not materially decrease the overall security of the Services during the Term.

The Practice's exclusive remedy for breach of this Section 9.2 is for FinVerified to use commercially reasonable efforts to correct the non-conformity. If FinVerified cannot do so within 30 days of written notice, the Practice may terminate the affected Services and receive a refund of any prepaid Fees for the period after termination.

9.3 The Practice. The Practice warrants that:

(a) it and its practitioners hold the licenses required to operate; and

(b) it has the rights and consents needed to provide Customer Data to FinVerified and to direct FinVerified's patient communications.

9.4 Disclaimer. EXCEPT AS EXPRESSLY STATED IN THIS AGREEMENT, THE SERVICES ARE PROVIDED "AS IS," AND FINVERIFIED DISCLAIMS ALL OTHER WARRANTIES, EXPRESS OR IMPLIED, INCLUDING MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, TITLE, AND NON-INFRINGEMENT. FINVERIFIED DOES NOT WARRANT THAT THE SERVICES WILL BE UNINTERRUPTED OR ERROR-FREE, OR THAT USE OF THE SERVICES WILL RESULT IN THE PRACTICE'S COMPLIANCE WITH ANY LAW. FINVERIFIED IS NOT RESPONSIBLE FOR THE PRODUCTS, DECISIONS, OR CONDUCT OF ANY THIRD-PARTY PROVIDER.

10. Term and Termination

10.1 Term. This Agreement begins on the Effective Date and continues until terminated (the "Term"). Unless the Practice has elected a Commitment Term, the Services are provided month to month.

10.2 Commitment Terms and automatic renewal. The Practice may elect a 12-month commitment at the commitment price shown in the platform at the time of election (a "Commitment Term").

(a) Automatic renewal. A COMMITMENT TERM AUTOMATICALLY RENEWS FOR SUCCESSIVE 12-MONTH COMMITMENT TERMS AT THE THEN-CURRENT COMMITMENT PRICE UNLESS THE PRACTICE TURNS OFF RENEWAL BEFORE THE END OF THE CURRENT COMMITMENT TERM. This is disclosed on the election screen before the Practice accepts.

(b) Renewal reminders. FinVerified will notify the account owner by email and in the platform at least 45 days and again at least 15 days before each renewal date. Each reminder states the renewal date and price and explains how to turn off renewal.

(c) Turning off renewal. The Practice may turn off renewal at any time in its billing settings with one click. If renewal is off, the Services continue month to month at the standard monthly price when the Commitment Term ends.

(d) Price changes. FinVerified will not change the commitment price during a Commitment Term. Any change to the commitment price for a renewal term will be stated in the 45-day reminder.

10.3 Termination for convenience. Either party may terminate this Agreement for any reason on 30 days' written notice.

(a) If the Practice terminates for convenience during a Commitment Term, termination takes effect at the end of the then-current Commitment Term. Fees for the remainder of that term remain payable monthly as scheduled.

(b) If FinVerified terminates for convenience during a Commitment Term, FinVerified will not charge any Fees after the termination date.

10.4 Termination for cause. Either party may terminate this Agreement on written notice if the other party:

(a) materially breaches this Agreement and does not cure the breach within 30 days after written notice (10 days for non-payment); or

(b) becomes the subject of a bankruptcy, insolvency, receivership, or assignment for the benefit of creditors that is not dismissed within 60 days.

FinVerified may also suspend access immediately, with notice, if needed to prevent imminent harm to the Services, other customers, or patients, or to comply with law. It will limit any suspension in scope and duration to what is reasonably necessary.

10.5 Effect of termination. On termination:

(a) the Practice's access ends, and unpaid Fees for Services already provided become due;

(b) for 60 days, FinVerified will make the Practice's Evidence Records and Customer Data available for export in a standard format at no charge; and

Termination does not affect patient Magic Links already completed or the integrity of sealed Evidence Records.

10.6 Survival. Sections 1.2–1.4, 3.3, 4 (for amounts owed), 5, 6.2, 6.3, 7, 8, 9.4, 10.5, 10.6, 11, 12, and 13 survive termination.

11. Indemnification

11.1 By FinVerified. FinVerified will defend the Practice against any third-party claim alleging that the Services, as provided by FinVerified, infringe or misappropriate that third party's U.S. intellectual-property rights. It will pay the resulting damages and costs finally awarded or agreed in settlement.

This does not apply to claims arising from:

(a) Customer Data or Practice content;

(b) the Practice's modification of the Services;

(d) use in breach of this Agreement.

If the Services are, or FinVerified believes they may be, subject to such a claim, FinVerified may procure the right for the Practice to continue using them, modify them to be non-infringing, or terminate the affected Services and refund any prepaid Fees for the unused period.

11.2 By the Practice. The Practice will defend FinVerified against any third-party claim arising from:

(a) the Practice's treatment plans, estimates, balances, in-house payment plans, or patient care;

(b) Customer Data that the Practice had no right to provide;

(d) the Practice's violation of law or of Section 3.5.

The Practice will pay the resulting damages and costs finally awarded or agreed in settlement.

11.3 Procedure. The indemnified party will:

(a) give prompt written notice of the claim (a delay excuses the indemnifying party only to the extent it is prejudiced);

(b) give the indemnifying party sole control of the defense and settlement, except that no settlement may impose an admission or non-monetary obligation on the indemnified party without its consent; and

12. Limitation of Liability

12.1 Exclusion of indirect damages. EXCEPT FOR EXCLUDED CLAIMS, NEITHER PARTY WILL BE LIABLE FOR ANY INDIRECT, INCIDENTAL, SPECIAL, CONSEQUENTIAL, OR PUNITIVE DAMAGES, OR FOR LOST PROFITS, REVENUE, OR GOODWILL, EVEN IF ADVISED OF THEIR POSSIBILITY.

12.2 General cap. EXCEPT FOR EXCLUDED CLAIMS AND DATA CLAIMS, EACH PARTY'S TOTAL LIABILITY ARISING OUT OF OR RELATING TO THIS AGREEMENT WILL NOT EXCEED THE FEES PAID AND PAYABLE BY THE PRACTICE UNDER THIS AGREEMENT IN THE TWELVE (12) MONTHS BEFORE THE EVENT GIVING RISE TO THE LIABILITY.

12.3 Data claims cap. FOR DATA CLAIMS, FINVERIFIED'S TOTAL LIABILITY WILL NOT EXCEED THE GREATER OF (A) THREE (3) TIMES THE FEES PAID AND PAYABLE IN THE TWELVE (12) MONTHS BEFORE THE EVENT, OR (B) ONE HUNDRED THOUSAND U.S. DOLLARS ($100,000). "DATA CLAIMS" MEANS CLAIMS ARISING FROM FINVERIFIED'S BREACH OF SECTION 5, SECTION 8 AS IT APPLIES TO CUSTOMER DATA, OR THE BAA. THIS CAP INCLUDES THE REASONABLE COSTS OF BREACH NOTIFICATION REQUIRED BY LAW.

12.4 Excluded claims. "Excluded Claims" are:

(a) a party's indemnification obligations under Section 11;

(b) the Practice's obligation to pay Fees; and

12.5 Basis of the bargain. These limitations apply to all theories of liability and even if a limited remedy fails of its essential purpose. The Fees reflect this allocation of risk.

13. General

13.1 Changes to this Agreement. FinVerified may update this Agreement or the BAA by publishing a new version and giving account owners written notice with a summary of the changes.

(a) A change that FinVerified marks as requiring re-acceptance takes effect for the Practice when the Practice accepts it.

(b) If the Practice has not accepted within 14 days after notice, FinVerified may pause new Magic Link sends until acceptance. Existing Evidence Records and completed patient flows are unaffected.

(c) If the Practice does not wish to accept, it may terminate under Section 10.3 and will not be bound by the new version.

(d) Changes not marked as requiring re-acceptance take effect 30 days after notice. Those changes may not materially reduce the Practice's rights or FinVerified's security or privacy obligations.

13.2 Governing law and venue. This Agreement is governed by the laws of the State of Florida, without regard to its conflict-of-laws rules. The state and federal courts located in Palm Beach County, Florida have exclusive jurisdiction, except that either party may seek injunctive relief in any court of competent jurisdiction to protect its Confidential Information or intellectual property.

13.3 Notices. Notices to FinVerified go to legal@finverified.ai, with a copy to FinVerified, Inc., 11718 SE Federal Hwy., Suite 202, Hobe Sound, FL 33455. Notices to the Practice go to the account owner's email address on file. Email notices are effective when sent, unless a bounce is received.

13.4 Assignment. Neither party may assign this Agreement without the other's written consent, which will not be unreasonably withheld. However, either party may assign it without consent to a successor in a merger, acquisition, or sale of all or substantially all of its assets or of the business to which this Agreement relates, if the successor assumes this Agreement in writing and, for any assignment of the Practice's account, provides the BAA assurances required by law.

13.5 Force majeure. Neither party is liable for a delay or failure caused by events beyond its reasonable control, other than payment obligations, if it uses reasonable efforts to resume performance.

13.6 Independent contractors. The parties are independent contractors. Nothing in this Agreement creates a partnership, joint venture, agency, fiduciary, or employment relationship.

13.7 No third-party beneficiaries. There are no third-party beneficiaries of this Agreement.

13.8 Electronic signature and records. The parties agree that this Agreement may be executed electronically, that the electronic record FinVerified keeps of the Practice's acceptance is an original, and that it is admissible to the same extent as a signed paper document.

13.9 Entire agreement; order of precedence. This Agreement, including the BAA (Exhibit A), any order form, and the Documentation referenced in this Agreement, is the entire agreement between the parties about its subject matter. It supersedes all prior agreements on that subject matter, including the Provider Service Agreement. If these documents conflict, the order of precedence is:

(a) the BAA, as to Protected Health Information;

(b) an order form signed by both parties, as to Fees;

(d) the Documentation.

Terms in any Practice purchase order or similar document do not apply.

13.10 Severability; waiver. If any provision is held unenforceable, it will be enforced to the maximum extent permissible and the rest of this Agreement remains in effect. A failure to enforce a provision is not a waiver.

Exhibit A: FinVerified Business Associate Agreement, Version 2026-09-30