Common use of LIST OF PARTIES Data Clause in Contracts

LIST OF PARTIES Data. exporter(s): 1. Name: The name of the Institution as specified in the Clinical Trial Agreement. Address: The address of the Institution as specified in the Clinical Trial Agreement. Contact person’s name, position and contact details: See notice section of the Clinical Trial Agreement. Activities relevant to the data transferred under these Clauses: See Clinical Trial Agreement. Signature and date: See signature of the Clinical Trial Agreement, which these SCCs relate to. Role (controller/processor): Controller Contact information to the Data Exporter(s) DPO: xxxxxxxxxxxxxxxxxxx Data importer(s): 1. Name: A. Janssen Research & Development, LLC Address: 000 Xxxxx 000 Xxxxx Xxxxxxx, Xxx Xxxxxx 00000 XXX Contact person’s name, position and contact details: See notice section of the Clinical Trial Agreement. Activities relevant to the data transferred under these Clauses: See Clinical Trial Agreement. Signature and date: See signature of the Clinical Trial Agreement, to which these SCCs relate. Role (controller/processor): Controller Contact information to the Data Importer(s) DPO: xxxxxxxxxxxxxxxxxxx B. DESCRIPTION OF TRANSFER Categories of data subjects whose personal data is transferred. The personal data transferred concern the following categories of data subjects: • Scientific and medical research subjects. • Scientific and medical research investigators and their staff, including, but not limited to, physicians and other health care professionals involved in administration of scientific research. • Other individuals involved in data exporter’s scientific and medical research (who may include consultants, representatives of service providers and business partners, government officials, and individuals who report adverse events and product quality complaints, among others). Categories of personal data transferred. The personal data transferred concern the following categories of data: • For scientific and medical research subjects, personal details may include key-coded information, other relevant identifiers (e.g., patient number); gender; age or age category (e.g., adolescent, adult, elderly) or date of birth (if necessary), associated health condition(s), medical history, and relevant family history. • For health care providers, or other points of contact, scientific and medical investigators and their staff, and other individuals involved in scientific and medical research, personal details may include contact information and other related information, such as name, address, e-mail and telephone details, gender, and professional licenses and affiliations provided as part of their credentials. Sensitive data transferred (if applicable) and applied restrictions or safeguards that fully take into consideration the nature of the data and the risks involved, such as for instance strict purpose limitation, access restrictions (including access only for staff having followed specialized training), keeping a record of access to the data, restrictions for onward transfers or additional security measures. • For research subjects, sensitive data may include key-coded information concerning certain health conditions and treatments, health-related information concerning adverse events and product quality complaints (if provided to the data exporter), and demographic information that may include race, ethnicity or other sensitive data that may be relevant to the adverse event (if provided to the data exporter). • See security measures in Annex II. Security measures include access only for staff having followed specialized training, keeping a record of access to the data, restrictions for onward transfers, and key-coding the information. The frequency of the transfer (e.g., whether the data is transferred on a one-off or continuous basis). • Data is transferred continuously in as required under the study protocol. Nature of the processing • The processing concerns the execution of a clinical trial, as further specified in the study protocol. Purpose(s) of the data transfer and further processing • The transfer of personal data concerning research subjects is performed for the purpose of executing a clinical trial, as further specified in the study protocol. • Personal data concerning other categories of data subjects is processed for the purpose of performing activities under the Agreement and as required to satisfy any legal or regulatory obligations. The period for which the personal data will be retained, or, if that is not possible, the criteria used to determine that period. • Any personal data will be retained as long as required considering the regulatory and legal requirement to retain records associated with the clinical trial and to satisfy the research objectives associated with the clinical trial. For transfers to (sub-) processors, also specify subject matter, nature and duration of the processing. • Any transfer to (sub-) processors is made for the same subject matter, and nature as described above. A (sub-) processor will only process personal data as long as necessary in order for such a (sub-) processor to deliver the services to the controller and shall thereafter return or delete any personal data based on the instructions of the controller, which holds to contract with the (sub-) processor. C.

LIST OF PARTIES Data. exporter(s): 1. Name: The name of the Institution as specified in the Clinical Trial Agreement. Address: The address of the Institution as specified in the Clinical Trial Agreement. Contact person’s name, position and contact details: See notice section of the Clinical Trial Agreement. Activities relevant to the data transferred under these Clauses: See Clinical Trial Agreement. Signature and date: See signature of the Clinical Trial Agreement, which these SCCs relate to. Role (controller/processor): Controller Contact information to the Data Exporter(s) DPO: xxxxxxxxxxxxxxxxxxx xxxxxxxxxxxxxxxxxxxxxx Data importer(s): 1. Name: A. Janssen Research & Development, LLC Address: 000 Xxxxx 000 Xxxxx Xxxxxxx, Xxx Xxxxxx 00000 XXX Contact person’s name, position and contact details: See notice section of the Clinical Trial Agreement. Activities relevant to the data transferred under these Clauses: See Clinical Trial Agreement. Signature and date: See signature of the Clinical Trial Agreement, to which these SCCs relate. Role (controller/processor): Controller Contact information to the Data Importer(s) DPO: xxxxxxxxxxxxxxxxxxx xxxxxxxxxxxxxxxxxxxxxxxx B. DESCRIPTION OF TRANSFER Categories of data subjects whose personal data is transferred. transferred The personal data transferred concern the following categories of data subjects: • Scientific and medical research subjects. • Scientific and medical research investigators and their staff, including, but not limited to, physicians and other health care professionals involved in administration of scientific research. • Other individuals involved in data exporter’s scientific and medical research (who may include consultants, representatives of service providers and business partners, government officials, and individuals who report adverse events and product quality complaints, among others). Categories of personal data transferred. transferred The personal data transferred concern the following categories of data: • For scientific and medical research subjects, personal details may include key-coded information, other relevant identifiers (e.g., patient number); gender; age or age category (e.g., adolescent, adult, elderly) or date of birth (if necessary), associated health condition(s), medical history, and relevant family history. • For health care providers, or other points of contact, scientific and medical investigators and their staff, and other individuals involved in scientific and medical research, personal details may include contact information and other related information, such as name, address, e-mail and telephone details, gender, and professional licenses and affiliations provided as part of their credentials. Sensitive data transferred (if applicable) and applied restrictions or safeguards that fully take into consideration the nature of the data and the risks involved, such as for instance strict purpose limitation, access restrictions (including access only for staff having followed specialized specialised training), keeping a record of access to the data, restrictions for onward transfers or additional security measures. • For research subjects, sensitive data may include key-coded information concerning certain health conditions and treatments, health-related information concerning adverse events and product quality complaints (if provided to the data exporter), and demographic information that may include race, ethnicity or other sensitive data that may be relevant to the adverse event (if provided to the data exporter). • See security measures in Annex II. Security measures include access only for staff having followed specialized specialised training, keeping a record of access to the data, restrictions for onward transfers, and key-coding the information. The frequency of the transfer (e.g., e.g. whether the data is transferred on a one-off or continuous basis). • Data is transferred continuously in as required under the study protocol. Nature of the processing • The processing concerns the execution of a clinical trial, as further specified in the study protocol. Purpose(s) of the data transfer and further processing • The transfer of personal data concerning research subjects is performed for the purpose of executing a clinical trial, as further specified in the study protocol. • Personal data concerning other categories of data subjects is processed for the purpose of performing activities under the Agreement and as required to satisfy any legal or regulatory obligations. The period for which the personal data will be retained, or, if that is not possible, the criteria used to determine that period. period • Any personal data will be retained as long as required considering the regulatory and legal requirement to retain records associated with the clinical trial and to satisfy the research objectives associated with the clinical trial. For transfers to (sub-) processors, also specify subject matter, nature and duration of the processing. processing • Any transfer to (sub-) processors is made for the same subject matter, and nature as described above. A (sub-) processor will only process personal data as long as necessary in order for such a (sub-) processor to deliver the services to the controller and shall thereafter return or delete any personal data based on the instructions of the controller, which holds to contract with the (sub-) processor. C.C. COMPETENT SUPERVISORY AUTHORITY Office for Personal Data Protection; xxxxx://xxx.xxxx.xx/ ________________________________________ ANNEX II TECHNICAL AND ORGANISATIONAL MEASURES INCLUDING TECHNICAL AND ORGANISATIONAL MEASURES TO ENSURE THE SECURITY OF THE DATA EXPLANATORY NOTE: The technical and organisational measures must be described in specific (and not generic) terms. See also the general comment on the first page of the Appendix, in particular on the need to clearly indicate which measures apply to each transfer/set of transfers. Description of the technical and organisational measures implemented by the data importer(s) (including any relevant certifications) to ensure an appropriate level of security, taking into account the nature, scope, context and purpose of the processing, and the risks for the rights and freedoms of natural persons. 1.

LIST OF PARTIES Data. exporter(s): 1. Name: The name of the Institution as specified in the Clinical Trial Agreement. Address: The address of the Institution as specified in the Clinical Trial Agreement. Contact person’s name, position and contact details: See notice section of the Clinical Trial Agreement. Activities relevant to the data transferred under these Clauses: See Clinical Trial Agreement. Signature and date: See signature of the Clinical Trial Agreement, which these SCCs relate to. Role (controller/processor): Controller Contact information to the Data Exporter(s) DPO: xxxxxxxxxxxxxxxxxxx [enter info] Data importer(s): 1. Name: A. Janssen Research & Development, LLC Address: 000 Xxxxx 000 Xxxxx Xxxxxxx, Xxx Xxxxxx 00000 XXX Contact person’s name, position and contact details: See notice section of the Clinical Trial Agreement. Activities relevant to the data transferred under these Clauses: See Clinical Trial Agreement. Signature and date: See signature of the Clinical Trial Agreement, to which these SCCs relate. Role (controller/processor): Controller Contact information to the Data Importer(s) DPO: xxxxxxxxxxxxxxxxxxx :xxxxxxxxxxxxxxxxxxxx B. DESCRIPTION OF TRANSFER Categories of data subjects whose personal data is transferred. transferred The personal data transferred concern the following categories of data subjects: • Scientific and medical research subjects. • Scientific and medical research investigators and their staff, including, but not limited to, physicians and other health care professionals involved in administration of scientific research. • Other individuals involved in data exporter’s scientific and medical research (who may include consultants, representatives of service providers and business partners, government officials, and individuals who report adverse events and product quality complaints, among others). Categories of personal data transferred. transferred The personal data transferred concern the following categories of data: • For scientific and medical research subjects, personal details may include include: key-coded information, other relevant identifiers (e.g., patient number); gender; age or age category (e.g., adolescent, adult, elderly) or date of birth (if necessary), associated health condition(s), medical history, and relevant family history. • For health care providers, or other points of contact, scientific and medical investigators and their staff, and other individuals involved in scientific and medical research, personal details may include include: contact information and other related information, such as name, address, e-mail and telephone details, gender, and professional licenses and affiliations provided as part of their credentials. Sensitive data transferred (if applicable) and applied restrictions or safeguards that fully take into consideration the nature of the data and the risks involved, such as for instance strict purpose limitation, access restrictions (including access only for staff having followed specialized specialised training), keeping a record of access to the data, restrictions for onward transfers or additional security measures. • For research subjects, sensitive data may include include: key-coded information concerning certain health conditions and treatments, health-related information concerning adverse events and product quality complaints (if provided to the data exporter), and demographic information that may include race, ethnicity or other sensitive data that may be relevant to the adverse event (if provided to the data exporter). • See security measures in Annex II. Security measures include access only for staff having followed specialized specialised training, keeping a record of access to the data, restrictions for onward transfers, and key-coding the information. The frequency of the transfer (e.g., e.g. whether the data is transferred on a one-off or continuous basis). • Data is transferred continuously in as required under the study protocol. Nature of the processing • The processing concerns the execution of a clinical trial, as further specified in the study protocol. Purpose(s) of the data transfer and further processing • The transfer of personal data concerning research subjects is performed for the purpose of executing a clinical trial, as further specified in the study protocol. • Personal data concerning other categories of data subjects is processed for the purpose of performing activities under the Agreement and as required to satisfy any legal or regulatory obligations. The period for which the personal data will be retained, or, if that is not possible, the criteria used to determine that period. period • Any personal data will be retained as long as required considering the regulatory and legal requirement to retain records associated with the clinical trial and to satisfy the research objectives associated with the clinical trial. For transfers to (sub-) processors, also specify subject matter, nature and duration of the processing. processing • Any transfer to (sub-) processors is made for the same subject matter, and nature as described above. A (sub-) processor will only process personal data as long as necessary in order for such a (sub-) processor to deliver the services to the controller controller, and shall thereafter return or delete any personal data based on the instructions of the controller, which holds to contract with the (sub-) processor. C.

LIST OF PARTIES Data. exporter(s): 1. Name: The name of the Institution as specified in the Clinical Trial Agreement. Address: The address of the Institution as specified in the Clinical Trial Agreement. Contact person’s name, position and contact details: See notice section of the Clinical Trial Agreement. Activities relevant to the data transferred under these Clauses: See Clinical Trial Agreement. Signature and date: See signature of the Clinical Trial Agreement, which these SCCs relate to. Role (controller/processor): Controller Contact information to the Data Exporter(s) DPO: xxxxxxxxxxxxxxxxxxx [enter info] Data importer(s): 1. Name: A. Janssen Research & Development, LLC Address: 000 Xxxxx 000 Xxxxx Xxxxxxx, Xxx Xxxxxx 00000 XXX Contact person’s name, position and contact details: See notice section of the Clinical Trial Agreement. Activities relevant to the data transferred under these Clauses: See Clinical Trial Agreement. Signature and date: See signature of the Clinical Trial Agreement, to which these SCCs relate. Role (controller/processor): Controller Contact information to the Data Importer(s) DPO: xxxxxxxxxxxxxxxxxxx xxxxxxxxxxxxxxxxxxxxxxxxxxx B. DESCRIPTION OF TRANSFER Categories of data subjects whose personal data is transferred. transferred The personal data transferred concern the following categories of data subjects: • Scientific and medical research subjects. • Scientific and medical research investigators and their staff, including, but not limited to, physicians and other health care professionals involved in administration of scientific research. • Other individuals involved in data exporter’s scientific and medical research (who may include consultants, representatives of service providers and business partners, government officials, and individuals who report adverse events and product quality complaints, among others). Categories of personal data transferred. transferred The personal data transferred concern the following categories of data: • For scientific and medical research subjects, personal details may include include: key-coded information, other relevant identifiers (e.g., patient number); gender; age or age category (e.g., adolescent, adult, elderly) or date of birth (if necessary), associated health condition(s), medical history, and relevant family history. • For health care providers, or other points of contact, scientific and medical investigators and their staff, and other individuals involved in scientific and medical research, personal details may include include: contact information and other related information, such as name, address, e-mail and telephone details, gender, and professional licenses and affiliations provided as part of their credentials. Sensitive data transferred (if applicable) and applied restrictions or safeguards that fully take into consideration the nature of the data and the risks involved, such as for instance strict purpose limitation, access restrictions (including access only for staff having followed specialized specialised training), keeping a record of access to the data, restrictions for onward transfers or additional security measures. • For research subjects, sensitive data may include include: key-coded information concerning certain health conditions and treatments, health-related information concerning adverse events and product quality complaints (if provided to the data exporter), and demographic information that may include race, ethnicity or other sensitive data that may be relevant to the adverse event (if provided to the data exporter). • See security measures in Annex II. Security measures include access only for staff having followed specialized specialised training, keeping a record of access to the data, restrictions for onward transfers, and key-coding the information. The frequency of the transfer (e.g., e.g. whether the data is transferred on a one-off or continuous basis). • Data is transferred continuously in as required under the study protocol. Nature of the processing • The processing concerns the execution of a clinical trial, as further specified in the study protocol. Purpose(s) of the data transfer and further processing • The transfer of personal data concerning research subjects is performed for the purpose of executing a clinical trial, as further specified in the study protocol. • Personal data concerning other categories of data subjects is processed for the purpose of performing activities under the Agreement and as required to satisfy any legal or regulatory obligations. The period for which the personal data will be retained, or, if that is not possible, the criteria used to determine that period. period • Any personal data will be retained as long as required considering the regulatory and legal requirement to retain records associated with the clinical trial and to satisfy the research objectives associated with the clinical trial. For transfers to (sub-) processors, also specify subject matter, nature and duration of the processing. processing • Any transfer to (sub-) processors is made for the same subject matter, and nature as described above. A (sub-) processor will only process personal data as long as necessary in order for such a (sub-) processor to deliver the services to the controller controller, and shall thereafter return or delete any personal data based on the instructions of the controller, which holds to contract with the (sub-) processor. C.