Leave ADDENDUM

The terms contained in this Addendum (“Addendum”) shall only apply to the Services for Leave (“Leave” or “LOA”) listed on the Order Form and are incorporated into and made subject to the Mitratech Terms and Conditions (the “Agreement”) between Mitratech and Customer executing the associated Order Form.  

Definitionen

“Input” means any administrative text, structural leave parameters, job-essential criteria, or high-level case notes provided by Customer’s authorized Human Resources personnel for processing by the AI LOA Product. Input explicitly excludes raw, unredacted healthcare documentation and Protected Health Information (PHI). 

“Output” means the analysis, compliance tracking summaries, statutory leave framework mappings, and recommendations generated by the AI LOA Product based on the submitted Input. 

“Leave Management Module” means the internal machine learning and natural language processing application designed exclusively as an administrative decision-support tool for Human Resources personnel to evaluate leave of absence requests (e.g., FMLA and ADA baseline parameters). 

2. Scope of Use & Responsibility

2.1 Use. Leave utilizes automated language models and structured compliance logic to assist Customer in evaluating, tracking, and organizing employee leave requests. Customer explicitly acknowledges that Leave functions solely as an advisory decision-support tool. 

2.2 No Legal or Medical Advice. Leave does not provide legal, medical, or formal professional compliance advice. Leave of absence legislation involves intricate, shifting federal, state, and regional mandates; Customer retains absolute responsibility to consult its own legal counsel or qualified employment specialists for verified compliance determinations. 

2.3 No Automated Decisions. The Leave Management Module provides raw compliance data summaries and advisory recommendations for informational purposes only. The platform does not possess the operational authority to execute, authorize, or automate any adverse employment actions, leave denials, or accommodation rejections. Customer maintains sole operational discretion and legal liability for all final employment determinations (including leave denials, workplace accommodations, or terminations). Customer warrants that an authorized, qualified human HR representative shall review all platform recommendations prior to executing any final employment action or policy implementation. 

3. Operational Interdependency & Warranty

3.1 Input Dependency. Customer acknowledges that the accuracy, context, and structural utility of the platform’s Output are directly dependent on the clarity, completeness, and administrative precision of the Input provided by Customer’s staff. Mitratech carries no liability for incorrect system recommendations generated from ambiguous, incomplete, or flawed data entries. 

3.2 Processing Warranty. Reciprocally, Mitratech warrants that the underlying platform shall process compliant customer inputs in strict accordance with standard programmed statutory leave frameworks (e.g., FMLA and ADA guidelines) as updated by Mitratech in the ordinary course of standard product lifecycle maintenance. 

3.3 Nature of Output. Customer acknowledges that the Output generated by the Leave Management Module is probabilistic in nature, reflecting statistical natural language analysis rather than absolute mathematical or clinical certainty. While Mitratech updates statutory leaf frameworks in the ordinary course of business, the Output does not constitute an official statutory legal record or an infallible compliance log. Customer carries the sole operational burden to cross-verify time-sensitive filing deadlines or statutory eligibility caps against current jurisdictional mandates. 

3.4 Limitation on Operational Feasibility. Recommendations regarding workplace modifications, schedule adjustments, or job-essential criteria generated by the platform are structural compliance mappings only. The Leave Management Module cannot evaluate the specific operational feasibility, safety parameters, or undue hardship thresholds of Customer’s unique physical or corporate environments. Customer retains sole liability for determining the ultimate reasonableness of any workplace accommodations. 

4. Strict Privacy, Data Isolation & Training Prohibitions

4.1 Model Training Restriction. Notwithstanding any provision to the contrary within the Agreement or any incorporated Data Privacy Addendum (DPA), Mitratech explicitly warrants that all Input and Output processed by the AI Leave Management Module shall remain strictly isolated within Customer’s dedicated tenant instance. Mitratech is strictly prohibited from using, sharing, or retaining Customer’s Input, Output, or any data derived therefrom to train, retrain, fine-tune, or improve any generalized, public, commercial, or multi-tenant large language models (LLMs) or machine learning algorithms. 

4.2 Permitted Use, PHI Exclusion. Leave is designed exclusively for administrative metrics and high-level structural parameters and is not intended to function as a persistent repository or processing engine for raw medical records or Protected Health Information (PHI) governed by the Health Insurance Portability and Accountability Act (HIPAA). Customer warrants that its authorized HR users shall not input or upload raw medical files, or unredacted physician certificates.

4.3 Automated Scrubbing. To safeguard against inadvertent operational data spills, Leave utilizes an automated programmatic ingestion gate engineered to scan, identify, redact, and permanently scrub common structural personal identifiers and raw medical markers (such as Social Security numbers, exact dates of birth, or explicit medical diagnostic strings) at the ingestion layer prior to algorithmic analysis. Mitratech explicitly disclaims any status as a HIPAA Covered Repository or Business Associate for this module, and no unredacted health data shall be committed to persistent database storage. 

4.3 Information Security, AI Transparency, and Compliance Audits. Mitratech shall maintain a formal, documented information security program containing administrative, technical, and physical safeguards designed to protect the security, confidentiality, and integrity of Customer’s Input and Output. 

1. Technical Controls and Architecture. Mitratech ensures that the Leave Management Module operates within a secure multi-tenant hosting infrastructure utilizing logical data isolation at the database layer to prevent cross-tenant data leakage. Security controls shall include, at a minimum: (i) industry-standard encryption protocols for data both in-transit (TLS 1.2 or higher) and at-rest (AES-256); (ii) restricted multi-factor authentication (MFA) for administrative access; (ii) automated application-layer security screening designed to mitigate prompt injection vulnerabilities and malicious inputs; and (iv) programmatic session-handling that prevents the persistent caching or logging of raw transactional data outside of active operational processing. 
2.  Verification and Independent Audits. Mitratech warrants that its operational security controls for the hosting environments utilizing the Leave Management Module are evaluated periodically by qualified, independent third-party auditors against recognized trust criteria frameworks. No more than once annually, and upon written request, Mitratech shall provide Customer with an executive summary of its then-current independent security audit report (e.g., Service Organization Control (“SOC”) report) and a completed industry-standard security questionnaire (e.g., SIG or CAIQ), subject to appropriate non-disclosure restrictions. Customer acknowledges that report formats, testing scopes, and audit tiers will evolve in alignment with the product’s development and compliance lifecycles. Notwithstanding the foregoing, on-site or physical audits shall not be permitted, except strictly in the event of an un-remediated, confirmed data security Incident impacting Customer’s data. In such a limited event, Customer’s certified, independent third-party auditors may conduct a targeted, on-site security review, subject to the following strict conditions: (i) Customer must provide a minimum of five (5) business days’ prior written notice; (ii) any such review shall be limited exclusively to the specific systems, logs, and personnel directly associated with the impacted tenant instance; (iii) the audit must be conducted during standard business hours in a manner that minimizes disruption to Mitratech’s operations; (iv) Customer shall bear all costs associated with such audit; and (v) under no circumstances shall Customer or its auditors be granted physical or logical access to Mitratech’s underlying source code, proprietary algorithms, or data belonging to other tenants. 

5. Liability Exclusions,Indemnity, & Use

5.1 Specific Risk Allocation. Notwithstanding any general liability parameters in the Agreement, Mitratech explicitly disclaims, and shall carry zero liability for, any third-party employment-related claims, regulatory enforcement actions, labor fines, or statutory penalties incurred by Customer arising from: (i) Customer’s direct reliance on platform Output, (ii) Customer’s failure to independently cross-verify platform summaries against prevailing local statutes, or (iii) any final adverse employment determinations executed by Customer’s personnel. 

5.2 Customer Indemnity. Customer agrees to defend, indemnify, and hold harmless Mitratech against any third-party actions, regulatory complaints, or employee lawsuits resulting directly from Customer’s failure to implement the mandatory “Human-in-the-Loop” review required under Section 2.3, or from Customer’s systemic failure to instruct its personnel on the data entry restrictions set forth in Section 4.2. 

5.3 Acceptable Use. Customer shall not, and shall ensure its authorized HR personnel do not: (a) utilize adversarial prompting, jailbreaking techniques, or systemic prompt injections designed to bypass platform safety filters or manipulate the core model logic; (b) use automated scraping tools or scripts to extract generalized compliance mapping datasets from the platform; or (c) leverage the Output to reverse-engineer or clone competitive leave-of-absence automated workflows 

6. Priority of Terms

6.1 Order of Precedence. In the event of any direct conflict or ambiguity between the provisions of this Product Addendum and the Agreement, the provisions of this Addendum shall control.