§1 Introduction

Shape Labs, Inc. (dba "ShapeScale") operates this website. The company is a Delaware incorporated C corporation headquartered at 179 11th St, San Francisco, CA 94103, and manufactures ShapeScale products and related services.

These Terms & Conditions ("Terms") apply to the ShapeScale device, the ShapeScale cloud service(s), and all related services, features, content, websites, or applications offered by ShapeScale (collectively, the "Service(s)").

By accessing the website, creating an account, or purchasing a Device, Customer acknowledges it has read, understood, and agrees to be bound by these Terms and ShapeScale's Privacy Policy.

§1.1 Acceptance of Terms

Customer agrees to be bound by these Terms by accessing or using any part of the website or Services. If Customer does not accept these Terms, Customer may not access the website or use any Services.

§1.2 Changes to Terms

ShapeScale reserves the right to update, change, or replace any part of these Terms of Service by posting updates and/or changes to our website. Continued use constitutes acceptance of changes. See §18 for advance notice requirements for material changes.

§1.3 Definitions

As used in these Terms, the following terms have the meanings set out below:

"Agreement" means these Terms and Conditions together with any order confirmation issued by ShapeScale, Schedule A (Data Processing Addendum), Schedule B (Service Level Agreement), and any other document expressly incorporated herein by reference. In the event of a conflict between these Terms and any Schedule, the Schedule controls with respect to its subject matter.

"Customer" means the business entity — including any gym, fitness studio, wellness center, healthcare facility, corporate wellness program, or other commercial or institutional organization — that enters into this Agreement by completing the checkout process. "Customer" refers to that legal entity, not to the individual who completes checkout on its behalf. All obligations, liabilities, and rights set out in this Agreement are those of the Customer entity.

"Authorized Users" means the employees, contractors, and staff members of Customer who are authorized by Customer to access, operate, and manage the Device and Services on Customer's behalf. Customer is responsible for all acts and omissions of its Authorized Users as if they were Customer's own.

"End Users" means the individual persons — including members, clients, patients, employees, or other individuals — whose body composition scans are collected through the Device by or on behalf of Customer. End Users are not party to this Agreement.

"Device" means the ShapeScale body composition scanning hardware unit purchased or leased by Customer under this Agreement, including any firmware or embedded software.

"Services" means the ShapeScale cloud platform, mobile application, scanning software, data processing infrastructure, and related services provided by ShapeScale in connection with the Device, as further described in §9.

"ShapeScale," "we," "us," or "our" means Shape Labs, Inc., a Delaware corporation doing business as ShapeScale, with its principal place of business in San Francisco, California.

"Business Day" means any day except Saturday, Sunday, or a U.S. federal public holiday. ShapeScale's business hours are 9:00 AM to 5:00 PM Pacific Time. Actions or notices received after 5:00 PM Pacific Time on a Business Day are deemed received on the next Business Day.

§2 Eligibility

The Services are available to business entities only. By entering into this Agreement, the individual completing the checkout process represents and warrants that: (i) they are at least 18 years of age with full legal capacity to contract; (ii) they are acting on behalf of the Customer entity named in the billing and account information; (iii) they have full authority to legally bind that Customer entity to this Agreement; and (iv) the Customer entity is a validly formed and existing legal entity in good standing under the laws of its jurisdiction of formation.

If the individual completing checkout does not have authority to bind the Customer entity, they must not proceed. By completing checkout, the individual and the Customer entity together accept and are bound by all terms of this Agreement.

§3 General Conditions

ShapeScale reserves the right to refuse service to anyone for any reason at any time. The company may withdraw or amend this website in our sole discretion without notice at any time and disclaims liability for unavailability.

§4 Accuracy, Completeness, and Timeliness of Information

ShapeScale is not responsible if information made available on this website is not accurate, complete, or current. Material is provided for general information only and any reliance on the material on this website is at the visitor's own risk.

§5 Modifications to the Service and Prices

Prices are subject to change without notice. ShapeScale reserves the right to modify or discontinue the Service (or any part or content thereof) without notice at any time. If discontinued, ShapeScale will cancel the Customer's order and provide the Customer a refund without further liability.

§6 Accuracy of Billing and Account Information

General Refusal Rights

ShapeScale reserves the right to refuse orders if: pricing or product information contains errors, billing is insufficient or erroneous, suspected fraud is detected, or products are unavailable. Orders connected with a previous payment dispute may be refused.

Quantity and Dealer Restrictions

The company may limit or cancel quantities purchased per person, per household, or per order and may limit or prohibit orders that, in our sole judgement, appear to be placed by dealers, resellers, or distributors.

Payment Obligations

The Customer agrees to pay for all orders made from their account in accordance with the prices and billing terms in effect at the time an order is made. Customers must pay all applicable taxes.

Payment Processing

Payments are processed through Stripe, Inc. Customers must provide current, complete, and accurate purchase and account information. ShapeScale shares information with the Payment Processor and does not store the Customer's payment information on our systems. Customer use of the Payment Processor is conditioned upon compliance with all of such Payment Processor's applicable terms and conditions. If the Payment Processor agreement terminates, customers may not be able to use the Services, or may have their account suspended or terminated.

Alternative Payment Methods

ShapeScale may change or add other payment processing services at any time upon notice to the Customer, which may be subject to additional terms or conditions.

Refund and Return Policy

All refund and return terms are governed by §13 of these Terms and Conditions, which is incorporated herein by reference. Business customers bound by these Terms are not subject to any separate return policy page.

§7 Ordering and Delivery

§7.1 Ordering Process

Customer completes the online checkout process through ShapeScale's website at business.shapescale.com to either purchase or lease a Device. The lease includes the rental of a Device and associated Services but does not convey ownership rights to the Device.

By completing checkout, the Customer — acting through the individual who clicks to accept — agrees to be bound by this Agreement in its entirety. The individual completing checkout represents and warrants on behalf of Customer that: (i) they are authorized to act as Customer's agent for purposes of entering into this Agreement; (ii) Customer is a business entity and not a consumer; (iii) all billing and shipping information provided is accurate and complete; and (iv) Customer will promptly notify ShapeScale of any changes to such information. Delivery timeframes are estimates only and are subject to change.

§7.2 Delivery Terms

Once confirmed, ShapeScale arranges delivery to the specified address. Delivery timeframes are estimates only and may vary based on factors such as manufacturing lead times, supply chain conditions, and shipping carrier availability, many of which are outside of ShapeScale's direct control.

Delivery and Setup Charge: Customers are responsible for a one-time delivery and setup charge of typically one hundred ninety-nine dollars ($199) per Device ordered. This fee covers standard ground shipping within the contiguous United States, as well as initial service setup and activation. Additional shipping fees may apply for expedited shipping, shipping to Alaska, Hawaii, or other U.S. territories, or for orders of multiple Devices.

Cancellation Right: ShapeScale reserves the right to decline or cancel any order at its sole discretion, at any time, and without prior notice to the customer. In the event that ShapeScale is unable to fulfill an order, the customer will be notified and promptly issued a full refund of any amounts paid.

§7.3 International Shipping Requirements

Customers outside the U.S. must contact ShapeScale directly to make arrangements for international shipping. The customer assumes responsibility for compliance with all applicable trade laws, import/export controls, and economic sanctions. ShapeScale reserves the right to decline any international order at its sole discretion, including orders that may violate trade restrictions, sanctions, or local regulations.

The customer will be responsible for all import duties, taxes, tariffs, and other fees imposed by both origin and destination countries, as well as for obtaining and maintaining any required import/export licenses, customs clearances, permits, certifications, or other governmental authorizations. The customer shall also bear all costs of return shipping to ShapeScale's office in San Francisco, California, USA in the event of a return or warranty claim.

All international shipments must be fully insured and sent via a trackable courier service with proper customs declarations. Delivery timeframes for international orders may be significantly longer than for U.S. orders and will vary based on destination country, customs processing times, and local conditions.

ShapeScale makes no representations regarding Device availability, compatibility with local power standards, or compliance with local regulations in specific countries. ShapeScale shall not be liable for any customs delays, holds, or rejections; changes in duties, taxes, or fees; lost, stolen, or damaged international shipments; delays due to customs inspection or documentation; carrier delays or service interruptions; or compliance with local certification requirements. Warranty service for international customers may experience longer service times and remains subject to local import/export restrictions. The customer bears all risk of loss or damage during return shipping, customs seizure or destruction, and delays in customs processing. ShapeScale reserves the right to modify these requirements by country or region, require additional documentation or verification, or cancel orders due to shipping or customs complications without liability.

§7.4 Trial Period Timing

All orders include a forty-five (45) day trial period ("Trial Period") from the date of delivery. The date of delivery shall be determined based on carrier tracking and delivery confirmation. For the lease program, the customer's twelve (12) month commitment begins upon delivery of the Device. During the Trial Period, the customer may cancel their order and return the Device, as outlined in Section 8.5 and Section 13.

§8 Lease Service Activation and Billing

§8.1 Lease Program Definition

The lease includes:

• Temporary possession and use of a ShapeScale device (the "Device")

• Access to ShapeScale's cloud-based software and processing

• Unlimited warranty coverage during the lease term

• Business Customer features and priority support

• Regular software updates

The Lease does not convey ownership rights to the Device. All Devices remain the property of Shape Labs, Inc.

§8.2 Lease Activation and Trial Period

The Lease will be activated upon delivery of the Device. The customer's twelve (12) month commitment begins upon delivery, subject to the customer's right to cancel during the Trial Period as defined in Section 7.4. During the Trial Period, the customer will have full access to the Device and all lease benefits for evaluation purposes. The customer may cancel during the Trial Period by notifying ShapeScale in writing, subject to the return policy in Section 10.

If the customer does not cancel during the Trial Period, the Lease will continue for the remainder of the twelve (12) month commitment term. The customer acknowledges that cancellation after the Trial Period will not entitle the customer to any refund of fees paid.

§8.3 Lease Payments and Commitments

Initial Term: Unless the customer notifies ShapeScale of their intent to cancel prior to the end of the Trial Period, the customer agrees to pay the monthly lease fee of one hundred ninety-nine dollars ($199) per month, billed annually at a rate of two thousand, three hundred eighty-eight dollars ($2,388) per year, for the first 12 months of the Lease term.

Renewal Terms: After the initial 12-month term, the Lease will automatically renew for additional 12-month terms at the then-current lease rate, unless either party provides written notice of non-renewal at least thirty (30) days prior to the end of the then-current term.

Fee Increases: ShapeScale reserves the right to increase lease fees for renewal terms, with at least sixty (60) days' advance written notice to the customer.

Non-Refundable Payments: Except as expressly provided in these Terms and Conditions, all lease payments are non-refundable.

Early Termination Liability: In the event of early termination by the customer after the end of the Trial Period, the customer shall remain responsible for the full annual lease payment for the remainder of the then-current 12-month term.

§8.4 Lease Purchase Option

§8.4.1 Purchase During First 12 Months

Credit Mechanism: At any point during the first twelve (12) months of the Lease term, customers may apply a portion of their prior lease payments towards the purchase of their leased Device.

Fair Market Value Calculation: The Device's Fair Market Value (FMV) is calculated based on a 60-month (5-year) useful life, with a monthly depreciation rate of one hundred sixty-three dollars ($163), derived from the initial Device value of nine thousand nine hundred ninety dollars ($9,990).

Monthly Credit: For each monthly lease payment of $199, ShapeScale will credit one hundred sixty-three dollars ($163) towards the purchase price of the Device.

Purchase Process: To exercise the purchase option, the customer must notify ShapeScale in writing of their intent to purchase. ShapeScale will then provide a written quote showing the current FMV (calculated as $9,990 minus $163 multiplied by the number of months leased), total lease credits accrued, and final payment amount required.

Refurbished Devices: For refurbished Devices with documented pre-existing wear acknowledged at lease inception, the initial FMV and depreciation schedule may be adjusted by mutual written agreement.

Payment Timeline: If the customer chooses to proceed with the purchase, they must pay the difference between the current FMV and their accrued lease credits within ten (10) business days. Upon receipt of payment, ShapeScale will transfer ownership of the Device to the customer.

Warranty on Purchased Devices: Purchased Devices are covered by a new two (2) year limited warranty from the date of purchase, subject to the terms described in Section 12.2.

§8.4.2 Purchase After 12 Months

After the initial 12-month lease term, customers may contact ShapeScale to discuss custom purchase arrangements for their leased Device. The terms of any custom purchase, including the purchase price, payment schedule, and warranty coverage, will be negotiated on a case-by-case basis and documented in a written agreement signed by both parties. Unless otherwise specified in the purchase agreement, Devices purchased after 12 months will be covered by ShapeScale's standard 2-year purchased Device warranty, as described in Section 12.2, commencing on the date of purchase. Customers who choose not to purchase their Device may continue leasing on a month-to-month basis, subject to the renewal terms in Section 8.2, or cancel their lease per the terms of Section 8.5.

§8.5 Lease Cancellation

§8.5.1 Trial Period Cancellation

The customer may cancel the Lease at any time during the Trial Period, as defined in Section 7.4. To initiate cancellation, the customer must notify ShapeScale in writing, either via email to help@shapescale.com or by physical mail to ShapeScale's corporate headquarters, prior to the end of the Trial Period. Upon receipt of a timely cancellation notice, ShapeScale will provide the customer with instructions for returning the Device in accordance with Section 10.

Once ShapeScale receives the Device in good working condition, a refund will be issued as follows:

For Monthly Billing:

• Customers will be charged for all full or partial months of service used through the cancellation date

• No further payments will be due

• The delivery and setup fee is non-refundable

For Annual Billing:

• ShapeScale will refund a prorated portion of the annual lease fee

• The prorated refund will be calculated based on the number of months used (rounded up to the nearest month)

• The delivery and setup fee is non-refundable

• Example: If the customer cancels 45 days after delivery, the refund would equal the annual fee minus two months of lease payments

Refund Timeline: Refunds will be processed within thirty (30) days of ShapeScale's receipt of the returned Device. The refund amount may be reduced by the cost of any damages or missing components identified during ShapeScale's inspection of the Device, as described in Section 10. All Trial Period cancellations and refunds are subject to the customer's compliance with the Device return provisions in Section 10.

§8.5.2 Post-Trial Cancellation

After the Trial Period ends, the customer may cancel the Lease at any time by providing written notice to ShapeScale at least thirty (30) days prior to the desired cancellation date. The customer will not be entitled to any refund of the annual lease fees paid for the current 12-month term, regardless of the remaining time in the term. If the customer has been paying on a monthly basis, they must continue to make scheduled lease payments through the end of the current annual term. The customer must return the Device to ShapeScale within thirty (30) days of the cancellation date, following the procedure described in Section 10. The customer will remain responsible for any unpaid lease fees, service charges, or other outstanding balances on their account. Cancellation will not relieve the customer of any liability for damage to or loss of the Device, as described in Sections 10.2 through 10.4.

§8.5.3 Effect of Cancellation

Upon cancellation, the customer's right to use the Device and associated ShapeScale for Business features shall immediately terminate. The customer must:

• Cease all use of the Device and associated features

• Return the Device to ShapeScale in accordance with Section 10

• Pay any outstanding balances due under this agreement

Failure to return the Device within the specified timeframe may result in additional charges, up to and including the full retail price of the Device. Cancellation does not nullify the customer's obligation to pay any outstanding lease fees, damage assessments, or other amounts owed under this Agreement. ShapeScale reserves the right to pursue collection of unpaid balances by any lawful means, including referring the customer's account to a third-party collection agency. Except as expressly provided in Section 8.5.1 regarding Trial Period cancellations, all fees paid prior to cancellation are non-refundable.

§9 Cloud Service and Billing

§9.1 Cloud Service Definition

The cloud service provides:

• Processing and analysis of 3D body scans

• Secure storage of all scan data and End User accounts

• Access to the ShapeScale business platform and features

• Regular software updates and improvements

§9.2 End User Accounts and Storage

There is no limit to the number of End User accounts that can be created on the platform or the number of processed scans stored. Billing is based solely on the number of unique End Users completing scans within a calendar month (Monthly Active Users or "MAUs").

§9.3 Monthly Active Users (MAUs)

§9.3.1 Definition

A Monthly Active User is defined as any unique End User who completes at least one ShapeScale scan on a Customer's Device within a calendar month. New End Users who complete their first scan will not count towards the Customer's MAU total for the first seven (7) days after their initial scan.

§9.3.2 MAU Tiers for Lease Customers

All rates shown as monthly fee when billed annually; monthly billing available at 25% surcharge.

§9.3.3 MAU Tiers for Purchase Customers

Purchased devices include 250 MAUs by default. Additional tiers:

§9.4 Usage Limits and Service Management

ShapeScale limits each customer Device to a maximum of one thousand (1,000) MAUs per month.

§9.4.1 MAU Limits

When limits are exceeded, ShapeScale will notify the account administrator via email. A grace period of thirty (30) to sixty (60) days will be provided to either reduce usage or upgrade to a higher MAU tier. If usage is not reduced or upgraded within the grace period, ShapeScale will automatically migrate the customer to the lowest-priced MAU tier that covers their actual monthly usage. The associated fees will be billed to the customer's payment method on file.

§9.4.2 Scan Volume Limitations

ShapeScale reserves the right to restrict, throttle, or temporarily suspend cloud service access if a business user's monthly scan volume exceeds five (5) times their MAU tier limit without prior written notice to ShapeScale. For example, a business on the 100 MAU tier should not exceed 500 scans per month without prior arrangement.

§9.4.3 Service Interruption

In cases where a customer: (a) exceeds their MAU allotment by more than one hundred percent (100%) within a single billing period; or (b) exceeds the scan volume limitations outlined in Section 9.4.2; ShapeScale reserves the right to immediately restrict or suspend cloud service access until usage is brought back into compliance or appropriate tier upgrades are purchased.

During service restriction: access to existing ShapeScale End User data will not be affected; customers may appeal by submitting a written request to help@shapescale.com within five (5) business days of notification; service will remain uninterrupted during the appeal review process; ShapeScale's determination on appeal shall be final and binding on the parties.

§10 Device Care and Returns

§10.1 Device Care Requirements

• The Customer shall maintain the Device in good working condition and repair throughout the lease term, following all care and maintenance guidelines provided by ShapeScale.

• The Customer shall promptly report any damage, malfunction, loss, or theft of the Device to help@shapescale.com within forty-eight (48) hours of discovery.

• All damage reports must include detailed written descriptions and photographic documentation of the issue.

• Failure to promptly report damage as required herein may result in the Customer being charged additional fees, up to and including the full replacement cost of the Device.

§10.2 Damage Assessment

§10.2.1 Device Damage

The following constitute device damage:

• Structural damage to the arm, base, or sensor head

• Deep scratches or abrasions longer than one-half inch (0.5") that fully penetrate the outer coating

• Internal damage to electronic components, sensors, or optical elements

• Cracked or broken components and housings

• Water damage or corrosion

• Impact damage affecting the overall operation and function of the Device

• Scratches or defects on the sensor lenses

• Any unauthorized modifications or alterations to the Device

• Any other damage that materially impairs the functionality, accuracy, or safe operation of the Device

§10.2.2 Normal Wear and Tear

For the purposes of this Agreement, normal wear and tear shall be defined as:

• Minor surface scratches less than one-half inch (0.5") in length

• Scuffs, marks, or blemishes that do not penetrate the outer coating

• Cosmetic defects that do not impact the operation of the Device

§10.2.3 Reboxing and Processing Fees

In addition to any charges for damage to the Device, ShapeScale reserves the right to charge the Customer a reboxing and processing fee of up to one thousand dollars ($1,000) for the following:

• Failure to include all original accessories and components with a returned Device

• Use of inadequate or non-original packaging materials when returning the Device

§10.2.4 Return Packaging Guidelines

The Customer acknowledges receipt of the ShapeScale Return Packaging Guide, which provides detailed instructions for properly packaging and shipping the Device to minimize the risk of damage during transit. The Customer agrees to follow these guidelines when returning the Device to ShapeScale.

§10.2.5 Liability for Improper Packaging

ShapeScale shall not be responsible for any damage to the Device resulting from the Customer's failure to comply with the ShapeScale Return Packaging Guide. The Customer shall be solely liable for any such damage, which will be assessed and charged in accordance with subsection (a) above.

§10.3 Return Conditions

In order to return the Device, the Customer must: (i) include all original accessories, components, and packaging materials; (ii) utilize either the original ShapeScale packaging or ShapeScale-approved equivalent protective packaging; (iii) follow all repackaging and shipping instructions provided by ShapeScale; and (iv) obtain a return merchandise authorization (RMA) number from ShapeScale prior to return. ShapeScale further reserves the right to charge the Customer a reboxing and processing fee of up to one thousand dollars ($1,000) for any of the following: (i) failure to include all original accessories and components; (ii) use of inadequate or non-original packaging materials; or (iii) damage resulting from improper packaging during return shipping.

§10.4 Lost or Stolen Devices

Full Replacement Cost: In the event the Device is lost, stolen, or otherwise not returned within ten (10) business days of the scheduled return date, or if ShapeScale has reasonable grounds to believe the Device has been lost or stolen, ShapeScale shall have the right to charge the Customer the full purchase price of nine thousand nine hundred ninety dollars ($9,990). If the Device is lost or stolen, in addition to the $9,990 replacement fee, the Customer shall remain responsible for all outstanding lease payments and service fees under the Agreement. The Customer must immediately report any lost or stolen Device to ShapeScale. Failure to do so within 48 hours of discovery will be deemed a material breach of the Agreement.

§10.5 Payment Terms and Collections

ShapeScale shall have the right to charge the full $9,990 purchase price of the Device to the Customer's payment method on file, and to collect such charge, in the event of any of the following: (i) the Device is not returned per the terms herein at the end of the lease term; (ii) the Customer's account falls more than 90 days delinquent; (iii) the Device is lost, stolen, or damaged beyond repair; or (iv) the Device is returned with damage exceeding normal wear and tear. Without limiting any other remedies, in the event of non-payment or delinquency, ShapeScale reserves the right to: (i) refer the Customer's account to a third-party collection agency; (ii) charge the Customer any reasonable costs of collection, including agency fees, legal costs, and court fees; and (iii) report and disclose the Customer's account status and payment history to business and consumer credit reporting agencies to the extent permitted by law.

§11 Customer Conduct and Acceptable Use

Customer and its Authorized Users may not use the website or Services for any unlawful purpose or in any way that violates these Terms. Prohibited conduct includes harassing, abusing, insulting, harming, defaming, slandering, disparaging, intimidating, or discriminating based on gender, sexual orientation, religion, ethnicity, race, age, national origin, or disability; submitting false or misleading information; uploading or transmitting viruses or any other type of malicious code; transmitting or soliciting advertising or promotional materials without prior written consent; collecting or tracking personal information of others without authorization; use for obscene or immoral purposes; impersonating ShapeScale's employees, another Authorized User, End User, or any other person or entity; or interfering with or circumventing the security features of the Service. ShapeScale reserves the right to suspend or terminate Customer's access to the Service for violating any of these prohibited uses.

§11.1 Restrictions and Responsibilities

Intellectual Property Restrictions: Customers will not, directly or indirectly, reverse engineer, decompile, disassemble, or otherwise attempt to discover the source code, object code, or underlying structure, ideas, know-how, or algorithms relevant to the Services or any software, documentation, or data related to the Services ("Software"); modify, translate, or create derivative works based on the Services or any Software; use the Services or any Software for timesharing or service bureau purposes or otherwise for the benefit of a third party; or remove any proprietary notices or labels.

Software License: With respect to any Software that is distributed or provided to Customers for use on Customer premises or devices, ShapeScale hereby grants Customers a non-exclusive, non-transferable, non-sublicensable license to use such Software during the Term only in connection with the Services.

Export Controls: Customers may not remove or export from the United States or allow the export or re-export of the Services, Software, or anything related thereto, or any direct product thereof in violation of any restrictions, laws, or regulations of the United States Department of Commerce, the United States Department of Treasury Office of Foreign Assets Control, or any other United States or foreign agency or authority.

Permitted Use: Customers represent, covenant, and warrant that they will use the Device only in compliance with ShapeScale's standard published policies then in effect and all applicable laws and regulations. Customers acknowledge that the Device is not an FDA approved device and is not intended for use in the diagnosis, treatment, or prevention of any disease.

Equipment Responsibility: Customers shall be responsible for obtaining and maintaining any equipment and ancillary services needed to connect to, access, or otherwise use the Services, including modems, hardware, servers, software, operating systems, networking, web servers, and the like (collectively, "Equipment").

Account Security: Customers shall also be responsible for maintaining the security of the Devices and Staff Accounts, passwords (including administrative and user passwords), and files, and for all uses of Customer account or the Equipment with or without Customer's knowledge or consent.

§11.2 Post-Purchase Usage

After purchasing and activating the Device, Customers agree to:

• Use the Device and Services in accordance with all instructions provided by ShapeScale.

• Maintain the Device in good working condition, following any maintenance guidelines provided.

• Not attempt to modify, repair, or alter the Device without ShapeScale's express written permission.

• Use the Device and Services for the purpose of providing body composition scanning services to Customer's clients and end users as part of Customer's fitness, wellness, or health business operations, which commercial use is expressly authorized under these Terms.

• Regularly update the Device's software when prompted to ensure optimal performance and security.

• Respect the privacy of End Users and not share or misuse any data collected by the Device.

§12 Warranty

§12.1 Warranty for Leased Devices

Coverage: ShapeScale warrants that the Device is free from defects in materials or workmanship for the duration of the Lease term, as long as all lease payments are current and there are no outstanding balances or unpaid fees (the "Lease Warranty Period"). During the Lease Warranty Period, if the Device is defective, ShapeScale will provide the necessary replacement or repair at no additional charge, subject to the conditions outlined in Section 12.3. This warranty remains in effect for the entire duration of the Lease, provided that the customer's account remains in good standing.

§12.2 Warranty for Purchased Devices

Duration: ShapeScale warrants that the Device is free from defects in materials or workmanship for a period of two (2) years from the date of purchase (the "Purchase Warranty Period"). During the Purchase Warranty Period, if the Device is defective, ShapeScale will provide the necessary replacement or repair at no additional charge, subject to the conditions outlined in Section 12.3. After the expiration of the Purchase Warranty Period, any repairs or replacements will be charged at ShapeScale's then-current rates.

§12.3 Warranty Conditions and Exclusions

This warranty is non-transferable and does not cover:

• Lost Device(s)

• Cosmetic damage

• Any unauthorized modification to the Device

• Attempted repair by unauthorized persons or with any parts not originally intended for or compatible with the Device

• Any alteration of the factory model name and/or serial number

• Damage or failure due to accident, acts of God, unauthorized commercial use, abuse, neglect, theft, or unusual atmospheric conditions

• Damage or failure through misuse or malfunction, normal wear and tear, improper or negligent use, improper or abnormal use, or any use contrary to instructions provided by ShapeScale

§12.4 Warranty Claims

To make a warranty claim, customers must: (a) have an active Service with no outstanding balance or any unpaid fees; and (b) have purchased the Device directly from ShapeScale or ShapeScale-approved partners.

§12.5 Limitation of Liability

ShapeScale's obligation under this warranty is limited to repair or replacement of the Device. ShapeScale shall not be liable for any incidental or consequential damages resulting from the use of the Device or from any breach of this warranty.

§12.6 Legal Rights

This warranty gives the customer specific legal rights. Customers may also have other rights which vary from state to state that may result in the change of this warranty. ShapeScale will provide ongoing service and support for the Device, including software updates and troubleshooting assistance. We will respond to any service or support requests made by the Customer within a reasonable timeframe. See Schedule B (Service Level Agreement) for defined response time commitments.

§13 Refunds and Returns

§13.1 Pre-Shipment Cancellations

A Customer may cancel their order for a full refund at any time before the Device ships from ShapeScale's facility. To cancel a pre-shipment order, the Customer must contact ShapeScale at help@shapescale.com. ShapeScale will confirm cancellation in writing and issue a full refund of any amounts paid, including the delivery and setup fee. Once the Device has shipped, §13.2 through §13.5 govern cancellations and returns.

§13.2 Trial Period

The first forty-five (45) days following delivery of a ShapeScale Device — whether leased or purchased — is the "Trial Period." The Trial Period commences on the date of delivery as confirmed by carrier tracking. To be eligible for a Trial Period return, the Customer must activate the Device through the ShapeScale app within seven (7) days of delivery. ShapeScale may deny a refund if the Device has not been activated within this window.

During the Trial Period, Customers may fully evaluate the Device and Services and may cancel and return the Device for a refund by providing written notice to ShapeScale at help@shapescale.com before the Trial Period expires.

§13.3 Purchase Customer Returns

Trial Period Returns: For Customers who purchased a Device outright, ShapeScale will issue a full refund of the Device purchase price upon return of the Device in good condition within the Trial Period. The one-time delivery and setup fee ($199) is non-refundable.

Post-Trial: After the Trial Period expires, purchased Devices may not be returned for a refund. Warranty coverage for post-Trial defects is governed by §12.

§13.4 Lease Customer Cancellations

Trial Period Cancellations: Lease Customers may cancel during the Trial Period pursuant to §8.5.1. Refunds are calculated as follows:

• Monthly-billed customers: ShapeScale will refund all payments made, less payment for any months used (rounded up to the nearest month) and less the non-refundable delivery and setup fee.

• Annual-billed customers: ShapeScale will refund a prorated portion of the annual lease fee based on the number of months used (rounded up to the nearest month), less the non-refundable delivery and setup fee.

Post-Trial Cancellations: After the Trial Period, cancellation terms are governed by §8.5.2 and §8.5.3. All lease payments made prior to cancellation are non-refundable except as expressly provided in §8.5.1. The Customer remains responsible for the full annual fee for the remainder of the then-current 12-month term upon early termination.

§13.5 Return Procedures

To initiate any return, the Customer must obtain a Return Merchandise Authorization (RMA) number from ShapeScale by contacting help@shapescale.com. Returns without a valid RMA will not be accepted.

Domestic Returns: For Customers shipping from within the contiguous United States, ShapeScale will provide a prepaid return shipping label and arrange pickup. The Customer must follow the ShapeScale Return Packaging Guide and include all original accessories and components.

International Returns: Customers returning a Device from outside the United States are responsible for all shipping costs to ShapeScale's office at 179 11th St, San Francisco, CA 94103, as well as all customs duties, import/export fees, and related charges. ShapeScale is not responsible for Devices lost, seized, or damaged in international transit.

Condition Requirements and Fees: Returned Devices are subject to inspection under §10.2. ShapeScale reserves the right to charge a reboxing and processing fee of up to one thousand dollars ($1,000) for missing accessories, inadequate packaging, or shipping damage caused by improper packaging. Damage exceeding normal wear and tear will be assessed and charged in accordance with §10.2.1. Return of the Device does not waive any outstanding lease fees, damage charges, or other amounts owed under the Agreement.

§13.6 Non-Returnable Items and Exceptions

The following are not eligible for return or refund under any circumstance: (i) Devices reported lost or stolen (which are subject to replacement charges under §10.4); (ii) Devices damaged through misuse, negligent use, or unauthorized modification; and (iii) any software, subscription credits, or service fees previously consumed. Damage from causes excluded under §12.3 will not be covered and may result in additional charges up to the full replacement cost of the Device ($9,990).

§14 Privacy Policy, Data Processing, and Security

§14.1 Privacy Policy and Data Processing

Your privacy and the security of your data, particularly body scan data, is of utmost importance to us. Our comprehensive Privacy Policy details how we collect, use, store, and protect your information, including body composition data, scan results, and personal information. The Privacy Policy also addresses data portability, access rights, retention periods, and compliance with various data protection regulations. By using our Services, you acknowledge that you have read and agree to our Privacy Policy, which is incorporated into these Terms by reference.

To the extent that ShapeScale processes personal information of Customer's end users on Customer's behalf, the parties agree that ShapeScale acts as a service provider / data processor and Customer acts as the business / data controller for purposes of applicable privacy law, including the California Consumer Privacy Act (CPRA) and, where applicable, the General Data Protection Regulation (GDPR). The terms of Schedule A (Data Processing Addendum) are incorporated into and form part of these Terms. In the event of a conflict between Schedule A and this Section 14, Schedule A shall control.

§14.2 Direct Communications with End Users

Customer acknowledges and agrees that ShapeScale may communicate directly with Customer's end users (including scan users, individual account holders, and app users) for the following purposes:

• Transactional and service communications: account setup and welcome messages, password resets, scan reminders, security alerts, and service or subscription notices. These communications are necessary for the operation of the ShapeScale platform and are sent on behalf of ShapeScale in its capacity as service provider. They cannot be disabled by Customer while an end user's account remains active.

• Product and service update communications: ShapeScale may send end users periodic emails regarding new features, app releases, and product improvements. End users may opt out of these communications at any time at the individual user level (via unsubscribe link or account notification settings), independently of any settings managed by Customer.

Customer represents and warrants that it has obtained all consents required under applicable law from its end users to allow ShapeScale to contact them for the purposes described in this §14.2, and that its privacy notices to end users accurately reflect ShapeScale's direct communications practices. ShapeScale's end-user communications are governed by ShapeScale's App & User Privacy Policy, which is provided to end users at account creation.

ShapeScale will not use end-user contact information obtained through Customer's account to send unsolicited advertising or to market products or services unrelated to ShapeScale. ShapeScale will honor opt-out requests submitted by end users at the individual level and will process such requests within the timeframe required by applicable law.

§14.3 Security Incidents and Breach Escalation

Each party will maintain reasonable administrative, technical, and physical safeguards designed to protect end-user personal information against unauthorized access, disclosure, alteration, or destruction.

Upon confirming a security incident that affects end-user personal information processed under these Terms — and that may require notification to consumers, regulators, or other parties under applicable law — the discovering party will notify the other party without unreasonable delay and in no event later than seventy-two (72) hours after confirmation. Notice will be provided to legal@shapescale.com (if ShapeScale is the notifying party) or to Customer's primary legal contact on record.

Each party will: (a) promptly cooperate in the investigation and remediation of any such incident; (b) provide the other party with the information reasonably necessary to comply with applicable breach notification obligations; and (c) not make public statements about the incident affecting the other party without prior written coordination, except as required by law.

Customer is solely responsible for any breach notification obligations arising from Customer's own use or misuse of end-user data, unauthorized sharing with third parties, or failure to implement reasonable security controls on Customer's systems.

§14.4 Contact

For specific questions about data privacy or security, please contact privacy@shapescale.com.

§15 Intellectual Property Rights

All content, features, and functionality of the Services, including but not limited to all information, software, text, displays, images, video, and audio, and the design, selection, and arrangement thereof, are owned by ShapeScale, its licensors, or other providers of such material and are protected by United States and international copyright, trademark, patent, trade secret, and other intellectual property or proprietary rights laws.

You must not reproduce, distribute, modify, create derivative works of, publicly display, publicly perform, republish, download, store, or transmit any of the material on our Services, except as expressly permitted by these Terms.

§16 Dispute Resolution

Any disputes arising out of or relating to these Terms or your use of our Services will be resolved through binding arbitration, rather than in court. The arbitration will be conducted by the American Arbitration Association (AAA) under its rules, including the AAA's Supplementary Procedures for Consumer-Related Disputes. The AAA's rules are available at www.adr.org or by calling 1-800-778-7879.

§17 Limitation of Liability

To the extent permitted by law, ShapeScale will not be liable for any indirect, incidental, special, punitive, or consequential damages (including loss of data, revenue, profits, or other economic advantage) arising out of or in connection with these Terms, even if we have been advised of the possibility of such damages.

ShapeScale's total cumulative liability to Customer arising out of or relating to these Terms, whether in contract, tort, or otherwise, shall not exceed the total fees paid by Customer to ShapeScale in the twelve (12) months immediately preceding the claim giving rise to liability.

The foregoing limitations do not apply to: (i) liability for death or personal injury caused by ShapeScale's negligence; (ii) liability for fraud or willful misconduct; or (iii) ShapeScale's indemnification obligations under §24.

§18 Changes to the Terms

ShapeScale reserves the right to modify these Terms at any time. ShapeScale will provide Customer with at least thirty (30) days' advance written notice of any material changes via email to the address on file. All changes will become effective no earlier than thirty (30) days after such notice. If ShapeScale materially increases Customer's recurring fees to ShapeScale or materially reduces the committed Service level set out in Schedule B, Customer may terminate these Terms within thirty (30) days of the notice date without incurring early termination liability for the remainder of the then-current term. ShapeScale will indicate at the top of the Terms when they were most recently updated. Continued use of our Services after the effective date of changes constitutes acceptance of the new Terms.

§19 Termination

Trial Period and Notice: The ShapeScale for Business Lease program and service includes a forty-five (45) day Trial Period from the date of delivery, during which customers may cancel with five (5) days written notice. The twelve (12) month commitment begins upon delivery, as detailed in Section 7.4.

Cure Period: Either party may terminate these Terms for material breach upon thirty (30) days' prior written notice to the breaching party, provided that if the breach is cured within such thirty (30) day period, the termination notice shall be of no effect.

Post-Trial Termination: After the Trial Period ends, either party may terminate at the end of any 12-month term with thirty (30) days prior written notice. The agreement automatically renews for successive 12-month terms unless terminated in accordance with this section and Section 8.5 (Service Cancellation).

Upon Termination: Upon termination, the Customer must cease all use of the ShapeScale for Business Lease program and service, return the Device in accordance with the provisions of Section 10 (Device Care and Returns), and pay any outstanding balances due under this agreement. The Customer's specific obligations and liabilities related to termination, including the timing of payments, refunds, and Device return, are further detailed in Sections 8.5 and 10.

§20 Severability

If any provision of these Terms of Service is determined to be unlawful, void, or unenforceable by a court or other tribunal of competent jurisdiction, such provision shall nonetheless be enforceable to the fullest extent permitted by applicable law, and the unenforceable portion shall be deemed to be severed from these Terms of Service. Such determination shall not affect the validity and enforceability of any other remaining provisions.

§21 Errors, Inaccuracies, and Omissions

Occasionally, there may be information on our website or in the Service that contains typographical errors, inaccuracies, or omissions that may relate to product descriptions, pricing, promotions, offers, product shipping charges, transit times, and availability. We reserve the right to correct any errors, inaccuracies, or omissions, and to change or update information or cancel orders if any information in the Service or on any related website is inaccurate at any time without prior notice (including after you have submitted your order). We undertake no obligation to update, amend, or clarify information in the Service or on any related website, including, without limitation, pricing information, except as required by law.

§22 Force Majeure

Neither ShapeScale nor Customer will be liable for any failure or delay in performing obligations under these Terms that result from causes beyond their reasonable control, including but not limited to: natural disasters (floods, earthquakes, hurricanes); fire; pandemics or epidemics; acts of government or regulatory authorities; civil unrest; acts of terrorism; power failures affecting our fulfillment operations; interruptions or failures of third-party cloud service providers (including but not limited to Amazon Web Services) that affect our ability to process scans or provide cloud services; telecommunications or internet backbone disruptions affecting our cloud services; cyber attacks or other security breaches affecting our systems or those of our cloud service providers; strikes or labor disputes affecting our California operations; transportation disruptions affecting delivery or pickup in the San Francisco Bay Area; and any other circumstances beyond reasonable control that prevent us from fulfilling orders, providing cloud services, or maintaining customer support operations.

During such events, ShapeScale will make reasonable efforts to maintain service continuity and communicate updates to affected customers. ShapeScale maintains redundancy in its cloud infrastructure where commercially reasonable, but does not guarantee uninterrupted availability of cloud services or scan processing capabilities during force majeure events.

§23 Disclaimer of Warranties; Limitation of Liability

No Guarantee: We do not guarantee, represent, or warrant that your use of our Service will be uninterrupted, timely, secure, or error-free. We do not warrant that the results that may be obtained from the use of the Service will be accurate or reliable. You agree that from time to time, we may remove the Service for indefinite periods of time or cancel the Service at any time, in our sole discretion and without notice to you.

As-Is Disclaimer: You expressly agree that your use of, or inability to use, the Service is at your sole risk. The Service and all products and services delivered to you through the Service are (except as expressly stated by us) provided "as is" and "as available" for your use, without any representation, warranties, or conditions of any kind, either expressed or implied, including all implied warranties or conditions of merchantability, merchantable quality, fitness for a particular purpose, durability, title, and non-infringement.

Liability Exclusion: In no case shall ShapeScale, its directors, officers, employees, affiliates, agents, contractors, interns, suppliers, service providers, or licensors be liable for any injury, loss, claim, or any indirect, incidental, punitive, special, or consequential damages of any kind, including, without limitation, lost profits, lost revenue, lost savings, loss of data, replacement costs, or any similar damages, whether based in contract, tort (including negligence), strict liability, or otherwise, arising from your use of any of the Service or any products procured using the Service, or for any other claim related in any way to your use of the Service or any product, including, but not limited to, any errors or omissions in any content, or any loss or damage of any kind incurred as a result of the use of the Service or any content (or product) posted, transmitted, or otherwise made available via the Service, even if advised of their possibility.

State Law Variation: Because some states or jurisdictions do not allow the exclusion or the limitation of liability for consequential or incidental damages, in such states or jurisdictions, our liability shall be limited to the maximum extent permitted by law.

§24 Indemnification

§24.1 Customer Indemnification

You agree to indemnify, defend, and hold harmless ShapeScale and its parent, subsidiaries, affiliates, partners, officers, directors, agents, contractors, licensors, service providers, subcontractors, suppliers, interns, and employees, harmless from any claim or demand, including reasonable attorneys' fees, made by any third-party due to or arising out of your breach of these Terms of Service or the documents incorporated by reference herein, or your violation of any laws or the rights of a third-party.

§24.2 ShapeScale Indemnification

ShapeScale shall indemnify, defend, and hold harmless Customer and its officers, directors, employees, and agents from and against any third-party claims, damages, losses, and expenses (including reasonable attorneys' fees) arising out of or relating to: (a) any claim that the ShapeScale platform, software, or technology infringes any third-party intellectual property right; (b) any data breach, unauthorized access, or loss of Customer or end-user data caused by ShapeScale's systems, infrastructure, or sub-processors; (c) ShapeScale's gross negligence or willful misconduct; or (d) ShapeScale's violation of applicable law in connection with its processing of personal or biometric data.

ShapeScale's indemnification obligation under this section is subject to: (i) Customer providing prompt written notice of the claim; (ii) ShapeScale having sole control of the defense and settlement (not to be settled in a manner that admits Customer liability without Customer's consent); and (iii) Customer providing reasonable cooperation at ShapeScale's expense.

§25 Waiver

The failure of ShapeScale to exercise or enforce any right or provision of these Terms of Service shall not constitute a waiver of such right or provision. No waiver shall be effective unless it is in writing signed by an authorized representative of ShapeScale.

§26 Governing Law

These Terms are governed by and construed in accordance with the laws of the State of California, without regard to its conflict of laws principles.

§27 Entire Agreement

These Terms, together with any other policies or terms referenced herein (including the Privacy Policy, Schedule A — Data Processing Addendum, and Schedule B — Service Level Agreement), constitute the entire agreement between you and ShapeScale with respect to the Services and supersede all prior or contemporaneous understandings, agreements, or communications between you and ShapeScale, whether written or oral.

§28 Biometric Data and Member Consent

§28.1 Customer Compliance Obligations

Customer acknowledges that the ShapeScale device and associated Services may collect, process, and store biometric data (including 3D body scan data) of Customer's end users. Where Customer operates in a state that has enacted a biometric privacy law — including, without limitation, the Illinois Biometric Information Privacy Act (740 ILCS 14/1 et seq.) and the Texas Capture or Use of Biometric Identifier Act (Tex. Bus. & Com. Code § 503.001 et seq.) — Customer represents, warrants, and covenants that, prior to permitting any end user to complete a scan:

• (a) Customer has obtained, or will obtain, a separate, freely given, informed, and written consent from each end user (or the end user's parent or guardian for users under 18) authorizing the collection, processing, and storage of their biometric data by Customer and by ShapeScale as Customer's service provider;

• (b) Customer has made available to the public a written biometric data retention schedule and destruction policy that complies with applicable state biometric privacy law;

• (c) Customer will notify ShapeScale promptly upon learning of any actual or threatened regulatory investigation, claim, or litigation relating to biometric data collected using the ShapeScale Service; and

• (d) Customer will indemnify, defend, and hold ShapeScale harmless from any claim, loss, or liability arising from Customer's failure to comply with applicable biometric privacy laws, including failure to obtain the required consents described in this section.

§28.2 ShapeScale Obligations

ShapeScale shall process biometric data only as a service provider acting on Customer's instructions and shall not sell, share, or use biometric data for any purpose other than providing the Services. ShapeScale's biometric data retention and destruction practices are set out in its Privacy Policy and Schedule A.

§29 Data Retention and Deletion

§29.1 Data Retention

ShapeScale retains end-user personal data and scan records in accordance with its then-current Privacy Policy and applicable law. Customers may view ShapeScale's data retention practices at shapescale.com/privacy. ShapeScale is not obligated to provide bulk data exports to Customer upon account closure or termination of these Terms.

§29.2 End-User Deletion Requests

End users wishing to request deletion of their personal data, including scan records and body composition data, may do so by contacting ShapeScale through the channels described in ShapeScale's Privacy Policy (privacy@shapescale.com). ShapeScale will process verified deletion requests in accordance with applicable law, including the CPRA and GDPR where applicable. ShapeScale will notify Customer of any deletion requests it receives that may affect Customer's access to end-user data.

§29.3 Account Closure

Upon termination of these Terms, ShapeScale will close the Customer's business account in accordance with ShapeScale's then-current Privacy Policy. Ongoing end-user accounts will be handled in accordance with ShapeScale's Privacy Policy and applicable law. Customer acknowledges that individual end users may maintain independent relationships with ShapeScale's consumer services, and that termination of the business relationship does not automatically delete end-user accounts or scan data.

§29.4 Biometric Data Destruction

Biometric data shall be deleted no later than the earlier of: (a) three (3) years from the date of the end user's last scan; or (b) within thirty (30) days following the termination of these Terms, in each case unless a shorter period is required by applicable biometric privacy law. ShapeScale shall confirm deletion in writing upon Customer's request.

§30 Insurance

§30.1 Customer Insurance

Customer shall maintain, at its own expense and throughout the term of these Terms, the following insurance coverages with insurers reasonably acceptable to ShapeScale: (a) Commercial General Liability insurance with limits of not less than $1,000,000 per occurrence and $2,000,000 aggregate; (b) Cyber Liability / Data Breach insurance with limits of not less than $1,000,000 per occurrence covering unauthorized access to or disclosure of personal information; and (c) Workers' Compensation insurance as required by applicable law. Upon ShapeScale's written request, Customer shall provide certificates of insurance evidencing such coverage within ten (10) Business Days.

§30.2 ShapeScale Insurance

ShapeScale shall maintain, at its own expense and throughout the term of these Terms: (a) Commercial General Liability insurance with limits of not less than $1,000,000 per occurrence; and (b) Cyber Liability / Data Breach insurance with limits of not less than $2,000,000 per occurrence. ShapeScale's cyber liability coverage extends to claims arising from unauthorized access to or disclosure of end-user personal and biometric data processed by ShapeScale's systems. Upon Customer's written request, ShapeScale shall provide certificates of insurance evidencing such coverage within ten (10) Business Days.

Schedule 1 — Device and Service Description

ShapeScale for Home

ShapeScale for Home is a 3D body scanner that brings the power of visual body composition to your personal space. The device measures body weight, fat, lean mass, BMI, a Health Score, a proprietary ShapeScale Score personalized to individual body measurements, circumference measurements, and regional volume measurements. Designed for non-commercial use, ShapeScale for Home is limited to a 5-user restriction, with the option to add additional users at a surcharge. The device comes with a 1-year warranty and is not intended for use in the diagnosis, treatment, or prevention of any disease.

ShapeScale for Business

ShapeScale for Business is a premium 3D body scanner, engineered for professional use. It offers the same core features as the Home version but is fine-tuned for enhanced reliability and scanning speed.

ShapeScale's customer success team provides comprehensive support, including:

• Device Maintenance and Servicing: ShapeScale ensures that the ShapeScale device is always in optimal condition, promptly addressing and resolving any issues that may arise.

• Mobile App and Cloud Service: ShapeScale provides access to a mobile app and cloud service, regularly updated to enhance performance, features, security, and compliance with industry standards.

• Exclusive Business Customer Features: ShapeScale for Business Customers gain access to exclusive features such as client management, data sharing, and future features like reports and data analytics.

• Onboarding and Technical Support: ShapeScale's customer success team provides onboarding, best practice guidance, technical support, and troubleshooting assistance, ensuring a seamless integration of ShapeScale into your business operations.

ShapeScale for Business Customers also enjoy the privilege of receiving advanced feature releases ahead of ShapeScale for Home users. This device is not intended for use in the diagnosis, treatment, or prevention of any disease.

Schedule A — Data Processing Addendum

This Data Processing Addendum ("DPA") is entered into as of the Effective Date set out in the Terms and is incorporated into and forms part of the ShapeScale for Business Terms and Conditions (the "Terms") between Shape Labs, Inc. ("ShapeScale") and Customer. In the event of any conflict between this DPA and the Terms, this DPA shall control with respect to the processing of Personal Information.

A.1 Definitions

"Applicable Privacy Law" means the California Consumer Privacy Act of 2018 and the California Privacy Rights Act of 2020 (collectively, "CPRA"), Cal. Civ. Code §§ 1798.100 et seq., as amended, together with any implementing regulations thereunder, and any other applicable U.S. state privacy laws that govern the processing activities described in this DPA.

"Biometric Data" means biometric identifiers and biometric information as defined under applicable biometric privacy laws, including three-dimensional (3D) body scan geometry, body measurements derived therefrom, and any physiological or biological data that may constitute a biometric identifier under Illinois BIPA (740 ILCS 14/1 et seq.), Texas CUBI (Tex. Bus. & Com. Code § 503.001 et seq.), or other applicable law.

"Business" or "Controller" means the entity that determines the purposes and means of processing Personal Information. For purposes of this DPA, Customer is the Business / Controller.

"Consumer" or "Data Subject" means an identified or identifiable individual whose Personal Information is processed under this DPA, including Customer's end users and clients.

"Personal Information" has the meaning set forth in Applicable Privacy Law and includes Biometric Data, body scan data, health and fitness data, contact information, and usage data processed in connection with the ShapeScale Services.

"Processing" means any operation or set of operations performed on Personal Information, whether or not by automated means, including collection, recording, organization, structuring, storage, adaptation, retrieval, consultation, use, disclosure, combination, restriction, erasure, or destruction.

"Service Provider" or "Processor" means ShapeScale, acting on Customer's documented instructions in providing the Services. ShapeScale is a "service provider" as defined in Cal. Civ. Code § 1798.140(ag).

"Sub-Processor" means any third party engaged by ShapeScale to process Personal Information in connection with providing the Services.

A.2 Role of the Parties

Customer is the Business / Controller and ShapeScale is the Service Provider / Processor with respect to Personal Information processed in connection with the Services. Customer determines the purposes and means of collecting Personal Information from its end users and instructs ShapeScale to process such data as described in this DPA and the Terms.

A.3 Nature, Purpose, and Duration of Processing

ShapeScale processes Personal Information solely to provide the Services as described in Schedule 1 and the Terms, including: (a) processing and analyzing 3D body scan data to generate body composition reports; (b) storing and making accessible scan data and End User account information through the ShapeScale business platform; (c) providing customer support and troubleshooting; (d) maintaining service security and integrity; and (e) fulfilling ShapeScale's obligations and exercising its rights under the Terms. The duration of processing corresponds to the term of the Terms, subject to Section A.11 below.

A.4 Customer Instructions

ShapeScale shall process Personal Information only on documented instructions from Customer, as set out in the Terms and this DPA. ShapeScale will promptly notify Customer if it determines that any instruction infringes Applicable Privacy Law. ShapeScale may process Personal Information as required by applicable law, provided that ShapeScale informs Customer of such legal requirement before processing, unless prohibited by law from providing such notice.

A.5 Confidentiality

ShapeScale shall ensure that persons authorized to process Personal Information are subject to appropriate confidentiality obligations (whether contractual or statutory) and have received adequate training on applicable data protection requirements.

A.6 Security

ShapeScale shall implement and maintain appropriate technical and organizational security measures designed to protect Personal Information against accidental or unlawful destruction, loss, alteration, unauthorized disclosure, or unauthorized access. Such measures include, at a minimum:

• (a) encryption of Personal Information in transit (TLS 1.2 or higher) and at rest (AES-256 or equivalent);

• (b) access controls and role-based permissions limiting access to Personal Information to ShapeScale personnel who require it to perform their duties;

• (c) logging and monitoring of access to systems containing Personal Information;

• (d) regular security assessments and vulnerability management; and

• (e) incident response procedures aligned with ShapeScale's Security Policy.

ShapeScale's infrastructure is hosted on Amazon Web Services (AWS) in SOC 2 Type II compliant data centers.

A.7 Sub-Processors

ShapeScale currently uses the following approved Sub-Processors in connection with the Services:

• (a) Amazon Web Services, Inc. ("AWS") — cloud infrastructure hosting and storage (United States); and

• (b) ActiveCampaign, LLC — customer communication and notification services (United States).

ShapeScale shall provide Customer with at least thirty (30) days' advance written notice (by email or via ShapeScale's website) before adding or replacing any Sub-Processor. Customer may object to such change in writing within fifteen (15) days of notice, and the parties shall cooperate in good faith to resolve the objection. If the parties cannot resolve the objection within thirty (30) days after Customer's notice of objection, either party may terminate the Terms on thirty (30) days' written notice without early termination liability. ShapeScale remains responsible for the acts and omissions of its Sub-Processors as if they were ShapeScale's own acts and omissions.

A.8 Assistance with Consumer Rights

ShapeScale shall provide Customer with reasonable technical assistance, taking into account the nature of the processing, to fulfill Customer's obligations to respond to Consumer rights requests under Applicable Privacy Law, including requests to access, correct, delete, or obtain a portable copy of Personal Information. ShapeScale will forward to Customer any Consumer rights requests it receives directly from end users within five (5) Business Days of receipt. Customer is responsible for determining whether a request is valid and for responding to Consumer rights requests.

A.9 Data Breach Notification

ShapeScale shall notify Customer without undue delay, and in no event later than seventy-two (72) hours after ShapeScale becomes aware of a confirmed personal data breach affecting Personal Information processed under this DPA. Such notification shall include, to the extent then known: (a) a description of the nature of the breach; (b) the categories and approximate number of Consumers affected; (c) the categories and approximate number of Personal Information records affected; (d) the likely consequences of the breach; and (e) measures taken or proposed to address the breach and mitigate its effects. ShapeScale shall cooperate with Customer in investigating, remediating, and making required regulatory notifications regarding any breach.

A.10 Cross-Border Data Transfers

ShapeScale processes Personal Information in the United States. To the extent that Customer's end users are located in the European Economic Area (EEA), United Kingdom, or Switzerland, and the transfer of their Personal Information to ShapeScale constitutes a "restricted transfer" under applicable European data protection law, the parties agree to execute the Standard Contractual Clauses (Module 2: Controller to Processor) adopted by the European Commission in June 2021, which are incorporated by reference herein. Customer shall contact privacy@shapescale.com to arrange execution of the applicable transfer mechanism before any such transfer occurs. ShapeScale shall not transfer Personal Information outside the United States to any country without an appropriate transfer mechanism in place.

A.11 Data Return and Deletion

Upon termination or expiration of the Terms for any reason: (a) ShapeScale shall delete or de-identify end-user account data and scan records in accordance with ShapeScale's then-current Privacy Policy and applicable law, except to the extent that retention is required by law or regulation; (b) Biometric Data shall be deleted no later than the earlier of: (i) three (3) years from the date of the end user's last scan, or (ii) within thirty (30) days following the termination of the Terms, unless a shorter period is required by applicable biometric privacy law; and (c) ShapeScale shall confirm deletion in writing upon Customer's written request. ShapeScale is not obligated to provide bulk data exports to Customer. End users wishing to request a copy or deletion of their Personal Information may do so through the channels described in ShapeScale's Privacy Policy.

A.12 CPRA Service Provider Restrictions

ShapeScale acknowledges and agrees that, with respect to Personal Information received from or on behalf of Customer, ShapeScale: (a) shall not sell or share Personal Information as those terms are defined under CPRA (Cal. Civ. Code §§ 1798.140(ah) and (ai)); (b) shall not retain, use, or disclose Personal Information for any purpose other than performing the Services or as otherwise permitted by CPRA for a service provider; (c) shall not retain, use, or disclose Personal Information outside the direct business relationship between ShapeScale and Customer; (d) shall not combine Personal Information received from Customer with Personal Information received from or on behalf of other businesses or collected from ShapeScale's own consumer interactions, except as permitted under CPRA; and (e) certifies that it understands these restrictions and will comply with them. ShapeScale shall notify Customer if it makes a determination that it can no longer meet its obligations under this Section A.12.

A.13 Biometric Data Restrictions

ShapeScale processes Biometric Data exclusively as a service provider on Customer's documented instructions and in accordance with Customer's consent framework obtained from end users under §28 of the Terms. ShapeScale shall not: (a) sell, lease, trade, or otherwise profit from Biometric Data; (b) disclose or disseminate Biometric Data to anyone other than authorized Sub-Processors performing services on ShapeScale's behalf; or (c) use Biometric Data for any purpose other than providing the Services.

A.14 Audit Rights

Customer may, upon at least thirty (30) days' prior written notice and no more than once per calendar year (except in connection with an actual or suspected data breach), request an audit or inspection of ShapeScale's compliance with this DPA. Such audit shall be conducted during normal business hours, at Customer's expense, and in a manner that minimizes disruption to ShapeScale's operations. ShapeScale may satisfy this obligation by providing Customer with a copy of its most recent third-party audit report (e.g., SOC 2 Type II report) or relevant security certification, subject to appropriate confidentiality obligations.

A.15 Governing Law

This DPA is governed by the laws of the State of California, consistent with the Terms.

Schedule B — Service Level Agreement

This Service Level Agreement ("SLA") forms part of the ShapeScale for Business Terms and Conditions and defines ShapeScale's service availability commitments and the remedies available to Customer if those commitments are not met.

B.1 Definitions

"Business Hours" and "Business Day" have the meanings set out in §1.3 of the Terms.

"Monthly Uptime Percentage" means the total number of minutes in a calendar month minus the number of minutes of Unplanned Downtime during that month, divided by the total number of minutes in that month, expressed as a percentage.

"Unplanned Downtime" means the total accumulated minutes in a calendar month during which the ShapeScale cloud services (scan processing and data access) are unavailable to Customer, excluding Scheduled Maintenance and Excluded Events defined in Section B.5.

"Scheduled Maintenance" means maintenance periods announced by ShapeScale with at least forty-eight (48) hours' prior written notice to Customer, conducted during the Maintenance Window.

"Maintenance Window" means the period from 12:00 AM to 6:00 AM Pacific Time on any calendar day.

"Service Credit" means the discount applied to Customer's next invoice as calculated pursuant to Section B.6.

B.2 Availability Commitment

ShapeScale commits to a Monthly Uptime Percentage of at least ninety-nine percent (99.0%) for the ShapeScale cloud scan processing and data access services. This commitment applies to the production service environment and does not extend to beta, pre-release, or trial features.

B.3 Uptime Measurement

ShapeScale monitors service availability on a continuous basis using automated monitoring tools. Monthly Uptime Percentage is calculated on a calendar-month basis. ShapeScale's measurement records shall be the authoritative source for uptime calculation purposes. Customer may request a monthly availability report by contacting help@shapescale.com.

B.4 Scheduled Maintenance

ShapeScale may perform Scheduled Maintenance during the Maintenance Window without such periods counting as Unplanned Downtime, provided that ShapeScale gives Customer at least forty-eight (48) hours' advance notice via email. ShapeScale will use commercially reasonable efforts to complete Scheduled Maintenance within the announced window and to minimize disruption to the Services.

B.5 Excluded Events

The following circumstances do not constitute Unplanned Downtime for the purpose of calculating the Monthly Uptime Percentage:

• (a) Scheduled Maintenance conducted in accordance with Section B.4;

• (b) downtime or degradation caused by acts or omissions of Customer, its end users, or Customer's third-party providers;

• (c) outages or degradations of Amazon Web Services (AWS) infrastructure outside ShapeScale's reasonable control, provided that ShapeScale uses commercially reasonable efforts to implement available mitigations once such an outage is identified;

• (d) internet, telecommunications, or backbone network failures beyond ShapeScale's network infrastructure boundary;

• (e) force majeure events as defined in §22 of the Terms;

• (f) Customer's failure to maintain minimum hardware, software, or connectivity requirements as specified in ShapeScale's documentation; or

• (g) denial-of-service attacks, security incidents, or intrusion attempts directed at ShapeScale's systems.

B.6 Service Credits

If the Monthly Uptime Percentage in any calendar month falls below 99.0%, Customer is eligible for a Service Credit calculated as follows: for each full one percent (1%) increment by which the Monthly Uptime Percentage falls below 99.0%, ShapeScale will credit five percent (5%) of Customer's monthly service fee for that month, up to a maximum aggregate credit of twenty percent (20%) of the monthly service fee for that month.

Service Credits are applied as a discount to Customer's next invoice following ShapeScale's approval of a credit claim submitted in accordance with Section B.8. Service Credits are Customer's sole and exclusive remedy for any failure by ShapeScale to meet the availability commitment set out in Section B.2, and no Service Credit will be combined with any other monetary remedy for service unavailability. ShapeScale's payment of Service Credits does not constitute an acknowledgment of fault or liability.

B.7 Support Response Times

ShapeScale will use commercially reasonable efforts to provide an initial response to support requests within the following target timeframes:

• Critical Issues (complete scan processing failure or inability to access customer data affecting all end users): initial response within eight (8) Business Hours of verified receipt during Business Hours.

• Standard Issues (partial service degradation, individual feature unavailability, device connectivity issues, or billing inquiries): initial response within two (2) Business Days.

• Enhancement Requests (feature requests, configuration changes, or non-urgent inquiries): initial response within ten (10) Business Days.

Response time targets represent ShapeScale's commitment to initial acknowledgment of a request, not resolution time. Actual resolution time will vary based on the nature and complexity of the issue.

B.8 Credit Claim Procedure

To be eligible for a Service Credit, Customer must submit a written credit request to help@shapescale.com within thirty (30) days of the end of the calendar month in which the alleged Unplanned Downtime occurred. The request must include: (a) the date(s) and time(s) of the alleged downtime; (b) a description of the service interruption experienced; and (c) the Customer account or device ID affected. ShapeScale will review the request against ShapeScale's monitoring records and notify Customer of the outcome within fifteen (15) Business Days of receipt. Approved credits will be applied to Customer's next invoice.

Last Updated: March 16, 2026 | Shape Labs, Inc. | legal@shapescale.com