Contract analysis

Section 1.1 — "Confidential Information" "Confidential Information" means all non-public information disclosed by or on behalf of a Disclosing Party to a Receiving Party in connection with the CLARION trial and/or the Agreement, whether disclosed orally, in writing, electronically, or in any other form or medium, and regardless of whether such information is marked or designated as "confidential," "proprietary," or w

Section 1.2 — "Disclosing Party" and "Receiving Party" "Disclosing Party" means the party (or its affiliates, subsidiaries, investigators, study personnel, employees, officers, directors, agents, or representatives) disclosing, furnishing, or making available Confidential Information to the other party or its representatives. "Receiving Party" means the party (or its affiliates, subsidiaries, investigators, study per

Section 1.3 — "Protected Health Information" or "PHI" "Protected Health Information" or "PHI" has the meaning ascribed to the term "protected health information" in 45 C.F.R. § 160.103, as amended from time to time. For purposes of this Exhibit F, PHI includes individually identifiable health information that is created, received, maintained, or transmitted by a Participating Site Institution, an investigator, or any

Section 1.4 — "De-Identified Data" "De-Identified Data" means data that has been de-identified in accordance with the standards set forth in 45 C.F.R. § 164.514(a) through (c), using either: (a) the expert determination method described in 45 C.F.R. § 164.514(b)(1), pursuant to which a person with appropriate knowledge of and experience with generally accepted statistical and scientific principles and methods for ren

Section 1.5 — "Study Data" "Study Data" means all data collected, generated, compiled, derived, or otherwise produced in connection with the conduct of Protocol PPC-4871-III at any Participating Site, including but not limited to: clinical observations; physical examination findings; vital signs; laboratory results (including hematology, chemistry, urinalysis, and specialized biomarker panels); imaging data (includin

Section 1.6 — "Applicable Data Protection Laws" "Applicable Data Protection Laws" means all laws, statutes, regulations, rules, ordinances, and regulatory guidance applicable to the collection, use, storage, processing, transfer, disclosure, or protection of Confidential Information, PHI, or personal data in connection with the CLARION trial, including without limitation: (a) The Health Insurance Portability and Acco

Section 1.7 — Other Defined Terms Capitalized terms used in this Exhibit F that are not otherwise defined herein shall have the meanings ascribed to such terms in the Agreement or in the applicable exhibits and attachments thereto.

ARTICLE 2 — OBLIGATIONS OF CONFIDENTIALITY

Section 2.1 — General Confidentiality Obligation Each Receiving Party covenants and agrees that it shall: (a) Hold all Confidential Information of the Disclosing Party in strict confidence; (b) Not disclose, publish, disseminate, or otherwise make available any Confidential Information to any third party, except as expressly permitted under Article 3 of this Exhibit F; (c) Use Confidential Information solely for the

Section 2.2 — Confidentiality Term The confidentiality obligations set forth in this Exhibit F shall remain in full force and effect for a period of ten (10) years from the date of disclosure of each item of Confidential Information by the Disclosing Party to the Receiving Party. Notwithstanding the foregoing, to the extent that any item of Confidential Information constitutes a trade secret under the applicable law

Section 2.3 — Personnel and Agent Obligations The Receiving Party shall strictly limit access to Confidential Information to those of its employees, officers, directors, agents, consultants, independent contractors, investigators, sub-investigators, study coordinators, research nurses, pharmacists, and other site staff who: (i) have a legitimate need to know such Confidential Information for purposes of performing un

Section 2.4 — Subcontractor Obligations The Receiving Party shall ensure that any permitted subcontractor, vendor, or third-party service provider to whom Confidential Information is disclosed or made available in connection with the CLARION trial — including, without limitation, Meridian Contract Research Organization, Inc. (CRO), Pinnacle Data Solutions, Inc. (EDC Vendor), and Northbridge Bioanalytical Laboratories

ARTICLE 3 — PERMITTED DISCLOSURES Notwithstanding the confidentiality obligations set forth in Article 2, a Receiving Party may disclose Confidential Information under the following circumstances, subject to the limitations and conditions specified below:

Section 3.1 — Institutional Review Boards (IRBs) The Receiving Party may disclose Confidential Information to the extent reasonably necessary for submission to, and review and approval by, the applicable Institutional Review Board ("IRB") or independent ethics committee, including the Graystone University Institutional Review Board (IRB Registration: IRB00012847), the Veridian Central IRB, and any local IRB exercisin

Section 3.2 — Regulatory Authorities Either party may disclose Confidential Information to the extent required by applicable law or regulation, or as requested or required by the FDA — including in connection with IND 157823, IND safety reports filed pursuant to 21 C.F.R. § 312.32, annual reports filed pursuant to 21 C.F.R. § 312.33, and any other submissions, correspondence, inspections, or inquiries related to the

Section 3.3 — Legal Counsel Either party may disclose Confidential Information to its internal and external legal counsel on a need-to-know basis for the purpose of obtaining legal advice in connection with the Agreement or the CLARION trial. For Penterra, such counsel includes its outside counsel, Calderwood & Harkness LLP, and its FDA regulatory counsel, Castleton & Hargrove LLP. For Veridian, such counsel includes

Section 3.4 — External Auditors and Financial Advisors Penterra may disclose financial terms, deal economics, and related Confidential Information to its external auditor, Townsend Independent Auditors LLP, and its financial advisor, Ridgeline Capital Markets LLC, to the extent necessary for the purpose of audit, financial reporting, tax compliance, capital allocation planning, or investor relations activities, provi

Section 3.5 — Insurance Carriers Either party may disclose Confidential Information to its insurance carriers, brokers, and underwriters — including Briarcliff Mutual Insurance Company (with respect to Policy No. BM-CTL-2023-04182) — to the extent reasonably necessary for the purpose of obtaining or maintaining insurance coverage, processing claims, fulfilling insurance reporting obligations, or responding to inquiri

Section 3.6 — Judicial or Administrative Proceedings Either party may disclose Confidential Information to the extent compelled by a valid court order, subpoena, civil investigative demand, or administrative process issued by a court or governmental authority of competent jurisdiction. Any such disclosure shall be subject to the following conditions: (a) The Receiving Party shall provide the Disclosing Party with pro

Section 3.7 — Securities Law Obligations Penterra may disclose Confidential Information to the extent required by applicable securities laws and regulations, including filings with the United States Securities and Exchange Commission ("SEC") — such as Annual Reports on Form 10-K, Quarterly Reports on Form 10-Q, Current Reports on Form 8-K, proxy statements, and registration statements — and disclosures required by th

Section 3.8 — Publication Disclosures Investigators and study personnel may publish or present Study Data and results of the CLARION trial in peer-reviewed journals, academic presentations, posters, and other scientific fora, subject to the terms and conditions set forth in Exhibit G (Intellectual Property and Publication Rights) of the Agreement. As provided in Exhibit G, all proposed publications and presentations

ARTICLE 4 — EXCLUSIONS FROM CONFIDENTIAL INFORMATION

Section 4.1 — Standard Exclusions The confidentiality and non-use obligations set forth in this Exhibit F shall not apply to any information that the Receiving Party can demonstrate by competent written evidence (including contemporaneous records, documents, or other tangible proof): (a) Public Domain — At Time of Disclosure. Was in the public domain at the time of disclosure by the Disclosing Party, through no act,

Section 4.2 — Combination of Information Any combination of features, elements, or components of Confidential Information shall not be deemed to fall within the exclusions set forth in Section 4.1 merely because individual features, elements, or components of such combination are in the public domain or are in the Receiving Party's possession. Such combination shall be excluded from the obligations of this Exhibit F

ARTICLE 5 — DATA PROTECTION AND HIPAA COMPLIANCE

Section 5.1 — HIPAA Framework The parties acknowledge and agree that the conduct of Protocol PPC-4871-III at the Participating Sites may involve the creation, receipt, maintenance, use, transmission, and disclosure of PHI, as defined under HIPAA (45 C.F.R. Parts 160 and 164), with respect to the trial subjects enrolled in the CLARION trial. Each party recognizes its respective obligations under HIPAA and agrees to co

Section 5.2 — Research Authorization Each Participating Site shall obtain a valid HIPAA research authorization from each trial subject (or the subject's legally authorized representative) prior to any use or disclosure of the subject's PHI for purposes of the CLARION trial, unless a valid waiver of authorization has been obtained from the applicable IRB or Privacy Board in accordance with 45 C.F.R. § 164.512(i)(1)(i)

Section 5.3 — Minimum Necessary Standard All uses and disclosures of PHI in connection with the CLARION trial shall be limited to the minimum amount of PHI necessary to accomplish the intended purpose of the use or disclosure, consistent with the minimum necessary standard set forth in 45 C.F.R. § 164.502(b) and the requirements of 45 C.F.R. § 164.514(d). Sponsor and Meridian CRO shall receive only the minimum PHI ne

Section 5.4 — De-Identification and Limited Data Sets To the extent practicable, Study Data shared between the parties and their respective subcontractors in connection with the CLARION trial shall be de-identified in accordance with 45 C.F.R. § 164.514(a) through (c) prior to transmission. The parties shall work cooperatively to identify opportunities for the use of De-Identified Data in lieu of PHI for data analyse

Section 5.5 — Business Associate Obligations To the extent that any party to the Agreement, or any subcontractor or agent thereof, acts as a Business Associate (as defined in 45 C.F.R. § 160.103) of a Participating Site or any other Covered Entity (as defined in 45 C.F.R. § 160.103) with respect to PHI created, received, maintained, or transmitted in connection with the CLARION trial, the applicable parties shall exe

Section 5.6 — Breach Notification In the event of a breach of unsecured PHI (as defined in 45 C.F.R. § 164.402), the party experiencing or discovering the breach shall notify the other party without unreasonable delay and in no event later than ten (10) calendar days following the date on which the breach is discovered or reasonably should have been discovered. The breaching party shall cooperate fully with the non-b

ARTICLE 6 — DATA SECURITY OBLIGATIONS

Section 6.1 — Administrative Safeguards Each party shall implement and maintain administrative safeguards consistent with the requirements of 45 C.F.R. § 164.308, as applicable to the party's role and responsibilities in connection with the CLARION trial. Such administrative safeguards shall include, at a minimum: (a) Security Management Process. Designation of a qualified security official who shall be responsible f

Section 6.2 — Physical Safeguards Each party shall implement and maintain physical safeguards consistent with the requirements of 45 C.F.R. § 164.310, as applicable. Such physical safeguards shall include, at a minimum: (a) Facility Access Controls. Implementation of facility access controls to limit physical access to electronic information systems, servers, workstations, and storage areas (including file cabinets,

Section 6.3 — Technical Safeguards Each party shall implement and maintain technical safeguards consistent with the requirements of 45 C.F.R. § 164.312, as applicable. Such technical safeguards shall include, at a minimum: (a) Access Controls. Implementation of unique user identification for each individual authorized to access electronic systems containing Confidential Information or PHI, together with role-based ac

Section 6.4 — 21 C.F.R. Part 11 Compliance All electronic records and electronic signatures created, maintained, modified, archived, retrieved, or transmitted in connection with the CLARION trial shall comply with the requirements of 21 C.F.R. Part 11 (Electronic Records; Electronic Signatures), as interpreted and enforced by the FDA. Without limiting the foregoing, the following requirements shall apply: (a) System

Section 6.5 — Incident Response Each party shall maintain and implement a written information security incident response plan that is appropriate to the nature and scope of the party's involvement in the CLARION trial and the types of Confidential Information and PHI that the party creates, receives, maintains, or transmits. In the event of a suspected or confirmed security incident involving Confidential Information

ARTICLE 7 — DOCUMENT RETENTION AND RETURN/DESTRUCTION OF CONFIDENTIAL INFORMATION

Section 7.1 — Document Retention Period Each Participating Site shall retain source documents, study records, informed consent forms, IRB correspondence, and all other documentation related to the CLARION trial for a minimum period of fifteen (15) years following study completion (currently projected for August 2028), or for such longer period as may be required by: (a) applicable federal or state law or regulation,

Section 7.2 — Return or Destruction Upon Termination or Expiration Upon the expiration or termination of the Agreement for any reason, or upon the written request of the Disclosing Party (subject to the retention obligations of Section 7.1), the Receiving Party shall, at the Disclosing Party's election: (a) Promptly return to the Disclosing Party all tangible and electronic copies of Confidential Information in the R

Section 7.3 — Backup and Archival Systems The parties acknowledge that Confidential Information may reside in automated backup, archival, or disaster recovery systems maintained in the ordinary course of business. Such information shall not be required to be returned or affirmatively destroyed from backup or archival systems that are not reasonably accessible in the ordinary course of business, provided that: (a) Suc

ARTICLE 8 — DATA OWNERSHIP CROSS-REFERENCE

Section 8.1 — Sponsor Data Ownership As set forth in Exhibit G (Intellectual Property and Publication Rights) and the applicable provisions of the Agreement, Penterra retains sole and exclusive ownership of all Study Data generated, collected, compiled, or derived in connection with Protocol PPC-4871-III, including all clinical, safety, laboratory, pharmacokinetic, pharmacodynamic, biomarker, and statistical data, an

Section 8.2 — Site Access to Study Data Participating Sites and investigators shall have access to Study Data to the extent reasonably necessary for: (a) The provision of ongoing clinical care to enrolled trial subjects; (b) Safety reporting, including the reporting of serious adverse events within twenty-four (24) hours of site awareness, as specified in Exhibit J (Pharmacovigilance and Safety Reporting Provisions)

Section 9.1 — Injunctive Relief The parties acknowledge and agree that any breach or threatened breach of the confidentiality, data protection, or data security obligations set forth in this Exhibit F may cause irreparable injury and harm to the Disclosing Party for which monetary damages would be an inadequate and insufficient remedy. Accordingly, in the event of an actual or threatened breach of this Exhibit F, the

Section 9.2 — Indemnification for Breach A breach of the confidentiality, data protection, or data security obligations set forth in this Exhibit F by either party shall constitute a material breach of the Agreement. Without limiting any other rights or remedies available under the Agreement, at law, or in equity, the non-breaching party shall be entitled to indemnification from the breaching party for all losses, da

ARTICLE 10 — REPRESENTATIONS AND WARRANTIES

Section 10.1 — Compliance Representations Each party represents and warrants to the other party that: (a) It has implemented, and will maintain throughout the term of the Agreement and for such additional period as Confidential Information or PHI remains in its possession or control, administrative, physical, and technical safeguards that are sufficient to protect the confidentiality, integrity, and availability of a

Section 10.2 — Authority Each party represents and warrants that: (a) It has the full right, power, and authority to disclose the Confidential Information that it provides to the other party under the Agreement; (b) Such disclosure does not violate any agreement with, or any right of, any third party, including any obligation of confidentiality, non-disclosure, non-competition, or intellectual property rights; and (c

ARTICLE 11 — GENERAL PROVISIONS

Section 11.1 — Governing Law This Exhibit F shall be governed by and construed in accordance with the laws of the State of New York, without regard to its principles of conflicts of laws, consistent with the governing law provision set forth in the Agreement. To the extent that any provision of this Exhibit F is governed by federal law (including HIPAA and 21 C.F.R. Part 11), such federal law shall apply.

Section 11.2 — Relationship to Agreement This Exhibit F is attached to and forms an integral part of the Agreement between Penterra and Veridian dated June 28, 2023, and is incorporated therein by reference. All terms and conditions of the Agreement that are not inconsistent with this Exhibit F shall apply to the subject matter hereof