Prior Authorization Support Agreement

Section 1: Services

RxGranted provides clinical documentation and administrative support services related to prior authorization, including:

• Preparation of prior authorization (PA) letters with clinical justification
• Clinical documentation supporting medical necessity
• Appeal letters for denied prior authorization requests
• Administrative submission of PA requests to payers (Full Service plan only)
• Status tracking and payer follow-up (Full Service plan only)
• Submission and management of prior authorization appeals and external appeal requests on Client's behalf

Section 1A: Administrative Representative Designation

Client designates ASKARX LLC d/b/a RxGranted as its administrative representative for the limited purpose of preparing, submitting, and managing prior authorization requests, internal appeals, payer communications, and related administrative tasks, to the extent permitted by applicable law, payer requirements, and reviewing-body procedures.

For external review proceedings, including those administered by the New Jersey Department of Banking and Insurance or its designated Independent Utilization Review Organizations, RxGranted may assist with preparation and coordination. Client acknowledges, however, that additional provider signatures, patient authorizations, consent-to-representation forms, releases, or attestations may be required by the applicable payer or reviewing authority for such proceedings.

Client remains solely responsible for obtaining and maintaining all authorizations, consents, releases, and provider attestations required by law, payer policy, or reviewing-body procedure before submission of any case. Nothing in this Agreement eliminates the need for patient-specific or case-specific authorization where required.

Section 2: Service Plans and Pricing

For purposes of this Agreement, a "PA Case" means a single prior authorization matter for one patient and one medication or treatment request, including associated preparation, documentation support, submission if applicable, status follow-up if applicable, and appeal support arising from that request. A "PA Letter" means the written prior authorization justification document prepared by RxGranted. In the Core and Core+ Plans, PA Letters are delivered to Client for Client's review, approval, modification if necessary, and submission to the applicable payer. In the Full Service Plan, RxGranted may prepare and submit PA requests to payers on Client's behalf, subject to Client authorization and payer portal access requirements.

RxGranted offers the following service plans. Specific pricing, overage rates, add-on seat pricing, annual billing discounts, and any client-specific modifications are set forth in this Agreement, the applicable Order Form, or the applicable enrollment confirmation.

Section 3: Turnaround and Delivery

3.1 Definition of Turnaround Time

"Turnaround Time" means the period from RxGranted's receipt of a Complete Submission (as defined in Section 3.4) to delivery of the completed PA letter to Client. Turnaround Time does not include payer review, payer decision, or any period during which RxGranted is awaiting information from Client.

3.2 Standard Requests

Standard PA requests are typically completed within 1–3 business days after RxGranted's receipt of a Complete Submission. This is an estimate only and not a guarantee.

3.3 Urgent Requests

Urgent PA requests — defined as cases for which Client provides documented clinical urgency at the time of submission — are typically completed within 24–72 hours. Urgent processing is subject to RxGranted's discretion and operational capacity at the time of submission. Designation of a case as "urgent" by Client does not guarantee expedited completion. RxGranted will notify Client if urgent processing cannot be accommodated.

3.4 Complete Submission

A "Complete Submission" means a case submission that includes all of the following: (a) accurate and complete patient demographics; (b) insurance information and policy details; (c) prescribing provider credentials (NPI, DEA if applicable, license, address, fax); (d) clinical documentation sufficient to support medical necessity; and (e) any payer-specific forms or requirements identified by RxGranted upon intake review. Turnaround Time does not begin until all required elements are received.

3.5 Excluded Delays

The following do not constitute delays by RxGranted and do not toll, extend, or restart any Turnaround Time commitment: (a) Client's failure to respond to RxGranted's requests for missing or supplemental information; (b) payer portal outages, payer processing delays, or payer requests for additional documentation after submission; (c) delays caused by third-party system failures; or (d) Force Majeure events described in Section 10B.

3.6 No Guarantee of Payer Outcome — Estimates Only

Turnaround Time references in this Agreement are estimates of RxGranted's internal drafting and delivery time only. RxGranted does not guarantee payer approval, payer processing speed, or any specific clinical outcome. Payer review timelines are set exclusively by the insurer and are entirely outside RxGranted's control. Nothing in this Section 3 creates an obligation for RxGranted to guarantee any specific payer response time or outcome.

3.7 Commercially Reasonable Efforts.

RxGranted shall use commercially reasonable efforts to meet the turnaround time estimates set forth in this Section 3. All timelines are estimates based on typical workflows, case complexity, and operational capacity, and do not constitute guarantees of completion within a specific timeframe.

Section 4: Client Responsibilities

Client agrees to:

• Provide accurate and complete patient demographics, clinical data, insurance information, and supporting documentation
• Maintain all provider-patient relationships and clinical decision-making authority
• Submit completed PA letters to the appropriate payer (Core plan)
• Grant and maintain necessary system access for RxGranted to perform submissions (Full Service plan)
• Execute a HIPAA Business Associate Agreement prior to sharing any Protected Health Information
• Notify RxGranted promptly of any changes to patient information, payer requirements, or access credentials
• Warrant the accuracy and completeness of all provider credentials provided, including NPI, DEA number, practice address, phone, fax, and license information. Submission errors arising from inaccurate credentials provided by Client are Client's sole responsibility.
• Notify RxGranted of any payer denial dates, appeal deadlines, or time-sensitive payer requirements within 2 business days of receipt. RxGranted's appeal obligations commence upon Client's transmission of the denial letter to RxGranted, not the payer's issuance date.

Section 5: Access Authorization and Subcontractor HIPAA Compliance

5.1 Case Intake; Portal-Based Submission

PHI and case information are submitted to RxGranted exclusively through the secure RxGranted client portal (the "Portal"). Client uploads case details, clinical values, supporting documents, and prescriber information via the Portal. RxGranted does not, by default, access Client's Electronic Medical Record (EMR/EHR), payer portals, clearinghouse accounts (e.g., Availity, CoverMyMeds), or any other Client system.

If Client separately and expressly authorizes RxGranted in writing to access a specific external system on Client's behalf for a specific purpose, such access shall be (a) limited to the minimum necessary to perform the authorized task, (b) restricted to the specific individual authorized by Client, (c) revocable by Client at any time, and (d) governed by the terms of this Agreement and the BAA. Client retains sole ownership of all credentials used for any such access, and RxGranted will not store credentials for any system outside its own infrastructure without Client's explicit written authorization.

5.2 Subcontractor HIPAA Compliance

RxGranted utilizes the following third-party vendors. RxGranted has executed, or will execute prior to any PHI transmission, a Business Associate Agreement (BAA) with each vendor that creates, receives, maintains, or transmits PHI on its behalf.

PHI-handling vendors (BAA-covered):

• Supabase, Inc. — database, authentication, and object storage for the client portal. Covered by Supabase's Business Associate Agreement under the Team + HIPAA plan.
• Amazon Web Services, Inc. — Amazon Bedrock service is used to generate draft clinical content. Covered by the AWS Business Associate Addendum.
• Google LLC (Google Workspace) — business email and document drafting. Covered by the Google Workspace Business Associate Agreement.

Non-PHI vendors (no BAA required):

• Netlify, Inc. — static website hosting and serverless function execution. No PHI is transmitted to or stored by Netlify; PHI writes from serverless functions are directed to Supabase via encrypted service-role calls.
• Stripe, Inc. — payment processing (PCI-DSS Level 1). Stripe does not receive PHI; payment card data is submitted directly to Stripe by Client and is not stored by RxGranted.

The list above reflects vendors in use as of the Effective Date. RxGranted will not transmit PHI to any new vendor that creates, receives, maintains, or transmits PHI on its behalf without first executing a BAA. An updated list of vendors and their BAA status is available to Client upon written request within thirty (30) days of addition of any new PHI-handling vendor.

5.3 PHI Retention

RxGranted retains Protected Health Information only as long as necessary to provide the Services, fulfill the terms of this Agreement and the BAA, comply with applicable law, and respond to reasonable Client requests. PHI retention periods vary based on service necessity, Client instructions, and legal obligations; this Agreement does not establish a fixed PHI retention period.

Separately, RxGranted maintains documentation of its policies, procedures, risk analyses, audit logs, and training records for six (6) years from the date of creation or the date last in effect, as required by 45 C.F.R. § 164.316(b)(2)(i).

Upon termination of this Agreement, RxGranted shall return or securely destroy PHI in accordance with the BAA, unless return or destruction is not feasible as provided in 45 C.F.R. § 164.504(e)(2)(ii)(J), in which case PHI protections continue to apply for as long as RxGranted retains the information.

Section 6: Payment Terms

• All plans are billed monthly in advance after the Proof of Concept period ends, unless annual billing or other billing terms are specified in this Agreement, the applicable Order Form, or enrollment confirmation
• Client shall maintain a valid payment method on file during the Proof of Concept period and throughout the service relationship
• Payment is due upon receipt of invoice unless otherwise stated in this Agreement, the applicable Order Form, or enrollment confirmation
• No long-term contract is required unless otherwise agreed in writing. Client may cancel in accordance with the cancellation terms of this Agreement
• No refunds are issued for completed PA Letter work, submitted PA Cases, appeal work, payer follow-up work, or partial months
• Additional PA Letters or PA Cases beyond plan limits are invoiced monthly in arrears at the applicable overage rate specified in this Agreement, the applicable Order Form, or enrollment confirmation
• Additional portal users are billed at the per-seat monthly rate specified in this Agreement, the applicable Order Form, or enrollment confirmation
• Annual billing may be available at a discounted rate if specified in this Agreement, the applicable Order Form, or enrollment confirmation
• Client's subscription rate is guaranteed for twelve (12) months from the Effective Date. After the initial twelve (12) month period, RxGranted may adjust pricing upon at least sixty (60) days' written notice to Client
• RxGranted reserves the right to suspend services for accounts more than thirty (30) days past due
• Overage charges, add-on seat charges, and any other variable charges are itemized on the monthly invoice. Disputed charges must be raised within thirty (30) days of the invoice date; undisputed portions remain due

Section 7: Liability and Disclaimers

• RxGranted is not responsible for payer coverage decisions. Approval of any prior authorization request is ultimately determined by the patient's insurance company.
• RxGranted shall not be liable for delays caused by incomplete or inaccurate information provided by Client.
• Except in cases of gross negligence, willful misconduct, or breach of Protected Health Information obligations, RxGranted's aggregate liability shall not exceed the total fees paid by Client in the twelve (12) months preceding the event giving rise to the claim.
• Client acknowledges that RxGranted's role is limited to documentation and administrative support, and that all clinical decisions remain with Client.
• RxGranted provides administrative documentation support services only and does not practice medicine, law, or pharmacy in a clinical capacity in connection with these Services. Nothing in this Agreement shall be construed as the practice of law or legal representation. For external appeal proceedings, RxGranted acts as Client's authorized healthcare administrative representative, not as legal counsel.
• RxGranted does not guarantee PA approval. Denial of any PA request, appeal, or external review by a payer or review organization does not constitute a failure of service and does not entitle Client to a refund. All completed work is non-refundable.

No Warranty of Outcome

RxGranted makes no warranties regarding the outcome of any prior authorization request, appeal, or payer determination. Such outcomes are solely determined by the applicable payer or reviewing body and are outside the scope of this Agreement.

Section 7A: Indemnification

Client shall indemnify, defend, and hold harmless RxGranted and its owners, employees, contractors, and agents from and against any claims, damages, liabilities, penalties, costs, and expenses, including reasonable attorneys' fees, arising out of or related to: (a) inaccurate, incomplete, misleading, or fraudulent information supplied by Client; (b) Client's failure to obtain required patient authorizations, provider attestations, signatures, or releases; (c) clinical decisions made by Client or its providers; or (d) Client's violation of applicable law, payer requirements, or third-party platform terms of use.

Section 8: HIPAA Compliance

RxGranted maintains administrative, physical, and technical safeguards designed to comply with the applicable provisions of the HIPAA Privacy Rule, Security Rule, and Breach Notification Rule (45 C.F.R. Parts 160 and 164). The Parties agree to execute a Business Associate Agreement ("BAA") prior to the exchange of any Protected Health Information. The BAA, attached hereto or executed separately, is incorporated into this Agreement by reference. Both Parties shall comply with all applicable provisions of the HIPAA Privacy Rule, Security Rule, and Breach Notification Rule.

Section 9: Confidentiality

Each Party agrees to maintain the confidentiality of the other Party's proprietary information, business methods, pricing, and operational procedures. This obligation survives termination of this Agreement for a period of two (2) years.

RxGranted shall not use Client's practice name, patient information, or case details for marketing or promotional purposes without Client's express prior written consent.

Section 10: Term and Termination

10.1 Term

This Agreement is effective as of the Effective Date and continues on a month-to-month basis until terminated.

10.2 Termination by Either Party

Either Party may terminate this Agreement at any time by providing written notice. Termination is effective at the end of the then-current billing cycle, unless the terminating Party expressly requests immediate termination.

10.3 Open Cases Upon Termination

Upon receipt of a termination notice, RxGranted shall: (a) complete all PA cases with status IN PROGRESS or SUBMITTED at the time of notice, at no additional charge; (b) cease accepting new case submissions as of the termination effective date; and (c) deliver all completed letters and case documentation to Client within 5 business days of completion.

10.4 Immediate Termination by RxGranted

RxGranted may terminate this Agreement immediately, without cure period, upon: (a) Client's non-payment exceeding 30 days past due; (b) Client's material breach of HIPAA or the BAA; or (c) Client's provision of materially false or fraudulent credentials or clinical information.

10.5 Access Revocation

Client shall revoke all system and portal access granted to RxGranted within 2 business days of the termination effective date.

10.6 Survival

Sections 7, 7A, 8, 9, and this Section 10 survive termination of this Agreement.

Section 10A: Peer-to-Peer Review Services

Where a peer-to-peer (P2P) review is available and clinically appropriate, RxGranted will prepare a clinical brief for Client's treating physician to use in direct conversation with the payer's medical director. The P2P call must be conducted by the treating physician. RxGranted's obligation is limited to preparation of the clinical brief and scheduling coordination. RxGranted cannot guarantee the availability of the payer's medical director or the outcome of the P2P review. Client acknowledges that physician participation is required and that RxGranted bears no responsibility for outcomes arising from the physician's unavailability or the substance of the physician's direct communication with the payer.

Section 10B: Force Majeure

RxGranted shall not be liable for any failure or delay in performance caused by circumstances beyond its reasonable control, including internet outages, payer portal downtime, electronic medical record outages, failures of third-party vendors or subcontractors, natural disasters, labor disruptions, acts of government, pandemics, or other events beyond RxGranted's reasonable control. Turnaround commitments under Section 3 are suspended for the duration of any such event.

Section 11A: Excluded Services

RxGranted does not provide Services for the following without prior written agreement: (a) controlled substance PA requests where the primary clinical justification requires prescriber attestation under DEA regulations; (b) experimental or investigational drug requests for which no published peer-reviewed clinical support exists; (c) requests where Client has materially misrepresented clinical facts in the submission. RxGranted reserves the right to decline any case outside its service scope and will promptly notify Client in writing with the reason for declination.

Section 11: Governing Law; Dispute Resolution

11.1 Governing Law

This Agreement shall be governed by the laws of the State of New Jersey, without regard to conflict of law principles, to the extent not preempted by federal law (including HIPAA).

11.2 Good-Faith Negotiation

The Parties shall first attempt in good faith to resolve any dispute arising out of or relating to this Agreement through informal negotiation between designated representatives within thirty (30) days of written notice of the dispute.

11.3 Binding Arbitration

If a dispute is not resolved through negotiation under Section 11.2, it shall be submitted to final and binding arbitration administered by the American Arbitration Association ("AAA") pursuant to its Commercial Arbitration Rules. Arbitration shall take place in Burlington County, New Jersey, or such other location as the Parties mutually agree. The arbitration shall be conducted by a single arbitrator, and the arbitrator's decision shall be final and binding. Each Party shall bear its own attorneys' fees unless otherwise ordered by the arbitrator. Judgment on the arbitration award may be entered in any court of competent jurisdiction.

11.4 Injunctive Relief; Enforcement

Notwithstanding Section 11.3, either Party may seek temporary or preliminary injunctive or equitable relief in a state or federal court located in New Jersey to protect intellectual property rights, confidential information, or PHI, or to enforce an arbitration award. The Parties consent to the personal jurisdiction and venue of such courts for those limited purposes.

11.5 No Class Actions

The Parties agree that arbitration shall be conducted on an individual basis and not as a class action, mass action, or consolidated proceeding.

Section 12: Entire Agreement

This Agreement, together with the BAA, constitutes the entire agreement between the Parties regarding the subject matter hereof. No modification shall be effective unless in writing and signed by both Parties.

Electronic Signatures

This Agreement may be executed electronically, and electronic signatures shall have the same legal force and effect as original signatures.

Non-Exclusive Relationship

Nothing in this Agreement shall be construed to create an exclusive relationship between the Parties.