Terms of Service, Privacy Policy & Data Processing Addendum

Subscription Order Form

This Subscription Order Form and Terms of Service (together, this “Agreement”) is entered into as of the date referred to as the “Effective Date” below, between Northern Lights AI Inc., a corporation incorporated under the Canada Business Corporations Act (Corporation No. 1811928-7), with its registered office at 4504 56 Ave, Unit 1346, Lamont, Alberta T0B 2R0 (the “Company”), and the consultant identified below (the “Consultant”). The Company and the Consultant are each a “Party” and together the “Parties.”

Effective Date: [Effective Date]

Consultant (legal name): [Consultant Legal Name]

Business/practice name (if different): [Business/Practice Name]

Address: [Address]

Contact email: [Contact Email]

Title: [Title]

Subscription tier: [Subscription Tier]

Audit allowance per billing period: [Audit Allowance]

Subscription fee: [Subscription Fee] plus applicable taxes, billed [monthly/annually]

Initial Subscription Term: [Initial Subscription Term], renewing as set out in Section 2 below

By signing below, the Consultant applies for and subscribes to access to the Platform on the terms of this Agreement, and acknowledges having read and agreed to Sections 1 through 18 below, together with the Company’s Privacy Policy and Data Processing Agreement, each incorporated into this Agreement by reference. Where the Company instead makes the Platform available for online, self-service subscription rather than by way of a countersigned order form, acceptance occurs by the Consultant’s electronic click-through acceptance of this Agreement at the point of registration, and references in this Agreement to the signed “Order Form” shall be read as the Consultant’s registration and acceptance through the Platform, as applicable.

Acknowledgment of disclaimer. The Consultant specifically acknowledges having read Section 6 (Nature of the Platform; AI-Generated Output; Not Legal Advice) and Section 13 (Warranties and Disclaimers), and confirms its understanding that the Platform’s AI Output, Findings, and Reports are not legal advice or compliance advice, are not reviewed by a lawyer, and are not a final determination of legal compliance, and that the Consultant remains solely responsible for verifying any Finding or Report against Applicable Law before relying on it or presenting it to a Client.

NORTHERN LIGHTS AI INC. — Name: Roberta Jacqueline Desrochers, Title: Director

CONSULTANT — Name: [Consultant Legal Name], Title: [Title]

Terms of Service — 1. Definitions

In this Agreement:

“Affiliate” means, with respect to a Party, any entity that directly or indirectly controls, is controlled by, or is under common control with that Party.

“AI Output” or “Findings” means the section-by-section compliance analysis, findings, and any accompanying commentary generated by the Platform in respect of an Uploaded Document and the Confirmed Safety Standards associated with it.

“Business Day” means a day other than a Saturday, a Sunday, or a statutory holiday in the Province of Alberta.

“Client” means a business or organization that engages the Consultant to perform an occupational health and safety audit, or, where the Consultant uses the Platform to review its own organization’s or its employer’s documents, that organization, in each case in respect of which the Consultant uses the Platform.

“Confidential Information” has the meaning given in Section 9.

“Confirmed Safety Standards” means the Safety Standards that the Consultant confirms as in scope for a particular audit and review activity in accordance with Section 7.

“Data Processing Agreement” or “DPA” means the data processing agreement entered into between the Parties, incorporated into this Agreement by reference, governing the Company’s processing of personal information on the Consultant’s behalf.

“Order Form” means the order form on the cover page of this Agreement, or the equivalent online subscription registration referred to on that cover page, as applicable.

“Personal Information” has the meaning given in the Privacy Policy and the DPA.

“Platform” means the Company’s web-based, subscription software-as-a-service platform currently marketed as “My Pocket Safety Specialist,” together with all related documentation, updates, and enhancements made available to the Consultant under this Agreement.

“Privacy Policy” means the Company’s privacy policy as published and updated from time to time, incorporated into this Agreement by reference.

“Report” means the formatted, downloadable output generated by the Platform following the Consultant’s review and any edits to the Findings.

“Safety Standards” means applicable laws, regulations, codes, and other applicable industry standards, guidelines, and recognized practices relevant to occupational health and safety in a given jurisdiction or industry, including human rights, employment standards, and labour legislation to the extent it bears on occupational health and safety programs, such as modified work, accommodation, and hours of work requirements.

“Safety Standards Library” means the Company’s internal, curated library of Safety Standards references (name, source or issuing body, jurisdiction or industry of application, and, where publicly available, a link to the official or authoritative source) maintained and expanded by the Company from time to time, as described in Section 7.

“Subscription Term” means the Initial Subscription Term specified in the Order Form, together with any Renewal Term under Section 2.

“Uploaded Document” means any safety practice document or other file the Consultant uploads to the Platform for comparison against Confirmed Safety Standards.

“User” means the Consultant and any individual within the Consultant’s own practice or organization whom the Consultant authorizes to access the Platform under the Consultant’s account, for whose acts and omissions in using the Platform the Consultant remains responsible.

Terms of Service — 2. Term and Renewal

This Agreement commences on the Effective Date and continues for the Initial Subscription Term specified in the Order Form. Upon expiry of the Initial Subscription Term, this Agreement automatically renews for successive periods of the same length (each, a “Renewal Term”) unless the Consultant cancels its subscription before the end of the then-current term in accordance with Section 16.2, or the Company gives the Consultant written notice of non-renewal at least 30 days before the end of the then-current term.

The Company may adjust Fees for a Renewal Term by giving the Consultant at least 30 days’ written notice before the Renewal Term begins. If the Consultant does not accept the adjusted Fees, the Consultant may decline renewal in accordance with this Section 2, and this Agreement will expire at the end of the then-current term.

Terms of Service — 3. Access to the Platform; Licence

Subject to the Consultant’s compliance with this Agreement and payment of all applicable Fees, the Company grants the Consultant a non-exclusive, non-transferable, non-sublicensable, revocable licence during the Subscription Term to access and use the Platform for the Consultant’s own professional occupational health and safety consulting practice or, where applicable, the internal occupational health and safety program of the Consultant’s organization, up to the audit allowance and User limits specified in the Order Form.

The Platform is a productivity aid for the Consultant’s own audit and safety policy analysis procedures. It is not sold or made available directly to Clients, and the Consultant shall not resell, sublicense, reproduce, modify, distribute, licence, publicly perform, transmit, stream, broadcast, or otherwise exploit or provide standalone access to the Platform to any Client or other third party except as permitted by the Company.

The Company reserves all rights not expressly granted. The Consultant shall not, and shall not permit any User or third party to: reverse engineer, disassemble, decompile, or attempt to derive the source code or underlying models of the Platform; link to, mirror or frame any portion of the Platform; cause or launch any programs or scripts for the purpose of scraping, indexing, surveying, or otherwise data mining any portion of the Platform; unduly burdening or hindering the operation and/or functionality of any aspect of the Platform; attempt to gain unauthorized access to or impair any aspect of the Platform or its related systems or networks; use the Platform to build a competing product or service; remove or obscure any proprietary notices; or use the Platform in a manner that violates Applicable Law or infringes any third party’s rights.

Terms of Service — 4. Consultant Accounts and Users

Each Consultant maintains its own account and portfolio of Client engagements within the Platform. Consultants do not have access to, and the Company will not disclose to a Consultant, another Consultant’s account, portfolio, or data.

The Consultant is responsible for maintaining the confidentiality of its account credentials, for all activity occurring under its account, and for ensuring that any User it authorizes complies with this Agreement. The Consultant shall notify the Company promptly of any unauthorized use of its account.

Terms of Service — 5. Subscription Fees and Payment

The Consultant shall pay the Fees specified in the Order Form, plus applicable taxes, in accordance with the billing frequency stated there. Fees are payable by the payment method the Consultant provides to the Company and, unless otherwise stated in the Order Form, are non-refundable.

The Company’s then-current subscription plans, including the applicable monthly and annual Fees, audit allowances, and bonus audits for each plan, are set out in Schedule A (Subscription Plans), as may be updated by the Company from time to time in accordance with this Agreement.

The Platform does not permit the Consultant to conduct audits in excess of the audit allowance for the current billing period, and a Consultant that has used its allowance may upgrade to a higher plan or change to annual billing at any time, in which case the Fees and audit allowance for the new plan apply from the date of the change, with any adjustment to the Fees for the current billing period calculated by Paddle. Audits not used by the end of a billing period lapse and do not carry forward to a subsequent billing period.

If any amount is not paid when due, the Company may, on notice to the Consultant, suspend access to the Platform until payment is received, without prejudice to any other right or remedy available to the Company.

Terms of Service — 6. Nature of the Platform; AI-Generated Output; Not Legal Advice

General. The Platform compares the text of an Uploaded Document against Confirmed Safety Standards using an artificial intelligence model and produces AI Output. The AI Output is a starting point for the Consultant’s own professional judgment and is not, and shall not be relied upon as, a final determination of legal compliance.

No legal advice; no legal opinion. The Company is a software provider, not a law firm, and does not provide legal advice, legal opinions or compliance advice. The AI Output is not reviewed against Safety Standards or Applicable Law by a licensed lawyer before it reaches the Consultant. Nothing in the Platform, the AI Output, or a Report creates a solicitor-client relationship, an advisory relationship, or any professional duty of care between the Company and the Consultant or the Consultant’s Client.

Limitations of the AI Output. The Consultant acknowledges and agrees that: the AI model may misinterpret document language, cite an incorrect provision, or miss context that only a qualified reviewer would identify; the AI Output does not warrant that the Safety Standards Library is complete, current, or reflects the most recent amendments, revisions, or republications, as Safety Standards may be amended, revised, replaced, or withdrawn after an entry was last reviewed by the Company; the Platform covers only the jurisdictions, industries, and Safety Standards currently in the Safety Standards Library, and the absence of a flagged gap does not mean full compliance with any Safety Standards or Applicable Law; and the AI Output is not tailored legal advice or compliance advice addressing a Client’s full legal or operational circumstances beyond what is contained in the relevant Uploaded Document.

NO RELIANCE. THE CONSULTANT ACKNOWLEDGES AND AGREES THAT IT DOES NOT, AND WILL NOT, RELY ON THE AI OUTPUT, ANY FINDING, OR ANY REPORT AS A DETERMINATION OF WHETHER A CLIENT COMPLIES WITH ANY SAFETY STANDARDS OR APPLICABLE LAW, AND WILL NOT REPRESENT OR SUGGEST TO A CLIENT, OR TO ANY OTHER PERSON, THAT IT IS SUCH A DETERMINATION. THE CONSULTANT WILL NOT PRESENT AI OUTPUT, A FINDING, OR A REPORT TO A CLIENT WITHOUT FIRST APPLYING THE CONSULTANT’S OWN INDEPENDENT PROFESSIONAL REVIEW AND JUDGMENT TO IT. THIS SECTION 6 APPLIES REGARDLESS OF HOW POLISHED, DETAILED, OR AUTHORITATIVE THE FORMATTING OR CONTENT OF A REPORT MAY APPEAR, AND REGARDLESS OF WHETHER A FINDING CITES A SPECIFIC STATUTORY OR REGULATORY PROVISION OR A SPECIFIC PROVISION OF ANY OTHER SAFETY STANDARD.

Assumption of risk. The Consultant assumes all risk arising from any use of the AI Output, a Finding, or a Report, including any use by a Client or third party to whom the Consultant provides a Report, and the Company disclaims all liability for any compliance failure, regulatory enforcement action, injury, or other loss arising from a Client’s or third party’s reliance on AI Output, a Finding, or a Report that has not been independently verified by the Consultant against the applicable Safety Standards and Applicable Law then in force or then current.

Consultant’s sole responsibility. The Consultant remains solely responsible for reviewing, verifying, and, where the Consultant considers it appropriate, editing the Findings before relying on them, for verifying Findings against the applicable Safety Standards and Applicable Law as currently in force or then current, and for the final compliance opinion, conclusion, or recommendation the Consultant provides to its Client. The Consultant shall advise its Clients, and its Clients’ own advisors, to seek independent legal counsel for advice specific to the Client’s circumstances.

Terms of Service — 7. Audit Workflow

To conduct an audit activity using the Platform, the Consultant: identifies the Client’s operating location(s), by country and province or state, and the Client’s industry or sector; reviews the Safety Standards the Platform proposes from the Safety Standards Library for that jurisdiction and industry; confirms which proposed Safety Standards are in scope for that audit, or marks an item not in scope with a stated reason, before the Platform’s analysis commences; and uploads the relevant Uploaded Document for analysis against the Confirmed Safety Standards.

The Consultant may flag any Safety Standards the Consultant believes are missing from the Safety Standards Library. The Company will review any such flag and determine, in its sole discretion, whether to add the item to the Safety Standards Library on a permanent basis. The Company is under no obligation to add any particular item, or to do so within any particular timeframe.

The Safety Standards Library contains a reference to the name of each item of Safety Standards, its source or issuing body, the jurisdiction or industry to which it applies, and, where publicly available, a link to the official or authoritative source, together with a brief AI-generated summary or comparison. The Company does not store or reproduce the full text of any Safety Standards within the Platform.

Terms of Service — 8. Consultant Responsibilities

The Consultant represents and warrants that it is, throughout the Subscription Term, a licensed or otherwise appropriately qualified occupational health and safety consultant entitled to practice in the jurisdiction(s) in which it uses the Platform or, where it uses the Platform on behalf of its own organization or its employer, a person with responsibility for occupational health and safety within that organization, and that it will use the Platform, and present the resulting Findings and Reports to Clients, in a manner consistent with its professional obligations.

The Consultant is solely responsible for: obtaining any consent or authorization from a Client necessary to upload the Client’s documents to the Platform; ensuring that Uploaded Documents do not contain personal information beyond what is reasonably necessary for the audit activity; and the accuracy of the jurisdiction, industry, and scope determinations the Consultant makes within the Platform.

Terms of Service — 9. Client Data and Confidentiality

“Confidential Information” means all non-public information disclosed by one Party to the other in connection with this Agreement, whether marked confidential or not, including Uploaded Documents, Findings, Reports, Client information, pricing, and the Platform’s non-public features and underlying methodology, but excluding information that is or becomes public through no fault of the receiving Party, was already lawfully known to the receiving Party without restriction, or is independently developed without reference to the disclosing Party’s Confidential Information.

Each Party shall protect the other’s Confidential Information using at least the same degree of care it uses to protect its own confidential information of similar nature, and in no event less than a reasonable degree of care, and shall use such Confidential Information only as necessary to perform its obligations or exercise its rights under this Agreement. Each Party may disclose Confidential Information to its personnel and professional advisors on a need-to-know basis, provided they are bound by confidentiality obligations at least as protective as those in this Section 9, and as required by Applicable Law or a valid order of a court or regulator, provided that, where legally permitted, the disclosing Party gives the other Party prompt notice to allow it to seek a protective order.

As between the Parties, Uploaded Documents, Findings, and Reports relating to a specific Client engagement are the Confidential Information of the Consultant. The Company shall not use them for any purpose other than providing the Platform to the Consultant, improving and maintaining the Platform on a de-identified and aggregate basis as described in the Privacy Policy, and as otherwise permitted under the DPA.

Terms of Service — 10. Data Protection

The Consultant agrees and acknowledges that other than in respect of the collection of Personal Information described in the Privacy Policy and the DPA, no other Personal Information is intended to be submitted to the Platform. Uploaded Documents will consist of policies, procedures, and technical safety content. To the extent an Uploaded Document or the Consultant’s account information contains personal information, the Company’s collection, use, and disclosure of that personal information is governed by the Privacy Policy, and the Company’s processing of personal information on the Consultant’s behalf as a service provider is governed by the DPA, each of which is incorporated into this Agreement by reference.

Consultant acknowledges and agrees that Company may collect usage data on access and use of the Platform, such as browser or device type and information about how Consultant navigates and interacts with the Platform. Consultant acknowledges and agrees that Company may associate such usage data with Consultant’s account and/or organization to help better understand usage patterns and improve the Platform and services.

If there is a conflict between this Agreement and the DPA in respect of the processing of Personal Information, the DPA governs to the extent of the conflict.

Terms of Service — 11. Intellectual Property

As between the Parties, the Company owns all right, title, and interest in and to the Platform, the Safety Standards Library, the underlying AI models and methodology, and all improvements, enhancements, and derivative works thereof, including all intellectual property rights therein. Nothing in this Agreement transfers any such right, title, or interest to the Consultant.

As between the Parties, the Consultant retains all right, title, and interest in and to its Uploaded Documents. The Consultant grants the Company a non-exclusive, worldwide, royalty-free licence, during the Subscription Term, to host, store, copy, process, and display the Uploaded Documents, and to generate the AI Output, Findings, and Reports derived from them, solely as necessary to provide and support the Platform for the Consultant. The Company may exercise this licence through its Affiliates and through subcontractors engaged to host or support the Platform, each bound by confidentiality obligations no less protective than those in Section 9. This licence terminates on expiry or termination of the Subscription Term, subject to the Company’s retention rights under Section 16, the DPA, and Applicable Law.

Improvement licence. The Consultant further grants the Company a non-exclusive, worldwide, royalty-free, perpetual, irrevocable licence to create, use, and disclose de-identified and aggregated data derived from Uploaded Documents, Findings, and usage information, in order to maintain, secure, and improve the Platform and the Safety Standards Library and to produce industry benchmarking. The Company shall not disclose such data in any form that identifies, or could reasonably be used to re-identify, the Consultant, any Client, or any individual, and shall not attempt to re-identify it. This licence survives termination or expiry of this Agreement.

Subject to Company’s underlying intellectual property as provided in this Section 11 and all warranties and limitations of liability contained in this Agreement, the Consultant owns the Reports produced from the Platform and Consultant may use, edit, and provide Reports to its Clients in the ordinary course of the Consultant’s practice.

Terms of Service — 12. Referral Program

The Company may, in its discretion, make available an optional referral program under which a Consultant may earn a referral payment for introducing new subscribers to the Platform through a referral link issued by the Company. No referral payment is available in respect of a subscriber that held a subscription before the referral. Participation in the referral program is voluntary, and the Company may modify or discontinue the program, or a Consultant’s participation in it, at any time on notice to the Consultant, without affecting the Consultant’s other rights under this Agreement. Participation is conditional on the Consultant entering into the Company’s referral agreement, which governs the attribution, calculation, and payment of referral payments. In the event of conflict between this Agreement and the referral agreement, the referral agreement governs in respect of the referral program and this Agreement governs in all other respects.

Terms of Service — 13. Warranties and Disclaimers

Each Party represents and warrants that it has the authority to enter into this Agreement and to perform its obligations under it.

EXCEPT AS EXPRESSLY SET OUT IN THIS AGREEMENT, THE PLATFORM, THE SAFETY STANDARDS LIBRARY, AND ALL AI OUTPUT, FINDINGS, AND REPORTS ARE PROVIDED “AS IS” AND “AS AVAILABLE,” AND “WITH ALL FAULTS” BASIS WITHOUT WARRANTY OF ANY KIND, WHETHER EXPRESS, IMPLIED, OR STATUTORY, INCLUDING ANY IMPLIED WARRANTY OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, NON-INFRINGEMENT, ACCURACY, OR COMPLETENESS, TO THE FULLEST EXTENT PERMITTED BY APPLICABLE LAW. WITHOUT LIMITING THE FOREGOING, THE COMPANY DOES NOT WARRANT THAT THE PLATFORM WILL BE UNINTERRUPTED, ERROR-FREE, OR SECURE, OR THAT ANY FINDING OR REPORT IS ERROR-FREE, ACCURATE, COMPLETE, CORRECT, OR CURRENT.

WITHOUT LIMITING SECTION 6 OR THE FOREGOING, THE COMPANY EXPRESSLY DISCLAIMS ANY WARRANTY THAT USE OF THE PLATFORM, OR COMPLIANCE WITH ANY FINDING OR REPORT, WILL RESULT IN A CLIENT’S COMPLIANCE WITH ANY LEGISLATION, REGULATION, OR OTHER LEGAL REQUIREMENT, OR WILL PREVENT A REGULATORY FINDING, ORDER, PENALTY, OR ENFORCEMENT ACTION AGAINST A CLIENT OR THE CONSULTANT. THE CONSULTANT ACKNOWLEDGES THAT COMPLIANCE WITH OCCUPATIONAL HEALTH AND SAFETY LEGISLATION DEPENDS ON FACTS AND CIRCUMSTANCES BEYOND WHAT IS CONTAINED IN AN UPLOADED DOCUMENT, AND THAT NO SOFTWARE TOOL, INCLUDING THE PLATFORM, CAN SUBSTITUTE FOR THE CONSULTANT’S OWN PROFESSIONAL AUDIT AND JUDGMENT, AND THE ACTUAL SAFETY PROCEDURES AND PRACTICES EXERCISED BY THE CONSULTANT’S CLIENTS. CONSULTANT AGREES THAT THE ENTIRE RISK ARISING OUT OF THEIR USE OF THE PLATFORM, AND ANY PLATFORM OR ANY FINDING, REPORT OR CONTENT RECEIVED BY CONSULTANT THROUGH THE USE OF THE PLATFORM, REMAINS SOLELY WITH THE CONSULTANT, TO THE MAXIMUM EXTENT PERMITTED UNDER APPLICABLE LAW.

Terms of Service — 14. Limitation of Liability

Neither Party is liable to the other for any indirect, incidental, special, consequential, exemplary, or punitive damages, or for any loss of profits, revenue, data, or business opportunity, arising out of or relating to this Agreement, even if advised of the possibility of such damages and regardless of the theory of liability.

Except for the Consultant’s payment obligations, a Party’s indemnification obligations under Section 15, and either Party’s breach of Section 9 (Confidentiality), each Party’s aggregate liability arising out of or relating to this Agreement shall not exceed the total Fees paid or payable by the Consultant to the Company under this Agreement in the twelve (12) months preceding the event giving rise to the claim.

Nothing in this Agreement excludes or limits either Party’s liability for fraud, wilful misconduct, or any other liability that cannot be excluded or limited as a matter of Applicable Law.

Terms of Service — 15. Indemnification

The Consultant shall indemnify and hold harmless the Company from and against any third-party claim, and associated liabilities, damages, and reasonable legal costs, arising from: the Consultant’s use of the Platform in breach of this Agreement or Applicable Law; the Consultant’s presentation of Findings or a Report to a Client as a final legal compliance determination rather than as a professional aid to the Consultant’s own judgment; or an Uploaded Document that the Consultant lacked the right to upload.

The Company shall indemnify and hold harmless the Consultant from and against any third-party claim, and associated liabilities, damages, and reasonable legal costs, alleging that the Platform, as provided by the Company and used in accordance with this Agreement, infringes a third party’s intellectual property rights, except to the extent the claim arises from the Consultant’s Uploaded Documents, the Consultant’s use of the Platform in combination with materials not provided by the Company, or the Consultant’s breach of this Agreement.

The indemnified Party shall give the indemnifying Party prompt written notice of a claim, allow the indemnifying Party to control its defence and settlement, provided any settlement does not impose liability on the indemnified Party without its consent, and provide reasonable cooperation at the indemnifying Party’s expense.

Terms of Service — 16. Suspension and Termination

Termination for Cause. Either Party may terminate this Agreement if the other Party materially breaches this Agreement and fails to cure that breach within ten (10) Business Days of written notice describing the breach.

The Company may suspend or terminate the Consultant’s access to the Platform immediately on notice if: the Consultant fails to pay Fees when due; the Consultant’s continued access would expose the Company to a legal or regulatory risk; or the Company reasonably believes the Consultant has used the Platform in a manner inconsistent with Sections 3 and 6 of this Agreement.

Termination for Convenience. The Consultant may cancel its subscription at any time using the cancellation function in the Platform or by written notice to the Company. Cancellation takes effect at the end of the then-current billing period, being the current month for a monthly subscription and the current year for an annual subscription, and the subscription will not renew. Until that date, the Consultant retains access to the Platform and may use any audits remaining in its audit allowance for that billing period. Fees paid or payable for the billing period in which cancellation occurs are not refundable and will not be pro-rated, and any audits unused at the end of that billing period lapse.

On termination or expiry of this Agreement, the Consultant’s right to access the Platform ends, and each Party shall return or destroy the other Party’s Confidential Information in its possession, except to the extent retention is required by Applicable Law, required or permitted by the DPA, or for the Company’s standard backup and archival processes. Sections 9 through 11, 13 through 15, and 17 survive termination or expiry of this Agreement.

Terms of Service — 17. General Provisions

Governing law and forum. Subject to Applicable Law, this Agreement is governed by the laws of the Province of Alberta and the federal laws of Canada applicable therein, without regard to conflict-of-laws principles. The Parties irrevocably attorn to the exclusive jurisdiction of the courts of the Province of Alberta sitting in the City of Calgary in respect of the enforcement or adjudication of any matter arising out of or relating to this Agreement, and each Party irrevocably waives, to the fullest extent permitted by Applicable Law, any objection it may now or hereafter have to the venue or jurisdiction of those courts, including any claim that any proceeding brought in those courts has been brought in an inconvenient forum.

Commercial purpose. The Consultant represents and acknowledges that it is entering into this Agreement in the course of its business or profession and for business purposes, and not for personal, family, or household purposes. The Consultant further acknowledges that the Platform is a professional tool made available only to licensed or otherwise qualified occupational health and safety consultants, and to other persons with responsibility for occupational health and safety within an organization, in each case acting in a business capacity, and that the Consultant is not acquiring the Platform as a consumer.

Notices. Notices under this Agreement shall be in writing and delivered by email to the address specified in the Order Form, or to such other address as a Party designates by notice given in accordance with this Section, and are deemed received on the date sent, provided no bounce-back or delivery failure is received by the sender.

Assignment. The Consultant may not assign this Agreement, in whole or in part, without the Company’s prior written consent. The Company may assign this Agreement, in whole or in part, in connection with a merger, acquisition, corporate reorganization, or sale of all or substantially all of its assets relating to the Platform, on notice to the Consultant.

Entire agreement. This Agreement, together with the Order Form, the Privacy Policy, and the DPA, constitutes the entire agreement between the Parties in respect of its subject matter and supersedes all prior discussions, negotiations, and agreements, whether written or oral, relating to that subject matter.

Severability. If any provision of this Agreement is held invalid or unenforceable, that provision shall be limited or eliminated to the minimum extent necessary, and the remaining provisions shall remain in full force and effect. Nothing in this Agreement limits or waives any right, benefit, or protection conferred on a Party by Applicable Law that cannot be limited or waived by agreement, and if any provision of this Agreement is unenforceable against a Party by reason of such a right, benefit, or protection, that provision applies to that Party only to the extent permitted by Applicable Law and the remainder of this Agreement continues in full force.

No waiver. No failure or delay by a Party in exercising any right under this Agreement operates as a waiver of that right, nor does a single or partial exercise of a right preclude any other or further exercise of it.

Force majeure. Neither Party is liable for any delay or failure to perform, other than an obligation to pay Fees, resulting from causes beyond its reasonable control, including natural disaster, act of government, labour dispute, internet or utility outage, or failure of a third-party AI model or infrastructure provider.

Relationship of the Parties. The Parties are independent contractors. Nothing in this Agreement creates a partnership, joint venture, agency, or employment relationship between the Parties.

Electronic execution. This Agreement may be executed electronically, including by way of the Consultant’s click-through acceptance where the Company makes the Platform available for online self-service subscription, and an electronic signature or acceptance has the same legal effect as a handwritten signature.

Amendments. The Company may update the terms of this Agreement from time to time on reasonable notice to the Consultant, except that Fees for the then-current Subscription Term may only be changed as set out in Section 2. Continued use of the Platform after an amendment takes effect constitutes acceptance of the amended terms.

No reliance. The Consultant confirms that it has not entered into this Agreement in reliance on any representation, warranty, or statement regarding the accuracy, completeness, or legal effect of any AI Output, Finding, or Report, other than as expressly set out in this Agreement, and that Section 6 and Section 13 reflect the Parties’ entire agreement as to the nature and limitations of the Platform’s compliance-related output.

Independent legal advice. Each Party acknowledges that it has had the opportunity to obtain independent legal advice with respect to this Agreement, that it has either obtained such advice or has knowingly and voluntarily elected not to do so, and that it is entering into this Agreement freely and without duress. The Consultant further acknowledges that the Company has not provided, and is not providing, legal advice to the Consultant in respect of this Agreement or in respect of the Consultant’s own professional or regulatory obligations.

Language. The Parties confirm their wish that this Agreement and all related documents be drawn up in English.

Terms of Service — 18. Contact

Questions regarding this Agreement may be directed to Northern Lights AI Inc. at bobbie@northernlightsai.ca, or by mail to 4504 56 Ave, Unit 1346, Lamont, Alberta T0B 2R0.

Schedule A — Subscription Plans

The following sets out the Company’s subscription plans as of the Effective Date. All Fees are stated in Canadian dollars (CAD) and are exclusive of applicable sales tax or value-added tax, which is calculated and collected by Paddle as merchant of record. The annual Fee for a plan is twelve (12) times the corresponding monthly Fee, and there is no additional per-audit discount for annual billing; the benefit of annual billing is a pooled audit allowance for the full year rather than a monthly reset, together with the bonus audits shown below, which are available on annual subscriptions only and are included in the pooled allowance shown, and not added to it.

Entry — Monthly: $29 CAD for 2 audits. Annual: $348 CAD for 25 pooled audits (includes 1 bonus audit).

Starter — Monthly: $69 CAD for 5 audits. Annual: $828 CAD for 62 pooled audits (includes 2 bonus audits).

Professional — Monthly: $209 CAD for 20 audits. Annual: $2,508 CAD for 245 pooled audits (includes 5 bonus audits).

Agency — Monthly: $559 CAD for 60 audits. Annual: $6,708 CAD for 728 pooled audits (includes 8 bonus audits).

The Company may update these plans, including the Fees, audit allowances, and bonus audits shown above, for a Renewal Term in accordance with Section 2 (Term and Renewal), or introduce additional or replacement plans from time to time on notice to the Consultant.

Privacy Policy

My Pocket Safety Specialist Platform — Last updated: October 2, 2026

Northern Lights AI Inc. (“we,” “us,” or the “Company”) operates “My Pocket Safety Specialist”, a subscription “Platform” used by professional occupational health and safety (“OHS”) consultants and other persons responsible for occupational health and safety within an organization (collectively, “Consultants”) to support their audit and compliance activities by analyzing their “Clients”’ safety practice and policy documents against applicable laws, regulations, codes, and other applicable industry standards, guidelines, and recognized practices relevant to occupational health and safety in a given jurisdiction or industry, including human rights, employment standards, and labour legislation to the extent it bears on occupational health and safety programs (collectively, “Safety Standards”). The Platform is a tool that assists a Consultant in performing an audit; it does not perform an audit, nor provide legal advice, and is not a substitute for the Consultant’s own review and professional judgment.

Privacy Policy — 1. Who We Are

Northern Lights AI Inc. is a corporation incorporated under the Canada Business Corporations Act (Corporation No. 1811928-7), with its registered office at 4504 56 Ave, Unit 1346, Lamont, Alberta T0B 2R0. For the purposes of applicable privacy legislation, we are the organization responsible for the Personal Information we collect directly from Consultants in connection with the Platform, as described in Section 3.

Privacy Policy — 2. Scope of This Policy

In this Policy, and for the purposes of our Terms of Service and our Data Processing Agreement, “Personal Information” means information about an identifiable individual. It does not include de-identified or aggregated data of the kind described in Section 9. Although privacy legislation may exclude business contact information used solely to communicate with an individual in relation to their employment, business, or profession, we apply this Policy to the Consultant business contact information described in Section 3 regardless of whether that information is technically excluded.

This Policy applies to Personal Information we collect through the Platform, our related website, and our communications with Consultants in connection with their subscription. It does not apply to a Consultant’s Clients or to individuals whose information may incidentally appear within an Uploaded Document; our relationship to that information is described in Section 8.

Privacy Policy — 3. What We Collect

Account information. When a Consultant subscribes, we collect the Consultant’s name, business or practice name, email address, mailing address, Consultant’s professional title, Consultant’s phone number, Consultant’s preferred pronouns are optional, the names of Clients, locations of Clients (jurisdiction), and billing information necessary to process payment.

Usage information. We collect information about how the Platform is used, such as login timestamps, audit counts, jurisdiction and industry selections, Confirmed Safety Standards confirmations, and feature interactions, to operate, secure, and improve the Platform and to administer subscription allowances.

Uploaded Documents. We receive the Clients’ safety practice documents which Consultants upload for analysis against Confirmed Safety Standards, and the resulting AI-generated Findings and Reports. These documents are supplied and controlled by the Consultant, as described in Section 8.

Communications. If a Consultant contacts us, including to flag missing Safety Standards or request support, we collect the content of that communication and any information the Consultant chooses to provide.

Technical and diagnostic information. We automatically collect limited technical information, such as IP address, browser type, device identifiers, and error logs, to maintain the security and reliability of the Platform.

Referral information. If a Consultant or other person participates in our referral program, we collect the information necessary to administer it, including the Referrer’s name, business or practice name, notice address, and any GST/HST registration number or tax residency declaration, withholding waiver application, or similar form we require in order to pay a Commission and satisfy our tax withholding and reporting obligations. Where a Consultant subscribes through a Referrer’s referral link, we record that the subscription was made through that link. We also retain the referral attribution, Commission, and Net Revenue records necessary to calculate and support amounts payable to a Referrer.

Privacy Policy — 4. How and Why We Use It

We use the Personal Information described in Section 3 to: create and administer the Consultant’s accounts and subscriptions; provide, operate, and maintain the Platform, including generating AI Output, Findings and Reports; process payment and manage billing; communicate with Consultants about their account, support requests, and changes to the Platform or this Policy; maintain the security, integrity, and proper functioning of the Platform, including detecting and preventing misuse; administer our referral program in accordance with our Referral Agreement, including verifying referral eligibility, attributing a Referred Consultant to a Referrer, calculating and paying Commissions, and meeting our related tax withholding and reporting obligations; and comply with our legal, regulatory, and contractual obligations.

Our authority to collect, use, and disclose Personal Information in this manner is the Consultant’s consent, given by subscribing to the Platform and agreeing to our Terms of Service, and, where applicable, our legitimate interest in operating and securing the Platform in a manner a Consultant would reasonably expect.

Privacy Policy — 5. Use of Artificial Intelligence

The Platform uses artificial intelligence models, including models operated by third-party AI infrastructure providers under contract with us, to generate the compliance analyses described in our Terms of Service. Account information is not used to train or fine-tune any underlying AI model. Uploaded Document content is processed by the relevant AI model solely to generate the Consultant’s Findings and is handled in accordance with our Data Processing Agreement and the confidentiality commitments of our AI infrastructure providers, who covenant that they restrict using that content to train models for other customers.

Privacy Policy — 6. Who We Share It With

We do not sell Personal Information. We disclose Personal Information only to: service providers who host, secure, and support the Platform (including cloud hosting and AI infrastructure providers), payment processors who handle billing, and professional advisors such as our accountants and lawyers, in each case bound by confidentiality and data protection obligations appropriate to the sensitivity of the information; a purchaser or successor in connection with a merger, acquisition, or sale of assets relating to the Platform, subject to that party assuming our obligations under this Policy; a Referrer, where a Consultant was referred by that Referrer, limited to the information necessary to confirm referral eligibility and to report and substantiate Commissions payable, and subject to the confidentiality and use restrictions in our Referral Agreement; and any party to whom disclosure is required by Applicable Law or a valid order of a court or regulator.

We maintain a current list of the service providers and sub-processors who may process Personal Information on our behalf, available on our website at https://www.mypocketsafetyspecialist.com/legal/subprocessors, including the name of each and the service it provides.

Privacy Policy — 7. Storage, Security, and Cross-Border Transfers

Where information is stored. Personal Information is stored using cloud infrastructure providers, which may store and process information in Canada, the United States, or other jurisdictions in which our service providers operate. Information disclosed to a service provider outside Canada may be accessible to that provider and to courts, law enforcement, and regulatory authorities in that jurisdiction under its laws.

Consent to storage outside the Consultant’s jurisdiction. By subscribing to the Platform and agreeing to our Terms of Service, the Consultant consents to our collecting, using, storing, and disclosing the Consultant’s Personal Information in Canada, the United States, and any other jurisdiction in which our service providers operate, and acknowledges that while in those jurisdictions the information is subject to their laws, including lawful requirements to disclose it to government authorities, courts, and law enforcement. Written information about our policies and practices with respect to service providers outside Canada, and the name or position of a person able to answer questions about the collection, use, disclosure, and storage of Personal Information by those service providers, may be obtained using the contact in Section 15, in accordance with Section 13.1 of the Personal Information Protection Act (Alberta) and, where it applies, the Personal Information Protection and Electronic Documents Act. The Consultant also consents to our disclosing the information described in Section 6 to a Referrer that may be located outside Canada, and acknowledges that while in that jurisdiction the information is subject to the laws of that jurisdiction.

Client Personal Information. Where an Uploaded Document contains Personal Information about a Client’s workers or other individuals, the Consultant is responsible for having given any notice, obtained any consent, and completed any assessment required under Applicable Law before that information is transferred to, stored in, or processed in the jurisdictions described above, including, where the Consultant or its Client is subject to Quebec’s Act respecting the protection of personal information in the private sector, the privacy impact assessment required by Section 17 of that Act. Section 8 continues to govern our role in respect of that information.

Security. We use administrative, technical, and physical safeguards appropriate to the sensitivity of the information involved, including access controls limiting each Consultant’s access to its own account and portfolio, encryption of information in transit, and contractual security requirements imposed on our service providers. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

Privacy Policy — 8. Uploaded Documents and the Consultant’s Clients

Uploaded Documents are supplied by the Consultant and generally consist of policies, procedures, and technical safety content rather than records about identifiable individuals. To the extent an Uploaded Document contains Personal Information about a Client’s workers or other individuals, that Personal Information is collected and controlled by the Consultant, not by us. As between us and the Consultant, the Consultant is responsible for ensuring it has the right to upload that information to the Platform, has obtained all third party consents (including consents from its Clients) with respect to the collection and disclosure of that information, and for complying with Applicable Law governing its own collection, use, and disclosure of it.

We process any such Personal Information solely as the Consultant’s service provider, strictly in accordance with the Consultant’s instructions as reflected in our Terms of Service and our Data Processing Agreement, and not for our own independent purposes, except on a de-identified and aggregate basis as described in Section 9.

Privacy Policy — 9. De-Identified and Aggregate Data

We may create de-identified or aggregated data derived from Uploaded Documents, Findings, and usage information, for example to improve the accuracy of the Platform’s analyses, expand the Safety Standards Library, or produce industry benchmarking. De-identified and aggregated data is processed and maintained in a form that does not identify, and could not reasonably be used to re-identify, any individual or Client, and we do not attempt to re-identify it.

Privacy Policy — 10. How Long We Keep Information

We retain account information for as long as the Consultant’s subscription remains active and for a reasonable period afterward to address billing, legal, audit, or dispute-resolution needs. We retain Uploaded Documents, Findings, and Reports for the period specified in our Terms of Service and Data Processing Agreement, after which they are deleted or returned to the Consultant in accordance with that agreement, except where retention is required by Applicable Law. We retain referral records, including referral attribution, Commission calculations, and supporting tax documentation, for as long as necessary to administer the referral relationship and thereafter for the period required by Applicable Law, including tax record-keeping requirements.

Privacy Policy — 11. Consultant Rights

Subject to applicable exceptions, a Consultant may request access to, and correction of, the Personal Information we hold about it, and may withdraw consent to certain uses of that information, subject to the effect withdrawal may have on our ability to provide the Platform. A Consultant may also request that we delete its account information, subject to our legal, regulatory, and contractual retention obligations. Requests may be directed to the contact in Section 15, and we will respond within the time required by Applicable Law.

Privacy Policy — 12. Children

The Platform is a professional tool intended for use by licensed or otherwise qualified OHS consultants, and by other persons responsible for OHS within an organization, in each case acting in a business capacity. It is not directed at, and we do not knowingly collect Personal Information from, children.

Privacy Policy — 13. If Something Goes Wrong

If we become aware of a breach of security safeguards involving Personal Information that creates a real risk of significant harm to an individual, we will notify affected Consultants and the applicable privacy regulator as required by Applicable Law, and will take reasonable steps to mitigate the harm. Our obligations to notify and assist the Consultant in respect of a breach affecting Personal Information the Consultant controls are further described in our Data Processing Agreement.

Privacy Policy — 14. Changes to This Policy

We may update this Policy from time to time to reflect changes to the Platform or Applicable Law. We will post the updated Policy with a new “last updated” date and, for material changes, will provide Consultants with reasonable advance notice through the Platform or by email before the change takes effect.

Privacy Policy — 15. Contact and Regulators

Questions, requests, or complaints regarding this Policy or our handling of Personal Information may be directed to Northern Lights AI Inc. at bobbie@northernlightsai.ca, or by mail to 4504 56 Ave, Unit 1346, Lamont, Alberta T0B 2R0. If a Consultant is not satisfied with our response, the Consultant may contact the Office of the Information and Privacy Commissioner of Alberta, or, where the Personal Information Protection and Electronic Documents Act applies, the Office of the Privacy Commissioner of Canada.

Data Processing Agreement

This Data Processing Agreement (this “DPA”) is entered into between Northern Lights AI Inc. (the “Company”) and the Consultant identified in the Order Form (the “Consultant”), and forms part of, and is incorporated by reference into, the Terms of Service between the Company and the Consultant (the “Agreement”). Capitalized terms used but not defined in this DPA have the meanings given in the Agreement.

DPA — 1. Purpose and Scope

This DPA governs the Company’s processing of Personal Information in connection with the Platform. It reflects the Parties’ shared understanding that no Personal Information is intended to be submitted to the Platform, and that Uploaded Documents will generally consist of policies, procedures, and technical safety content. This DPA nonetheless applies to the extent any Personal Information is processed through the Platform, whether contained in an Uploaded Document, in Consultant account information, or otherwise.

DPA — 2. Definitions

“Applicable Data Protection Law” means all laws and regulations applicable to the processing of Personal Information under this DPA, including without limitation and as applicable, the Personal Information Protection and Electronic Documents Act (Canada) and applicable Canadian provincial private-sector privacy legislation.

“Personal Information” means information about an identifiable individual that is processed by the Company on the Consultant’s behalf in connection with the Platform, including any such information that may be contained within an Uploaded Document or Consultant account information.

“Process” or “Processing” means any operation performed on Personal Information, including collection, recording, storage, use, disclosure, and destruction.

“Security Incident” means a breach of security safeguards leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Personal Information processed under this DPA.

“Sub-processor” means a third party engaged by the Company to process Personal Information on the Company’s behalf in connection with the Platform, including cloud hosting and AI infrastructure providers.

DPA — 3. Roles of the Parties

As between the Parties, the Consultant is the controller (or, under applicable terminology, the organization) responsible for any Personal Information contained in an Uploaded Document or otherwise submitted to the Platform, and the Company processes that Personal Information solely as the Consultant’s service provider (or, under applicable terminology, processor) acting on the Consultant’s behalf and instructions. In respect of Consultant account information collected directly from the Consultant for the Company’s own account administration, billing, and platform security purposes, the Company is the organization responsible for that information, as described in the Privacy Policy.

DPA — 4. Consultant Responsibilities

The Consultant represents and warrants that it has, and will maintain throughout the Subscription Term, all third party consents, authorizations, and legal bases necessary under Applicable Data Protection Law to submit any Personal Information contained in an Uploaded Document to the Platform and to permit the Company to process it in accordance with this DPA.

The Consultant shall not include in an Uploaded Document any Personal Information beyond what is reasonably necessary for the Company to generate the Findings, and in particular shall avoid including sensitive categories of information (such as health, financial account, or government identification information about identifiable individuals) unless reasonably necessary for the audit activities and as permitted under Applicable Data Protection Law.

The Consultant is solely responsible for determining whether an Uploaded Document should be submitted to the Platform at all, having regard to its own professional and legal obligations to its Client.

DPA — 5. Company Obligations

The Company shall: process Personal Information only as necessary to provide the Platform in accordance with the Agreement and the Consultant’s documented instructions as reflected in the Agreement, and not for the Company’s own independent purposes, except on a de-identified and aggregate basis as permitted under Section 9; ensure that personnel authorized to process Personal Information are subject to appropriate confidentiality obligations; implement the security safeguards described in Section 8; not sell Personal Information or disclose Personal Information to third parties for their independent marketing purposes; and notify the Consultant if, in the Company’s reasonable opinion, an instruction from the Consultant would require the Company to act in a manner inconsistent with Applicable Data Protection Law.

DPA — 6. Nature and Purpose of Processing

The Company processes Personal Information solely to: receive and store Uploaded Documents; generate AI Output and Reports by analyzing Uploaded Document content against Confirmed Safety Standards; maintain the security, integrity, and availability of the Platform; and provide support to the Consultant in connection with its use of the Platform.

The categories of Personal Information reasonably anticipated to be processed under this DPA are limited to: to the extent incidentally present in an Uploaded Document, the names, titles, or roles of individuals referenced in a Client’s safety practice documentation; and the Consultant’s own account contact and billing information. The data subjects are, correspondingly, individuals incidentally referenced in Uploaded Documents and the Consultant’s own personnel.

DPA — 7. Sub-processors

The Consultant authorizes the Company to engage Sub-processors to provide the Platform, including cloud hosting and AI infrastructure providers, provided the Company imposes on each Sub-processor data protection obligations no less protective than those in this DPA, and remains responsible to the Consultant for each Sub-processor’s performance of those obligations.

The Company will maintain a current list of its Sub-processors, available on its website at https://www.mypocketsafetyspecialist.com/legal/subprocessors, and will provide the Consultant with reasonable advance notice of the addition of a new Sub-processor that will process Personal Information. If the Consultant has concerns regarding a new Sub-processor, the Parties shall discuss the concern in good faith. Company is not required to modify its Sub-processor arrangements unless required by applicable law or expressly agreed by Company in writing.

DPA — 8. Security Safeguards

The Company shall maintain administrative, physical, technical, and organizational safeguards designed to protect Personal Information against unauthorized access, use, disclosure, alteration, or destruction, appropriate to the sensitivity of the information involved, including: access controls restricting each Consultant’s access to its own account and portfolio; encryption of Personal Information in transit; contractual security obligations imposed on Sub-processors; and logging and monitoring designed to detect unauthorized access.

DPA — 9. De-identified and Aggregate Data

The Company may create de-identified or aggregated data derived from Uploaded Documents and Findings to maintain, secure, and improve the Platform and the Safety Standards Library and any other purposes described in the Privacy Policy, provided that data is processed and maintained in a form that does not identify, and could not reasonably be used to re-identify, any individual, Client, or Consultant, and the Company does not attempt to re-identify it.

Nothing in this DPA restricts Company from using information that is not Personal Information, including de-identified data, aggregated information, technical performance data, statistical information, and learnings derived from operation of the Platform, provided that Company complies with the confidentiality obligations in the Agreement and does not re-identify individuals except as required to provide the Platform, investigate security issues, comply with applicable laws, or as otherwise permitted by Consultant in writing.

DPA — 10. Cross-Border Processing

The Consultant acknowledges that the Company’s Sub-processors may store and process Personal Information outside Canada, including in the United States, and that Personal Information so transferred may be accessible to courts, law enforcement, and regulatory authorities of that jurisdiction under its laws. The Company shall take reasonable steps to ensure that any such transfer is subject to a contractual commitment from the relevant Sub-processor to protect the Personal Information to a standard consistent with this DPA.

DPA — 11. Security Incidents

The Company shall notify the Consultant without undue delay after becoming aware of a Security Incident affecting Personal Information processed under this DPA, and shall provide the information reasonably available to the Company concerning the nature of the incident, the categories and approximate number of affected data subjects and records, the likely consequences, and the measures taken or proposed to address it, as that information becomes available. Where feasible, notification will occur within seventy-two (72) hours after becoming aware of the Security Incident.

The notice will include, to the extent reasonably available at the time of notice: a description of the nature of the Security Incident; the categories of Personal Information affected; the approximate number or categories of affected individuals, where known; the measures taken or proposed to contain, investigate, and remediate the Security Incident; any recommended steps for Consultant to mitigate risk to affected individuals; and a contact point for further information.

The Company shall take reasonable steps to contain, investigate, and remediate a Security Incident and shall reasonably cooperate with the Consultant in meeting the Consultant’s own notification obligations under Applicable Data Protection Law, including with respect to notifying affected individuals and applicable regulators, provided that nothing in this Section requires the Company to make any admission of fault.

DPA — 12. Individual Rights Assistance

If the Company receives a request from an individual to exercise a right under Applicable Data Protection Law in respect of Personal Information processed under this DPA, the Company shall promptly forward the request to the Consultant and shall provide reasonable assistance, at the Consultant’s expense for anything beyond ordinary support, to enable the Consultant to respond to the request.

DPA — 13. Retention, Return, and Deletion

The Company shall retain Uploaded Documents, Findings, and Reports for so long as reasonably necessary to provide the Platform during the Subscription Term, and for ninety (90) days following termination or expiry of the Agreement to permit the Consultant to retrieve them, after which the Company shall delete or de-identify them, except to the extent retention is required by Applicable Data Protection Law or the Company’s standard backup and archival processes, in which case the retained copies remain subject to this DPA until deleted in the ordinary course.

On the Consultant’s written request made within the period described above, the Company shall provide the Consultant with a reasonable opportunity to export its Uploaded Documents, Findings, and Reports before deletion.

Company may retain Personal Information to the extent required or permitted by applicable law, or as reasonably necessary for legal, regulatory, tax, audit, billing, security, fraud prevention, backup, disaster recovery, dispute resolution, or enforcement purposes. Any retained Personal Information remains subject to the confidentiality, security, and use restrictions in this DPA for as long as it is retained.

DPA — 14. Audit and Assurance

Consultant may request reasonable information about Company’s privacy and security practices, safeguards, Sub-processors, and Security Incident handling no more than once per calendar year, unless a Security Incident or documented material concern justifies additional requests. Company may satisfy such requests through written responses, security summaries, policies, diagrams, questionnaires, third-party reports, or other reasonable assurance materials, as determined by Company having regard to the nature of the request and the sensitivity of the information requested.

If a Security Incident affects Consultant’s Personal Information, or if Consultant has a documented and reasonable basis to believe that Company is materially non-compliant with this DPA, Consultant may request an audit of Company’s compliance with this DPA. Any audit will be subject to the following conditions: Consultant must provide reasonable prior written notice and describe the scope and basis for the audit request; the audit must be conducted during normal business hours and in a manner that does not unreasonably interfere with Company’s operations or compromise the security, confidentiality, or availability of the Services; the audit must be limited to matters reasonably related to the Security Incident or documented material concern; any auditor must be a qualified independent third party subject to confidentiality obligations acceptable to Company, unless the parties agree otherwise; the audit must not permit access to the Personal Information, Confidential Information, systems, or environments of other clients; Consultant is responsible for the costs of the audit unless the audit reveals material non-compliance by Company, in which case Company will reimburse Consultant for reasonable audit costs proportionate to the non-compliance; and all audit materials, findings, reports, and communications will be treated as Confidential Information of Company.

Company may implement additional routine compliance summaries, assurance reports, certifications, or third-party attestations in the future, but nothing in this DPA requires Company to obtain or maintain any specific certification or attestation unless expressly agreed in a separate written agreement.

DPA — 15. Liability

Liability arising out of or relating to this DPA is subject to the limitation of liability and indemnification provisions of the Agreement, which apply to this DPA as though set out in full.

DPA — 16. Term and Termination

This DPA takes effect on the Effective Date of the Agreement and remains in effect for as long as the Company processes Personal Information on the Consultant’s behalf in connection with the Platform, and terminates automatically on termination or expiry of the Agreement, subject to the survival of Sections 11 through 13, and 15.

DPA — 17. General

Order of precedence. If there is a conflict between this DPA and the Agreement in respect of the processing of Personal Information, this DPA governs to the extent of the conflict.

Governing law. Subject to Applicable Law, this Agreement is governed by the laws of the Province of Alberta and the federal laws of Canada applicable therein, without regard to conflict-of-laws principles. The Parties irrevocably attorn to the exclusive jurisdiction of the courts of the Province of Alberta sitting in the City of Calgary in respect of the enforcement or adjudication of any matter arising out of or relating to this Agreement, and each Party irrevocably waives, to the fullest extent permitted by Applicable Law, any objection it may now or hereafter have to the venue or jurisdiction of those courts, including any claim that any proceeding brought in those courts has been brought in an inconvenient forum.

Amendment. The Company may update this DPA from time to time to reflect changes in Applicable Data Protection Law or the Company’s Sub-processors, on the same notice terms as apply to amendments of the Agreement.

DPA — 18. Contact

Questions regarding this DPA may be directed to Northern Lights AI Inc. at bobbie@northernlightsai.ca, or by mail to 4504 56 Ave, Unit 1346, Lamont, Alberta T0B 2R0.

NORTHERN LIGHTS AI INC. — Name: Roberta Jacqueline Desrochers, Title: Director

CONSULTANT — Name: [Consultant Legal Name], Title: [Title]