LulaRoost Business and Health Account Agreement

This agreement is between LulaLou's Ltd Liability Co., an Alabama limited liability company doing business as LulaRoost ("LulaRoost," "we" or "us"), and the business, clinic or other organization that opens a LulaRoost Business or Health account ("the Organization" or "you"). It's posted at lularoost.com/business-terms.

1. About this agreement

1. Accepting. The person who opens the account accepts this agreement for the Organization by checking "I agree" in the LulaRoost business portal, and confirms they have authority to bind the Organization. LulaRoost records the version accepted, the person and the time.

2. What's included. Schedule A, the Business Associate Addendum, is part of this agreement for any Health account opened by a HIPAA covered entity or business associate.

3. Riders. Everyone who rides on the Organization's account follows the LulaRoost Terms of Service and the Community Guidelines. If this agreement conflicts with the Terms of Service about the Organization's account, this agreement controls.

2. Account types

3. Administrators and bookers

1. Administrators manage the account, add and remove bookers, and see the account's rides and invoices.

2. Bookers book rides for riders. Every administrator and booker has their own login with two-step verification.

3. Your responsibility. The Organization is responsible for every ride its administrators and bookers book. Remove a person's access the same day they leave or no longer need it.

4. Booking rides

1. What bookers enter. The rider's name and mobile number, the pickup and drop-off, the time, and for Health rides any medical equipment the rider will bring.

2. Rider consent to texts. By booking a ride, the Organization confirms the rider agreed to share their mobile number with LulaRoost and to get ride texts at it, as the Text Messaging Terms at lularoost.com/sms-terms describe.

3. Where rides can go. Rides start inside the LulaRoost service area and end in Alabama. Rides over 30 miles are booked as Scheduled rides.

4. Rates. Rides are priced at the published rates at lularoost.com/ride-terms. Cancellation, no-show, wait-time, extra-stop and damage fees apply as published.

5. Tips are optional. Bookers can add one for up to 72 hours after a ride, and 100% goes to the driver.

5. Health rides

1. Transportation only. Drivers aren't medical professionals, don't provide medical care, and don't lift or carry riders. Health rides aren't for emergencies; for an emergency, call 911.

2. Getting in and out. The rider must be able to get in and out of the car on their own, or with help from a companion who rides along. One companion rides at no extra charge.

3. Equipment. List the equipment the rider will bring, such as a folding wheelchair, a walker or portable oxygen. It must fit safely in the car. There's no wait-time charge on Health rides that list equipment.

4. No medical information. Never enter a diagnosis, the reason for a visit, or other medical information in any field or message. LulaRoost stores only the equipment listed and the pickup and drop-off times.

5. PIN. The driver confirms the rider's PIN, the last 4 digits of their phone number, before the ride starts.

6. Wheelchair-accessible vehicles. LulaRoost doesn't offer them in Dothan yet. For a rider who needs one, contact the Wiregrass Transit Authority.

7. Not a Medicaid or insurance service. LulaRoost isn't a Medicaid transportation provider and doesn't bill insurance. The Organization pays for every ride it books.

6. Billing and payment

1. How you pay. Each ride is charged to the card on the account when it ends. Organizations that LulaRoost approves for invoicing receive a monthly invoice instead, due within 15 days.

2. What's billed. The ride's charges, the service fee, any tip and any fees under Section 4.4. A rider's personal card is charged only if the Organization declines the ride.

3. Damage fees. The Organization pays damage fees for rides it books, up to $250 a ride, after LulaRoost reviews the driver's photos. It may dispute a damage fee within 7 days.

4. Billing questions. Report a billing error within 30 days of the charge or invoice at support@lulalous.com. LulaRoost answers within 7 days and corrects any confirmed error.

5. Late payment. If an invoice is more than 15 days past due, LulaRoost may pause new bookings until it's paid.

6. Fee changes. LulaRoost gives at least 30 days' notice before changing the service fee.

7. Information and privacy

1. What you see. For rides on your account: the rider's name, pickup and drop-off, times, distance and charges, and the driver's first name.

2. How you use it. Only to manage your account, your rides and your billing.

3. Your right to share. The Organization confirms it has the right to give LulaRoost the rider information it enters.

4. How LulaRoost uses it. Only to provide the rides, bill the Organization, keep riders safe and meet the law, as the Privacy Policy at lularoost.com/privacy describes. LulaRoost doesn't sell rider information.

5. Health accounts. Schedule A governs protected health information LulaRoost receives from a HIPAA covered entity or business associate.

6. Security. Each party protects the other's information with reasonable safeguards, and tells the other within 10 business days of discovering a breach that affects it.

8. Safety and conduct

1. Safety reports. Report any safety concern from the business portal or at safety@lulalous.com. LulaRoost acknowledges every report within 24 hours.

2. What bookers may not ask drivers to do: carry an item with no rider aboard, wait without the ride being booked, give medical help, or take payment outside the app.

3. Refusing or ending rides. LulaRoost or a driver may refuse or end a ride for safety, as the Terms of Service and Community Guidelines allow.

9. Drivers and insurance

1. Independent drivers. Drivers are independent contractors, not employees of LulaRoost or the Organization. The Organization doesn't direct or supervise drivers.

2. Insurance. LulaRoost maintains the transportation network company insurance Alabama law requires, including $1,000,000 in primary liability coverage from the moment a driver accepts a ride until the rider gets out.

10. Responsibility for claims

1. The Organization's claims. The Organization covers LulaRoost's losses, including reasonable attorneys' fees, from claims caused by its bookers' misuse of the account, or by rider information it gave LulaRoost without the right to do so.

2. LulaRoost's claims. LulaRoost covers the Organization's losses, including reasonable attorneys' fees, from claims caused by LulaRoost's breach of this agreement or of the law.

3. Limits. Neither party is liable to the other for indirect, special or punitive damages, or lost profits. Each party's total liability under this agreement is limited to the fees the Organization paid LulaRoost in the 12 months before the claim. These limits don't apply to Sections 10.1 and 10.2, to a breach of Section 7 or Schedule A, to gross negligence or willful misconduct, or to injury or property damage covered by the insurance in Section 9.2.

11. Term and ending the agreement

1. Term. This agreement continues month to month.

2. Ending it. Either party may end it with 30 days' written notice, or right away if the other party materially breaches it and doesn't fix the breach within 10 days of notice. LulaRoost may pause the account right away for safety, fraud or an unpaid balance.

3. What continues. Unpaid charges, Sections 7, 10 and 13, and Schedule A continue after the agreement ends.

12. Changes

LulaRoost gives at least 30 days' notice of changes to this agreement by email to the account's administrators. Rides booked after the change date follow the new version.

13. General terms

1. Talk to us first. Before filing any claim, send a written notice to legal@lulalous.com. Both parties will have 30 days to try to resolve it.

2. Courts and law. Alabama law governs this agreement. Any claim goes to the state courts of Houston County, Alabama, or the federal court for the Middle District of Alabama.

3. Notices. To LulaRoost: legal@lulalous.com, or LulaLou's Ltd Liability Co., PO Box 65, Dothan, Alabama 36302. To the Organization: the administrators' email addresses on the account.

4. The whole agreement. This agreement, with Schedule A and the documents it names, is the whole agreement about the Organization's account.

5. Other terms. Neither party may transfer this agreement without the other's written consent, except to a company that takes over its business. If any part can't be enforced, the rest still applies. Neither party is responsible for delays caused by events beyond its reasonable control.

This agreement is effective October 13, 2026.

Schedule A: Business Associate Addendum

This addendum applies to Health accounts opened by an Organization that is a covered entity or business associate under the Health Insurance Portability and Accountability Act of 1996 (HIPAA). In it, LulaRoost is the "Business Associate," and terms like "protected health information" (PHI) have their HIPAA meanings (45 CFR Parts 160 and 164).

A1. Uses and disclosures

• LulaRoost uses and discloses PHI only to arrange and provide rides for the Organization, to bill for them, to manage its own operations and meet its legal duties as 45 CFR 164.504(e)(4) allows, and as the law requires.

• LulaRoost uses only the minimum PHI needed, and never sells PHI or uses it for marketing.

• The Organization won't send LulaRoost more PHI than a ride needs, and won't ask LulaRoost to use PHI in a way HIPAA wouldn't allow the Organization to.

A2. Safeguards

LulaRoost uses administrative, physical and technical safeguards that meet the HIPAA Security Rule (45 CFR Part 164, Subpart C) to protect electronic PHI.

A3. Reporting

• LulaRoost reports to the Organization any use or disclosure of PHI this addendum doesn't allow, any security incident, and any breach of unsecured PHI, without unreasonable delay and no later than 10 business days after discovering it. A breach report includes the information 45 CFR 164.410 requires, as it becomes available.

• This addendum is notice of routine unsuccessful attempts on LulaRoost's systems, such as pings and port scans that don't result in access. No further report of them is needed.

A4. Subcontractors

LulaRoost makes sure any subcontractor that creates, receives, keeps or sends PHI for it agrees in writing to the same restrictions and conditions.

A5. Individuals' rights

• LulaRoost doesn't keep a designated record set for the Organization. If it ever does, it will provide access to, or amend, PHI within 15 days of the Organization's request, as 45 CFR 164.524 and 164.526 require.

• LulaRoost documents its disclosures of PHI and gives the Organization the information it needs for an accounting under 45 CFR 164.528 within 15 days of a request.

A6. Government review

LulaRoost makes its internal practices, books and records about PHI available to the Secretary of Health and Human Services to determine compliance with HIPAA.

A7. Ending the addendum

• This addendum ends when the agreement ends. Either party may end it if the other materially breaches it and doesn't fix the breach within 30 days of notice.

• When it ends, LulaRoost returns or destroys the PHI it holds for the Organization. Alabama rules require LulaRoost to keep trip records for 2 years, so returning or destroying them isn't feasible; LulaRoost keeps protecting them under this addendum and uses them only for the reasons that make returning them infeasible.

A8. Interpretation

Any unclear term in this addendum is read to comply with HIPAA. If HIPAA changes, the parties will update this addendum to keep it compliant.