Terms of Service

How this document works. The Master Terms below apply to every Sentinel product. Each product also has its own Product Schedule that adds product-specific provisions (covered scope, pricing, deliverables, refund mechanics, specialty disclosures). Master Terms + the applicable Schedule together form your agreement with us for that product. If any provision in a Schedule conflicts with the Master Terms, the Schedule controls for that product only.

These Master Terms govern your use of any service ("Service") offered by Sentinel Risk Group, LLC, a Florida limited liability company ("Sentinel," "we," "our," "us"), through the website at sentinelriskgrp.com and any related properties.

These Master Terms apply to every Sentinel product. Each product also has its own Product Schedule that adds product-specific provisions. Master Terms + the applicable Product Schedule together form your agreement with us for that product. If any provision in a Schedule conflicts with these Master Terms, the Schedule controls for that product only.

By purchasing, engaging, or accessing any Sentinel Service, you accept these Master Terms and the applicable Product Schedule. If you do not agree, do not purchase or use the Service.

We may modify these Master Terms or any Schedule from time to time. Modifications become effective when posted with a new Effective Date. Material changes will be communicated by email to active customers at least ten (10) days before they take effect where practicable. Continued use of the Service after the Effective Date constitutes acceptance.

• "Service" means any Sentinel product, including AI Governance Shield™ certification (and its specialty variants such as the Behavioral Health overlay), the free risk-assessment screening tool, and any future products added under their own Schedule.
• "Deliverables" means the documents, certifications, reports, training materials, and supporting artifacts we deliver to you under a Service.
• "Practice" or "Client" means the healthcare entity, behavioral health entity, or other organization that purchases or engages a Service.
• "You" or "your" means the natural person or entity that purchases, engages, or accesses a Service.

Sentinel Risk Group, LLC is not a law firm and does not provide legal advice. Use of any Sentinel Service does not create an attorney-client relationship. Sentinel's preparation of governance documentation, intake-driven assessments, and reviewer-validated reports is not the practice of law and is conducted consistent with Florida Bar Rule 10-2.1 (defining the practice of law) and the safe-harbor principles articulated in Florida Bar v. Sperry, 140 So. 2d 587 (Fla. 1962) (computer software with conspicuous notice that the product is not a substitute for legal advice). Customer is the filer and signatory of record on any Deliverable submitted to a third party; Sentinel does not file, submit, or transmit Deliverables on Customer's behalf. Deliverables are professional governance evaluation, certification, training, and advisory documentation prepared from your intake responses, your provided evidence, your AI vendor agreements, and the published policies of relevant regulatory bodies, applying the proprietary AI Governance Shield™ Method.

The professionals who designed the Sentinel methodologies do not provide legal services to customers through Sentinel. If your matter requires legal representation — drafting a contract, negotiating an enforcement action, defending litigation, advising on regulatory exposure — retain a licensed attorney in your jurisdiction. Selection and retention of an attorney is your decision alone.

You are the author and signatory of record for any decision based on a Sentinel Deliverable. We provide evaluation and certification; you remain the responsible decision-maker for your practice's operations.

Many Sentinel Services use software, including automated systems and large-language-model artificial-intelligence tools, in the production of Deliverables. This is true of the AI Governance Shield certification process (initial AI-assisted analysis followed by qualified-reviewer validation, per Schedule H.5) and the risk-assessment screening tool, among others.

AI-assisted generation does not change the no-attorney-client-relationship posture of any Service, the no-outcome-guarantee posture in §9, or your responsibility as the decision-maker for your practice. Every Deliverable that depends on AI-assisted analysis goes through a qualified-reviewer validation step before delivery; the specific workflow is described in the applicable Schedule.

AI-generated materials can contain errors. You are expected to review any Deliverable, ask questions, and surface inaccuracies before relying on the content in any high-stakes decision. We will correct factual inaccuracies on request.

We use models from third-party providers (currently including Anthropic, Inc.) under their respective commercial usage policies. We do not train AI models on your intake content; intake content is processed for the purpose of preparing your Deliverable and retained per the Sentinel Privacy Policy.

You represent and warrant that:

(a) You are authorized to engage Sentinel on behalf of your Practice or to enter into this agreement individually for the Service.

(b) The information you provide at intake — about your AI systems, vendor agreements, patient population, jurisdictional footprint, and governance posture — is true, accurate, and complete to the best of your knowledge.

(c) You will not use the Service to evade court orders, regulatory enforcement actions properly imposed by law, or contractual obligations to third parties (including but not limited to malpractice carriers and HIPAA business associates).

We may decline to deliver a Service, or refund a fee paid, if we determine in good faith that the Service is being requested for a purpose described in (c).

We never request, and you should never share with us, login credentials, passwords, two-factor codes, session tokens, or production access to your AI vendor systems. Any process that asks for these is a security risk; report it to us via the contact channel.

Identity-verification document parity rule. The same posture applies to identity-verification documentation required by any third party (e.g., regulatory submission, vendor verification, or platform-imposed identity verification frameworks). Where a Service prepares documentation referencing identity values, your Deliverable is drafted with placeholders ([LEGAL NAME], [TAX ID], [LICENSURE NUMBER], etc.); you fill those values in from your own records before submission. Sentinel does not request, collect, store, or transmit your government ID, passport, license documents, social security number, or any identity-verification documents.

You may not use any Sentinel Service:

• For an entity that is not yours or for which you do not have lawful authority to engage on
• To submit knowingly false, misleading, or fraudulent information to Sentinel
• To represent, or to imply that Sentinel certified, assessed, or endorsed something Sentinel did not actually evaluate
• To evade enforcement actions properly imposed by law enforcement, courts, or regulators
• To circumvent privacy laws (HIPAA, 42 CFR Part 2, state behavioral-health privacy statutes, etc.) applicable to your Practice
• For any purpose prohibited by applicable law in your jurisdiction or the United States

Violation of this Section 6 is grounds for immediate termination of the Service without refund and may be reported to applicable regulators or law-enforcement authorities.

Pricing for each Service is set in the applicable Product Schedule. Payment is processed by Stripe (or, where a Schedule specifies, an alternative processor identified in that Schedule).

Where a Service has covered-scope criteria and your engagement falls outside coverage, refund mechanics are described in the applicable Schedule. Where a Service is delivered as scoped, fees are non-refundable absent our error.

No refund where eligibility was misrepresented. The out-of-scope refund in any Schedule applies where you accurately represented your Practice’s eligibility and your engagement is genuinely outside our covered scope. No refund is due where the engagement was procured by a material misrepresentation of your Practice’s eligibility or scope (for example, representing that your Practice is a healthcare entity within scope when it is not). In that case the Service is terminated under Section 6 without refund, except to the extent applicable law requires otherwise.

Sentinel processes each intake and issues Deliverables within thirty (30) days of intake submission, absent (a) your written consent to extend or (b) Sentinel's written notification of a processing issue. If we miss that thirty-day window without (a) or (b), you may request a refund per the Schedule's refund policy. Contact via sentinelriskgrp.com/contact.

Absent extension by written agreement or Force Majeure Event, no engagement will exceed thirty (30) days from intake submission without entitling you to either (a) a written progress report explaining the delay and a revised timeline, or (b) refund per the Schedule's refund policy.

The AI Governance Shield™ Method, the certification framework, the six-domain governance model, the V3 deliverable structure, and all template structures, taxonomies, scoring rubrics, and methodologies are proprietary to Sentinel Risk Group, LLC and are protected by copyright, trade secret, and trademark law.

Each Deliverable is licensed to you for your Practice's own internal use, regulatory submission, carrier renewal, audit response, or similar legitimate purpose. You may not resell, redistribute, white-label, or use a Deliverable as a template for unrelated practices.

Trademarks referenced in our materials, including but not limited to Anthropic, OpenAI, Microsoft, Google, AWS, third-party AI products, and regulatory body names, are trademarks of their respective owners. Sentinel is not affiliated with, endorsed by, or sponsored by any of those parties unless expressly stated.

No regulatory outcome, carrier renewal outcome, audit outcome, litigation outcome, or other third-party decision is guaranteed by any Sentinel Service. Our Services produce evaluation, documentation, certification, and training; outcomes depend on your Practice's operations after delivery, the specific facts of any inquiry, the regulator or carrier or counsel involved, and many other factors outside our control.

We commit to delivering each Service according to the AI Governance Shield™ Method and the applicable Schedule. We do not commit to any specific third-party outcome.

To the maximum extent permitted by law, Sentinel's total cumulative liability arising from or related to any Service is limited to the fees you paid for the specific Service giving rise to the claim in the twelve (12) months preceding the claim, or as otherwise expressly negotiated in writing between you and Sentinel for a particular engagement.

In practice, "fees paid" generally means: (a) for in-progress engagements where only the deposit has been invoiced — the deposit; (b) for completed engagements — deposit + balance; (c) for repeat-customer relationships within the trailing twelve (12) months — the aggregate fees paid across those engagements.

For Enterprise or other custom-scoped engagements where you require a different cap as a condition of engagement, the cap can be negotiated and stated in the engagement letter or Statement of Work for that engagement. Any negotiated cap controls only for the engagement in which it appears.

We will not be liable for indirect, consequential, incidental, exemplary, punitive, or special damages, including loss of revenue, lost data, regulatory penalties, carrier non-renewal, or lost profits, even if advised of the possibility of such damages.

Some jurisdictions do not permit certain limitations of liability; in those jurisdictions our liability is limited to the maximum extent permitted by law.

You agree to defend, indemnify, and hold harmless Sentinel Risk Group, LLC, its officers, principals, employees, and agents from any claim, demand, loss, or expense (including reasonable attorneys' fees) arising from:

(a) your breach of these Master Terms or any applicable Schedule;
(b) information you provided that was false, misleading, or incomplete;
(c) your Practice's operational decisions, regardless of any Sentinel Deliverable;
(d) your violation of applicable law (including HIPAA, 42 CFR Part 2, state privacy statutes, FDA regulations, FTC requirements) or any third-party agreement (vendor agreement, carrier policy, payer contract).

Neither party shall be liable for any failure or delay in performance under these Master Terms or any applicable Schedule (other than payment obligations already due) caused by events outside that party's reasonable control, including without limitation: acts of God; natural disasters, severe weather, fire, flood, earthquake; war, terrorism, civil unrest, riot; government action, order, or change of law; pandemic or public health emergency; strikes or labor disputes; failure of public utilities, internet service, or third-party cloud, AI-model, payment, or messaging infrastructure providers (each a "Force Majeure Event").

The affected party shall use reasonable efforts to mitigate the impact of any Force Majeure Event and resume performance as soon as practicable. Performance commitments under these Terms or any Schedule are extended for the duration of the Force Majeure Event.

If a Force Majeure Event continues for more than thirty (30) consecutive days, either party may terminate the affected engagement on written notice; pre-paid fees attributable to undelivered work will be refunded within fourteen (14) days of termination.

These Master Terms, every Schedule, and any non-contractual matters arising out of or related to them are governed by the laws of the State of Florida, USA, without regard to conflict-of-laws principles.

Disputes between you and Sentinel must be brought in the state or federal courts located in Orange County, Florida. You consent to the personal jurisdiction of those courts.

Master Terms + the applicable Product Schedule + the Sentinel Privacy Policy + any executed Data Processing Addendum (where applicable) + any Cookie Policy or Acceptable Use Policy referenced from the Privacy Policy constitute the entire agreement between you and Sentinel with respect to the relevant Service. They supersede any prior or contemporaneous agreement. For the AI Governance Shield™ certification engagement, the executed Engagement Letter (together with its Exhibits) is the governing agreement for that engagement and controls over any conflicting provision of these Master Terms or Schedule H; these Master Terms and Schedule H otherwise govern your use of the Sentinel website and account and supplement the Engagement Letter.

If any provision is held unenforceable, the remainder remains in full force; the unenforceable provision will be enforced to the maximum extent permissible.

For customer data rights (access, correction, deletion, portability, opt-out) and the process for exercising them, see Privacy Policy § 8 Your Rights.

For questions about these Terms or any Sentinel Service, use the contact form at sentinelriskgrp.com/contact or the support page at sentinelriskgrp.com/portal-help.

This Schedule supplements the Master Terms above. Customer + Master Terms + this Schedule together govern AI Governance Shield certification engagements.

The AI Governance Shield™ certification is an independent third-party evaluation of your Practice's AI governance posture against the AI Governance Shield™ Framework's seven domains:

1. Governance Architecture — committee structure, charter, decision rights, escalation paths
2. Risk Management — risk register, AI-system risk screening cadence, incident classification
3. Vendor & AI Inventory — current AI systems in use, vendor agreements on file, contract terms vs. operational reality
4. Patient & Workforce — patient disclosure language, consent posture, workforce training, role-based AI usage
5. Monitoring & Audit — monitoring schedule, audit logs, bias-review cadence, accuracy tracking
6. Incident Response — incident response playbook, vendor-notice path, learning loop
7. Equity & Ongoing Oversight — algorithmic-equity screening, post-deployment monitoring habits, model-update and audit-log discipline

Three tiers are offered:

Tier	Scope	Typical price
Solo	Single provider	$2,000
Practice	2–15 providers	$2,500 + $500 per additional provider
Large / Multi-site	16+ providers	From $9,500 (+ $500 per additional provider)

Tiers are not based on quality of evaluation (every engagement is evaluated against the same seven domains and the same V3 deliverable framework). Tiers reflect engagement scope and depth required to meet a Practice of a given size and complexity.

Each engagement evaluates:

• Your AI vendor agreements and the AI systems currently deployed in clinical or operational use
• Your governance documentation (policies, charter, committee minutes, training records, incident logs)
• Your monitoring and audit posture against the AI Governance Shield™ Framework
• Your jurisdictional exposure (multi-state telehealth practices receive additional mapping per H.6)
• Your specialty footprint (behavioral-health practices receive the Schedule BH overlay automatically)

Each engagement does NOT evaluate:

• Specific clinical decisions made by individual providers (clinical judgment is your domain)
• Patient outcomes or specific care episodes (outside our scope; we evaluate your governance, not your care)
• The technical correctness of AI vendor algorithms (we do not audit vendor models; we evaluate your governance over their use)

Pricing is scoped to the size of the Practice. The certification fee is $2,000 for a single provider, plus $500 for each additional provider (for example, a 5-provider Practice is $4,000 and a 16-provider Practice is $9,500). All AI workflows in use and all applicable jurisdictions are included in the scoped fee. Billed as 50% deposit at intake, 50% balance due before delivery of certification documents.

Provider count and scope. Provider count and pricing are established from the Practice’s verified provider roster (NPIs) collected at intake. The certification is issued to the Practice; the roster establishes the scope of the engagement and the basis for the fee. Materially understating provider count or scope is a misrepresentation under Section 7 and may void the certification and any refund.

Recertification is on an annual cycle at the scoped fee then in effect; recertification focuses on what has changed since the prior certification (new AI tools, new jurisdictions, regulatory updates, incidents, policy refinements).

Delivery timeline. Standard engagements typically deliver within approximately 5–20 business days of intake submission, based on scope. Larger multi-site engagements may vary. In all cases, the outside boundary is thirty (30) days from intake submission, per the refund policy at H.4.

Outside boundary. Absent written agreement to extend or a Force Majeure Event (Master §12), no engagement under this Schedule will exceed thirty (30) days from intake submission without entitling you to refund per H.4 below.

Custom-scoped engagements: if your Practice requires depth beyond the published tier scope (e.g., 5+ AI vendors with bespoke contract terms, federal-program participation, multi-state regulatory mapping for >5 states, FDA-pathway AI products), the engagement will be quoted as Custom and an alternative delivery timeline will be agreed in writing.

Payment is processed by Stripe.

Refunds are issued in these circumstances:

• Out-of-scope refund: if at intake or upon review we determine your Practice is not a healthcare entity within the scope of this Schedule, or your engagement falls outside the AI Governance Shield™ Framework's coverage, full refund of any deposit within five (5) business days of the determination — provided your eligibility was accurately represented; no refund where the engagement was procured by material misrepresentation of your Practice’s eligibility or scope (Section 7).
• Tier-mismatch refund: if intake or upon review reveals your Practice fits a lower-priced tier than the one purchased, the differential is refunded before the balance is invoiced.
• Delivery-failure refund: if we do not deliver the Service within thirty (30) days of your intake submission, absent (a) your written consent to extend or (b) Sentinel's written notification of a processing issue, you may request a refund. If no review or evaluation work has been performed on your engagement, you are entitled to a full refund of all fees paid. If review or evaluation work has commenced, you are entitled to a refund of fees attributable to undelivered work, with Sentinel retaining only the portion fairly attributable to work performed.
• Pre-delivery cancellation: if you cancel before any evaluation work begins, deposit is fully refundable. If cancellation occurs after evaluation work has begun, the deposit is non-refundable against work performed but no further fees are owed.

Beyond these, fees are non-refundable. The Service is preparation-of-Deliverables under the Method; you cannot expect a refund based on a regulatory outcome you did not like, a carrier renewal that went badly, or a litigation result.

Each AI Governance Shield engagement includes an AI-assisted analysis phase followed by a qualified-reviewer validation phase before any Deliverable is issued.

After evaluation, your engagement results in one of three outcomes:

• Certified (≥70/100 on the Framework): your Practice has documented governance practices across all seven domains operating effectively under the Framework. You receive the AI Governance Shield™ Certificate, the full certification report, the certificate-of-completion training module, and 90/60/30/7-day renewal reminders ahead of your annual recertification window.
• Conditional (with 90-day remediation roadmap): your Practice has a foundation but specific gaps require attention before full certification. You receive a Conditional finding, a documented remediation roadmap with specific deliverables, and one (1) re-evaluation included at no additional fee within ninety (90) days from the date of the initial assessment; Sentinel will grant one (1) extension of up to thirty (30) days upon the Practice’s written request. If remediation is documented and re-evaluated successfully within the window, your Practice receives the full Certified outcome and certificate; remediation not documented and re-evaluated within the window may require a new assessment engagement.
• Not Certifiable (significant restructuring required): your Practice has fundamental governance gaps that cannot be remediated within a single engagement cycle. You receive a Not Certifiable letter explaining the specific findings, a roadmap to restructure, and the option to re-engage Sentinel after restructuring is complete.

The certification outcome reflects evaluation findings against the Framework. It does not reflect — and is not — a finding of compliance with HIPAA, state law, FDA regulation, or any other authority. See Master §3 and §9.

Certification is valid for twelve (12) months from the certificate Effective Date.

You receive renewal reminders at 90 days, 60 days, 30 days, 7 days, and on expiration day. Recertification is a new certification engagement at the then-current tier price. Sentinel Risk Group may, at its sole discretion, offer promotional renewal pricing from time to time; any such promotion is communicated separately and does not modify these Terms.

Without renewal, your certification lapses. The certificate mark on your Practice's website and marketing materials must be removed within thirty (30) days of expiration.

HIPAA scope: the Service evaluates governance over AI systems your Practice uses; it is not a HIPAA covered-entity activity in itself. Sentinel does not provide protected health information ("PHI") handling services; intake and evidence submission flows are designed so PHI does not flow to Sentinel. If PHI accidentally reaches Sentinel (e.g., via an evidence-upload screenshot containing patient identifiers), it is encrypted, isolated, retained per the AWS Business Associate Agreement framework Sentinel maintains with AWS for the fallback quarantine bucket, and destroyed per minimum-necessary record-review timing.

Synthetic test data — AI output verification: The AI-output verification step uses synthetic, fictitious test cases that contain no real protected health information (“PHI”) and describe no real patients. Every identifier in those cases — patient IDs, medical record numbers, names, dates, and facilities (e.g., “Synthetic City Memorial Hospital,” “Hypothetical State”) — is fabricated solely for AI-governance evaluation. You agree to run each assigned synthetic case through your AI tool only in a test, sandbox, or evaluation context, and to submit only that tool’s output for the assigned synthetic case; you must not submit real PHI, real patient data, or any production clinical record through this step. AI output you submit, and any content derived from these synthetic cases, are evaluation artifacts and must not be used to inform real patient care. Sentinel labels this content as synthetic — including a published manifest of case identifiers and hashes at sentinelriskgrp.com/synthetic-test-cases/manifest.json — so that it is identifiable as fictitious test data rather than PHI by you, by Sentinel’s service providers, and by any automated content- or abuse-detection system. If real PHI is nonetheless submitted, it is handled under the HIPAA scope provisions above.

BAA posture: the standard engagement does not include a Business Associate Agreement between Sentinel Risk Group, LLC and your Practice. The AI Governance Shield™ certification is a governance evaluation; the standard scope is designed so PHI does not flow to Sentinel. If your Practice’s privacy officer requires a signed Sentinel-customer BAA as a condition of engagement, you may execute one at any time via Sentinel’s self-service Business Associate Agreement page at sentinelriskgrp.com/baa. Sentinel's position is that the Services are designed to operate without PHI flow and that, as so designed, Sentinel is not a Business Associate of Customer in fact; execution of the BAA is offered out of an abundance of caution to satisfy Customer procurement requirements and is without prejudice to that position. See the BAA itself for full terms.

Multi-state practices: if your Practice operates telehealth or in-person care across multiple states, your engagement maps your jurisdictional footprint against enacted AI-related statutes in each state (Texas TRAIGA, Colorado SB 26-189 + HB 26-1139 + HB 26-1195, Illinois HB 3773, California SB 1120, NY S7263, plus federal and other-state requirements as applicable).

Behavioral health practices: if your Practice treats behavioral health, mental health, or substance-use disorder patients, the engagement automatically includes Schedule BH (Behavioral Health Overlay). No separate fee is added unless Schedule BH triggers custom-scoping.

This Schedule supplements the Master Terms and Schedule H. Customer + Master Terms + Schedule H + this Schedule together govern certification engagements for behavioral health Practices.

This Schedule applies if any of the following is true of your Practice:

• You provide outpatient mental-health services (counseling, psychiatry, psychological assessment)
• You operate a substance-use disorder treatment program (residential or outpatient) subject to 42 CFR Part 2 confidentiality requirements
• You provide integrated behavioral-health services in a primary-care or specialty-medical setting
• You operate a partial-hospitalization or intensive-outpatient program for behavioral health
• You provide telehealth therapy across multiple states
• Your Practice meets the definition of a behavioral-health entity under your state's behavioral-health privacy statute

If your Practice meets any of the above, the AI Governance Shield™ certification engagement runs Schedule H plus this Schedule BH overlay automatically. There is no separate fee for the overlay unless complexity triggers custom-scoping (see BH.5).

Beyond the HIPAA-aware framework in Schedule H.8, behavioral-health Practices have layered confidentiality obligations that the AI Governance Shield™ engagement evaluates:

• California AB 3030 (effective Jan 1, 2025) — generative-AI patient-communication disclaimer requirements where AI is used to draft patient-facing messaging. Applies to Sentinel's BH customers operating in California to the extent any AI scribe or generative AI is used for patient communications.
• California SB 1580 — behavioral-health AI overlay requirements.
• Ambient-recording consent posture — engagements that include ambient-listening or scribe AI are evaluated against the consent-specificity posture articulated in Saucedo v. Sharp HealthCare (Cal. Super. Ct. Nov. 2025), the first AI-scribe class action, alleging insufficient specific informed consent for AI-recorded patient encounters. Sentinel's deliverable evaluates whether your practice's consent format meets state-specific requirements (especially in two-party consent states).
• 42 CFR Part 2 for SUD-records confidentiality (where applicable). Re-disclosure prohibition applies — anyone who receives Part 2 information cannot re-disclose without consent. AI-generated therapy notes containing SUD information that flow to a referring provider or insurer without consent create a chain of downstream violations.
• State behavioral-health privacy statutes. Several states have privacy laws that exceed HIPAA for behavioral health (Tennessee, California, Massachusetts, others). The engagement maps your operational footprint to those state statutes.
• FERPA overlay for school-based behavioral-health services (if applicable).
• Clinical documentation chain integrity. AI-generated therapy notes, treatment plans, and psychiatric evaluations require word-for-word provider verification before signature, plus confirmation that the AI did not generate independent clinical recommendations. The provider makes every therapeutic decision; the AI documents what the provider decided.

Behavioral-health certification engagements include specialty variants of the standard V3 deliverable suite:

• Certification Report (Behavioral Health variant) — emphasizes the layered confidentiality framework above, Part 2 re-disclosure controls, and the behavioral-health-specific consent posture.
• Gap Assessment Report (Behavioral Health variant) — domain-by-domain findings tailored to behavioral-health-specific risks (Part 2 leakage, multi-state telehealth across consent regimes, AI-generated therapy notes signature workflow).
• Certificate (Behavioral Health variant) — same certification mark as standard, optionally noting the BH specialty in the certificate body language.
• Enterprise variants — for hospital-system or large-network behavioral-health departments that require on-site engagement and white-glove polish.

For Practices delivering behavioral-health services across multiple states (including telehealth), the certification engagement includes:

• Mapping each operating state against its behavioral-health privacy statute and any additional AI-related provisions
• Identifying the highest-floor confidentiality regime applicable to any patient-state combination (a Tennessee patient seen by a Florida provider via telehealth triggers Tennessee's behavioral-health privacy floor)
• Documenting the workflow controls your Practice uses (or needs to add) to satisfy the highest-floor regime
• Incorporating that mapping into the Certification Report, the Gap Assessment Report, and (when applicable) the Conditional Roadmap

The Behavioral Health Overlay is included at no separate fee within the Schedule H certification you purchase, unless your Practice's specialty depth triggers custom-scoping. Triggers for custom-scoping include:

• Operating in five (5) or more states with telehealth across each
• Federal-program participation for SUD treatment (42 CFR Part 2 facility certification)
• A multi-entity structure where the behavioral-health entity is separate from a parent medical entity for governance purposes
• AI-system inventory of more than three (3) AI tools used specifically for behavioral-health workflow (intake screening, treatment-plan drafting, psychiatric-evaluation drafting, etc.)

If custom-scoping is triggered, the additional engagement scope is quoted at intake before any deposit is taken. You may decline the custom scope and proceed under the standard Schedule H certification with the Practice's behavioral-health complexity flagged in the Conditional or Not-Certifiable outcome (rather than fully evaluated for Certified outcome).

You acknowledge that:

(a) Sentinel does not provide therapy, psychiatric services, behavioral-health treatment, or clinical supervision. All AI Governance Shield™ Deliverables are governance evaluation documents. Clinical care decisions and clinical supervision remain with your licensed providers and your Practice's clinical leadership.

(b) The certification does not authorize, license, accredit, or otherwise approve your behavioral-health Practice. State licensing, federal program participation, and accreditation (Joint Commission, CARF, etc.) are separate processes; AI Governance Shield™ certification does not substitute for any of them.

(c) Re-disclosure of certification documents to third parties (carriers, regulators, accreditors, attorneys) does not transfer Sentinel's evaluation findings to those third parties as a regulatory or legal opinion. Sentinel provides no legal opinion. See Master §3.

This Schedule supplements the Master Terms above. Customer + Master Terms + this Schedule together govern Knowledge Series purchases. The Knowledge Series is an educational product; it is separate from, and does not include, the AI Governance Shield™ certification governed by Schedule H.

The Knowledge Series is a catalog of self-paced, single-topic training modules on the legal and regulatory landscape of healthcare AI (healthcare, behavioral-health, and assisted-living tracks). Each module includes plain-English lessons, a knowledge check, and — upon passing — a dated Certificate of Completion and a per-staff completion record retained in Sentinel's training-record system and available to you.

• Knowledge Series content is educational and informational only. It is not legal advice, and no attorney-client relationship is created by purchasing or completing any module. Laws change; content reflects the law as of the date shown in each module and may not reflect subsequent developments. Consult qualified legal counsel for advice specific to your circumstances.
• A Certificate of Completion documents completion of an educational module only. It is not a professional credential, a license, a continuing-education credit (unless expressly stated otherwise for a specific module), and it is not the AI Governance Shield™ certification. Completion of Knowledge Series modules does not make a practice "certified" by Sentinel Risk Group.

• Single Module — $59, one-time. Access to one module for the individual purchaser.
• All-Access Pass — $199/year, auto-renewing subscription. Access to every module in the catalog (including modules added during your term) for one named individual.
• Practice/Site License — $499/year, auto-renewing subscription. Access to every module for all staff at one physical practice location, plus the manager completion roster and attestation described in K.6.

Prices may change prospectively; a price change takes effect at your next renewal, with notice per K.4.

• The All-Access Pass and Practice/Site License are annual subscriptions that renew automatically at the then-current price until canceled. Your payment method on file is charged at each renewal.
• Renewal notice. We send a renewal reminder to the email on file before each annual renewal date.
• How to cancel. You may cancel at any time by emailing admin@sentinelriskgrp.com from the email on file, or via the contact form at sentinelriskgrp.com/contact. Cancellation stops the next renewal; your access continues through the end of the period already paid. Subscription billing is processed by Stripe, and cancellations take effect at the end of the current billing period.
• Single Module purchases are one-time and do not renew. Single Module access does not expire.

Consistent with the Master Terms (§7), Knowledge Series content is a digital Service delivered immediately upon purchase; where delivered as scoped, fees are non-refundable absent our error. Refunds are issued in these circumstances:

• Delivery-failure refund: if your access link is not delivered or does not work, and we cannot restore access within five (5) business days of your report to admin@sentinelriskgrp.com (or via the contact form), full refund of the purchase.
• Pre-access refund: if you request a refund before any module content has been accessed under your purchase (and, for a Single Module, before its knowledge check has been passed or a certificate generated), full refund.
• Billing-error refund: duplicate charges, or a renewal charged after a cancellation requested per K.4, are refunded in full.

Beyond these, fees are non-refundable; cancellation of a subscription stops future renewals rather than refunding the current term, and no pro-rata refunds are issued for unused time. Refunds, where applicable, are issued to the original payment method; access is revoked upon refund.

• A Practice/Site License covers the employees and contracted staff who work at one physical practice location, meaning one street address; fully-remote staff attach to the practice location designated as their home clinic. Organizations with multiple locations need one license per location.
• Staff access the modules through the practice's private access link. Each staff member's passed knowledge checks are logged to the practice's manager completion roster, which the license manager may view, print, and attest to at any time. The roster and attestation are educational-training records for the practice's own files; they are not certifications by Sentinel Risk Group.
• You are responsible for controlling distribution of your access link. Sharing an access link beyond the licensed scope (outside your one person, for All-Access; outside your one location's staff, for Practice/Site) is a material breach and grounds for revocation without refund.

• All Knowledge Series content is owned by Sentinel Risk Group, LLC and licensed — not sold — to you for the internal training of the licensed user(s) described in K.3.
• You may print or save certificates, completion records, and the module checklists for your own records. You may not otherwise copy, republish, redistribute, resell, scrape, frame, use to train machine-learning models, or make the content available to any third party or unlicensed person.
• Tokenized access links are personal to the purchase. Sentinel may revoke access used in violation of this Schedule.

Modules state the date through which their legal content was verified. Sentinel refreshes catalog content on a commercially reasonable cadence but does not warrant that any module reflects the law at your moment of reading. Where a module is materially updated during an active All-Access or Practice/Site term, the updated module is included in your access at no additional charge.

• The Knowledge Series is separate from the staff-training portal bundled with an active AI Governance Shield™ certification engagement (Schedule H). Purchasing the Knowledge Series is neither required for, nor credited toward, certification; no Knowledge Series fees credit toward any other Sentinel product.
• The disclaimers, IP, liability, indemnification, governing-law, and dispute provisions of the Master Terms (§§3–4, 8–14) apply in full to Knowledge Series purchases, and the standard site disclaimer applies to all module content.