MapSorix Care Subscription Agreement

Parties

MapSorix Innovations Inc., a corporation with its office at 231 Thakur St, Saskatoon, SK S7W 0Z9 ("MapSorix", "we", "us"); and

the person or company named as the operator on the Setup Form, which holds the licence under The Personal Care Homes Act for each Home on this subscription ("the Operator", "you").

Background

A. MapSorix makes MapSorix Care, a hosted service for running a licensed personal care home in Saskatchewan.

B. The Operator holds a licence under The Personal Care Homes Act, SS 1989-90, c P-6.01, for each Home named on the Setup Form, and wishes to use MapSorix Care for those Homes on the terms below.

C. As the licensee, the Operator is a trustee of personal health information under The Health Information Protection Act, SS 1999, c H-0.021, s.2(1)(t)(iv). MapSorix is an information management service provider to it under s.2(1)(j) and s.18 of that Act. Their duties about personal health information are set out in the HIPA Agreement, signed separately.

1. Definitions and interpretation

1.1 In this Agreement:

• (a) "Administrator" means a User whom the Operator gives the administrator role for a Home.
• (b) "Agreement" means this subscription agreement, together with the Setup Form for each Home and the purchase confirmation MapSorix sends.
• (c) "Billing Period" means the month or the year for which Fees are paid in advance.
• (d) "Business Day" means a weekday that is not a statutory holiday in Saskatchewan.
• (e) "Commissioner" means the Saskatchewan Information and Privacy Commissioner.
• (f) "Confidential Information" has the meaning in 12.1.
• (g) "Effective Date" means the day the Operator accepts this Agreement under 18.12.
• (h) "Enhanced Cap" and "General Cap" have the meanings in 15.3 and 15.2.
• (i) "Fees" means the amounts payable for the Service and the Records Archive under sections 3, 4 and 6.5, before taxes.
• (j) "HIPA" means The Health Information Protection Act, SS 1999, c H-0.021, and "the Regulations" means The Health Information Protection Regulations, 2023, as each is amended from time to time.
• (k) "HIPA Agreement" means the written agreement between the Operator and MapSorix that HIPA s.18(2) requires, covering every Home.
• (l) "Home" means each personal care home that the Operator holds a licence for and that is named on a Setup Form for this subscription.
• (m) "Home Data" means all information that Users, or MapSorix on the Operator's behalf, put into the Service for a Home, including personal health information and other personal information. It is the same information the HIPA Agreement calls "Home Information".
• (n) "Licensed Beds" means the authorized capacity of a Home: the maximum number of residents stated on its current licence.
• (o) "Privacy Breach" has the meaning in the HIPA Agreement.
• (p) "Privacy Claim" means a claim against MapSorix arising from a Privacy Breach caused by MapSorix's breach of the HIPA Agreement, or of section 12 as it applies to Home Data.
• (q) "Records Archive" means the read-only arrangement described in 6.5.
• (r) "Service" means MapSorix Care: the web app, its use on tablets the Operator enrols, the family portal, the pharmacy portal, its help and documentation, and the backups of them, as MapSorix provides them from time to time.
• (s) "Service Data" means information about how the Service runs, such as error reports, counts, timings and device types, that contains no resident's name and no health information.
• (t) "Setup Form" means the form, online or on paper, on which the Operator names a Home, its Licensed Beds, its first Administrator and its billing contact.
• (u) "Shared Subscription" means a subscription covering more than one Home under 3.4.
• (v) "Support Access" means the procedure in 16.3 by which an Administrator lets MapSorix support see a Home's records.
• (w) "User" means a person to whom the Operator, or a pharmacy the Operator pairs with, gives access to the Service for a Home: staff, family members and pharmacy staff.

1.2 Headings are for convenience only. "Including" means "including without limitation". The singular includes the plural. A reference to a statute or regulation is to it as amended or replaced. All amounts are in Canadian dollars.

1.3 If this Agreement and the HIPA Agreement conflict about Home Data or personal health information, the HIPA Agreement prevails. Otherwise this Agreement prevails over the Setup Form, the purchase confirmation, the website's summary terms and the Service's own policy text.

2. What MapSorix provides

2.1 MapSorix grants the Operator a non-exclusive, non-transferable right, without the right to sublicense, to use the Service, and to let its Users use it, for operating each Home, for as long as the subscription continues.

2.2 The subscription includes, for each Home: every feature of the Service; unlimited staff accounts; up to 20 enrolled tablets; remote setup; two hours of online training; support under 10.2; hosting in Canada; daily backups of the database, and of uploaded files; and every update MapSorix releases to all subscribers.

2.3 The Service is a hosted service. No software is licensed for installation on the Operator's own equipment. MapSorix may change how the Service works, provided it does not materially reduce the functions described in 2.2 during a paid Billing Period, or weaken the protections in the HIPA Agreement.

2.4 Not included, and quoted separately if the Operator asks: training beyond the two hours in 2.2; visits to a Home in person; payroll exports in a new format; features built only for the Operator; and support outside the hours in 10.2. MapSorix quotes each in writing, and each is payable in full before the work is scheduled, by credit card on a secure payment page or by Interac e-Transfer. A quote is open for 14 days. To move scheduled work, the Operator tells MapSorix at least 48 hours before it; with less notice it may move it once at no charge, and after that the amount paid is kept. MapSorix bears any card processing fee.

3. Price and bed limits

3.1 The subscription is priced by the Licensed Beds, in graduated bands:

All amounts exclude GST and PST (4.4).

3.2 Each band applies only to the beds within it, in the way income tax rates apply to bands of income. A Home with 30 Licensed Beds pays the first-band rate for beds 1 to 20 and the second-band rate for beds 21 to 30. Adding a bed therefore never reduces the amount payable. A minimum of 8 billable beds applies: a Home with fewer Licensed Beds is charged for 8. A Home with more than 100 Licensed Beds is quoted separately and does not buy online.

3.3 The limit is the bed count, not a plan. The Service refuses to admit or re-admit a resident once a Home's current residents reach the beds paid for. The Operator changes what it pays by changing the bed count in the Service. An increase takes effect at once, and the difference is charged for the rest of the Billing Period. A decrease takes effect from the next Billing Period, with no refund for the current one, and is refused while the Home has more current residents than the smaller count allows.

3.4 Shared Subscriptions. One subscription may cover up to 10 Homes of the same Operator. They share one subscription and one invoice, and the bands in 3.1 apply to all their Licensed Beds added together. Each Home keeps its own records, home code, staff and bed count. The Operator acknowledges that, because the subscription is shared, a failed payment makes every Home on it read-only at once (section 5). On a Shared Subscription the Operator changes the Billing Period, moves a Home to the Records Archive, or cancels by writing to MapSorix. The payment pages in the Service then offer only the card on file and the invoices.

4. Payment, taxes and interest

4.1 Payment. Fees are payable in advance for each Billing Period, monthly or yearly, by credit card through MapSorix's payment processor. MapSorix does not receive or store card or bank account details. An amount MapSorix invoices instead, such as a quote for a Home of more than 100 Licensed Beds, is payable within 30 days of the invoice date.

4.2 Paid from the start. The Fees for the first Billing Period are charged when the Operator buys the subscription, and each later Billing Period is charged at its start. A yearly subscription is charged at the yearly rates in 3.1, which are lower than twelve times the monthly rates.

4.3 Renewal and price changes. The subscription renews automatically for successive Billing Periods until cancelled under 6.1. The Service gives notice before each payment, and MapSorix emails the billing contact at least 30 days before a yearly renewal. MapSorix may change the rates in 3.1 on at least 60 days' notice under 18.5, effective from the Operator's next renewal after the notice period ends.

4.4 Taxes. The Fees exclude goods and services tax (GST, 5%), Saskatchewan provincial sales tax (PST, 6%) and any other sales tax. MapSorix adds them at the rates in force when the tax is payable, and shows each separately on every invoice and receipt, with MapSorix's GST registration number. The Operator pays them in addition to the Fees.

4.5 Records. MapSorix keeps a record of each charge, payment, refund and tax for at least six years after the end of the tax year it relates to (Income Tax Act, s.230(4); Excise Tax Act, s.286(3)). The Administrators can see and download the invoices in the Service, and MapSorix provides a statement of account on request.

4.6 Interest on overdue amounts. Any amount not paid when due carries simple interest from the day after it was due until it is paid, before and after judgment, at the Prime Rate plus 2% a year. "Prime Rate" means the prime business rate charged by Canadian chartered banks, as published by the Bank of Canada, as it stands on the first day of each month the amount is unpaid. Interest is calculated daily on the basis of a year of 365 days. For the purposes of the Interest Act (Canada), whenever interest is calculated on the basis of a year of 365 days, the yearly rate of interest to which that rate is equivalent is that rate multiplied by the actual number of days in the calendar year in which it is calculated and divided by 365. MapSorix charges no late fee or other charge for late payment.

4.7 Founding licences. A founding licence is not a subscription, and this Agreement does not govern it. A founding licence is arranged with MapSorix directly and is governed by its own agreement, including any subscription for beds beyond those the licence covers.

5. Missed payments

5.1 If a payment fails, the Service becomes read-only at once for every Home on the subscription. Users may view, print and export every record, but nothing can be added or changed. This stops care being recorded in a period that has not been paid for. It is not a penalty.

5.2 MapSorix emails the billing contact, and the payment processor tries the payment again. When a payment succeeds, full use resumes at once.

5.3 If no payment is received within 90 days of the first failed payment, this Agreement ends at the end of those 90 days and the Service closes for the Home's Users, its Administrators included. The Fees for the Billing Period whose payment failed remain owed, with interest under 4.6, but no Fees accrue for any later period. Records are kept under section 7 and are never deleted for non-payment. The Operator may open them again by paying, keep read-only access with the Records Archive (6.5), or ask for them under 7.6.

5.4 The Operator should keep a downtime procedure under 8.1(i), because a read-only Service cannot record care.

6. Cancelling and ending this Agreement

6.1 The Operator may cancel at any time, in the Service or, for a Shared Subscription, by writing to MapSorix. The subscription then ends at the end of the Billing Period already paid for: the current month for a monthly subscription, the paid year for a yearly one. Fees already paid are not refunded, except under 6.2, 6.3, 6.4(b), 14.1 and 18.2, and sections 6.5 and 12.6 of the HIPA Agreement. Nothing is charged for any Billing Period after the subscription ends.

6.2 MapSorix may end this Agreement for convenience on at least 60 days' notice to the Operator. It then refunds the Fees prepaid for any part of a Billing Period after the end date. This does not apply where MapSorix stops providing the Service to all its customers, for which 7.7 applies.

6.3 Either party may end this Agreement for cause by notice to the other:

• (a) if the other materially breaches this Agreement or the HIPA Agreement and does not put the breach right within 30 days of being told about it in writing; or
• (b) if the other becomes insolvent, makes an assignment for the benefit of creditors, or has a receiver, trustee in bankruptcy or similar officer appointed over its business, to the extent the law allows.

If the Operator ends this Agreement under 6.3 because of MapSorix's breach, MapSorix refunds the Fees prepaid for any part of a Billing Period after the end date.

6.4 MapSorix may suspend or end the Service for a Home at once, by notice:

• (a) if the Service is used unlawfully, or in a way that endangers residents, other homes or the security of the Service; or
• (b) if the Home's licence is revoked or the Home stops operating. MapSorix then refunds the Fees prepaid for any part of a Billing Period after the end date.

Suspension under (a) lasts only as long as the cause continues, and records are kept under section 7.

6.5 After this Agreement ends. The Users of each Home keep 30 days of read-only access at no charge, to view, print and export its records, except where the Agreement ended under 5.3, when the 90 days of read-only access in 5.1 have already passed. After that the Service closes for the Home's Users, its Administrators included. The Home's records are still kept under section 7, and MapSorix provides them to the Operator on request under 7.6 for as long as they are kept. To keep read-only access for its staff, the Operator may move the Home to the Records Archive at $19 a month, plus taxes, for as long as it chooses, billed under section 4.

6.6 What continues. Sections 4 (for amounts already due), 6.5, 7, 11, 12, 14, 15, 16 and 18, and the HIPA Agreement, continue after this Agreement ends, together with any other term that by its nature is meant to continue.

7. The Home's records

7.1 All Home Data belongs to the Operator, for the Home that entered it. MapSorix claims no ownership of Home Data and uses it only to provide the Service, under the HIPA Agreement. Nothing in this Agreement gives MapSorix any other right to use Home Data.

7.2 The Operator is the trustee of personal health information under HIPA for each Home. MapSorix acts as its information management service provider (section 16).

7.3 Retention. HIPA s.17(2)(a) requires a trustee to keep personal health information retrievable, readable and usable for its full retention period, and a trustee's retention and destruction policy must keep it for at least 10 years after the last episode of care, or until the person turns 20 if they were a minor, whichever is longer, unless the trustee adopts a retention schedule instead (the Regulations, s.6(a)). The Service refuses to remove a resident's records until 10 years after the later of the resident's discharge and the last change to their record. MapSorix will not delete records because a subscription has lapsed or this Agreement has ended.

7.4 Records are removed only on the Operator's written instruction, given by an Administrator of the Home in the Service, and only after the Operator confirms that its retention period has passed and that nothing requires the records to be kept longer. On that instruction MapSorix will:

• (a) remove the records from the Service, so that no one can view, print or export them there;
• (b) let the backups that still hold them expire (each is deleted 35 days after it was made), and not restore a removed record from a backup unless the Operator asks in writing before that backup expires;
• (c) confirm to the Home's Administrators in writing when both are done; and
• (d) keep, for the Home's Administrators only, the record of destruction the Regulations, s.6(c), require: whose records were destroyed, a summary of what was destroyed, the period they covered, how they were destroyed, and the name and job title of the person who supervised it.

7.5 The audit log is kept, without what it said about the removed records. Removing records under 7.4 does not remove the audit log entries that describe them. It takes out of those entries what they said about the removed records, and keeps in each one who did what, when, and to which record (by the record's reference, not by name). Each entry changed this way is marked with when its content was removed and why. The audit log's integrity check still passes afterwards. The Administrator's request and MapSorix's removal are both recorded in the audit log.

7.6 Exports and copies. Each Home's Administrators may export its records at any time, in PDF and CSV, at no charge, including during the 30 days after this Agreement ends (6.5). On written request, including after this Agreement ends, MapSorix provides:

• (a) a complete export of a Home's records, readable without the Service, within 15 Business Days, at no charge once a year and otherwise for a charge MapSorix quotes in advance; and
• (b) when the Operator needs a named individual's records to answer that individual's request for access under HIPA, within 5 Business Days and at no charge, either a copy of those records, readable without the Service, or read-only access for the Home's Administrators for 30 days so they can make the copy themselves, so that the Operator can respond within the 30 days HIPA s.36 allows.

7.7 If MapSorix stops providing the Service to all its customers, by discontinuing it, ceasing to trade or otherwise, MapSorix will give the Operator at least 6 months' notice, keep each Home's access to view, print and export its records throughout that period, and give the Operator a complete copy of each Home's records, readable without the Service, before any record is removed. MapSorix then removes the records only on the Operator's written instruction, or as the HIPA Agreement provides.

8. The Operator's responsibilities, representations and warranties

8.1 The Operator will:

• (a) make sure what is recorded is accurate, and that care is recorded by the person who gave it;
• (b) manage its own Users: give each User only the access their work needs, add and remove people promptly, and deactivate departing staff;
• (c) keep tablets physically secure with a device passcode, enrol only tablets it owns or controls, and remove a lost or stolen tablet in the Service at once;
• (d) obtain any consent or authority required before giving a family member access to the family portal, and keep a record of it;
• (e) use the Service in accordance with The Personal Care Homes Act, The Personal Care Homes Regulations, 1996, HIPA, the Regulations and any other law that applies to the Home;
• (f) keep its own written privacy and security policies, its retention and destruction policy, and its staff's pledges of confidentiality and training, as HIPA ss.16 and 17 and the Regulations, ss.5 and 6, require of a trustee;
• (g) keep the bed count in the Service for each Home equal to its Licensed Beds, and tell MapSorix when a licence changes;
• (h) sign the HIPA Agreement before any Home keeps real resident records in the Service, and not send MapSorix personal health information outside the Service, such as by email or in a support request;
• (i) keep a downtime procedure, including blank daily medication administration records printed from the Service at each medication cart and staff who know when to use them, so that care and medication administration can continue and be recorded on paper if the Service, the Home's equipment or its internet connection is unavailable;
• (j) provide and maintain its own tablets, computers, printers and internet connection; and
• (k) make sure its Users follow this Agreement, and be responsible for what they do in the Service.

8.2 The Operator represents and warrants that:

• (a) it is the licensee of each Home under The Personal Care Homes Act, its licences are in good standing, and the person accepting this Agreement for it has authority to bind it;
• (b) it has the authority under HIPA, including Part IV (ss.23 to 30), and any other law, to collect, use and disclose the personal health information and other personal information that its Users put into the Service, and to make each disclosure it makes through the Service, such as to family members and to a pharmacy it pairs with; and
• (c) the information on each Setup Form is true.

8.3 The Service does not provide clinical advice. The Service is intended for record-keeping and the administration of a personal care home. It is not intended to diagnose, treat, mitigate or prevent any disease, disorder or abnormal physical state, or any of their symptoms, and it makes no clinical assessment of its own. Its alerts, reminders and checks compare what Users record with the medication orders and schedules the Home sets. It records vital signs without interpreting them: the only check on a reading asks the person entering it to confirm a number that is probably mistyped, such as a temperature of 44 °C. Alerts, reminders, checks and warnings are aids to the Home's staff, not judgements. They may be wrong or missing, and they do not replace professional judgement. Every clinical and care decision remains the Home's.

9. Acceptable use

9.1 The Operator will not, and will make sure its Users do not:

• (a) use the Service for a home that is not on this subscription, or let anyone outside the Operator's organization use it, except Users the Service is designed for;
• (b) share a sign-in, PIN or authenticator between people;
• (c) copy, modify, reverse engineer or decompile the Service, or build a competing product using it, except as the law allows despite this restriction;
• (d) probe, scan or test the Service's security, or put excessive load on it, without MapSorix's written consent;
• (e) upload anything unlawful, malicious or infringing; or
• (f) use the Service in a way that breaks the law or another person's rights.

10. Availability, support and suspension

10.1 Availability. MapSorix aims for 99.5% availability each month, not counting planned maintenance announced in the Service in advance. This is a target, not a guarantee. No service credits or other compensation are offered for not meeting it. MapSorix aims to schedule planned maintenance outside 8:00 a.m. to 8:00 p.m. Saskatchewan time.

10.2 Support. Support is by telephone and email, Monday to Friday, 9:00 a.m. to 5:00 p.m. Saskatchewan time, except statutory holidays in Saskatchewan, at care@mapsorix.com and (306) 400-1800. MapSorix aims to reply within one Business Day, and within four business hours to a problem that stops medication administration. These are targets, not guarantees.

10.3 Offline use. The Service works offline on enrolled tablets. Records entered offline are saved on the tablet and sent when a connection returns.

10.4 Suspension to protect the Service. MapSorix may suspend a User's access, a tablet, or a Home's access to part or all of the Service, without liability, to the extent and for as long as reasonably necessary to protect Home Data, the Service or other homes from a security threat, or to comply with the law. MapSorix tells the Home's Administrators as soon as practicable, keeps read-only access where it is safe to do so, and restores access as soon as the reason ends.

11. Intellectual property and feedback

11.1 MapSorix and its licensors own the Service, its software, documentation, help, templates and designs, and every improvement to them, including improvements made at the Operator's suggestion, together with all intellectual property rights in them. The Operator receives only the rights expressly granted in 2.1.

11.2 The Operator owns Home Data, including policies, care note templates and other material its Users write or upload. The Operator grants MapSorix a non-exclusive, royalty-free licence to host, copy, process, transmit and display Home Data only as needed to provide the Service under this Agreement and the HIPA Agreement.

11.3 MapSorix owns Service Data and may use it to run, secure, support and improve the Service. Service Data contains no resident's name and no health information, and MapSorix does not derive it from the content of resident records.

11.4 If the Operator or its Users give MapSorix suggestions or feedback about the Service, MapSorix may use them freely, without payment or obligation. Feedback never includes Home Data.

12. Confidentiality

12.1 "Confidential Information" means non-public information that one party discloses to the other in connection with this Agreement and that is marked confidential or that a reasonable person would understand to be confidential, including the Service's security documentation and either party's non-public business information. Home Data is governed by the HIPA Agreement, and also by this section to the extent it is not personal health information.

12.2 The receiving party will use the other's Confidential Information only for this Agreement, protect it with at least the care it uses for its own confidential information and no less than reasonable care, and disclose it only to its employees, contractors and professional advisers who need to know it and are bound by duties of confidence at least as protective as this section.

12.3 Confidential Information does not include information that is or becomes public through no fault of the receiving party, that the receiving party already lawfully had or independently developed, or that it lawfully receives from someone else without a duty of confidence.

12.4 If the law requires a party to disclose the other's Confidential Information, it will, where the law allows, tell the other first and disclose only what is required. For Home Data, the HIPA Agreement, s.7.2, applies.

12.5 This section continues for five years after this Agreement ends, and for as long as the information remains a trade secret or Home Data.

13. Warranties and disclaimers

13.1 MapSorix warrants that:

• (a) the Service will perform materially as described in this Agreement and its documentation;
• (b) it will provide the Service with reasonable skill and care, in keeping with the HIPA Agreement; and
• (c) it will use measures consistent with good industry practice to keep malicious code out of the Service, including scanning every uploaded file for viruses before anyone can open it (the HIPA Agreement, Schedule C).

13.2 If the Service does not meet 13.1(a), the Operator tells MapSorix in writing, and MapSorix will use reasonable efforts to correct it. If MapSorix cannot correct a material failure within 30 days of that notice, the Operator may end this Agreement under 6.3 and receive the refund there. This is the Operator's only remedy for a breach of 13.1(a).

13.3 Except as expressly stated in this Agreement and the HIPA Agreement, and to the fullest extent the law allows, the Service is provided "as is". MapSorix gives no other warranty or condition, express or implied, including of merchantability, fitness for a particular purpose, or that the Service will be uninterrupted or error-free.

14. Indemnities

14.1 By MapSorix. MapSorix will defend the Operator against any claim by a third party that the Service, as MapSorix provides it, infringes that person's copyright, trade-mark or patent in Canada, and will pay the damages and costs finally awarded, or agreed in a settlement MapSorix approves. This does not apply to a claim arising from Home Data, from a change to the Service not made by MapSorix, from use of the Service with something MapSorix did not provide, or from use in breach of this Agreement. If such a claim is made or likely, MapSorix may, at its option and cost, get the right for the Operator to keep using the Service, change the Service so it no longer infringes without materially reducing its functions, or end this Agreement and refund the Fees prepaid for any part of a Billing Period after the end date. This section states MapSorix's whole liability for infringement, subject to the Enhanced Cap.

14.2 By the Operator. The Operator will defend MapSorix, its directors, officers and employees against any claim by a third party, including a resident, a resident's family or representative, a regulator or a pharmacy, and pay the damages, penalties and costs finally awarded or agreed in a settlement the Operator approves, to the extent the claim arises from:

• (a) care provided or not provided at a Home, or any clinical or care decision, whether or not the Service was used to make or record it;
• (b) the Operator's or its Users' collection, use or disclosure of personal information without the authority 8.2(b) describes, or other breach of HIPA as a trustee; or
• (c) Home Data, or the Operator's or its Users' breach of section 9;

except to the extent the claim is caused by MapSorix's breach of this Agreement or the HIPA Agreement, or by the negligence or wilful misconduct of MapSorix or its personnel. The Operator's liability under 14.2(b) and (c) is subject to a limit equal to the Enhanced Cap, calculated in the same way; its liability under 14.2(a) is not limited.

14.3 Procedure. A party seeking defence under this section tells the other promptly in writing, lets the other control the defence and any settlement, and co-operates at the other's cost. A delay in telling the other relieves it only to the extent the delay prejudices it. No settlement may admit fault for, or impose an obligation on, the defended party without its written consent, which it will not unreasonably withhold.

15. Limitation of liability

The Operator should read this section carefully. It limits what MapSorix owes if something goes wrong.

15.1 The limits below apply to all claims arising out of or in connection with this Agreement, the HIPA Agreement or the Service, however they arise, whether in contract, tort (including negligence), under statute or otherwise, and whether or not the party knew the loss was possible.

15.2 General Cap. Except as 14.2, 15.3 and 15.5 provide, each party's total liability to the other, for all claims together, will not exceed the greater of:

• (a) the Fees paid and payable by the Operator for the 12 months before the event that first gave rise to liability; and
• (b) $10,000

(the "General Cap").

15.3 Enhanced Cap. Subject to 15.5, for Privacy Claims and for claims under MapSorix's indemnity in 14.1, MapSorix's total liability, for all those claims together, will not exceed the greater of:

• (a) three times the Fees paid and payable by the Operator for the 12 months before the event that first gave rise to liability; and
• (b) $50,000

(the "Enhanced Cap"). Amounts MapSorix pays under the General Cap count towards the Enhanced Cap, and MapSorix's total liability for all claims to which a cap in this section applies will never exceed the Enhanced Cap.

15.4 Breach response costs. Within the Enhanced Cap, the Operator's reasonable, documented out-of-pocket costs of the following, incurred because of a Privacy Breach caused by MapSorix's breach of the HIPA Agreement, are recoverable as direct losses: (a) notifying affected individuals and the Commissioner; (b) a call line for affected individuals, for up to 90 days; (c) credit monitoring or identity protection, where the Privacy Breach exposed health services numbers or financial information, for the period the Commissioner or the Operator's counsel reasonably recommends; and (d) responding to a review or investigation by the Commissioner.

15.5 Not limited. Nothing in this Agreement limits:

• (a) either party's liability for fraud, wilful misconduct or gross negligence;
• (b) the Operator's obligation to pay the Fees and taxes;
• (c) the Operator's obligations under 14.2(a); or
• (d) any liability that cannot be limited or excluded at law.

15.6 Excluded losses. Except for amounts recoverable under 15.4 and amounts payable to a third party under section 14, neither party is liable to the other for indirect, consequential, incidental, special or punitive loss, or for loss of profit, revenue, business, goodwill or anticipated savings, or the cost of substitute services. MapSorix's liability for loss or corruption of Home Data that is not caused by its breach of the HIPA Agreement is limited to using reasonable efforts to restore it from the most recent backup the HIPA Agreement requires MapSorix to keep.

15.7 Why these limits. The Operator acknowledges that the Fees reflect these limits, that it was able to read this Agreement and take legal advice before accepting it, and that it can insure its own risks, including the professional and general liability insurance its operation requires.

15.8 Outages outside MapSorix's control. MapSorix is not liable for an interruption of the Service, or for any loss it causes, where the interruption comes from something beyond MapSorix's reasonable control. This includes a failure or interruption of a hosting, cloud, internet, telecommunications or power provider, a widespread internet outage, and a failure of a Home's own internet connection, power or devices. This does not excuse MapSorix where its own failure to take reasonable care caused the interruption or made it worse. The Operator's downtime procedure (8.1(i)) is how care continues meanwhile.

16. Privacy and health information

16.1 The HIPA Agreement. MapSorix handles personal health information only under the HIPA Agreement, which HIPA s.18(2) and the Regulations, s.7, require before a trustee provides personal health information to an information management service provider. It must be signed before any Home keeps real resident records in the Service, and until MapSorix records it, signed, for a Home, that Home can be set up but cannot hold resident or care records.

16.2 Where information is kept. Home Data is stored and processed in Canada, in data centres in Montréal, except as 16.5 and the HIPA Agreement, Schedule D, describe.

16.3 No standing access. MapSorix has no standing access to a Home's records through the Service. MapSorix support may ask an Administrator for Support Access, giving a written reason. The Administrator decides whether to allow it, what it covers (settings only, or settings and resident records, read-only) and for how long (1, 4 or 24 hours). Access ends when an Administrator ends it or the time runs out, whichever comes first, and every screen MapSorix opens is recorded in the Home's audit log.

16.4 Infrastructure access. A small number of named MapSorix personnel who administer the hosting systems can reach stored data outside the Service, as they must to run, secure and restore it. That access is recorded in the hosting systems' own logs and is governed by the HIPA Agreement, not by the Service itself.

16.5 Handled outside Canada. Some information that is not health information is handled outside Canada:

• (a) the sign-in service holds the email address each User signs in with, their second-step settings, any backup phone number for sign-in codes, the identifier of each home they belong to, and whether they are a family member or pharmacy staff, and may store them outside Canada;
• (b) account emails, the weekly summary email of counts to Administrators and the email telling a family member the Home has answered their message are delivered by an email service in the United States;
• (c) the check that confirms requests come from the real app may run outside Canada;
• (d) the hosting systems' logs, which hold record and account identifiers and internet addresses, are kept for 30 days in a location that may be outside Canada; and
• (e) where a nurse or Administrator turns on alerts, or a family member turns on notices, on their own phone or computer, each passes through the notification service of their browser or phone maker, which may be outside Canada. It is encrypted, so that service cannot read it, and names only the kind of alert, or that the Home answered, and the Home.

None of these holds a resident's name or health information. The HIPA Agreement sets them out (its section 6 and Schedule D).

16.6 No training on Home Data. MapSorix does not sell Home Data, use it for advertising, or use it to train any software model.

17. Insurance

17.1 MapSorix will maintain technology errors and omissions insurance, with limits that are commercially reasonable for a business of its size and kind, while this Agreement continues, and will give the Operator, on request, written confirmation that the insurance is in force.

17.2 The Operator will maintain the commercial general liability and professional liability insurance that its licence and the law require for each Home, and any other insurance a prudent operator of a personal care home would carry.

18. General

18.1 Law and courts. This Agreement is governed by the laws of Saskatchewan and the federal laws of Canada that apply there. The parties submit to the courts of Saskatchewan, sitting in Saskatoon.

18.2 Changes to this Agreement. MapSorix may amend this Agreement on at least 60 days' notice under 18.5, saying what changes and the date it takes effect. A change applies from that date, and never to a claim about something that happened before it. Rates change only under 4.3. An Operator that does not accept a change may cancel before that date by notice to MapSorix, and MapSorix then refunds the Fees prepaid for any part of a Billing Period after the date the change would have taken effect. Continuing to use the Service after that date is acceptance. Each version of this Agreement is published on the MapSorix Care website with its date. Changes to the HIPA Agreement follow its own terms.

18.3 Disputes. Before starting a court proceeding, other than for urgent injunctive relief or to stop a limitation period expiring, a party tells the other in writing what the dispute is, and senior representatives of both meet, in person or by video, within 15 Business Days to try to resolve it.

18.4 Assignment. The Operator may not assign this Agreement without MapSorix's written consent, which MapSorix will not unreasonably withhold where the assignee is the new licensee of every Home and signs the HIPA Agreement. MapSorix may assign this Agreement, on notice to the Operator, to a successor to the business of providing the Service that agrees in writing to be bound by this Agreement and the HIPA Agreement.

18.5 Notices. A notice under this Agreement is given in writing, and email counts as writing.

• (a) To the Operator, by email to each Home's Administrators who sign in to MapSorix Care with an email address and to its billing contact, as they are recorded in MapSorix Care when the notice is sent. The Operator designates those addresses for receiving notices under this Agreement. A notice MapSorix gives every home, such as a change under 4.3 or 18.2, is sent this way, and MapSorix keeps a record of when it was sent and to which addresses.
• (b) To MapSorix, by email to care@mapsorix.com, or by mail to MapSorix Innovations Inc., 231 Thakur St, Saskatoon, SK S7W 0Z9.
• (c) An email is received on the next Business Day after it is sent, unless the sender is told it was not delivered; a letter, on the fifth Business Day after it is mailed.
• (d) A notice ending this Agreement under 6.2, 6.3 or 6.4 also goes by mail or courier.
• (e) Each party keeps its addresses current: the Operator through its Administrators' accounts and its billing contact, MapSorix on its website. A notice sent to the addresses recorded at the time is given, even if a person there has since left.

18.6 Events beyond a party's control. Neither party is liable for a delay or failure caused by an event beyond its reasonable control, such as a natural disaster, a widespread failure of the internet, a failure or interruption of a hosting, cloud, internet, telecommunications or power provider, a pandemic, or an act of government, provided it tells the other promptly and works to limit the effect. This does not excuse the Operator's payment obligations, MapSorix's duties to keep Home Data secure and to report a Privacy Breach, or the Operator's duty to keep its downtime procedure (8.1(i)).

18.7 Whole agreement. This Agreement and the HIPA Agreement are the whole agreement between the parties about the Service. They replace any earlier proposal, quote or understanding, and no other term applies, including any term in a purchase order of the Operator.

18.8 Severability and waiver. If a court finds any part of this Agreement unenforceable, that part is limited as little as possible and the rest continues. A failure or delay to enforce a right is not a waiver of it.

18.9 Relationship. The parties are independent contractors. Nothing in this Agreement makes either the agent, partner or employee of the other.

18.10 No third-party rights. No resident, family member, pharmacy or other person has any right under this Agreement, except the persons defended under 14.

18.11 Publicity. MapSorix may name the Operator or a Home as a customer only with the Operator's written consent.

18.12 Acceptance and signatures. The Operator accepts this Agreement when its authorized representative ticks "I agree" on the MapSorix Care website when buying a subscription, or signs the Setup Form or this Agreement. This Agreement starts on that day, the Effective Date, and continues until it ends under section 5 or 6. Ticking "I agree" is an acceptance by an action in electronic form, and a contract formed this way is not denied legal effect because it is electronic (The Electronic Information and Documents Act, 2000, SS 2000, c E-7.22, s.18). MapSorix keeps a record of who accepted and when. This Agreement may be signed in counterparts and electronically.

18.13 Language. The parties have asked that this Agreement be drawn up in English.

Acceptance

The Operator accepts this Agreement as 18.12 describes. The person who ticks "I agree" or signs confirms that they have authority to bind the Operator. MapSorix sends a copy signed for MapSorix Innovations Inc. on request.