Master Services Agreement
Last modified: May 1, 2026
Related documents: Privacy Policy · Cookie Policy · Subprocessors · AI/ML Disclosure · Trust Center
This Master Services Agreement ("MSA") governs Customer's use of the Wellness360 platform and is incorporated by reference into the Service Order signed by Customer. By executing a Service Order that references this MSA, Customer (the entity named in the Service Order) agrees to be bound by all terms below.
1. The Services
1.1 Wellness360 will provide the wellness platform services described in the Service Order ("Services"). Specific modules, features, integrations, and configurations are listed in the Service Order.
1.2 Service Orders. Each Service Order incorporates this MSA by reference. The order of precedence between this MSA, Service Orders, and referenced documents is set forth in Section 15.4.
1.3 Customer's authorized administrators may configure the platform, manage user accounts, run reports, and adjust permitted settings within the platform. Customer is responsible for the actions of its administrators.
2. Term and Termination
2.1 Term. This MSA is effective on the date Customer signs the first Service Order and remains in effect until all Service Orders have expired or been terminated. Each Service Order has its own term as specified in that Service Order (typically one year).
2.2 Renewal. Service Orders auto-renew for successive one-year terms at Wellness360's then-current pricing (subject to a 3–5% annual uplift consistent with industry norms) unless either party gives written notice of non-renewal at least sixty (60) days before the renewal date.
2.3 Termination for Cause. Either party may terminate this MSA or any Service Order by written notice if the other party materially breaches the agreement and fails to cure within thirty (30) days of receiving written notice of the breach. In addition, Wellness360 may suspend the Services for non-payment after ten (10) days' written notice, and may terminate the affected Service Order if non-payment continues sixty (60) days past the original due date.
2.4 Effect of Termination. Upon termination or expiration of any Service Order, Customer's right to use the affected Services ceases. For thirty (30) days after termination, Customer may use the Services' standard data export functionality at no additional charge to retrieve Customer Data. If Customer terminates this MSA or a Service Order for cause under Section 2.3, Wellness360 will refund any prepaid fees for the unused remainder of the Service Order term. If Wellness360 terminates for cause under Section 2.3 (including for Customer's non-payment), no refund is due. Sections that by their nature should survive termination remain in effect, including without limitation Sections 4 (Customer Data), 7 (HIPAA), 8 (Intellectual Property), 9 (Confidentiality), 11 (Indemnification), 12 (Limitation of Liability), 14 (Dispute Resolution), and 15 (General).
3. Fees and Payment
3.1 Customer pays the fees specified in the Service Order. Unless the Service Order says otherwise, payment is Net 30 from the invoice date.
3.2 Late payments accrue interest at 1.5% per month (or the maximum permitted by law). After thirty (30) days past due plus ten (10) days' written notice, Wellness360 may suspend the Services until paid.
3.3 Any invoice not disputed in writing within thirty (30) days of receipt is deemed accepted. The undisputed portion of any invoice is paid by the original due date.
3.4 Fees are exclusive of taxes (other than taxes on Wellness360's net income), which Customer is responsible for.
4. Customer Data and Privacy
4.1 Ownership. Customer owns all data Customer provides to Wellness360 or that program participants enter into the Services ("Customer Data"). Wellness360 acquires no ownership rights in Customer Data and uses it only to provide the Services and as permitted by this MSA.
4.2 Aggregated Data. Wellness360 may create aggregated, de-identified data from Customer Data and use it for analytics, benchmarking, and product improvement. Aggregated data cannot identify Customer or any individual.
4.3 AI/ML Training Restriction. Wellness360 will not use Customer Data to train third-party general-purpose AI/ML models without Customer's prior written consent. Wellness360's AI/ML practices are described in the AI/ML Disclosure.
4.4 Privacy and Applicable Laws. Wellness360 complies with applicable data protection laws, including HIPAA (where PHI is involved), CCPA/CPRA, and other US state privacy laws. For Customers whose program participants reside in the EU/EEA, UK, or other jurisdictions with cross-border data transfer requirements, Wellness360 will execute standard contractual clauses (SCCs) and other transfer mechanisms required by applicable law upon written request to privacy@wellness360.co, at no additional fee.
4.5 Data Residency. Customer Data is stored and processed in the United States.
4.6 Customer's Responsibilities. Customer represents that it has obtained any consents required to share program participant data with Wellness360 and that Customer Data does not infringe any third-party rights.
5. Security
5.1 Wellness360 maintains commercially appropriate administrative, physical, and technical safeguards to protect Customer Data, including:
- Encryption in transit (TLS 1.2+) and at rest (AES-256)
- Multi-factor authentication for administrative access
- Role-based access controls
- Annual third-party penetration testing
- Workforce HIPAA and security training
5.2 Certifications. Wellness360 maintains HITRUST r2, SOC 2 Type II, and ISO/IEC 27001 certifications. Current certifications and audit reports are available on the Trust Center.
5.3 Breach Notification. Upon discovery of a security incident affecting Customer Data, Wellness360 will notify Customer within seventy-two (72) hours, with details available at that time. Wellness360 will provide detailed follow-up information within ten (10) business days as the investigation progresses. For PHI breaches, the additional notification requirements in Section 7 apply.
6. Subprocessors
6.1 Wellness360 may use subprocessors (such as cloud infrastructure, communications, and analytics providers) to deliver the Services. The current list is published at https://www.wellness360.co/list-of-sub-processors/.
6.2 Wellness360 ensures all subprocessors are bound by data protection terms no less protective than this MSA, and signs Business Associate Agreements with subprocessors that handle PHI.
6.3 Wellness360 will provide at least thirty (30) days' notice (which may be by updating the published list) before adding new subprocessors that will access Customer Data. Customer may raise reasonable data-protection objections by written notice to privacy@wellness360.co during that thirty (30) day period. If the parties cannot resolve Customer's objection within thirty (30) days of the objection, Customer may terminate the affected Service Order without penalty.
7. HIPAA Business Associate Terms
This Section 7 applies only if Customer's Service Order indicates that the Services will involve Protected Health Information (PHI). When it applies, Customer is the Covered Entity (or covered entity-equivalent) and Wellness360 is the Business Associate.
7.1 Permitted Use. Wellness360 uses and discloses PHI only to perform the Services and as permitted by HIPAA. Wellness360 will not sell PHI, use PHI for marketing, or use PHI to train third-party general-purpose AI/ML models.
7.2 Safeguards. Wellness360 implements safeguards required by the HIPAA Security Rule (Section 5 of this MSA describes these in detail).
7.3 Subcontractors. Subcontractors that handle PHI sign Business Associate Agreements with Wellness360 and are bound by terms no less protective than this MSA.
7.4 Breach Notification. Wellness360 reports Breaches of Unsecured PHI to Customer within seventy-two (72) hours of discovery, with detailed follow-up notice within ten (10) business days. Wellness360 cooperates with Customer in any required participant or regulator notifications.
7.5 Individual Rights. When Customer requests it (typically because a participant has exercised their HIPAA rights), Wellness360 will:
- Provide access to PHI in a designated record set within fifteen (15) business days
- Make amendments to PHI as directed within thirty (30) business days
- Provide an accounting of disclosures within thirty (30) business days
7.6 Government Access. Wellness360 makes its compliance practices available to HHS as required by HIPAA, and notifies Customer of any such request unless prohibited by law.
7.7 Return or Destruction. Within sixty (60) days of termination of the Service Order or of this MSA, Wellness360 will return or destroy all PHI that Wellness360 still maintains in any form. Where return or destruction is not feasible (for example, PHI retained in routine backup systems), Wellness360 will continue to protect such PHI under this MSA and limit further use or disclosure to the purposes that make return or destruction infeasible. Wellness360 will provide written certification of return or destruction upon Customer's reasonable written request.
7.8 Amendments for HIPAA Changes. The parties will amend this Section 7 as necessary to comply with future changes to HIPAA.
8. Intellectual Property
8.1 Wellness360 owns the platform, software, content, and all related IP. Customer receives a limited, non-exclusive, non-transferable license to use the Services during the term, only for Customer's internal wellness program purposes.
8.2 Customer may not (a) reverse engineer the Services, (b) use the Services to build a competitive product, (c) use the Services or its content to train AI/ML models, or (d) resell the Services without Wellness360's written consent.
8.3 Feedback. Wellness360 may freely use any feedback Customer provides without compensation.
8.4 Trademarks. Use of either party's name, logo, or trademarks is governed by Section 15.6 (Publicity). Each party retains all rights in its own marks.
9. Confidentiality
9.1 Each party will protect the other's non-public information ("Confidential Information") with the same degree of care it uses to protect its own confidential information of similar nature (and in any event no less than reasonable care), will use Confidential Information only for purposes of performing under this MSA, and will not disclose Confidential Information except to its employees, contractors, and advisors who need access for those purposes and are bound by written confidentiality obligations no less protective than those in this MSA. Confidential Information does not include information that (a) is or becomes publicly available without breach of this MSA, (b) was rightfully known before disclosure, (c) is independently developed without reference to the disclosing party's Confidential Information, or (d) is required to be disclosed by law or court order, provided that the receiving party gives prompt notice to the disclosing party (where legally permitted) and reasonable cooperation in seeking a protective order.
9.2 Specific protections for PHI are in Section 7.
10. Disclaimers
10.1 Services Provided "As Is." Except for the express commitments in this MSA, Wellness360 disclaims all warranties (express or implied), including merchantability, fitness for a particular purpose, and non-infringement.
10.2 Not Medical Advice. THE SERVICES ARE NOT MEDICAL ADVICE, DIAGNOSIS, OR TREATMENT. Wellness360 is not a healthcare provider. Content, recommendations, and coaching messages are general wellness information. Customer agrees to communicate to participants that they should consult their physician or qualified healthcare provider before beginning any exercise program, modifying their diet, or making any health-related changes based on Services content.
10.3 Service Availability. Wellness360 targets 99.9% monthly uptime. Wellness360 does not warrant that the Services will be uninterrupted or error-free. Customer may report outages to support@wellness360.co. Wellness360 may issue service credits at its discretion.
10.4 Support. Standard support is email-based during business hours (M–F, 9 AM – 7 PM Central Time, excluding US federal holidays). Support response times are commercially reasonable based on issue severity.
11. Indemnification
11.1 Wellness360 will defend, indemnify, and hold harmless Customer against any third-party claim that the Services, as provided by Wellness360 and used in accordance with this MSA, infringe a third party's intellectual property rights, and will pay any damages and costs (including reasonable attorneys' fees) finally awarded against Customer or agreed in settlement. Wellness360 may, at its option and expense, (a) procure for Customer the right to continue using the Services, (b) modify the Services to be non-infringing while preserving substantially equivalent functionality, or (c) terminate the affected Service Order and refund the prepaid unused fees. Wellness360 has no obligation under this Section 11.1 to the extent a claim arises from: (i) Customer's modification of the Services, (ii) combination of the Services with products or services not provided by Wellness360, where the Services alone would not be infringing, (iii) Customer's continued use of the Services after notice of alleged infringement, or (iv) Customer Data.
11.2 Customer will defend, indemnify, and hold harmless Wellness360 against any third-party claim arising from (a) Customer Data (including any claim that Customer Data infringes third-party rights or was provided without legally required consents), or (b) Customer's use of the Services in violation of this MSA or applicable law, and will pay any damages and costs (including reasonable attorneys' fees) finally awarded against Wellness360 or agreed in settlement.
11.3 Indemnification under this Section 11 is conditioned on the indemnified party (a) providing prompt written notice of the claim (failure to provide prompt notice excuses the indemnifying party's obligations only to the extent of actual prejudice), (b) granting the indemnifying party sole control over the defense and settlement of the claim, and (c) providing reasonable cooperation in the defense at the indemnifying party's expense. The indemnifying party may not enter any settlement that admits liability on behalf of the indemnified party or imposes non-monetary obligations on the indemnified party without the indemnified party's prior written consent (not to be unreasonably withheld).
12. Limitation of Liability
12.1 No Indirect Damages. Neither party will be liable for indirect, incidental, special, consequential, or punitive damages, including lost profits, lost revenue, or lost data, even if advised of the possibility of such damages. The foregoing exclusion does not apply to (a) breach of confidentiality, (b) indemnification obligations, (c) gross negligence or willful misconduct, or (d) Customer's failure to pay fees owed.
12.2 General Cap. Each party's total liability for all claims arising from or related to this MSA will not exceed the fees paid or payable by Customer in the twelve (12) months immediately before the event giving rise to the claim, except as set forth in Sections 12.3 and 12.4.
12.3 HIPAA Super Cap. For claims arising from breach of HIPAA obligations or unauthorized use or disclosure of PHI, Wellness360's total liability will not exceed the greater of (a) two times (2x) the fees paid in the prior twelve months, or (b) US $1,000,000.
12.4 Exceptions. The caps in Sections 12.2 and 12.3 do not apply to: (a) breach of confidentiality, (b) indemnification obligations under Section 11, (c) gross negligence or willful misconduct, or (d) Customer's failure to pay fees owed.
12.5 Each party acknowledges that the limitations of liability in this Section 12 are a fundamental basis of the bargain.
13. Insurance
Wellness360 maintains, at its own expense, the following insurance coverage with reputable insurance carriers:
- Commercial General Liability: $2,000,000 per occurrence / $2,000,000 aggregate
- Technology Errors & Omissions / Professional Liability: $1,000,000 per claim / $1,000,000 aggregate
- Cyber Liability: $1,000,000 per claim / $1,000,000 aggregate
- Workers' Compensation: as required by applicable state law
Certificates of insurance evidencing the coverage above are available upon Customer's reasonable written request. Wellness360 may modify the foregoing coverage so long as it remains commercially appropriate for similarly situated technology service providers. Maintenance of insurance does not limit Wellness360's liability under this MSA.
14. Dispute Resolution
14.1 Informal Resolution. Before initiating any formal proceeding, the parties will negotiate in good faith for thirty (30) days through their respective senior representatives to resolve any dispute. Notice of dispute may be sent to legal@wellness360.co.
14.2 Court or Arbitration. Either party may bring unresolved disputes (a) in the federal or state courts located in San Francisco County, California, or (b) by election of either party made by written notice to the other within thirty (30) days of the conclusion of the informal resolution period in Section 14.1, before the American Arbitration Association under its Commercial Arbitration Rules. Notwithstanding the foregoing, claims related to intellectual property infringement or misappropriation may be brought in court by either party at any time.
14.3 Governing Law. This MSA is governed by the laws of the State of California, without regard to conflict-of-law principles.
15. General
15.1 Force Majeure. Neither party is liable for delays or failures caused by events beyond their reasonable control (natural disasters, cyberattacks, pandemics, telecom outages, etc.), provided the affected party gives prompt notice and uses reasonable efforts to resume performance. PHI protection obligations under Section 7 continue regardless.
15.2 Assignment. Neither party may assign or transfer this MSA, in whole or in part, without the other party's prior written consent (not unreasonably withheld). Notwithstanding the foregoing, either party may assign this MSA, with prior written notice to the other party but without consent, to an affiliate or in connection with a merger, acquisition, corporate reorganization, or sale of all or substantially all of its assets. Any assignment in violation of this Section is void.
15.3 Notices. All notices under this MSA must be in writing and are deemed given (a) upon delivery if delivered by hand, (b) one (1) business day after deposit with a nationally recognized overnight courier, (c) three (3) business days after mailing by certified or registered mail, return receipt requested, postage prepaid, or (d) on the date of transmission if sent by email with confirmation of transmission, provided that follow-up notice is also given by one of the methods in (a)–(c) within five (5) business days. Notices to Wellness360 go to legal@wellness360.co (with a copy to privacy@wellness360.co for privacy- or PHI-related matters) at 548 Market St # 517464, San Francisco, CA 94104-5401. Notices to Customer go to the contact and address specified in the Service Order.
15.4 Entire Agreement; Order of Precedence. This MSA, together with the Service Order and the documents referenced in this MSA (including the Privacy Policy, AI/ML Disclosure, and Subprocessors list), constitutes the entire agreement between the parties regarding the Services and supersedes all prior or contemporaneous understandings, whether oral or written. In the event of conflict, the order of precedence is: (1) the Service Order, with respect to terms expressly addressed therein; (2) this MSA; and (3) the documents referenced in this MSA.
15.5 Compliance with Laws. Each party will comply with all laws and regulations applicable to its performance under this MSA, including, where applicable, HIPAA, the ADA, GINA, the ACA, the FTC Health Breach Notification Rule, and applicable US state privacy laws.
15.6 Publicity. Wellness360 may identify Customer as a customer of Wellness360 in customer lists on Wellness360's website and in marketing materials, using Customer's name and logo in accordance with Customer's branding guidelines. Customer may revoke this permission at any time by written notice to legal@wellness360.co, in which case Wellness360 will remove the identification within a reasonable period. Any other use of Customer's name or logo (including case studies, press releases, or quoted statements) requires Customer's prior written consent.
15.7 Updates to Referenced Terms. Wellness360 may update the Privacy Policy, AI/ML Disclosure, and Subprocessors list. Material changes that adversely affect Customer's rights are communicated by email or in-platform notice with at least thirty (30) days' notice; if Customer reasonably objects and the parties cannot resolve the objection, Customer may terminate the affected Service Order without penalty within sixty (60) days of notice.
15.8 No Third-Party Beneficiaries. This MSA is for the sole benefit of the parties and their permitted successors and assigns. No other person or entity has any rights under this MSA.
15.9 Severability and Waiver. If any provision of this MSA is held invalid, illegal, or unenforceable, the remaining provisions remain in full force and effect. A party's failure to enforce any provision does not constitute a waiver of that or any other provision.
15.10 Independent Contractors. The parties are independent contractors. This MSA does not create a partnership, joint venture, agency, or employment relationship.
15.11 Counterparts and Electronic Signature. This MSA may be accepted electronically, including by clickwrap or electronic signature. Electronic acceptance is binding under the Electronic Signatures in Global and National Commerce Act (E-SIGN) and the Uniform Electronic Transactions Act (UETA).
15.12 Custom Terms. If Customer's procurement process requires a negotiated agreement, contact legal@wellness360.co.
Acceptance
BY EXECUTING A SERVICE ORDER THAT REFERENCES THIS MSA, CUSTOMER ACKNOWLEDGES THAT IT HAS READ AND UNDERSTOOD THIS AGREEMENT, THAT THE INDIVIDUAL EXECUTING THE SERVICE ORDER HAS AUTHORITY TO BIND THE NAMED CUSTOMER ENTITY, AND THAT CUSTOMER AGREES TO BE BOUND BY ALL TERMS HEREIN. Where the Service Order indicates that the Services will involve PHI, Section 7 (HIPAA Business Associate Terms) applies automatically without separate execution.
LAST UPDATED: May 1, 2026
END OF MASTER SERVICES AGREEMENT
© 2026 Wellness360 Technologies, Inc. All rights reserved.