Contract analysis

I. Executive Summary This memorandum analyzes the data ownership, site record retention, and permissible licensing and data sharing provisions negotiated and finalized in the execution version of the Master Clinical Trial Agreement (the "MCTA"), dated June 28, 2023, between Penterra Pharmaceuticals Corp. ("Penterra" or "PPC"), a Delaware corporation headquartered at 200 Biopharma Boulevard, Suite 1400, Princeton, New

1. Exclusive Sponsor Ownership. Penterra retains exclusive ownership of all clinical trial data generated under the MCTA in connection with Protocol PPC-4871-III. This ownership is comprehensive, covering case report form data, laboratory data, safety data, biomarker and pharmacokinetic/pharmacodynamic data, imaging data, patient-reported outcomes, statistical analyses, and regulatory submissions. The ownership provi

2. Record Retention. Veridian and its participating sites are obligated to retain source documents and essential trial records for a minimum of 15 years following study completion, or longer if required by applicable law. Given the projected study completion date of August 2028, this retention obligation extends through at least August 2043. This contractual period provides a substantial buffer beyond the regulatory

3. Data Sharing Through Penterra. Any post-study licensing, sharing, or transfer of clinical trial data to third parties must flow through Penterra as the sole data owner. Veridian, its participating sites, and individual investigators do not have independent authority to license or share study data with third parties outside of the narrowly defined exceptions set forth in the MCTA.

4. Investigator Publication Rights. Limited data access rights are preserved for investigators for academic publication purposes, subject to Penterra's 60-day review period for confidential information and patentable subject matter, followed by an additional delay of up to 90 days to permit patent filings. This framework represents the negotiated compromise between Penterra's interest in protecting its commercial pos

5. HIPAA and Regulatory Constraints. Additional layers of restriction on permissible data sharing arise under the Health Insurance Portability and Accountability Act of 1996 ("HIPAA"), its implementing regulations, and the FDA's regulatory framework governing investigational new drug applications under 21 C.F.R. Part 312. Penterra should develop a de-identification protocol for any anticipated post-study commercial d

II. Background A. The CLARION Trial and MCTA The CLARION trial (Protocol PPC-4871-III) is a Phase III, randomized, double-blind, placebo-controlled, multicenter study evaluating penterafenib (PPC-4871) in patients with advanced hepatocellular carcinoma who have progressed on or are intolerant to first-line systemic therapy. Penterafenib is an oral multi-kinase inhibitor targeting VEGFR-1/2/3, PDGFR-α/β, FGFR-1/2/3, a

III. Analysis of Penterra's Exclusive Data Ownership A. Scope of Data Ownership

Section 8.1 of the MCTA provides that Penterra shall be the sole and exclusive owner of all "Study Data" (as defined in the MCTA) generated, collected, compiled, or derived in connection with the conduct of Protocol PPC-4871-III. The definition of Study Data in Section 1.42 of the MCTA is intentionally broad and is designed to capture the full universe of data generated during the clinical trial. Specifically, Study

1. Data Generation at Sites. Clinical investigators and study coordinators at each of the 38 Veridian Network sites generate data through direct patient interactions, including physical examinations, treatment administration, adverse event assessments, and collection of patient-reported outcome instruments. This data is recorded in Source Documents maintained at the site.

2. Data Entry into Pinnacle EDC. Site personnel enter Study Data from Source Documents into electronic case report forms using the Pinnacle eClinical Suite v.8.2 platform. Data entry is performed according to the CLARION Data Management Plan and is subject to programmatic validation checks (edit checks) built into the EDC system. The Pinnacle platform is hosted on validated, 21 C.F.R. Part 11-compliant servers mainta

3. Data Management and Cleaning by Meridian CRO. Meridian CRO's data management team reviews eCRF data for completeness, consistency, and accuracy. Discrepancies are resolved through data queries issued to site personnel via the Pinnacle EDC platform. Meridian CRO also integrates laboratory data received electronically from Northbridge Bioanalytical Laboratories and imaging data from the central imaging core laborato

4. Central Laboratory Data from Northbridge. Northbridge Bioanalytical Laboratories generates laboratory data from blood and urine samples shipped from participating sites. Raw laboratory results are transmitted electronically to Meridian CRO's data management system via validated, encrypted data transfer protocols. Northbridge retains raw analytical data and sample logs in accordance with its Central Laboratory Serv

5. Biostatistical Analysis by Meridian CRO. Following database lock, Meridian CRO's biostatistics group performs all pre-specified statistical analyses in accordance with the CLARION Statistical Analysis Plan. Analytical datasets (in SDTM and ADaM formats), statistical programs, outputs, tables, listings, and figures are prepared and delivered to Penterra.

6. Penterra's Ultimate Control. Penterra, as Sponsor and data owner, has unrestricted access to all Study Data at every stage of the data flow. Jennifer Holt (VP, Clinical Operations) and her team have direct login access to the Pinnacle EDC platform with full data export capabilities. Penterra receives periodic data extracts and has real-time dashboard access to enrollment, safety, and data quality metrics. All stud

IV. Site Record Retention Obligations A. MCTA Retention Requirement

Section 9.1 of the MCTA imposes upon each participating Veridian Network site a mandatory obligation to retain all Source Documents and essential trial records generated in connection with Protocol PPC-4871-III for a minimum period of fifteen (15) years following the date of study completion, or such longer period as may be required by applicable federal, state, or institutional law, regulation, or policy. For purpos

Section 9.2 further provides that the retention obligation applies to records in all formats — paper, electronic, and mixed media — and that sites are responsible for maintaining records in a manner that preserves their integrity, legibility, and accessibility throughout the retention period. Electronic records must be maintained in formats that remain readable and retrievable with commercially available technology,

Section 9.3 of the MCTA addresses the procedures applicable at the expiration of the record retention period. Prior to destroying any Study-related records, each participating site is required to provide Penterra with not less than one hundred eighty (180) days' advance written notice of its intention to destroy such records. The notice must identify the categories and volume of records proposed for destruction, the

V. Confidentiality Framework Applicable to Data A. MCTA Confidentiality Provisions (Exhibit F) The MCTA incorporates a comprehensive confidentiality framework through Section 10 and the detailed provisions set forth in Exhibit F (Confidentiality and Data Protection Provisions). Under Exhibit F, all "Confidential Information" disclosed by either party to the other in connection with the CLARION trial is subject to con

VI. Permissible Licensing and Data Sharing Frameworks for Post-Study Analyses A. Data Sharing with Third Parties As the exclusive owner of all Study Data generated under the CLARION trial, Penterra has the unfettered right — subject to applicable law — to license, share, transfer, or otherwise make available such data to third parties for any lawful purpose. The MCTA does not impose any requirement for Penterra to ob