NEMT ENGINE — TERMS OF SERVICE

Provider: Summa OS Inc DBA NeMT Engine ("Provider," "we," "us")

Product: NEMT Engine (nemtengine.com) — private-pay dispatch and operations software for non-emergency transportation operators

Contact: contact@nemtengine.com

Scope: These Terms govern both the NEMT Engine website (nemtengine.com) (the "Website") and the NEMT Engine subscription service (the "Service"). By accessing the Website or using the Service, you agree to these Terms.

Effective Date: October 4, 2026

Version: 1.0

1. THE SERVICE

1.1. Provider offers NEMT Engine, a software-as-a-service platform for dispatching, scheduling, driver coordination, customer booking, voice-AI call handling, SMS messaging, and related operational tools (the "Service").

1.2. Private-pay scope only. The Service is offered strictly for private-pay transportation operations. Customer represents and warrants that it will NOT use the Service to:

(a) submit claims to, or receive payment from, Medicare, Medicaid, or any health plan, broker, or managed-care organization (including but not limited to Modivcare, MTM, and Access2Care);

(b) transmit eligibility checks, authorizations, or any transaction governed by HIPAA's Transactions Rule; or

(c) process Protected Health Information on behalf of a HIPAA covered entity.

1.3. Provider does not offer or sign HIPAA Business Associate Agreements for the Service at this time. If Customer's use changes so that HIPAA applies, Customer must notify Provider immediately and stop such use until a written agreement covering it is in place.

1.4. Regulatory posture — private pay. The parties acknowledge and agree that the Service is designed, marketed, and offered exclusively for private-pay transportation operations. Provider does not create, receive, maintain, or transmit protected health information (as defined by HIPAA, 45 CFR 160.103) on behalf of a HIPAA covered entity, does not act as a HIPAA business associate, and does not execute HIPAA Business Associate Agreements for the Service. Customer acknowledges that (a) its use of the Service is limited to private-pay operations as warranted in Section 1.2, (b) nothing in these Terms authorizes the processing of protected health information on behalf of a covered entity, and (c) if Customer's operations change such that HIPAA or any similar health-data regulation could apply, Customer must notify Provider in writing before making that change, and the parties must execute a separate written agreement addressing it before such use begins.

1.5. Website visitors. You may browse the Website without creating an account. By accessing the Website you agree to these Terms. Sections 6 (Acceptable Use), 8 (Confidentiality), 9 (Warranties and Disclaimer), 10 (Limitation of Liability), 11 (Indemnification, as applicable), and 14 (General) apply to all Website visitors. All remaining sections apply when you create an account or purchase a subscription.

2. ACCOUNTS AND ACCESS TIERS

2.1. Customer Admin (account level). Customer's designated administrators receive full control over their own account: users and staff seats, driver assignments, dispatch workflows, scheduling, service settings, greetings, pricing, and exports of their data.

2.2. Provider Root (platform level). Infrastructure, server configuration, security patching, database administration, platform-wide monitoring, and multi-tenant system integrity remain exclusively with Provider. Customer shall not attempt to access, probe, or modify platform-level systems, other tenants' data, or Provider's source infrastructure.

2.3. Customer is responsible for all activity under its accounts and for keeping credentials confidential. Customer must notify Provider promptly of any suspected unauthorized access.

3. CUSTOMER DATA — OWNERSHIP, LICENSE, AND HANDLING

3.1. Ownership. As between the parties, Customer owns all data Customer and its users submit to the Service ("Customer Data"), including rider information, trip records, dispatch logs, driver records, call recordings, transcripts, and messages.

3.2. Limited license. Customer grants Provider a limited, non-exclusive, worldwide license to host, store, transmit, process, display, and create backups of Customer Data solely to operate, maintain, secure, and support the Service. Provider claims no ownership interest in Customer Data. Provider may use de-identified and aggregated data derived from Customer Data for analytics and product improvement.

3.3. Customer responsibilities. Customer warrants that it has all necessary rights, consents, and authorizations to submit Customer Data to the Service and to have Provider process it as described in these Terms and the Privacy Policy. Customer is solely responsible for the accuracy, legality, and appropriateness of Customer Data.

3.4. No sale of data. Provider will not sell Customer Data to third parties.

4. DELETION, ARCHIVING, AND RETENTION

4.1. "Delete" means archive. When a Customer user deletes a record in the Service (trip, rider profile, dispatch log, or similar), the record is removed from the active operational interface and flagged as archived. The underlying record is retained in encrypted backend storage.

4.2. Why. Archived retention protects both parties: it preserves records needed for billing disputes, payment chargebacks, tax records, legal proceedings, and regulatory inquiries, and it maintains the integrity of system audit trails.

4.3. Retention period. Customer Data, including archived records and system audit logs, is retained for a minimum of six (6) years from creation, unless a longer period is required by applicable law. Exception: call recordings. Call audio recordings are not covered by this six-year period. They are kept for ninety (90) days and then permanently deleted, and an Owner may permanently delete an individual recording sooner. Deleted recordings cannot be recovered. Call details (time, duration, outcome, linked trip) remain subject to the six-year period.

4.4. Export anytime. Customer may export its Customer Data in a standard machine-readable format at any time during the subscription through the account's export tools.

4.5. Termination purge. Upon termination or expiration, Customer has thirty (30) days to export Customer Data (the "Export Window"). After the Export Window closes, Provider will permanently and programmatically destroy Customer's tenant data partition, including archived records and backups as they cycle, using cryptographic key destruction or equivalent secure deletion. Provider has no obligation to retain Customer Data after the Export Window.

4.6. Hard delete on customer request (non-standard). As an exception to Sections 4.1–4.3, an authorized Customer administrator may submit a written request for immediate permanent deletion ("Hard Delete") of specified Customer Data or the entire tenant dataset.

(a) The request must specify the exact data scope and be confirmed a second time no sooner than 7 days after the initial request.

(b) Before executing, Provider will provide a written summary of consequences, which Customer must acknowledge in writing: the deletion is irreversible; Customer will lose records that may be needed for billing disputes, payment chargebacks, tax documentation, and legal proceedings; and residual encrypted copies will persist in backups until they cycle (up to 30 days).

(c) Customer assumes all risk arising from the Hard Delete and will indemnify, defend, and hold harmless Provider from any claims, losses, damages, or penalties arising from the unavailability of the deleted data — including claims by Customer's riders, customers, or tax authorities — except to the extent caused by Provider's gross negligence or willful misconduct in executing the deletion itself.

(d) Hard Delete never applies to Provider's own business records (signed contracts, invoices, payment records), de-identified platform security logs, or anything Provider is required by law to retain. Those are Provider's records, not Customer Data.

(e) Provider will execute a confirmed Hard Delete within 14 days of final confirmation. A reasonable processing fee may apply at Provider's then-current rate.

5. FEES AND PAYMENT

5.1. Customer will pay the subscription fees set out in the applicable order form or plan selected at signup ("Fees"). Fees are monthly, due in advance, and non-refundable except as expressly stated here.

5.2. Payment is processed by our third-party payment processor. Provider does not store full payment card numbers.

5.3. Late payments may result in suspension of the Service after 7 days' written notice.

6. ACCEPTABLE USE

Customer will not: (a) use the Service for any unlawful purpose; (b) upload malicious code; (c) attempt to gain unauthorized access to the Service or other tenants' data; (d) resell or sublicense the Service without written permission; (e) use the Service to send unlawful robocalls or texts — Customer is solely responsible for compliance with the TCPA and all telemarketing laws for any outbound calls or messages it initiates; (f) misrepresent its identity or affiliation.

6.1. Call recording. Calls answered by the Service's phone answering feature are recorded by our telephony provider. Where the recording notice is enabled for Customer, the Service plays the notice "This call may be recorded for quality and service." at the start of each call and makes recordings available for playback in the Service. Customer will not disable, obscure, or ask the Service to omit this notice once enabled. Customer is solely responsible for complying with all call-recording, wiretap, and consent laws that apply to its callers and staff, including laws in states that require the consent of every party to a call, and for informing its own staff that calls transferred to them may be recorded.

7. SECURITY AND BREACH RESPONSE

7.1. Provider maintains the administrative, technical, and physical safeguards described in the Data Processing & Security Exhibit (Schedule A), incorporated here by reference.

7.2. If Provider confirms a security incident involving unauthorized access to Customer Data, Provider will notify Customer's designated contact within seventy-two (72) hours of confirmation, describe what is known, and provide reasonable cooperation including relevant logs. Customer is responsible for any notifications it owes to its own riders, regulators, or the public.

8. CONFIDENTIALITY

Each party will keep the other's non-public business information confidential, using at least reasonable care, and will not disclose it except to staff, advisors, or contractors who need it and are bound by confidentiality, or as required by law.

9. WARRANTIES AND DISCLAIMER

9.1. Provider warrants it will provide the Service with reasonable skill and care consistent with industry standards.

9.2. EXCEPT AS STATED IN 9.1, THE SERVICE IS PROVIDED "AS IS" AND "AS AVAILABLE." PROVIDER DISCLAIMS ALL OTHER WARRANTIES, EXPRESS OR IMPLIED, INCLUDING MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, AND NON-INFRINGEMENT. PROVIDER DOES NOT WARRANT THE SERVICE WILL BE UNINTERRUPTED OR ERROR-FREE.

10. LIMITATION OF LIABILITY — READ CAREFULLY

10.1. Cap. TO THE MAXIMUM EXTENT PERMITTED BY LAW, PROVIDER'S TOTAL AGGREGATE LIABILITY ARISING OUT OF OR RELATED TO THESE TERMS, THE WEBSITE, OR THE SERVICE WILL NOT EXCEED THE TOTAL FEES PAID BY CUSTOMER TO PROVIDER IN THE TWELVE (12) MONTHS PRECEDING THE EVENT GIVING RISE TO THE CLAIM. IF NO FEES HAVE BEEN PAID (FOR EXAMPLE, WEBSITE VISITORS WITHOUT A SUBSCRIPTION), PROVIDER'S TOTAL AGGREGATE LIABILITY WILL NOT EXCEED $100.

10.2. Excluded damages. IN NO EVENT WILL PROVIDER BE LIABLE FOR ANY INDIRECT, INCIDENTAL, SPECIAL, CONSEQUENTIAL, OR PUNITIVE DAMAGES, OR FOR LOSS OF PROFITS, REVENUE, DATA, OR BUSINESS OPPORTUNITY, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGES.

10.3. Essential basis. The limitations in this Section 10 are an essential basis of the bargain: the Fees reflect this allocation of risk.

10.4. Nothing in this Section limits liability that cannot legally be limited, Customer's payment obligations, or Customer's indemnity obligations under Section 11.

11. INDEMNIFICATION

11.1. Customer will indemnify, defend, and hold harmless Provider from claims arising from: (a) Customer Data; (b) Customer's use of the Service in violation of these Terms, including any use for Medicare/Medicaid or broker billing in breach of Section 1.2; (c) Customer's outbound calls, texts, or marketing; or (d) Customer's violation of law.

11.2. Provider will indemnify Customer against third-party claims that the Service infringes a U.S. intellectual property right, subject to Customer's prompt notice and cooperation.

12. TERM AND TERMINATION

12.1. These Terms begin on the Effective Date (or account activation) and continue for the subscription term selected, renewing automatically unless either party gives 30 days' notice before renewal.

12.2. Either party may terminate for material breach if the breach is not cured within 30 days of written notice. Provider may suspend the Service immediately for non-payment, security risk, or unlawful use.

12.3. On termination: Customer's access ends; the Export Window and purge in Section 4.5 apply; Sections 3 (ownership/license as to retained archival copies), 4, 8, 9, 10, 11, and 14 survive.

13. CHANGES TO TERMS

Provider may update these Terms with 30 days' notice. Continued use after the notice period constitutes acceptance. Material adverse changes give Customer the right to terminate under Section 12 without early-termination penalty.

14. GENERAL

14.1. Governing law: the laws of the State of Georgia, without regard to conflict-of-law rules. Exclusive venue in state or federal courts located in Fulton County, Georgia.

14.2. Entire agreement; severability; no waiver by delay; no assignment by Customer without consent; notices by email to the addresses on record; force majeure.

SCHEDULE A — Data Processing & Security Exhibit (attached; incorporated by reference)

SMS MESSAGING TERMS

NeMT Engine sends only transactional ride-request confirmation and price-update texts, including updated-price approval links — no marketing or reminders by text, no cold outreach, and no purchased lists.

Text-message consent is optional. The booking-form checkbox is unchecked by default and states: "I agree to receive NeMT Engine transactional ride-request confirmation and price-update texts. Message frequency varies. Msg & data rates may apply. Reply STOP to opt out, HELP for help. See our [Terms](/terms) and [Privacy Policy](/privacy)."

Message frequency varies. Message and data rates may apply. Reply STOP at any time to opt out, or HELP for help. Consent is not required to request a ride. For help, contact contact@nemtengine.com or (943) 230-0955.