Master Subscription Agreement

• "Services" means the HazProof web application, the iOS and Android apps, APIs, AI Features, and related documentation, as described in an Order Form.
• "Order Form" means an ordering document or online checkout that references this Agreement. It sets out the Services, the number of users or projects, the fees, and the Subscription Term.
• "Customer Data" means data and content the Customer or its Users submit to the Services, including records of JHAs, meetings, inspections, observations, incidents, injuries and illnesses, witness statements, lift plans, training, photos, signatures, and location data, plus Output that a User saves into a record.
• "User" means an individual the Customer authorizes to use the Services: employees, subcontractor personnel, or others the Customer invites.
• "AI Features" means features that use machine learning or large language models, including the OSHA Advisor, incident copilot, intake assist, JHA assist and insights, photo write-ups, toolbox topics, and safety summaries. "Output" means content an AI Feature generates.
• "Safety Content" means templates, hazard libraries, inspection forms, regulatory references, calculators (including lift-plan and load-chart calculations), risk codes, guidance, and Output.
• "Workplace Records" means records the Customer must keep under occupational safety, workers' compensation, employment, or other law, including OSHA Forms 300, 300A, and 301 and the privacy-case list.

2.1 Access. Subject to this Agreement and payment, HazProof grants the Customer, during the Subscription Term, a non-exclusive, non-transferable, non-sublicensable right for its Users to access and use the Services for the Customer's internal business purposes.

2.2 Users. The Customer is responsible for its Users' acts and omissions as if they were its own. It must keep credentials confidential, assign roles, and remove access promptly when a User leaves.

2.3 Updates. HazProof may update the Services. It won't materially reduce the core functionality of a paid Service during the current Subscription Term. Purchases don't depend on any future feature.

2.5 Offline use. Records created offline stay on the device until they sync. The Customer is responsible for making sure critical records have synced. HazProof isn't liable for data lost on a device before it syncs.

2.6 Affiliates. A Customer Affiliate may buy Services by signing its own Order Form that refers to this Agreement. For that Order Form, the Affiliate is the "Customer" and is responsible for it. The Customer that signed this Agreement remains jointly responsible for any Affiliate it authorizes. "Affiliate" means an entity that controls, is controlled by, or is under common control with a party, where control means owning more than 50% of the voting interests.

2.7 Support. HazProof provides support under its Support Policy at hazproof.com/support, as updated from time to time. Unless an Order Form says otherwise, support is by email during business hours (Central Time). Response times are targets, not commitments, and no service-level credits apply.

2.8 Feature changes and discontinuation. HazProof may add, change, replace, or retire features. If it retires a material feature of a paid Service during a Subscription Term without offering a reasonably comparable replacement, it will give at least 60 days' notice. If that retirement materially reduces the Service, the Customer may terminate the affected Order Form and receive a pro-rata refund of prepaid, unused fees. That is the Customer's sole remedy.

3.1 Fees are as stated in the Order Form and are due within 30 days of invoice unless the Order Form says otherwise. Except as this Agreement expressly provides, fees are non-cancelable and non-refundable.

3.2A Renewal pricing. Fees for each renewal term may increase to HazProof's then-current pricing for the same Services. HazProof will give written notice of any increase at least 75 days before the renewal date, so the Customer can decide whether to renew before the non-renewal deadline. Unless the Order Form caps increases, renewal at the new price is accepted if the Customer doesn't give notice of non-renewal.

3.3 Late payment. Overdue amounts accrue interest at the lesser of 1.5% per month or the maximum lawful rate. HazProof may suspend access after 15 days' written notice of non-payment. A suspension never deletes Customer Data, and the Customer may still export its Workplace Records while suspended.

3.3A No set-off; acceleration; collection. The Customer will pay all amounts without set-off, deduction, counterclaim, or withholding. Disputes over an invoice must be raised in good faith in writing within 30 days of the invoice date, and the undisputed portion must still be paid on time. If any undisputed amount is more than 30 days overdue, HazProof may, after written notice, declare all unpaid fees for the remainder of the current Subscription Term immediately due. The Customer will reimburse HazProof's reasonable costs of collection, including attorneys' fees.

3.4 Taxes. Fees exclude taxes. The Customer pays all applicable taxes except taxes on HazProof's income.

4.1 Ownership. As between the parties, the Customer owns Customer Data, including Output saved into a record.

4.2 License to HazProof. The Customer grants HazProof a worldwide, non-exclusive, royalty-free license to host, copy, process, transmit, and display Customer Data only to provide, secure, support, and maintain the Services, to comply with law, and as the Customer instructs.

4.3 DPA. The Data Processing Addendum (Exhibit B) is part of this Agreement. HazProof is the Customer's processor for Customer Personal Data.

4.4 No sale; no AI training. HazProof doesn't sell Customer Data, use it for advertising, or use Customer Data, prompts, or Output to train or fine-tune AI models, and it doesn't allow its AI subprocessors to do so.

4.5 Usage data and aggregated data. HazProof may collect technical, usage, and performance data about the Services ("Usage Data") and may create Aggregated Data. Aggregated Data is data derived from Customer Data or Usage Data that is de-identified and combined with other data so that it doesn't identify, and can't reasonably be used to identify, the Customer, any project or jobsite, any User, or any individual. HazProof owns Usage Data and Aggregated Data. It may use them during and after the Term for any lawful purpose, including operating, securing, and improving the Services, benchmarking, and industry statistics. HazProof won't try to re-identify Aggregated Data, won't disclose Aggregated Data that identifies the Customer, and won't use Customer Data or Aggregated Data to train AI models (§4.4).

4.6 Customer responsibilities for data. The Customer is solely responsible for (a) the accuracy, quality, legality, and completeness of Customer Data; (b) having all rights, notices, and consents needed to collect it and submit it, including notices to workers about photographs, GPS stamping, and any electronic-monitoring notice state law requires; and (c) deciding which Users may see injury, illness, and treatment information.

4.7 Feedback. If the Customer or its Users give HazProof suggestions, ideas, enhancement requests, or other feedback about the Services ("Feedback"), the Customer assigns to HazProof all right, title, and interest in that Feedback. To the extent an assignment isn't effective, the Customer grants HazProof a perpetual, irrevocable, worldwide, royalty-free, sublicensable license to use Feedback for any purpose. Feedback isn't the Customer's Confidential Information. HazProof won't publicly identify the Customer as the source of Feedback without consent.

5.1 HazProof maintains reasonable administrative, technical, and physical safeguards suited to the sensitivity of Customer Data, as described in Exhibit B, Annex 3. HazProof won't describe a security control in marketing, questionnaires, or this Agreement unless it is actually in place.

5.2 HazProof answers one reasonable security questionnaire per year and provides its third-party assessment report, when one exists, under NDA.

6.3 Electronic records. OSHA allows recordkeeping by computer if the system can produce equivalent forms when needed (29 CFR 1904.29(b)(4)–(5)). The Customer must keep its own exports of Workplace Records and must not rely on the Services as its only copy.

6.4 No reliance by third parties. The Services and Safety Content are provided only for the Customer's use. HazProof makes no representation to, and assumes no duty toward, the Customer's employees, subcontractors, project owners, insurers, or any other third party.

7.1 The Customer won't, and won't allow anyone to: resell or sublicense the Services; reverse-engineer them (except where the law allows); access them to build a competing product; probe or test their security without written consent; get around access controls; or use the Services in violation of law or of Exhibit C.

7.2 The Customer won't use the Services as the sole means of stopping or controlling physical equipment, or for emergency response. HazProof isn't an emergency service. Call 911.

7.3 The Customer won't let anyone under 18 hold an account.

7.4 Prohibited data. The Customer won't upload: employee medical records or exposure records under 29 CFR 1910.1020 (which must be kept for the duration of employment plus 30 years, or 30 years); protected health information subject to HIPAA where the Customer is a covered entity or business associate; Social Security numbers, government ID numbers, or financial-account numbers; or data of children under 13. HazProof has no obligation to retain prohibited data for any period and has no liability for it.

8.1 Each party will protect the other's Confidential Information with at least reasonable care, use it only to perform this Agreement, and disclose it only to personnel and advisors who need to know it and are bound by similar duties. The usual exclusions apply: information that is public, already known, independently developed, or rightfully received from someone else.

8.2 Customer Data is the Customer's Confidential Information.

8.3 Compelled disclosure. A party may disclose Confidential Information when the law requires it, after giving prompt notice where lawful and reasonable help to seek protection, at the disclosing party's expense.

8.4 Subpoenas for Customer Data. HazProof will try to redirect requests for Customer Data to the Customer, and will preserve and produce data only as Exhibit B §10 provides. The Customer reimburses HazProof's reasonable costs (including attorneys' fees) of responding to subpoenas or discovery about the Customer's projects, incidents, or disputes when HazProof isn't a party.

Exhibit A governs AI Features. Administrators can turn AI Features off for the organization.

10.1 This Agreement lasts until all Order Forms have expired or been terminated.

10.2 Either party may terminate an Order Form for the other's material breach that isn't cured within 30 days of written notice, or immediately if the other party becomes insolvent or makes an assignment for the benefit of creditors. HazProof may also terminate on written notice if (a) undisputed fees remain unpaid 30 days after the suspension notice under §3.3, or (b) the Customer materially breaches §7, §7.5, or Exhibit C.

10.3 Export Window. For 90 days after termination or expiration (the "Export Window"), HazProof keeps Customer Data available for the Customer to export, including OSHA 300/300A/301 PDFs, ITA-compatible CSV, record tables (CSV), photos, and signatures (original files). THE CUSTOMER ACKNOWLEDGES THAT IT MUST KEEP CERTAIN WORKPLACE RECORDS FOR 5 YEARS OR LONGER, AND THAT IT MUST EXPORT OR ARCHIVE THEM BEFORE THE EXPORT WINDOW ENDS. HazProof sends at least two written reminders during the Export Window.

10.4 Deletion. Within 30 days after the Export Window ends, HazProof deletes Customer Data, subject to Exhibit B §9.4 (legal requirements, legal holds, and backups until they expire). It gives written confirmation on request.

10.5 Refunds on termination. If the Customer terminates for HazProof's uncured material breach, HazProof refunds prepaid fees for the remaining term. If HazProof terminates for the Customer's breach, the remaining fees for the current term become due.

10.6 Survival. Sections 1, 2.4, 3 (amounts owed), 4 (including 4.5 and 4.7), 6, 7.4, 7.5, 8, 10.2A (as to data access), 10.3–10.6, 12–22, Exhibit A (A.2, A.6, A.7, A.9–A.11), and any other provision that by its nature should survive, survive any termination or expiration.

11.1 Mutual. Each party represents that it has authority to enter this Agreement.

11.2 HazProof. HazProof warrants that (a) the paid Services will perform materially in accordance with the documentation, and (b) it won't knowingly introduce malicious code. The Customer's exclusive remedy, and HazProof's entire liability, for breach of this warranty is for HazProof to fix the non-conformity or, if it can't within 30 days of notice, for either party to terminate the affected Service with a pro-rata refund of prepaid, unused fees..)

11.3 Customer. The Customer warrants that its use of the Services and Customer Data complies with law and that it has every right and consent needed under §4.6.

13.1 By HazProof (IP). HazProof will defend the Customer against any third-party claim alleging that the Services, as provided by HazProof and used under this Agreement, infringe a U.S. patent, copyright, or trademark or misappropriate a trade secret. HazProof will pay damages finally awarded or settlements HazProof agrees to. Exclusions: modifications not made by HazProof; combinations with items HazProof didn't provide; Customer Data; Output; beta or free features; and use in breach of this Agreement. HazProof may procure a license, modify or replace the Service, or terminate it and refund prepaid, unused fees. This is HazProof's entire liability for infringement claims.

13.3 Procedure. The indemnified party gives prompt written notice, sole control of the defense and settlement to the indemnifying party (no settlement imposing obligations or admissions on the indemnified party without its consent, not to be unreasonably withheld), and reasonable cooperation at the indemnifying party's expense.

13.4 Exclusive remedy. This Section 13 states each party's entire liability, and the other party's exclusive remedy, for third-party claims described in it.

14.5 The parties agree these limits are an essential basis of the bargain and apply even if a limited remedy fails of its essential purpose. They don't limit liability that can't lawfully be limited.

15.1 HazProof insurance. HazProof will maintain, at its own expense, with insurers it reasonably selects: technology errors-and-omissions (professional) liability combined with network-security and privacy (cyber) liability; and commercial general liability. Limits are stated in the Order Form or on a certificate available on request. HazProof's insurance doesn't expand its liability under §14.
15.2 Customer insurance. The Customer is responsible for its own workers' compensation, employer's liability, commercial general liability, and other insurance for its operations and jobsites. Nothing in this Agreement makes HazProof an additional insured or a substitute for that coverage, and the Customer's insurers have no right of subrogation against HazProof for losses covered by §13.2, to the extent the Customer's policies allow it to waive subrogation.

HazProof may name the Customer as a customer only with the Customer's prior written consent (an email is enough).

HazProof may update this Agreement for online customers with at least 30 days' notice to Admins. A change that materially reduces the Customer's rights doesn't apply until the next renewal. If the Customer objects, it may terminate within 30 days of the notice and get a pro-rata refund (benchmark: SafetyCulture/Mitti §20). A signed Order Form's negotiated terms control during its term.

Each party complies with U.S. export and sanctions laws. If the Customer is a U.S. government entity, the Services are "commercial computer software" under FAR 12.212 and DFARS 227.7202.
Sanctions representation. Each party represents that it is not on, and is not owned or controlled by anyone on, a U.S. sanctions or restricted-party list, and that it won't allow access to the Services from a comprehensively sanctioned country or region.
Anti-bribery. Each party will comply with the U.S. Foreign Corrupt Practices Act and other applicable anti-bribery and anti-corruption laws. Neither party has offered or will offer any improper payment or thing of value to influence this Agreement or any purchase decision. Modest customary business courtesies are permitted.

Neither party may assign this Agreement without consent, except to a successor in a merger, acquisition, or sale of substantially all related assets that assumes this Agreement in writing. HazProof may use subcontractors and subprocessors under Exhibit B. Neither party is liable for delay caused by events beyond its reasonable control (excluding payment obligations), including outages of internet, cellular, or cloud providers.

20.1 Governing law. Texas law governs this Agreement and any dispute relating to it or to the Services, without regard to conflict-of-law rules. The UN Convention on Contracts for the International Sale of Goods and UCITA don't apply.

20.6 Attorneys' fees. The prevailing party in any action to enforce this Agreement may recover reasonable attorneys' fees and costs.

20.7 DTPA. The Customer acknowledges that it is a business consumer with knowledge and experience in business matters that enable it to evaluate the merits and risks of this transaction, and that it isn't in a significantly disparate bargaining position.

Notices to HazProof go to legal@hazproof.com and. Notices to the Customer go to the Admin email and the address in the Order Form. Email notice is effective on sending unless a bounce is received.

A.1 What AI Features do. AI Features generate drafts and suggestions, for example hazard and control suggestions for a JHA, an incident narrative or root-cause prompts, a write-up of a photo observation, toolbox topics, or general answers about OSHA regulations ("OSHA Advisor"). Output is generated by third-party models (currently Anthropic) and isn't reviewed by HazProof.

A.3 Qualified human review required. The Customer must make sure a competent or qualified person with the authority to change it reviews Output before it is (a) relied on in the field; (b) saved into a JHA, lift plan, incident record, or OSHA form; (c) used in any decision about a worker (discipline, fault, fitness for duty, pay, or employment); or (d) given to anyone as advice. The Services label Output "AI-assisted" and record who reviewed it. The Services will not finalize a JHA, a recordability determination, or a lift plan from Output without a named human approval.

A.4 Disclosure. When the Customer gives Output, or a decision based on Output, to a worker or third party, the Customer will disclose that AI was used.

A.5 Inputs. The Customer is responsible for Inputs. It shouldn't enter names, medical details, or identifiers unless they're needed. HazProof pseudonymizes names and witness identities before sending them to the model provider. Inputs may be kept by the model provider for up to 30 days for abuse monitoring unless zero-data-retention applies.

A.6 Ownership; no training. Inputs and Output are Customer Data. Neither HazProof nor its model providers train models on them. Output may be similar to Output generated for others.

A.8 Off switch. Administrators may disable all or individual AI Features.

A.9 NON-UNIQUE OUTPUT. Because of how AI models work, the same or similar Output may be generated for other customers or users. The Customer doesn't gain exclusive rights in Output that is the same as or similar to Output provided to others, and HazProof makes no representation that Output is original or can be protected by copyright.

A.10 No misrepresentation of Output. The Customer won't present Output as human-written, or as reviewed or approved by a qualified person, unless a qualified person actually reviewed and approved it under A.3. It won't remove or hide the "AI-assisted" label in a way that could mislead a worker, regulator, or third party.

Data Processing Addendum: available at hazproof.com/dpa or from legal@hazproof.com.

Don't: upload unlawful content or content you have no right to use; harass anyone or use records to retaliate against anyone for reporting an injury; upload prohibited data (§7.4); attempt to access another organization's data; interfere with the Services; use the Services to falsify safety records or signatures; or impersonate a signer. Signatures captured for attendees on a shared device must name the attendee and the person presenting the device.

D.1 You use HazProof at the invitation of an organization (your "Organization"). Your Organization controls the records you create, including incident reports, statements, JHAs, and signatures, and those records belong to your Organization.

D.2 You aren't responsible for your Organization's fees or contract obligations.

D.3 Record information honestly. Don't sign for anyone else. Keep your login and device secure. Make sure offline records have synced before you sign out.

D.4 HazProof is a recordkeeping tool. It isn't safety, legal, or medical advice. Follow your Organization's safety rules and your supervisor's instructions, and stop work if it's unsafe. AI suggestions may be wrong and must be reviewed. In an emergency, call 911.

D.5 Reporting injuries is your right. Federal law prohibits employers from retaliating against you for reporting a work-related injury or illness (29 CFR 1904.35(b)(1)(iv); OSH Act §11(c)). You may file a retaliation complaint with OSHA within 30 days (whistleblowers.gov/complaint_page). HazProof never shares your records with anyone except your Organization and its processors as the Privacy Policy describes.

D.6 You may delete your HazProof login in the app (You → Delete account) or at hazproof.com/account-deletion. Records your Organization must keep stay with your Organization.

D.7 Liability. To the maximum extent the law allows, HazProof provides the apps to you "as is" and isn't liable to you for indirect or consequential damages. Nothing here limits liability for HazProof's gross negligence or willful misconduct, or rights you have under workers' compensation or employment law against your employer.

D.8 Texas law governs.

These terms are between you and Opynbox, not Apple or Google. Apple and Google have no obligation to provide maintenance or support, and they aren't responsible for claims about the app (product liability, failure to meet legal or regulatory requirements, consumer protection, IP). If the app fails a warranty, you may notify Apple, which may refund the purchase price (if any) and has no other warranty obligation. You represent that you're not in an embargoed country or on a restricted-party list. Apple and its subsidiaries are third-party beneficiaries of these terms.

Customer legal name and address · Admin contact · Services and plan · Users/projects · Subscription Term and start date · Fees and invoicing · Renewal (yes/no) · Renewal price cap (if any) · Affiliates authorized · AI Features (on/off at start) · Archive plan (yes/no) · Data Protection Super-Cap · HazProof insurance limits · Special terms · Signatures.