Organization Platform Terms

Including Compass’s Data Protection Commitments

These Organization Platform Terms (“Terms”) are between Compass CHW Corp, a Delaware corporation with its principal place of business in Los Angeles, California (“Compass”), and the organization named on the signature page (“Organization”). They include Exhibit A (Services and information), Exhibit B (Subcontractors), and Exhibit C (Signature page).

If Organization is a HIPAA covered entity, or a business associate of one, the parties will also sign Compass’s Business Associate Agreement (the “BAA”). The BAA is a separate agreement that covers only Protected Health Information under HIPAA. Organizations that are not subject to HIPAA do not sign the BAA. Compass protects every organization’s information under Section 11 of these Terms, whether or not a BAA is signed.

Organization accepts these Terms by signing Exhibit C. Electronic signatures satisfy the federal ESIGN Act and the California Uniform Electronic Transactions Act. The parties may sign in counterparts.

Parties. Compass CHW Corp, 3701 Santa Rosalia Dr., Suite 1200, Los Angeles, CA 90008. Notices: legal@joincompasschw.com and, for privacy matters, the Privacy Officer at privacy@joincompasschw.com.

1. Parties and acceptance

The person who signs represents that they have authority to bind Organization. If they do not, they must not sign and must not submit information about other people into Compass.

Organization accepts these Terms by signing Exhibit C, or by a later written order that incorporates these Terms. The member and Community Health Worker terms at joincompasschw.com do not govern Organization. If those terms appear in a signup screen, these Terms control for the organization account.

2. Order of precedence

If Organization has signed the BAA and these Terms conflict with the BAA on the handling of Protected Health Information, the BAA controls. These Terms control on everything else. Sections 17 through 19 of these Terms (disclaimers, limitation of liability, and indemnity) govern liability under both these Terms and the BAA, and control over any conflicting term.

3. What Compass provides

Compass operates a technology platform that connects Community Health Workers (“CHWs”) with Medi-Cal members and with community organizations. For an organization account, the services are:

• An organization profile and staff seats (an organization admin and invited staff).

• A listing, which stays private until Compass marks the organization verified.

• Inbound referrals from CHWs, and outbound referrals to CHWs.

• Messaging with CHWs, and with members who have consented, routed through Compass.

• Capacity, events, RSVP, and check-in.

• After the gates in Section 7, an intake roster, CSV import and export, and Compass member accounts for the people on the roster, as Section 7.2 describes.

• Aggregate performance counts for the organization’s own operational and grant reporting.

Compass arranges community health worker services through independent CHWs who contract with Compass, and operates the platform. Compass is not a Medi-Cal plan and is not Organization’s HIPAA privacy officer. Compass does not provide medical advice, diagnosis, or treatment, and does not guarantee that a CHW will accept a referral, that a member will enroll, or that Medi-Cal will pay a claim. Compass is not responsible for the acts, omissions, advice, or services of any member, other organization, or third-party provider, or for any decision Organization makes based on information available through the platform.

Attending an organization event is not itself a billable CHW service. CHW compensation, when any, follows Compass’s CHW terms and Medi-Cal session billing. Organization has no payment rail of its own on the platform.

4. Organization type and HIPAA status

Organization will register as one of: Food Bank or Pantry, Pharmacy, School, Resource Organization, Faith-Based Organization, or Other, as marked on Exhibit C. Organization will provide the type-specific identifiers Compass requests (such as NPI, EIN, or school district) and one verification document. Organization must keep that information accurate.

Organization will also state its HIPAA status on Exhibit C. If Organization is a HIPAA covered entity or a business associate of one, it must sign the BAA before it submits any Protected Health Information. Organization is solely responsible for determining its own HIPAA status. Compass may rely on Organization’s statement and is not responsible for the accuracy of that statement. Organization will tell Compass promptly if its status changes.

5. Accounts and staff

Organization is responsible for:

• Naming an admin who can bind the organization for day-to-day use.

• Inviting only workforce members who need access, and removing them when they leave or change roles.

• Unique credentials for each person. Shared logins are not allowed.

• All activity under its seats, until Compass receives notice to disable a seat and has had a reasonable time to act.

• Notifying legal@joincompasschw.com promptly of a suspected compromise of an organization login.

Compass may suspend or disable a seat or the organization account, without liability, if Compass reasonably believes information is false, a user abuses the platform, a required agreement is missing, security is at risk, or the law requires it.

6. Verification

Open signup creates an account. It does not make the listing public, and it does not turn on intake. Compass may refuse or withdraw verification. Verification is a review of the materials Organization submits. It is not a warranty of Organization’s licensure, nonprofit status, or HIPAA status.

7. Two levels of information

7.1 Before intake is turned on

Organization may maintain its profile and, once verified, use listing, referral, messaging, capacity, and event tools as Compass makes them available.

The referral view is designed to show Organization only basic information: the member’s first name and last initial, the service category, preferred language, and ZIP code, plus any additional details the member chooses to share. It is not designed to show Organization the member’s date of birth, Medi-Cal CIN, insurance, street address, clinical notes, diagnoses, or other notes a CHW recorded.

Contact with a member is routed through Compass, by in-app message or a masked call. The platform is designed so that Organization does not receive the member’s telephone number or email address through the platform.

7.2 After intake is turned on

Intake, CSV import, CSV export of the roster, and promotion open only when all of the following are true: Compass has marked Organization verified, Organization has signed these Terms, and, if Organization is a HIPAA covered entity or business associate, the BAA is signed. Until then, Compass will not accept a roster upload of health or identity information.

Intake fields may include name, date of birth, phone, sex, email, address, medical plan, Medi-Cal CIN, household size, and food bank client ID. CIN is stored encrypted.

Compass creates a Compass member account for each person 18 or older added to the roster, whether by intake, CSV upload, RSVP, QR code sign-up, or walk-up. If the person’s information matches an existing Compass account, Compass links the roster record to that account and may combine matching accounts into one. Compass tells the person how to sign in. The person must accept the member terms before using the account, and Compass sends text messages only with the person’s own consent. Being added to a roster is not that acceptance or consent. Organization will add a person only with that person’s permission, and will tell the person that Compass will create an account for them.

Deleting a person from Organization’s roster removes Organization’s copy or link. Deletion does not delete the person’s Compass member account, which the person can close by contacting Compass, and does not delete another organization’s records.

8. Events, referrals, and metrics

Organization may publish events and capacity. Members and CHWs see an event only to the extent Organization’s visibility setting allows. Check-in is recorded for people already on the roster. Walk-ups are intake records, subject to Section 7.2.

Performance metrics are counts. They may be broken out by language or ZIP code. Compass does not show a count below 11 in any breakdown, so that small numbers cannot identify a person. They do not include names, dates of birth, CINs, telephone numbers, street addresses, or row-level records. Organization will not treat an aggregate as a promise of grant eligibility.

9. Organization’s duties about the information it submits

Organization will submit information only when it has the legal right to do so, including any authorization, consent, parental authority, school authority, or minimum-necessary judgment the law requires. Organization is responsible for the accuracy of what its staff enter or upload.

Organization will not upload:

• For a person under 18, anything beyond name, date of birth, household, and event attendance, such as health, insurance, or Medi-Cal information.

• A student education record, unless Organization has the authority described in Section 11.8.

• Clinical notes, diagnoses, or session transcripts that the product does not ask for.

• Information Organization wants used for marketing, advertising, or sale.

Organization will not ask a member or CHW to move a conversation off Compass in order to collect a phone number or email address the platform has withheld.

Organization will train its staff who can see platform information, and will limit each person to what their job requires.

Organization is responsible for keeping its own copies of any records it must retain. The platform is not Organization’s official system of record, and Compass is not responsible for Organization’s recordkeeping obligations.

10. Compass’s duties

Compass will provide the services in a commercially reasonable manner and will protect information as Section 11 and, if signed, the BAA require. Compass may change, add, or discontinue platform features at any time, and will give reasonable notice before removing a feature Organization actively uses.

11. Data protection

11.1 One standard for all information

“Protected Information” means any health, insurance, identity, or roster information that Organization submits through intake, a CSV, or messaging, or that Compass creates for Organization, including name, date of birth, phone, sex, email, address, medical plan, Medi-Cal CIN, referral category, and event attendance. It includes Protected Health Information under HIPAA (“PHI”), medical information under the California Confidentiality of Medical Information Act (“CMIA”), and education records under FERPA.

Compass applies one privacy and security program to all Protected Information. That program follows the standards of the HIPAA Privacy and Security Rules, and Compass applies it whatever Organization’s type, whether or not HIPAA applies to Organization, and whether or not Organization meets its own legal obligations. Compass’s commitments in this Section are its own and do not depend on Organization’s HIPAA status or compliance. For PHI received from an Organization that has signed the BAA, the BAA adds the specific terms HIPAA requires.

11.2 How Compass uses Protected Information

Compass may use and disclose Protected Information only:

• To provide the services.

• For Compass’s own proper management and administration, or to carry out its legal responsibilities, and only if the disclosure is required by law or Compass obtains reasonable assurance that the recipient will hold the information in confidence and use it only for the purpose for which Compass disclosed it or as the law requires.

• As required by law.

• To provide Organization with aggregate counts that do not identify a person.

• To de-identify information under the methods in 45 CFR § 164.514(a)–(c), and to use that de-identified information, provided Compass does not attempt to re-identify it.

Compass will not sell Protected Information, use it for marketing or fundraising, use it to market third-party products, use it to train generalized artificial-intelligence models, or combine it with data from other customers for a purpose other than operating the services and producing de-identified statistics. A subcontractor that drafts a summary or transcript for a session may process the information only to provide that feature and may not train its models on it. Compass will limit each use and disclosure to the minimum necessary for its purpose.

11.3 Safeguards

Compass will maintain reasonable and appropriate administrative, physical, and technical safeguards, consistent with the HIPAA Security Rule, designed to protect all Protected Information. As of the Effective Date, those safeguards include encryption of Medi-Cal CIN at rest, encryption in transit, access limited by role, audit logging of access to Protected Information, and a prohibition on putting Protected Information in SMS or notification bodies. Compass may change the specific controls at any time, as long as the overall protection still meets this Section.

11.4 Incident notice

Compass will notify Organization without unreasonable delay, and no later than thirty (30) calendar days after discovery, of a confirmed unauthorized acquisition, access, use, or disclosure of Organization’s Protected Information that compromises its security or privacy (a “Breach”). The notice will include, to the extent known, what happened, when, the types of information and the individuals involved, what Compass is doing in response, and a contact at Compass, and Compass will supplement it as it learns more. Compass will give Organization reasonable help with any notice to individuals or regulators the law requires, including under California Civil Code § 1798.82. Unsuccessful attempts that do not result in unauthorized access, such as pings, port scans, and blocked login attempts, do not require notice. A notice under this Section is not an admission of fault or liability by Compass. If the BAA is signed, the BAA’s reporting terms also apply to PHI.

11.5 Subcontractors

Compass will not let a subcontractor receive Protected Information unless the subcontractor has agreed in writing to restrictions and safeguards at least as protective as this Section. Exhibit B lists those subcontractors as of the Effective Date. Compass will update Exhibit B and notify the organization admin when it adds a subcontractor that will receive Protected Information. If Organization objects on reasonable privacy grounds within fifteen (15) days after that notice, Organization’s sole remedy is to end the services that require that subcontractor.

11.6 Requests about individuals

Compass will give Organization a copy, correction, or deletion of a roster record that Organization is entitled to within forty-five (45) days after a written request, subject to records the law requires Compass to keep. If a person contacts Compass directly about Organization’s records, Compass will refer them to Organization and notify Organization, unless the law requires Compass to respond itself. Requests can be sent to privacy@joincompasschw.com.

11.7 California medical information and consumer privacy

For medical information covered by CMIA, Compass is a contractor that receives the information to provide the services, and will not use or disclose it except as these Terms or the law permit.

For personal information covered by the California Consumer Privacy Act and the California Privacy Rights Act, Compass is a service provider and contractor. Compass will not sell or share that personal information, will not retain, use, or disclose it except to provide the services, and will not combine it with personal information from other sources except as those laws allow a service provider to do. Compass will tell Organization if it can no longer meet its CCPA obligations, and will allow Organization to stop the transfer and take reasonable steps to stop unauthorized use. Compass certifies that it understands these restrictions and will comply with them.

11.8 Schools and FERPA

If Organization is a school or district, or is acting for one, and it submits education records as defined in FERPA, 20 U.S.C. § 1232g and 34 CFR Part 99:

• Organization designates Compass as a school official with a legitimate educational interest, but only for the services and only to the extent Organization has authority to make that designation.

• Compass will use education records only for the services, will not redisclose them except as Organization directs or as FERPA permits, and will subject its staff and subcontractors who can see those records to the same limit.

Organization will not submit an education record if it cannot make this designation.

11.9 Minors

Compass member accounts and CHW services are for people 18 and older. Organization may add a person under 18 to its roster only through staff entry or as part of a parent’s or guardian’s household, and only with name, date of birth, household, and event attendance. Compass will not create a member account for that person, text them, or refer them to a CHW, and will use their information only to provide Organization’s roster, check-in, and aggregate counts. Organization will not let a person under 18 sign themselves up through an RSVP or QR code form. Organization remains responsible for any parental consent the law requires and for supervising minors who take part in its programs and events.

11.10 Return and deletion

When the account ends, Compass will, at Organization’s written choice, return Protected Information to Organization or delete it within sixty (60) days after Organization’s written request. If Organization makes no choice within thirty (30) days after the account ends, Compass may delete it. These duties apply except to the extent the law requires Compass to keep the information or return is infeasible. Information Compass keeps remains subject to this Section, is isolated from routine use, and is deleted when the legal hold ends. A record that supports a Medi-Cal claim may be retained for 10 years, as Medi-Cal requires, or longer if another law requires it.

11.11 Organization’s own compliance

Organization is solely responsible for its own compliance with HIPAA, CMIA, FERPA, and every other law that applies to it, including its notices to individuals, its privacy officer duties, and its duties to the people it serves. Organization will not ask Compass to use or disclose Protected Information in a way that would violate the law if Organization did it directly. Compass may rely on Organization’s statements about its authority, consents, and legal status, and is not responsible for Organization’s failure to meet its own obligations.

12. Fees

Unless a written order signed by both parties states a fee, the organization services described in these Terms are provided at no charge. Compass will not later start charging for those services. If Compass offers optional paid add-ons, Organization pays only for add-ons it chooses in a written order signed by both parties. Medi-Cal reimbursement and CHW payouts are not organization fees and are not owed to Organization.

13. Acceptable use

Organization will not:

• Misrepresent its identity, licensure, authority, or HIPAA status.

• Submit false roster, referral, attendance, or check-in information.

• Harass a member, CHW, or another organization.

• Probe, scrape, or circumvent access controls, or upload malware.

• Resell the platform or build a competing dataset from it.

• Use the platform for a purpose the law forbids, including a disclosure Section 11 or the BAA does not allow.

14. Ownership

Organization keeps ownership of the roster and other records it submits. Organization grants Compass a non-exclusive license to host, process, transmit, and display that information only to provide the services, meet the law, and carry out Section 11 and the BAA.

Compass keeps ownership of the platform, software, interface designs, and Compass trademarks. These Terms do not assign that property to Organization. Feedback Organization volunteers may be used by Compass without obligation.

Aggregate metrics Compass computes for Organization may be used by Organization for its own reporting. Compass may use de-identified or aggregate statistics that do not identify Organization or any person, as Section 11.2 allows.

15. Confidentiality of business information

Each party will protect the other’s non-public business information with reasonable care and use it only to perform this relationship. This Section does not limit Section 11 or the BAA. Information that is public, already known without a duty of confidence, independently developed, or rightfully received from someone else is not covered. A party may disclose business information if the law requires it, after notice when notice is legally allowed.

16. Term and ending the relationship

These Terms start on the Effective Date on Exhibit C and continue until either party ends them.

Organization may end the organization account at any time by written notice. Compass may end it for convenience on 30 days’ written notice. Either party may end the account if the other party materially breaches and does not cure within 30 days after notice. Compass may suspend or end access immediately if Organization’s breach cannot be cured, creates a material risk to individuals or the platform, or the law requires it.

When the account ends, Organization’s access ends, and the BAA, if signed, ends as its own terms provide. Compass will return or delete Protected Information as Section 11.10 and, if signed, the BAA require. Clauses that by their nature should survive (including ownership, confidentiality, Section 11 for information Compass still holds, disclaimers, limits of liability, indemnity, and Section 21) survive.

17. Disclaimers

THE PLATFORM AND SERVICES ARE PROVIDED “AS IS” AND “AS AVAILABLE.” EXCEPT AS SECTION 11 AND THE BAA EXPRESSLY STATE, COMPASS DISCLAIMS ALL WARRANTIES, EXPRESS, IMPLIED, OR STATUTORY, INCLUDING WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, TITLE, AND NON-INFRINGEMENT. COMPASS DOES NOT WARRANT UNINTERRUPTED OR ERROR-FREE OPERATION; THE ACCURACY OR COMPLETENESS OF INFORMATION ENTERED BY ORGANIZATION, CHWS, MEMBERS, OR THIRD PARTIES; THE QUALIFICATIONS OR CONDUCT OF ANY CHW; OR THAT A REFERRAL, ENROLLMENT, GRANT, OR CLAIM WILL SUCCEED.

Organization is solely responsible for its own services, staff, events, and decisions, including the consent for and supervision of any minors who take part in them, and for its own compliance with the laws that apply to it. Compass does not monitor, and is not responsible for, the content of messages users send through the platform.

Some jurisdictions do not allow certain disclaimers. In those jurisdictions, the disclaimer applies to the extent the law allows.

18. Limitation of liability

TO THE MAXIMUM EXTENT THE LAW ALLOWS, NEITHER PARTY IS LIABLE TO THE OTHER FOR INDIRECT, INCIDENTAL, SPECIAL, CONSEQUENTIAL, EXEMPLARY, OR PUNITIVE DAMAGES, OR FOR LOST PROFITS, REVENUE, GOODWILL, OR DATA, OR THE COST OF SUBSTITUTE SERVICES, HOWEVER CAUSED AND UNDER ANY THEORY OF LIABILITY, EVEN IF ADVISED OF THE POSSIBILITY.

EXCEPT AS STATED BELOW, EACH PARTY’S TOTAL LIABILITY ARISING OUT OF OR RELATING TO THESE TERMS OR THE BAA IS LIMITED TO THE GREATER OF (A) THE FEES ORGANIZATION PAID COMPASS FOR THE ORGANIZATION SERVICES IN THE 12 MONTHS BEFORE THE EVENT GIVING RISE TO THE CLAIM OR (B) ONE THOUSAND DOLLARS (US $1,000).

Compass’s total liability for all claims arising from a breach of Section 11 or the BAA, a Breach or Security Incident, or a breach of Section 15 is limited, in the aggregate, to the greater of (A) two times the fees Organization paid Compass in the 12 months before the event giving rise to the claim or (B) ten thousand dollars (US $10,000). That amount is Compass’s only liability for those claims and includes any notification or mitigation costs Organization incurs.

None of the limits in this Section apply to Organization’s obligations under Section 19, Organization’s breach of Section 9, Section 11.9, Section 11.11, or Section 13, Organization’s submission of information it had no right to submit, or a party’s fraud or willful misconduct. The limits do not change either party’s duties to individuals or regulators under HIPAA or other law, which are not contractual damages. The limits apply even if a limited remedy fails of its essential purpose.

19. Indemnity

Organization will defend, indemnify, and hold harmless Compass and its officers, directors, shareholders, employees, contractors, and agents against third-party claims, and related losses, damages, fines, penalties, settlements, and reasonable attorneys’ fees, that arise from Organization’s roster or uploads, Organization’s lack of authority to submit that information, an inaccurate statement of Organization’s HIPAA status, Organization’s staff, events, programs, or services, information about minors that Organization or its staff submit or collect, the participation of minors in Organization’s programs or events, Organization’s violation of law, or Organization’s use of the platform in breach of these Terms or the BAA.

Compass will defend, indemnify, and hold harmless Organization and its officers, directors, employees, and agents against third-party claims, and related losses, damages, fines, penalties, settlements, and reasonable attorneys’ fees, that arise from Compass’s breach of Section 11 or the BAA, or Compass’s violation of law, subject to the limits in Section 18.

If a third party claims that the platform infringes its intellectual property, Compass may, at its option and expense, procure the right for Organization to keep using it, modify it, or end the affected service and refund any prepaid fees for that service. This is Organization’s sole remedy for any infringement claim.

The party seeking indemnity will give the other party prompt notice of a claim and reasonable cooperation at the indemnifying party’s expense. A delay in notice relieves the indemnifying party only to the extent it is materially prejudiced. The indemnifying party may control the defense with counsel reasonably acceptable to the other party, and the other party may participate with its own counsel at its own cost. The indemnifying party will not settle a claim that admits fault by the other party or imposes a duty on it without its written consent.

20. Changes

Compass may update these Terms by posting a new version and emailing the organization admin. Material changes take effect 30 days after that notice. If Organization does not agree, it may end the account before the effective date and stop using the platform. Changes the law requires for the BAA follow the BAA’s change-in-law section and may take effect sooner.

21. Law and disputes

California law governs these Terms and the BAA, without regard to conflict-of-law rules. The state and federal courts located in Los Angeles County, California, are the exclusive venue, and each party consents to personal jurisdiction there. Either party may seek temporary injunctive relief in those courts for misuse of confidential information or intellectual property.

To the extent the law allows, any claim against Compass arising out of or relating to these Terms or the BAA must be brought within one (1) year after the claim arises, or it is permanently barred. Each party will bring claims only in its individual capacity, and not as a plaintiff or class member in any class or representative proceeding.

The member and CHW arbitration clause and class waiver do not apply to Organization.

22. Other terms

• These Terms and, if signed, the BAA are the entire agreement for the organization account and supersede prior discussions on that subject.

• A failure to enforce a provision is not a waiver.

• If a provision is unenforceable, the rest remains in effect.

• Organization may not assign these Terms without Compass’s written consent, except to a successor of all or substantially all of its assets, with notice. Compass may assign them to a successor of the platform.

• Notices to Compass go to legal@joincompasschw.com and, for privacy matters, privacy@joincompasschw.com. Notices to Organization go to the email and address on Exhibit C. Notice is given when sent, if no bounce is received, or on delivery if sent by courier.

• Neither party is liable for delay or failure to perform caused by events beyond its reasonable control, including outages of hosting, telecommunications, or other third-party providers, natural disasters, pandemics, labor disputes, and government action. This does not excuse a duty to give notice under Section 11.4 or the BAA.

• There are no third-party beneficiaries.

• The parties are independent contractors. Nothing in these Terms creates a partnership, joint venture, agency, or employment relationship, and neither party may bind the other.

Exhibit A — Services and information

Services. Hosting the organization account; staff access; verified listing; referrals to and from Community Health Workers; messaging and masked contact through Compass; events, RSVP, and check-in; intake roster; CSV import and export of that roster; Compass member accounts for people on the roster, as Section 7.2 describes; aggregate counts for Organization.

Protected Information involved. Name, date of birth, phone, sex, email, postal address, medical plan, Medi-Cal CIN, referral category, language, ZIP code, event attendance, and the messages Organization exchanges on the platform about a person it serves. Clinical notes, diagnoses, call recordings, and transcripts are CHW and member records. They are not part of the organization roster. Compass does not disclose them to Organization except under a later written instruction, and only if the product allows it. They are not part of the basic referral view.

Not included. Showing Organization a member’s full chart. Giving Organization a member’s telephone number or email address.

Exhibit B — Subcontractors

Compass may update this Exhibit under Section 11.5. As of the Effective Date, the subcontractors that may receive Protected Information are listed below.

Compass will not allow a subcontractor on this Exhibit to receive Organization’s Protected Information until the written agreement required by Section 11.5 (and, for PHI, by the BAA) is in effect. Roster-only intake uses the hosting row. The session and billing rows apply only after a person is a Compass member and the relevant feature runs.

Exhibit C — Signature page

By signing below, Organization agrees to the Compass CHW Organization Platform Terms, including Exhibits A and B. Compass agrees to the same by signing below.

Organization legal name

Organization type (mark one)

[ ] Food Bank or Pantry

[ ] Pharmacy

[ ] School

[ ] Resource Organization

[ ] Faith-Based Organization

[ ] Other

Address for notices

Admin email

EIN or NPI, if any

HIPAA status (mark one)

[ ] HIPAA covered entity. The BAA must also be signed before any PHI is submitted.

[ ] Business associate of a covered entity. The BAA must also be signed before any PHI is submitted.

[ ] Not subject to HIPAA. No BAA is needed. Section 11 protects Organization’s information.

Effective Date

Agreed by the parties