Master Agreement for Clinical Trials Management Services

Exhibit 10.41

Horn & Co. Final, May 3, 2018

Master Agreement for
Clinical Trials Management Services

This Master Agreement for Clinical Trials Management Services (the “Agreement”) is made and entered into on May 3,2018 and effective as of November 20,2017, (the “Effective Date”), by and between Biosight Ltd., an Israeli corporation, with offices at 0 Xxxxxxxx Xx., Xxxxxxx Xxxx, X.X.X 0000 Lod 7019802, Israel (hereinafter referred to as “Sponsor”) and Pharmaceutical Research Associates, Inc., a Commonwealth of Virginia corporation, together with its Affiliates, with offices at 0000 XxxxXxxx Xxxxxx, Xxxxx 000, Xxxxxxx, XX 00000 (hereinafter referred to as “PRA”), each hereinafter referred as “Party” and both hereinafter referred as “Parties”.

PRA is engaged in the business of providing services related to the design, implementation and management of clinical development programs for the pharmaceutical, biotechnology and medical device industries; and

Sponsor desires to engage PRA to perform such services in connection with certain pharmaceutical products under development by or under control of Sponsor;

Therefore, in consideration of the premises and mutual promises and undertakings herein, the receipt and sufficiency of which are hereby acknowledged, the Parties intending to be legally bound do hereby agree as follows:

1.0	Definitions

	a.	Affiliates: With respect to either Party, an Affiliate is any entity that is controlled by, controls, or is under common control with the party named above including joint venture partnerships where the Party has at least 50% of the voting power,

	b.	Amendment: A written specification of changes to a Task Order that is agreed to by the Parties and authorized by signature of each Party’s authorized representative(s), in a format substantially similar to Exhibit B attached hereto.

	c.	Applicable Anti-Bribery Laws: Any bribery, fraud, kickback, or other similar anti-corruption law or regulation of any relevant country, including the UK Xxxxxxx Xxx 0000 and the US Foreign Corrupt Practices Act of 1977,

	d.	Audit: A systematic and independent examination of trial related activities and documents to determine whether the evaluated trial related activities were conducted, and the data were recorded, analyzed and accurately reported according to the Protocol, standard operating procedures (SOPs), Good Clinical Practice (GCP), and the applicable regulatory requirement(s) (GCP 1.6),

	e.	Budget for Services: A component of a Task Order that outlines the estimated cost of the Services based upon the Project Specifications.

	f.	Inspection: The act by a regulatory authority (ies) of conducting an official review of documents, facilities, records, and any other resources that are deemed by the authority (ies) to be related to the clinical trial and that may be located at the site of the trial, at the Sponsor’s and/or contract research organization’s (CRO’s) facilities, or at other establishments deemed appropriate by the regulatory authority (ies) (GCP 1.29).

	g.	Institutional Review Board (“IRB”): Any board, committee, or other group formally designated by an institution to review, to approve the initiation of, and to conduct periodic review of, biomedical research involving human subjects. The primary purpose of such review is to assure the protection of the rights and welfare of human subjects. The term has the same meaning as the phrase institutional review committee, independent ethics committee or ethics committee.

Horn & Co. Final, May 3, 2018

	h.	Early Development Services: A Study performed at a facility or external investigative site for Phase I to Phase IIa clinical trials as designated in a Task Order.

	i.	GCP or Good Clinical Practice: The standard defined in the ICH Harmonised Tripartite Guideline For Good Clinical Practice E6(R1) Current Step 4 version dated 10 June 1996 (including the Post Step 4 corrections) together with, for Services performed in the European Union, such other Good Clinical Practice requirements as are specified in Directive 2001/20/EC of the European Parliament and the Council of 4 April 2001 relating to medicinal products for human use and in guidance published by the European Commission pursuant to such Directive; and for Services performed in other jurisdictions, any analogous laws and/or regulations. All, as may be updated or amended from time to time.

	j.	Institution: Any public or private entity or agency or medical or dental facility where clinical trials are conducted.

	k.	Investigator(s): Except where defined otherwise in a Task Order for Early Development Services, a third party responsible for the conduct of the clinical trial at a Trial Site. If a trial is conducted by a team of individuals at a Trial Site, the Investigator is the responsible leader of the team and may be called the principal investigator.

	l.	Key Personnel: The key PRA personnel assigned to the Services including the Project Manager and others as agreed to by the Parties.

	m.	Milestone: An event associated with a specific date, for which a payment will be due, as set out in the Payment Schedule of any Task Order.

	n.	Pass-Through Budget: A component of a Task Order that outlines the estimated costs of pass-through expenses for goods and services incurred by PRA on behalf of Sponsor, in connection with the performance of the Services.

	o.	Payment Schedule: A component of a Task Order that describes the timing of payments due to be made for Services delivered and pass-through expenses incurred,

	p.	PRA Project Manager: The PRA representative assigned to lead the PRA project team, act as the principal liaison between PRA and Sponsor, and provide general oversight in the delivery of Services with regard to a specific Task Order.

	q.	Project Schedule: A component of a Task Order that outlines the project milestones, estimated timelines and completion date for the Services based upon the Project Specifications,

	r.	Project Specifications: A component of a Task Order that outlines the specific Services to be provided, assumptions used in preparing the Budget for Services, Pass-Through Budget and Project Schedule, and assignment of project-related responsibilities between the Parties.

	s.	Services: The services to be provided by PRA and Subcontractors (if applicable) under this Agreement as specifically outlined in a Task Order or otherwise authorized by Sponsor.

Horn & Co. Final, May 3, 2018

	t.	Study: A clinical trial performed at one or more investigative sites under the supervision of one or more Investigator(s) pursuant to a study Protocol.

	u.	Subcontractor: An individual or company engaged to conduct some elements of a Task Order, including without limitation, clinical laboratories, patient recruitment services, interactive voice recognition systems and other services. Investigators are not included as subcontractors.

	v.	Task Order: A written specification of Services to be performed by PRA under this Agreement, including the Project Specifications, Project Schedule, Contact Information, Budget for Services, Pass-Through Budget, and Payment Schedule.

	w.	Trial Site(s): Except where defined otherwise in a Task Order for Early Development Services, a third party location where trial-related activities are actually conducted following Sponsor’s written approval of such Trial Site and the terms of operation therein.

2.0	Services

	PRA, itself or through one of its Affiliates or Subcontractors (if applicable), will perform the Services in accordance with: (i) the Protocol, (ii) the terms and conditions of this Agreement and the associated Task Order, (ii) PRA’s standard operating procedures, which will be available for review upon written request of Sponsor, or when applicable and agreed under the Task Order, Sponsor’s standard operating procedures (iii) all applicable laws, rules and regulations including GCP, (iv) the standards and practices that are generally accepted in the industry and exercised by other entities engaged in performing similar services; and (v) the written instructions of Sponsor, from time to time. PRA shall use commercially reasonable efforts, skills and resources to diligently and competently perform the Services described in any Task Order issued hereunder and to meet all obligations and deadlines described in such Task Orders. The Parties will agree in advance on all Services to be provided and the performance of those Services will be authorized in writing through the execution of a Task Order. Unless otherwise agreed to by the Parties in writing, PRA will not begin work on any Services without an executed Task Order authorizing the Services. During the term of this Agreement PRA shall provide Sponsor with periodically written progress reports, as shall be further agreed between the Parties. PRA representatives conducting and/or supervising the Services shall be available during the term of this Agreement for meetings from time to time, as agreed under the Task Orders, during regular business hours for updates with Sponsor representatives.

2.1	Task Orders

	PRA will provide Services as specified in one or more Task Orders, which will be prepared in a format substantially similar to the Form of Task Order, attached hereto, as appropriate. Each Task Order may include detailed information, as applicable, with respect to a specific project, including Project Specifications, Project Schedule, Budget for Services, Pass-Through Budget, and Payment Schedule. Task Orders will become effective when signed by an authorized representative of both Parties.

2.2	Amendments

	Any changes to a Task Order, including but not limited to changes to the Project Specifications, Project Schedule, Budget for Services or Pass-Through Budget, will be agreed upon by the Parties and documented in an Amendment to the Task Order in a form substantially similar to that attached hereto as Exhibit B. Sponsor agrees that PRA will not perform any out-of-scope work described in an Amendment until it is approved in writing by both Parties.

Horn & Co. Final, May 3, 2018

a.	Amendment Process. Some changes in costs associated with clinical research are not within the control of PRA and PRA will not be responsible for any such changes. Upon identification by either Party of changes to the project assumptions or other changes to the Project Specifications, the Parties will negotiate in good faith an Amendment to accommodate increases or decreases to the Project Budget, Project Schedule, and Payment Schedule that are reasonably associated with any such adjustments. Amendments will be documented in accordance with the terms of this Section 2.2. Such changes may include, but are not limited to, any of the following (in all cases, to the extent that such delays are indeed not within the control of PRA):

	i.	delays in receiving from Sponsor technical information or Sponsor’s acceptance of documents submitted by PRA in a timely manner in the performance of its duties under this Agreement or any Task Order, or any other delay on the part of Sponsor;

	ii.	delay in receipt of regulatory approval from a regulatory agency, IRB, or Ethics Committee;

	iii.	delay in performance by a Subcontractor not selected by PRA;

	iv.	delay in shipment of study drug, clinical samples, and/or clinical supplies;

	x.	xxxxx due to changes in standard of care, clinical landscape, regulation, or changes in medical practice affecting participating sites;

	vi.	delay by reason of force majeure as defined herein;

	vii.	Sponsor requested changes to the Services or the Protocol;

	viii.	delays due to questions received by either Party from regulatory agencies or ethics committees regarding submission materials that relate to characteristics of the study drug or Protocol design;

	ix.	delays due to any changes in applicable law or regulatory environment; or

	x.	changes for any other reason agreed upon in writing and in advance by Sponsor to be changes outside PRA control,

2.3	Project Staffing

	In performing the Services, PRA will assign personnel who are adequately trained, qualified and experienced to conduct the work as specified in a Task Order. Sponsor may make reasonable requests for replacement of assigned personnel for cause, such as unsatisfactory performance or interpersonal conflicts. PRA will promptly respond to any such request and make reasonable efforts to correct the situation in order to improve performance, or to provide a replacement, at its own expense, within a mutually agreeable timeframe.

		Key Personnel. PRA will assign a PRA Project Manager and other employees whose participation in a project is required for the duration of the project, who will serve as Key Personnel. For clarity, the Key Personnel are the functional team leads as determined in each Task Order. Key Personnel may include, without limitation, Lead Data Managers and Medical Monitors and Lead Biostatisticians. PRA will provide thirty (30) days notice to Sponsor, whenever possible, of any changes to the Key Personnel and PRA will make reasonable efforts to manage the impact in the Study, PRA will provide project-specific training to replacement Key Personnel at its own expense. Notwithstanding the foregoing, the following Key Personnel may not be replaced without the Sponsor’s prior written consent: PRA Project Manager (“PM”) and Clinical Team Manager (“CTM”), unless in circumstances (i) which are not within the control of PRA (as termination of the employment, sickness, absence, maternity/paternity leave of that employee, etc.,), (ii) promotion of such individual, or (iii) underutilization of such individual in connection with the Project on which such individual is assigned as a PM or CTM, the following procedure shall apply; (a) PRA will make reasonable efforts to manage the impact in the Study; (b) the situation shall be discussed in good faith between the parties to find a reasonable solution; and (c) the transition process (unless such transition process is not possible, e.g.: sickness, absence, etc.), and, in any case, the replacement shall be made in consultation and agreement with Sponsor. Sponsor’s agreement shall not be unreasonably withheld.

Horn & Co. Final, May 3, 2018

	a.	Project Team. PRA will assign non-Key Personnel from one or more of its offices located worldwide, as needed to perform the Services in accordance with the Task Order. Sponsor will receive in advance the CV of the Clinical Research Associates.

	From time to time, PRA may assign some elements of the Services to contract employees. PRA agrees that any contract employees used to perform the Services will be adequately qualified, experienced and trained as required to perform the Services in the same manner as PRA qualifies and trains its own employees. PRA will remain responsible for satisfactory performance of all Services performed by contract employees.

	In the event that any unauthorized change of PM and CTM (or the procedure above was not followed when applicable), and provided such authorization was not unreasonably withheld, shall directly result in a delay or have any other direct adverse effect to the Project, then, without derogating from any other right or remedy to which Sponsor may be entitled, PRA shall reimburse BioSight for the portion of Services in failure due to such unauthorized replacement.

2.4	Use of Subcontractors

	Upon and subject to the prior written approval of the Sponsor, PRA may use Subcontractors to conduct some elements of the Services. In the event that Sponsor objects, for reasonable cause, to any such Subcontractors selected and contracted directly by PRA, PRA will replace the Subcontractor within a mutually agreeable timeframe. Sponsor may request that PRA contracts and uses a specific subcontractor, but such engagement will be subject to PRA’s written consent to engage such subcontractor. Such written consent will be subject to PRA performing the necessary activities to qualify and approve a subcontractor, and negotiate contractual terms, and will not be withheld unreasonably. PRA will be responsible and retain primary liability for the performance and agrees to manage the performance of all Subcontractors whom have been qualified, approved and contracted by PRA according to PRA SOPs. In the unlikely event that PRA is unable to consent to engage with a Sponsor requested subcontractor, PRA will work with Sponsor to find a mutually acceptable solution for the Services, and to clarify, PRA will not be responsible for the performance of such unapproved subcontractors.

2.5	Applicable Standards

	The Parties agree that PRA will provide the operational systems, processes and standard operating procedures to be used in performance of the Services unless specified otherwise in the Task Order. All Services will be conducted in accordance with GCP and applicable laws and regulations.

Horn & Co. Final, May 3, 2018

2.6	Sponsor-Provided Systems

	In the event that Sponsor requires PRA to use Sponsor’s information systems and associated processes, Sponsor will be responsible for all costs associated with installation and operation of the systems, including costs for hardware and software licenses, and for training of PRA personnel assigned to the project in the use of Sponsor system(s)

3.0	PAYMENT

	The Parties agree that the fees and other reimbursements that PRA will receive for performing the Services hereunder will be outlined in each Task Order and are subject to the following terms and conditions.

3.1	Compensation for Services

	For Services provided, Sponsor will pay PRA in accordance with the terms in this section of the Agreement and each applicable Task Order. The timing and frequency of payments will be governed by the Payment Schedule detailed in each Task Older.

3.2	Pass-Through Budget

	a.	Pass-Through Expenses. In order to provide funding for pass-through expenses, exclusive of investigator grants described below, Sponsor will make an advance payment to PRA in an amount set forth in a Task Order immediately upon execution of the Task Order. PRA will submit to Sponsor monthly invoices for amounts incurred during the relevant billing period. The advance payment will be retained by PRA until the completion of the Services, at which time a reconciliation of expenses will be done to ensure that Sponsor pays for only those expenses actually incurred. The advance payment will then be applied to the final invoice, if unpaid, and any remaining advance payment will be refunded to Sponsor within thirty (30) days from the date of the final reconciliation.

	b.	Sponsor will reimburse all travel expenses in accordance with PRA’s applicable Travel and Expense Policy (to be provided upon request). Each invoice will include, as necessary, a summary of all pass-through expenses. Provided however, that any such expense which exceeds an amount of US$ 500 (per single expense), and was not originally included in the Task Order budget, shall be subject to the advanced written approval of the Sponsor.

3.3	Investigator Grants and Reconciliation.

	In order to provide for timely payments to Investigators, Sponsor will make an additional advance payment to PRA in an amount set forth in a Task Order immediately upon execution of a Task Order. PRA will submit to Sponsor quarterly invoices in advance for estimated amounts to be paid to Investigators to be incurred in the upcoming quarter to ensure that adequate funds are available to pay such expenses. Sponsor agrees that PRA will not make payments to Investigators without sufficient funds available. The advance payment will be retained by PRA until the completion of the Services, at which time a reconciliation of expenses will be done to ensure that Sponsor pays for only those expenses actually incurred. The advance payment will then be applied to the final invoice, if unpaid, and any remaining advance payment will be refunded to Sponsor within thirty (30) days from the date of the final reconciliation.

3.4	Invoices

	a.	Invoices for Services and pass-through expenses will be submitted in accordance with the Payment Schedule associated with the relevant Task Order and will be prepared monthly, or as frequently as necessary. Any final payments specified in the Task Order will be invoiced upon completion of the project and delivery to Sponsor of any final study databases, reports or other deliverables as specified in the Project Specifications.

Horn & Co. Final, May 3, 2018

	b.	All invoices under this Agreement will be forwarded to the Sponsor representative designated in the relevant Task Order.

	c.	All payments under this Agreement will be remitted to the PRA affiliate named in the Task Order, to the address and in the manner set forth in the Payment Schedule of the applicable Task Order.

3.5	Payment Terms

	Sponsor agrees to pay for Services and pass-through expenses in accordance with the Payment Schedule outlined in each Task Order or associated Amendment. Sponsor will pay for all Services, pass-through expenses and other invoiced items within thirty (30) days of the last day of the calendar month in which the Sponsor had received the respective invoice. If Sponsor notifies PRA in writing of any deficiencies in the Services during such period, Sponsor will pay for the portions of the Services that conform to the Task Order within thirty (30) days of the last day of the calendar month in which the Sponsor had received the respective invoice and PRA will correct any non-conforming Services within thirty (30) days of the notice. Upon final shipment of the corrected Services, PRA will submit the invoice for the corrected Services to Sponsor. All payments will be made in the currency noted in the Payment Schedule of the Task Order. All fees for Services and pass-through expenses are exclusive of VAT (including non- refundable VAT) or similar taxes payable by Sponsor under applicable law, including local taxes, social taxes, charges or remittance fees over the pass-through expenses, which Sponsor will pay when applicable. In the event that value added tax (VAT) must be paid by PRA on pass-through expenses and when such VAT is not recoverable by PRA because such recovery is legally impermissible based on the facts and circumstances of the engagement with the third party suppliers, or when PRA considers that it would not be commercially viable to pursue the recovery, PRA may charge such VAT to Sponsor and if Sponsor has any question about such not recoverable VAT, PRA shall provide information. Each Party shall be solely responsible for the payment of all taxes imposed on its share of income arising directly or indirectly from its activities or receipt of payments under this Agreement. To the extent Sponsor is required to deduct and withhold taxes on any payment to PRA hereunder, after exhausting available legal remedies, it shall pay the amounts of such taxes to the proper governmental authority in a timely manner and promptly transmit to PRA an official lax certificate or other evidence of such withholding sufficient to enable PRA to claim such payment of taxes. PRA shall provide Sponsor any tax forms that may be reasonable necessary in order for Sponsor not to withhold tax or to withhold tax at a reduced rate under applicable law.

3.6	Currency Management.

	The Parties agree that neither should receive a material benefit or detriment from currency exchange rate fluctuation between the currencies in which costs are incurred, and the currencies used for pricing or invoicing and payment.

	a.	Service Fees: For service fees, the bid currencies will be tracked and managed against the contract currency established in each Task Order. On an annual basis a currency review may occur to assess the impact of currency fluctuation on the value of services using the average rate during the evaluation period as published by Xxxxx.xxx on the basis of the date of invoicing. For exchange rate fluctuations of less than 5% no adjustments will be made. Once the Parties have agreed upon the impact of any currency fluctuation PRA will issue an invoice or credit memo as appropriate. The Parties will also discuss at that time whether to amend the value of the Task Order to reflect trends in currency fluctuation.

Horn & Co. Final, May 3, 2018

	b.	Expenses. For pass-through expenses and investigator grants, conversion from the currency in which the payment is made to the contract currency will occur at the time the transaction is processed using daily exchange rates provided by Xxxxx.xxx. Due to investigator fee invoices being raised on a forecast of payments to be made a retrospective reconciliation will occur at the end of the project using the actual exchange rates applied.

	For Early Development Services, the Study budget will be agreed upon in the currency of the country where the Study will be performed, provided however, if an exchange rate fluctuation mechanism is applicable the mechanism will be set out in the Task Order.

4.0	Term and Termination

4.1	Term

	Unless earlier terminated, this Agreement will remain in effect for an initial term of three (3) years from the Effective Date. In the event of expiration or termination of this Agreement, any outstanding Task Order will continue until completion of the Services described in such Task Order or appropriate termination of the Task Order.

4.2	Termination

	a.	The Sponsor may terminate this Agreement or any Task Order for any reason upon thirty (30) days written notice to PRA.

	b.	Each Party may terminate this Agreement or any Task Order upon written notice to the other Party in the event of a material breach of this Agreement or any Task Order by the other Party that is not cured within sixty (60) days of receipt of written notice of breach.

	c.	Each Party may terminate this Agreement or any Task Order immediately upon written notice to the other Party, if the other Party; (i) files a petition for bankruptcy or has an involuntary bankruptcy petition filed against it; (ii) is adjudged as bankrupt; (iii) becomes insolvent; (iv) has a receiver, trustee, conservator or liquidator appointed for all or a substantial part of its assets; (v) ceases to do business; (vi) commences any dissolution, liquidation or winding up; or (vii) makes an assignment of its assets for the benefit of its creditors.

	4.3	Termination for Other Reasons

	If PRA’s continued performance of the Services contemplated by this Agreement or any Task Order could constitute a potential or actual violation of legal, regulatory, ethical or scientific standards, then PRA may terminate this Agreement or any Task Order by giving written notice stating the effective date (which may not be less than sixty [60] days from the notice date) of such termination. The Parties shall use all reasonable efforts to rectify the alleged violation prior to the end of such notice period.

	4.4	Effects of Termination/Expiration

	In the event of termination or expiration of this Agreement or any Task Order, Sponsor will pay PRA for Services performed up to the effective date of termination, non-cancellable costs and expenses and any associated wind down costs incurred up to effective date of termination. Within thirty (30) days of either Party’s receipt of such notice, the Parties will meet to develop a plan for closing down this Agreement or the applicable Task Order, which will include transferring any remaining tasks or other responsibilities to Sponsor or its designee. In the event of termination or postponement of Early Development Services, additional terms will apply as set forth in the applicable Task Order.

Horn & Co. Final, May 3, 2018

4.5	Survival

	Expiration or termination of this Agreement will not relieve the Parties of any obligation accruing prior to such expiration or termination. In addition, the Sections on Payment, Term and Termination, Representations and Warranties, Debarment Certification, Ownership of Data and Intellectual Property, Confidential Information, Indemnification, and Employees as well as any other sections which by their nature should survive, will survive expiration or termination of this Agreement indefinitely, or for the period of time noted in the specific clause.

5.0	Representations and Warranties

5.1	Acknowledgments

	Sponsor acknowledges and agrees that the results of the Services to be provided hereunder are inherently uncertain and that, accordingly, there can be no assurance, representation or warranty by PRA that the drug, compound, device or other material which is the subject of research covered by this Agreement or any Task Order issued hereunder can, either during the term of this Agreement or thereafter, will be successfully developed or, if so developed, will receive the required approval by the United States Food and Drug Administration (“FDA”) or other regulatory authority.

5.2	Mutual Representations

	Each of the Parties represents, warrants and covenants to the other that: (a) it has taken all necessary actions on its part to authorize the execution, delivery and performance of the obligations undertaken in this Agreement, and no other corporate actions are necessary with respect thereto; (b) it is not a party to any agreement or understanding and knows of no law or regulation that would prohibit it from entering into and performing this Agreement; (c) when executed and delivered by it, this Agreement will constitute a legal, valid and binding obligation of it, enforceable against it in accordance with this Agreement’s terms; (d) it is duly licensed, incorporated, authorized or qualified to do business and is in good standing in every jurisdiction in which a license, authorization or qualification is required for it to perform its obligations under this Agreement; (e) it will perform its obligations hereunder in accordance with current industry standards, the terms of this Agreement and any Task Order issued hereunder; (f) it will perform its obligations hereunder in accordance with all applicable federal, international, state or local law or regulation, including all Applicable Anti-Bribery Laws in the countries where Services are to be performed; (g) performance of its obligations hereunder will not infringe or violate the rights of any third party including but not limited to property, contractual, employment, trademark, trade secrets, copyright, patent, proprietary information and non-disclosure rights; and (h) it will not enter into any other agreements which would interfere or prevent performance of the obligations described herein.

5.3	Representations and Warranties of Sponsor

	a.	Sponsor represents and warrants that it has the right, title and interest in the drug, compound, device or other material which is the subject of research covered by this Agreement or any Task Order (whether such right, title and interest is held solely by Sponsor or jointly with others) and that it has the legal right, authority and power to perform any clinical trial which is the subject of a Task Order issued hereunder.

Horn & Co. Final, May 3, 2018

	b.	If Sponsor requires PRA to use MedDRA to code, analyze or report data for a Study, Sponsor represents and warrants that it has a current and valid license agreement with the Maintenance and Support Services Organization (“MSSO”) to use MedDRA. Furthermore, if PRA is required to use WHO Drug, WHO Herbal or WHO ART for coding of data, Sponsor warrants and represents that it has a current and valid license agreement with The Uppsala Monitoring Centre for the dictionaries which PRA will be required to use. If Sponsor does not currently have such licenses, it represents and warrants that such licenses will be in place prior to PRA’s delivery of data which is coded using these dictionaries. PRA will not be liable to Sponsor for use of data coded without proper licensing, and Sponsor will hold PRA harmless in these occasions.

	c.	Sponsor further warrants and represents that for any software application, computer system or program that is required to be used by PRA in the performance of Services to which PRA does not hold a license at the commencement of this Agreement or the relevant Task Order, Sponsor will have acquired and will maintain current and valid licenses which are necessary for the use of such applications or programs, and that PRA’s use of such applications or programs will not subject PRA to any liability for such use.

	d.	Any drug material used in a Study that is provided by or on behalf of Sponsor will be manufactured, packaged, labeled, and shipped in accordance with all applicable laws, rules, and regulations, including, without limitation, applicable current Good Manufacturing Practices (“cGMPs”) as such cGMPs may be adopted in any nations in which such study drugs are imported or manufactured, as applicable.

5.4	Representations and Warranties of PRA

	a.	PRA represents and warrants that without derogating from the representations set forth in Section 2 above, it has the experience, capability, and resources necessary to perform Services under this Agreement, and that the personnel assigned to perform Services rendered under this Agreement will be capable professionally.

	b.	PRA further represents and warrants that it will make available to Sponsor or to the responsible regulatory authority relevant records, programs, and data as may be reasonably requested by Sponsor for purposes related to filing and prosecution of Sponsor’s related new drug applications.

	c.	In conformity with any applicable law, including the United States Foreign Corrupt Practices Act (“USFCPA”), PRA and its employees and officers shall not directly or indirectly make any offers, payments, promises to pay, or authorize payment, or offer a gift, promise to give, or authorize the giving of anything of value for the purpose of influencing an act (including a decision not to act) or decision of an official of any government within the territory in which the Agreement is being executed or inducing such a person to use his/her influence to affect any such governmental act or decision in order to assist Sponsor (or its clients) in obtaining, retaining or directing business for the benefit of Sponsor (or its clients) if such action on the part of PRA would be in violation of such applicable law,

5.5	No Other Warranties

	The Parties’ warranties and representations contained in this Agreement are in lieu of all other warranties expressed or implied.

Horn & Co. Final, May 3, 2018

6.0	Debarment Certification

	a.	PRA certifies that it has not been debarred under Section 306 of the Federal Food, Drug, and Cosmetic Act, 21 U.S.C. §335a(a) or (b) or any equivalent local law or regulation. In the event that PRA becomes debarred, PRA agrees to notify Sponsor immediately,

	b.	PRA certifies that it has not and will not use in any capacity the services of any individual, corporation, partnership, or association which has been debarred under Section 306 of the Federal Food, Drug and Cosmetic Act, 21 X.X.X §000x (a) or (b) or any equivalent local law or regulation. In the event that PRA becomes aware of or receives notice of the debarment of any individual, corporation, partnership, or association providing services to PRA, which relate to the Services being provided under this Agreement, PRA agrees to notify Sponsor immediately.

7.0	Inspections and Audits

7.1	Audit by Sponsor

	During the term of this Agreement, PRA will permit representatives of Sponsor who are not competitors of PRA, to examine, at a reasonable time during normal business hours, upon prior written notice to PRA of at least sixty (60) days for once per 12 month period routine audits and at least three (3) days for cause/emergency audits (which shall not be limited by number of audits): (i) the facilities where the Services are being, will be or have been conducted; (ii) related study documentation; and (iii) any other relevant information necessary for Sponsor to confirm that the Services are being or will be or have been conducted in conformance with applicable standard operating procedures, the specific Task Orders, this Agreement and in compliance with applicable laws and regulations. PRA will promptly provide copies of any materials reasonably requested by Sponsor during such audit. However, Sponsor acknowledges that such audits may not be possible due to reasons outside the reasonable control of PRA. In such cases, PRA will endeavor to arrange such audit on the first available date after the sixty (60) day notice and in any event within 75 days from the notice date.

7.2	Inspection by Regulatory Authorities

	During the term of this Agreement, each Party will permit regulatory authorities to examine, (i) the facilities where the Services are being conducted; (ii) study documentation; and (iii) any other relevant information, including information that may be designated by one or both of the Parties as confidential, reasonably necessary for regulatory authorities to confirm that the Services are being conducted in compliance with applicable laws and regulations. Each Party will immediately notify the other if any regulatory authority schedules, or without scheduling, begins an inspection that relates to the Services or the Parties’ respective obligations hereunder. PRA shall disclose to Sponsor any finding from any regulatory authority that is directly related to the Services herein, and if permitted by the regulatory authority shall promptly provide Sponsor with a copy of the inspection report after the removal of any information of a confidential nature which is not related to the Services or to Sponsor’s activities or products, PRA shall reasonably act to contractually obtain, if PRA is responsible for contracting the Trial Sites, the cooperation of investigators and Trial Sites with respect to regulatory review. As part of PRA’s quality management procedures, PRA conducts periodical audits of its processes and systems. If such audits identify critical findings that impact the Services and/or Sponsor’s activities, PRA agrees to inform Sponsor of such findings.

Horn & Co. Final, May 3, 2018

7.3	Audits of Trial Site(s) by PRA; Recruitment by Trial Sites

	In connection with PRA’s provision of Services as specified in this Agreement and any associated Task Order, PRA may conduct audits of Trial Sites, and will conduct such audits at Sponsor’s written request and expense, Based on PRA’s observations of any Trial Site, PRA may recommend to Sponsor: i) that enrollment should be suspended at the Trial Site; ii) that a Trial Site’s non-compliance needs to be reported to regulatory authorities; and/or (iii) Trial Site’s participation in a Study needs to be terminated. Upon such a recommendation, PRA will present to Sponsor a basis for its decision. If Sponsor disagrees with the basis for PRA’s recommendation, PRA may in its discretion assign its contract with the Trial Site to Sponsor and Sponsor agrees to accept such assignment and to be responsible for all contractual duties and obligations to the Trial Site. Without derogating from the foregoing, both Parties agree to notify the other Party of instances of continued non-compliance or suspected scientific misconduct by Trial Sites, Investigators or Key Personnel, as it relates to the Services.

	7.3 (A). In the event that any Trial Site is recommended by PRA, or PRA accepts a Trial Site suggested by Biosight without raising concerns, and they shall not recruit the expected total number of patients set forth in the respective Task Order (provided no unforeseen events occurred that were outside PRA’s control as noted in section 2.2.a), Sponsor shall decide, in consultation and agreement with PRA, the correct course of action, and PRA shall bear the cost of any new or replacement Trial Sites to recruit the original amount of total patients included in the original Task Order, including without limitation, any reasonably identifiable delays caused by such replacement, as discussed and agreed by Sponsor and PRA in good faith.

8.0	Ownership of Data and Intellectual Property

	All data (including without limitation, written, printed, graphic, video and audio material, and information contained in any computer database or computer readable form) generated or collected by PRA in the course of conducting the Services (the “Data”) and related to the Services will be Sponsor’s property. Any copyrightable work created in connection with performance of the Services and contained in the Data will be considered work made for hire, whether published or unpublished, and all rights therein will be the property of Sponsor as employer, author and owner of copyright in such work.

	The underlying rights to the intellectual property and materials that are the subject of each Task Order, including, without limitation, all intellectual property rights in Sponsor’s drug candidates or products, are owned solely by Sponsor. Neither PRA, its Affiliates nor any of their respective Subcontractors will acquire any rights of any kind whatsoever with respect to Sponsor’s drug candidates or products as a result of conducting Services hereunder. All rights to any know-how, trade secrets, developments, discoveries, inventions or improvements (whether or not patentable) conceived or reduced to practice in the performance of work conducted under this Agreement by PRA’s or its Affiliates’ employees, or independent contractors, either solely or jointly with employees, agents, consultants or other representatives of Sponsor (the “Intellectual Property”), will be owned solely by Sponsor. PRA, its Affiliates and their respective employees and Subcontractors will sign and deliver to Sponsor all writings and do all such things as may be necessary or appropriate to vest in Sponsor all right, title and interest in and to such Intellectual Property, PRA will promptly disclose to Sponsor any such Intellectual Property arising under this Agreement. Sponsor may, in its sole discretion, file and prosecute in its name and at its expense, patent applications on any patentable inventions within the Intellectual Property. Upon the request of Sponsor, and at the sole expense of Sponsor, PRA will assist Sponsor in the preparation, filing and prosecution of such patent applications and will execute and deliver any and all instruments necessary to effectuate the ownership of such patent applications and to enable Sponsor to file and prosecute such patent applications in any country.

Horn & Co. Final, May 3, 2018

	Notwithstanding the foregoing, Sponsor agrees that PRA possesses or may in the future possess analytical methods, computer technical expertise and software, which do not relate specifically to the Sponsor’s products or Intellectual Property, and which have been independently developed by PRA and which will remain the sole and exclusive property of PRA, except to the extent that improvements or modifications include, incorporate or are based upon Sponsor’s information, in which case these will belong to Sponsor as set forth above. Improvements or enhancements made to PRA’s processes or methods which are independently developed incidental to the provision of Services hereunder and are not directly related to Sponsor’s products or Intellectual Property will remain the sole property of PRA. Sponsor may use this information of PRA free of charge for interpretation purposes or regulatory authorities’ purposes or for any purposes that are appropriate within the scope of this Agreement, to the extent necessary or desirable to commercialization of Sponsor’s products, if applicable. Any improvement on information of Sponsor will remain the sole property of Sponsor.

8A.	Maintenance and Disposition of Computer Files and Study Materials

	PRA shall maintain all materials and all other Data obtained or generated by PRA in the course of providing the Services and will take reasonable and customary precautions, including periodic backup of computer files, to prevent the loss or alteration of Sponsor’s study Data, documentation, and correspondence. Upon termination of a Study PRA will send to the Sponsor the electronic Trial Master File.

9.0	Confidential Information

9.1	Sponsor Confidential Information

	a.	Sponsor may disclose confidential information to PRA during the course of this Agreement. All information provided by or on behalf of Sponsor (including the study drug) or Data collected by PRA during the performance of the Services, including the study results and Sponsor’s Intellectual Property are deemed to be the confidential information of Sponsor and is hereinafter referred to as “Sponsor Information”. PRA will not disclose Sponsor Information to any person other than its employees, agents, Investigators, Trial Sites, regulatory authorities, IRBs (only to the extent required by applicable law) and Subcontractors involved in the Services to whom it needs to disclose such specific information or use any such information for any purpose other than the performance of Services without the prior written consent of Sponsor.

	b.	PRA will require (and be responsible) that it and its Affiliates’ employees, agents, Subcontractors and shall require (and take any reasonable action and collaborate with the Sponsor to require) that the Investigators and Trial Sites involved in the Services will comply with terms substantively similar to the confidentiality provisions of this Agreement, pursuant to a form of confidentiality and non-use agreement approved by Sponsor in advance. PRA will disclose only the Sponsor Information to those of its employees, agents, Investigators, Trial Sites and Subcontractors who reasonably need to know the Sponsor Information. The disclosure to Investigators and Trial Sites shall be pursuant to a form of confidentiality and non-use agreement approved by Sponsor in advance.

	c.	PRA will exercise due care to prevent the unauthorized disclosure and use of Sponsor Information associated with the Services.

Horn & Co. Final, May 3, 2018

	d.	This confidentiality, nondisclosure and nonuse provision will not apply to Sponsor Information that PRA can demonstrate by competent evidence:

	i.	was known by PRA before initiation of the Services or which is independently discovered, after the initiation of the Services, without the aid, application of use of Sponsor Information, as evidenced by written records;

	ii.	was in the public domain at the initiation of the Services or subsequently became publicly available through no fault or action of PRA, provided however, that Sponsor Information shall not be deemed to be in the public domain merely because any part of the Sponsor Information is embodied in general disclosure or because individual features, components or combinations thereof are now or become known to the public; or

	iii.	was disclosed to PRA on a non-confidential basis by a third party authorized to disclose it,

	e.	In no event will either Party be prohibited from disclosing confidential information of the other Party to the extent required by law to be disclosed, provided that the disclosing Party provides the non-disclosing Party with written notice thereof, prior to disclosure, to the extent reasonably practicable, discloses only what is required to be disclosed by law or regulation, and, at the non-disclosing Party’s request and expense, cooperates with the non-disclosing Party’s efforts to obtain a protective order or other confidential treatment of the confidential information required to be disclosed. Since a breach by PRA of any of the promises or agreements contained herein may result in irreparable and continuing damage to Sponsor for which there may be no adequate remedy at law, Sponsor shall be entitled to seek injunctive relief and/or a decree for specific performance, and such other relief as may be proper (including monetary damages if appropriate). Nothing in this Section shall be construed as derogating from any right or remedy that the Sponsor may be entitled to under applicable law or this Agreement.

9.2	PRA Confidential Information

	Sponsor agrees that all business processes, contract terms, prices, procedures, policies, methodologies, systems, computer programs, software, applications, databases, proposals and other documentation generally used by PRA and not developed solely for the Sponsor pursuant to the provisions of Section 8.0 above, are the exclusive proprietary and confidential property of PRA (hereinafter “PRA Information”) or the third parties from whom PRA has secured the right of use. Sponsor agrees that all PRA Information, along with any improvement, alteration or enhancement made thereto during the course of the Services, will be the exclusive proprietary and confidential property of PRA, and will be subject to the same degree of protection as is required of PRA to protect Sponsor Information.

9.3	Disposition of Confidential Information

	At the conclusion of a Study, or upon the written request of the Sponsor, PRA will deliver to Sponsor or destroy, as the Sponsor may request in its sole discretion, all Sponsor Information in its possession unless Sponsor directs otherwise. Sponsor may communicate any special request for the disposition of materials in writing to PRA. Sponsor will bear all costs incurred by PRA in complying with any such written instructions furnished by Sponsor (provided that disposal or return costs which exceed, in the aggregate, US$ 250, shall require the prior written approval of tire Sponsor). PRA will provide a written estimate to Sponsor, and Sponsor will provide written approval, of all such costs prior to any action by PRA. PRA shall use all reasonable efforts to destroy all notes, summaries, analyses and reports made by PRA’s employees, agents and consultants containing such Sponsor Information. Provided, however, that PRA shall be entitled to retain in confidence under this Agreement one archived copy of Sponsor Information solely for the purpose of administering PRA’s obligations under this Agreement and Sponsor Information contained in PRA’s electronic back-up files that are created in the normal course of business pursuant to PRA’s standard protocol for preserving its electronic records.

Horn & Co. Final, May 3, 2018

9.4	Data Privacy

	Definitions. For the purpose of this Section 9.4, ‘Personal Data’, ‘Process/Processing’, ‘Data Controller’, ‘Data Processor’ and ‘Data Subject’ shall have the same meaning as in Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data (“Directive 95/46/EC”) as implemented in the law of any EU Member State which is applicable to the provision of the Services or as defined in the law of any other country which is applicable to the provision of the Services (including, as applicable, the Regulation (EU) 2016/679 of the European Parliament and the Council of 27 April 2017 (“GDPR”), the Health Insurance Portability and Accountability Act of 1996 (HIPAA) Privacy and Security Rules, 45 C.F.R. Parts 160-164, and the Health Information Technology for Economic and Clinical Health Act (HITECH), P.L. No. 111-005, Part I, Title XIII, Subpart D, 13401-13409, and state privacy laws) (collectively referred to as the “Applicable Data Privacy Laws”).

	Compliance. Each Party warrants to the other that it will Process the Personal Data in compliance with all Applicable Data Privacy Laws.

	Data Processing Agreement, attached hereto as Exhibit C, shall be incorporated into and an effective part of the Task Order and this Agreement. The Parties will execute the Annexes to the Data Processing Agreement with each Task Order.

	Data Processing. Sponsor and PRA acknowledge that Sponsor is the Data Controller and PRA is the Data Processor with respect to the Processing of Personal Data relating to the Services provided under this Agreement. PRA shall Process the Personal Data only in accordance with the written instructions from Sponsor or as may be required or permitted by law (the instructions may be specific instructions or instructions of a general nature as set out in this Agreement, a Task Order, the Protocol, or as otherwise notified by Sponsor to PRA during the term hereof).

	Security. PRA shall implement appropriate technical and organizational measures to protect the Personal Data as required by GCP and Applicable Data Privacy Laws.

	Data Privacy Requests. PRA shall promptly notify Sponsor in writing if it receives any communication with regard to data privacy relating to the Services from a Data Subject, a privacy authority or other regulatory authority, and provide Sponsor with cooperation and assistance in relation to any such communication from Data Subjects. PRA shall be entitled to charge Sponsor for such assistance, at its usual hourly rate, unless the communication relates to a breach or violation by PRA of its obligations under this Section 9.4. However, PRA and Sponsor recognize that any fees charged to the requesting Party must comply with Applicable Data Privacy Laws.

	Security Breaches, If PRA becomes aware of any breach of an Applicable Data Privacy Law at PRA or its sub-processors relating to the Services, then it shall promptly notify Sponsor and, if requested, assist Sponsor with investigating the breach and in meeting any obligations under Applicable Data Privacy Law to notify Data Subjects, regulatory authorities or other required parties, as applicable. PRA shall be entitled to charge Sponsor for such assistance, at its usual hourly rate, unless PRA was solely responsible for such breach.

	Data transfers. PRA shall only Process or otherwise transfer Personal Data outside the European Economic Area (“EEA”) (member states of the European Union plus, Norway, Iceland & Liechtenstein) as necessary to provide Services under this Agreement, or any Task Order or where otherwise instructed by Sponsor. The Sponsor acknowledges that PRA operates a global IT network with primary servers based in the US. In addition, some of the Services performed for the Sponsor with include cloud-based software systems. Sponsor hereby approves and authorizes PRA to make such transfers. PRA shall work with Sponsor to ensure the lawful export of Personal Data under appropriate cross border transfer mechanisms, which may be structured in a separate agreement between the Parties. In providing Services, it may be necessary to sub-contract certain tasks to one or more third party vendors, including cloud based service providers, whose servers may be located outside the EEA. Transfers of Personal Data to said vendors shall be made on the basis of Data Subject consent and/or through a commitment by the vendor to comply with the appropriate cross border transfer mechanisms.

Horn & Co. Final, May 3, 2018

10.0	Publicity

	Sponsor may use, refer to and disseminate reprints of scientific, medical and other published articles which disclose the name of PRA consistent with applicable international copyright laws, provided such use does not constitute an endorsement of any commercial product or service by PRA. Neither party will disclose publicly or utilize in any advertising or promotional materials or media the existence of this Agreement or its association with the other, or use of the other party’s name or the name of any of the other party’s Affiliates, divisions, subsidiaries, products or investigations without the prior written permission of the other party, provided however, that PRA may use the name of Sponsor in its list of customers. Further, either Party may make such public disclosures as it determines, based on advice of counsel, are reasonably necessary to comply with laws or regulations in which case the disclosing Party shall provide the other Party with reasonable advance notice of such required public announcement, and provided further that Sponsor shall be entitled to disclose the existence and terms of this Agreement in the course of due diligence enquiries subject to standard confidentiality undertakings.

11.0	Indemnification

11.1	Sponsor’s Agreement

	a.	Sponsor will indemnify, defend and hold harmless PRA, its Affiliates, and their officers, directors, agents, employees, and independent contractors approved by Sponsor (each an “Indemnitee”) against any claim, suit, action, proceeding, arbitration or investigation, pending or threatened by a third party (each a “Claim”) against Indemnitees relating to the Services, including but not limited to court costs, reasonable legal fees, awards or settlements.

	b.	Under no circumstances, however, will Sponsor accept liability on behalf of PRA, or otherwise enter into any settlement agreement that attributes fault or negligence to PRA without prior written consent of PRA, not to be unreasonably withheld. PRA will fully cooperate and aid in any such defense.

	c.	Sponsor will not indemnify, defend, or hold harmless PRA against any Claim to the extent that such Claim arose as a result of PRA’s negligence, recklessness, intentional misconduct, or material breach of this Agreement or any Task Order hereunder. Under such circumstances PRA will repay to Sponsor all reasonable defense costs incurred by Sponsor on its behalf.

Horn & Co. Final, May 3, 2018

11.2	PRA’s Agreement

	PRA will indemnify, defend and hold harmless Sponsor and its employees, officers, and directors against any and all losses, costs, expenses and damages, including but not limited to reasonable attorney’s fees, based on a Claim resulting from PRA’s negligence, intentional misconduct, or material breach of this Agreement or any Task Order hereunder.

	a.	Under no circumstances, however, will PRA accept liability, on behalf of Sponsor or enter into any settlement agreement that attributes fault or negligence to Sponsor without prior written consent of Sponsor, not to be unreasonably withheld. Sponsor will fully cooperate and aid in any such defense.

	b.	PRA will not indemnify, defend or hold harmless Sponsor against any Claim to the extent that such Claim arose as a result of Sponsor’s negligence, recklessness, intentional misconduct, or material breach of this Agreement or any Task Order hereunder. Under such circumstances Sponsor will repay to PRA all reasonable defense costs incurred by PRA on its behalf.

11.3	Indemnification Procedure

	Each indemnified Party shall give the indemnifying Party prompt notice of any Claim for which indemnification is sought hereunder; provided, that the failure to give such notice will not relieve the indemnifying Party of its indemnification obligation under this Section 11 except to the extent, if at all, it is prejudiced thereby. The indemnifying Party shall have the right to control the defense and settlement of a Claim, provided the indemnifying Party shall act reasonably and in good faith with respect to all matters relating to the settlement or disposition of the Claim, and the indemnified Party shall reasonably cooperate in the investigation, defense and settlement of such Claim. In the event that representation of indemnified Party and the indemnifying Party by the same counsel is a conflict of interest for such counsel, the indemnified Party may select its own independent counsel, at the indemnifying Party’s expense, without relieving the indemnifying Party of its obligations under this Section 11.

11.4	Limits of Liability

	Both Parties’ liability for direct damages hereunder will not exceed twice the total fees for Services, excluding pass-through expenses and investigator grants, payable by Sponsor to PRA under the applicable Task Order with the exception of the indemnification obligation set forth in Section 11.2 and 11.1 (respectively) above. In no event will either Party be liable to the other for any indirect, incidental, special, or consequential damages or lost profits arising out of this Agreement or Task Order, even if a Party has been advised of the possibility of such damages, provided however, that such limitation shall not apply with respect to damages which result from breach of Sections 8 and the Confidentiality obligations under 9 hereunder.

11.5	Insurance

	a.	Sponsor Insurance. During the term of this Agreement, for as long as Company is conducting clinical trials, and for a period of three (3) years following the termination or completion of such clinical trials, Sponsor shall maintain in full force and effect the following program of insurance:

		i.	products liability insurance covering clinical trials activity with limits of not less than Five Million Dollars ($5,000,000); and

		ii.	Clinical trials insurance in compliance with local compulsory requirements

	PRA may from time to time request evidence confirming such insurance.

Horn & Co. Final, May 3, 2018

	b.	PRA Insurance. PRA shall at all times during the term of this Agreement and for an extended period of three (3) years, provide and maintain at its own expense, the following types of insurance:

		i.	Professional Liability: Professional Liability covering all professional acts, errors and omissions in an amount of not less than Five Million Dollars ($5,000,000) per occurrence and in the aggregate.

		ii.	General Liability: Commercial General Liability insurance against claims for bodily injury and property damage in an amount of not less than One Million Dollars ($1,000,000) per occurrence, Two Million Dollars ($2,000,000) in the aggregate, and Ten Million Dollars ($10,000,000) in excess or umbrella coverage.

		iii.	Workers Compensation and Employers’ Liability: To comply with the statutory requirements of the state(s) in which the Services are performed.

		iv.	Employer’s liability insurance with a limit of not less than one million dollars (US$1,000,000);

	c.	General Terms

	d.	Insurance required herein will be underwritten by insurers with A. M. Best ratings of not less than A- (Excellent).

	e.	Throughout the term, each party will provide the other party with at least thirty (30) days advance written notice of cancellation, non-renewal or material reduction of the insurance required herein.

	f.	Upon request, each will provide with a valid, current certificate of insurance as evidence of the insurance required herein.

	g.	Nothing in this Section 11.5 shall be construed as limiting each party’s obligations elsewhere under this Agreement. Such insurance may be provided on a claims-made basis (with the exception of workers compensation and employers’ liability), however, such insurance shall have a retroactive date prior to the date that any work will be performed pursuant to the Agreement.

12.0	Independent Contractor Relationship

	PRA and Sponsor are independent contractors. Nothing in this Agreement will be construed to create the relationship of partners, joint venturers, or employer and employee between PRA and Sponsor or PRA’s employees. Neither Party, nor its employees, or independent contractors will have authority to act on behalf of or bind the other Party in any manner whatsoever unless otherwise authorized in this Agreement or in a separate writing signed by both Parties.

13.0	Employees

	Neither Party, during the term of this Agreement and for twelve months thereafter, will, without the prior written consent of the other Party, directly or indirectly solicit for employment or contract, attempt to employ or contract with or assist any other entity in employing, contracting with or soliciting for employment or contract any employee or executive who is at that time employed/contracted by the other Xxxxx and who had been employed/contracted by the other Party in connection with one or more Task Orders issued hereunder. Provided, however, that the foregoing provision will not prevent either Party from conducting solicitation via a general advertisement for employment that is not specifically directed to any such employee or from employing any such person who responds to such solicitation.

Horn & Co. Final, May 3, 2018

14.0

Notices

Except as otherwise provided, all communications and notices required under this Agreement will be mailed by email, first class mail or sent via nationally recognized overnight courier to the addresses set forth below, or to such other addresses as the Parties from time to time specify in writing.

	If to Sponsor:	If to PRA:
	BioSight Ltd.	Pharmaceutical Research Associates, Inc.
	0 Xxxxxxxx Xx., Xxxxxxx Xxxx	0000 XxxxXxxx Xxxxxx
	X.X.X 0000	Suite 400
	Lod 7019802, Israel	Xxxxxxx, XX 00000
		Attn: Vice President of Legal Affairs

15.0

Force Majeure

If the performance of this Agreement by PRA or Sponsor is prevented, restricted, interfered with or delayed (either totally or in part) by reason of any cause beyond the control of the Parties (including, but not limited to, acts of God, explosion, disease, weather, war, insurrection, terrorism, civil strike, riots or extensive power failure), the Party so affected will, upon giving notice to the other Party as soon as is practical, be excused from such performance to the extent of such prevention, restriction, interference or delay, provided that the affected Party will use reasonable efforts to avoid or remove such causes of non-performance and will continue performance whenever such causes are removed.

16.0

Governing Law

This Agreement will be governed in all respects by the laws of England and Wales without regard to its conflict of laws principles.

17.0

Severability

If any of the provisions or a portion of any provision of this Agreement is held to be unenforceable or invalid by a court of competent jurisdiction, the validity and enforceability of the enforceable portion of any such provision and/or the remaining provisions will not be affected thereby.

18.0

Assignment

Neither Party may assign this Agreement without the prior written consent of the other party, which consent will not be unreasonably withheld; provided, however, that either party may assign all of its rights and obligations under this Agreement without consent to a successor in interest to substantially all of the business of that party to which the subject matter of this Agreement relates upon delivery to the other Party of notice of such assignment and provided that such assignment shall not adversely affect the non assigning Party.

19.0

Waiver

No waiver of any term, provision or condition of this Agreement whether by conduct or otherwise in any one or more instances will be deemed to be construed as a further or continuing waiver of such term, provision or condition or of any other term, provision or condition of this Agreement.

Horn & Co. Final, May 3, 2018

20.0

Entire Agreement

This Agreement, including all Exhibits hereto contains the full understanding of the Parties with respect to the Services and supersedes all existing Agreements and all other oral, written or other communications between the Parties concerning the subject matter hereof. This Agreement will not be modified in any way except in writing and signed by a duly authorized representative of Sponsor and an authorized officer of PRA.

21.0

English Language

The Parties hereto confirm that this Agreement as well as any other documents relating hereto, including notices, have been and shall be drawn up in the English language only.

22.0

Counterparts

This Agreement may be executed in several counterparts, each of which will be deemed an original but all of which will constitute one and the same instrument.

23.0

ARBITRATION

In the event a dispute relating to this Agreement or any Task Order arises between the Parties, the Parties will use all reasonable efforts to resolve the dispute through direct discussions for a period of thirty (30) business days. The senior management of each Party is committed to respond to any such dispute. Subsequent to such thirty-day period, any dispute, controversy or claim arising out of or relating to this Agreement may be settled by arbitration. If arbitration is being conducted shall be in accordance with the International Chamber of Commerce (“ICC”) Arbitration Rules as of present in force and shall be held at London, England in the English language by one arbitrator. The appointing authority shall be the ICC acting in accordance with the Rules adopted by the ICC for this purpose.

The undersigned have executed this Agreement as of the Effective Date.

Pharmaceutical Research Associates, Inc.		Biosight Ltd.

By	/s/ Xxxxxxx Xxxxxxxx	By	/s/ Xxxx Xxx Xxxxx
Name	Xxxxxxx Xxxxxxxx	Name	Xxxx Xxx Xxxxx
Title	Vice President of Finance	Title	CEO
	Date 5/3/2018		Date

LIST OF EXHIBITS

Exhibit A:	Form of Task Order – Product Registration

Exhibit B:	Form of Amendment

Exhibit C:	Standard Contractual Clauses

Horn & Co. Final, May 3, 2018

EXHIBIT A:

FORM OF TASK ORDER (Product Registration)

Task Order Number: _______

Sponsor Project Number: ___________

This Task Order is made and entered into on <Month> <Day>, <Year>, (the “Effective Date”), by and between BioSight Ltd., a corporation of Israel ________ with offices at Xxxxxxxx Xx., Xxxxxxx Xxxx, X.X.X 0000 Lod 7019802, Israel (hereinafter referred to as “Sponsor”) and Pharmaceutical Research Associates, Inc., a corporation of the Commonwealth of Virginia, with offices at 0000 XxxxXxxx Xxxxxx, Xxxxx 000, Xxxxxxx, XX 00000 (hereinafter referred to as “PRA”).

WHEREAS, Sponsor and PRA have entered into that certain Master Agreement for Clinical Trials Management Services dated the <day> of <month>, 200_ (hereinafter referred to as the “Master Agreement”); and

WHEREAS, pursuant to the Master Agreement, PRA has agreed to perform certain Services in accordance with Task Orders from time to time entered into by the Parties, as more fully provided in Section 2 of the Master Agreement, and Sponsor and PRA now desire to enter into such a Task Order.

WHEREAS, PRA and Sponsor desire that PRA provide certain Services with respect to a _________________________________________________________________, (the “Study”) for the study of the drug _________________________________ (“Study Drug”) as set out in the Protocol titled: _____________________, which is incorporated herein by reference (the “Protocol”).

NOW, THEREFORE, in consideration of the mutual covenants contained herein, the parties hereby agree as follows:

1. Project Specifications. PRA will perform the services described in the Project Specifications, attached hereto as Appendix A, in accordance with the Project Schedule, attached hereto as Appendix B and any other documents attached to this Task Order (“Services”).

2. Compensation. For performance of these Services, Sponsor will pay to PRA the amounts described in the Budget for Services and Pass-Through Budget set forth in Appendix C, which amounts will be payable pursuant to the Payment Schedule set forth in Appendix D.

3. Term and Termination. The term of this Task Order will commence upon its execution by PRA and Sponsor and will continue until completion of the Services described in Appendix A, provided, however, that either party may terminate this Task Order in accordance with Section 4, Term and Termination, of the Master Agreement.

4. Designated Contact Persons and Key Personnel. The PRA Project Manager and Key Personnel who will oversee the Services in accordance with the Master Agreement are identified in Appendix E, Designated Contact Persons and Key Personnel.

5. Incorporation by Reference; Conflict. The provisions of the Master Agreement are hereby expressly incorporated by reference into and made a part of this Task Order. In the event of a conflict between the terms and conditions of this Task Order and those of the Master Agreement, the terms of the Master Agreement will take precedence and control unless in the event that the Task Order explicitly provides otherwise.

Horn & Co. Final, May 3, 2018

IN WITNESS WHEREOF, the parties have hereunto signed this Task Order as of the Effective Date.

Pharmaceutical Research Associates, Inc.			BioSight Ltd.

By:			By:
Name:			Name:
Title:			Title:
Date:			Date:

List of Appendices

Appendix A:	Project Specifications
Appendix B:	Project Schedule
Appendix C:	Budget for Services and Pass-Through Budget
Appendix D:	Payment Schedule
Appendix E:	Designated Contact Persons and Key Personnel Designation

Horn & Co. Final, May 3, 2018

EXHIBIT B

FORM OF AMENDMENT

AMENDMENT #

Task Order #

Protocol #

THIS AMENDMENT #1 (“Amendment #1”), dated <Month> <Day>, <Year> (the “Effective Date”), by and between Pharmaceutical Research Associates, Inc., together with its affiliates, with offices at 0000 XxxxXxxx Xxxxxx, Xxxxx 000, Xxxxxxx, XX 00000 (“PRA”) and BioSight Ltd., a corporation of Israel, with offices at Xxxxxxxx Xx., Xxxxxxx Xxxx, X.X.X 0000 Lod 7019802, Israel (“Sponsor”).

W I T N E S S E T H:

WHEREAS, under the terms of a certain Master Agreement for Clinical Trials Management Services (the “Master Agreement”), dated the ____ day of ________, 201_ by and between the parties, Sponsor agreed to retain PRA, and PRA agreed to be retained by Sponsor, to perform the Services as more particularly described in the Master Agreement pursuant to the terms of Task Orders to be issued from time to time; and

WHEREAS, the parties entered into Task Order #___, dated (the “Task Order”) for the performance of Services as more pertaining to Sponsor’s protocol ________;

WHEREAS, the parties hereto have entered into certain additional agreements with respect to modification of the Task Order, and which they desire to memorialize in this Amendment

NOW, THEREFORE, in consideration of the premises and of the following mutual promises, covenants and conditions hereinafter set forth, the parties hereto agree as follows:

1. Project Specifications. [Use the following if work is to be added to the existing scope of work. If the old scope no longer applies, and a completely new Scope of work is necessary, the old specifications should be stricken and replaced by the new ones.] The Services to be provided by PRA pursuant to the Task Order are hereby amended by inclusion of the Services described in Amendment Appendix ___, “Additional Project Specifications”, which is attached hereto and incorporated herein by reference.

2. Project Schedule. The Project Schedule, attached to the Task Order as Appendix ___, is hereby stricken and replaced by the Amended Project Schedule, attached hereto as Amendment Appendix ___, “Amended Project Schedule”, which is incorporated herein by reference.

3. Budget and Payment Schedule, [Each revised Budget should show the following, on one chart; Budget from the original contract, new amounts added or subtracted, and new total budget. This should follow the format of the original contract.] Therefore, the following changes to the Agreement are hereby made:

The Budget for Services, attached to the Task Order as Appendix ___, is hereby stricken and replaced by the “Amended Budget”, attached hereto as Amendment Appendix __, which is incorporated herein by reference.

The Payment Schedule, attached to the Task Order as Appendix ___, is hereby stricken and replaced by the “Amended Payment Schedule”, attached hereto as Amendment Appendix ___, which is incorporated herein by reference.

4. Designated Contact Persons and Key Personnel. [If there have been changes to the designated people or Key Personnel members, use the following] The staff assigned to the Study has changed, Therefore, the Designated Contact Persons and Key Personnel, attached to the Task Order as Appendix ___, is hereby stricken and replaced by the “Amended Designated Contact Persons and Key Personnel” attached hereto as Amendment Appendix ___, which is incorporated herein by reference.

5. Ratification of Balance of Task Order. In all other respects, the terms of the Task Order are hereby ratified and affirmed by each of the parties hereto.

6. Headings. The headings in this Amendment # are for convenience of reference only and will not affect its interpretation.

Horn & Co. Final, May 3, 2018

IN WITNESS WHEREOF, the parties hereto, each by a duly authorized representative, have executed this Amendment # as of the Effective Date,

PHARMACEUTICAL RESEARCH ASSOCIATES, INC.			BioSight Ltd.

By:			By:
Name:			Name:
Title:			Title:
Date:			Date:

List of Appendices:

Amendment Appendix A:	Additional Project Specifications
Amendment Appendix B:	Amended Project Schedule
Amendment Appendix C:	Amended Budget
Amendment Appendix D:	Amended Payment Schedule
Amendment Appendix E:	Amended Contact Persons and Key Personnel

Horn & Co. Final, May 3, 2018

EXHIBIT C

European Data Processing Agreement

This Data Processing Agreement (“DPA”) is entered into by and between:

a)	Biosight Ltd, having its principal place of business at 0 Xxxxxxxx Xx., Xxxxxxx Xxxx, X.X.X 0000 Lod 7019802, Israel (“Controller”)

b)	Pharm Research Associates (UK) Ltd. having its principal place of business at 000 Xxxxx Xxx Xxx, Xxxxx Xxxx, Xxxxxxx, Xxxxxxxxx, XX0 0XX (“Processor” or “PRA”)

each a “Party”, together the “Parties”.

BACKGROUND

Under the Agreement for Clinical Trials Management Services concluded by and between the Parties on the date of [insert date] (the “Agreement”), Processor agreed to provide Controller with the services as further specified in Annex 1 to this DPA (the “Services”).

WHEREAS,	Controller is a private pharmaceutical development company

WHEREAS,	Processor is a pharmaceutical research group of companies.

WHEREAS,	in rendering the Services, Processor may from time to time be provided with, or have access to information of Controller’s Personal Data or personally identifiable information within the meaning of Applicable Data Protection Law;

WHEREAS,	Controller engages PRA as an appointed Processor acting on behalf of Controller;

WHEREAS,	this DPA contains the terms and conditions applicable to the collection, processing and use of such Personal Data by PRA as the appointed Processor of Controller with the aim to ensure that the Parties comply with Applicable Data Protection Law;

WHEREAS,	if Controller is located outside the European Union (“EU”)/European Economic Area (“EEA”) the Parties also wish to adduce adequate safeguards in connection with transfers of Personal Data and therefore additionally agree to enter into the Standard Contractual Clauses for the transfer of Personal Data to Processors established in third countries (“Standard Contractual Clauses”) pursuant to Commission Decision 2010/87/EC of 5 February 2010 (Part 2).

WHEREAS,	Controller also means data exporter and Processor also means data importer.
WHEREAS,	for this purpose, the DPA consists of the following parts:

	Part 1	Data Processing Agreement to comply with the requirements for the appointed Processor of Personal Data

	Part 1 - Annex 1	Details of data processing

	Part 1 - Annex 2	Technical and Organisational Security Measures

	Part 2	Standard Contractual Clauses (unmodified version)

	Part 2 – Appendix 1	Description of data processing operations

	Part 2 – Appendix 2	Technical and Organizational Security Measures

WHEREAS,

in the event of inconsistencies between the provisions of this DPA and any other agreements between the Parties, the provisions of this DPA shall prevail with regard to the Parties’ data protection obligations. In case of inconsistencies between this DPA and the Standard Contractual Clauses, the Standard Contractual Clauses shall prevail.

Horn & Co. Final, May 3, 2018

Part 1 - Data Processing Agreement

1.	Definitions

For the purposes of this DPA:

	“Applicable Data Protection Law”		shall mean the international and local legislation protecting the fundamental rights and freedoms of individuals and, in particular, their right to privacy with respect to the Processing of Personal Data applicable to Controller and Processor; the term Applicable Data Protection Law shall encompass the GDPR. as of May 25, 2018;

	“Controller”		shall mean the entity that determines as a legal person alone or jointly with others the purposes and means of the Processing of Personal Data;

	“General Data Protection Regulation” or “GDPR”		shall mean the Regulation (EU) 2016/679 of the European Parliament and of the Council of April 27, 2016 on the protection of natural persons with regard to the Processing of Personal Data and on the free movement of such data which will apply as of May 25, 2018;

	“Member State”		shall mean a country belonging to the EU;

	“Personal Data”		shall mean any information relating to an identified or identifiable natural person (“Data Subject”); an identifiable person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person;

	“Personal Data Breach”		shall mean a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure, or access to Personal Data transmitted, stored or otherwise Processed;

	“Process/Processing”		shall mean any operation or set of operations which is performed on Personal Data or on sets of Personal Data, whether or not by automated, means, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction;

	“Processor”		shall mean PRA who Processes Personal Data on behalf of Controller;

	“Special Categories of Data”		shall mean data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership; genetic data, biometric data Processed for the purpose of uniquely identifying a natural person; data concerning health or data concerning a natural person’s sex life or sexual orientation;

Horn & Co. Final, May 3, 2018

	“Standard Contractual Clauses”		shall mean the Standard Contractual Clauses as adopted by the European Commission and as adapted from time to time.

	“Subprocessor”		shall mean any data processor engaged by Processor who agrees to receive from Processor Personal Data exclusively intended for Processing activities to be carried out on behalf of Controller in accordance with its instructions, the terms of this DPA (including the Standard Contractual Clauses, if applicable) and the terms of the written subcontract;

	“Supervisory Authority”		shall mean an independent public authority which is established by a Member State pursuant to Article 51 of the GDPR; and

	“Technical and Organizational Security Measures”		shall mean those measures aimed at protecting Personal Data against accidental destruction or accidental loss, alteration, unauthorized disclosure or access, in particular where the Processing involves the transmission of data over a network, and against all other unlawful forms of Processing.

2.	Details of the Processing

The details of the Processing operation provided by Processor to Controller as appointed Processor (e.g., the subject-matter of the Processing, the nature and purpose of the Processing, the type of Personal Data nod categories of Data Subjects) are specified in Part 1 Annex 1 to this DPA,

3.	Rights and Obligations of Controller

Controller remains the responsible data controller for the Processing of the Personal Data.

Controller is entitled to instruct Processor in connection with the Processing of the Personal Data, generally or in the individual case. Instructions may also relate to the correction, deletion, blocking of the Personal Data. Upon request, Controller shall specify its order, instructions and comments more precisely.

4.	Obligations of Processor

Processor shall:

	a.	Comply with and act on any written instruction from and on behalf of the Controller regarding the Processing of Personal Data. Such obligation also applies to the transfer of Personal Data to a third country. Processor shall transfer Personal Data to the US via its IT Network. Instructions are provided in the Agreement, this DPA and/or otherwise in documented form.

	b.	Not Process Personal Data for any other purposes other than to provide the Services to Controller.

	c.	Immediately notify Controller, where Processor in its opinion believes that an instruction of Controller would result in a violation of Applicable Data Protection Law and request Controller to withdraw, amend or confirm the relevant instruction. Pending the decision on the withdrawal, amendment or confirmation of the relevant instruction, Processor shall be entitled to suspend the implementation of the relevant instruction.

Horn & Co. Final, May 3, 2018

	d.	Ensure that persons authorized by Processor to Process the Personal Data on behalf of Controller are suitably informed, trained and instructed in respect of Applicable Data Protection Law and have committed themselves in writing to confidentiality or are under an appropriate statutory obligation of confidentiality. Processor will procure that such authorized persons observe any Applicable Data Protection Law beyond their respective employment periods.
	e.	Implement the Technical and Organizational Security Measures which will meet the requirements of Applicable Data Protection Law as further specified in Annex 2 before Processing the Personal Data and ensure to provide sufficient guarantees to Controller on such Technical and Organizational Security Measures.
	f.	Assist Controller by appropriate Technical and Organizational Security Measures, insofar as this is possible, for the fulfillment of Controller’s obligation to respond to requests for exercising Data Subjects’ rights concerning information, access, rectification and erasure, restriction of Processing, notification, data portability, objection and automated decision-making.
	g.	Take actions requested or instructed by Controller in order to comply with Data Subject’s rights under Applicable Data Protection Law. In particular, Processor must provide the information on action taken on such request without undue delay, respectively in a timely manner.
	h.	Make available to Controller all information necessary to demonstrate compliance with the obligations laid down in this DPA and in Art. 28 GDPR.
	i.	Allow for and contribute to audits, including inspections conducted by Controller or another auditor mandated by Controller in accordance with the terms of the Agreement as set out therein or as may be otherwise specified.
	j.	Notify Controller without undue delay:

	(i)	about any legally binding request for disclosure of the Personal Data by a law enforcement authority, unless otherwise prohibited, such as a prohibition under criminal law to preserve the confidentiality of a law enforcement investigation;

	(ii)	about any complaints and requests received directly from Data Subjects (e.g., regarding access, rectification, erasure, restriction of Processing, data portability, objection to Processing of data, automated decision-making) without responding to that request, unless it has been otherwise authorized to do so;

	(iii)	after Processor becomes aware of a Personal Data Breach at Processor or its Subprocessors. In case of such Personal Data Breach, Processor will assist Controller with investigating the Personal Data Breach and Controller’s obligation under Applicable Data Protection Law to inform the Data Subjects and the Supervisory Authorities, as applicable, and to document the Personal Data Breach.

Assist Controller with any data protection impact assessment and with prior consultation, if any, that relate to the Services provided by Processor to Controller and the Personal Data Processed on behalf of Controller.

Horn & Co. Final, May 3, 2018

5.	Subprocessing

	a.	Any subcontract with a third party by which any Services are subcontracted require Controller’s prior specific or general written consent and must be concluded in writing, including electronic form.

	b.	In case of a general written consent from Controller, Processor must inform Controller about any intended changes concerning the addition or replacement of Subprocessors, thereby giving Controller the opportunity to object to such changes,

	c.	Processor must ensure contractually that with respect to the subcontracted portion of the Services, the Subprocessor has corresponding obligations vis-à-vis Controller, in particular that Subprocessor provides sufficient guarantees to implement appropriate Technical and Organizational Security Measures in such a manner that the Processing will meet the requirements of Applicable Data Protection Law.

	d.	Where Subprocessor fails to fulfill its data protection obligations, Processor shall remain fully liable to Controller for the performance of the Subprocessor’s obligations.

	e.	Controller shall be entitled to conduct direct audits at Subprocessor and to issue instructions to Subprocessor directly. Controller shall be entitled to request a copy of the subprocessing agreement.

	f.	Processor shall choose Subprocessor diligently.

6.	Duration and termination

	a.	The term of this DPA is identical with the term of the relevant Agreement. Save as otherwise agreed herein, termination rights and requirements shall be the same as set forth in the relevant Agreement.

	b.	Processor shall, at the choice of Controller, delete or return all Personal Data to Controller after the end of the provision of Services, and shall save one copy as required by EU or equivalent local legislation, in particular the XXX Clinical Trials Regulation 536/2014.

7.	Miscellaneous

A Determination that any provision of the DPA is invalid or unenforceable shall not affect the other provisions of the DPA. In such case the invalid unenforceable provision shall automatically be replaced by a valid and enforceable provision that comes closest to the purpose of the original provision. The same shall apply if the DPA contains an unintended gap.

On behalf of the Controller: Biosight Limited

Name (written out in full): Xxxx Xxx Xxxxx

Position: CEO

Address: 0 Xxxxxxxx Xx., Xxxxxxx Xxxx, X.X.X 0000 Lod 701 9802, Israel

Signature: /s/ Xxxx Xxx Xxxxx

Date:

On behalf of the Processor:

Name (written out in full): Xxxxx Xxxx & Uri-Ben-Or

Position: VP, Operations Finance – Chief Financial Officer

Address: 000 Xxxxx Xxx Xxx, Xxxxx Xxxx, Xxxxxxx, XX0 GAD

Signature: /s/ Xxxxx Xxxx - /s/ Xxx-Xxx-Or

Date:4 May 2018

Horn & Co. Final, May 3, 2018

Part 1 – Annex 1 – Details of Data Processing

1.	The Controller is; Biosight Limited

Please specify briefly your activities relevant to the transfer:

The Controller is a pharmaceutical company engaged in the discovery, development, manufacturing and sale of therapeutic products and clinical studies.

2.	Tile Processor is: Pharm Research Associates (UK) Limited

Please specify briefly activities relevant lo the transfer:

The Processor is Contract Research Organization in the business of providing professional and state-of-the-art clinical and medical research services.

3.	Categories of Data Subjects

The Personal Data transferred concern the following categories of Data Subjects:

Study patient / subject

Investigator / Investigator site staff

4.	Type of Personal Data

The Personal Data Processed by Processor on behalf of Controller concern the following categories of Personal Data:

●	health information

●	date of birth, where applicable

●	management of (Serious) Adverse Events

●	CVs - clinical experience and qualifications

●	financial disclosure/transparency requirements

5.	Special Categories of Data (if appropriate)

The Personal Data Processed by Processor on behalf of Controller concern the following Special Categories of Data:

Key-coded/pseudonymised health related data of patients.

6.	Processing Operations

The personal data transferred will be subject to the following basic processing activities (please specify)

Processing of personal data associated with the management of, and scientific analysis for clinical trials and samples.

Horn & Co. Final, May 3, 2018

Part 1 - Annex 2 - Technical and Organizational Security Measures

Description of the Technical and Organizational Security Measures implemented by Processor in accordance with Applicable Data Protection Law:

This Annex describes the Technical and Organizational Security Measures and procedures that Processor shall, as a minimum, maintain to protect the security of Personal Data created, collected, received, or otherwise obtained.

Access Control of Processing Areas

Processor implements suitable measures in order to prevent unauthorized persons from gaining access to the data processing equipment where the Personal Data is Processed. This is accomplished by;

●	establishing security areas;

●	securing the data processing equipment;

●	establishing access authorizations for staff and third parties, including the respective documentation;

●	access to data centres is logged and monitored; and

●	data centres are protected by appropriate security measures.

Access Control to Data Processing Systems

Processor implements suitable measures to prevent its data processing systems from being used by unauthorized persons. This is accomplished by:

●	identification of the terminal and/or the terminal user to the Processor systems;

●	automatic time-out of user terminal if left idle, identification and password required to reopen;

●	automatic turn-off of the user ID when several erroneous passwords are entered, log file of events (monitoring of break-in-attempts);

●	issuing and safeguarding of access/identification codes;

●	staff policies and training in respect of each staff access rights to Personal Data (if any), informing staff about their obligations; and

●	utilisation of audit trail.

Access Control to Use Specific Areas of Data Processing Systems

Processor commits that the persons entitled to use its data processing system are only able to access the data within the scope and to the extent covered by its access permission (authorization) and that Personal Data cannot be read, copied or modified or removed without authorization. This shall be accomplished by:

●	staff policies and training in respect of each staff member’s access rights to the Personal Data;

●	allocation of individual user accounts;

●	utilisation of audit trail;

●	release of data to only authorized persons; and

●	control of files, controlled and documented destruction of data

Horn & Co. Final, May 3, 2018

Availability Control

Processor implements suitable measures to ensure that Personal Data are protected from accidental destruction or loss. This is accomplished by;

●	infrastructure redundancy; and

●	data redundancy via data backup;

Transmission Control

Processor implements suitable measures to prevent the Personal Data from being read, copied, altered or deleted by unauthorized parties during the transmission thereof or during the transport of the data media. This is accomplished by:

●	use of appropriate firewall and encryption technologies; and

●	as far as possible, all data transmissions are logged and monitored

Input Control

Processor implements suitable measures to ensure that it is possible to check and establish whether and by whom Personal Data have been input into data processing systems or removed. This is accomplished by:

●	an authorization policy for the input of data, as well as for the reading, alteration and deletion of stored data (role based access management rules);

●	authentication of the authorized personnel;

●	utilization of user codes (passwords);

●	all users who have access to Personal Data shall reset their passwords as specified in the relevant password policy; and

●	areas housing the computer hardware and related equipment are capable of being locked.

Processor System Administrators

Processor implements suitable measures to monitor its system administrators and to ensure that they act in accordance with instructions received. This is accomplished by;

●	individual appointment of system administrators;

●	adoption of suitable measures to register system administrators’ access logs and keep them secure, accurate and unmodified for a reasonable period; and

●	keeping an updated list with system administrators’ identification details (e.g. name, surname, function or organizational area) and tasks assigned.

Separation of Processing for Different Purposes

Processor implements suitable measures to ensure that data collected for different purposes and different clients can be Processed separately. This is accomplished by:

●	access to data is separated through application security for the appropriate users; and

●	modules within Processor’s database separate which data is used for which purpose, i.e. by functionality and function;

Xxxx & Xx. Xxxxx, Xxx 0, 0000

Xxxx0 - Standard Contractual Clauses

For the purposes of Article 26(2) of Directive 95/46/EC for the transfer of personal data to processors established in third countries which do not ensure an adequate level of data protection

Clause 1 Definitions

For the purpose of the Clauses:

(a)	“personal data”, “special categories of data”, “process/processing”, ‘‘controller”, “processor”, “data subject” and “supervisory authority” shall have the same meaning as in Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data;

(b)	“the data exporter” means the controller who transfers the personal data;

(c)	“the data importer” means the processor who agrees to receive from the data exporter personal data intended for processing on his behalf after the transfer in accordance with his instructions and the terms of the Clauses and who is not subject to a third country’s system ensuring adequate protection within the meaning of Article 25(1) of Directive 95/46/EC;

(d)	“the sub-processor” means any processor engaged by the data importer or by any other sub-processor of the data importer who agrees to receive from the data importer or from any other sub-processor of the data importer personal data exclusively intended for processing activities to be carried out on behalf of the data exporter after the transfer in accordance with his instructions, the terms of the Clauses and the Xxxxx of the written subcontract;

(e)	“the applicable data protection law” means the legislation protecting the fundamental rights and freedoms of individuals and, in particular, their right to privacy with respect to the processing of personal data applicable to a data controller in the Member Stale in which the data exporter is established;

(f)	‘‘technical and organisational security measures” means those measures aimed at protecting personal data against accidental or unlawful destruction or accidental loss, alteration, unauthorised disclosure or access, in particular where the processing involves the transmission of data over a network, and against all other unlawful forms of processing.

Clause 2 Details of the transfer

The details of the transfer and in particular the special categories of personal data where applicable are specified in Appendix I which forms an integral part of the Clauses.

Clause 3 Third-party beneficiary clause

1.	The data subject can enforce against the data exporter this Clause, Clause 4(b) to (i), Clause 5(a) to (c), and (g) to (j), Clause 6(1) and (2), Clause 7, Clause 8(2), and Clauses 9 to 12 as third-party beneficiary.

2.	The data subject can enforce against the data importer this Clause, Clause 5(a) to (e) and (g), Clause 6, Clause 7, Clause 8(2), and Clauses 9 to 12, in cases where the data exporter has factually disappeared or has censed to exist in law unless any successor entity has assumed the entire legal obligations of the data exporter by contract or by operation of law, as a result of which it takes on the rights and obligations of the data exporter, in which case the data subject can enforce them against such entity.

3.	The data subject can enforce against the sub-processor this Clause, Clause 5(a) to (e) and (g), Clause 6, Clause 7, Clause 8(2), and Clauses 9 to 12, in cases where both the data exporter and the data importer have factually disappeared or ceased to exist in law or have become insolvent, unless any successor entity has assumed the entire legal obligations of the data exporter by contract or by operation of law as a result of which it takes on the rights and obligations of the data exporter, in which case the data subject can enforce them against such entity. Such third-party liability of the sub-processor shall be limited to its own processing operations under the Clauses.

4.	The parties do not object to a data subject being represented by an association or other body of the data subject so expressly wishes and if permitted by national law.

Horn & Co. Final, May 3, 2018

Clause 4 Obligations of the data exporter

The data exporter agrees and warrants:

(a)	that the processing, including the transfer itself, of the personal data has been and will continue to be carried out in accordance with the relevant provisions of the applicable data protection law (and, where applicable, has been notified to the relevant authorities of the Member State where the data exporter is established) and does not violate the relevant provisions of that State;

(b)	that it has instructed and throughout the duration of the personal data processing services will instruct the data importer to process the personal data transferred only on the data exporter’s behalf and in accordance with the applicable data protection law and the Clauses;

(c)	that the data importer will provide sufficient guarantees in respect of the technical and organisational security measures specified in Appendix 2 to this contract;

(d)	that after assessment of the requirements of the applicable data protection law, the security measures are appropriate to protect personal data against accidental or unlawful destruction or accidental loss, alteration, unauthorised disclosure or access, in particular where the processing involves the transmission of data over a network, and against all other unlawful forms of processing, and that these measures ensure a level of security appropriate to the risks presented by the processing and the nature of the data to be protected having regard to the state of the art and the cost of their implementation;

(e)	that it will ensure compliance with the security measures;

(f)	that, if the transfer involves special categories of data, the data subject has been informed or will be informed before, or as icon as possible after, the transfer that its data could be transmitted to a third country not providing adequate protection within the meaning of Directive 95/46/EC;

(g)	to forward any notification received from the data importer or any sub-processor pursuant to Clause 5(b) and Clause 8(3) to the data protection supervisory authority if the data exporter decides to continue the transfer or to lift the suspension;

(h)	to make available to the data subjects upon request a copy of the Clauses, with the exception of Appendix 2, and a summary description of the security measures, as well as a copy of any contract for subprocessing services which has to be mode in accordance with the Clauses, unless the Clauses or the contract contain commercial information, in which case it may remove such commercial information;

(i)	that, in the event of subprocessing, the processing activity is carried out in accordance with Clause 11 by a sub-processor providing at least the same level of protection for the personal data and the rights of data subject as the data importer under the Clauses; and

(j)	that it will ensure compliance with Clause 4(a) to (i).

Horn & Co. Final, May 3, 2018

Clause 5 Obligations of the data Importer

The data importer agrees and warrants:

(a)	to process the personal data only on behalf of the data exporter and in compliance with its instructions and the Clauses; if it cannot provide such compliance for whatever reasons, it agrees to inform promptly the data exporter of its inability to comply, in which case the data exporter is entitled to suspend the transfer of data and/or terminate the contract;

(b)	that it has no reason to believe that the legislation applicable to it prevents it from fulfilling the instructions received from the data exporter and its obligations under the contract and that in the event of a change in this Legislation which is likely to have a substantial adverse effect on the warranties and obligations provided by the Clauses, it will promptly notify the change to the data exporter as soon as it is aware, in which case the data exporter is entitled to suspend the transfer of data and/or terminate the contract;

(c)	that it has implemented the technical and organisational security measures specified in Appendix 2 before processing the personal data transferred;

(d)	that it will promptly notify the data exporter about:

	(i)	any legally binding request for disclosure of the personal data by a law enforcement authority unless otherwise prohibited, such as a prohibition under criminal law to preserve the confidentiality of a law enforcement investigation,

	(ii)	any accidental or unauthorised access, and

	(iii)	any request received directly from the data subjects without responding to that request, unless it has been otherwise authorised to do so;

(e)	to deal promptly and properly with all inquiries from the data exporter relating to its processing of the personal data subject to the transfer and to abide by the advice of the supervisory authority with regard to the processing of the data transferred:

(f)	at the request of the data exporter to submit its data processing facilities for audit of the processing activities covered by the Clauses which shall be carried out by the data exporter or an inspection body composed of independent members and in possession of the required professional qualifications bound by a duty of confidentiality, selected by the data exporter, where applicable, in agreement with the supervisory authority;

(g)	to make available to the data subject upon request a copy of the Clauses, or any existing contract for subprocessing, unless the Clauses or contract contain commercial information, in which case it may remove such commercial information, with the exception of Appendix 2 which shall be replaced by a summary description of the security measures in those cases where the data subject is unable to obtain a copy from the data exporter.

(h)	that, in the event of subprocessing, it has previously informed the data exporter and obtained its prior written consent;

(i)	that the processing services by the sub-processor will be carried out in accordance with Clause 11;

(j)	to send promptly a copy of any sub-processor agreement it concludes under the Clauses to the data exporter.

Horn & Co. Final, May 3, 2018

Clause 6 Liability

1.	The parties agree that any data subject, who has suffered damage as a result of any breach of the obligations referred to in Clause 3 or in Clause 11 by any party or sub-processor is entitled to receive compensation from the data exporter for the damage suffered.

If a data subject is not able to bring a claim for compensation in accordance with paragraph 1 against the data exporter, arising out of a breach by the data importer or his sub-processor of any of their obligations referred to in Clause 3 or in Clause 11. because foe data exporter has factually disappeared or ceased to exist in law or has become insolvent, the data importer agrees that the data subject may issue a claim against the data importer as if it were the data exporter, unless any successor entity has assumed the entire legal obligations of the data exporter by contract or by operation of law, in which case the data subject can enforce its rights against such entity.

The data importer may not rely on a breach by a sub-processor of its obligations in order to avoid its own liabilities.

If a data subject is not able to bring a claim against the data exporter or the data importer referred to in paragraphs 1 and 2, arising out of a breach by the sub-processor of any of their obligations referred to in Clause 3 or in Clause 11 because both the data exporter and the data importer have factually disappeared or ceased to exist in law or have become insolvent, the sub-processor agrees that the data subject may issue a claim against the data sub-processor with regard to its own processing operations under the Clauses as if it were the data exporter or the data importer, unless any successor entity has assumed the entire legal obligations of the data exporter or data importer by contract or by operation of law, in which case the data subject can enforce its rights against such entity. The liability of the sub-processor shall be limited to its own processing operations under the Clauses.

Clause 7 Mediation and jurisdiction

1.	The data importer agrees that if the data subject invokes against it third-party beneficiary rights and/or claims compensation for damages under the Clauses, the data importer will accept the decision of the data subject:

(a)

to refer the dispute to mediation, by an independent person or, where applicable, by the supervisory authority;

(b)

to refer the dispute to the courts in the Member State in which the data exporter is established.

2.	The parties agree that the choice made by the data subject will not prejudice its substantive or procedural rights to seek remedies in accordance with other provisions of national or international law.

Clause 8 Cooperation with supervisory authorities

1.	The data exporter agrees to deposit a copy of this contract with the supervisory authority if it so requests of if such deposit is required under the applicable data protection law.

2.	The parties agree that (the supervisory authority has the right to conduct an audit of the data importer, and of any sub-processor, which has the same scope and is subject to the same conditions as would apply to an audit of the data exporter under the applicable data protection law.

The data importer shall promptly inform the data exporter about the existence of legislation applicable to it or any sub-processor preventing the conduct of an audit of the data importer, or any sub-processor, pursuant to paragraph 2. In such a case the data exporter shall be entitled to take the measures foreseen in Clause 5 (b).

Clause 9 Governing Law

The Clauses shall be governed by the law of the Member State in which the data exporter is established.

Horn & Co. Final, May 3, 2018

Clause 10 Variation of the contract

The parties undertake not to vary or modify the Clauses. This does not preclude the parties from adding clauses on business related issues where required as long as they do not contradict the Clause.

Clause 11 Subprocessing

1.	The data importer shall not subcontract any of its processing operations performed on behalf of the data exporter under the Clauses without the prior written consent of the data exporter, Where the data importer subcontracts its obligations under the Clauses, with the consent of the data exporter, it shall do so only by way of a written agreement with the sub-processor which imposes the same obligations on the sub-processor as arc imposed on the data importer under the Clauses. Where the sub-processor fails to fulfil its data protection obligations under such written agreement the data importer shall remain fully liable to the data exporter for the performance of the sub-processor’s obligations under such agreement.

2.	The prior written contract between the data importer and the sub-processor shall also provide for a third-party beneficiary clause as laid down in Clause 3 for cases where the data subject is not able to bring the claim for compensation referred to in paragraph 1 of Clause 6 against the data exporter or the data importer because they have factually disappeared or have ceased to exist in law or have become insolvent and no successor entity has assumed the entire legal obligations of the data exporter or data importer by contract or by operation of law. Such third-party liability of the sub-processor shall be limited to its own processing operations under the Clauses,

3.	The provisions relating to data protection aspects for subprocessing of the contract referred to in paragraph 1 shall be governed by the law of the Member State in which the data exporter is established.

4.	The data exporter shall keep a list of subprocessing agreements concluded under the Clauses and notified by the data importer pursuant to Clause 5(j), which shall be updated at least once a year. The list shall be available to the data exporter’s data protection supervisory authority.

Clause 12 Obligation after the termination of personal data processing services

1.	The parties agree that on the termination of the provision of data processing services, the data importer and the sub-processor shall, at the choice of the data exporter, return all the personal data transferred and the copies thereof to the data exporter or shall destroy all the personal data and certify to the data exporter that it has done so, unless legislation imposed upon the data importer prevents it from returning or destroying all or part of the personal data transferred. In that case, the data importer warrants that it will guarantee the confidentiality of the personal data transferred and will not actively process the personal data transferred anymore.

2.	The data importer and the sub-processor warrant that upon request of the data exporter and/or of the supervisory authority, it will submit its data processing facilities for an audit of the measures referred to in paragraph 1.

Signatures:

On behalf of the data exporter: Biosight Limited

/s/ Xxxx Xxx Xxxxx

Name (written out in full): Xxxx Xxx Xxxxx

Position: CEO

Address. 0 Xxxxxxxx Xx., Xxxxxxx Xxxx, X.X.X 0000 Lod 7019802, Israel

Other Information necessary in order for the contract to be binding (If any):

Signature____________________________

(stamp of organization)

On behalf of the data exporter: Importer: Pharm Research Associates (UK) Limited

/s/ Xxxxx Xxxx - /s/ Xxx-Xxx-Or

Name (written out in full): Xxxxx Xxxx – Uri-Ben-Or

Position: VP, Operations Finance – Chief Financial Officer

Address: 000 Xxxxx Xxx Xxx, Xxxxx Xxxx, Xxxxxxx, Xxxxxxxxx RO2 SAD

Other Information necessary in order for the contract to be binding (If any):

Signature____________________________

(stamp of organization)

Part 2 - Appendix 1

This Appendix forms part of the Clauses and must be completed and signed by the parties.

Data exporter

The data exporter is: Biosight Limited
(please specify briefly your activities relevant to the transfer):

The data exporter is a pharmaceutical company engaged in the discovery, development, manufacturing and sale of therapeutic products and clinical studies.

Data importer

The data importer is: Pharm Research Associates (UK) Limited
(please specify briefly activities relevant to the transfer):

The data importer is Contract Research Organization in the business of providing professional and state-of-the-art clinical and medical research services.

Data subjects

The personal data transferred concern the following categories of data subjects:

Study patient / subject

Investigator / investigator site staff

Categories of data

The personal data transferred concern the following categories of data:

	●	Health information

	●	Date of birth, where applicable

	●	Management of (Serious) Adverse Events in compliance with applicable data protection law

	●	CV - clinical experience and qualifications

	●	Financial disclosure/transparency requirements

Special categories of data (if appropriate)

The personal data transferred concern the following special categories of data:

Key-coded/pseudonymised health related data of patients.

Processing operations

The personal data transferred will be subject to the following basic processing activities (please specify):

Processing of personal data associated with the management of, and scientific analysis for clinical trials and samples.

Signatures:

On behalf of the data exporter: Biosight Limited

/s/ Xxxx Xxx Xxxxx

Name (written out in full): Xxxx Xxx Xxxxx

Position: CEO

Address. 0 Xxxxxxxx Xx., Xxxxxxx Xxxx, X.X.X 0000 Lod 7019802, Israel

Other Information necessary in order for the contract to be binding (If any):

Signature____________________________

(stamp of organization)

On behalf of the data exporter: Importer: Pharm Research Associates (UK) Limited

/s/ Xxxxx Xxxx – /s/ Uri-Ben-Or

Name (written out in full): Xxxxx Xxxx – Xxx-Xxx-Or

Position: VP, Operations Finance – Chief Financial Officer

Address: 000 Xxxxx Xxx Xxx, Xxxxx Xxxx, Xxxxxxx, Xxxxxxxxx RO2 SAD

Other Information necessary in order for the contract to be binding (If any):

Signature____________________________

(stamp of organization)

Part 2 - Appendix 2

This Appendix forms part of the Clauses and must be completed and signed by the parties.

Description of the technical and organizational security measures implemented by the data importer in accordance with Clauses 4(d) and 5(c).

Access Control of Processing Areas

Data importer implements suitable measures in order to prevent unauthorized persons from gaining access to the data processing equipment where the Personal Data is Processed. This is accomplished by:

	●	establishing security areas;

	●	securing the data processing equipment;

	●	establishing access authorizations for staff and third parties, including the respective documentation;

	●	access to data centres is logged and monitored; and

	●	data centres are protected by appropriate security measures.

Access Control to Data Processing Systems

Data importer implements suitable measures to prevent its data processing systems from being used by unauthorized persons. This is accomplished by:

	●	identification of the terminal and/or the terminal user to the data importer systems;

	●	automatic time-out of user terminal if left idle, identification and password required to reopen;

	●	automatic turn-off of the user ID when several erroneous passwords arc entered, log file of events (monitoring of break-in-attempts);

	●	issuing and safeguarding of access/identification codes;

	●	staff policies and training in respect of each staff access rights to Personal Data (if any), informing staff about their obligations; and

	●	utilisation of audit trail.

Access Control to Use Specific Areas of Data Processing Systems

Data importer commits that the persons entitled to use its data processing system are only able to access the data within the scope and to the extent covered by its access permission (authorization) and that Personal Data cannot be read, copied or modified or removed without authorization. This shall be accomplished by;

	●	staff policies and training in respect of each staff member’s access rights to the Personal Data;

	●	allocation of individual user accounts;

	●	utilisation of audit trail;

	●	release of data to only authorized persons; and

	●	control of files, controlled and documented destruction of data

Availability Control

Data importer implements suitable measures to ensure that Personal Data are protected from accidental destruction or loss. This is accomplished by:

	●	infrastructure redundancy; and

	●	data redundancy via data backup;

Transmission Control

Data importer implements suitable measures to prevent the Personal Data from being read, copied, altered or deleted by unauthorized parties during the transmission thereof or during the transport of the data media. This is accomplished by:

	●	use of appropriate firewall and encryption technologies; and

	●	as far as possible, all data transmissions arc logged and monitored

Input Control

Data importer implements suitable measures to ensure that it is possible to check and establish whether and by whom Personal Data have been input into data processing systems or removed. This is accomplished by:

	●	an authorization policy for the input of data, as well as for the reading, alteration and deletion of stored data (role based access management rules);

	●	authentication of the authorized personnel;

	●	utilization of user codes (passwords);

	●	all users who have access to Personal Data shall reset their passwords as specified in the relevant password policy; and

	●	areas housing the computer hardware and related equipment are capable of being locked.

Data Importer System Administrators

Data importer implements suitable measures to monitor its system administrators and to ensure that they act in accordance with instructions received. This is accomplished by:

	●	individual appointment of system administrators;

	●	adoption of suitable measures to register system administrators’ access logs and keep them secure, accurate and unmodified for a reasonable period; and

	●	keeping an updated list with system administrators’ identification details (e.g. name, surname, function or organizational area) and tasks assigned.

Separation of Processing for Different Purposes

Data importer implements suitable measures to ensure that data collected for different purposes and different clients can be Processed separately. This is accomplished by:

	●	access to data is separated through application security for the appropriate users; and

	●	modules within data importer’s database separate which data is used for which purpose, i.e. by functionality and function;

On behalf of the data exporter: Biosight Limited

/s/ Xxxx Xxx Xxxxx

Name (written out in full): Xxxx Xxx Xxxxx

Position: CEO

Address. 0 Xxxxxxxx Xx., Xxxxxxx Xxxx, X.X.X 0000 Lod 7019802, Israel

Other Information necessary in order for the contract to be binding (If any):

Signature____________________________

(stamp of organization)

On behalf of the data exporter: Importer: Pharm Research Associates (UK) Limited

/s/ Xxxxx Xxxx - /s/ Uri-Ben-Or

Name (written out in full): Xxxxx Xxxx – Xxx-Xxx-Or

Position: VP, Operations Finance – Chief Financial officer

Address: 000 Xxxxx Xxx Xxx, Xxxxx Xxxx, Xxxxxxx, Xxxxxxxxx RO2 SAD

Other Information necessary in order for the contract to be binding (If any):

Signature____________________________

(stamp of organization)

Document Metadata

Table of Contents

Master Agreement for Clinical Trials Management Services

Document Metadata