Polestar GRC Professional Services Addendum
Version 1.0, effective October 10, 2026
This Professional Services Addendum ("Addendum") is part of the Polestar GRC Terms of Service (the "Terms") between Polestar GRC, a fictitious business name of Jonathan Prine (the "Owner"), 434 Kern St, Taft, CA 93268 ("Polestar GRC", "we", "us") and the organization that orders Professional Services ("Customer", "you"). It applies to the Professional Services described in Section 6 of the Terms. Capitalized terms not defined here have the meanings given in the Terms.
1. Statements of work
1.1 Each engagement. Each engagement is described in an order or statement of work ("SOW") that both parties accept in writing, including electronically. Each SOW states the services, any deliverables, the person or people who will perform officer support (if included), the fees and billing method, the start date and the term.
1.2 Order of precedence. For Professional Services, the SOW controls over this Addendum, and this Addendum controls over the Terms. No SOW may change a Platform Agreement or reduce the protection of PHI or Protected Data.
1.3 Changes. Either party may propose a change to an SOW in writing. A change takes effect only when both parties accept it in writing.
1.4 Account required. Professional Services are provided to customers that have a Polestar GRC workspace and have accepted the Terms and the applicable Platform Agreement in the Service, even if the customer orders only Professional Services.
2. Nature of the services
2.1 Advisory services. Professional Services are compliance program support provided by compliance professionals. They are not legal advice, do not create an attorney-client relationship, and are not a substitute for your own counsel.
2.2 Your decisions. You make every decision about your compliance program, including adopting policies, accepting risk, determining whether an incident is a breach, and deciding whether and how to notify individuals, regulators or the media. We recommend and document. You decide.
2.3 No guarantee of outcome. We do not guarantee that you will pass an audit, investigation or review, or that your program complies with any law.
2.4 Your information. We rely on the information, access and cooperation you provide. You are responsible for its accuracy and completeness.
3. Named Security Officer or Privacy Officer support
3.1 Your designation. If you designate a person we provide as your Privacy Official under 45 CFR 164.530(a) or your Security Official under 45 CFR 164.308(a)(2), the designation is your own act. You remain responsible for your obligations as a covered entity or business associate. The designation does not make us or that person your employee, officer or agent.
3.2 Executive sponsor. You will name an executive sponsor on your own staff who has authority to approve policies, accept risk and make breach notification decisions, and who is available to us during the engagement.
3.3 Scope. Officer support includes only the activities the SOW lists, for example maintaining policies, coordinating the annual risk analysis, running workforce training, tracking incidents and preparing documentation.
3.4 Outside communications. We will not communicate with HHS, a state attorney general or other regulator, the media, or your patients or clients on your behalf unless you authorize that communication in writing.
3.5 Availability. We provide officer support during US business hours, with the response times stated in the SOW. Officer support is not a 24-hour incident response service unless the SOW says so. If we learn of a possible breach or security incident while performing Professional Services, we will report it to your executive sponsor promptly, and no later than your Platform Agreement requires.
3.6 Independent contractor. We perform Professional Services as an independent contractor. We control the manner and means of our work, and you direct only the results.
4. PHI and Customer Data
4.1 Platform Agreement governs. PHI and Protected Data that we handle while performing Professional Services are governed by your Platform Agreement. We will not begin Professional Services that involve PHI or Protected Data until your Platform Agreement is in effect.
4.2 Where we work. We perform Professional Services inside your Polestar GRC workspace or in your own systems, using individual accounts you issue to us and subject to your access controls. You will remove those accounts when the engagement ends.
4.3 No local copies. We will not keep copies of PHI or Protected Data on our own devices or systems unless the SOW requires it. Any copy we keep is encrypted and is returned or destroyed as your Platform Agreement provides.
4.4 Minimum necessary. We will access only the PHI or Protected Data reasonably necessary for the task. Do not send PHI or Protected Data to us by email.
4.5 Your systems. You are responsible for the security of your own systems. When we use them, we will follow the policies you give us in writing.
5. Fees and payment
5.1 Fees. Fees are stated in the SOW. Hourly work is billed in quarter-hour increments. A monthly retainer is billed in advance at the start of each month.
5.2 Retainer hours. Unused retainer hours expire at the end of each month unless the SOW says otherwise.
5.3 Expenses. Travel and other expenses are billed at cost, only with your prior written approval.
5.4 Payment. Invoices are due within thirty (30) days after the invoice date unless the SOW says otherwise.
5.5 Refunds. Fees for work already performed are not refundable. If an SOW ends under Section 8, we will refund prepaid fees for work not yet performed, except where we end the SOW because of your uncured material breach.
6. Deliverables
6.1 Ownership. Once you have paid for them, you own the deliverables we prepare specifically for you under an SOW, excluding our pre-existing materials.
6.2 Our materials. We keep ownership of our templates, methods, know-how and other pre-existing materials. To the extent they are included in a deliverable, you may use them for your internal business purposes under Section 13 of the Terms.
6.3 General knowledge. We may reuse general skills and knowledge we gain during an engagement, as long as we do not use or disclose your Confidential Information, PHI or Protected Data.
7. Warranty
7.1 Workmanlike services. We warrant that we will perform Professional Services in a professional and workmanlike manner consistent with generally accepted industry practice.
7.2 Remedy. If you notify us in writing within thirty (30) days after we perform services that do not meet Section 7.1, we will re-perform them. If we cannot, we will refund the fees paid for the nonconforming services. This is your exclusive remedy for breach of Section 7.1.
7.3 Disclaimer. Except as stated in Section 7.1, Section 19.3 of the Terms applies to Professional Services.
8. Term and termination
8.1 Term. Each SOW runs for the term it states.
8.2 For convenience. Either party may end an SOW on thirty (30) days' written notice. You pay for work performed through the end date.
8.3 For cause. Either party may end an SOW if the other party materially breaches it and does not cure the breach within thirty (30) days after written notice, or immediately if cure is not possible.
8.4 Effect on subscriptions. Ending an SOW does not end your subscription. Ending a subscription does not end an SOW unless the SOW depends on the Service. Termination of the Terms ends every SOW.
8.5 Transition. When officer support ends, we will give your executive sponsor a written handoff summary of open items within ten (10) business days, and will return or destroy your materials as your Platform Agreement provides.
9. Liability
9.1 Cap. Our total liability arising out of Professional Services under an SOW will not exceed the fees paid or payable under that SOW in the twelve (12) months before the event giving rise to the claim. This cap replaces Section 20.2 of the Terms for claims arising out of Professional Services. Sections 20.1 and 20.4 of the Terms apply.
9.2 PHI and Protected Data. Claims relating to PHI or Protected Data, including PHI or Protected Data we handle while performing Professional Services, are governed by the liability terms of your Platform Agreement.
9.3 Penalties. We are not responsible for civil money penalties or other amounts imposed on you, except as the indemnification terms of your Platform Agreement provide.
10. Insurance
The insurance we carry is stated in Section 11.5 of our Business Associate Agreement. We will provide a certificate of insurance on request.
11. General
The Terms govern everything this Addendum does not address, including governing law and venue (Sections 22 and 23 of the Terms). Sections 2, 6, 9 and 11 of this Addendum survive the end of an SOW.
Appendix: SOW fields
Each SOW should state:
- Customer legal name and executive sponsor
- Services and any deliverables
- For officer support: which role (Privacy, Security or both), the activities included, response times, and the person who will perform it
- Fees (hourly rate, retainer amount and included hours, or fixed fee)
- Billing method and payment terms
- Start date, term, and renewal (if any)
- Any work that will happen outside the Polestar GRC workspace, and the systems involved