Common use of Data Privacy and Security Laws Clause in Contracts

Data Privacy and Security Laws. The Company and its subsidiaries are, and at all prior times were, in material compliance with all applicable state and federal data privacy and security laws and regulations, including without limitation the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”) as amended by the Health Information Technology for Economic and Clinical Health Act (the “HITECH Act”) (collectively, the “Privacy Laws”). To ensure compliance with the Privacy Laws, the Company and its subsidiaries have in place, comply with, and take appropriate steps reasonably designed to ensure compliance in all material respects with their policies and procedures relating to data privacy and security and the collection, storage, use, disclosure, handling, and analysis of Personal Data (the “Policies”). “Personal Data” means (i) a natural person’s name, street address, telephone number, e-mail address, photograph, social security number or tax identification number, driver’s license number, passport number, credit card number, bank information, or customer or account number; (ii) any information which would qualify as “personally identifying information” under the Federal Trade Commission Act, as amended; (iii) Protected Health Information as defined by HIPAA; and (iv) any other piece of information that allows the identification of such natural person, or his or her family, or permits the collection or analysis of any data related to an identified person’s health or sexual orientation. The Company and its subsidiaries have at all times made all disclosures to users or customers required by applicable laws and regulatory rules or requirements, and no disclosure made pursuant to any Policy has, to the knowledge of the Company, been inaccurate or in violation of any applicable laws and regulatory rules or requirements in any material respect. The Company further certifies that neither it nor any subsidiary: (i) has received notice of any actual or potential material liability under or relating to, or actual or potential material violation of, any of the Privacy Laws, and has no knowledge of any event or condition that would reasonably be expected to result in any such notice; (ii) is currently conducting or paying for, in whole or in part, any investigation, remediation or other corrective action pursuant to any Privacy Law; or (iii) is a party to any order, decree, or agreement that imposes any obligation or liability under any Privacy Law.

Data Privacy and Security Laws. The Except as could not reasonably be expected to have a Material Adverse Effect, the Pricing Disclosure Package and the Prospectus, the Company and its subsidiaries are, and at all prior times weresince the Company’s inception have been, in material compliance with all applicable state and federal data privacy and security laws and regulations, including without limitation the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”) as amended by the Health Information Technology for Economic and Clinical Health Act (the “HITECH Act”) (collectively, the “Privacy Laws”). To ensure compliance with the Privacy Laws, the Company and its subsidiaries have in place, comply with, and take appropriate steps reasonably designed to ensure compliance in all material respects with their policies and procedures relating to data privacy and security and the collection, storage, use, disclosure, handling, and analysis of Personal Data (the “Policies”). “Personal Data” means (i) a natural person’s name, street address, telephone number, e-mail address, photograph, social security number or tax identification number, driver’s license number, passport number, credit card number, bank information, or customer or account number; (ii) any information which would qualify as “personally identifying information” under the Federal Trade Commission Act, as amended; (iii) Protected Health Information as defined by HIPAA; and (iv) any other piece of information that allows the identification of such natural person, or his or her family, or permits the collection or analysis of any data related to an identified person’s health or sexual orientation. The Except as could not reasonably be expected to have a Material Adverse Effect or as disclosed in the Registration Statement, the Pricing Disclosure Package and the Prospectus, the Company and its subsidiaries have at all times made all disclosures to users or customers required by applicable laws and regulatory rules or requirements, and no disclosure none of such disclosures made pursuant to or contained in any Policy hashave, to the knowledge of the Company, been inaccurate or in violation of any applicable laws and regulatory rules or requirements in any material respectrequirements. The Neither the Company further certifies that neither it nor any subsidiary: (i) has received notice of any actual or potential material liability under or relating to, or actual or potential material violation of, any of the Privacy Laws, and has no knowledge of any event or condition that would reasonably be expected to result in any such notice; (ii) is currently conducting or paying for, in whole or in part, any investigation, remediation remediation, or other corrective action pursuant to any Privacy Law; or (iii) is a party to any order, decree, or agreement that imposes any obligation or liability under any Privacy Law.

Data Privacy and Security Laws. The Except as could not reasonably be expected to have a Material Adverse Effect or as disclosed in the Registration Statement, the Pricing Disclosure Package and the Prospectus, the Company and its subsidiaries are, and at all prior times weresince the Company’s inception have been, in material compliance with all applicable state and federal data privacy and security laws and regulations, including without limitation the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”) as amended by the Health Information Technology for Economic and Clinical Health Act (the “HITECH Act”) (collectively, the “Privacy Laws”). To ensure compliance with the Privacy Laws, the Company and its subsidiaries have in place, comply in all material respects with, and take appropriate steps reasonably designed to ensure compliance in all material respects with their policies and procedures relating to data privacy and security and the collection, storage, use, disclosure, handling, and analysis of Personal Data (the “Policies”). “Personal Data” means (i) a natural person’s name, street address, telephone number, e-mail address, photograph, social security number or tax identification number, driver’s license number, passport number, credit card number, bank information, or customer or account number; (ii) any information which would qualify as “personally identifying information” under the Federal Trade Commission Act, as amended; (iii) Protected Health Information as defined by HIPAA; and (iv) any other piece of information that allows the identification of such natural person, or his or her family, or permits the collection or analysis of any data related to an identified person’s health or sexual orientation. The Except as could not reasonably be expected to have a Material Adverse Effect or as disclosed in the Registration Statement, the Pricing Disclosure Package and the Prospectus, the Company and its subsidiaries have at all times made all disclosures to users or customers required by applicable laws and regulatory rules or requirements, and no disclosure none of such disclosures made pursuant to or contained in any Policy hashave, to the knowledge of the Company, been inaccurate or in violation of any applicable laws and regulatory rules or requirements requirements. Except as could not reasonably be expected, individually or in any material respect. The the aggregate, to have a Material Adverse Effect, neither the Company further certifies that neither it nor any subsidiaryof its subsidiaries: (i) has received notice of any actual or potential material liability under or relating to, or actual or potential material violation of, any of the Privacy Laws, and has no knowledge of any event or condition that would reasonably be expected to result in any such notice; (ii) is currently conducting or paying for, in whole or in part, any investigation, remediation remediation, or other corrective action pursuant to any Privacy Law; or (iii) is a party to any order, decree, or agreement that imposes any obligation or liability under any Privacy Law.

Data Privacy and Security Laws. The Company and its subsidiaries are, and at all prior times were, in material compliance with all applicable state and federal data privacy and security laws and regulations, including without limitation the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”) as amended by the Health Information Technology for Economic and Clinical Health Act (the “HITECH Act”) (collectively, the “Privacy Laws”). To ensure compliance with the Privacy Laws, the Company and its subsidiaries have in place, comply with, and take appropriate steps reasonably designed to ensure compliance in all material respects with their policies and procedures relating to data privacy and security and the collection, storage, use, disclosure, handling, and analysis of Personal Data (the “Policies”). “Personal Data” means (i) a natural person’s name, street address, telephone number, e-mail address, photograph, social security number or tax identification number, driver’s license number, passport number, credit card number, bank information, or customer or account number; (ii) any information which would qualify as “personally identifying information” under the Federal Trade Commission Act, as amended; (iii) Protected Health Information as defined by HIPAA; and (iv) any other piece of information that allows the identification of such natural person, or his or her family, or permits the collection or analysis of any data related to an identified person’s health or sexual orientation. The Company and its subsidiaries have at all times made all disclosures to users or customers required by applicable laws and regulatory rules or requirements, and no disclosure none of such disclosures made pursuant to or contained in any Policy hashave, to the knowledge of the Company, been inaccurate or in violation of any applicable laws and regulatory rules or requirements in any material respect. The Company further certifies that neither it nor any subsidiaryof its subsidiaries: (i) has received notice of any actual or potential material liability under or relating to, or actual or potential material violation of, any of the Privacy Laws, and has no knowledge of any unauthorized use or disclosure of Personal Data or any event or condition that would reasonably be expected to result in any such notice; (ii) is currently conducting or paying for, in whole or in part, any investigation, remediation remediation, or other corrective action pursuant to any Privacy Law; or (iii) is a party to any order, decree, or agreement that imposes any obligation or liability under any Privacy Law.

Data Privacy and Security Laws. The Company and its subsidiaries and, to the Company’s knowledge, their respective agents and subcontractors, are, and at all prior times were, in compliance in all material compliance respects with all applicable state state, federal, and federal international data privacy and data security laws laws, regulations, and regulationsrelated rules and requirements, including without limitation the Health Insurance Portability and Accountability Act of 1996 and the HITECH Act (collectively “HIPAA”), the European Union General Data Protection Regulation (“GDPR”) as amended by the Health Information Technology for Economic and Clinical Health Act (the “HITECH Act”EU 2016/679) (collectively, the “Privacy Laws”). To ensure address compliance with the Privacy Laws, the Company and its subsidiaries have in place, comply with, and take appropriate commercially reasonable steps reasonably designed to ensure achieve compliance in all material respects with their policies and procedures relating to data privacy and security and the collection, storage, use, disclosure, handling, and analysis transfer of Personal Data (the “Policies”). “Personal Data” means (i) a natural person’s name, street address, telephone number, e-mail address, photograph, social security number or tax identification number, driver’s license number, passport number, credit card number, bank information, or customer or account number; (ii) any information which would qualify as “personally identifying information” under the Federal Trade Commission Act, as amended; (iii) Protected Health Information as defined by HIPAA; and (iv) any other piece of information that allows the identification of identifies such natural personperson and is defined in or addressed by Privacy Laws. At all times, or his or her family, or permits the collection or analysis of any data related to an identified person’s health or sexual orientation. The Company and its subsidiaries have at all times made all disclosures to users or customers required by applicable laws and regulatory rules or requirementsPrivacy Laws, and no disclosure none of such disclosures made pursuant to or contained in any Policy hashave, to the knowledge of the Company, been inaccurate or in violation of any applicable laws and regulatory rules or requirements in any material respectPrivacy Laws. The Company further certifies that (a) neither it nor any subsidiarysubsidiary at any time: (i) has received receive written notice of any actual or potential material liability liability, including, but not limited to security or data privacy breaches or other unauthorized or improper access to, use of, or destruction of its Sensitive Data (defined below) owned or controlled by the Company or its subsidiaries, under or relating to, or actual or potential material violation of, any of the Privacy Laws, and has no knowledge of any event or condition that would reasonably be expected to result in any such notice; (ii) other than pursuant to its ongoing compliance efforts in the ordinary course of business, is currently conducting conducting, subject to, or paying forpaying, in whole or in part, any material investigation, remediation remediation, or other corrective action pursuant to resulting from the Company’s or its subsidiaries’ non-compliance with any Privacy Law; or (iii) is a party to any order, decree, settlement agreement, or agreement judgment from a governmental entity that imposes any obligation or liability under any Privacy Law; and (b) it is not aware of any specific events rendering any of the foregoing reasonably likely to occur.

Data Privacy and Security Laws. The Company and each of its subsidiaries are, and at all prior times were, in material compliance with all applicable state and federal data privacy and security laws and regulations, including including, without limitation limitation, the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”) as amended by the Health Information Technology for Economic and Clinical Health Act (the “HITECH Act”), the California Consumer Privacy Act of 2018 (“CCPA”), and the European Union General Data Protection Regulation (“GDPR”) (EU 2016/679) (collectively, the “Privacy Laws”). To ensure compliance with the Privacy Laws, the Company and its subsidiaries have in place, comply with, and take appropriate steps reasonably designed to ensure compliance in all material respects with their policies and procedures relating to data privacy and security and the collection, storage, use, disclosure, handling, and analysis of Personal Data (the “Policies”). “Personal Data” means (i) a natural person’s name, street address, telephone number, e-mail address, photograph, social security number or tax identification number, driver’s license number, passport number, credit card number, bank information, or customer or account number; (ii) any information which would qualify as “personally identifying information” under the Federal Trade Commission Act, as amended; (iii) Protected Health Information as defined by HIPAA; (iv) “personal data” as defined by the GDPR; (v) “personal information” as defined by the CCPA; and (ivvi) any other piece of information that allows allows, directly or indirectly, the identification of such natural person, or his or her familyfamily or household, or permits the collection or analysis of any data related to an identified person’s health or sexual orientation. The Company and each of its subsidiaries have at all times has made all disclosures to users or customers individuals required by applicable laws and regulatory rules or requirements, and no disclosure none of such disclosures made pursuant to or contained in any Policy has, to the knowledge of the Company, ’s policies or notices relating to data privacy and security have been inaccurate or in violation of any applicable laws and regulatory rules or requirements in any material respect. The Neither the Company further certifies that neither it nor any subsidiary: of its subsidiaries (i) has have received notice of any actual or potential material liability under or relating to, or actual or potential material violation of, any of the Privacy Laws, and has no knowledge of any event or condition that would reasonably be expected to result in any such notice; (ii) is are currently conducting or paying for, in whole or in part, any investigation, remediation remediation, or other corrective action pursuant to any Privacy Law; or and (iii) is are a party to any order, decree, or agreement that imposes any obligation or liability under any Privacy Law.

Data Privacy and Security Laws. The Company and each of its subsidiaries are, and at all prior times werewas, in material compliance with all applicable state and federal data privacy and security laws and regulations, including without limitation limitation, as applicable, the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”) as amended by the Health Information Technology for Economic and Clinical Health Act (the “HITECH Act”) and the European Union General Data Protection Regulation (“GDPR”) (EU 2016/679) (collectively, the “Privacy Laws”), except to the extent that any non-compliance would not, individually or in the aggregate, reasonably be expected to have a Material Adverse Effect. To The Company has in place, complies with, and takes reasonable steps to ensure compliance with the Privacy Laws, the Company and its subsidiaries have in place, comply with, and take appropriate steps reasonably designed to ensure compliance in all material respects with their policies and procedures relating to data privacy and security and the collection, storage, use, disclosure, handling, and analysis of Personal Data (the “Policies”). “Personal Data” means means, as applicable, (i) a natural person’s name, street address, telephone number, e-mail address, photograph, social security number or tax identification number, driver’s license number, passport number, credit card number, bank information, or customer or account number; (ii) any information which would qualify as “personally identifying information” under the Federal Trade Commission Act, as amended; (iii) Protected Health Information as defined by HIPAA; (iv) “personal data” as defined by GDPR; and (ivv) any other piece of information that allows the identification of such natural person, or his or her family, or permits the collection or analysis of any data related to an identified person’s health or sexual orientation. The Company and its subsidiaries have have, at all times times, made all disclosures to users or customers required by applicable laws and regulatory rules or requirementsPrivacy Laws, and no disclosure none of such disclosures made pursuant to or contained in any Policy has, to the knowledge of the Company, have been inaccurate or in violation of any applicable laws and regulatory rules Privacy Laws, except in each case as would not, individually or requirements in any material respectthe aggregate, reasonably be expected to have a Material Adverse Effect. The Company further certifies that neither it nor any subsidiaryand each of its subsidiaries: (i) has not received written notice of any actual or potential material liability under or relating to, or actual or potential material violation by the Company of, any of the Privacy Laws, Laws and has no knowledge of any event or condition that would reasonably be expected to result in any such notice; (ii) is not currently conducting or paying for, in whole or in part, any investigation, remediation remediation, or other corrective action required by any governmental entity pursuant to any Privacy Law; or (iii) has made all notices to all persons, including affected individuals and applicable governmental or regulatory authorities, required under any Privacy Law with respect to the use, disclosure or breaches of Personal Data; or (iv) is not a party to any order, decree, or settlement agreement that imposes any obligation or liability under any Privacy Law.

Data Privacy and Security Laws. The Company and its subsidiaries are, and at all prior times were, in material compliance with all applicable state and federal data privacy and security laws and regulations, including without limitation HIPAA and the Health Insurance Portability HITECH Act, and Accountability Act of 1996 the Company and its subsidiaries have taken commercially reasonable actions to prepare to comply with the European Union General Data Protection Regulation (“HIPAAGDPR”) (EU 2016/679) and all other applicable laws and regulations with respect to Personal Data (defined below) that have been announced as amended by of the Health Information Technology date hereof as becoming effective within 12 months after the date hereof, and for Economic and Clinical Health Act (the “HITECH Act”) which any non-compliance with same would be reasonably likely to create a material liability (collectively, the “Privacy Laws”). To the Company’s knowledge, since May 25, 2018, the Company and its subsidiaries have been and currently are in material compliance with the GDPR. To ensure material compliance with the Privacy Laws, the Company and its subsidiaries have in place, comply withtaken, and take appropriate currently take, commercially reasonable steps reasonably designed to ensure compliance in all material respects with their policies and procedures Privacy Laws relating to data privacy and security and the collection, storage, use, disclosure, handling, and analysis of Personal Data (that the “Policies”)Company has collected, and collects, or is in the Company’s possession. “Personal Data” means (i) a natural person’s name, street address, telephone number, e-mail address, photograph, social security number or tax identification number, driver’s license number, passport number, credit card number, bank information, or customer or account number; (ii) any information which would qualify as “personally identifying information” under the Federal Trade Commission Act, as amended; (iii) Protected Health Information as defined by HIPAA; (iv) “personal data” as defined by GDPR, and (ivv) any other piece of information that allows the identification of such natural person, or his or her family, or permits the collection or analysis of any data related to an identified person’s health or sexual orientation. The Company and its subsidiaries since inception have at all times made all disclosures to users or customers required by applicable laws and regulatory rules Privacy Laws, except where the failure to do so would not, individually or requirementsin the aggregate, and no disclosure have a Material Adverse Effect. None of such disclosures made pursuant to any Policy hashave been inaccurate, to the knowledge of the Companymisleading, been inaccurate deceptive or in violation of any applicable laws and regulatory rules or requirements Privacy Laws in any material respect. The execution, delivery and performance of this Agreement or any other agreement referred to in this Agreement will not result in a breach of violation of any Privacy Laws. The Company further certifies that neither it nor any subsidiary: (i) has received notice of any actual or potential material liability under or relating to, or actual or potential material violation of, any of the Privacy Laws, and has no knowledge of any event or condition that would reasonably be expected to result in any such notice; (ii) is currently conducting or paying for, in whole or in part, any investigation, remediation remediation, or other corrective action pursuant to any Privacy Law; or (iii) is a party to any order, decree, or agreement that imposes any obligation or liability under any Privacy Law, except, in the case of (i), (ii), or (iii), where such violation, investigation, remediation, order, decree or agreement would not, individually or in the aggregate, reasonably be expected to have a Material Adverse Effect.

Data Privacy and Security Laws. The Company and its subsidiaries areis, and at all prior times werewas, in material compliance with all applicable state and federal data privacy and security laws and regulations, including without limitation limitation, as applicable, the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”) as amended by the Health Information Technology for Economic and Clinical Health Act (the “HITECH Act”) and the European Union General Data Protection Regulation (“GDPR”) (EU 2016/679) (collectively, the “Privacy Laws”), except to the extent that any non-compliance would not, individually or in the aggregate, reasonably be expected to have a Material Adverse Effect. To The Company has in place, complies with, and takes reasonable steps to ensure compliance with the Privacy Laws, the Company and its subsidiaries have in place, comply with, and take appropriate steps reasonably designed to ensure compliance in all material respects with their policies and procedures relating to data privacy and security and the collection, storage, use, disclosure, handling, and analysis of Personal Data (the “Policies”). “Personal Data” means means, as applicable, (i) a natural person’s name, street address, telephone number, e-mail address, photograph, social security number or tax identification number, driver’s license number, passport number, credit card number, bank information, or customer or account number; (ii) any information which would qualify as “personally identifying information” under the Federal Trade Commission Act, as amended; (iii) Protected Health Information as defined by HIPAA; (iv) “personal data” as defined by GDPR; and (ivv) any other piece of information that allows the identification of such natural person, or his or her family, or permits the collection or analysis of any data related to an identified person’s health or sexual orientation. The Company and its subsidiaries have has at all times made all disclosures to users or customers required by applicable laws and regulatory rules or requirementsPrivacy Laws, and no disclosure none of such disclosures made pursuant to or contained in any Policy has, to the knowledge of the Company, have been inaccurate or in violation of any applicable laws and regulatory rules Privacy Laws, except in each case as would not, individually or requirements in any material respectthe aggregate, reasonably be expected to have a Material Adverse Effect. The Company further certifies that neither it nor any subsidiaryCompany: (i) has not received written notice of any actual or potential material liability under or relating to, or actual or potential material violation by the Company of, any of the Privacy Laws, Laws and has no knowledge of any event or condition that would reasonably be expected to result in any such notice; (ii) is not currently conducting or paying for, in whole or in part, any investigation, remediation remediation, or other corrective action required by any governmental entity pursuant to any Privacy Law; or (iii) it has made all notices to all persons, including affected individuals and applicable governmental or regulatory authorities, required under any Privacy Law with respect to the use, disclosure or breaches of Personal Data; or (iv) is not a party to any order, decree, or settlement agreement that imposes any obligation or liability under any Privacy Law.

Data Privacy and Security Laws. The Company and its subsidiaries are, and at all prior times were, in material compliance with all applicable state and federal data privacy and security laws and regulations, including without limitation the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”) as amended by the Health Information Technology for Economic and Clinical Health Act (the “HITECH Act”); and the Company and its subsidiaries have taken commercially reasonable actions to prepare to comply with, and since May 25, 2018, have been and currently are in compliance with, the European Union General Data Protection Regulation (“GDPR”) (EU 2016/679), the California Consumer Protection Act of 2018 and all other applicable laws and regulations with respect to Personal Data and that have been announced as of the date hereof as becoming effective within 12 months after the date hereof, and for which any non-compliance with same would be reasonably likely to create a material liability (collectively, the “Privacy Laws”). To ensure compliance with the Privacy Laws, the Company and its subsidiaries have in place, comply with, and take appropriate steps reasonably designed to ensure compliance in all material respects with their policies and procedures relating to data privacy and security and the collection, storage, use, disclosure, handling, and analysis of Personal Data (the “Policies”). “Personal Data” means (i) a natural person’s name, street address, telephone number, e-mail address, photograph, social security number or tax identification number, driver’s license number, passport number, credit card number, bank information, or customer or account number; (ii) any information which would qualify as “personally identifying information” under the Federal Trade Commission Act, as amended; (iii) Protected Health Information as defined by HIPAA; (iv) “personal data” as defined by GDPR; and (ivv) any other piece of information that allows the identification of such natural person, or his or her family, or permits the collection or analysis of any data related to an identified person’s health or sexual orientation. The Company and its subsidiaries have at all times made all disclosures to users or customers required by applicable laws and regulatory rules or requirements, and no disclosure none of such disclosures made pursuant to or contained in any Policy hashave, to the knowledge of the Company, been inaccurate or in violation of any applicable laws and regulatory rules or requirements in any material respect. The Company further certifies that neither it nor any subsidiary: (i) has received notice of any actual or potential material liability under or relating to, or actual or potential material violation of, any of the Privacy Laws, and has no knowledge of any event or condition that would reasonably be expected to result in any such notice; (ii) is currently conducting or paying for, in whole or in part, any investigation, remediation remediation, or other corrective action pursuant to any Privacy Law; or (iii) is a party to any order, decree, or agreement that imposes any obligation or liability under any Privacy Law.

Data Privacy and Security Laws. The Company and its subsidiaries are, and at all prior times were, in material compliance with all applicable state and federal data privacy and security laws and regulations, including without limitation the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”) as amended by the Health Information Technology for Economic and Clinical Health Act (the “HITECH Act”) and the European Union General Data Protection Regulation (“GDPR”) (collectively, the “Privacy Laws”). To ensure compliance with the Privacy Laws, the Company and its subsidiaries have in place, comply with, and take appropriate steps reasonably designed to ensure compliance in all material respects with their policies and procedures relating to data privacy and security and the collection, storage, use, disclosure, handling, and analysis of Personal Data (the “Policies”). “Personal Data” means (i) a natural person’s name, street address, telephone number, e-mail address, photograph, social security number or tax identification number, driver’s license number, passport number, credit card number, bank information, or customer or account number; (ii) any information which would qualify as “personally identifying information” under the Federal Trade Commission Act, as amended; (iii) Protected Health Information as defined by HIPAA; and (iv) any other piece of information that allows the identification of such natural person, or his or her family, or permits the collection or analysis of any data related relates to an identified person’s health or sexual orientationidentifiable natural person or otherwise constitutes personally identifiable information, personal information, personal data or similar information protected by Privacy Laws. The Company and its subsidiaries have at all times made all required disclosures to users or customers required by and obtained all necessary consents from individuals pursuant to applicable laws and regulatory rules or requirements, and no disclosure made pursuant to any Policy has, to the knowledge of the Company, been inaccurate or in violation of any applicable laws and regulatory rules or requirements in any material respect. The Company further certifies that neither it nor any subsidiary: (i) has received notice of any actual or potential material liability under or relating to, or actual or potential material violation of, any of the Privacy Laws, and has no knowledge of any event or condition that would reasonably be expected to result in any such notice; (ii) is currently conducting or paying for, in whole or in part, any investigation, remediation or other corrective action pursuant to any Privacy Law; or (iii) is a party to any order, decree, or agreement that imposes any obligation or liability under any Privacy Law.

Data Privacy and Security Laws. The To the Company's knowledge, the Company and its subsidiaries Subsidiaries are, and at all prior times were, in material compliance with all applicable state and federal data privacy and security laws and regulationsregulations in the United States, and all applicable provincial and federal data privacy and security laws and regulations in Canada, including without limitation the Health Insurance Portability Personal Information Protection and Accountability Act of 1996 (“HIPAA”) as amended by the Health Information Technology for Economic and Clinical Health Electronic Documents Act (S.C. 2000, c. 5) ("PIPEDA"), and the “HITECH Act”Company and its Subsidiaries have taken commercially reasonable actions to prepare to comply with, and have been and currently are in compliance with, the European Union General Data Protection Regulation ("GDPR") (EU 2016/679) (collectively, the “"Privacy Laws”"). To ensure compliance with the Privacy Laws, the Company and its subsidiaries Subsidiaries have in place, comply with, and take appropriate steps reasonably designed to ensure compliance in all material respects with their policies and procedures relating to data privacy and security and the collection, storage, use, disclosure, handling, and analysis handling of Personal Data (the “"Policies”"). “"Personal Data” " means (i) a natural person’s 's name, street address, telephone number, e-mail address, photograph, social security number or tax identification number, driver’s 's license number, passport number, credit card number, bank information, or customer or account number; (ii) any information which would qualify as “"personally identifying information” " under the Federal Trade Commission Act, as amended; (iii) Protected Health Information "personal information", "personal health information". and "business contact information" as defined by HIPAAPXXXXX; (iv) "personal data" as defined by GDPR; and (ivv) any other piece of information that allows the identification of such natural person, or his or her family, or permits the collection or analysis of any data related to an identified person’s 's health or sexual orientation. The Company and its subsidiaries Subsidiaries have at all times made all disclosures to users or customers required by applicable laws and regulatory rules or requirements, and no disclosure none of such disclosures made pursuant to or contained in any Policy hashave, to the knowledge of the Company, been inaccurate or in violation of any applicable laws and regulatory rules or requirements in any material respect. The Company further certifies that neither it nor any subsidiarySubsidiary: (i) has received notice of any actual or potential material liability under or relating to, or actual or potential material violation of, any of the Privacy Laws, and has no knowledge of any event or condition that would reasonably be expected to result in any such notice; (ii) is currently conducting or paying for, in whole or in part, any investigation, remediation remediation, or other corrective action pursuant to any Privacy Law; or (iii) is a party to any order, decree, or agreement that imposes any obligation or liability under any Privacy Law.

Data Privacy and Security Laws. The Company and its subsidiaries arehave taken commercially reasonable actions to prepare to comply with the European Union General Data Protection Regulation (“GDPR”) (EU 2016/679) and all other applicable laws and regulations with respect to Personal Data (defined below) that have been announced as of the date hereof as becoming effective within 12 months after the date hereof, and at all prior times were, in material for which any non-compliance with all applicable state and federal data privacy and security laws and regulations, including without limitation the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”) as amended by the Health Information Technology for Economic and Clinical Health Act (the “HITECH Act”) same would be reasonably likely to create a material liability (collectively, the “Privacy Laws”). To ensure the Company’s knowledge, since May 25, 2018, the Company and its subsidiaries have been and currently are in material compliance with the GDPR. To support material compliance with the Privacy Laws, the Company and its subsidiaries have in place, comply withtaken, and take appropriate currently take, commercially reasonable steps reasonably designed to ensure compliance in all material respects with their policies and procedures Privacy Laws relating to data privacy and security and the collection, storage, use, disclosure, handling, and analysis of Personal Data (that the “Policies”)Company has collected, and collects, or is in the Company’s possession. “Personal Data” means (i) a natural person’s name, street address, telephone number, e-mail address, photograph, social security number or tax identification number, driver’s license number, passport number, credit card number, bank information, or customer or account number; (ii) any information which would qualify as “personally identifying information” under the Federal Trade Commission Act, as amended; (iii) Protected Health Information “personal data” as defined by HIPAA; GDPR, and (iv) any other piece of information that allows the identification of such natural person, or his or her family, or permits the collection or analysis of any data related to an identified person’s health or sexual orientation. The Company and its subsidiaries since inception have at all times made all disclosures to users or customers required by applicable laws and regulatory rules Privacy Laws, except where the failure to do so would not, individually or requirementsin the aggregate, and no disclosure have a Material Adverse Effect. None of such disclosures made pursuant to any Policy hashave been inaccurate, to the knowledge of the Companymisleading, been inaccurate deceptive or in violation of any applicable laws and regulatory rules or requirements Privacy Laws in any material respect. The execution, delivery and performance of this Agreement or any other agreement referred to in this Agreement will not result in a breach of violation of any Privacy Laws. The Company further certifies that neither it nor any subsidiary: (i) has received notice of any actual or potential material liability under or relating to, or actual or potential material violation of, any of the Privacy Laws, and has no knowledge of any event or condition that would reasonably be expected to result in any such notice; (ii) is currently conducting or paying for, in whole or in part, any investigation, remediation remediation, or other corrective action pursuant to any Privacy Law; or (iii) is a party to any order, decree, or agreement that imposes any obligation or liability under any Privacy Law, except, in the case of (i), (ii), or (iii), where such violation, investigation, remediation, order, decree or agreement would not, individually or in the aggregate, reasonably be expected to have a Material Adverse Effect.

Data Privacy and Security Laws. The Company and its subsidiaries are, and at all prior times werehave been, in material compliance with all applicable state laws and federal regulations relating to data privacy and security laws and regulationsSensitive Data (defined below) that have been in effect and that have been announced as of the date hereof as becoming effective within 15 months after the date hereof, including without limitation the Health Insurance Portability and Accountability California Consumer Privacy Act of 1996 (“CCPA”), HIPAA, HITECH Act, the European Union General Data Protection Regulation (“GDPR”) (EU 2016/679), and the GDPR as amended by it forms part of the Health Information Technology for Economic and Clinical Health Act (law of the “HITECH Act”) United Kingdom (collectively, the “Privacy Laws”). To ensure compliance with the Privacy Laws, the The Company and its subsidiaries have in place, comply with, and take appropriate steps reasonably designed to ensure compliance in all material respects with their policies and procedures relating to data privacy and security and the collection, storage, use, disclosure, handling, and analysis of Personal Sensitive Data (the “Policies”). At all times since inception, the Company and its subsidiaries have provided all required notices of its Policies and obtained all necessary consents from individuals. None of the disclosures made or contained in any of the Policies have been inaccurate, misleading, deceptive, incomplete, or in violation of any Privacy Laws or Policies. “Personal Data” means (i) a natural person’s name, street address, telephone number, e-mail address, photograph, social security number or tax identification number, driver’s license number, passport number, credit card number, bank information, or customer or account number; (ii) any information which would qualify as “personally identifying information” under the Federal Trade Commission Act, as amended; (iii) Protected Health Information as defined by HIPAA; and (iv) any other information that constitutes “personal data”, “personal information”, “personally identifiable information”, “nonpublic personal information”, “customer proprietary network information”, “individually identifiable health information”, “protected health information”, or similar information under Privacy Laws, and (v) any other piece of information that allows the identification of such a natural person, or his or her family, device, or permits the collection or analysis of any data related to an identified person’s health or sexual orientation. “Sensitive Data” means all confidential, proprietary, or otherwise sensitive information (including Personal Data). The Company execution, delivery and its subsidiaries have at all times made all disclosures performance of this Agreement or any other agreement referred to users or customers required by applicable laws and regulatory rules or requirements, and no disclosure made pursuant to any Policy has, to the knowledge in this Agreement will not result in a breach of the Company, been inaccurate or in violation of any applicable laws and regulatory rules Privacy Laws or requirements in any material respectPolicies. The Neither the Company further certifies that neither it nor any subsidiary: (i) has received notice of any actual or potential material liability under or relating to, or actual or potential material violation of, any of the Privacy Laws, and has no knowledge of any event fact, event, or condition that would reasonably be expected to result in any such notice; (ii) is currently participating in, subject to, conducting or paying for, in whole or in part, any investigation, remediation remediation, or other corrective action pursuant to any Privacy Law; or (iii) is a party to any order, decree, or agreement that imposes any obligation or liability under any Privacy Law.

Data Privacy and Security Laws. The Company and its subsidiaries are, and at all prior times were, in material compliance with all applicable state and federal data privacy and security laws and regulations, including without limitation HIPAA, HITECH Act, and the Health Insurance Portability and Accountability Act of 1996 European Union General Data Protection Regulation (“HIPAAGDPR”) (EU 2016/679) (and all other applicable laws and regulations with respect to Personal Data (defined below) that have been announced as amended by of the Health Information Technology date hereof as becoming effective within 12 months after the date hereof, and for Economic and Clinical Health Act (the “HITECH Act”which any non-compliance with same would be reasonably likely to create a material liability) (collectively, the “Privacy Laws”). To ensure compliance with the Privacy Laws, the Company and its subsidiaries have in place, comply with, and take appropriate steps reasonably designed to ensure compliance in all material respects with their policies and procedures relating to data privacy and security and the collection, storage, use, disclosure, handling, and analysis of Personal Data (the “Policies”)Policies”).The Company provides accurate notice of its Policies then in effect to its customers, employees, third party vendors and representatives in material compliance with Privacy Laws. Each of the Company Policies provides accurate and sufficient notice of the Company’s privacy practices relating to its subject matter and such Company Policies do not contain any material omissions of the Company’s privacy practices. “Personal Data” means (i) a natural person’s name, street address, telephone number, e-mail address, photograph, social security number or tax identification number, driver’s license number, passport number, credit card number, bank information, or customer or account number; (ii) any information which would qualify as “personally identifying information” under the Federal Trade Commission Act, as amended; (iii) Protected Health Information as defined by HIPAA; (iv) “personal data” as defined by GDPR, and (ivv) any other piece of information that allows the identification of such natural person, or his or her family, or permits the collection or analysis of any data related to an identified person’s health or sexual orientation. The Company execution, delivery and its subsidiaries have at all times made all disclosures performance of this Agreement or any other agreement referred to users or customers required by applicable laws and regulatory rules or requirements, and no disclosure made pursuant to any Policy has, to the knowledge in this Agreement will not result in a breach of the Company, been inaccurate or in violation of any applicable laws and regulatory rules Privacy Laws or requirements in any material respectPolicies. The Company further certifies that neither it nor any subsidiary: (i) has received notice of any actual or potential material liability under or relating to, or actual or potential material violation of, any of the Privacy Laws, and has no knowledge of any event or condition that would reasonably be expected to result in any such notice; (ii) is currently conducting or paying for, in whole or in part, any investigation, remediation remediation, or other corrective action pursuant to any Privacy Law; or (iii) is a party to any order, decree, or agreement that imposes any obligation or liability under any Privacy Law.

Data Privacy and Security Laws. The Company and its subsidiaries are, and at all prior times since inception were, in material compliance with all applicable state and federal data privacy and data security laws and regulations, including without limitation HIPAA, the Health Insurance Portability HITECH Act, and Accountability Act of 1996 the European Union General Data Protection Regulation (“HIPAAGDPR”) (EU 2016/679) (and all other applicable laws and regulations with respect to Personal Data (defined below) that have been announced as amended by of the Health Information Technology date hereof as becoming effective within 12 months after the date hereof, and for Economic and Clinical Health Act (the “HITECH Act”which any non-compliance with same would be reasonably likely to create a material liability) (collectively, the “Privacy Laws”). To ensure support compliance with the Privacy Laws, the Company and its subsidiaries have in place, comply with, and take appropriate steps reasonably designed to ensure compliance in all material respects with their with, policies and procedures relating to data privacy and data security and the collection, storage, use, disclosure, handling, and analysis of Personal Data (the “Policies”). At all times since inception, the Company has provided accurate notice of its Policies then in effect to its customers, employees, third party vendors and representatives. Each of the Company Policies provides accurate and sufficient notice of the Company’s then-current privacy practices relating to its subject matter and such Company Policies do not contain any material omissions of the Company’s then-current privacy practices. “Personal Data” means (i) a natural person’s name, street address, telephone number, e-mail address, photograph, social security number or tax identification number, driver’s license number, passport number, credit card number, bank information, or customer or account number; (ii) any information which would qualify as “personally identifying information” under the Federal Trade Commission Act, as amended; (iii) Protected Health Information as defined by HIPAA; (iv) “personal data” as defined by GDPR, and (ivv) any other piece of information that allows the identification of such natural person, or his or her family, or permits the collection or analysis of any data related to an identified person’s health or sexual orientationorientation that is not aggregated with the data of other individuals or otherwise irreversibly anonymized such that a natural person cannot be identified. The Company and its subsidiaries since inception have at all times made all disclosures to users or customers required by applicable laws and regulatory rules or requirements, and no disclosure have provided accurate notice of its Policies then in effect to its customers, employees, third party vendors and representatives. None of such disclosures made pursuant to or contained in any Policy has, to the knowledge of the CompanyPolicies have been inaccurate, been inaccurate misleading, deceptive or in violation of any applicable laws and regulatory rules Privacy Laws or requirements Policies in any material respect. The execution, delivery and performance of this Agreement or any other agreement referred to in this Agreement will not result in a breach of violation of any Privacy Laws or Policies. The Company further certifies that neither it nor any subsidiary: (i) has received notice of any actual or potential material liability under or relating to, or actual or potential material violation of, any of the Privacy Laws, and has no knowledge of any event or condition that would reasonably be expected to result in any such notice; (ii) is currently conducting or paying for, in whole or in part, any investigation, remediation remediation, or other corrective action pursuant to any Privacy Law; or (iii) is a party to any order, decree, or agreement that imposes any obligation or liability under any Privacy Law.

Data Privacy and Security Laws. The Except as could not reasonably be expected to have a Material Adverse Effect or as disclosed in the Time of Sale Information and the Offering Memorandum, the Company and its subsidiaries are, and at all prior times weresince the Company’s inception have been, in material compliance with all applicable state and federal data privacy and security laws and regulations, including without limitation the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”) as amended by the Health Information Technology for Economic and Clinical Health Act (the “HITECH Act”) (collectively, the “Privacy Laws”). To ensure compliance with the Privacy Laws, the Company and its subsidiaries have in place, comply in all material respects with, and take appropriate steps reasonably designed to ensure compliance in all material respects with their policies and procedures relating to data privacy and security and the collection, storage, use, disclosure, handling, and analysis of Personal Data (the “Policies”). “Personal Data” means (i) a natural person’s name, street address, telephone number, e-mail address, photograph, social security number or tax identification number, driver’s license number, passport number, credit card number, bank information, or customer or account number; (ii) any information which would qualify as “personally identifying information” under the Federal Trade Commission Act, as amended; (iii) Protected Health Information as defined by HIPAA; and (iv) any other piece of information that allows the identification of such natural person, or his or her family, or permits the collection or analysis of any data related to an identified person’s health or sexual orientation. The Except as could not reasonably be expected to have a Material Adverse Effect or as disclosed in the Time of Sale Information and the Offering Memorandum, the Company and its subsidiaries have at all times made all disclosures to users or customers required by applicable laws and regulatory rules or requirements, and no disclosure none of such disclosures made pursuant to or contained in any Policy hashave, to the knowledge of the Company, been inaccurate or in violation of any applicable laws and regulatory rules or requirements requirements. Except as could not reasonably be expected, individually or in any material respect. The the aggregate, to have a Material Adverse Effect, neither the Company further certifies that neither it nor any subsidiaryof its subsidiaries: (i) has received notice of any actual or potential material liability under or relating to, or actual or potential material violation of, any of the Privacy Laws, and has no knowledge of any event or condition that would reasonably be expected to result in any such notice; (ii) is currently conducting or paying for, in whole or in part, any investigation, remediation remediation, or other corrective action pursuant to any Privacy Law; or (iii) is a party to any order, decree, or agreement that imposes any obligation or liability under any Privacy Law.

Data Privacy and Security Laws. The Company and its subsidiaries areis, and at all prior times weresince its inception has been, in material compliance with all applicable state and federal data privacy and security laws and regulations, including without limitation the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”) as amended by the Health Information Technology for Economic and Clinical Health Act (the “HITECH Act”) (collectively, the “Privacy Laws”). To ensure compliance with the Privacy Laws, the Company and its subsidiaries have has in place, comply complies with, and take takes appropriate steps reasonably designed to ensure compliance in all material respects with their its, policies and procedures relating to data privacy and security and the collection, storage, use, disclosure, handling, and analysis of Personal Data (the “Policies”). “Personal Data” means (i) a natural person’s name, street address, telephone number, e-mail address, photograph, social security number or tax identification number, driver’s license number, passport number, credit card number, bank information, or customer or account number; (ii) any information which would qualify as “personally identifying information” under the Federal Trade Commission Act, as amended; (iii) Protected Health Information as defined by HIPAA; and (iv) any other piece of information that allows the identification of such natural person, or his or her familyfamily or household, or permits the collection or analysis of any data related to an identified person’s health or sexual orientation. The Company and its subsidiaries have has at all times made all disclosures to users or customers required by applicable laws and regulatory rules or requirements, and no disclosure none of such disclosures made pursuant to or contained in any Policy hashave, to the knowledge of the Company, been inaccurate or in violation of any applicable laws and regulatory rules or requirements in any material respect. The Company further certifies that neither it nor any subsidiarythat: (i) it has not received notice of any actual or potential material liability under or relating to, or actual or potential material violation of, any of the Privacy Laws, and has no knowledge of any event or condition that would reasonably be expected to result in any such notice; (ii) it is not currently conducting or paying for, in whole or in part, any investigation, remediation remediation, or other corrective action pursuant to any Privacy Law; or and (iii) is not a party to any order, decree, or agreement that imposes any obligation or liability under any Privacy Law.

Data Privacy and Security Laws. The Company and its subsidiaries are, and at all prior times since inception were, in material compliance with all applicable state and federal data privacy and data security laws and regulations, including without limitation HIPAA, the Health Insurance Portability and Accountability Act of 1996 HITECH Act, the European Union General Data Protection Regulation (“HIPAAGDPR”) as amended by (EU 2016/679), and the Health Information Technology for Economic and Clinical Health California Consumer Privacy Act (“CCPA”) (and all other applicable laws and regulations with respect to Personal Data (defined below) that have been announced as of the “HITECH Act”date hereof as becoming effective within 12 months after the date hereof, and for which any non-compliance with same would be reasonably likely to create a material liability) (collectively, the “Privacy Laws”). To ensure support compliance with the Privacy Laws, the Company and its subsidiaries have in place, comply with, and take appropriate steps reasonably designed to ensure compliance in all material respects with their with, policies and procedures relating to data privacy and data security and the collection, storage, use, disclosure, handling, and analysis of Personal Sensitive Data (the “Policies”). At all times since inception, the Company has provided accurate notice of its Policies then in effect to its customers, employees, third party vendors and representatives. Each of the Company Policies provides accurate and sufficient notice of the Company’s then-current privacy practices relating to its subject matter and such Company Policies do not contain any material omissions of the Company’s then-current privacy practices. “Personal Data” means (i) a natural person’s name, street address, telephone number, e-mail address, photograph, social security number or tax identification number, driver’s license number, passport number, credit card number, bank information, or customer or account number; (ii) any information which would qualify as “personally identifying information” under the Federal Trade Commission Act, as amended; (iii) Protected Health Information as defined by HIPAA; (iv) “personal data” as defined by GDPR, and (ivv) any other piece of information that allows the identification of such natural person, or his or her family, or permits the collection or analysis of any data related to an identified person’s health or sexual orientationorientation that is not aggregated with the data of other individuals or otherwise irreversibly anonymized such that a natural person cannot be identified. “Sensitive Data” means any Personal Data or any sensitive, proprietary, or trade secret information of the Company or any such information of a third party in the possession of the Company. The Company and its subsidiaries since inception have at all times made all disclosures to users or customers required by applicable laws and regulatory rules or requirements, and no disclosure have provided accurate notice of its Policies then in effect to its customers, employees, third party vendors and representatives. None of such disclosures made pursuant to or contained in any Policy has, to the knowledge of the CompanyPolicies have been inaccurate, been inaccurate misleading, deceptive or in violation of any applicable laws and regulatory rules Privacy Laws or requirements Policies in any material respect. The execution, delivery and performance of this Agreement or any other agreement referred to in this Agreement will not result in a breach of violation of any Privacy Laws or Policies. The Company further certifies that neither it nor any subsidiary: (i) has received notice of any actual or potential material liability under or relating to, or actual or potential material violation of, any of the Privacy Laws, and has no knowledge of any event or condition that would reasonably be expected to result in any such notice; (ii) is currently conducting or paying for, in whole or in part, any investigation, remediation remediation, or other corrective action pursuant to any Privacy Law; or (iii) is a party to any order, decree, or agreement that imposes any obligation or liability under any Privacy Law.

Data Privacy and Security Laws. The Company and its subsidiaries are, and at all prior times were, in compliance in all material compliance respects with all applicable state state, federal, and federal international data privacy and data security laws and regulations, including without limitation HIPAA and the Health Insurance Portability HITECH Act, and Accountability the European Union General Data Protection Regulation (“GDPR”) (EU 2016/679), and the Company and its subsidiaries are currently or have taken commercially reasonable actions to prepare to comply with the California Consumer Protection Act of 1996 2018 (“HIPAA”) as amended by the Health Information Technology for Economic and Clinical Health Act (the “HITECH ActCCPA”) (collectively, the “Privacy Laws”). To ensure address compliance with the Privacy Laws, the Company and its subsidiaries have in place, comply with, and take appropriate commercially reasonable steps reasonably designed to ensure achieve compliance in all material respects with their policies and procedures relating to data privacy and security and the collection, storage, use, disclosure, handling, and analysis transfer of Personal Data (the “Policies”). “Personal Data” means (i) a natural person’s name, street address, telephone number, e-mail address, photograph, social security number or tax identification number, driver’s license number, passport number, credit card number, bank information, or customer or account number; (ii) any information which would qualify as “personally identifying information” under the Federal Trade Commission Act, as amended; (iii) Protected Health Information as defined by the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”); (iv) “personal data” as defined by GDPR; and (ivv) any other piece of information that allows the identification of identifies such natural person. At all times, or his or her family, or permits the collection or analysis of any data related to an identified person’s health or sexual orientation. The Company and its subsidiaries have at all times made all disclosures to users or customers required by applicable laws Privacy Laws and regulatory rules or requirements, and no disclosure none of such disclosures made pursuant to or contained in any Policy hashave, to the knowledge of the Company, been inaccurate or in violation of any applicable laws and regulatory rules or requirements in any material respect. The Company further certifies that (a) neither it nor any subsidiarysubsidiary at any time: (i) has received receive written notice of any actual or potential material liability liability, including, but not limited to security or data privacy breaches or other unauthorized or improper access to, use of, or destruction of its Personal Data owned or controlled by the Company or its subsidiaries, under or relating to, or actual or potential material violation of, any of the Privacy Laws, and has no knowledge of any event or condition that would reasonably be expected to result in any such notice; (ii) other than pursuant to its ongoing compliance efforts in the ordinary course of business, is currently conducting conducting, subject to, or paying forpaying, in whole or in part, any material investigation, remediation remediation, or other corrective action pursuant to resulting from the Company’s or its subsidiaries’ non-compliance with any Privacy Law; or (iii) is a party to any order, decree, settlement agreement, or agreement judgment from a governmental entity that imposes any obligation or liability under any Privacy Law; and (b) it is not aware of any specific events rendering any of the foregoing reasonably likely to occur.

Data Privacy and Security Laws. The Company and its subsidiaries are, and at all prior times were, in compliance in all material compliance respects with all applicable state state, federal and federal international data privacy, security and, with respect to data privacy and security security, consumer protection laws and regulations, including without limitation the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”) as amended by the Health Information Technology for Economic and Clinical Health Act Act, and since May 25, 2018, the European Union General Data Protection Regulation (the “HITECH ActGDPR”) (EU 2016/679) (collectively, the “Privacy Laws”), except to the extent that any non-compliance would not, individually or in the aggregate, reasonably be expected to have a Material Adverse Effect. To ensure compliance with the Privacy LawsExcept as would not reasonably be expected to have a Material Adverse Effect, the Company and its subsidiaries (i) have in place, comply complies with, and take appropriate takes reasonable steps reasonably designed to ensure compliance in all material respects with their its policies and procedures relating to data privacy and security and the collection, storage, use, disclosure, handling, and analysis of Personal Data (the “Policies”), and (ii) implement and maintain (I) information technology and equipment, computer systems, networks, software, websites, applications, and databases (collectively, “IT Systems”) commercially reasonable for the operation of the business of the Company as currently conducted and (II) commercially reasonable controls and safeguards to maintain and protect its material confidential information and the integrity, continuous operation, redundancy and security of all IT Systems and data within its operational control used in connection with its businesses. “Personal Data” means means, as applicable, (i) a natural person’s name, street address, telephone number, e-mail address, photograph, social security number or tax identification number, driver’s license number, passport number, credit card number, bank information, or customer or account number; (ii) any information which would qualify as “personally identifying information” under the Federal Trade Commission Act, as amended; (iii) Protected Health Information as defined by HIPAA; (iv) “personal data” as defined by GDPR; and (ivv) any other piece of information that allows the identification of such natural person, or his or her family, or permits the collection or analysis of any data related relates to an identified person’s health or sexual orientation. The Company and its subsidiaries have at all times made all disclosures to users or customers required by applicable laws and regulatory rules or requirementsPrivacy Laws, and no disclosure none of such disclosures made pursuant to or contained in any Policy has, to the knowledge privacy policy of the Company, Company have been inaccurate or in violation of any applicable laws Privacy Laws, except in each case as would not, individually or in the aggregate, reasonably be expected to have a Material Adverse Effect. Except as would not, individually or in the aggregate, reasonably be expected to have a Material Adverse Effect, the Company and regulatory rules or requirements in any material respect. The Company further certifies that neither it nor any subsidiaryits subsidiaries: (i) has have not received written notice of any actual or potential material liability of the Company relating to, security or data privacy breaches or other unauthorized or improper access to, use of or destruction of its confidential information or Personal Data, or under or relating to, or to any actual or potential material violation by the Company of, any of the Privacy Laws, and has no knowledge of any event or condition that would reasonably be expected to result in any such notice; (ii) is are not currently conducting or paying for, in whole or in part, any investigation, remediation remediation, or other corrective action required by any governmental entity pursuant to any Privacy Law, other than in the ordinary course of business; or (iii) is are not a party to any order, decree, or agreement with any governmental entity that imposes any obligation or liability under any Privacy Law.

Data Privacy and Security Laws. The Company and its subsidiaries are, and at all prior times werehave been, in material compliance with all applicable state laws and federal regulations relating to data privacy and security laws and regulationsSensitive Data (defined below) that have been in effect and that have been announced as of the date hereof as becoming effective within 12 months after the date hereof, including without limitation the Health Insurance Portability and Accountability California Consumer Privacy Act of 1996 (“CCPA”), HIPAA, HITECH Act, the European Union General Data Protection Regulation (“GDPR”) (EU 2016/679), and the GDPR as amended by it forms part of the Health Information Technology for Economic and Clinical Health Act (law of the “HITECH Act”) United Kingdom (collectively, the “Privacy Laws”). To ensure compliance with the Privacy Laws, the The Company and its subsidiaries have in place, comply with, and take appropriate steps reasonably designed to ensure compliance in all material respects with their policies and procedures relating to data privacy and security and the collection, storage, use, disclosure, handling, and analysis of Personal Sensitive Data (the “Policies”). At all times since inception, the Company and its subsidiaries have provided all required notices of its Policies and obtained all necessary consents from individuals. None of the disclosures made or contained in any of the Policies have been inaccurate, misleading, deceptive, incomplete, or in violation of any Privacy Laws or Policies. “Personal Data” means (i) a natural person’s name, street address, telephone number, e-mail address, photograph, social security number or tax identification number, driver’s license number, passport number, credit card number, bank information, or customer or account number; (ii) any information which would qualify as “personally identifying information” under the Federal Trade Commission Act, as amended; (iii) Protected Health Information as defined by HIPAA; and (iv) any other information that constitutes “personal data”, “personal information”, “personally identifiable information”, “nonpublic personal information”, “customer proprietary network information”, “individually identifiable health information”, “protected health information”, or similar information under Privacy Laws, and (v) any other piece of information that allows the identification of such a natural person, or his or her family, device, or permits the collection or analysis of any data related to an identified person’s health or sexual orientation. “Sensitive Data” means all confidential, proprietary, or otherwise sensitive information (including Personal Data). The Company execution, delivery and its subsidiaries have at all times made all disclosures performance of this Agreement or any other agreement referred to users or customers required by applicable laws and regulatory rules or requirements, and no disclosure made pursuant to any Policy has, to the knowledge in this Agreement will not result in a breach of the Company, been inaccurate or in violation of any applicable laws and regulatory rules Privacy Laws or requirements in any material respectPolicies. The Neither the Company further certifies that neither it nor any subsidiary: (i) has received notice of any actual or potential material liability under or relating to, or actual or potential material violation of, any of the Privacy Laws, and has no knowledge of any event fact, event, or condition that would reasonably be expected to result in any such notice; (ii) is currently participating in, subject to, conducting or paying for, in whole or in part, any investigation, remediation remediation, or other corrective action pursuant to any Privacy Law; or (iii) is a party to any order, decree, or agreement that imposes any obligation or liability under any Privacy Law.

Data Privacy and Security Laws. The Company and its subsidiaries are, and at all times prior times werehereto have been, in compliance in all material compliance respects with all applicable state state, federal, and federal international data privacy privacy, security and security consumer protection laws and regulations, including including, without limitation limitation, applicable requirements of the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”) 1996, as amended by the Health Information Technology for Economic and Clinical Health Act (collectively, “HIPAA”); and the Company and its subsidiaries have taken commercially reasonable actions to comply with, and have been and currently are in compliance in all material respects with, the European Union General Data Protection Regulation (“HITECH ActGDPR”) (EU 2016/679) (collectively, the “Privacy Laws”). To ensure facilitate compliance with the Privacy Laws, the Company and its subsidiaries have in place, comply with, place and take appropriate commercially reasonable steps reasonably designed to ensure compliance comply in all material respects with their policies and procedures relating to data privacy and security and the collection, storage, use, disclosure, handling, and analysis of Personal Data (the “Policies”). “Personal Data” means (iA) a natural person’s name, street address, telephone number, e-mail address, photograph, social security number or tax identification number, driver’s license number, passport number, credit card number, bank information, or customer or account number; (iiB) any information which would qualify as “personally identifying informationidentifiable” under information as applied by the Federal Trade Commission Act, as amendedCommission; (iiiC) “Protected Health Information Information,” as defined by HIPAA; (D) “personal data,” as defined by GDPR; and (ivE) any other piece of information that allows the identification of such natural person, or his or her family, or permits the collection or analysis of any data related to an identified person’s health or sexual orientation. The Company and its subsidiaries have have, at all times prior hereto, made all material disclosures to users or customers required by applicable laws and regulatory rules or requirementsPrivacy Laws, and no disclosure none of such disclosures made pursuant to or contained in any Policy hassuch disclosures have, to the knowledge of the Company, been inaccurate or in violation of any applicable laws and regulatory rules or requirements Privacy Laws in any material respect. The Neither the Company further certifies that neither it nor any subsidiary: (i1) has received notice of any actual or potential material liability liability, including, but not limited to security or data privacy breaches or other unauthorized or improper access to, use of, or destruction of Personal Data, under or relating to, or actual or potential material violation of, any of the Privacy Laws, and has no knowledge of any event or condition that would reasonably be expected to result in any such notice; (ii2) is currently conducting or paying for, in whole or in part, any investigation, remediation remediation, or other corrective action pursuant to any Privacy Law; or (iii3) is a party to any order, decree, or agreement that imposes any obligation or liability under any Privacy Law.

Data Privacy and Security Laws. The Company and its subsidiaries are, and at all prior times were, in material compliance with all applicable state and federal data privacy and security laws and regulations, including without limitation the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”) as amended by the Health Information Technology for Economic and Clinical Health Act (the “HITECH Act”); and the Company and its subsidiaries have taken commercially reasonable actions to prepare to comply with, and since May 25, 2018, have been and currently are in compliance with, the European Union General Data Protection Regulation (“GDPR”) (EU 2016/679) (collectively, the “Privacy Laws”). To ensure compliance with the Privacy Laws, the Company and its subsidiaries have in place, comply with, and take appropriate steps reasonably designed to ensure compliance in all material respects with their policies and procedures relating to data privacy and security and the collection, storage, use, disclosure, handling, and analysis of Personal Data (the “Policies”). “Personal Data” means (i) a natural person’s name, street address, telephone number, e-mail address, photograph, social security number or tax identification number, driver’s license number, passport number, credit card number, bank information, or customer or account number; (ii) any information which would qualify as “personally identifying information” under the Federal Trade Commission Act, as amended; (iii) Protected Health Information as defined by HIPAA; (iv) “personal data” as defined by GDPR; and (ivv) any other piece of information that allows the identification of such natural person, or his or her family, or permits the collection or analysis of any data related to an identified person’s health or sexual orientation. The Company and its subsidiaries have at all times made all disclosures to users or customers required by applicable laws and regulatory rules or requirements, and no disclosure none of such disclosures made pursuant to or contained in any Policy hashave, to the knowledge of the Company, been inaccurate or in violation of any applicable laws and regulatory rules or requirements in any material respect. The Company further certifies that neither it nor any subsidiary: (i) has received notice of any actual or potential material liability under or relating to, or actual or potential material violation of, any of the Privacy Laws, and has no knowledge of any event or condition that would reasonably be expected to result in any such notice; (ii) is currently conducting or paying for, in whole or in part, any investigation, remediation remediation, or other corrective action pursuant to any Privacy Law; or (iii) is a party to any order, decree, or agreement that imposes any obligation or liability under any Privacy Law.

Data Privacy and Security Laws. The Company and its subsidiaries are, and at comply in all prior times were, in material compliance respects with all applicable state and federal data privacy and security laws and regulations, including without limitation the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”) as amended by the Health Information Technology for Economic and Clinical Health Act (the “HITECH Act”) (42 U.S.C. Section 17921 et seq.), European Union’s General Data Protection Regulation 2016/679 (“EU GDPR”), the EU GDPR as it forms part of United Kingdom (“UK”) law by virtue of section 3 of the European Union (Withdrawal) Act 2018 (“UK GDPR”), and the California Consumer Protection Act of 2018, as amended by the California Privacy Rights Act of 2020, (“CPRA”) (collectively, “CCPA”); and all applicable laws and regulations with respect to Personal Data and that have been announced as of the date hereof as becoming effective within 12 months after the date hereof, and for which any non-compliance with same would be reasonably likely to create a material liability (collectively, the “Privacy Laws”). To ensure compliance with the Privacy Laws, the The Company and its subsidiaries have in place, comply with, and take appropriate steps reasonably designed to ensure compliance comply in all material respects with their policies and procedures relating to data privacy and security and the collection, storage, use, disclosure, handling, and analysis of Personal Data (the “Policies”). As used in this Agreement, “Personal Data” means (i) a natural person’s name, street address, telephone number, e-mail email address, photograph, social security number or tax identification number, driver’s license number, passport number, credit card number, bank information, or customer or account number; (ii) any information which would qualify as “personal information,” “personally identifying information,” or similar term as defined under the Federal Trade Commission Act, as amendedAct or Privacy Laws; (iii) Protected Health Information as defined by HIPAA; and (iv) any other piece of information that allows the identification of such natural person, or his or her family, or permits the collection or analysis of any data related to an identified person’s health or sexual orientation. The Company and its subsidiaries have at all times made all disclosures to users or customers required by applicable laws and regulatory rules or requirements, and no disclosure none of such disclosures made pursuant to or contained in any Policy hashave, to the knowledge of the Company, been inaccurate or in violation of any applicable laws and regulatory rules or requirements in any material respect. The Company further certifies that neither it nor any subsidiary: (i) has received notice of any actual or potential material liability under or relating to, or actual or potential material violation of, any of the Privacy LawsLaw, and has no knowledge of any event or condition that would reasonably be expected to result in any such notice; (ii) is currently conducting or paying for, in whole or in part, any investigation, remediation remediation, or other corrective action pursuant to any Privacy Law; or (iii) is a party to any order, decree, or agreement that imposes any obligation or liability under any Privacy Law.

Data Privacy and Security Laws. The Except as would not, individually or in the aggregate, reasonably be expected to have a Material Adverse Effect, the Company and its subsidiaries are, and at all prior times werefor the past four (4) years have been, in material compliance with all applicable state and federal data privacy and security laws and regulations, including without limitation to the Health Insurance Portability extent applicable, the California Consumer Privacy Act, HIPAA, HITECH Act, and Accountability Act of 1996 the European Union General Data Protection Regulation (“HIPAAGDPR”) as amended by (EU 2016/679) (and all other applicable laws and regulations governing the Health Information Technology for Economic data privacy and Clinical Health Act security of Personal Data (the “HITECH Act”defined below) (collectively, the “Privacy Laws”)). To ensure compliance with the Privacy Laws, the Company and its subsidiaries have in place, comply with, and take appropriate commercially reasonable steps reasonably designed to ensure compliance in all material respects with their policies and procedures relating to data privacy and security and the collection, storage, use, disclosure, handling, and analysis of Personal Data (the “Policies”). Each of the Company Policies has been designed to provide accurate and sufficient notice of the Company’s then-current privacy practices relating to its subject matter. “Personal Data” means (i) a natural person’s name, street address, telephone number, e-mail address, photograph, social security number or tax identification number, driver’s license number, passport number, credit card number, bank information, or customer or account number; (ii) any information which would qualify as “personally identifying information” under the Federal Trade Commission Act, as amended; (iii) Protected Health Information as defined by HIPAA; and (iv) “personal data” as defined by GDPR, and (v) any other piece of information that allows the identification of such natural person, or his or her family, or permits the collection or analysis of any data related to an identified person’s health or sexual orientation. The Except as would not, individually or in the aggregate, reasonably be expected to have a Material Adverse Effect, (i) for the past four (4) years, the Company and its subsidiaries have at all times made all disclosures to users or customers required by applicable laws and regulatory rules or requirementsPrivacy Laws, and no disclosure made pursuant to any Policy has, (ii) to the knowledge of the Company, none of such disclosures have been inaccurate inaccurate, misleading, deceptive or in violation of any applicable laws Privacy Laws; and regulatory rules (iii) the execution, delivery and performance of this Agreement or requirements any other agreement referred to in this Agreement will not result in a breach of violation of any material respectPrivacy Laws or Policies. The During the past four (4) years, neither the Company further certifies that neither it nor any subsidiary: (i) has received written notice of any actual or potential material liability under or relating to, or actual or potential material violation of, of any of the Privacy Laws, and has no knowledge of any event or condition that would reasonably be expected to result in any such notice; (ii) is currently conducting or paying for, in whole or in part, any investigation, remediation remediation, or other corrective action pursuant to any Privacy Law; or (iii) is a party to any order, decree, or agreement that imposes any obligation or liability under any Privacy Law.

Data Privacy and Security Laws. The To the knowledge of the Company, the Company and its subsidiaries are, and at all times prior times werehereto have been, in compliance in all material compliance respects with all applicable state state, federal, and federal international data privacy privacy, security and security consumer protection laws and regulations, including including, without limitation limitation, applicable requirements of the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”) 1996, as amended by the Health Information Technology for Economic and Clinical Health Act (collectively, “HIPAA”); and the Company and its subsidiaries have taken commercially reasonable actions to comply with, and have been and currently are in compliance in all material respects with, the European Union General Data Protection Regulation (“HITECH ActGDPR”) (EU 2016/679) (collectively, the “Privacy Laws”). To ensure compliance with the extent required by the Privacy Laws, the Company and its subsidiaries have in place, comply with, place and take appropriate commercially reasonable steps reasonably designed to ensure compliance comply in all material respects with their policies and procedures relating to data privacy and security and the collection, storage, use, disclosure, handling, and analysis of Personal Data (the “Policies”)Data. “Personal Data” means (iA) a natural person’s name, street address, telephone number, e-mail address, photograph, social security number or tax identification number, driver’s license number, passport number, credit card number, bank information, or customer or account number; (iiB) any information which would qualify as “personally identifying informationidentifiable” under information as applied by the Federal Trade Commission Act, as amendedCommission; (iiiC) “Protected Health Information Information,” as defined by HIPAA; (D) “personal data,” as defined by GDPR; and (ivE) any other piece of information that allows the identification of such natural person, or his or her family, or permits the collection or analysis of any data related to an identified person’s health or sexual orientation. The Company and its subsidiaries have have, at all times prior hereto, made all material disclosures to users or customers required by applicable laws and regulatory rules or requirementsPrivacy Laws, and no disclosure none of such disclosures made pursuant to or contained in any Policy hassuch disclosures have, to the knowledge of the Company, been inaccurate or in violation of any applicable laws and regulatory rules or requirements Privacy Laws in any material respect. The Neither the Company further certifies that neither it nor any subsidiary: (i1) has received written notice of any actual or potential material liability alleged liability, including, but not limited to security or data privacy breaches or other unauthorized or improper access to, use of, or destruction of Personal Data, under or relating to, or actual or potential material violation of, any of to the Privacy Laws, and has no knowledge of any event or condition that would reasonably be expected to result in any such notice; (ii2) is currently conducting or paying for, in whole or in part, any investigation, remediation remediation, or other corrective action pursuant to any Privacy Law; or (iii3) is a party to any order, decree, or agreement that imposes any obligation or liability under any Privacy Law.

Data Privacy and Security Laws. The Company and its subsidiaries are, and at all times prior times werehereto have been, in compliance in all material compliance respects with all applicable state state, federal, and federal international data privacy privacy, security and security consumer protection laws and regulations, including including, without limitation limitation, applicable requirements of the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”) 1996, as amended by the Health Information Technology for Economic and Clinical Health Act (collectively, “HIPAA”); and the Company and its subsidiaries have taken commercially reasonable actions to comply with, and have been and currently are in compliance in all material respects with, the European Union General Data Protection Regulation (“HITECH ActGDPR”) (EU 2016/679) (collectively, the “Privacy Laws”). To ensure facilitate compliance with the Privacy Laws, the Company and its subsidiaries have in place, comply with, place and take appropriate commercially reasonable steps reasonably designed to ensure compliance comply in all material respects with their policies and procedures relating to data privacy and security and the collection, storage, use, disclosure, handling, and analysis of Personal Data (the “PoliciesData”)”. “Personal Data” means (iA) a natural person’s name, street address, telephone number, e-mail address, photograph, social security number or tax identification number, driver’s license number, passport number, credit card number, bank information, or customer or account number; (iiB) any information which would qualify as “personally identifying informationidentifiable” under information as applied by the Federal Trade Commission Act, as amendedCommission; (iiiC) “Protected Health Information Information,” as defined by HIPAA; (D) “personal data,” as defined by GDPR; and (ivE) any other piece of information that allows the identification of such natural person, or his or her family, or permits the collection or analysis of any data related to an identified person’s health or sexual orientation. The Company and its subsidiaries have have, at all times prior hereto, made all material disclosures to users or customers required by applicable laws and regulatory rules or requirementsPrivacy Laws, and no disclosure none of such disclosures made pursuant to or contained in any Policy hassuch disclosures have, to the knowledge of the Company, been inaccurate or in violation of any applicable laws and regulatory rules or requirements Privacy Laws in any material respect. The Neither the Company further certifies that neither it nor any subsidiary: (i1) has received written notice of any actual liability, including, but not limited to security or potential material liability data privacy breaches or other unauthorized access to, use of, or destruction of Personal Data, under or relating to, or actual or potential material violation of, any of the Privacy Laws, and has no knowledge of any event or condition that would reasonably be expected to result in any such notice; (ii2) is currently conducting or paying for, in whole or in part, any investigation, remediation remediation, or other corrective action pursuant to any Privacy Law; or (iii3) is a party to any order, decree, or agreement that imposes any obligation or liability under any Privacy Law.

Data Privacy and Security Laws. The Except as could not reasonably be expected to have a Material Adverse Effect or as disclosed in the Registration Statement, the Pricing Disclosure Package and the Prospectus, the Company and its subsidiaries Evolent Health are, and at all prior times weresince the Company’s and Evolent Health’s inception have been, in material compliance with all applicable state and federal data privacy and security laws and regulations, including without limitation the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”) as amended by the Health Information Technology for Economic and Clinical Health Act (the “HITECH Act”) (, and collectively, the “Privacy Laws”). To ensure compliance with the Privacy Laws, the Company and its subsidiaries Evolent Health have in place, comply with, and take appropriate steps reasonably designed to ensure compliance in all material respects with their policies and procedures relating to data privacy and security and the collection, storage, use, disclosure, handling, and analysis of Personal Data (the “Policies”). “Personal Data” means (i) a natural person’s name, street address, telephone number, e-mail address, photograph, social security number or tax identification number, driver’s license number, passport number, credit card number, bank information, or customer or account number; (ii) any information which would qualify as “personally identifying information” under the Federal Trade Commission Act, as amended; (iii) Protected Health Information as defined by HIPAA; and (iv) any other piece of information that allows the identification of such natural person, or his or her family, or permits the collection or analysis of any data related to an identified person’s health or sexual orientation. The Company and its Evolent Health and their respective subsidiaries have at all times made all disclosures to users or customers required by applicable laws and regulatory rules or requirements, and no disclosure such disclosures made pursuant to or contained in any Policy has, to the knowledge of the Company, have been inaccurate or in violation of any applicable laws and regulatory rules or requirements requirements, except as could not reasonably be expected to result in any material respecta Material Adverse Effect. The Neither the Company further certifies that neither it nor any subsidiaryEvolent Health: (i) has received notice of any actual or potential material liability under or relating to, or actual or potential material violation of, any of the Privacy Laws, and has no knowledge of any event or condition that would reasonably be expected to result in any such notice; (ii) is currently conducting or paying for, in whole or in part, any investigation, remediation remediation, or other corrective action pursuant to any Privacy Law; or (iii) is a party to any order, decree, or agreement that imposes any obligation or liability under any Privacy Law.

Data Privacy and Security Laws. The Company and its subsidiaries are, and at all times prior times werehereto have been, in compliance in all material compliance respects with all applicable state state, federal, and federal international data privacy privacy, security and security consumer protection laws and regulations, including including, without limitation limitation, applicable requirements of the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”) 1996, as amended by the Health Information Technology for Economic and Clinical Health Act (collectively, “HIPAA”); and the Company and its subsidiaries have taken commercially reasonable actions to comply with, and have been and currently are in compliance in all material respects with, the European Union General Data Protection Regulation (“HITECH ActGDPR”) (EU 2016/679) (collectively, the “Privacy Laws”). To ensure facilitate compliance with the Privacy Laws, the Company and its subsidiaries have in place, comply with, place and take appropriate commercially reasonable steps reasonably designed to ensure compliance comply in all material respects with their policies and procedures relating to data privacy and security and the collection, storage, use, disclosure, handling, and analysis of Personal Data (the “Policies”). “Personal Data” means (i) a natural person’s name, street address, telephone number, e-mail address, photograph, social security number or tax identification number, driver’s license number, passport number, credit card number, bank information, or customer or account number; (ii) any information which would qualify as “personally identifying informationidentifiable” under information as applied by the Federal Trade Commission Act, as amendedCommission; (iii) “Protected Health Information Information,” as defined by HIPAA; and (iv) “personal data,” as defined by GDPR; and (v) any other piece of information that allows the identification of such natural person, or his or her family, or permits the collection or analysis of any data related to an identified person’s health or sexual orientation. The Company and its subsidiaries have have, at all times prior hereto, made all material disclosures to users or customers required by applicable laws and regulatory rules or requirementsPrivacy Laws, and no disclosure none of such disclosures made pursuant to or contained in any Policy hassuch disclosures have, to the knowledge of the Company, been inaccurate or in violation of any applicable laws and regulatory rules or requirements Privacy Laws in any material respect. The Neither the Company further certifies that neither it nor any subsidiary: (iA) has received notice of any actual or potential material liability liability, including, but not limited to security or data privacy breaches or other unauthorized or improper access to, use of, or destruction of Personal Data, under or relating to, or actual or potential material violation of, any of the Privacy Laws, and has no knowledge of any event or condition that would reasonably be expected to result in any such notice; (iiB) is currently conducting or paying for, in whole or in part, any investigation, remediation remediation, or other corrective action pursuant to any Privacy Law; or (iiiC) is a party to any order, decree, or agreement that imposes any obligation or liability under any Privacy Law.

Data Privacy and Security Laws. The Company and its subsidiaries are, and at all prior times were, in compliance in all material compliance respects with all applicable state state, federal, and federal international data privacy and data security laws and regulations, including without limitation HIPAA and the Health Insurance Portability HITECH Act, and Accountability the European Union General Data Protection Regulation (“GDPR”) (EU 2016/679); and the Company and its subsidiaries are currently or have taken commercially reasonable actions to prepare to comply with the California Consumer Protection Act of 1996 2018 (“HIPAA”) as amended by the Health Information Technology for Economic and Clinical Health Act (the “HITECH ActCCPA”) (collectively, the “Privacy Laws”). To ensure address compliance with the Privacy Laws, the Company and its subsidiaries have in place, comply with, and take appropriate commercially reasonable steps reasonably designed to ensure achieve compliance in all material respects with their policies and procedures relating to data privacy and security and the collection, storage, use, disclosure, handling, and analysis transfer of Personal Data (the “Policies”). “Personal Data” means (i) a natural person’s name, street address, telephone number, e-mail address, photograph, social security number or tax identification number, driver’s license number, passport number, credit card number, bank information, or customer or account number; (ii) any information which would qualify as “personally identifying information” under the Federal Trade Commission Act, as amended; (iii) Protected Health Information as defined by the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”); (iv) “personal data” as defined by GDPR; and (ivv) any other piece of information that allows the identification of identifies such natural person. At all times, or his or her family, or permits the collection or analysis of any data related to an identified person’s health or sexual orientation. The Company and its subsidiaries have at all times made all disclosures to users or customers required by applicable laws Privacy Laws and regulatory rules or requirements, and no disclosure none of such disclosures made pursuant to or contained in any Policy hashave, to the knowledge of the Company, been inaccurate or in violation of any applicable laws and regulatory rules or requirements in any material respect. The Company further certifies that (a) neither it nor any subsidiarysubsidiary at any time: (i) has received receive written notice of any actual or potential material liability liability, including, but not limited to security or data privacy breaches or other unauthorized or improper access to, use of, or destruction of its Personal Data owned or controlled by the Company or its subsidiaries, under or relating to, or actual or potential material violation of, any of the Privacy Laws, and has no knowledge of any event or condition that would reasonably be expected to result in any such notice; (ii) other than pursuant to its ongoing compliance efforts in the ordinary course of business, is currently conducting conducting, subject to, or paying forpaying, in whole or in part, any material investigation, remediation remediation, or other corrective action pursuant to resulting from the Company’s or its subsidiaries’ non-compliance with any Privacy Law; or (iii) is a party to any order, decree, settlement agreement, or agreement judgment from a governmental entity that imposes any obligation or liability under any Privacy Law; and (b) it is not aware of any specific events rendering any of the foregoing reasonably likely to occur.

Data Privacy and Security Laws. The Company and its subsidiaries areis, and at all prior times werehas been, in material compliance with all applicable state state, federal, and federal international data privacy privacy, security and security consumer protection laws and regulations, including without limitation the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”) HIPAA as amended by the Health Information Technology for Economic and Clinical Health Act (the “HITECH Act”); the Company has taken commercially reasonable actions to prepare to comply with, and since May 25, 2018, has been and currently is in compliance with, the European Union General Data Protection Regulation (“GDPR”) (EU 2016/679); and the Company has taken or will take commercially reasonable actions to prepare to comply with the California Consumer Privacy Act of 2018 (“CCPA”) (collectively, the “Privacy Laws”). To ensure compliance with the Privacy Laws, the Company and its subsidiaries have has in place, comply complies with, and take takes appropriate steps reasonably designed to ensure compliance in all material respects with their its policies and procedures relating to data privacy and security and the collection, storage, use, disclosure, handling, and analysis of Personal Data (the “Policies”). “Personal Data” means (i) a natural person’s name, street address, telephone number, e-mail address, photograph, social security number or tax identification number, driver’s license number, passport number, credit card number, bank information, or customer or account number; (ii) any information which would qualify as “personally identifying information” under the Federal Trade Commission Act, as amended; (iii) Protected Health Information as defined by HIPAA; (iv) “personal data” as defined by GDPR; and (ivv) any other piece of information that allows the identification of such natural person, or his or her family, or permits the collection or analysis of any data related to an identified person’s health or sexual orientation. The Company and its subsidiaries have has at all times made all disclosures to users or customers materially required by applicable laws and regulatory rules or requirements, and no disclosure none of such disclosures made pursuant to or contained in any Policy hashave, to the knowledge of the Company, been inaccurate or in violation of any applicable laws and regulatory rules or requirements in any material respect. The Company further certifies that neither it nor any subsidiaryit: (i) has not received written notice of any actual or potential material liability liability, including, but not limited to security or data privacy breaches or other unauthorized or improper access to, use of, or destruction of its IT Systems and Data or Personal Data, under or relating to, or actual or potential material violation of, any of the Privacy Laws, and has no knowledge of any event or condition that would reasonably be expected to result in any such notice; (ii) is not currently conducting or paying for, in whole or in part, any investigation, remediation remediation, or other corrective action pursuant to any Privacy Law; or and (iii) is not a party to any order, decree, or agreement that imposes any obligation or liability under any Privacy Law.

Data Privacy and Security Laws. The Company and its subsidiaries are, and at all prior times during the past three (3) years were, in material compliance with all applicable state and federal data privacy and security laws and regulations, including without limitation the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”) as amended by the Health Information Technology for Economic and Clinical Health Act (the “HITECH Act”) regulations (collectively, the “Privacy Laws”)) except where the noncompliance would not, individually or in the aggregate, have a Material Adverse Effect. To ensure compliance with the Privacy Laws, the Company and its subsidiaries have in place, comply in material respects with, and take appropriate steps reasonably designed to ensure compliance in all material respects with their policies and procedures relating to data privacy and security and the collection, storage, use, disclosure, handling, and analysis of Personal Data (the “Policies”). “Personal Data” means (i) a natural person’s name, street address, telephone number, e-mail address, photograph, social security number or tax identification number, driver’s license number, passport number, credit card number, bank information, or customer or account number; (ii) any information which would qualify as “personally identifying information” for protection under the Federal Trade Commission Act, as amended; (iii) Protected Health Information as defined by HIPAAapplicable Privacy Laws; and (iviii) any other piece of information that allows the identification of such natural person, or his or her family, or permits the collection or analysis of any data related to an identified person’s health or sexual orientation. The Company and its subsidiaries have at all times made all disclosures to users or customers required by applicable laws and regulatory rules or requirements, and no disclosure none of such disclosures made pursuant to or contained in any Policy hashave, to the knowledge of the Company, been inaccurate or in violation of any applicable laws and regulatory rules or requirements in any material respect. The Neither the Company further certifies that neither it nor any subsidiary: (i) has received written notice of any actual or potential material liability under or relating to, or actual or potential material violation of, any of the Privacy Laws, and has no knowledge of any event or condition that would reasonably be expected to result in any such notice; (ii) is currently conducting or paying for, in whole or in part, any investigation, remediation remediation, or other corrective action pursuant to any Privacy Law; or (iii) is a party to any order, decree, or agreement that imposes any obligation or liability under any Privacy Law.

Data Privacy and Security Laws. The Company and its subsidiaries are, and at all prior times were, in compliance in all material compliance respects with all applicable state state, federal and federal international data privacy privacy, security and security consumer protection laws and regulations, including without limitation the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”) as amended by the Health Information Technology for Economic and Clinical Health Act (the “HITECH Act”), and their implementing regulations; and the Company and its subsidiaries have taken commercially reasonable actions to prepare to comply with, and have been and currently are in compliance with, the European Union General Data Protection Regulation (“GDPR”) (EU 2016/679) (collectively, the “Privacy Laws”), except to the extent that any non-compliance would not, individually or in the aggregate, reasonably be expected to have a Material Adverse Effect. To ensure compliance with the Privacy Laws, the Company and its subsidiaries have in place, comply with, and take commercially appropriate steps reasonably designed to ensure compliance in all material respects with their policies and procedures relating to data privacy and security and the collection, storage, use, disclosure, handling, and analysis of Personal Data (the “Policies”). “Personal Data” means (i) a natural person’s name, street address, telephone number, e-mail address, photograph, social security number or tax identification number, driver’s license number, passport number, credit card number, bank information, or customer or account number; (ii) any information which would qualify as “personally identifying information” under the Federal Trade Commission Act, as amended; (iii) Protected Health Information as defined by HIPAA; (iv) “personal data” as defined by GDPR; and (ivv) any other piece of information that allows the identification of such natural person, or his or her family, or permits the collection or analysis of any data related to an identified person’s health or sexual orientation. The Company and its subsidiaries have at all times made all disclosures to users or customers required by applicable laws and regulatory rules or requirements, and no disclosure none of such disclosures made pursuant to or contained in any Policy hashave, to the knowledge of the Company, been inaccurate or in violation of any applicable laws and regulatory rules or requirements in any material respect. The Company further certifies that neither it nor any subsidiary: (i) has received written notice of any actual or potential material liability liability, including, but not limited to, security or data privacy breaches or other unauthorized or improper access to, use of or destruction of its Confidential Data or Personal Data, under or relating to, or actual or potential material violation of, any of the Privacy Laws, and has no knowledge of any event or condition that would reasonably be expected to result in any such notice; (ii) is currently conducting or paying for, in whole or in part, any investigation, remediation remediation, or other corrective action pursuant to any Privacy Law, other than in the ordinary course of business; or (iii) is a party to any order, decree, or agreement with any governmental entity that imposes any obligation or liability under any Privacy Law.

Data Privacy and Security Laws. The Company and its subsidiaries are, and at all prior times were, in material compliance with all applicable state and federal data privacy and security laws and regulations, including without limitation the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”) as amended by the Health Information Technology for Economic and Clinical Health Act (the “HITECH Act”) (collectively, the “Privacy Laws”). To ensure compliance with the Privacy Laws, the Company and its subsidiaries have in place, comply with, and take appropriate steps reasonably designed to ensure compliance in all material respects with their policies and procedures relating to data privacy and security and the collection, storage, use, disclosure, handling, and analysis of Personal Data (the “Policies”). “Personal Data” means (i) a natural person’s name, street address, telephone number, e-mail address, photograph, social security number or tax identification number, driver’s license number, passport number, credit card number, bank information, or customer or account number; (ii) any information which would qualify as “personally identifying information” under the Federal Trade Commission Act, as amended; (iii) “personal data” as defined by the European Union General Data Protection Regulation (“GDPR”) (EU 2016/679); (iv) Protected Health Information as defined by HIPAA; and (ivv) any other piece of information that allows the identification of such natural person, or his or her family, or permits the collection or analysis of any data related to an identified person’s health or sexual orientation. The Company and its subsidiaries have at all times made all disclosures to users or customers required by applicable laws and regulatory rules or requirements, and no disclosure none of such disclosures made pursuant to or contained in any Policy hashave, to the knowledge of the Company, been inaccurate or in violation of any applicable laws and regulatory rules or requirements in any material respect. The Company further certifies that neither it nor any subsidiary: (i) has received notice of any actual or potential material liability under or relating to, or actual or potential material violation of, any of the Privacy Laws, and has no knowledge of any event or condition that would reasonably be expected to result in any such notice; (ii) is currently conducting or paying for, in whole or in part, any investigation, remediation remediation, or other corrective action pursuant to any Privacy Law; or (iii) is a party to any order, decree, or agreement that imposes any obligation or liability under any Privacy Law.

Data Privacy and Security Laws. The Company and its subsidiaries areis, and at all prior times weresince its inception has been, in material compliance with all applicable state and federal data privacy and security laws and regulations, including without limitation the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”) as amended by the Health Information Technology for Economic and Clinical Health Act (the “HITECH Act”) (collectively, the “Privacy Laws”). To ensure compliance with the Privacy Laws, the Company and its subsidiaries have has in place, comply with, and take appropriate steps reasonably designed to ensure compliance in all material respects with their its policies and procedures relating to data privacy and security and the collection, storage, use, disclosure, handling, and analysis of Personal Data (the “Policies”). “Personal Data” means (i) a natural person’s name, street address, telephone number, e-mail address, photograph, social security number or tax identification number, driver’s license number, passport number, credit card number, bank information, or customer or account number; (ii) any information which would qualify as “personally identifying information” under the Federal Trade Commission Act, as amended; (iii) Protected Health Information as defined by HIPAA; and (iv) any other piece of information that allows the identification of such natural person, or his or her familyfamily or household, or permits the collection or analysis of any data related to an identified person’s health or sexual orientation. The Company and its subsidiaries have has at all times made all disclosures to users or customers required by applicable laws and regulatory rules or requirements, and no disclosure none of such disclosures made pursuant to or contained in any Policy hashave, to the knowledge of the Company, been inaccurate or in violation of any applicable laws and regulatory rules or requirements in any material respect. The Company further certifies that neither it nor any subsidiarythat: (i) it has not received notice of any actual or potential material liability under or relating to, or actual or potential material violation of, any of the Privacy Laws, and has no knowledge of any event or condition that would reasonably be expected to result in any such notice; (ii) it is not currently conducting or paying for, in whole or in part, any investigation, remediation remediation, or other corrective action pursuant to any Privacy Law; or and (iii) is not a party to any order, decree, or agreement that imposes any obligation or liability under any Privacy Law.

Data Privacy and Security Laws. The Company and its subsidiaries Subsidiary are, and at all prior times were, in compliance in all material compliance respects with all applicable state state, federal, and federal international data privacy and data security laws and regulations, including without limitation HIPAA and the Health Insurance Portability HITECH Act, and Accountability the European Union General Data Protection Regulation (“GDPR”) (EU 2016/679), and the Company and its Subsidiary are currently or have taken commercially reasonable actions to comply with the California Consumer Protection Act of 1996 (“HIPAA”) as amended by the Health Information Technology for Economic and Clinical Health Act (the “HITECH Act”) 2018 (collectively, the “Privacy Laws”). To ensure address compliance with the Privacy Laws, the Company and its subsidiaries Subsidiary have in place, comply with, and take appropriate commercially reasonable steps reasonably designed to ensure achieve compliance in all material respects with their policies and procedures relating to data privacy and security and the collection, storage, use, disclosure, handling, and analysis transfer of Personal Data (the “Policies”)Data. “Personal Data” means (i) a natural person’s name, street address, telephone number, e-mail address, photograph, social security number or tax identification number, driver’s license number, passport number, credit card number, bank information, or customer or account number; (ii) any information which would qualify as “personally identifying information” under the Federal Trade Commission Act, as amended; (iii) Protected Health Information as defined by the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”); (iv) “personal data” as defined by GDPR; and (ivv) any other piece of information that allows the identification of identifies such natural person. At all times, or his or her family, or permits the collection or analysis of any data related to an identified person’s health or sexual orientation. The Company and its subsidiaries Subsidiary have at all times made all disclosures to users or customers required by applicable laws Privacy Laws and regulatory rules or requirements, and no disclosure none of such disclosures made pursuant to or contained in any Policy hashave, to the knowledge of the Company, been inaccurate or in violation of any applicable laws and regulatory rules or requirements in any material respect. The Company further certifies that (a) neither it nor any subsidiarysubsidiary at any time: (i) has received written notice of any actual or potential material liability liability, including, but not limited to security or data privacy breaches or other unauthorized or improper access to, use of, or destruction of its Personal Data owned or controlled by the Company or its Subsidiary, under or relating to, or actual or potential material violation of, any of the Privacy Laws, and has no knowledge of any event or condition that would reasonably be expected to result in any such notice; (ii) other than pursuant to its ongoing compliance efforts in the ordinary course of business, is currently conducting conducting, subject to, or paying forpaying, in whole or in part, any material investigation, remediation remediation, or other corrective action pursuant to resulting from the Company’s or its Subsidiary’s non-compliance with any Privacy Law; or (iii) is a party to any order, decree, settlement agreement, or agreement judgment from a governmental entity that imposes any obligation or liability under any Privacy Law; and (b) it is not aware of any specific events rendering any of the foregoing reasonably likely to occur.

Data Privacy and Security Laws. The Company and its subsidiaries are, and at all prior times were, since their inception have been in material compliance with all applicable state and state, federal or foreign data privacy and security laws and regulations, including including, without limitation limitation, the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”) as amended by the Health Information Technology for Economic and Clinical Health Act (the “HITECH Act”), the California Consumer Privacy Act of 2018 (“CCPA”), and the European Union General Data Protection Regulation (“GDPR”) (EU 2016/679) (collectively, the “Privacy Laws”). To ensure compliance with the Privacy Laws, the Company and each of its subsidiaries have in place, comply with, and take appropriate steps reasonably designed to ensure compliance in all material respects with their internal and external policies and procedures relating to data privacy and security and the collection, storage, use, disclosure, handling, and analysis of Personal Data (the “Policies”). “Personal Data” means (i) a natural person’s name, street address, telephone number, e-mail address, photograph, social security number or tax identification number, driver’s license number, passport number, credit card number, bank information, or customer or account number; (ii) any information which would qualify as “personally identifying information” under the Federal Trade Commission Act, as amended; (iii) Protected Health Information as defined by HIPAA; (iv) “personal data” as defined by the GDPR; (v) “personal information” as defined by the CCPA; and (ivvi) any other piece of information that allows the identification of such natural person, or his or her familyfamily or household, or permits the collection or analysis of any data related to an identified person’s health or sexual orientation. The Company and its subsidiaries have at all times made all disclosures to users or customers individuals required by applicable laws and regulatory rules or requirements, and no disclosure none of such disclosures made pursuant to or contained in any Policy hashave, to the knowledge of the Company, been inaccurate inaccurate, misleading, deceptive or in violation of any applicable laws and regulatory rules or requirements in any material respect. The execution, delivery, and performance of this Agreement, will not result in a breach or violation of any Privacy Law or Policies. The Company further certifies that neither it nor any subsidiary: and its subsidiaries (i) has have not received notice of any actual or potential material liability under or relating to, or actual or potential material violation of, any of the Privacy Laws, and has no knowledge of any event or condition that would reasonably be expected to result in any such notice; (ii) is are not currently conducting or paying for, in whole or in part, any investigation, remediation remediation, or other corrective action pursuant to any Privacy Law; or and (iii) is are not a party to any order, decree, or agreement that imposes any obligation or liability under any Privacy Law.

Data Privacy and Security Laws. The Company and its subsidiaries are, and at all prior times weresince May 25, 2018 have been, in material compliance with all applicable state and federal data privacy and security laws and regulations, including without limitation the Health Insurance Portability California Consumer Privacy Act, HIPAA, HITECH Act, and Accountability Act of 1996 the European Union General Data Protection Regulation (“HIPAAGDPR”) (EU 2016/679) (and all other applicable laws and regulations with respect to Personal Data (defined below) that have been announced as amended by of the Health Information Technology date hereof as becoming effective within 12 months after the date hereof, and for Economic and Clinical Health Act (the “HITECH Act”which any non-compliance with same would be reasonably likely to create a material liability) (collectively, the “Privacy Laws”). To ensure compliance with the Privacy Laws, the Company and its subsidiaries have in place, comply with, and take appropriate steps reasonably designed to ensure compliance in all material respects with their policies and procedures relating to data privacy and security and the collection, storage, use, disclosure, handling, and analysis of Personal Data (the “Policies”). The execution, delivery and performance of this Agreement or any other agreement referred to in this Agreement will not result in a breach of violation of any Privacy Laws or Policies. The Company further certifies that neither it nor any subsidiary: (i) has received notice of any actual or potential liability under or relating to, or actual or potential violation of, any of the Privacy Laws, and has no knowledge of any event or condition that would reasonably be expected to result in any such notice; (ii) is currently conducting or paying for, in whole or in part, any investigation, remediation, or other corrective action pursuant to any Privacy Law; or (iii) is a party to any order, decree, or agreement that imposes any obligation or liability under any Privacy Law. “Personal Data” means (i) a natural person’s name, street address, telephone number, e-mail address, photograph, social security number or tax identification number, driver’s license number, passport number, credit card number, bank information, or customer or account number; (ii) any information which would qualify as “personally identifying information” under the unfair and deceptive trade practice authority of the Federal Trade Commission (“FTC”) pursuant to the FTC Act, as amended; (iii) Protected Health Information as defined by HIPAA; (iv) “personal data” as defined by GDPR, (v) “personal information” as defined by the California Consumer Privacy Act (“CCPA”) and (ivvi) any other piece of information that allows the identification of such natural person, or his or her family, or permits the collection or analysis of any data related to an identified person’s health or sexual orientation. The Company and its subsidiaries have at all times made all disclosures to users or customers required by applicable laws and regulatory rules or requirements, and no disclosure made pursuant to any Policy has, to the knowledge of the Company, been inaccurate or in violation of any applicable laws and regulatory rules or requirements in any material respect. The Company further certifies that neither it nor any subsidiary: (i) has received notice of any actual or potential material liability under or relating to, or actual or potential material violation of, any of the Privacy Laws, and has no knowledge of any event or condition that would reasonably be expected to result in any such notice; (ii) is currently conducting or paying for, in whole or in part, any investigation, remediation or other corrective action pursuant to any Privacy Law; or (iii) is a party to any order, decree, or agreement that imposes any obligation or liability under any Privacy Law.

Data Privacy and Security Laws. The Except as would not reasonably be expected to have a Material Adverse Effect, the Company and its subsidiaries subsidiary are, and at all prior times were, in material compliance with all applicable state and federal data privacy and security laws and regulationsall judgements, orders, rules and regulations of any court or arbitrator or governmental or regulatory authority, policies, applicable industry standards such as the Payment Card industry Data Security Standards, and contractual obligations relating (i) to the privacy and security of IT Assets and Data, including without limitation the Health Insurance Portability collection, storage, transfer, processing and/or use of Data, and Accountability Act (ii) to the protection of 1996 (“HIPAA”) as amended by the Health Information Technology for Economic such IT Assets and Clinical Health Act (the “HITECH Act”) Data from unauthorized use, access, misappropriation or modification (collectively, the “Privacy LawsData Protection Requirements”). To ensure compliance with the Privacy LawsData Protection Requirements, the Company and its subsidiaries subsidiary have in place, comply with, and take appropriate steps reasonably designed to ensure compliance in all material respects with their policies and procedures relating to data privacy and security and the collection, storage, use, disclosure, handling, and analysis of Personal Data (the “Policies”). “Personal Data” means (i) a natural person’s name, street address, telephone number, e-mail address, photograph, social security number or tax identification number, driver’s license number, passport number, credit card number, bank information, or customer or account number; (ii) any information which would qualify as “personally identifying information” under the Federal Trade Commission Act, as amended; (iii) Protected Health Information as defined by HIPAA; and (iv) any other piece of information that allows the identification of such natural person, or his or her family, or permits the collection or analysis of any data related to an identified person’s health or sexual orientation. The Company and its subsidiaries subsidiary have at all times made all disclosures to users or customers required by applicable laws and regulatory rules or requirementsData Protection Requirements, and no disclosure none of such disclosures made pursuant to or contained in any Policy hashave, to the knowledge of the Company, been inaccurate or in violation of any applicable laws and regulatory rules or requirements in any material respect. The Company further certifies that neither it nor any its subsidiary: (iA) has received notice of any actual or potential material liability under or relating to, or actual or potential material violation of, any of the Privacy LawsData Protection Requirements, and has no knowledge of any unauthorized use or disclosure of Data or any event or condition that would reasonably be expected to result in any such notice; (iiB) is currently conducting or paying for, in whole or in part, any investigation, remediation remediation, or other corrective action pursuant to any Privacy LawData Protection Requirement; or (iiiC) is a party to any order, decree, or agreement that imposes any obligation or liability under any Privacy LawData Protection Requirement. The execution, delivery and performance of this Agreement or any other agreement referred to in this Agreement will not result in a material breach of any Data Protection Requirements.

Data Privacy and Security Laws. The Except as would not, individually or in the aggregate, reasonably be expected to have a Material Adverse Effect, the Company and its subsidiaries are, and at all prior times werefor the past four (4) years have been, in material compliance with all applicable state and federal data privacy and security laws and regulations, including without limitation to the Health Insurance Portability extent applicable, the California Consumer Privacy Act, HIPAA, HITECH Act, and Accountability Act of 1996 the European Union General Data Protection Regulation (“HIPAA”) as amended by the Health Information Technology for Economic and Clinical Health Act (the “HITECH ActGDPR”) (collectivelyEU 2016/679) (and all other applicable laws and regulations governing the data privacy and security of Personal Data (defined below)(collectively, the “Privacy Laws”). To ensure compliance with the Privacy Laws, the Company and its subsidiaries have in place, comply with, and take appropriate commercially reasonable steps reasonably designed to ensure compliance in all material respects with their policies and procedures relating to data privacy and security and the collection, storage, use, disclosure, handling, and analysis of Personal Data (the “Policies”). Each of the Company Policies has been designed to provide accurate and sufficient notice of the Company’s then-current privacy practices relating to its subject matter. “Personal Data” means (i) a natural person’s name, street address, telephone number, e-mail address, photograph, social security number or tax identification number, driver’s license number, passport number, credit card number, bank information, or customer or account number; (ii) any information which would qualify as “personally identifying information” under the Federal Trade Commission Act, as amended; (iii) Protected Health Information as defined by HIPAA; and (iv) “personal data” as defined by GDPR, and (v) any other piece of information that allows the identification of such natural person, or his or her family, or permits the collection or analysis of any data related to an identified person’s health or sexual orientation. The Except as would not, individually or in the aggregate, reasonably be expected to have a Material Adverse Effect, (i) for the past four (4) years, the Company and its subsidiaries have at all times made all disclosures to users or customers required by applicable laws and regulatory rules or requirementsPrivacy Laws, and no disclosure made pursuant to any Policy has, (ii) to the knowledge of the Company, none of such disclosures have been inaccurate inaccurate, misleading, deceptive or in violation of any applicable laws Privacy Laws; and regulatory rules (iii) the execution, delivery and performance of this Agreement or requirements any other agreement referred to in this Agreement will not result in a breach of violation of any material respectPrivacy Laws or Policies. The During the past four (4) years, neither the Company further certifies that neither it nor any subsidiary: (i) has received written notice of any actual or potential material liability under or relating to, or actual or potential material violation of, of any of the Privacy Laws, and has no knowledge of any event or condition that would reasonably be expected to result in any such notice; (ii) is currently conducting or paying for, in whole or in part, any investigation, remediation remediation, or other corrective action pursuant to any Privacy Law; or (iii) is a party to any order, decree, or agreement that imposes any obligation or liability under any Privacy Law.

Data Privacy and Security Laws. The Company and its subsidiaries are, and at all prior times werehave been, in material compliance with all applicable state and federal data privacy and security laws and regulations, including without limitation the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”) as amended by the Health Information Technology for Economic and Clinical Health Act (the “HITECH Act”) (collectively, the “Privacy Laws”)) , except to the extent that any non-compliance would not, individually or in the aggregate, reasonably be expected to have a Material Adverse Effect. To ensure compliance with the Privacy Laws, the Company and its subsidiaries have in place, comply with, and take commercially appropriate steps reasonably designed to ensure compliance in all material respects with their policies and procedures relating to data privacy and security and the collection, storage, use, disclosure, handling, and analysis of Personal Data (the “Policies”). “Personal Data” means (i) a natural person’s name, street address, telephone number, e-mail address, photograph, social security number or tax identification number, driver’s license number, passport number, credit card number, bank information, or customer or account number; (ii) any information which would qualify as “personally identifying information” under the Federal Trade Commission Act, as amended; (iii) Protected Health Information as defined by HIPAA; and (iv) any other piece of information that allows the identification of such natural person, or his or her family, or permits the collection or analysis of any data related to an identified person’s health or sexual orientation. The Company and its subsidiaries have at all times made all disclosures to users or customers as required by applicable laws and regulatory rules or requirements, and no disclosure none of such disclosures made pursuant to or contained in any Policy hashave, to the knowledge of the Company, been inaccurate or in violation of any applicable laws and regulatory rules or requirements in any material respect. The Company further certifies that neither it nor any subsidiary: (i) has received written notice of any actual or potential material liability under or relating to, or actual or potential material violation of, any of the Privacy Laws, and has no knowledge of any event or condition that would reasonably be expected to result in any such notice; (ii) is currently conducting or paying for, in whole or in part, any investigation, remediation remediation, or other corrective action pursuant to any Privacy Law, other than in the ordinary course; or (iii) is a party to any order, decree, or agreement with any Governmental Entity that imposes any obligation or liability under any Privacy Law.

Data Privacy and Security Laws. The Company and its subsidiaries are, and at all prior times were, in material compliance with all applicable state and federal data privacy and security laws and regulations, including without limitation the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”) as amended by the Health Information Technology for Economic and Clinical Health Act (the “HITECH Act”) (collectively, the “Privacy Laws”). To ensure compliance with the Privacy Laws, the Company and its subsidiaries have in place, comply with, and take appropriate steps reasonably designed to ensure compliance in all material respects with their policies and procedures relating to data privacy and security and the collection, storage, use, disclosure, handling, and analysis of Personal Data (the “Policies”). “Personal Data” means (i) a natural person’s name, street address, telephone number, e-mail address, photograph, social security number or tax identification number, driver’s license number, passport number, credit card number, bank information, or customer or account number; (ii) any information which would qualify as “personally identifying information” under the Federal Trade Commission Act, as amended; (iii) Protected Health Information as defined by HIPAA; and (iv) any other piece of information that allows the identification of such natural person, or his or her family, or permits the collection or analysis of any data related to an identified person’s health or sexual orientation. The Company and its subsidiaries have at all times made all disclosures to users or customers required by applicable laws and regulatory rules or requirements, and no disclosure none of such disclosures made pursuant to or contained in any Policy hashave, to the knowledge of the Company, been inaccurate or in violation of any applicable laws and regulatory rules or requirements in any material respect. The Company further certifies that neither it nor any subsidiary: (i) has received notice of any actual or potential material liability under or relating to, or actual or potential material violation of, any of the Privacy Laws, and has no knowledge of any event or condition that would reasonably be expected to result in any such notice; (ii) is currently conducting or paying for, in whole or in part, any investigation, remediation remediation, or other corrective action pursuant to any Privacy Law; or (iii) is a party to any order, decree, or agreement that imposes any obligation or liability under any Privacy Law.

Data Privacy and Security Laws. The Company and its subsidiaries areis, and at all prior times were, since its inception has been in material compliance with all applicable state and state, federal or foreign data privacy and security laws and regulations, including including, without limitation limitation, the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”) as amended by the Health Information Technology for Economic and Clinical Health Act (the “HITECH Act”), the California Consumer Privacy Act of 2018 (“CCPA”), and the European Union General Data Protection Regulation (“GDPR”) (EU 2016/679) (collectively, the “Privacy Laws”). To ensure compliance with the Privacy Laws, the Company and its subsidiaries have has in place, comply complies with, and take takes appropriate steps reasonably designed to ensure compliance in all material respects with their its internal and external policies and procedures relating to data privacy and security and the collection, storage, use, disclosure, handling, and analysis of Personal Data (the “Policies”). “Personal Data” means (i) a natural person’s name, street address, telephone number, e-mail address, photograph, social security number or tax identification number, driver’s license number, passport number, credit card number, bank information, or customer or account number; (ii) any information which would qualify as “personally identifying information” under the Federal Trade Commission Act, as amended; (iii) Protected Health Information as defined by HIPAA; (iv) “personal data” as defined by the GDPR; (v) “personal information” as defined by the CCPA; and (ivvi) any other piece of information that allows the identification of such natural person, or his or her familyfamily or household, or permits the collection or analysis of any data related to an identified person’s health or sexual orientation. The Company and its subsidiaries have has at all times made all disclosures to users or customers individuals required by applicable laws and regulatory rules or requirements, and no disclosure none of such disclosures made pursuant to or contained in any Policy hashave, to the knowledge of the Company, been inaccurate inaccurate, misleading, deceptive or in violation of any applicable laws and regulatory rules or requirements in any material respect. The execution, delivery, and performance of this Agreement, will not result in a breach or violation of any Privacy Law or Policies. The Company further certifies that neither it nor any subsidiary: (i) has not received notice of any actual or potential material liability under or relating to, or actual or potential material violation of, any of the Privacy Laws, and has no knowledge of any event or condition that would reasonably be expected to result in any such notice; (ii) is not currently conducting or paying for, in whole or in part, any investigation, remediation remediation, or other corrective action pursuant to any Privacy Law; or and (iii) is not a party to any order, decree, or agreement that imposes any obligation or liability under any Privacy Law.

Data Privacy and Security Laws. The Company and its subsidiaries are, and at all prior times during the past three (3) years preceding the end of the most recent fiscal year were, in material compliance with all applicable state and federal data privacy and security laws and regulations, including without limitation the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”) as amended by the Health Information Technology for Economic and Clinical Health Act (the “HITECH Act”) regulations (collectively, the “Privacy Laws”)) except where the noncompliance would not, individually or in the aggregate, have a Material Adverse Effect. To ensure compliance with the Privacy Laws, the Company and its subsidiaries have in place, comply in material respects with, and take appropriate steps reasonably designed to ensure compliance in all material respects with their policies and procedures relating to data privacy and security and the collection, storage, use, disclosure, handling, and analysis of Personal Data (the “Policies”). “Personal Data” means (i) a natural person’s name, street address, telephone number, e-mail address, photograph, social security number or tax identification number, driver’s license number, passport number, credit card number, bank information, or customer or account number; (ii) any information which would qualify as “personally identifying information” for protection under the Federal Trade Commission Act, as amended; (iii) Protected Health Information as defined by HIPAAapplicable Privacy Laws; and (iviii) any other piece of information that allows the identification of such natural person, or his or her family, or permits the collection or analysis of any data related to an identified person’s health or sexual orientation. The Company and its subsidiaries have at all times made all disclosures to users or customers required by applicable laws and regulatory rules or requirements, and no disclosure none of such disclosures made pursuant to or contained in any Policy hashave, to the knowledge of the Company, been inaccurate or in violation of any applicable laws and regulatory rules or requirements in any material respect. The Neither the Company further certifies that neither it nor any subsidiary: (i) has received written notice of any actual or potential material liability under or relating to, or actual or potential material violation of, any of the Privacy Laws, and has no knowledge of any event or condition that would reasonably be expected to result in any such notice; (ii) is currently conducting or paying for, in whole or in part, any investigation, remediation remediation, or other corrective action pursuant to any Privacy Law; or (iii) is a party to any order, decree, or agreement that imposes any obligation or liability under any Privacy Law.

Data Privacy and Security Laws. The Company and its subsidiaries Subsidiaries are, and at all times prior times werehereto have been, in compliance in all material compliance respects with all applicable state state, federal, and federal international data privacy privacy, security and security consumer protection laws and regulations, including including, without limitation limitation, applicable requirements of the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”) 1996, as amended by the Health Information Technology for Economic and Clinical Health Act (collectively, “HIPAA”); and the Company and its Subsidiaries have taken commercially reasonable actions to comply with, and have been and currently are in compliance in all material respects with, the European Union General Data Protection Regulation (“HITECH ActGDPR”) (EU 2016/679) (collectively, the “Privacy Laws”). To ensure facilitate compliance with the Privacy Laws, the Company and its subsidiaries Subsidiaries have in place, comply with, place and take appropriate commercially reasonable steps reasonably designed to ensure compliance comply in all material respects with their policies and procedures relating to data privacy and security and the collection, storage, use, disclosure, handling, and analysis of Personal Data (the “Policies”). “Personal Data” means (i) a natural person’s name, street address, telephone number, e-mail address, photograph, social security number or tax identification number, driver’s license number, passport number, credit card number, bank information, or customer or account number; (ii) any information which would qualify as “personally identifying informationidentifiable” under information as applied by the Federal Trade Commission Act, as amendedCommission; (iii) “Protected Health Information Information,” as defined by HIPAA; and (iv) “personal data,” as defined by GDPR; and (v) any other piece of information that allows the identification of such natural person, or his or her family, or permits the collection or analysis of any data related to an identified person’s health or sexual orientation. The Company and its subsidiaries have Subsidiaries have, at all times prior hereto, made all material disclosures to users or customers required by applicable laws and regulatory rules or requirementsPrivacy Laws, and no disclosure none of such disclosures made pursuant to or contained in any Policy hassuch disclosures have, to the knowledge of the Company, been inaccurate or in violation of any applicable laws and regulatory rules or requirements Privacy Laws in any material respect. The Neither the Company further certifies that neither it nor any subsidiary: (iA) has received written notice of any actual or potential material liability liability, including, but not limited to security or data privacy breaches or other unauthorized or improper access to, use of, or destruction of Personal Data, under or relating to, or actual or potential material violation of, any of the Privacy Laws, and has no knowledge of any event or condition that would reasonably be expected to result in any such notice; (iiB) is currently conducting or paying for, in whole or in part, any investigation, remediation remediation, or other corrective action pursuant to any Privacy Law; or (iiiC) is a party to any order, decree, or agreement that imposes any obligation or liability under any Privacy Law.

Data Privacy and Security Laws. The Company Except as could not reasonably be expected to have a Material Adverse Effect or as disclosed in the Registration Statement, the Pricing Disclosure Package and its the Prospectus, the Company, Evolent Health and the Company’s other subsidiaries are, and at all prior times weresince the Company’s, Evolent Health’s or such Company subsidiary’s inception have been, in material compliance with all applicable state and federal data privacy and security laws and regulations, including without limitation the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”) as amended by the Health Information Technology for Economic and Clinical Health Act (the “HITECH Act”) (, and collectively, the “Privacy Laws”). To ensure compliance with the Privacy Laws, the Company Company, Evolent Health and its subsidiaries the Company’s other subsidiaries, taken as a whole, have in place, comply with, and take appropriate steps reasonably designed to ensure compliance in all material respects with their policies and procedures relating to data privacy and security and the collection, storage, use, disclosure, handling, and analysis of Personal Data (the “Policies”). “Personal Data” means (i) a natural person’s name, street address, telephone number, e-mail address, photograph, social security number or tax identification number, driver’s license number, passport number, credit card number, bank information, or customer or account number; (ii) any information which would qualify as “personally identifying information” under the Federal Trade Commission Act, as amended; (iii) Protected Health Information as defined by HIPAA; and (iv) any other piece of information that allows the identification of such natural person, or his or her family, or permits the collection or analysis of any data related to an identified person’s health or sexual orientation. The Company Company, Evolent Health and its the Company’s other subsidiaries have at all times made all disclosures to users or customers required by applicable laws and regulatory rules or requirements, and no disclosure such disclosures made pursuant to or contained in any Policy has, to the knowledge of the Company, have been inaccurate or in violation of any applicable laws and regulatory rules or requirements requirements, except as could not reasonably be expected to result in a Material Adverse Effect. None of the Company, Evolent Health or any material respect. The Company further certifies that neither it nor any subsidiaryof the Company’s other subsidiaries: (i) has received notice of any actual or potential material liability under or relating to, or actual or potential material violation of, any of the Privacy Laws, and has no knowledge of any event or condition that would reasonably be expected to result in any such notice; (ii) is currently conducting or paying for, in whole or in part, any investigation, remediation remediation, or other corrective action pursuant to any Privacy Law; or (iii) is a party to any order, decree, or agreement that imposes any obligation or liability under any Privacy Law.

Data Privacy and Security Laws. The Company and each of its subsidiaries areis, and at all prior times werewas, in material compliance with all applicable state and federal data privacy and security laws and regulations, including including, without limitation limitation, the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”) as amended by the Health Information Technology for Economic and Clinical Health Act (the “HITECH Act”), the California Consumer Privacy Act of 2018 (“CCPA”), and the European Union General Data Protection Regulation (“GDPR”) (EU 2016/679) (collectively, the “Privacy Laws”). To ensure compliance with the Privacy Laws, the Company and its subsidiaries have in place, comply with, and take appropriate steps reasonably designed to ensure compliance in all material respects with their policies and procedures relating to data privacy and security and the collection, storage, use, disclosure, handling, and analysis of Personal Data (the “Policies”). “Personal Data” means (i) a natural person’s name, street address, telephone number, e-mail address, photograph, social security number or tax identification number, driver’s license number, passport number, credit card number, bank information, or customer or account number; (ii) any information which would qualify as “personally identifying information” under the Federal Trade Commission Act, as amended; (iii) Protected Health Information as defined by HIPAA; (iv) “personal data” as defined by the GDPR; (v) “personal information” as defined by the CCPA; and (ivvi) any other piece of information that allows allows, directly or indirectly, the identification of such natural person, or his or her familyfamily or household, or permits the collection or analysis of any data related to an identified person’s health or sexual orientation. The Company and each of its subsidiaries have at all times has made all disclosures to users or customers individuals required by applicable laws and regulatory rules or requirements, and no disclosure none of such disclosures made pursuant to or contained in any Policy has, to the knowledge of the Company, have been inaccurate or in violation of any applicable laws and regulatory rules or requirements in any material respect. The Neither the Company further certifies that neither it nor any subsidiary: of its subsidiaries (i) has have received notice of any actual or potential material liability under or relating to, or actual or potential material violation of, any of the Privacy Laws, and has no knowledge of any event or condition that would reasonably be expected to result in any such notice; (ii) is are currently conducting or paying for, in whole or in part, any investigation, remediation remediation, or other corrective action pursuant to any Privacy Law; or and (iii) is are a party to any order, decree, or agreement that imposes any obligation or liability under any Privacy Law.

Data Privacy and Security Laws. The Company and its subsidiaries areis, and at all prior times werehas been, in compliance in all material compliance respects with all applicable state state, federal, and federal international data privacy and data security laws and regulations, including without limitation HIPAA and the Health Insurance Portability HITECH Act, and Accountability Act of 1996 the European Union General Data Protection Regulation (“HIPAAGDPR”) as amended by the Health Information Technology for Economic and Clinical Health Act (the “HITECH Act”EU 2016/679) (collectively, the “Privacy Laws”). To ensure address compliance with the Privacy LawsLaws to the extent applicable, the Company and its subsidiaries have has in place, comply complies with, and take appropriate takes commercially reasonable steps reasonably designed to ensure achieve compliance in all material respects with their its policies and procedures relating to data privacy and security and the collection, storage, use, disclosure, handling, and analysis transfer of Personal Data (the “Policies”)Data. “Personal Data” means (i) a natural person’s name, street address, telephone number, e-mail address, photograph, social security number or tax identification number, driver’s license number, passport number, credit card number, bank information, or customer or account number; (ii) any information which would qualify as “personally identifying information” under the Federal Trade Commission Act, as amended; (iii) Protected Health Information as defined by the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”); (iv) “personal data” as defined by GDPR; and (ivv) any other piece of information that allows the identification of identifies such natural person. At all times, or his or her family, or permits the collection or analysis of any data related to an identified person’s health or sexual orientation. The Company and its subsidiaries have at all times has made all disclosures to users or customers required by applicable laws Privacy Laws and regulatory rules or requirements, and no disclosure made pursuant to any Policy hasnone of such disclosures have, to the knowledge of the Company, been inaccurate or in violation of any applicable laws and regulatory rules or requirements in any material respect. The Company further certifies that (a) neither it nor any subsidiarysubsidiary at any time: (i) has received written notice of any actual or potential material liability liability, including, but not limited to security or data privacy breaches or other unauthorized or improper access to, use of, or destruction of its Personal Data owned or controlled by the Company, under or relating to, or actual or potential material violation of, any of the Privacy Laws, and has no knowledge of any event or condition that would reasonably be expected to result in any such notice; (ii) other than pursuant to its ongoing compliance efforts in the ordinary course of business, is currently conducting conducting, subject to, or paying forpaying, in whole or in part, any material investigation, remediation remediation, or other corrective action pursuant to resulting from the Company’s non-compliance with any Privacy Law; or (iii) is a party to any order, decree, settlement agreement, or agreement judgment from a governmental entity that imposes any obligation or liability under any Privacy Law; and (b) it is not aware of any specific events rendering any of the foregoing reasonably likely to occur. The Company is not a “covered entity” or “business associate” as such terms are defined under HIPAA.