Mayo Clinic Platform
Service Level Agreement

Last Updated: March 26, 2026

The obligations and remedies in these terms are in addition to Mayo’s and Customer’s obligations elsewhere in the Agreement and Schedule. In the event of a conflict between these terms and any other terms of the Agreement or Schedule, the terms of this Service Level Agreement shall control.

1. Background

1. 1. Purpose
      This document is a Service Level Agreement (“SLA”) between Mayo and Customer to document and define the internal working relationships for supporting the Hosted Environment within Mayo Clinic Cloud (“MCC”). The SLA remains valid until revised or terminated. The goal of this SLA is to obtain consensus for service provision between Mayo’s and Customer’s teams.
   2. Objectives
      The objectives of this SLA are to:
      • Provide clear reference to service ownership, accountability, roles and/or responsibilities.
      • Present a clear, concise, and measurable description of service provision to Customer.
   3. Definitions and Assumptions
      For purposes of this Attachment 3:
      • The term “Service Provider” refers to Mayo.
      • The term “Service Manager” refers to the leader on the Hosted Environment team responsible for the administration of this Schedule.
      • “ServiceNow” means the Saas application used to provide ITSM (as defined herein) processes including but not limited to Incident, Change, Problem, Service catalog/request fulfillment processes.
      • This document represents the current configuration to support the Hosted Environment. Changes to the Hosted Environment service will be addressed as separate service projects outside the scope of this document. Such changes will not materially affect the terms of this SLA without a written amendment to this SLA.
      • Major upgrades are treated as a project outside the scope of this SLA.

2. Service Providers Roles and Responsibilities

The Hosted Environment is hosted on the third-party hosting cloud platform. Customer can request systems in an established environment which will provide a dynamically allocated computation space.

2. 1. Service Provider
      The Service Provider has the following responsibilities:
      1. Meet response times associated with the priority assigned to Customer incidents and service requests (see Section 4.02).
      2. Notify Customer in writing at least seven (7) business days prior to any all scheduled maintenance via the ServiceNow change management process which is based on Mayo’s IT Service Management (“ITSM”) urgency and impact processes.
      3. Facilitate all service support activities involving incident, problem, change, release, and configuration management.
   2. Service Manager
      The Service Manager has the following responsibilities:
      1. Act as a trustworthy intermediary for finding solutions.
      2. Oversee and ensure basic interoperability and security.
      3. Manage the integration and architectural infrastructure design for tight collaboration.
      4. Manage the customization and given capabilities with potential new functionality.
      5. Review response incident times and take corrective action to meet Customer’s requests as set out in this SLA.
      6. Verify that support staff are trained on service support tools.
         

3. Data Usage Level and Restrictions

The use of the Hosted Environment has the following usage level and restrictions. 

3. 1. De-identified Information
      The privacy and security of information is a priority concern for individuals using the Hosted Environment. Existing standards and restrictions concerning de-identified information are applicable. These include policies and security safeguards to protect unauthorized access of information. Customer must follow established Mayo standards for protecting de-identified information. The Agreement explicitly state obligations relative to the data, including the following measures. The de-identified data will be maintained in a secure data container. This system will be secured such that only encrypted connections by authorized users are permitted. In addition, all interactions with the de-identified data container will be recorded such that subsequent auditing and evaluation of a user’s actions can be reviewed.
   2. Usage Hours 
      The hours of operation are seven days a week, 24 hours a day, 365 days a year outside of planned maintenance.
      

4. Problem Reporting and Resolution

The process for obtaining Hosted Environment support and reporting of incidents will be through ServiceNow. The use of ServiceNow will allow the Hosted Environment services team to respond to and record Customer’s requests. 

4. 1. Service Provider Support Hours
      Normal business hours for support provided by Mayo are Monday - Friday 7 am - 6 pm CST, excluding holidays. Mayo shall also provide an after-hours support service desk seven days a week, 24 hours a day, 365 days per year for urgent technical issues that cannot be resolved during normal business hours relating to Mayo’s cloud environment, available by calling 1-507-266-3500. If the after-hours support service desk is unable to resolve the issue, a ticket may be escalated to the applicable service team for additional troubleshooting during normal business hours.
   2. Mayo Clinic Incident Management Prioritization
      Prioritization of an incident is determined by reviewing incident urgency and its impact to the business, based on the severity levels set forth below. The priority of the incident is used to determine the order which incidents shall be worked on. Higher priority incidents should take precedence over incidents with lower priority. Mayo shall provide Customer with updates on the status of Mayo’s efforts by telephone, e-mail, or such other means according to the table below, particularly during Critical or High severity incidents. Mayo shall respond to all Customer requests, and address all vulnerabilities, in accordance with the response and resolution times identified in the table below:
      

5. Hosted Environment Maintenance/Support

Maintenance of the Hosted Environment including cloud infrastructure, software releases, and enhancement will occur on a periodic basis. Mayo will notify Customer of planned environmental outages seven (7) days in advance or within forty-eight (48) hours of when Mayo is notified of the planned outage.

5. 1. Cloud environment management and administration responsibility and ownership
      Managing the Cloud environments used for Cloud deployments and their life cycles will be both Customer and Mayo’s responsibility. This will include monitoring, troubleshooting, providing consistency checks, and ensuring health of the cloud resources.
   2. Technical Support
      Mayo shall establish, sufficiently staff, and maintain the organization and processes necessary to provide technical support, troubleshooting, incident identification, isolation, response and remediation, and other assistance. The contact information for Mayo’s technical support organization shall be provided by Mayo from time to time, in any event upon Customer’s request. Mayo’s personnel shall provide Customer with technical guidance and expertise and will participate in high priority incident troubleshooting calls as reasonably requested by Customer from time to time.
   3. Availability.
      Mayo will ensure that the Hosted Environment will have a minimum monthly availability service level of 95.0%, excluding scheduled downtime or emergency maintenance of the Hosted Environment. The Hosted Environment will be deemed unavailable, and subject to “downtime” in response to a High incident that requires an emergency change to remediate the issue.
      Scheduled downtime shall only occur during the hours of 10pm to 4am CST.
   4. Backup and Recovery
      Mayo will be responsible for the initial backup of all Platform Data and for updates thereto provided by Mayo; however, Customer will be responsible for all backups of any analyses or machine learning conducted on such Platform Data. Mayo s not responsible for the backup and recovery of the Customer application host systems nor other files or artifacts residing upon the host systems. It is the responsibility of Customer to maintain a secured copy of its data and Customer’s work (where applicable), outside of the Hosted Environment. The parties may agree otherwise in writing on a case-by-case basis.