1.1 Incorporation. The Master Services Agreement MSA-IN-001 (the "Master Form") is incorporated into this Agreement and forms part of it, save as varied by this instrument. Where a clause of the Master Form is stated below to be replaced, the replacement text applies and the corresponding clause of the Master Form has no effect. Where a clause is stated to be varied, the Master Form clause applies as modified. Where a clause is not mentioned, it applies unchanged.

1.2 Defined terms. Terms defined in the Master Form have the same meaning here. In addition:

1.2.1 <DefinedTerm term="EEA" /> means the European Economic Area.

1.2.2 <DefinedTerm term="GDPR" /> means Regulation (EU) 2016/679, including as incorporated into the EEA Agreement and as implemented by the national law of the Customer's jurisdiction.

1.2.3 <DefinedTerm term="NIS2 Directive" /> means Directive (EU) 2022/2555, as transposed into the law of the Customer's jurisdiction, and any successor instrument.

1.2.4 <DefinedTerm term="EHDS Regulation" /> means Regulation (EU) 2025/327 establishing the European Health Data Space.

1.2.5 <DefinedTerm term="MDR" /> means Regulation (EU) 2017/745 on medical devices.

1.2.6 <DefinedTerm term="Customer Jurisdiction" /> means the jurisdiction recorded at Customer jurisdiction in the Order Form.

1.3 Vocabulary. In this Agreement and in every document forming part of it, the Customer is the controller and Edsol Edtech Pvt. Ltd. is the processor. The Indian statutory terms Data Fiduciary and Data Processor are not used and, where they appear in an incorporated document, are read as controller and processor respectively.

1.4 Language. This Agreement is executed in English. Pensieve Labs provides the core assurance pack in the Customer Jurisdiction's official language on request; a translation is supplied for convenience only and the English text governs.

2.1 Clause 2 of the Master Form is replaced. In the event of conflict, the following order applies, highest first:

1. the Standard Contractual Clauses incorporated into DPA-EU-001, which prevail over every other document to the extent of any conflict, as their own terms require;
2. the executed Order Form;
3. DPA-EU-001, Data Processing Agreement (GDPR Article 28, EU/EEA);
4. ADD-GL-001, Security Addendum;
5. SLA-GL-001, Service Level Agreement;
6. this Agreement;
7. the Master Form;
8. the Denmark or Norway delta pack applicable to the Customer Jurisdiction;
9. the policies and disclosures published at https://trust.pensievelabs.org and in force at the Effective Date.

2.2 No silent variation. A published policy or disclosure may not vary a term of this Agreement, of the Order Form or of DPA-EU-001. Where a published document is amended after the Effective Date, the version in force at the Effective Date continues to apply to the Customer unless the Parties agree otherwise in writing, save that a change made to comply with a change of law applies on notice.

Clauses 25 (Dispute Resolution) and 26 (Governing Law and Jurisdiction) of the Master Form are replaced in their entirety. Indian governing law and an Indian arbitral seat are not offered to an EEA Customer.

3.1 Election. The governing law and forum are elected in the Order Form from the following table. If the Order Form is silent, Option A applies.

3.2 Public-sector constraint. Where the Customer is a contracting authority or a body governed by public law, only Option A is offered. A public buyer cannot ordinarily accept a foreign forum, and an arbitration clause in a public contract raises questions of transparency and of the review body's jurisdiction that no commercial benefit justifies.

3.3 Escalation before proceedings. Before commencing proceedings, other than for urgent interim relief, a Party must give written notice of the dispute and the Parties' respective named executives must meet, in person or by video, within fifteen (15) Business Days. This clause does not prevent an application for interim or protective measures in any court of competent jurisdiction, including under Article 35 of Regulation (EU) 1215/2012.

3.4 Mandatory law preserved. Nothing in this Agreement excludes or restricts:

1. the jurisdiction conferred on a supervisory authority or a court by the GDPR, including under Article 79, or the rights of a data subject under Chapter VIII of the GDPR;
2. any right of a Party or of a third party under the Standard Contractual Clauses, including Clause 18 (choice of forum and jurisdiction) which prevails over this clause in respect of a data subject's claim; or
3. any mandatory provision of the law of the Customer Jurisdiction that cannot be derogated from by agreement.

3.5 Rome I and Rome II. The election under 3.1 is made under Article 3 of Regulation (EC) 593/2008 and, as to non-contractual obligations arising out of or in connection with this Agreement, under Article 14 of Regulation (EC) 864/2007.

3.6 CISG. The United Nations Convention on Contracts for the International Sale of Goods does not apply.

3.7 Service of process. Where Option A or Option B is elected and Edsol Edtech Pvt. Ltd. is not established in the forum State, Edsol Edtech Pvt. Ltd. appoints and maintains an agent for service of process in that State throughout the Term and for two (2) years afterwards, and notifies the Customer of the agent's name and address before the Effective Date. Failure to maintain an agent does not invalidate service effected by any other lawful means.

This clause has no equivalent in the Master Form. It exists because several standard-form protections that are ordinary in an Indian technology contract are unenforceable, or are read down, in an EEA jurisdiction, and because a clause that a court will strike is worse than no clause: it invites a redline and then delivers nothing.

4.1 The Customer is not a consumer. This Agreement is concluded between undertakings acting in the course of their trade or profession. Neither Directive 93/13/EEC on unfair terms in consumer contracts nor Directive (EU) 2019/770 on contracts for the supply of digital content and digital services applies to it, and no term of this Agreement is to be construed as a consumer term.

4.2 Where a patient is an end user. Where the Platform presents an interface directly to a patient or other natural person who is not acting in the course of a trade or profession, a patient portal, appointment booking or a consent capture screen, the Customer, not Pensieve Labs, is the trader in that relationship. The Customer is responsible for the terms presented to that person, for the information duties owed to them, and for any consumer-law compliance arising. Pensieve Labs supplies the interface and the configurability; it does not contract with the patient. DIS-GL-024 records the same boundary for connected third-party systems.

4.3 Standard terms and reasonableness. The Parties record that:

1. this Agreement has been negotiated, and each Party has had the opportunity to take independent legal advice;
2. the allocation of risk in it (in particular the limitation of liability, the disclaimers and the indemnities) has been taken into account in setting the Charges, and each Party accepts that the Charges would be materially different under a different allocation;
3. the Customer has been offered, and may at any time request, a higher liability cap at a priced uplift under 6.5; and
4. no term of this Agreement is to be construed against a Party merely because that Party proposed it.

4.4 Terms that are not asserted in the EEA. Pensieve Labs does not rely on, and disapplies for an EEA Customer, any term of the Master Form to the extent that it purports to:

1. exclude or limit liability for death or personal injury caused by negligence;
2. exclude or limit liability for fraud, fraudulent misrepresentation, or wilful misconduct or gross negligence, the last being a distinction the Master Form does not draw and which several EEA jurisdictions treat as non-excludable;
3. exclude the Customer's right to a remedy in respect of a defect that Pensieve Labs knew of and did not disclose;
4. exclude or limit any liability that the applicable law does not permit to be excluded or limited; or
5. require the Customer to waive a mandatory statutory right.

4.5 Severance preserves the balance. Where a term is held unenforceable in the Customer Jurisdiction, it is severed and replaced by the enforceable term closest in effect to the original, and the remainder of the Agreement is unaffected. Where severance would materially alter the commercial balance, either Party may require a good-faith renegotiation of the affected term within thirty (30) days.

4.6 Unilateral change. Pensieve Labs may not unilaterally vary the Services, the Charges or the service levels during a Contract Year, save (a) as expressly permitted by POL-GL-064 (end of life) or POL-GL-065 (price change and renewal), (b) to comply with a change of law, or (c) where the change is a material improvement at no additional cost and no reduction in function. Any other variation requires a Change Order under ADD-GL-015.

This clause has no equivalent in the Master Form. It exists because the Customer is, in most EEA jurisdictions, an essential entity in the health sector under the NIS2 Directive as transposed, and Article 21(2)(d) of that Directive requires it to address the security of its supply chain, including the security-related aspects of the relationships between it and its direct suppliers. That duty is discharged, in practice, by flowing requirements down in the supplier contract. This clause is the flow-down, pre-accepted, so it does not have to be negotiated.

5.1 The boundary, stated first. Edsol Edtech Pvt. Ltd. is not itself an essential or important entity under the NIS2 Directive or its national transpositions. It is not established in the Union or the EEA for that purpose, it does not operate as a provider of a covered digital infrastructure or digital service in the Union, and it is not registered with any national competent authority under those instruments and does not represent that it is. The obligations in this clause are contractual, assumed by Edsol Edtech Pvt. Ltd. so that the Customer can discharge its own statutory position. Stating that precisely is more useful to the Customer's own documentation than implying a registration that does not exist. STM-EU-002 sets the position out in full and is incorporated by reference.

5.2 Incident notification. Edsol Edtech Pvt. Ltd. will notify the Customer of a Security Incident affecting the Customer's environment or Customer Data:

"Aware" means the point at which any Pensieve Labs person or system holds information indicating that an incident may have occurred. It does not mean the point at which the incident is confirmed or scoped. DIS-EU-016 states the same commitment in the customer-facing form and is the source of truth for it; this clause makes it contractual.

5.3 Risk-management cooperation. On the Customer's request, and not more than twice in any Contract Year without charge, Edsol Edtech Pvt. Ltd. will supply the inputs the Customer's own risk analysis and information-system security policies require under Article 21(2)(a) of the NIS2 Directive, including the current versions of WPR-GL-001, DIS-GL-006, DIS-GL-011, DIS-GL-012, DIS-GL-013, DIS-GL-014, DIS-GL-017, DIS-GL-033 and the register of Pensieve Labs personnel with production access.

5.4 Business continuity. Backup management, disaster recovery and crisis management under Article 21(2)(c) are addressed by DIS-GL-014, including the recovery time and recovery point objectives per deployment model, and by the test evidence in REP-GL-013. Under DM-4 the recovery objectives apply only to components Pensieve Labs controls; the Master Form clause 4 variant block governs.

5.5 Supply-chain security. Edsol Edtech Pvt. Ltd. will:

1. maintain the Subprocessor Register DIS-GL-009, stating for each sub-processor its name, role, location and transfer safeguard;
2. impose on each sub-processor, in writing, obligations no less protective than those in this clause and in DPA-EU-001;
3. give the Customer thirty (30) days' notice of the addition or replacement of a sub-processor processing Customer Data, with a right to object on reasonable data-protection or security grounds under POL-GL-055;
4. verify sub-processor conformance in accordance with the verification programme described in POL-GL-135, and make the evidence of verification available to the Customer on request; and
5. remain liable to the Customer for the acts and omissions of its sub-processors as for its own.

5.6 Vulnerability handling and disclosure. DIS-GL-017 states the severity classes and remediation windows, and POL-GL-059 states the coordinated disclosure process and publishes the security contact. Both are contractual for the purpose of Article 21(2)(b) and (e).

5.7 Cryptography, access control and personnel security. Articles 21(2)(h), (i) and (j) are addressed by DIS-GL-011, DIS-GL-012, DIS-GL-020 and the multi-factor authentication commitment in POL-GL-115. Screening, training and revocation on exit are stated in DIS-GL-020.

5.8 Evidence and audit. The Customer's audit right under ADD-GL-001 extends to verification of this clause. Edsol Edtech Pvt. Ltd. will supply, annually and without charge, the summary of the most recent independent security assessment, and will respond to a written supply-chain questionnaire once per Contract Year within ten (10) Business Days.

5.9 Change of transposition. Where the Customer Jurisdiction's transposition of the NIS2 Directive changes in a way that requires a different flow-down, the Parties will agree the amended text acting reasonably and without charge, within thirty (30) days of either Party's written request. Neither Party may use this clause to reopen commercial terms.

5.10 Where NIS2 is not yet in force. In an EEA State in which the NIS2 Directive has not yet been incorporated or transposed, this clause applies as a contractual commitment on its own terms, and references to statutory obligations of the Customer are read as references to the obligations the Customer expects to assume. Pensieve Labs does not represent that a given State has completed transposition; the Denmark and Norway delta packs record the position in each.

This clause has no equivalent in the Master Form. It exists because Chapter III of the EHDS Regulation introduces, for the first time, a conformity regime for EHR systems placed on the internal market, and a European hospital procuring a hospital operating system in 01 August 2026 is buying a system that will still be running when that regime bites.

6.1 What the Regulation does. For an EHR system within its scope, the EHDS Regulation requires the manufacturer to meet essential requirements on interoperability and on logging, to implement a European interoperability component and a European logging component, to maintain technical documentation, to draw up an EU declaration of conformity, to affix the conformity marking, to register the system in the EU database and to test it in a European testing environment. Conformity is self-declared by the manufacturer. In the ordinary case there is no notified body and no third-party certificate.

6.2 Dates. The obligations attach to systems intended to process Priority Category 1 data, patient summary, ePrescription and eDispensation, from 26 March 2029, and to systems processing Priority Category 2 data, medical imaging and image reports, laboratory results and discharge reports from 26 March 2031. The Commission implementing acts carrying the European electronic health record exchange format and the common specifications follow the general application date of 26 March 2027. A claim that EHR systems required certification from January 2026 has circulated in secondary commentary; it is not supported by the Regulation and Pensieve Labs does not repeat it.

6.3 Pensieve Labs's position, stated without overreach. As at 01 August 2026 Edsol Edtech Pvt. Ltd. holds no EU declaration of conformity for an EHR system, has not registered any system in the EU database, and does not affix any conformity marking. No obligation to do so has yet crystallised. STM-EU-001 states what has been built, what has not, and the date by which Edsol Edtech Pvt. Ltd. intends to declare.

6.4 What Edsol Edtech Pvt. Ltd. commits to. It will:

1. maintain the EHDS technical documentation file for the Platform, and make its index available to the Customer on request;
2. design and operate the access-logging capability in DIS-GL-013 so that it can satisfy the European logging component without a re-architecture, and make the log exportable to the Customer in a machine-readable form;
3. track the Commission implementing acts from the general application date and inform the Customer, within sixty (60) days of adoption of a relevant act, of the effect on the Platform and on the Customer's own obligations;
4. publish, and keep current, a dated readiness statement at https://trust.pensievelabs.org; and
5. where the Customer's Order Form records that the deployment processes Priority Category 1 or Priority Category 2 data, complete conformity for the applicable category before the applicable date at no additional Charge to the Customer, or, if it will not, give the Customer not less than twelve (12) months' notice and the right to terminate the affected Services without penalty and with the exit assistance in Master Form clause 22.

6.5 What Edsol Edtech Pvt. Ltd. does not commit to. It does not warrant that the Platform will meet a specification that has not yet been adopted, and it does not represent that the Customer's own obligations under the EHDS Regulation (including as a health data holder) are discharged by using the Platform. The Customer's obligations are the Customer's.

6.6 MyHealth@EU and national contact points. Connection to a national contact point for digital health or to MyHealth@EU is out of scope unless the Order Form records it as in scope with a specification and a date. DIS-GL-024 states the integration boundary and it applies here without modification.

7.1 Currency. Charges are stated and invoiced in Deal currency, which for an EEA Customer is the currency of the Customer Jurisdiction or the euro, as recorded in the Order Form. Charges are not indexed to the Indian rupee and no exchange-rate adjustment is applied within a Contract Year.

7.2 The tariff. The three-part tariff in the Master Form applies with the following EEA default:

7.3 Why the Value Share is off by default in the EEA. A contingent, measured, arrears-invoiced charge cannot be scored against a comparable price in a public procurement, cannot be committed against an annual appropriation, and requires a baseline, a measurement methodology, an attribution rule and a dispute mechanism to be agreed before signature. In this market that is a multi-month negotiation for a proportion of revenue that the Customer's finance function will in any event seek to cap. Where the Customer does want a gain-share, ADD-GL-019 governs it in full and is executed as an addendum, with its own baseline-setting period; signature of this Agreement is never blocked on agreeing it.

7.4 Value added tax. Edsol Edtech Pvt. Ltd. is established outside the Union and the EEA and supplies electronically supplied services. For a supply to a Customer that is a taxable person or a non-taxable legal person identified for value added tax purposes:

1. the place of supply is the Customer Jurisdiction under the general business-to-business rule;
2. the Customer accounts for the tax under the reverse charge, and Edsol Edtech Pvt. Ltd. charges no value added tax;
3. the invoice carries the Customer's value added tax identification number and the notation recorded in the applicable country delta pack; and
4. the Customer warrants that it is acting as a taxable person and notifies Edsol Edtech Pvt. Ltd. promptly of any change to its status or identification number.

7.5 Charges are exclusive; the reverse charge is a real cost. Charges are exclusive of value added tax. A hospital whose own supplies are exempt healthcare will generally not recover the tax it self-accounts for. Pensieve Labs records this expressly rather than allowing the Customer's finance function to discover it after signature, and the Order Form states the applicable rate for information.

7.6 Withholding. Where the Customer Jurisdiction requires an amount to be withheld from a payment, the Parties will co-operate to apply the lowest rate available under the double taxation agreement between India and the Customer Jurisdiction. Edsol Edtech Pvt. Ltd. will supply, before the first invoice, its tax residency certificate, the Indian prescribed particulars form, a no-permanent-establishment declaration and a beneficial-ownership confirmation, and will refresh them annually. The Customer will supply the withholding certificate within the statutory period.

7.7 Characterisation. The Services are supplied as access to a hosted platform operated by Edsol Edtech Pvt. Ltd.. This Agreement does not grant a licence of software for the Customer to exercise, does not transfer technology, and does not grant a right in intellectual property beyond the right of access and use necessary to receive the Services. Master Form clause 13 operates as a reservation of rights and not as a grant. The Parties record that this characterisation is deliberate and reflects what is actually supplied. [Each Party takes its own tax advice; neither advises the other, and the Order Form records the position agreed.]

7.8 Electronic invoicing. Edsol Edtech Pvt. Ltd. will issue invoices in a structured electronic format conforming to EN 16931 through an accredited access point, in the syntax and profile recorded in the applicable country delta pack. Where the Customer is a contracting authority, an invoice not issued in the required format is not payable and the payment clock does not start; the Order Form therefore records the Customer's electronic address, its participant identifier and any reference or purchase-order data the Customer requires on the invoice, and the Customer notifies changes in writing.

7.9 Late payment. Interest on a late payment accrues at the statutory rate applicable under the Customer Jurisdiction's implementation of Directive 2011/7/EU on combating late payment in commercial transactions, together with the statutory fixed compensation for recovery costs, in place of the rate in Master Form clause 6. Where the Customer is a public authority, the statutory payment period applicable to public authorities in the Customer Jurisdiction applies.

8.1 Master Form clause 10 is replaced. DPA-EU-001 governs the Processing of personal data under this Agreement in its entirety, including the Standard Contractual Clauses incorporated into it, and is executed at the same time as this Agreement. DPA-GL-001 and its Annexure V do not apply to a Customer that has executed DPA-EU-001.

8.2 Transfers. The transfer of personal data to India, including by remote access for support and operations, is made under the Standard Contractual Clauses and the supplementary measures recorded in DPA-EU-001, and is assessed in the transfer impact assessment REP-GL-021, which Edsol Edtech Pvt. Ltd. maintains, supplies to the Customer, and re-opens on any of the triggers stated in it.

8.3 Suspension. Where a re-assessment concludes that the transfer is no longer supported, Edsol Edtech Pvt. Ltd. will suspend the affected transfer and notify the Customer. This is a contractual obligation and not a statement of intent. The Customer may suspend the transfer or terminate the affected Services under Clause 16 of the Standard Contractual Clauses without liability for future Charges.

8.4 No conflicting instruction. Edsol Edtech Pvt. Ltd. will inform the Customer if, in its opinion, an instruction infringes the GDPR or other Union or Member State data protection law, and may suspend performance of that instruction until it is withdrawn or confirmed in writing.

9.1 Master Form clause 14 applies, varied so that the applicable regulatory frame is the MDR and the guidance MDCG 2019-11 Rev.1, and so that the operative boundary statement is DIS-EU-028.

9.2 The position. The Platform is a hospital information system. It stores, archives, communicates, displays and searches; it does not diagnose, does not treat, and does not make or drive a clinical decision. Edsol Edtech Pvt. Ltd. holds no CE marking, has no notified body, and has made no declaration of conformity under the MDR, and does not represent otherwise.

9.3 Excluded functions. The functions listed in DIS-EU-028 Section 4 as device-qualifying are not enabled in the EEA build, are not configurable on by the Customer, and are not supplied under this Agreement. The Customer will not configure, extend or integrate the Platform so as to produce a device-qualifying function without first notifying Edsol Edtech Pvt. Ltd. in writing and agreeing in a Change Order how regulatory responsibility is allocated.

9.4 Customer-built content. Where the Customer or a third party builds a rule, calculation, alert or score inside the Platform that provides information used to take decisions with a diagnostic or therapeutic purpose, the Customer is the manufacturer of that function for MDR purposes, and clause 9.3 of DIS-EU-028 governs. Pensieve Labs supplies the substrate; it does not thereby become the manufacturer of what is built on it.

9.5 Vigilance. Where either Party becomes aware of a circumstance that may constitute a serious incident or a field safety corrective action in respect of any device-qualifying module, it will notify the other within twenty-four (24) hours. Reporting to a competent authority is the responsibility of the manufacturer of the module concerned.

10.1 Master Form clause 18 applies, varied as follows.

10.2 Non-excludable liability. Neither Party excludes or limits liability for death or personal injury caused by its negligence, for fraud or fraudulent misrepresentation, for wilful misconduct or gross negligence, or for any liability that the applicable law does not permit to be excluded or limited. Master Form clause 18 is read subject to this sub-clause, and 4.4 applies.

10.3 Data protection liability. The cap in Master Form clause 18 does not limit:

1. either Party's liability to a data subject or to a supervisory authority arising under the GDPR;
2. either Party's liability under Clause 12 of the Standard Contractual Clauses; or
3. Edsol Edtech Pvt. Ltd.'s obligation to indemnify the Customer against an administrative fine imposed on the Customer to the extent it is attributable to Edsol Edtech Pvt. Ltd.'s breach of DPA-EU-001, which is subject to a separate cap recorded in the Order Form.

10.4 Apportionment. Where both Parties are involved in the same processing and one Party has paid full compensation to a data subject under Article 82(4) of the GDPR, it may claim back from the other the part of the compensation corresponding to that other Party's part of the responsibility, under Article 82(5). Nothing in this Agreement restricts that right.

10.5 Uplift. The Customer may request a higher aggregate cap. Pensieve Labs will quote an uplift in the Order Form. A refusal to quote must state a reason.

11.1 Master Form clauses 21 and 22 apply, varied as follows.

11.2 Termination for a transfer failure. The Customer may terminate the affected Services on written notice, without liability for Charges in respect of the period after termination, where:

1. Edsol Edtech Pvt. Ltd. notifies it under Clause 14(f) or 16 of the Standard Contractual Clauses that it can no longer comply with them; or
2. a supervisory authority or a court of competent jurisdiction prohibits or suspends the transfer.

11.3 Retention obligations survive. The Customer's statutory obligation to retain clinical records survives termination and is the Customer's own. Edsol Edtech Pvt. Ltd.'s obligation is to deliver a complete, readable, self-describing export in the format recorded in the Order Form, within the export window in Master Form clause 22, and then to delete under DIS-GL-023. The export format is a contractual term, not an implementation detail, and the country delta packs record the national retention clock that the Customer must plan against.

11.4 Public-sector continuity. Where the Customer is a contracting authority, Edsol Edtech Pvt. Ltd. will, on request, extend exit assistance beyond the period in the Master Form for up to a further six (6) months at the rates in the Order Form, so that the Customer can complete a compliant re-procurement. This is offered because a public buyer cannot lawfully be rushed into a direct award by a supplier's exit timetable.

12.1 Electronic execution. This Agreement may be executed by advanced or qualified electronic signature within the meaning of Regulation (EU) 910/2014, and by counterparts. A qualified electronic signature has the legal effect of a handwritten signature. No stamp duty is payable on this Agreement in an EEA Customer Jurisdiction and none is applied.

12.2 Notices. Master Form clause 27 applies, with the addition that a notice under 5.2 (incident notification), 8.3 (transfer suspension) or Clause 14 or 16 of the Standard Contractual Clauses is validly given by email to the address recorded in the Order Form and takes effect on transmission.

12.3 Article 27 representative. Where Edsol Edtech Pvt. Ltd.'s processing is subject to the GDPR under Article 3(2) and Article 27 requires a representative in the Union to be designated, Edsol Edtech Pvt. Ltd. designates one, publishes the identity and contact details at https://trust.pensievelabs.org, and notifies the Customer in writing before the first transfer. Where Article 27 does not apply, no representative is designated and none is claimed.

12.4 Entire agreement. This Agreement, the Master Form as varied, the Order Form, DPA-EU-001 and the documents named in 2.1 constitute the entire agreement between the Parties on their subject matter. Nothing in this clause limits liability for fraudulent misrepresentation.