End User License Agreement (EULA) — Spread

Effective date: June 1, 2026

This End User License Agreement (the "Agreement" or "EULA") is a legal agreement between you ("you", "Licensee") and apphero Tech LLC, a Nevada limited liability company based in Las Vegas, Nevada, USA ("apphero", "we", "us", "our"), governing your use of the Spread managed package and related software components (collectively, the "Software") distributed on the Salesforce AppExchange under the namespace aph.

Spread is a notifiable-disease surveillance and outbreak-response platform designed for public-health authorities, hospitals, school districts, universities, and other organizations mandated with disease reporting, contact tracing, cluster detection, and population-health communication. Because Spread is used to process Protected Health Information ("PHI") and other special-category personal data, this Agreement is supplemented by a separate Data Processing Agreement (DPA) and, where required, a Business Associate Agreement (BAA). Installation of the Software is contingent upon the execution of those supplemental agreements where applicable.

By installing, accessing, or using the Software, you acknowledge that you have read, understood, and agree to be bound by this Agreement. If you do not agree, do not install or use the Software.

1. Definitions

• "Software" means the Spread managed package, including its Apex classes, Lightning components, Flows, custom objects, custom metadata types, platform events, AI agent components (including Jean-Claude), associated documentation, and any updates, patches, or new versions made available by apphero.
• "Subscriber Org" means a Salesforce org in which the Software is installed.
• "Authorized User" means an individual employee, contractor, agent, or volunteer of the Licensee authorized to access the Software within the Subscriber Org.
• "End User" means a citizen, patient, contact, or member of the public who interacts with the Software through a Spread-powered portal operated by Licensee or apphero on Licensee's behalf.
• "PHI" means Protected Health Information as defined under the Health Insurance Portability and Accountability Act of 1996 ("HIPAA"), 45 C.F.R. § 160.103, as amended.
• "Special Category Data" means data concerning health and other sensitive data as defined under Article 9 of the EU/UK General Data Protection Regulation ("GDPR") and equivalent provisions of Quebec's Law 25 and Belgium's data protection law.
• "Salesforce" means Salesforce, Inc. and its affiliates.

2. License Grant

Subject to the terms of this Agreement, the DPA (and BAA where applicable), and payment of all applicable fees, apphero grants Licensee a non-exclusive, non-transferable, non-sublicensable, revocable license to install and use the Software in the Subscriber Org for Licensee's internal public-health, surveillance, reporting, and outbreak-response operations, solely during the term of an active subscription.

3. Restrictions

Licensee shall not, and shall not permit any third party to:

(a) copy, modify, translate, or create derivative works of the Software; (b) reverse engineer, decompile, disassemble, or otherwise attempt to derive the source code of the Software, except to the extent expressly permitted by applicable law; (c) rent, lease, lend, sell, sublicense, distribute, or otherwise transfer the Software to any third party; (d) remove, alter, or obscure any proprietary notices contained in the Software; (e) use the Software to develop a competing product or service; (f) use the Software in any manner that violates applicable law (including but not limited to HIPAA, the HITECH Act, GDPR, Quebec's Law 25, and Belgium's data protection law), infringes third-party rights, or breaches Salesforce's terms of service; (g) circumvent any technical limitations, license enforcement mechanisms, anonymization controls, audit logging, or feature gates within the Software; (h) use the Software to process PHI or Special Category Data unless a current DPA and (for HIPAA-covered uses) a current BAA are in effect between Licensee and apphero; (i) use the Software for any purpose that is not consistent with its design as a notifiable-disease surveillance platform — including, without limitation, any form of public-health-data brokerage, sale, or commercial profiling of identified individuals.

4. Ownership and Intellectual Property

The Software is licensed, not sold. apphero retains all right, title, and interest in and to the Software, including all intellectual property rights therein. No rights are granted to Licensee other than those expressly stated in this Agreement. Feedback, suggestions, or ideas provided by Licensee regarding the Software may be used by apphero without obligation or compensation, provided that such feedback is de-identified and contains no PHI.

5. Subscription, Updates, and Suspension

The license is contingent upon an active, paid subscription. apphero may release updates, patches, and new versions, which become part of the Software and are governed by this Agreement. apphero will notify Licensee in advance of updates that materially affect the security or compliance posture of the Software.

apphero reserves the right to suspend or terminate the license upon thirty (30) days' prior written notice in the event of:

(a) non-payment of fees; (b) material breach of this Agreement, the DPA, or the BAA, not cured within the notice period; (c) violation of Section 3 (Restrictions); (d) Salesforce removing or suspending the package on the AppExchange; (e) legal or regulatory requirements making continued provision unlawful.

In case of a security incident involving PHI, a credible breach of the BAA, suspected fraud, or material harm to the Software or other customers, apphero may suspend access immediately, with notice provided as soon as reasonably practicable.

6. Support

Support is provided in accordance with the Spread Support Guide available at https://apphero.tech/spread/support. Support availability, response times, and channels may be updated from time to time and are incorporated into this Agreement by reference. apphero-side support personnel handling Licensee data are trained on HIPAA and GDPR confidentiality and are bound by written confidentiality undertakings.

7. AI Components

The Software includes AI-powered features, notably the Jean-Claude chatbot embedded in the citizen, professional, and agency interfaces. Licensee acknowledges that:

(a) AI outputs may be inaccurate, incomplete, or unsuitable for a particular purpose. Licensee is responsible for reviewing AI outputs before relying on them in any clinical, investigative, or public-communication decision. AI outputs are not medical advice. (b) AI features may rely on third-party AI providers (including Anthropic) whose terms apply to the underlying model usage. apphero contracts with such providers to ensure that no PHI is used to train or fine-tune the AI models, and that all inference traffic is conducted under enterprise-grade no-retention terms. (c) Licensee is responsible for ensuring its use of AI features complies with applicable law, including consent and disclosure requirements when AI is used in the context of patient-facing communications. (d) Licensee may, under Custom Metadata SPR_LLM_Config__mdt, configure the Software to route AI inference to a Licensee-provided LLM endpoint ("BYO-LLM"), in which case Licensee is solely responsible for the compliance of that endpoint with applicable law and the BAA.

8. Compliance Posture

apphero certifies that the Software has been designed and tested with the following compliance frameworks in mind:

• HIPAA / HITECH (US) — Safe Harbor de-identification on automated anonymization, audit logging, access controls, encryption at rest and in transit
• GDPR / RGPD (EU/UK) — Article 9 special-category processing with appropriate safeguards, right to erasure, data minimization, pseudonymization
• Quebec's Law 25 — designated privacy officer, breach notification, automated decision-making transparency
• Belgium's Data Protection Law — alignment with COCOM (Brussels-Capital Common Community Commission) reporting requirements
• AppExchange Security Review — Salesforce's certification of secure design and code

Licensee acknowledges that compliance with applicable law depends on both apphero's design and Licensee's configuration and operation of the Software. apphero is not the data controller of records processed within the Subscriber Org.

9. Warranty Disclaimer

THE SOFTWARE IS PROVIDED "AS IS" AND "AS AVAILABLE", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING WITHOUT LIMITATION ANY WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, NON-INFRINGEMENT, OR ACCURACY. APPHERO DOES NOT WARRANT THAT THE SOFTWARE WILL BE UNINTERRUPTED, ERROR-FREE, OR FREE OF HARMFUL COMPONENTS. THE SOFTWARE IS NOT A MEDICAL DEVICE AND IS NOT INTENDED FOR THE DIAGNOSIS, TREATMENT, CURE, OR PREVENTION OF ANY DISEASE; ALL CLINICAL AND PUBLIC-HEALTH DECISIONS REMAIN THE EXCLUSIVE RESPONSIBILITY OF LICENSEE'S QUALIFIED PROFESSIONALS.

10. Limitation of Liability

TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW, APPHERO SHALL NOT BE LIABLE FOR ANY INDIRECT, INCIDENTAL, SPECIAL, CONSEQUENTIAL, OR PUNITIVE DAMAGES, OR FOR ANY LOSS OF PROFITS, REVENUE, DATA, OR BUSINESS OPPORTUNITIES, ARISING OUT OF OR RELATED TO THIS AGREEMENT, EVEN IF APPHERO HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES.

APPHERO'S TOTAL AGGREGATE LIABILITY UNDER THIS AGREEMENT SHALL NOT EXCEED THE FEES PAID BY LICENSEE TO APPHERO FOR THE SOFTWARE DURING THE TWELVE (12) MONTHS PRECEDING THE EVENT GIVING RISE TO THE CLAIM. Notwithstanding the foregoing, claims arising out of apphero's breach of the BAA or its confidentiality undertakings regarding PHI are subject to the separate liability framework set out in the BAA.

11. Indemnification

Licensee shall indemnify, defend, and hold harmless apphero from and against any claims, damages, liabilities, costs, and expenses (including reasonable attorneys' fees) arising out of or related to (a) Licensee's use of the Software in violation of this Agreement, the DPA, or the BAA; (b) Licensee's content, configuration, or data processed through the Software, including without limitation the lawful collection and provenance of PHI submitted to the Software; (c) Licensee's violation of applicable law; or (d) any claim by an Authorized User or End User to the extent such claim is attributable to Licensee's acts or omissions.

apphero shall indemnify, defend, and hold harmless Licensee from and against any third-party claim that the Software, as provided and used in accordance with this Agreement, infringes a U.S. patent, copyright, or trade secret of such third party.

12. Termination

This Agreement remains in effect until terminated. Licensee may terminate by uninstalling the Software and ceasing all use. apphero may terminate as set forth in Section 5. Upon termination, Licensee's license rights cease immediately, and Licensee shall uninstall the Software. Within thirty (30) days of termination, apphero shall, at Licensee's option, return or destroy any PHI in apphero's possession (typically limited to incident-response artifacts), pursuant to the BAA. Sections 3, 4, 9, 10, 11, 12, and 13 survive termination.

13. Governing Law and Jurisdiction

This Agreement is governed by the laws of the State of Nevada, USA, without regard to its conflict of laws principles. Any dispute arising out of or related to this Agreement shall be resolved exclusively by the state and federal courts located in Clark County, Nevada, and the parties consent to the personal jurisdiction of such courts. The parties waive any right to a jury trial.

For Licensees located in the European Union, the United Kingdom, Switzerland, or Quebec, nothing in this Section limits the rights granted to Licensee under mandatory law in its home jurisdiction.

14. Relationship to Salesforce

The Software runs on the Salesforce platform. Licensee's use of Salesforce is governed by Licensee's separate agreement with Salesforce. Salesforce is not a party to this Agreement and has no obligations to Licensee under it. This Agreement is between Licensee and apphero only.

15. Miscellaneous

(a) Entire agreement. This Agreement, together with the Terms of Service, Privacy Policy, the executed DPA, and (where applicable) the BAA, constitutes the entire agreement between the parties regarding the Software. In case of conflict, the order of precedence is: BAA → DPA → EULA → Terms of Service → Privacy Policy. (b) Severability. If any provision is held unenforceable, the remaining provisions remain in effect. (c) No waiver. Failure to enforce any provision is not a waiver of future enforcement. (d) Assignment. Licensee may not assign this Agreement without apphero's prior written consent. apphero may assign in connection with a merger, acquisition, or sale of assets, provided that the assignee assumes all obligations under the BAA. (e) Notices. Notices to apphero shall be sent to the address below. apphero may provide notices to Licensee electronically. (f) Export controls. Licensee shall not export or re-export the Software in violation of applicable export laws.

16. Contact

apphero Tech LLC Las Vegas, Nevada, USA Email: legal@apphero.tech Privacy / data-protection inquiries: privacy@apphero.tech HIPAA / BAA inquiries: hipaa@apphero.tech

A French version of this Agreement is available at https://apphero.tech/spread/fr/legal/eula. In case of conflict between the two versions, the English version prevails.