1018-00004 · Penterra Pharmaceuticals Corp · Transaction Documents/IP & Data

data-ownership-licensing-memo.docx DOCUMENT Finance & Banking

42 / 78 ← → ✕

MEMORANDUM

PRIVILEGED & CONFIDENTIAL ATTORNEY-CLIENT PRIVILEGE / ATTORNEY WORK PRODUCT

TO: Miriam Calloway, Partner, Calderwood & Harkness LLP

FROM: Christopher Aiken, Associate, Calderwood & Harkness LLP

DATE: June 25, 2023

RE: Data Ownership, Licensing, and Post-Study Data Sharing Framework under the Master Clinical Trial Agreement between Penterra Pharmaceuticals Corp. and Veridian Health Research Network, Inc. — Protocol PPC-4871-III (CLARION)

MATTER NO.: 1018-00004

CLIENT: Penterra Pharmaceuticals Corp.

Right-click to update Table of Contents

I. Executive Summary

This memorandum analyzes the data ownership, site record retention, and permissible licensing and data sharing provisions negotiated and finalized in the execution version of the Master Clinical Trial Agreement (the "MCTA"), dated June 28, 2023, between Penterra Pharmaceuticals Corp. ("Penterra" or "PPC"), a Delaware corporation headquartered at 200 Biopharma Boulevard, Suite 1400, Princeton, New Jersey 08540, publicly traded on the Nasdaq Global Select Market (ticker: PTRA), and Veridian Health Research Network, Inc. ("Veridian" or "VHRN"), a Delaware 501(c)(3) nonprofit corporation headquartered at 750 Research Parkway, 8th Floor, Philadelphia, Pennsylvania 19104. The MCTA governs the conduct of the Phase III CLARION trial (Protocol PPC-4871-III, ClinicalTrials.gov Identifier NCT05928174, IND 157823) evaluating penterafenib (PPC-4871), an oral multi-kinase inhibitor, in patients with advanced hepatocellular carcinoma ("HCC").

This memorandum was prepared at the direction of client counsel and is intended to advise the deal team on the structural framework for data rights under the MCTA. The analysis focuses on the interplay among the contractual provisions, applicable federal and state regulatory requirements, HIPAA compliance obligations, and the intellectual property framework established in the related IP Side Letter. The memorandum identifies key risks associated with the data ownership and sharing framework and provides actionable recommendations for mitigating those risks during the study's projected 60-month duration and beyond.

The principal conclusions of this memorandum are as follows:

1. Exclusive Sponsor Ownership. Penterra retains exclusive ownership of all clinical trial data generated under the MCTA in connection with Protocol PPC-4871-III. This ownership is comprehensive, covering case report form data, laboratory data, safety data, biomarker and pharmacokinetic/pharmacodynamic data, imaging data, patient-reported outcomes, statistical analyses, and regulatory submissions. The ownership provision is enforceable under governing New York law and is consistent with established industry practice for sponsor-funded clinical trials.

2. Record Retention. Veridian and its participating sites are obligated to retain source documents and essential trial records for a minimum of 15 years following study completion, or longer if required by applicable law. Given the projected study completion date of August 2028, this retention obligation extends through at least August 2043. This contractual period provides a substantial buffer beyond the regulatory minimums established under 21 C.F.R. § 312.62(c) and ICH E6(R2).

3. Data Sharing Through Penterra. Any post-study licensing, sharing, or transfer of clinical trial data to third parties must flow through Penterra as the sole data owner. Veridian, its participating sites, and individual investigators do not have independent authority to license or share study data with third parties outside of the narrowly defined exceptions set forth in the MCTA.

4. Investigator Publication Rights. Limited data access rights are preserved for investigators for academic publication purposes, subject to Penterra's 60-day review period for confidential information and patentable subject matter, followed by an additional delay of up to 90 days to permit patent filings. This framework represents the negotiated compromise between Penterra's interest in protecting its commercial position and Veridian's insistence on preserving academic freedom.

5. HIPAA and Regulatory Constraints. Additional layers of restriction on permissible data sharing arise under the Health Insurance Portability and Accountability Act of 1996 ("HIPAA"), its implementing regulations, and the FDA's regulatory framework governing investigational new drug applications under 21 C.F.R. Part 312. Penterra should develop a de-identification protocol for any anticipated post-study commercial data sharing.

The total deal value of the MCTA is approximately $80,000,000, covering clinical trial conduct across 38 Veridian Network sites located in 14 states over the projected 60-month study duration, consisting of a 42-month enrollment period followed by an 18-month follow-up period. The per-patient fee structure is $52,000 per enrolled subject based on targeted enrollment of 1,200 subjects, with the balance allocated to site activation, investigator grants, maintenance fees, and study closeout costs. Target first patient in is August 14, 2023.

II. Background

A. The CLARION Trial and MCTA

The CLARION trial (Protocol PPC-4871-III) is a Phase III, randomized, double-blind, placebo-controlled, multicenter study evaluating penterafenib (PPC-4871) in patients with advanced hepatocellular carcinoma who have progressed on or are intolerant to first-line systemic therapy. Penterafenib is an oral multi-kinase inhibitor targeting VEGFR-1/2/3, PDGFR-α/β, FGFR-1/2/3, and c-Kit, with a novel mechanism of dual RAF/MEK pathway inhibition. The compound was identified and developed by Penterra's internal discovery platform, and Penterra holds all composition-of-matter, formulation, and method-of-use patents relating to the compound.

The trial is designed to enroll a total of 1,200 subjects randomized in a 2:1 ratio (800 subjects to the penterafenib treatment arm and 400 subjects to the matching placebo arm). The primary endpoint is overall survival ("OS"). Key secondary endpoints include progression-free survival ("PFS"), objective response rate ("ORR") per RECIST v1.1 criteria as assessed by blinded independent central review, duration of response ("DOR"), and time to deterioration in quality of life as measured by the EORTC QLQ-C30 and HCC-specific QLQ-HCC18 instruments.

Penterra filed the original Investigational New Drug Application for penterafenib with the U.S. Food and Drug Administration ("FDA") in October 2021, under IND 157823. The Phase II study (Protocol PPC-4871-II, BEACON) was completed in January 2023 and demonstrated a 38% objective response rate in 186 evaluable patients with second-line advanced HCC, a clinically meaningful and statistically significant result that supported advancement to Phase III. The CLARION trial represents the pivotal registration study for penterafenib and is central to Penterra's regulatory strategy for a New Drug Application ("NDA") submission, currently projected for the first quarter of 2029 assuming favorable trial results.

The MCTA governs the legal and operational relationship between Penterra, acting as the Sponsor of the CLARION trial, and Veridian, acting as the coordinating organization for a network of 38 academic medical centers and affiliated research institutions that will serve as clinical trial sites. Veridian is a well-established site network organization with a 22-year track record of managing large-scale, multicenter clinical trials in oncology, cardiology, and neuroscience. Veridian does not itself conduct clinical research; rather, it functions as an intermediary that coordinates site selection, regulatory submissions, contract negotiation, and administrative oversight on behalf of its member institutions.

The 38 participating sites are located across 14 states: Pennsylvania (8 sites), Illinois (5 sites), New York (4 sites), California (4 sites), Texas (3 sites), Massachusetts (3 sites), Ohio (2 sites), Michigan (2 sites), Florida (2 sites), North Carolina (1 site), Georgia (1 site), Maryland (1 site), Washington (1 site), and Colorado (1 site). The lead sites for the CLARION trial are:

• Site 001 — Graystone University Medical Center, 1200 University Avenue, Philadelphia, Pennsylvania 19104; Principal Investigator: Dr. Catherine Aldridge, M.D., Ph.D., Professor of Medicine, Division of Medical Oncology, Graystone University School of Medicine. Dr. Aldridge also serves as the Global Principal Investigator for the CLARION trial.

• Site 002 — Lakemont Medical Center, 4400 North Michigan Drive, Chicago, Illinois 60611; Co-Principal Investigator: Dr. Howard Matsuoka, M.D., Professor of Medicine, Department of Hematology/Oncology, Lakemont Medical Center. Dr. Matsuoka serves as the national Co-Principal Investigator.

The MCTA was the product of extensive negotiations between the parties over a period of approximately five months, from January through June 2023. Data ownership and publication rights were among the most heavily negotiated provisions, as discussed in detail in Sections III and VI below.

B. Parties and Advisors Relevant to Data Issues

The following individuals and entities play key roles in the data-related aspects of the CLARION trial and MCTA and are referenced throughout this memorandum:

Penterra Pharmaceuticals Corp.:

• Rebecca Liang, Esq., Associate General Counsel, Clinical Affairs — primary day-to-day legal contact for MCTA administration and data-related issues.

• Jennifer Holt, Vice President, Clinical Operations — responsible for overall clinical operations oversight of the CLARION trial, including data management strategy and CRO oversight.

• Samantha Novak, Director, Clinical Contracts — responsible for contract administration, site payments, and coordination with Veridian's contracts team.

Veridian Health Research Network, Inc.:

• Gregory Callahan, Esq., Vice President, Legal & Compliance — Veridian's primary internal legal contact for MCTA negotiations and ongoing compliance.

• Diane Prescott, Chief Operating Officer — responsible for network-wide operational coordination.

• Dr. Lena Marchetti, Senior Vice President, Research Administration — responsible for research compliance, site capability assessments, and investigator qualifications.

• Patricia Dunne, Director, Regulatory & Data Compliance — responsible for regulatory submissions coordination and data protection compliance across the Veridian network.

• Outside Counsel: Allison Whitmore, Partner, Whitmore, Jansen & Callahan LLP, 1500 Market Street, Suite 3200, Philadelphia, Pennsylvania 19102 — provided legal counsel to Veridian during MCTA negotiations.

Contract Research Organization:

• Meridian Contract Research Organization, Inc. ("Meridian CRO"), 9200 Corporate Boulevard, Raleigh, North Carolina 27615; Chief Executive Officer: Thomas Hartwell. Meridian CRO is engaged by Penterra under a separate Master Services Agreement ("Meridian MSA") dated January 15, 2023, and is responsible for data management, clinical monitoring, safety reporting, pharmacovigilance, and biostatistical analysis for the CLARION trial. Meridian CRO's data-related responsibilities and custodial role are governed exclusively by the Meridian MSA.

EDC Platform Vendor:

• Pinnacle Data Solutions, Inc. ("Pinnacle"), 6000 Clearwater Drive, San Diego, California 92121 — provides the electronic data capture ("EDC") platform (Pinnacle eClinical Suite v.8.2) for the CLARION trial, including electronic case report form design, data validation, and hosting. Pinnacle's services are provided under a separate Technology Services Agreement with Penterra dated March 8, 2023.

Central Laboratory:

• Northbridge Bioanalytical Laboratories, Inc. ("Northbridge"), 2900 Commerce Way, Baltimore, Maryland 21224 — provides centralized laboratory services for the CLARION trial, including pharmacokinetic/pharmacodynamic sample analysis, biomarker testing (including circulating tumor DNA and AFP levels), hematology, serum chemistry, and safety laboratory assessments. Northbridge's services are provided under a separate Central Laboratory Services Agreement with Penterra dated February 22, 2023.

Regulatory Counsel:

• Castleton & Hargrove LLP, with Dr. Priya Sundaram, Esq. serving as lead regulatory counsel to Penterra for FDA interactions, IND maintenance, and NDA strategy related to penterafenib.

C. Relevant MCTA Provisions

The data-related provisions in the execution version of the MCTA are dispersed across several sections and exhibits of the agreement. The principal provisions relevant to this memorandum include:

• Section 8 (Data Ownership and Access), which establishes Penterra's exclusive ownership of all Study Data and grants Penterra unrestricted access to source documents at participating sites;

• Section 9 (Record Retention), which establishes the 15-year post-study-completion retention obligation for site records and sets forth the procedures for record transfer and destruction;

• Section 10 (Confidentiality), which incorporates by reference the detailed confidentiality provisions set forth in Exhibit F (Confidentiality and Data Protection Provisions);

• Section 11 (Intellectual Property and Publication), which incorporates by reference the provisions of Exhibit G (Intellectual Property and Publication Rights) and the separately executed IP Side Letter dated June 28, 2023;

• Section 14 (Regulatory Compliance), which addresses FDA compliance obligations, including 21 C.F.R. Part 11 requirements for electronic records and the allocation of regulatory responsibilities between Sponsor and investigator;

• Section 17 (Subcontracting), which identifies approved subcontractors listed in Exhibit K and establishes the requirement that all subcontractors be bound by confidentiality and data protection obligations no less restrictive than those applicable to the parties under the MCTA;

• Section 23 (Governing Law and Dispute Resolution), which provides that the MCTA is governed by the laws of the State of New York without regard to conflicts of law principles and establishes binding arbitration in New York, New York under the Commercial Arbitration Rules of the American Arbitration Association ("AAA"), before a panel of three arbitrators.

The exhibits and ancillary documents referenced above are incorporated into the MCTA by reference and form an integral part of the contractual framework governing data rights. This memorandum analyzes these provisions in the aggregate to provide a comprehensive assessment of the data ownership, licensing, and sharing framework applicable to the CLARION trial.

III. Analysis of Penterra's Exclusive Data Ownership

A. Scope of Data Ownership

Section 8.1 of the MCTA provides that Penterra shall be the sole and exclusive owner of all "Study Data" (as defined in the MCTA) generated, collected, compiled, or derived in connection with the conduct of Protocol PPC-4871-III. The definition of Study Data in Section 1.42 of the MCTA is intentionally broad and is designed to capture the full universe of data generated during the clinical trial. Specifically, Study Data is defined to include, without limitation, the following categories of data:

(a) Case Report Form Data. All data entered by site personnel into electronic case report forms ("eCRFs") through the Pinnacle EDC platform (Pinnacle eClinical Suite v.8.2), including subject demographics, medical history, concomitant medications, treatment administration records, protocol-specified assessments, and endpoint evaluations. The eCRF data is the core structured dataset of the CLARION trial and forms the foundation for all statistical analyses and regulatory submissions.

(b) Laboratory Data. All laboratory results generated by Northbridge Bioanalytical Laboratories in connection with the CLARION trial, including hematology panels, serum chemistry panels, hepatic function tests, coagulation parameters, urinalysis, and specialized safety assessments. This category also encompasses all bioanalytical data generated by Northbridge, including penterafenib and metabolite plasma concentration data used for pharmacokinetic analyses.

(c) Safety Data. All adverse event reports, serious adverse event reports, suspected unexpected serious adverse reactions ("SUSARs"), IND safety reports filed with the FDA, and all related source documentation, case narratives, and causality assessments. Safety data is of particular importance given the oncology setting and the known hepatotoxicity signals observed in the Phase II BEACON trial.

(d) Biomarker and Pharmacokinetic/Pharmacodynamic Data. All data relating to pre-specified biomarker analyses, including circulating tumor DNA ("ctDNA") levels, alpha-fetoprotein ("AFP") kinetics, tumor mutational profiling data, and any other translational or correlative science data generated under the protocol's exploratory objectives. Pharmacokinetic data include penterafenib and metabolite concentration-time profiles, population PK model parameters, and exposure-response analyses.

(e) Imaging and Radiological Assessments. All radiological imaging data collected in connection with the CLARION trial, including CT scans, MRI studies, and bone scans, as well as all tumor measurement data and response assessments performed by the blinded independent central review committee and by local site radiologists. Imaging data is transmitted to and stored by the central imaging core laboratory operated by Meridian CRO.

(f) Quality of Life and Patient-Reported Outcome Data. All data collected through the EORTC QLQ-C30, QLQ-HCC18, and EQ-5D-5L instruments, including raw questionnaire responses, domain scores, and derived quality-of-life metrics.

(g) Statistical Analyses and Databases. All statistical analyses, analytical datasets (SDTM and ADaM formats), statistical analysis plans, analysis outputs, tables, listings, and figures compiled by Meridian CRO's biostatistics group, as well as the locked clinical trial database and any interim or final analysis datasets.

(h) Regulatory Submissions and Correspondence. All data included in or generated in connection with regulatory submissions to the FDA under IND 157823, including IND annual reports, protocol amendments, information amendments, and all FDA correspondence relating to the CLARION trial. This category also encompasses any data submitted to international regulatory authorities in connection with the global development program for penterafenib, to the extent such data originates from CLARION trial sites.

Critically, Section 8.2 of the MCTA draws a clear distinction between "Study Data" (owned exclusively by Penterra) and "Source Documents" (which remain the property of the respective site institutions). Source Documents are defined in Section 1.39 as original medical records, hospital charts, laboratory notes, pharmacy dispensing records, subject diaries, and other original documents or certified copies thereof that exist at the site institution and from which Study Data is derived or verified. While Source Documents remain the property of the generating site institution — as they must, since they form part of the subject's medical record and are subject to institutional and state law requirements — Penterra is granted comprehensive access and audit rights to Source Documents under Section 8.3 of the MCTA. These rights include the right to inspect, copy, and audit Source Documents at any reasonable time during the study and for the duration of the record retention period, and the right to authorize the FDA and other regulatory authorities to access Source Documents in connection with inspections and audits.

This distinction between Study Data and Source Documents is both commercially important and legally sound. It ensures that Penterra acquires ownership of all data in the structured, analyzable formats that are necessary for regulatory submissions, commercialization, and licensing purposes, while respecting the institutional ownership of original medical records that cannot practically or legally be transferred to a pharmaceutical sponsor.

B. Legal Basis for Sponsor Data Ownership

The exclusive sponsor ownership of clinical trial data established in Section 8.1 of the MCTA is enforceable under governing New York law. While there is limited New York case law directly addressing ownership of clinical trial data under a master clinical trial agreement, the contractual framework in the MCTA is well-supported by general principles of contract law and by the regulatory reality of the IND framework.

Contractual Framework. The data ownership provision in Section 8.1 functions as both a prospective assignment and a work-product ownership allocation. Under New York law, parties are free to allocate ownership of intangible assets — including data — by contract, provided that the allocation is supported by adequate consideration and is not unconscionable or contrary to public policy. See, e.g., Borg-Warner Corp. v. Universal Maritime Serv. Corp., 731 F. Supp. 1226, 1231 (S.D.N.Y. 1990) (enforcing contractual allocation of intellectual property rights); Speedfit LLC v. Woodway USA, Inc., 53 F. Supp. 3d 561, 577 (E.D.N.Y. 2014) (recognizing the validity of contractual data ownership provisions). Here, the consideration supporting Penterra's data ownership is the substantial study funding provided under the MCTA — $80,000,000 in total across the 38-site network — which compensates Veridian and its sites for the work of generating the data under the protocol. The allocation is neither unconscionable nor contrary to public policy; it reflects the standard industry practice in sponsor-funded clinical trials, where the sponsor bears the financial risk and regulatory responsibility and accordingly retains ownership of the resulting data.

The MCTA employs a hybrid approach to establishing Penterra's ownership. Section 8.1(a) provides that all Study Data "shall be and shall remain the sole and exclusive property of Penterra." Section 8.1(b) provides that to the extent any Study Data might be deemed a "work made for hire" under 17 U.S.C. § 101, it is so deemed, and to the extent it is not, Veridian and each participating site irrevocably assigns to Penterra all right, title, and interest in such Study Data. Section 8.1(c) includes a further assurances clause requiring Veridian and participating sites to execute such additional documents and take such further actions as may be reasonably necessary to effectuate Penterra's ownership. This belt-and-suspenders approach is a best practice that minimizes the risk of any challenge to Penterra's ownership claim.

Regulatory Reality. The data ownership allocation is further supported by the regulatory framework governing investigational new drug applications. As the IND holder for penterafenib (IND 157823), Penterra is the entity with exclusive authority and responsibility to submit clinical trial data to the FDA under 21 C.F.R. Part 312. The IND holder has the obligation to maintain and submit all clinical study reports, safety data, and efficacy data, and bears full regulatory responsibility for the integrity of the data. It would be anomalous and impractical for any entity other than the IND holder to own the clinical trial data that the IND holder is obligated by federal regulation to control and submit. The FDA's regulatory framework effectively presupposes sponsor ownership of clinical trial data, even though it does not mandate it as a matter of statutory or regulatory text.

Work-for-Hire Analogy. Although clinical trial data is not a copyrightable "work of authorship" in the traditional sense, the work-for-hire analogy is instructive. Under the Copyright Act, a work prepared by an employee within the scope of employment, or a specially ordered or commissioned work in certain enumerated categories, is a work made for hire and is owned by the employer or commissioning party. 17 U.S.C. § 101. The MCTA's invocation of the work-for-hire concept in Section 8.1(b) reflects the economic reality that Veridian and participating sites generate Study Data at Penterra's direction, pursuant to Penterra's protocol, using Penterra's investigational product, and funded by Penterra's financial support. While the sites are independent contractors rather than employees — and the data may not fall within the enumerated categories of specially commissioned works — the contractual assignment in Section 8.1(b) serves as a backstop to ensure that ownership vests in Penterra regardless of the technical applicability of the work-for-hire doctrine.

C. Limitations on Penterra's Ownership

While Penterra's data ownership is comprehensive, it is not absolute. The MCTA and the IP Side Letter carve out certain categories of intellectual property and data that are not owned by Penterra:

(a) Pre-Existing intellectual Property. Section 2.1 of the IP Side Letter provides that each party retains all right, title, and interest in its pre-existing intellectual property, defined as intellectual property owned by or licensed to a party prior to the effective date of the MCTA, or developed independently of the MCTA without the use of the other party's confidential information. For Veridian and its investigators, this includes pre-existing research methodologies, proprietary analytical tools, institutional databases, and previously published research results. Penterra's data ownership under the MCTA does not operate to transfer or encumber any such pre-existing intellectual property.

(b) Patient Medical Records. As noted in Section III.A above, Source Documents — including patient medical records that exist independently of the CLARION trial — remain the property of the generating site institution. Penterra's ownership extends only to Study Data derived from or relating to the clinical trial. To the extent a subject's participation in the CLARION trial generates entries in the subject's general medical record that are not specific to the trial (e.g., records of standard-of-care treatments provided during the study period), those records are not Study Data and are not owned by Penterra.

(c) Investigator-Generated Hypotheses and Independent Analyses. Section 3.4 of the IP Side Letter provides that hypotheses, theories, or analytical frameworks independently developed by investigators using their own expertise and not funded under the MCTA are not Study Data and are not owned by Penterra. However, this exception is subject to two important qualifications. First, any such independently developed work product that incorporates, references, or is derived from Study Data remains subject to the confidentiality and publication review obligations set forth in Exhibit G of the MCTA. Second, to the extent an investigator's independent analysis utilizes Study Data as an input, the Study Data itself remains Penterra's property even though the investigator's original analytical contribution may not be.

These limitations are reasonable and reflect the practical reality that Penterra cannot — and does not seek to — acquire ownership of every piece of information that every investigator at every site may develop during the course of a multi-year clinical trial. The limitations are, however, narrowly drawn, and the broad definition of Study Data in Section 1.42 should be understood as the default rule, with the exceptions identified above serving as limited carve-outs rather than broadly applicable limitations.

D. Data Custody and Control During the Study

The CLARION trial involves a multi-layered data flow architecture in which Study Data is generated at multiple sites and passes through multiple custodial intermediaries before reaching Penterra as the ultimate data owner. Understanding this data flow is essential to assessing data integrity, security, and ownership risks.

The general data flow is as follows:

1. Data Generation at Sites. Clinical investigators and study coordinators at each of the 38 Veridian Network sites generate data through direct patient interactions, including physical examinations, treatment administration, adverse event assessments, and collection of patient-reported outcome instruments. This data is recorded in Source Documents maintained at the site.

2. Data Entry into Pinnacle EDC. Site personnel enter Study Data from Source Documents into electronic case report forms using the Pinnacle eClinical Suite v.8.2 platform. Data entry is performed according to the CLARION Data Management Plan and is subject to programmatic validation checks (edit checks) built into the EDC system. The Pinnacle platform is hosted on validated, 21 C.F.R. Part 11-compliant servers maintained by Pinnacle Data Solutions, Inc. at its data center in San Diego, California. Penterra holds the master data license for all data housed on the Pinnacle platform, and Pinnacle's Technology Services Agreement expressly confirms that Pinnacle acquires no ownership interest in any data entered, stored, or processed through its platform.

3. Data Management and Cleaning by Meridian CRO. Meridian CRO's data management team reviews eCRF data for completeness, consistency, and accuracy. Discrepancies are resolved through data queries issued to site personnel via the Pinnacle EDC platform. Meridian CRO also integrates laboratory data received electronically from Northbridge Bioanalytical Laboratories and imaging data from the central imaging core laboratory. Meridian CRO is responsible for database lock following completion of data cleaning for each analysis timepoint.

4. Central Laboratory Data from Northbridge. Northbridge Bioanalytical Laboratories generates laboratory data from blood and urine samples shipped from participating sites. Raw laboratory results are transmitted electronically to Meridian CRO's data management system via validated, encrypted data transfer protocols. Northbridge retains raw analytical data and sample logs in accordance with its Central Laboratory Services Agreement with Penterra, but all laboratory data generated in connection with the CLARION trial is owned by Penterra.

5. Biostatistical Analysis by Meridian CRO. Following database lock, Meridian CRO's biostatistics group performs all pre-specified statistical analyses in accordance with the CLARION Statistical Analysis Plan. Analytical datasets (in SDTM and ADaM formats), statistical programs, outputs, tables, listings, and figures are prepared and delivered to Penterra.

6. Penterra's Ultimate Control. Penterra, as Sponsor and data owner, has unrestricted access to all Study Data at every stage of the data flow. Jennifer Holt (VP, Clinical Operations) and her team have direct login access to the Pinnacle EDC platform with full data export capabilities. Penterra receives periodic data extracts and has real-time dashboard access to enrollment, safety, and data quality metrics. All study databases, analytical datasets, and statistical outputs are transferred to and maintained by Penterra upon study completion.

Each of the approved subcontractors identified in Exhibit K of the MCTA — Meridian CRO, Pinnacle Data Solutions, and Northbridge Bioanalytical Laboratories — handles Study Data in a custodial capacity only. None of these entities acquires any ownership interest in Study Data by virtue of its custodial role. Each subcontractor's data handling is governed by its own separate agreement with Penterra, which includes robust confidentiality, data protection, and data security provisions. The key agreements are:

• Meridian CRO: Master Services Agreement dated January 15, 2023, including Data Protection Addendum

• Pinnacle Data Solutions: Technology Services Agreement dated March 8, 2023, including Data Hosting and Security Exhibit

• Northbridge Bioanalytical Laboratories: Central Laboratory Services Agreement dated February 22, 2023, including Data Transfer Specifications Appendix

A flowchart depicting the complete CLARION trial data flow architecture is attached as Appendix C to this memorandum.

IV. Site Record Retention Obligations

A. MCTA Retention Requirement

Section 9.1 of the MCTA imposes upon each participating Veridian Network site a mandatory obligation to retain all Source Documents and essential trial records generated in connection with Protocol PPC-4871-III for a minimum period of fifteen (15) years following the date of study completion, or such longer period as may be required by applicable federal, state, or institutional law, regulation, or policy. For purposes of Section 9.1, "study completion" is defined as the date on which Penterra provides written notification to Veridian that the CLARION trial has been completed, which includes final database lock, completion of all protocol-specified assessments, and resolution of all outstanding data queries.

Based on the current study timeline, with a projected enrollment period of 42 months commencing in August 2023 and an 18-month follow-up period, study completion is projected for approximately August 2028. Accordingly, the minimum contractual retention period is projected to extend through approximately August 2043 — a period of twenty years from the present date.

The categories of records subject to the retention obligation are comprehensive and include, without limitation:

• Signed informed consent forms (including re-consent forms and HIPAA research authorizations)

• Original Source Documents (medical records, laboratory reports, imaging studies, pharmacy dispensing logs)

• IRB/IEC correspondence, approvals, and continuing review documentation

• Regulatory correspondence with the FDA or other governmental authorities

• Financial disclosure forms (Form FDA 3454 and 3455)

• Site-level study files, including investigator brochure receipt logs, delegation of authority logs, protocol deviation reports, and monitoring visit reports

• Correspondence with Penterra, Meridian CRO, and Veridian central office relating to the conduct of the study

Section 9.2 further provides that the retention obligation applies to records in all formats — paper, electronic, and mixed media — and that sites are responsible for maintaining records in a manner that preserves their integrity, legibility, and accessibility throughout the retention period. Electronic records must be maintained in formats that remain readable and retrievable with commercially available technology, and sites are required to migrate electronic records to current formats as necessary to prevent obsolescence.

B. Regulatory Retention Requirements

The 15-year contractual retention period established in Section 9.1 of the MCTA was specifically negotiated to exceed the regulatory minimums applicable to clinical trial records. The relevant regulatory requirements are as follows:

21 C.F.R. § 312.62(c). Under FDA regulations, an investigator is required to retain records relating to a clinical investigation for a period of two (2) years following the date on which a marketing application (NDA or BLA) is approved for the indication for which the investigational drug was tested, or, if no marketing application is filed or if the application is not approved, for a period of two (2) years after the investigation is discontinued and the FDA is notified. For the CLARION trial, this two-year clock would not begin running until the earliest of (a) FDA approval of the NDA for penterafenib, (b) Penterra's decision not to file an NDA, or (c) discontinuation of the investigation and notification to the FDA. Given Penterra's current NDA submission timeline (projected first quarter 2029), the regulatory retention period under Section 312.62(c) would likely extend to approximately 2031 at the earliest. The MCTA's 15-year post-study-completion period (through approximately August 2043) thus provides a buffer of at least 12 years beyond the minimum regulatory requirement.

ICH E6(R2) GCP Guidelines. The International Council for Harmonisation's Guideline for Good Clinical Practice (E6(R2)) provides that essential documents should be retained until at least two (2) years after the last approval of a marketing application in an ICH region, and until there are no pending or contemplated marketing applications in an ICH region, or until at least two (2) years after the formal discontinuation of clinical development of the investigational product. For a compound with global development potential like penterafenib, where regulatory submissions may be made to the European Medicines Agency, Japan's PMDA, and other ICH-region authorities at different times, the ICH retention period may extend several years beyond the FDA-specific minimum. The MCTA's 15-year period accounts for this possibility.

State-Specific Record Retention Laws. The CLARION trial will be conducted at 38 sites in 14 states, each of which may have its own requirements for retention of medical records and research records. These requirements vary significantly:

• Pennsylvania: Medical records must be retained for a minimum of 7 years from the date of the last entry (28 Pa. Code § 563.5), though research records may be subject to longer institutional requirements at academic medical centers.

• Illinois: Medical records must be retained for a minimum of 10 years after the patient's last treatment (735 ILCS 5/8-2001).

• New York: Hospital records must be retained for 6 years after discharge (10 NYCRR § 405.10(a)(6)).

• California: Medical records must be retained for a minimum of 7 years following discharge or 1 year following a minor patient reaching age 18 (Cal. Health & Safety Code § 123145).

• Texas: Hospital records must be retained for 10 years from the date of last treatment (25 Tex. Admin. Code § 133.41).

• Massachusetts: Medical records must be maintained for 30 years after the date of the last encounter in certain hospital settings (105 CMR 130.200).

The Massachusetts 30-year retention requirement is notable as it exceeds the MCTA's 15-year period for the three Massachusetts sites (Wentworth University Hospital, Cambridge Medical Institute, and Bay Colony Research Center). For these sites, the MCTA's "or longer if required by applicable law" proviso in Section 9.1 would extend the retention obligation to 30 years post-study completion (approximately August 2058) to the extent the Massachusetts requirement applies to the records at issue. We recommend that Rebecca Liang and Samantha Novak confirm the applicability of the Massachusetts rule to clinical trial records at each of the three Massachusetts sites.

HIPAA Requirements. Under the HIPAA Privacy Rule, a covered entity must retain documentation of its HIPAA-related policies, procedures, and compliance actions — including research authorizations — for a period of six (6) years from the date of creation or the date the document was last in effect, whichever is later (45 C.F.R. § 164.530(j)(2)). This requirement applies to the signed research authorizations obtained from CLARION trial subjects and to the sites' HIPAA-related policies governing the use and disclosure of protected health information in connection with the study. The MCTA's 15-year retention period comfortably exceeds this HIPAA minimum.

Taken together, the 15-year contractual retention period represents a reasonable and prudent approach that provides substantial protection for both Penterra's data access rights and the long-term regulatory defensibility of the CLARION trial data. The period is long enough to accommodate the extended timelines typical of Phase III oncology programs — including potential FDA review cycles, advisory committee meetings, complete response letters, post-marketing requirements, and potential pediatric study deferrals — while remaining within the range of customary retention periods for pharmaceutical industry clinical trial agreements.

C. Site Obligations Upon Retention Period Expiration

Section 9.3 of the MCTA addresses the procedures applicable at the expiration of the record retention period. Prior to destroying any Study-related records, each participating site is required to provide Penterra with not less than one hundred eighty (180) days' advance written notice of its intention to destroy such records. The notice must identify the categories and volume of records proposed for destruction, the proposed destruction method, and the expected date of destruction.

Upon receipt of such notice, Penterra has the right, exercisable within ninety (90) days of receipt, to request that the site transfer any or all of the records proposed for destruction to Penterra or to a third-party records custodian designated by Penterra. If Penterra elects to receive the records, the costs of transfer — including packing, shipping, and any necessary format conversion — are borne by Penterra. If Penterra does not respond within the 90-day period, or if Penterra affirmatively declines to receive the records, the site may proceed with destruction in accordance with applicable institutional policies and regulatory requirements.

This procedure provides Penterra with an important safety net, ensuring that critical trial records are not destroyed without Penterra's knowledge and, where Penterra determines that continued retention is warranted, providing a mechanism for Penterra to assume custody of the records. Given the projected retention period extending to approximately August 2043, the practical exercise of these provisions lies far in the future. Nevertheless, Penterra should establish internal processes now to ensure that the relevant personnel (or their successors) are aware of the forthcoming obligation and can respond appropriately when the time comes.

D. Practical Considerations for Multi-Site Retention

The 15-year retention obligation applies across 38 sites in 14 states — a logistically complex undertaking. Several practical considerations merit attention:

Institutional Mergers, Closures, and Network Departures. Over a 15-year period, it is foreseeable that some participating site institutions may merge with other health systems, close operations, or withdraw from the Veridian network. Section 9.4 of the MCTA addresses these scenarios by providing that if a site institution ceases operations, merges with another entity, or withdraws from the Veridian network, the departing institution's record retention obligations survive and are binding on any successor entity. If no successor entity exists (e.g., in the case of a closure without merger), Veridian is required to use commercially reasonable efforts to ensure that the records are transferred to another Veridian network site or to Penterra. This provision shifts the coordination burden to Veridian — a reasonable allocation given Veridian's role as the network operator and its ongoing relationship with member institutions.

Electronic vs. Paper Record Storage. The CLARION trial is designed primarily as an electronic trial, with eCRF data captured in the Pinnacle EDC platform and laboratory data transmitted electronically from Northbridge. However, significant volumes of paper records will exist at sites, including signed informed consent forms, printed imaging studies, pharmacy dispensing logs, and various regulatory documents. Over a 15-year period, the costs of secure paper storage can be substantial. While the MCTA does not mandate any particular storage format (other than the requirement to maintain integrity and accessibility), sites may wish to convert paper records to electronic format during the study to reduce long-term storage costs. Any such conversion must comply with 21 C.F.R. Part 11 and applicable state laws governing the admissibility of electronic copies of original records.

Veridian's Central Coordination Role. Veridian's central office in Philadelphia serves as the coordinating hub for record retention compliance across the network. Under Section 9.5 of the MCTA, Veridian is required to maintain a central registry of record retention status for each participating site, including the location and format of records, the identity of the responsible custodian at each site, and the expected retention period. Veridian is also required to conduct periodic compliance assessments of site record retention practices and to report any deficiencies to Penterra. Diane Prescott (COO) and Dr. Lena Marchetti (SVP, Research Administration) have been identified as the responsible Veridian personnel for overseeing these obligations.

Post-Study Storage Costs. During the active study period, site maintenance fees of $40,000 per site per year are included in the MCTA's budget and cover, among other things, the costs of maintaining study records. However, Section 9.6 of the MCTA provides that post-study record retention is a site responsibility, and the costs of long-term storage after study closeout are not covered by Penterra's study funding. This allocation was a point of negotiation, with Veridian initially requesting that Penterra fund post-study storage through the end of the retention period. The compromise reached is that Penterra covers storage costs during the active study period and for a 12-month "wind-down" period following study completion, after which the costs shift to the sites. Given that some sites may face storage costs extending 14 or more years beyond the wind-down period, this is a meaningful cost allocation that could affect site compliance over time. Penterra should remain vigilant and consider whether supplemental funding or centralized storage solutions may be necessary to ensure compliance in the later years of the retention period.

V. Confidentiality Framework Applicable to Data

A. MCTA Confidentiality Provisions (Exhibit F)

The MCTA incorporates a comprehensive confidentiality framework through Section 10 and the detailed provisions set forth in Exhibit F (Confidentiality and Data Protection Provisions). Under Exhibit F, all "Confidential Information" disclosed by either party to the other in connection with the CLARION trial is subject to confidentiality obligations for a period of ten (10) years from the date of disclosure.

The definition of Confidential Information in Exhibit F, Section F.1.1, is broad and encompasses:

• All Study Data generated under Protocol PPC-4871-III

• The protocol and all amendments thereto

• The Investigator's Brochure and all updates

• The chemical structure, formulation, and manufacturing processes for penterafenib (PPC-4871)

• Pharmacological and toxicological data

• Regulatory strategy documents and FDA correspondence

• Financial terms of the MCTA, including the $80,000,000 total deal value, per-patient fee structure of $52,000 per subject, investigator grant allocations of $1,500,000, and site maintenance fees of $40,000 per site per year

• Business plans, forecasts, and commercial strategies relating to penterafenib

• Any other information marked as confidential or that a reasonable person would understand to be confidential given the nature of the information and the circumstances of disclosure

Standard exclusions apply: information that (i) is or becomes publicly available through no fault of the receiving party; (ii) was known to the receiving party prior to disclosure; (iii) is independently developed by the receiving party without use of or reference to the disclosing party's Confidential Information; or (iv) is disclosed to the receiving party by a third party without restriction and without breach of any obligation of confidentiality.

The confidentiality obligations require each receiving party to (a) use Confidential Information solely for purposes of the CLARION trial and its obligations under the MCTA; (b) restrict access to Confidential Information to those employees, agents, and subcontractors who have a need to know and are bound by confidentiality obligations no less restrictive than those in Exhibit F; and (c) protect Confidential Information with at least the same degree of care used to protect its own most sensitive confidential information, but in no event less than reasonable care.

B. Permitted Disclosures

Exhibit F, Section F.3, enumerates certain permitted disclosures that do not constitute a breach of the confidentiality obligations. These include:

(a) IRB Submissions. Veridian and participating sites may disclose Protocol-related Confidential Information to institutional review boards ("IRBs") to the extent necessary for IRB review and approval of the study. The primary IRB for Pennsylvania sites is the Graystone University Institutional Review Board (IRB Registration No. IRB00012847; OHRP Federal Wide Assurance No. FWA00004206). For non-Pennsylvania sites, the study utilizes the Veridian Central IRB (IRB Registration No. IRB00015391), which serves as the IRB of record under the single-IRB mandate applicable to federally funded multi-site research under 45 C.F.R. § 46.114(b). While the CLARION trial is industry-funded, Veridian has adopted the single-IRB model for operational efficiency across its network. Confidential Information disclosed to IRBs is subject to those bodies' own confidentiality policies and is not further disclosable.

(b) Regulatory Authorities. Either party may disclose Confidential Information to the FDA or other applicable governmental or regulatory authorities to the extent required by law, regulation, or regulatory request. This includes, without limitation, disclosures in connection with IND submissions, IND safety reports, FDA inspections, and any other regulatory interactions relating to the CLARION trial or the development program for penterafenib.

(c) Legal Counsel. Either party may disclose Confidential Information to its legal counsel, including outside counsel, provided that such counsel is subject to obligations of confidentiality no less restrictive than those in Exhibit F. This provision permits Penterra to share MCTA-related Confidential Information with Calderwood & Harkness LLP and Castleton & Hargrove LLP, and permits Veridian to share such information with Whitmore, Jansen & Callahan LLP.

(d) Court Order or Legal Process. Either party may disclose Confidential Information to the extent required by court order, subpoena, or other compulsory legal process, provided that the disclosing party (i) promptly notifies the other party of the requirement (to the extent legally permitted), (ii) cooperates with the other party's efforts to obtain a protective order or other appropriate remedy, and (iii) discloses only that portion of the Confidential Information that is legally required to be disclosed.

C. Interplay with Data Ownership

The relationship between the ten-year confidentiality term in Exhibit F and Penterra's perpetual ownership of Study Data under Section 8.1 warrants careful consideration. These are conceptually distinct rights that operate on different temporal planes.

Penterra's ownership of Study Data is perpetual — it does not expire. Penterra may use, license, transfer, or otherwise dispose of Study Data at any time and for any purpose, subject to applicable law (including HIPAA). Penterra's ownership rights are not dependent on, and are not limited by, the confidentiality provisions in Exhibit F.

By contrast, the confidentiality obligations imposed on Veridian and participating sites under Exhibit F expire ten years from the date of disclosure. After the confidentiality term expires, Veridian and site personnel are no longer contractually obligated to treat Study Data or other Protocol-related information as confidential. As a practical matter, this means that after approximately 2033 (ten years from the 2023 execution date), investigators could theoretically disclose Study Data without breaching the MCTA's confidentiality provisions.

However, several factors mitigate this risk. First, the publication review framework in Exhibit G continues to apply independently of the confidentiality provisions in Exhibit F — and Exhibit G does not contain a fixed expiration date for publication review rights, providing Penterra with a separate contractual mechanism to review and control the timing of data disclosures through publications. Second, Penterra's ownership of the data means that any third party that receives Study Data from a site after the confidentiality period expires would be receiving data that it does not own and to which it has no independent right of use, creating potential conversion or misappropriation claims. Third, HIPAA restrictions on the disclosure of identifiable protected health information operate independently of the MCTA's confidentiality framework and do not sunset.

Nevertheless, we recommend that Penterra monitor the approaching confidentiality expiration date as it nears and consider whether to request extensions of the confidentiality period from Veridian and individual investigators, particularly with respect to commercially sensitive Study Data and data that may be relevant to ongoing or anticipated patent prosecution.

VI. Permissible Licensing and Data Sharing Frameworks for Post-Study Analyses

A. Data Sharing with Third Parties

As the exclusive owner of all Study Data generated under the CLARION trial, Penterra has the unfettered right — subject to applicable law — to license, share, transfer, or otherwise make available such data to third parties for any lawful purpose. The MCTA does not impose any requirement for Penterra to obtain Veridian's consent before licensing or sharing Study Data with third parties, except to the extent that such sharing involves the disclosure of Veridian's own Confidential Information (as distinguished from Study Data).

Penterra's anticipated third-party data sharing scenarios include the following:

(a) Regulatory Submissions. Penterra will use CLARION trial data as the primary evidentiary basis for the NDA submission for penterafenib, currently projected for the first quarter of 2029. In addition, Penterra may include CLARION trial data in regulatory submissions to international regulatory authorities, including the European Medicines Agency (EMA), Japan's Pharmaceuticals and Medical Devices Agency (PMDA), Health Canada, and the U.K. Medicines and Healthcare products Regulatory Agency (MHRA), as part of the global regulatory strategy for penterafenib. No consent of Veridian or participating sites is required for regulatory submissions by Penterra as IND holder and NDA applicant.

(b) Pharmaceutical Partnerships. Penterra may enter into licensing agreements, co-development agreements, or co-promotion agreements with other pharmaceutical companies for the further development or commercialization of penterafenib. Such agreements typically require the sharing of clinical trial data with the licensing or collaboration partner to enable the partner's independent evaluation of the compound's efficacy and safety profile. Penterra's exclusive data ownership under the MCTA ensures that Penterra can share CLARION trial data with potential partners without seeking Veridian's consent, provided that such sharing complies with HIPAA requirements (discussed in Section VII below) and that the partner is bound by appropriate confidentiality obligations.

(c) Academic Collaborations and Secondary Data Analyses. Penterra may elect to sponsor or support secondary analyses of CLARION trial data by academic researchers, either at Veridian network sites or at independent institutions. Such analyses may include meta-analyses combining CLARION data with data from other penterafenib studies, subgroup analyses exploring biomarker-defined patient populations, or health economics and outcomes research. Any such sharing would be subject to appropriate data use agreements and, where identifiable data is involved, HIPAA compliance requirements.

(d) Post-Marketing Safety Surveillance. If penterafenib receives FDA approval, Penterra will be subject to post-marketing pharmacovigilance obligations, which may include the use of CLARION trial data for post-marketing safety analyses, periodic safety update reports (PSURs), and responses to FDA post-marketing requirements or commitments. Penterra's data ownership ensures unencumbered access to the clinical trial data for these regulatory purposes.

In all of these scenarios, Penterra must ensure compliance with HIPAA de-identification requirements (45 C.F.R. § 164.514) to the extent that the data being shared contains protected health information, or must obtain appropriate research authorizations from subjects if sharing identifiable data. The HIPAA compliance considerations applicable to post-study data sharing are discussed in detail in Section VII below.

B. Data Sharing with Veridian Sites / Investigators for Publication

The framework for investigator access to Study Data for publication purposes was among the most heavily negotiated provisions of the MCTA. Academic medical centers and physician-investigators place a high value on the ability to publish the results of clinical trials in which they participate, both for the advancement of medical knowledge and for the professional development of individual investigators. Veridian, representing a network of 38 academic institutions, insisted on robust publication rights as a condition of entering into the MCTA. At the same time, Penterra had legitimate interests in controlling the timing and content of publications to protect its intellectual property, maintain regulatory integrity, and preserve its commercial position.

The compromise reached is reflected in Exhibit G of the MCTA, which establishes the following framework:

(a) Data Access for Publication. Investigators at participating sites, including Dr. Catherine Aldridge as Global Principal Investigator and Dr. Howard Matsuoka as Co-Principal Investigator, have the right to access aggregated Study Data and site-specific Study Data for the purpose of preparing manuscripts for publication in peer-reviewed scientific journals. Data access requests are submitted through Penterra's Clinical Operations team and are processed within thirty (30) days of receipt. Penterra may not unreasonably withhold access to Study Data for bona fide publication purposes.

(b) Penterra's 60-Day Review Period. Prior to submission of any manuscript, abstract, poster, or oral presentation incorporating Study Data to any journal, conference, or other publication venue, the investigator is required to submit a complete copy of the proposed publication to Penterra. Penterra then has a period of sixty (60) calendar days to review the proposed publication for (i) the inclusion of Penterra's Confidential Information, (ii) patentable subject matter, and (iii) factual accuracy. During this review period, Penterra may request that the investigator remove or modify specific content that constitutes Confidential Information or that could jeopardize the filing or prosecution of patent applications.

(c) 90-Day Patent Delay. If Penterra determines that the proposed publication contains patentable subject matter, Penterra may request an additional delay of up to ninety (90) calendar days beyond the initial 60-day review period to permit the filing of patent applications covering the relevant subject matter. The investigator is obligated to comply with this request and to delay submission of the publication until the earlier of (i) the expiration of the 90-day delay period, or (ii) written confirmation from Penterra that the relevant patent application has been filed. The total maximum delay under the review and patent-delay framework is thus one hundred fifty (150) calendar days from the date of submission of the manuscript to Penterra.

(d) Investigator Grants. The MCTA includes a total allocation of $1,500,000 for investigator grants supporting academic publication efforts related to the CLARION trial. These grants are administered through Veridian's research administration office and are available to investigators at participating sites for the preparation of manuscripts, statistical analyses for publication purposes, and rela

MEMORANDUM
PRIVILEGED & CONFIDENTIAL ATTORNEY-CLIENT PRIVILEGE / ATTORNEY WORK PRODUCT
TO: Miriam Calloway, Partner, Calderwood & Harkness LLP
FROM: Christopher Aiken, Associate, Calderwood & Harkness LLP
DATE: June 25, 2023
RE: Data Ownership, Licensing, and Post-Study Data Sharing Framework under the Master Clinical Trial Agreement between Penterra Pharmaceuticals Corp. and Veridian Health Research Network, Inc. — Protocol PPC-4871-III (CLARION)
MATTER NO.: 1018-00004
CLIENT: Penterra Pharmaceuticals Corp.
Right-click to update Table of Contents
I. Executive Summary
This memorandum analyzes the data ownership, site record retention, and permissible licensing and data sharing provisions negotiated and finalized in the execution version of the Master Clinical Trial Agreement (the "MCTA"), dated June 28, 2023, between Penterra Pharmaceuticals Corp. ("Penterra" or "PPC"), a Delaware corporation headquartered at 200 Biopharma Boulevard, Suite 1400, Princeton, New Jersey 08540, publicly traded on the Nasdaq Global Select Market (ticker: PTRA), and Veridian Health Research Network, Inc. ("Veridian" or "VHRN"), a Delaware 501(c)(3) nonprofit corporation headquartered at 750 Research Parkway, 8th Floor, Philadelphia, Pennsylvania 19104. The MCTA governs the conduct of the Phase III CLARION trial (Protocol PPC-4871-III, ClinicalTrials.gov Identifier NCT05928174, IND 157823) evaluating penterafenib (PPC-4871), an oral multi-kinase inhibitor, in patients with advanced hepatocellular carcinoma ("HCC").
This memorandum was prepared at the direction of client counsel and is intended to advise the deal team on the structural framework for data rights under the MCTA. The analysis focuses on the interplay among the contractual provisions, applicable federal and state regulatory requirements, HIPAA compliance obligations, and the intellectual property framework established in the related IP Side Letter. The memorandum identifies key risks associated with the data ownership and sharing framework and provides actionable recommendations for mitigating those risks during the study's projected 60-month duration and beyond.
The principal conclusions of this memorandum are as follows:
1. Exclusive Sponsor Ownership. Penterra retains exclusive ownership of all clinical trial data generated under the MCTA in connection with Protocol PPC-4871-III. This ownership is comprehensive, covering case report form data, laboratory data, safety data, biomarker and pharmacokinetic/pharmacodynamic data, imaging data, patient-reported outcomes, statistical analyses, and regulatory submissions. The ownership provision is enforceable under governing New York law and is consistent with established industry practice for sponsor-funded clinical trials.
2. Record Retention. Veridian and its participating sites are obligated to retain source documents and essential trial records for a minimum of 15 years following study completion, or longer if required by applicable law. Given the projected study completion date of August 2028, this retention obligation extends through at least August 2043. This contractual period provides a substantial buffer beyond the regulatory minimums established under 21 C.F.R. § 312.62(c) and ICH E6(R2).
3. Data Sharing Through Penterra. Any post-study licensing, sharing, or transfer of clinical trial data to third parties must flow through Penterra as the sole data owner. Veridian, its participating sites, and individual investigators do not have independent authority to license or share study data with third parties outside of the narrowly defined exceptions set forth in the MCTA.
4. Investigator Publication Rights. Limited data access rights are preserved for investigators for academic publication purposes, subject to Penterra's 60-day review period for confidential information and patentable subject matter, followed by an additional delay of up to 90 days to permit patent filings. This framework represents the negotiated compromise between Penterra's interest in protecting its commercial position and Veridian's insistence on preserving academic freedom.
5. HIPAA and Regulatory Constraints. Additional layers of restriction on permissible data sharing arise under the Health Insurance Portability and Accountability Act of 1996 ("HIPAA"), its implementing regulations, and the FDA's regulatory framework governing investigational new drug applications under 21 C.F.R. Part 312. Penterra should develop a de-identification protocol for any anticipated post-study commercial data sharing.
The total deal value of the MCTA is approximately $80,000,000, covering clinical trial conduct across 38 Veridian Network sites located in 14 states over the projected 60-month study duration, consisting of a 42-month enrollment period followed by an 18-month follow-up period. The per-patient fee structure is $52,000 per enrolled subject based on targeted enrollment of 1,200 subjects, with the balance allocated to site activation, investigator grants, maintenance fees, and study closeout costs. Target first patient in is August 14, 2023.
II. Background
A. The CLARION Trial and MCTA
The CLARION trial (Protocol PPC-4871-III) is a Phase III, randomized, double-blind, placebo-controlled, multicenter study evaluating penterafenib (PPC-4871) in patients with advanced hepatocellular carcinoma who have progressed on or are intolerant to first-line systemic therapy. Penterafenib is an oral multi-kinase inhibitor targeting VEGFR-1/2/3, PDGFR-α/β, FGFR-1/2/3, and c-Kit, with a novel mechanism of dual RAF/MEK pathway inhibition. The compound was identified and developed by Penterra's internal discovery platform, and Penterra holds all composition-of-matter, formulation, and method-of-use patents relating to the compound.
The trial is designed to enroll a total of 1,200 subjects randomized in a 2:1 ratio (800 subjects to the penterafenib treatment arm and 400 subjects to the matching placebo arm). The primary endpoint is overall survival ("OS"). Key secondary endpoints include progression-free survival ("PFS"), objective response rate ("ORR") per RECIST v1.1 criteria as assessed by blinded independent central review, duration of response ("DOR"), and time to deterioration in quality of life as measured by the EORTC QLQ-C30 and HCC-specific QLQ-HCC18 instruments.
Penterra filed the original Investigational New Drug Application for penterafenib with the U.S. Food and Drug Administration ("FDA") in October 2021, under IND 157823. The Phase II study (Protocol PPC-4871-II, BEACON) was completed in January 2023 and demonstrated a 38% objective response rate in 186 evaluable patients with second-line advanced HCC, a clinically meaningful and statistically significant result that supported advancement to Phase III. The CLARION trial represents the pivotal registration study for penterafenib and is central to Penterra's regulatory strategy for a New Drug Application ("NDA") submission, currently projected for the first quarter of 2029 assuming favorable trial results.
The MCTA governs the legal and operational relationship between Penterra, acting as the Sponsor of the CLARION trial, and Veridian, acting as the coordinating organization for a network of 38 academic medical centers and affiliated research institutions that will serve as clinical trial sites. Veridian is a well-established site network organization with a 22-year track record of managing large-scale, multicenter clinical trials in oncology, cardiology, and neuroscience. Veridian does not itself conduct clinical research; rather, it functions as an intermediary that coordinates site selection, regulatory submissions, contract negotiation, and administrative oversight on behalf of its member institutions.
The 38 participating sites are located across 14 states: Pennsylvania (8 sites), Illinois (5 sites), New York (4 sites), California (4 sites), Texas (3 sites), Massachusetts (3 sites), Ohio (2 sites), Michigan (2 sites), Florida (2 sites), North Carolina (1 site), Georgia (1 site), Maryland (1 site), Washington (1 site), and Colorado (1 site). The lead sites for the CLARION trial are:
• Site 001 — Graystone University Medical Center, 1200 University Avenue, Philadelphia, Pennsylvania 19104; Principal Investigator: Dr. Catherine Aldridge, M.D., Ph.D., Professor of Medicine, Division of Medical Oncology, Graystone University School of Medicine. Dr. Aldridge also serves as the Global Principal Investigator for the CLARION trial.
• Site 002 — Lakemont Medical Center, 4400 North Michigan Drive, Chicago, Illinois 60611; Co-Principal Investigator: Dr. Howard Matsuoka, M.D., Professor of Medicine, Department of Hematology/Oncology, Lakemont Medical Center. Dr. Matsuoka serves as the national Co-Principal Investigator.
The MCTA was the product of extensive negotiations between the parties over a period of approximately five months, from January through June 2023. Data ownership and publication rights were among the most heavily negotiated provisions, as discussed in detail in Sections III and VI below.
B. Parties and Advisors Relevant to Data Issues
The following individuals and entities play key roles in the data-related aspects of the CLARION trial and MCTA and are referenced throughout this memorandum:
Penterra Pharmaceuticals Corp.:
• Rebecca Liang, Esq., Associate General Counsel, Clinical Affairs — primary day-to-day legal contact for MCTA administration and data-related issues.
• Jennifer Holt, Vice President, Clinical Operations — responsible for overall clinical operations oversight of the CLARION trial, including data management strategy and CRO oversight.
• Samantha Novak, Director, Clinical Contracts — responsible for contract administration, site payments, and coordination with Veridian's contracts team.
Veridian Health Research Network, Inc.:
• Gregory Callahan, Esq., Vice President, Legal & Compliance — Veridian's primary internal legal contact for MCTA negotiations and ongoing compliance.
• Diane Prescott, Chief Operating Officer — responsible for network-wide operational coordination.
• Dr. Lena Marchetti, Senior Vice President, Research Administration — responsible for research compliance, site capability assessments, and investigator qualifications.
• Patricia Dunne, Director, Regulatory & Data Compliance — responsible for regulatory submissions coordination and data protection compliance across the Veridian network.
• Outside Counsel: Allison Whitmore, Partner, Whitmore, Jansen & Callahan LLP, 1500 Market Street, Suite 3200, Philadelphia, Pennsylvania 19102 — provided legal counsel to Veridian during MCTA negotiations.
Contract Research Organization:
• Meridian Contract Research Organization, Inc. ("Meridian CRO"), 9200 Corporate Boulevard, Raleigh, North Carolina 27615; Chief Executive Officer: Thomas Hartwell. Meridian CRO is engaged by Penterra under a separate Master Services Agreement ("Meridian MSA") dated January 15, 2023, and is responsible for data management, clinical monitoring, safety reporting, pharmacovigilance, and biostatistical analysis for the CLARION trial. Meridian CRO's data-related responsibilities and custodial role are governed exclusively by the Meridian MSA.
EDC Platform Vendor:
• Pinnacle Data Solutions, Inc. ("Pinnacle"), 6000 Clearwater Drive, San Diego, California 92121 — provides the electronic data capture ("EDC") platform (Pinnacle eClinical Suite v.8.2) for the CLARION trial, including electronic case report form design, data validation, and hosting. Pinnacle's services are provided under a separate Technology Services Agreement with Penterra dated March 8, 2023.
Central Laboratory:
• Northbridge Bioanalytical Laboratories, Inc. ("Northbridge"), 2900 Commerce Way, Baltimore, Maryland 21224 — provides centralized laboratory services for the CLARION trial, including pharmacokinetic/pharmacodynamic sample analysis, biomarker testing (including circulating tumor DNA and AFP levels), hematology, serum chemistry, and safety laboratory assessments. Northbridge's services are provided under a separate Central Laboratory Services Agreement with Penterra dated February 22, 2023.
Regulatory Counsel:
• Castleton & Hargrove LLP, with Dr. Priya Sundaram, Esq. serving as lead regulatory counsel to Penterra for FDA interactions, IND maintenance, and NDA strategy related to penterafenib.
C. Relevant MCTA Provisions
The data-related provisions in the execution version of the MCTA are dispersed across several sections and exhibits of the agreement. The principal provisions relevant to this memorandum include:
• Section 8 (Data Ownership and Access), which establishes Penterra's exclusive ownership of all Study Data and grants Penterra unrestricted access to source documents at participating sites;
• Section 9 (Record Retention), which establishes the 15-year post-study-completion retention obligation for site records and sets forth the procedures for record transfer and destruction;
• Section 10 (Confidentiality), which incorporates by reference the detailed confidentiality provisions set forth in Exhibit F (Confidentiality and Data Protection Provisions);
• Section 11 (Intellectual Property and Publication), which incorporates by reference the provisions of Exhibit G (Intellectual Property and Publication Rights) and the separately executed IP Side Letter dated June 28, 2023;
• Section 14 (Regulatory Compliance), which addresses FDA compliance obligations, including 21 C.F.R. Part 11 requirements for electronic records and the allocation of regulatory responsibilities between Sponsor and investigator;
• Section 17 (Subcontracting), which identifies approved subcontractors listed in Exhibit K and establishes the requirement that all subcontractors be bound by confidentiality and data protection obligations no less restrictive than those applicable to the parties under the MCTA;
• Section 23 (Governing Law and Dispute Resolution), which provides that the MCTA is governed by the laws of the State of New York without regard to conflicts of law principles and establishes binding arbitration in New York, New York under the Commercial Arbitration Rules of the American Arbitration Association ("AAA"), before a panel of three arbitrators.
The exhibits and ancillary documents referenced above are incorporated into the MCTA by reference and form an integral part of the contractual framework governing data rights. This memorandum analyzes these provisions in the aggregate to provide a comprehensive assessment of the data ownership, licensing, and sharing framework applicable to the CLARION trial.
III. Analysis of Penterra's Exclusive Data Ownership
A. Scope of Data Ownership
Section 8.1 of the MCTA provides that Penterra shall be the sole and exclusive owner of all "Study Data" (as defined in the MCTA) generated, collected, compiled, or derived in connection with the conduct of Protocol PPC-4871-III. The definition of Study Data in Section 1.42 of the MCTA is intentionally broad and is designed to capture the full universe of data generated during the clinical trial. Specifically, Study Data is defined to include, without limitation, the following categories of data:
(a) Case Report Form Data. All data entered by site personnel into electronic case report forms ("eCRFs") through the Pinnacle EDC platform (Pinnacle eClinical Suite v.8.2), including subject demographics, medical history, concomitant medications, treatment administration records, protocol-specified assessments, and endpoint evaluations. The eCRF data is the core structured dataset of the CLARION trial and forms the foundation for all statistical analyses and regulatory submissions.
(b) Laboratory Data. All laboratory results generated by Northbridge Bioanalytical Laboratories in connection with the CLARION trial, including hematology panels, serum chemistry panels, hepatic function tests, coagulation parameters, urinalysis, and specialized safety assessments. This category also encompasses all bioanalytical data generated by Northbridge, including penterafenib and metabolite plasma concentration data used for pharmacokinetic analyses.
(c) Safety Data. All adverse event reports, serious adverse event reports, suspected unexpected serious adverse reactions ("SUSARs"), IND safety reports filed with the FDA, and all related source documentation, case narratives, and causality assessments. Safety data is of particular importance given the oncology setting and the known hepatotoxicity signals observed in the Phase II BEACON trial.
(d) Biomarker and Pharmacokinetic/Pharmacodynamic Data. All data relating to pre-specified biomarker analyses, including circulating tumor DNA ("ctDNA") levels, alpha-fetoprotein ("AFP") kinetics, tumor mutational profiling data, and any other translational or correlative science data generated under the protocol's exploratory objectives. Pharmacokinetic data include penterafenib and metabolite concentration-time profiles, population PK model parameters, and exposure-response analyses.
(e) Imaging and Radiological Assessments. All radiological imaging data collected in connection with the CLARION trial, including CT scans, MRI studies, and bone scans, as well as all tumor measurement data and response assessments performed by the blinded independent central review committee and by local site radiologists. Imaging data is transmitted to and stored by the central imaging core laboratory operated by Meridian CRO.
(f) Quality of Life and Patient-Reported Outcome Data. All data collected through the EORTC QLQ-C30, QLQ-HCC18, and EQ-5D-5L instruments, including raw questionnaire responses, domain scores, and derived quality-of-life metrics.
(g) Statistical Analyses and Databases. All statistical analyses, analytical datasets (SDTM and ADaM formats), statistical analysis plans, analysis outputs, tables, listings, and figures compiled by Meridian CRO's biostatistics group, as well as the locked clinical trial database and any interim or final analysis datasets.
(h) Regulatory Submissions and Correspondence. All data included in or generated in connection with regulatory submissions to the FDA under IND 157823, including IND annual reports, protocol amendments, information amendments, and all FDA correspondence relating to the CLARION trial. This category also encompasses any data submitted to international regulatory authorities in connection with the global development program for penterafenib, to the extent such data originates from CLARION trial sites.
Critically, Section 8.2 of the MCTA draws a clear distinction between "Study Data" (owned exclusively by Penterra) and "Source Documents" (which remain the property of the respective site institutions). Source Documents are defined in Section 1.39 as original medical records, hospital charts, laboratory notes, pharmacy dispensing records, subject diaries, and other original documents or certified copies thereof that exist at the site institution and from which Study Data is derived or verified. While Source Documents remain the property of the generating site institution — as they must, since they form part of the subject's medical record and are subject to institutional and state law requirements — Penterra is granted comprehensive access and audit rights to Source Documents under Section 8.3 of the MCTA. These rights include the right to inspect, copy, and audit Source Documents at any reasonable time during the study and for the duration of the record retention period, and the right to authorize the FDA and other regulatory authorities to access Source Documents in connection with inspections and audits.
This distinction between Study Data and Source Documents is both commercially important and legally sound. It ensures that Penterra acquires ownership of all data in the structured, analyzable formats that are necessary for regulatory submissions, commercialization, and licensing purposes, while respecting the institutional ownership of original medical records that cannot practically or legally be transferred to a pharmaceutical sponsor.
B. Legal Basis for Sponsor Data Ownership
The exclusive sponsor ownership of clinical trial data established in Section 8.1 of the MCTA is enforceable under governing New York law. While there is limited New York case law directly addressing ownership of clinical trial data under a master clinical trial agreement, the contractual framework in the MCTA is well-supported by general principles of contract law and by the regulatory reality of the IND framework.
Contractual Framework. The data ownership provision in Section 8.1 functions as both a prospective assignment and a work-product ownership allocation. Under New York law, parties are free to allocate ownership of intangible assets — including data — by contract, provided that the allocation is supported by adequate consideration and is not unconscionable or contrary to public policy. See, e.g., Borg-Warner Corp. v. Universal Maritime Serv. Corp., 731 F. Supp. 1226, 1231 (S.D.N.Y. 1990) (enforcing contractual allocation of intellectual property rights); Speedfit LLC v. Woodway USA, Inc., 53 F. Supp. 3d 561, 577 (E.D.N.Y. 2014) (recognizing the validity of contractual data ownership provisions). Here, the consideration supporting Penterra's data ownership is the substantial study funding provided under the MCTA — $80,000,000 in total across the 38-site network — which compensates Veridian and its sites for the work of generating the data under the protocol. The allocation is neither unconscionable nor contrary to public policy; it reflects the standard industry practice in sponsor-funded clinical trials, where the sponsor bears the financial risk and regulatory responsibility and accordingly retains ownership of the resulting data.
The MCTA employs a hybrid approach to establishing Penterra's ownership. Section 8.1(a) provides that all Study Data "shall be and shall remain the sole and exclusive property of Penterra." Section 8.1(b) provides that to the extent any Study Data might be deemed a "work made for hire" under 17 U.S.C. § 101, it is so deemed, and to the extent it is not, Veridian and each participating site irrevocably assigns to Penterra all right, title, and interest in such Study Data. Section 8.1(c) includes a further assurances clause requiring Veridian and participating sites to execute such additional documents and take such further actions as may be reasonably necessary to effectuate Penterra's ownership. This belt-and-suspenders approach is a best practice that minimizes the risk of any challenge to Penterra's ownership claim.
Regulatory Reality. The data ownership allocation is further supported by the regulatory framework governing investigational new drug applications. As the IND holder for penterafenib (IND 157823), Penterra is the entity with exclusive authority and responsibility to submit clinical trial data to the FDA under 21 C.F.R. Part 312. The IND holder has the obligation to maintain and submit all clinical study reports, safety data, and efficacy data, and bears full regulatory responsibility for the integrity of the data. It would be anomalous and impractical for any entity other than the IND holder to own the clinical trial data that the IND holder is obligated by federal regulation to control and submit. The FDA's regulatory framework effectively presupposes sponsor ownership of clinical trial data, even though it does not mandate it as a matter of statutory or regulatory text.
Work-for-Hire Analogy. Although clinical trial data is not a copyrightable "work of authorship" in the traditional sense, the work-for-hire analogy is instructive. Under the Copyright Act, a work prepared by an employee within the scope of employment, or a specially ordered or commissioned work in certain enumerated categories, is a work made for hire and is owned by the employer or commissioning party. 17 U.S.C. § 101. The MCTA's invocation of the work-for-hire concept in Section 8.1(b) reflects the economic reality that Veridian and participating sites generate Study Data at Penterra's direction, pursuant to Penterra's protocol, using Penterra's investigational product, and funded by Penterra's financial support. While the sites are independent contractors rather than employees — and the data may not fall within the enumerated categories of specially commissioned works — the contractual assignment in Section 8.1(b) serves as a backstop to ensure that ownership vests in Penterra regardless of the technical applicability of the work-for-hire doctrine.
C. Limitations on Penterra's Ownership
While Penterra's data ownership is comprehensive, it is not absolute. The MCTA and the IP Side Letter carve out certain categories of intellectual property and data that are not owned by Penterra:
(a) Pre-Existing intellectual Property. Section 2.1 of the IP Side Letter provides that each party retains all right, title, and interest in its pre-existing intellectual property, defined as intellectual property owned by or licensed to a party prior to the effective date of the MCTA, or developed independently of the MCTA without the use of the other party's confidential information. For Veridian and its investigators, this includes pre-existing research methodologies, proprietary analytical tools, institutional databases, and previously published research results. Penterra's data ownership under the MCTA does not operate to transfer or encumber any such pre-existing intellectual property.
(b) Patient Medical Records. As noted in Section III.A above, Source Documents — including patient medical records that exist independently of the CLARION trial — remain the property of the generating site institution. Penterra's ownership extends only to Study Data derived from or relating to the clinical trial. To the extent a subject's participation in the CLARION trial generates entries in the subject's general medical record that are not specific to the trial (e.g., records of standard-of-care treatments provided during the study period), those records are not Study Data and are not owned by Penterra.
(c) Investigator-Generated Hypotheses and Independent Analyses. Section 3.4 of the IP Side Letter provides that hypotheses, theories, or analytical frameworks independently developed by investigators using their own expertise and not funded under the MCTA are not Study Data and are not owned by Penterra. However, this exception is subject to two important qualifications. First, any such independently developed work product that incorporates, references, or is derived from Study Data remains subject to the confidentiality and publication review obligations set forth in Exhibit G of the MCTA. Second, to the extent an investigator's independent analysis utilizes Study Data as an input, the Study Data itself remains Penterra's property even though the investigator's original analytical contribution may not be.
These limitations are reasonable and reflect the practical reality that Penterra cannot — and does not seek to — acquire ownership of every piece of information that every investigator at every site may develop during the course of a multi-year clinical trial. The limitations are, however, narrowly drawn, and the broad definition of Study Data in Section 1.42 should be understood as the default rule, with the exceptions identified above serving as limited carve-outs rather than broadly applicable limitations.
D. Data Custody and Control During the Study
The CLARION trial involves a multi-layered data flow architecture in which Study Data is generated at multiple sites and passes through multiple custodial intermediaries before reaching Penterra as the ultimate data owner. Understanding this data flow is essential to assessing data integrity, security, and ownership risks.
The general data flow is as follows:
1. Data Generation at Sites. Clinical investigators and study coordinators at each of the 38 Veridian Network sites generate data through direct patient interactions, including physical examinations, treatment administration, adverse event assessments, and collection of patient-reported outcome instruments. This data is recorded in Source Documents maintained at the site.
2. Data Entry into Pinnacle EDC. Site personnel enter Study Data from Source Documents into electronic case report forms using the Pinnacle eClinical Suite v.8.2 platform. Data entry is performed according to the CLARION Data Management Plan and is subject to programmatic validation checks (edit checks) built into the EDC system. The Pinnacle platform is hosted on validated, 21 C.F.R. Part 11-compliant servers maintained by Pinnacle Data Solutions, Inc. at its data center in San Diego, California. Penterra holds the master data license for all data housed on the Pinnacle platform, and Pinnacle's Technology Services Agreement expressly confirms that Pinnacle acquires no ownership interest in any data entered, stored, or processed through its platform.
3. Data Management and Cleaning by Meridian CRO. Meridian CRO's data management team reviews eCRF data for completeness, consistency, and accuracy. Discrepancies are resolved through data queries issued to site personnel via the Pinnacle EDC platform. Meridian CRO also integrates laboratory data received electronically from Northbridge Bioanalytical Laboratories and imaging data from the central imaging core laboratory. Meridian CRO is responsible for database lock following completion of data cleaning for each analysis timepoint.
4. Central Laboratory Data from Northbridge. Northbridge Bioanalytical Laboratories generates laboratory data from blood and urine samples shipped from participating sites. Raw laboratory results are transmitted electronically to Meridian CRO's data management system via validated, encrypted data transfer protocols. Northbridge retains raw analytical data and sample logs in accordance with its Central Laboratory Services Agreement with Penterra, but all laboratory data generated in connection with the CLARION trial is owned by Penterra.
5. Biostatistical Analysis by Meridian CRO. Following database lock, Meridian CRO's biostatistics group performs all pre-specified statistical analyses in accordance with the CLARION Statistical Analysis Plan. Analytical datasets (in SDTM and ADaM formats), statistical programs, outputs, tables, listings, and figures are prepared and delivered to Penterra.
6. Penterra's Ultimate Control. Penterra, as Sponsor and data owner, has unrestricted access to all Study Data at every stage of the data flow. Jennifer Holt (VP, Clinical Operations) and her team have direct login access to the Pinnacle EDC platform with full data export capabilities. Penterra receives periodic data extracts and has real-time dashboard access to enrollment, safety, and data quality metrics. All study databases, analytical datasets, and statistical outputs are transferred to and maintained by Penterra upon study completion.
Each of the approved subcontractors identified in Exhibit K of the MCTA — Meridian CRO, Pinnacle Data Solutions, and Northbridge Bioanalytical Laboratories — handles Study Data in a custodial capacity only. None of these entities acquires any ownership interest in Study Data by virtue of its custodial role. Each subcontractor's data handling is governed by its own separate agreement with Penterra, which includes robust confidentiality, data protection, and data security provisions. The key agreements are:
• Meridian CRO: Master Services Agreement dated January 15, 2023, including Data Protection Addendum
• Pinnacle Data Solutions: Technology Services Agreement dated March 8, 2023, including Data Hosting and Security Exhibit
• Northbridge Bioanalytical Laboratories: Central Laboratory Services Agreement dated February 22, 2023, including Data Transfer Specifications Appendix
A flowchart depicting the complete CLARION trial data flow architecture is attached as Appendix C to this memorandum.
IV. Site Record Retention Obligations
A. MCTA Retention Requirement
Section 9.1 of the MCTA imposes upon each participating Veridian Network site a mandatory obligation to retain all Source Documents and essential trial records generated in connection with Protocol PPC-4871-III for a minimum period of fifteen (15) years following the date of study completion, or such longer period as may be required by applicable federal, state, or institutional law, regulation, or policy. For purposes of Section 9.1, "study completion" is defined as the date on which Penterra provides written notification to Veridian that the CLARION trial has been completed, which includes final database lock, completion of all protocol-specified assessments, and resolution of all outstanding data queries.
Based on the current study timeline, with a projected enrollment period of 42 months commencing in August 2023 and an 18-month follow-up period, study completion is projected for approximately August 2028. Accordingly, the minimum contractual retention period is projected to extend through approximately August 2043 — a period of twenty years from the present date.
The categories of records subject to the retention obligation are comprehensive and include, without limitation:
• Signed informed consent forms (including re-consent forms and HIPAA research authorizations)
• Original Source Documents (medical records, laboratory reports, imaging studies, pharmacy dispensing logs)
• IRB/IEC correspondence, approvals, and continuing review documentation
• Regulatory correspondence with the FDA or other governmental authorities
• Financial disclosure forms (Form FDA 3454 and 3455)
• Site-level study files, including investigator brochure receipt logs, delegation of authority logs, protocol deviation reports, and monitoring visit reports
• Correspondence with Penterra, Meridian CRO, and Veridian central office relating to the conduct of the study
Section 9.2 further provides that the retention obligation applies to records in all formats — paper, electronic, and mixed media — and that sites are responsible for maintaining records in a manner that preserves their integrity, legibility, and accessibility throughout the retention period. Electronic records must be maintained in formats that remain readable and retrievable with commercially available technology, and sites are required to migrate electronic records to current formats as necessary to prevent obsolescence.
B. Regulatory Retention Requirements
The 15-year contractual retention period established in Section 9.1 of the MCTA was specifically negotiated to exceed the regulatory minimums applicable to clinical trial records. The relevant regulatory requirements are as follows:
21 C.F.R. § 312.62(c). Under FDA regulations, an investigator is required to retain records relating to a clinical investigation for a period of two (2) years following the date on which a marketing application (NDA or BLA) is approved for the indication for which the investigational drug was tested, or, if no marketing application is filed or if the application is not approved, for a period of two (2) years after the investigation is discontinued and the FDA is notified. For the CLARION trial, this two-year clock would not begin running until the earliest of (a) FDA approval of the NDA for penterafenib, (b) Penterra's decision not to file an NDA, or (c) discontinuation of the investigation and notification to the FDA. Given Penterra's current NDA submission timeline (projected first quarter 2029), the regulatory retention period under Section 312.62(c) would likely extend to approximately 2031 at the earliest. The MCTA's 15-year post-study-completion period (through approximately August 2043) thus provides a buffer of at least 12 years beyond the minimum regulatory requirement.
ICH E6(R2) GCP Guidelines. The International Council for Harmonisation's Guideline for Good Clinical Practice (E6(R2)) provides that essential documents should be retained until at least two (2) years after the last approval of a marketing application in an ICH region, and until there are no pending or contemplated marketing applications in an ICH region, or until at least two (2) years after the formal discontinuation of clinical development of the investigational product. For a compound with global development potential like penterafenib, where regulatory submissions may be made to the European Medicines Agency, Japan's PMDA, and other ICH-region authorities at different times, the ICH retention period may extend several years beyond the FDA-specific minimum. The MCTA's 15-year period accounts for this possibility.
State-Specific Record Retention Laws. The CLARION trial will be conducted at 38 sites in 14 states, each of which may have its own requirements for retention of medical records and research records. These requirements vary significantly:
• Pennsylvania: Medical records must be retained for a minimum of 7 years from the date of the last entry (28 Pa. Code § 563.5), though research records may be subject to longer institutional requirements at academic medical centers.
• Illinois: Medical records must be retained for a minimum of 10 years after the patient's last treatment (735 ILCS 5/8-2001).
• New York: Hospital records must be retained for 6 years after discharge (10 NYCRR § 405.10(a)(6)).
• California: Medical records must be retained for a minimum of 7 years following discharge or 1 year following a minor patient reaching age 18 (Cal. Health & Safety Code § 123145).
• Texas: Hospital records must be retained for 10 years from the date of last treatment (25 Tex. Admin. Code § 133.41).
• Massachusetts: Medical records must be maintained for 30 years after the date of the last encounter in certain hospital settings (105 CMR 130.200).
The Massachusetts 30-year retention requirement is notable as it exceeds the MCTA's 15-year period for the three Massachusetts sites (Wentworth University Hospital, Cambridge Medical Institute, and Bay Colony Research Center). For these sites, the MCTA's "or longer if required by applicable law" proviso in Section 9.1 would extend the retention obligation to 30 years post-study completion (approximately August 2058) to the extent the Massachusetts requirement applies to the records at issue. We recommend that Rebecca Liang and Samantha Novak confirm the applicability of the Massachusetts rule to clinical trial records at each of the three Massachusetts sites.
HIPAA Requirements. Under the HIPAA Privacy Rule, a covered entity must retain documentation of its HIPAA-related policies, procedures, and compliance actions — including research authorizations — for a period of six (6) years from the date of creation or the date the document was last in effect, whichever is later (45 C.F.R. § 164.530(j)(2)). This requirement applies to the signed research authorizations obtained from CLARION trial subjects and to the sites' HIPAA-related policies governing the use and disclosure of protected health information in connection with the study. The MCTA's 15-year retention period comfortably exceeds this HIPAA minimum.
Taken together, the 15-year contractual retention period represents a reasonable and prudent approach that provides substantial protection for both Penterra's data access rights and the long-term regulatory defensibility of the CLARION trial data. The period is long enough to accommodate the extended timelines typical of Phase III oncology programs — including potential FDA review cycles, advisory committee meetings, complete response letters, post-marketing requirements, and potential pediatric study deferrals — while remaining within the range of customary retention periods for pharmaceutical industry clinical trial agreements.
C. Site Obligations Upon Retention Period Expiration
Section 9.3 of the MCTA addresses the procedures applicable at the expiration of the record retention period. Prior to destroying any Study-related records, each participating site is required to provide Penterra with not less than one hundred eighty (180) days' advance written notice of its intention to destroy such records. The notice must identify the categories and volume of records proposed for destruction, the proposed destruction method, and the expected date of destruction.
Upon receipt of such notice, Penterra has the right, exercisable within ninety (90) days of receipt, to request that the site transfer any or all of the records proposed for destruction to Penterra or to a third-party records custodian designated by Penterra. If Penterra elects to receive the records, the costs of transfer — including packing, shipping, and any necessary format conversion — are borne by Penterra. If Penterra does not respond within the 90-day period, or if Penterra affirmatively declines to receive the records, the site may proceed with destruction in accordance with applicable institutional policies and regulatory requirements.
This procedure provides Penterra with an important safety net, ensuring that critical trial records are not destroyed without Penterra's knowledge and, where Penterra determines that continued retention is warranted, providing a mechanism for Penterra to assume custody of the records. Given the projected retention period extending to approximately August 2043, the practical exercise of these provisions lies far in the future. Nevertheless, Penterra should establish internal processes now to ensure that the relevant personnel (or their successors) are aware of the forthcoming obligation and can respond appropriately when the time comes.
D. Practical Considerations for Multi-Site Retention
The 15-year retention obligation applies across 38 sites in 14 states — a logistically complex undertaking. Several practical considerations merit attention:
Institutional Mergers, Closures, and Network Departures. Over a 15-year period, it is foreseeable that some participating site institutions may merge with other health systems, close operations, or withdraw from the Veridian network. Section 9.4 of the MCTA addresses these scenarios by providing that if a site institution ceases operations, merges with another entity, or withdraws from the Veridian network, the departing institution's record retention obligations survive and are binding on any successor entity. If no successor entity exists (e.g., in the case of a closure without merger), Veridian is required to use commercially reasonable efforts to ensure that the records are transferred to another Veridian network site or to Penterra. This provision shifts the coordination burden to Veridian — a reasonable allocation given Veridian's role as the network operator and its ongoing relationship with member institutions.
Electronic vs. Paper Record Storage. The CLARION trial is designed primarily as an electronic trial, with eCRF data captured in the Pinnacle EDC platform and laboratory data transmitted electronically from Northbridge. However, significant volumes of paper records will exist at sites, including signed informed consent forms, printed imaging studies, pharmacy dispensing logs, and various regulatory documents. Over a 15-year period, the costs of secure paper storage can be substantial. While the MCTA does not mandate any particular storage format (other than the requirement to maintain integrity and accessibility), sites may wish to convert paper records to electronic format during the study to reduce long-term storage costs. Any such conversion must comply with 21 C.F.R. Part 11 and applicable state laws governing the admissibility of electronic copies of original records.
Veridian's Central Coordination Role. Veridian's central office in Philadelphia serves as the coordinating hub for record retention compliance across the network. Under Section 9.5 of the MCTA, Veridian is required to maintain a central registry of record retention status for each participating site, including the location and format of records, the identity of the responsible custodian at each site, and the expected retention period. Veridian is also required to conduct periodic compliance assessments of site record retention practices and to report any deficiencies to Penterra. Diane Prescott (COO) and Dr. Lena Marchetti (SVP, Research Administration) have been identified as the responsible Veridian personnel for overseeing these obligations.
Post-Study Storage Costs. During the active study period, site maintenance fees of $40,000 per site per year are included in the MCTA's budget and cover, among other things, the costs of maintaining study records. However, Section 9.6 of the MCTA provides that post-study record retention is a site responsibility, and the costs of long-term storage after study closeout are not covered by Penterra's study funding. This allocation was a point of negotiation, with Veridian initially requesting that Penterra fund post-study storage through the end of the retention period. The compromise reached is that Penterra covers storage costs during the active study period and for a 12-month "wind-down" period following study completion, after which the costs shift to the sites. Given that some sites may face storage costs extending 14 or more years beyond the wind-down period, this is a meaningful cost allocation that could affect site compliance over time. Penterra should remain vigilant and consider whether supplemental funding or centralized storage solutions may be necessary to ensure compliance in the later years of the retention period.
V. Confidentiality Framework Applicable to Data
A. MCTA Confidentiality Provisions (Exhibit F)
The MCTA incorporates a comprehensive confidentiality framework through Section 10 and the detailed provisions set forth in Exhibit F (Confidentiality and Data Protection Provisions). Under Exhibit F, all "Confidential Information" disclosed by either party to the other in connection with the CLARION trial is subject to confidentiality obligations for a period of ten (10) years from the date of disclosure.
The definition of Confidential Information in Exhibit F, Section F.1.1, is broad and encompasses:
• All Study Data generated under Protocol PPC-4871-III
• The protocol and all amendments thereto
• The Investigator's Brochure and all updates
• The chemical structure, formulation, and manufacturing processes for penterafenib (PPC-4871)
• Pharmacological and toxicological data
• Regulatory strategy documents and FDA correspondence
• Financial terms of the MCTA, including the $80,000,000 total deal value, per-patient fee structure of $52,000 per subject, investigator grant allocations of $1,500,000, and site maintenance fees of $40,000 per site per year
• Business plans, forecasts, and commercial strategies relating to penterafenib
• Any other information marked as confidential or that a reasonable person would understand to be confidential given the nature of the information and the circumstances of disclosure
Standard exclusions apply: information that (i) is or becomes publicly available through no fault of the receiving party; (ii) was known to the receiving party prior to disclosure; (iii) is independently developed by the receiving party without use of or reference to the disclosing party's Confidential Information; or (iv) is disclosed to the receiving party by a third party without restriction and without breach of any obligation of confidentiality.
The confidentiality obligations require each receiving party to (a) use Confidential Information solely for purposes of the CLARION trial and its obligations under the MCTA; (b) restrict access to Confidential Information to those employees, agents, and subcontractors who have a need to know and are bound by confidentiality obligations no less restrictive than those in Exhibit F; and (c) protect Confidential Information with at least the same degree of care used to protect its own most sensitive confidential information, but in no event less than reasonable care.
B. Permitted Disclosures
Exhibit F, Section F.3, enumerates certain permitted disclosures that do not constitute a breach of the confidentiality obligations. These include:
(a) IRB Submissions. Veridian and participating sites may disclose Protocol-related Confidential Information to institutional review boards ("IRBs") to the extent necessary for IRB review and approval of the study. The primary IRB for Pennsylvania sites is the Graystone University Institutional Review Board (IRB Registration No. IRB00012847; OHRP Federal Wide Assurance No. FWA00004206). For non-Pennsylvania sites, the study utilizes the Veridian Central IRB (IRB Registration No. IRB00015391), which serves as the IRB of record under the single-IRB mandate applicable to federally funded multi-site research under 45 C.F.R. § 46.114(b). While the CLARION trial is industry-funded, Veridian has adopted the single-IRB model for operational efficiency across its network. Confidential Information disclosed to IRBs is subject to those bodies' own confidentiality policies and is not further disclosable.
(b) Regulatory Authorities. Either party may disclose Confidential Information to the FDA or other applicable governmental or regulatory authorities to the extent required by law, regulation, or regulatory request. This includes, without limitation, disclosures in connection with IND submissions, IND safety reports, FDA inspections, and any other regulatory interactions relating to the CLARION trial or the development program for penterafenib.
(c) Legal Counsel. Either party may disclose Confidential Information to its legal counsel, including outside counsel, provided that such counsel is subject to obligations of confidentiality no less restrictive than those in Exhibit F. This provision permits Penterra to share MCTA-related Confidential Information with Calderwood & Harkness LLP and Castleton & Hargrove LLP, and permits Veridian to share such information with Whitmore, Jansen & Callahan LLP.
(d) Court Order or Legal Process. Either party may disclose Confidential Information to the extent required by court order, subpoena, or other compulsory legal process, provided that the disclosing party (i) promptly notifies the other party of the requirement (to the extent legally permitted), (ii) cooperates with the other party's efforts to obtain a protective order or other appropriate remedy, and (iii) discloses only that portion of the Confidential Information that is legally required to be disclosed.
C. Interplay with Data Ownership
The relationship between the ten-year confidentiality term in Exhibit F and Penterra's perpetual ownership of Study Data under Section 8.1 warrants careful consideration. These are conceptually distinct rights that operate on different temporal planes.
Penterra's ownership of Study Data is perpetual — it does not expire. Penterra may use, license, transfer, or otherwise dispose of Study Data at any time and for any purpose, subject to applicable law (including HIPAA). Penterra's ownership rights are not dependent on, and are not limited by, the confidentiality provisions in Exhibit F.
By contrast, the confidentiality obligations imposed on Veridian and participating sites under Exhibit F expire ten years from the date of disclosure. After the confidentiality term expires, Veridian and site personnel are no longer contractually obligated to treat Study Data or other Protocol-related information as confidential. As a practical matter, this means that after approximately 2033 (ten years from the 2023 execution date), investigators could theoretically disclose Study Data without breaching the MCTA's confidentiality provisions.
However, several factors mitigate this risk. First, the publication review framework in Exhibit G continues to apply independently of the confidentiality provisions in Exhibit F — and Exhibit G does not contain a fixed expiration date for publication review rights, providing Penterra with a separate contractual mechanism to review and control the timing of data disclosures through publications. Second, Penterra's ownership of the data means that any third party that receives Study Data from a site after the confidentiality period expires would be receiving data that it does not own and to which it has no independent right of use, creating potential conversion or misappropriation claims. Third, HIPAA restrictions on the disclosure of identifiable protected health information operate independently of the MCTA's confidentiality framework and do not sunset.
Nevertheless, we recommend that Penterra monitor the approaching confidentiality expiration date as it nears and consider whether to request extensions of the confidentiality period from Veridian and individual investigators, particularly with respect to commercially sensitive Study Data and data that may be relevant to ongoing or anticipated patent prosecution.
VI. Permissible Licensing and Data Sharing Frameworks for Post-Study Analyses
A. Data Sharing with Third Parties
As the exclusive owner of all Study Data generated under the CLARION trial, Penterra has the unfettered right — subject to applicable law — to license, share, transfer, or otherwise make available such data to third parties for any lawful purpose. The MCTA does not impose any requirement for Penterra to obtain Veridian's consent before licensing or sharing Study Data with third parties, except to the extent that such sharing involves the disclosure of Veridian's own Confidential Information (as distinguished from Study Data).
Penterra's anticipated third-party data sharing scenarios include the following:
(a) Regulatory Submissions. Penterra will use CLARION trial data as the primary evidentiary basis for the NDA submission for penterafenib, currently projected for the first quarter of 2029. In addition, Penterra may include CLARION trial data in regulatory submissions to international regulatory authorities, including the European Medicines Agency (EMA), Japan's Pharmaceuticals and Medical Devices Agency (PMDA), Health Canada, and the U.K. Medicines and Healthcare products Regulatory Agency (MHRA), as part of the global regulatory strategy for penterafenib. No consent of Veridian or participating sites is required for regulatory submissions by Penterra as IND holder and NDA applicant.
(b) Pharmaceutical Partnerships. Penterra may enter into licensing agreements, co-development agreements, or co-promotion agreements with other pharmaceutical companies for the further development or commercialization of penterafenib. Such agreements typically require the sharing of clinical trial data with the licensing or collaboration partner to enable the partner's independent evaluation of the compound's efficacy and safety profile. Penterra's exclusive data ownership under the MCTA ensures that Penterra can share CLARION trial data with potential partners without seeking Veridian's consent, provided that such sharing complies with HIPAA requirements (discussed in Section VII below) and that the partner is bound by appropriate confidentiality obligations.
(c) Academic Collaborations and Secondary Data Analyses. Penterra may elect to sponsor or support secondary analyses of CLARION trial data by academic researchers, either at Veridian network sites or at independent institutions. Such analyses may include meta-analyses combining CLARION data with data from other penterafenib studies, subgroup analyses exploring biomarker-defined patient populations, or health economics and outcomes research. Any such sharing would be subject to appropriate data use agreements and, where identifiable data is involved, HIPAA compliance requirements.
(d) Post-Marketing Safety Surveillance. If penterafenib receives FDA approval, Penterra will be subject to post-marketing pharmacovigilance obligations, which may include the use of CLARION trial data for post-marketing safety analyses, periodic safety update reports (PSURs), and responses to FDA post-marketing requirements or commitments. Penterra's data ownership ensures unencumbered access to the clinical trial data for these regulatory purposes.
In all of these scenarios, Penterra must ensure compliance with HIPAA de-identification requirements (45 C.F.R. § 164.514) to the extent that the data being shared contains protected health information, or must obtain appropriate research authorizations from subjects if sharing identifiable data. The HIPAA compliance considerations applicable to post-study data sharing are discussed in detail in Section VII below.
B. Data Sharing with Veridian Sites / Investigators for Publication
The framework for investigator access to Study Data for publication purposes was among the most heavily negotiated provisions of the MCTA. Academic medical centers and physician-investigators place a high value on the ability to publish the results of clinical trials in which they participate, both for the advancement of medical knowledge and for the professional development of individual investigators. Veridian, representing a network of 38 academic institutions, insisted on robust publication rights as a condition of entering into the MCTA. At the same time, Penterra had legitimate interests in controlling the timing and content of publications to protect its intellectual property, maintain regulatory integrity, and preserve its commercial position.
The compromise reached is reflected in Exhibit G of the MCTA, which establishes the following framework:
(a) Data Access for Publication. Investigators at participating sites, including Dr. Catherine Aldridge as Global Principal Investigator and Dr. Howard Matsuoka as Co-Principal Investigator, have the right to access aggregated Study Data and site-specific Study Data for the purpose of preparing manuscripts for publication in peer-reviewed scientific journals. Data access requests are submitted through Penterra's Clinical Operations team and are processed within thirty (30) days of receipt. Penterra may not unreasonably withhold access to Study Data for bona fide publication purposes.
(b) Penterra's 60-Day Review Period. Prior to submission of any manuscript, abstract, poster, or oral presentation incorporating Study Data to any journal, conference, or other publication venue, the investigator is required to submit a complete copy of the proposed publication to Penterra. Penterra then has a period of sixty (60) calendar days to review the proposed publication for (i) the inclusion of Penterra's Confidential Information, (ii) patentable subject matter, and (iii) factual accuracy. During this review period, Penterra may request that the investigator remove or modify specific content that constitutes Confidential Information or that could jeopardize the filing or prosecution of patent applications.
(c) 90-Day Patent Delay. If Penterra determines that the proposed publication contains patentable subject matter, Penterra may request an additional delay of up to ninety (90) calendar days beyond the initial 60-day review period to permit the filing of patent applications covering the relevant subject matter. The investigator is obligated to comply with this request and to delay submission of the publication until the earlier of (i) the expiration of the 90-day delay period, or (ii) written confirmation from Penterra that the relevant patent application has been filed. The total maximum delay under the review and patent-delay framework is thus one hundred fifty (150) calendar days from the date of submission of the manuscript to Penterra.
(d) Investigator Grants. The MCTA includes a total allocation of $1,500,000 for investigator grants supporting academic publication efforts related to the CLARION trial. These grants are administered through Veridian's research administration office and are available to investigators at participating sites for the preparation of manuscripts, statistical analyses for publication purposes, and rela

MEMORANDUM

PRIVILEGED & CONFIDENTIAL ATTORNEY-CLIENT PRIVILEGE / ATTORNEY WORK PRODUCT

MATTER NO.: 1018-00004

Record

Parties

Dates

Amounts