EXHIBIT F
CONFIDENTIALITY AND DATA PROTECTION PROVISIONS
This Exhibit F (these "Confidentiality and Data Protection Provisions") is attached to and incorporated by reference into the Master Clinical Trial Agreement dated June 28, 2023 (the "Agreement" or "MCTA"), by and between:
Penterra Pharmaceuticals Corp., a corporation organized and existing under the laws of the State of Delaware, with its principal offices at 200 Biopharma Boulevard, Suite 1400, Princeton, New Jersey 08540 (hereinafter referred to as "Sponsor" or "Penterra");
and
Veridian Health Research Network, Inc., a corporation organized and existing under the laws of the State of Delaware as a 501(c)(3) tax-exempt organization, with its principal offices at 750 Research Parkway, 8th Floor, Philadelphia, Pennsylvania 19104 (hereinafter referred to as "Site Network" or "Veridian"), including each Participating Site Institution that has executed an Individual Site Agreement (Joinder) under Exhibit C of the Agreement.
Protocol Reference: Protocol PPC-4871-III, titled "CLARION — Clinical Assessment of Response with Longitudinal Investigation in ONcology"
ClinicalTrials.gov Identifier: NCT05928174
IND Number: IND 157823
The parties hereby agree that the following confidentiality and data protection provisions shall govern the treatment, handling, use, and disclosure of Confidential Information exchanged in connection with the CLARION trial and the Agreement.
Right-click to update Table of Contents
ARTICLE 1 — DEFINITIONS
Section 1.1 — "Confidential Information"
"Confidential Information" means all non-public information disclosed by or on behalf of a Disclosing Party to a Receiving Party in connection with the CLARION trial and/or the Agreement, whether disclosed orally, in writing, electronically, or in any other form or medium, and regardless of whether such information is marked or designated as "confidential," "proprietary," or with any similar legend. Without limiting the generality of the foregoing, Confidential Information includes the following categories of information:
(a) Protocol Information. The Protocol (PPC-4871-III), including the study design, primary endpoint (overall survival), key secondary endpoints (progression-free survival, objective response rate, and duration of response), planned enrollment targets (1,200 subjects, randomized 2:1 — 800 subjects in the treatment arm and 400 subjects in the placebo arm), stratification factors, statistical analysis plans, interim analysis schedules, data safety monitoring board charters, and all amendments, supplements, and modifications thereto.
(b) Investigational Product Information. All information relating to penterafenib (PPC-4871), an oral multi-kinase inhibitor, including without limitation its chemical composition, formulation, manufacturing processes, specifications, stability data, pharmacological data, mechanism of action, pharmacokinetic and pharmacodynamic profiles, Phase II clinical results (including the 38% objective response rate in advanced hepatocellular carcinoma observed in the Phase II study completed in January 2023), preclinical data (including toxicology, carcinogenicity, and reproductive toxicology studies), and all IND-related submissions filed with the United States Food and Drug Administration (the "FDA") under IND 157823, including amendments, annual reports, safety reports, and correspondence with the FDA.
(c) Clinical Trial Data. All data collected, generated, compiled, or derived from the CLARION trial, including case report forms (whether paper or electronic), electronic data capture ("EDC") data entered into and maintained on the EDC platform operated by Pinnacle Data Solutions, Inc., source documents (including medical records, laboratory reports, imaging studies, and pharmacy records), bioanalytical and laboratory data generated by Northbridge Bioanalytical Laboratories, Inc. (in its capacity as central laboratory for the CLARION trial), safety data, serious adverse event reports, suspected unexpected serious adverse reaction ("SUSAR") reports, individual case safety reports, aggregate safety analyses, interim and final statistical analyses, clinical study reports, and any compilations, summaries, or derivative works based on any of the foregoing.
(d) Financial and Commercial Terms. The financial and commercial terms of the Agreement, including the total deal value (Eighty Million Dollars ($80,000,000)), per-patient site fees (Fifty-Two Thousand Dollars ($52,000) per enrolled subject), start-up fees (Seventy-Five Thousand Dollars ($75,000) per Participating Site), site maintenance fees (Forty Thousand Dollars ($40,000) per Participating Site per year), the network coordination fee payable to Veridian (Four Million Two Hundred Thousand Dollars ($4,200,000)), investigator grants (One Million Five Hundred Thousand Dollars ($1,500,000) in the aggregate), technology and EDC integration costs (One Million Two Hundred Thirty Thousand Dollars ($1,230,000)), the contingency reserve (Two Million Five Hundred Thousand Dollars ($2,500,000)), and all payment schedules, milestone structures, invoicing procedures, and reconciliation mechanisms set forth in the Agreement and its exhibits.
(e) Business Information. Business information of either party, including strategic plans, corporate development plans, pipeline information, financial data and projections, market analyses, competitive intelligence, intellectual property (including patent applications, trade secrets, and know-how), proprietary methodologies and standard operating procedures, patient recruitment and retention strategies, site selection criteria, regulatory strategies, and any information relating to actual or potential mergers, acquisitions, partnerships, collaborations, or financing transactions.
(f) Subcontractor Information. Information regarding approved subcontractors and third-party service providers, including Meridian Contract Research Organization, Inc. ("Meridian CRO"), Pinnacle Data Solutions, Inc. ("Pinnacle" or "EDC Vendor"), and Northbridge Bioanalytical Laboratories, Inc. ("Northbridge" or "Central Lab"), including the terms and conditions of any agreements, work orders, or statements of work between any party and such subcontractors, and any proprietary methodologies, systems, or technology platforms employed by such subcontractors in connection with the CLARION trial.
(g) Insurance Information. Insurance policy details, including coverage under the clinical trial liability insurance policy issued by Briarcliff Mutual Insurance Company, Policy Number BM-CTL-2023-04182, coverage limits, deductibles, policy terms and conditions, premium amounts, endorsements, claims history, and claims information, as well as any certificates of insurance or evidence of coverage provided under the Agreement.
(h) Protected Health Information and Personal Data. Personal data and Protected Health Information ("PHI") of trial subjects enrolled in the CLARION trial, as more specifically defined in Section 1.3 below.
For the avoidance of doubt, Confidential Information includes information disclosed prior to the date of the Agreement to the extent such information was disclosed in connection with the negotiation of the Agreement or the planning of the CLARION trial, and information disclosed after the date of the Agreement in connection with the performance of the Agreement or the conduct of Protocol PPC-4871-III.
Section 1.2 — "Disclosing Party" and "Receiving Party"
"Disclosing Party" means the party (or its affiliates, subsidiaries, investigators, study personnel, employees, officers, directors, agents, or representatives) disclosing, furnishing, or making available Confidential Information to the other party or its representatives.
"Receiving Party" means the party (or its affiliates, subsidiaries, investigators, study personnel, employees, officers, directors, agents, or representatives) receiving or obtaining access to Confidential Information from the Disclosing Party or its representatives.
Each of Penterra and Veridian (including the Participating Sites) may serve as both a Disclosing Party and a Receiving Party under the Agreement. The applicability of a party's obligations as a Receiving Party shall be determined with respect to each item or category of Confidential Information by reference to the party that disclosed such information.
Section 1.3 — "Protected Health Information" or "PHI"
"Protected Health Information" or "PHI" has the meaning ascribed to the term "protected health information" in 45 C.F.R. § 160.103, as amended from time to time. For purposes of this Exhibit F, PHI includes individually identifiable health information that is created, received, maintained, or transmitted by a Participating Site Institution, an investigator, or any study personnel in connection with the CLARION trial, and that relates to: (i) the past, present, or future physical or mental health or condition of a trial subject; (ii) the provision of health care to a trial subject; or (iii) the past, present, or future payment for the provision of health care to a trial subject — and that identifies the individual trial subject, or with respect to which there is a reasonable basis to believe that the information can be used to identify the individual. PHI includes information in any form or medium, whether electronic, paper, or oral.
Section 1.4 — "De-Identified Data"
"De-Identified Data" means data that has been de-identified in accordance with the standards set forth in 45 C.F.R. § 164.514(a) through (c), using either: (a) the expert determination method described in 45 C.F.R. § 164.514(b)(1), pursuant to which a person with appropriate knowledge of and experience with generally accepted statistical and scientific principles and methods for rendering information not individually identifiable has determined that the risk is very small that the information could be used, alone or in combination with other reasonably available information, by an anticipated recipient to identify an individual who is a subject of the information; or (b) the safe harbor method described in 45 C.F.R. § 164.514(b)(2), pursuant to which the eighteen (18) specified categories of identifiers have been removed and the covered entity does not have actual knowledge that the remaining information could be used alone or in combination with other information to identify an individual. Data that has been de-identified in accordance with this Section 1.4 does not constitute PHI.
Section 1.5 — "Study Data"
"Study Data" means all data collected, generated, compiled, derived, or otherwise produced in connection with the conduct of Protocol PPC-4871-III at any Participating Site, including but not limited to: clinical observations; physical examination findings; vital signs; laboratory results (including hematology, chemistry, urinalysis, and specialized biomarker panels); imaging data (including CT scans, MRI studies, and radiographic assessments performed pursuant to RECIST v1.1 criteria); patient-reported outcomes; quality-of-life assessments; pharmacokinetic and pharmacodynamic data; biomarker analyses (including circulating tumor DNA and immunohistochemistry results); safety data (including adverse events, serious adverse events, and adverse events of special interest); concomitant medication records; protocol deviation reports; and any analyses, compilations, summaries, reports, or derivative works based on any of the foregoing.
Ownership of Study Data is governed by Exhibit G (Intellectual Property and Publication Rights) and the applicable provisions of the Agreement. As set forth therein, Sponsor retains exclusive ownership of all Study Data generated in connection with Protocol PPC-4871-III.
Section 1.6 — "Applicable Data Protection Laws"
"Applicable Data Protection Laws" means all laws, statutes, regulations, rules, ordinances, and regulatory guidance applicable to the collection, use, storage, processing, transfer, disclosure, or protection of Confidential Information, PHI, or personal data in connection with the CLARION trial, including without limitation:
(a) The Health Insurance Portability and Accountability Act of 1996, as amended by the Health Information Technology for Economic and Clinical Health Act of 2009 ("HITECH Act"), and the implementing regulations codified at 45 C.F.R. Parts 160 and 164, including the Standards for Privacy of Individually Identifiable Health Information (the "Privacy Rule"), the Security Standards for the Protection of Electronic Protected Health Information (the "Security Rule"), and the Breach Notification for Unsecured Protected Health Information (the "Breach Notification Rule") (collectively, "HIPAA");
(b) Any applicable state data privacy laws, data protection statutes, and data breach notification laws in effect in the fourteen (14) states in which Veridian Network Participating Sites are located, including without limitation the California Consumer Privacy Act (Cal. Civ. Code § 1798.100 et seq.), as amended by the California Privacy Rights Act, and the data breach notification statutes of each applicable state;
(c) The regulations of the FDA governing electronic records and electronic signatures, codified at 21 C.F.R. Part 11, as amended from time to time;
(d) The International Council for Harmonisation of Technical Requirements for Pharmaceuticals for Human Use Guideline for Good Clinical Practice, ICH E6(R2), with respect to subject data protection, privacy, and confidentiality obligations; and
(e) Any successor, supplemental, or replacement regulations, guidance documents, or standards promulgated under or in connection with any of the foregoing.
Section 1.7 — Other Defined Terms
Capitalized terms used in this Exhibit F that are not otherwise defined herein shall have the meanings ascribed to such terms in the Agreement or in the applicable exhibits and attachments thereto.
ARTICLE 2 — OBLIGATIONS OF CONFIDENTIALITY
Section 2.1 — General Confidentiality Obligation
Each Receiving Party covenants and agrees that it shall:
(a) Hold all Confidential Information of the Disclosing Party in strict confidence;
(b) Not disclose, publish, disseminate, or otherwise make available any Confidential Information to any third party, except as expressly permitted under Article 3 of this Exhibit F;
(c) Use Confidential Information solely for the purpose of performing its obligations or exercising its rights under the Agreement in connection with Protocol PPC-4871-III, and not for any other purpose whatsoever, including without limitation for the development of any competing product or therapy, for competitive intelligence, or for any commercial purpose unrelated to the CLARION trial; and
(d) Protect Confidential Information using at least the same degree of care that it uses to protect its own confidential and proprietary information of a similar nature and sensitivity, but in no event less than a reasonable degree of care under the circumstances.
The foregoing obligations apply to all forms and categories of Confidential Information, regardless of the medium in which such information is embodied or the manner in which it was disclosed.
Section 2.2 — Confidentiality Term
The confidentiality obligations set forth in this Exhibit F shall remain in full force and effect for a period of ten (10) years from the date of disclosure of each item of Confidential Information by the Disclosing Party to the Receiving Party.
Notwithstanding the foregoing, to the extent that any item of Confidential Information constitutes a trade secret under the applicable law of any jurisdiction (including the Defend Trade Secrets Act of 2016, 18 U.S.C. § 1836 et seq., and the applicable state Uniform Trade Secrets Act), such information shall remain subject to the confidentiality obligations set forth in this Exhibit F for so long as such information continues to constitute a trade secret under applicable law, even if the resulting period of protection exceeds ten (10) years.
The confidentiality obligations set forth in this Exhibit F shall survive the expiration or termination of the Agreement for any reason, and shall continue for the full duration of the applicable ten-year period (or, in the case of trade secrets, such longer period) measured from the date on which the relevant Confidential Information was disclosed.
Section 2.3 — Personnel and Agent Obligations
The Receiving Party shall strictly limit access to Confidential Information to those of its employees, officers, directors, agents, consultants, independent contractors, investigators, sub-investigators, study coordinators, research nurses, pharmacists, and other site staff who: (i) have a legitimate need to know such Confidential Information for purposes of performing under or administering the Agreement and Protocol PPC-4871-III; and (ii) have been informed of the confidential nature of such information and the obligations arising under this Exhibit F.
Prior to being granted access to any Confidential Information, all such personnel and agents must be bound by written confidentiality and non-use obligations that are no less restrictive than those set forth in this Exhibit F. Such obligations may be satisfied through individual confidentiality agreements, provisions in employment agreements, or institutional policies and procedures, provided that the terms thereof are at least as protective as this Exhibit F.
The Receiving Party shall be fully responsible and liable for any breach of the confidentiality obligations of this Exhibit F by any of its personnel, agents, or representatives, and any such breach shall be deemed a breach by the Receiving Party.
Section 2.4 — Subcontractor Obligations
The Receiving Party shall ensure that any permitted subcontractor, vendor, or third-party service provider to whom Confidential Information is disclosed or made available in connection with the CLARION trial — including, without limitation, Meridian Contract Research Organization, Inc. (CRO), Pinnacle Data Solutions, Inc. (EDC Vendor), and Northbridge Bioanalytical Laboratories, Inc. (Central Lab), as listed in Exhibit K to the Agreement — is bound by written confidentiality and data protection obligations that are substantively consistent with, and no less restrictive than, the obligations set forth in this Exhibit F prior to any such disclosure.
The Receiving Party shall remain fully liable to the Disclosing Party for any breach of confidentiality or data protection obligations by any of its subcontractors, vendors, or third-party service providers, as if such breach had been committed by the Receiving Party itself. The Receiving Party shall promptly notify the Disclosing Party of any known or suspected breach by a subcontractor, vendor, or third-party service provider and shall cooperate in the investigation and remediation of any such breach.
ARTICLE 3 — PERMITTED DISCLOSURES
Notwithstanding the confidentiality obligations set forth in Article 2, a Receiving Party may disclose Confidential Information under the following circumstances, subject to the limitations and conditions specified below:
Section 3.1 — Institutional Review Boards (IRBs)
The Receiving Party may disclose Confidential Information to the extent reasonably necessary for submission to, and review and approval by, the applicable Institutional Review Board ("IRB") or independent ethics committee, including the Graystone University Institutional Review Board (IRB Registration: IRB00012847), the Veridian Central IRB, and any local IRB exercising jurisdiction over a Participating Site under a reliance agreement or other cooperative review arrangement.
Such disclosure shall be limited to the minimum Confidential Information required for the IRB to fulfill its responsibilities under 21 C.F.R. Part 56, 45 C.F.R. Part 46, and applicable institutional policies, including review of the protocol, informed consent forms, investigator qualifications, safety data, and recruitment materials. Members and staff of the applicable IRB must be subject to obligations of confidentiality under their institutional policies, bylaws, or standard operating procedures.
Section 3.2 — Regulatory Authorities
Either party may disclose Confidential Information to the extent required by applicable law or regulation, or as requested or required by the FDA — including in connection with IND 157823, IND safety reports filed pursuant to 21 C.F.R. § 312.32, annual reports filed pursuant to 21 C.F.R. § 312.33, and any other submissions, correspondence, inspections, or inquiries related to the CLARION trial — or by any other governmental or regulatory authority having jurisdiction over the parties, the Participating Sites, or the conduct of Protocol PPC-4871-III.
Where practicable and not prohibited by applicable law or regulation, the disclosing party shall provide the non-disclosing party with reasonable prior written notice of such required or requested disclosure, and shall reasonably cooperate with the non-disclosing party to limit the scope of such disclosure to the extent permitted by law.
Section 3.3 — Legal Counsel
Either party may disclose Confidential Information to its internal and external legal counsel on a need-to-know basis for the purpose of obtaining legal advice in connection with the Agreement or the CLARION trial. For Penterra, such counsel includes its outside counsel, Calderwood & Harkness LLP, and its FDA regulatory counsel, Castleton & Hargrove LLP. For Veridian, such counsel includes its outside counsel, Whitmore, Jansen & Callahan LLP. All such counsel must be under professional obligations of confidentiality (including obligations arising under applicable rules of professional conduct) or must be bound by written confidentiality agreements containing terms no less restrictive than those set forth in this Exhibit F.
Section 3.4 — External Auditors and Financial Advisors
Penterra may disclose financial terms, deal economics, and related Confidential Information to its external auditor, Townsend Independent Auditors LLP, and its financial advisor, Ridgeline Capital Markets LLC, to the extent necessary for the purpose of audit, financial reporting, tax compliance, capital allocation planning, or investor relations activities, provided that such parties are bound by written confidentiality obligations containing terms no less restrictive than those set forth in this Exhibit F.
Veridian may similarly disclose financial terms and related Confidential Information to its external auditors and financial advisors, subject to the same conditions.
Section 3.5 — Insurance Carriers
Either party may disclose Confidential Information to its insurance carriers, brokers, and underwriters — including Briarcliff Mutual Insurance Company (with respect to Policy No. BM-CTL-2023-04182) — to the extent reasonably necessary for the purpose of obtaining or maintaining insurance coverage, processing claims, fulfilling insurance reporting obligations, or responding to inquiries from insurance carriers in connection with the CLARION trial. All such insurance carriers, brokers, and underwriters must be under contractual or regulatory obligations of confidentiality applicable to the information disclosed.
Section 3.6 — Judicial or Administrative Proceedings
Either party may disclose Confidential Information to the extent compelled by a valid court order, subpoena, civil investigative demand, or administrative process issued by a court or governmental authority of competent jurisdiction. Any such disclosure shall be subject to the following conditions:
(a) The Receiving Party shall provide the Disclosing Party with prompt written notice of the compelled disclosure, to the extent such notice is permitted by law, and in any event within five (5) business days of receipt of the order, subpoena, or demand (or such shorter period as may be required for compliance), so as to afford the Disclosing Party a reasonable opportunity to seek a protective order, motion to quash, or other appropriate remedy;
(b) The Receiving Party shall cooperate with the Disclosing Party's reasonable efforts to obtain such protective order or other remedy, at the Disclosing Party's expense;
(c) The Receiving Party shall disclose only that portion of the Confidential Information that is legally required to be disclosed, and shall use commercially reasonable efforts to ensure that any Confidential Information so disclosed is afforded confidential treatment by the court or tribunal; and
(d) Any Confidential Information disclosed pursuant to this Section 3.6 shall continue to be treated as Confidential Information for all other purposes under this Exhibit F.
Section 3.7 — Securities Law Obligations
Penterra may disclose Confidential Information to the extent required by applicable securities laws and regulations, including filings with the United States Securities and Exchange Commission ("SEC") — such as Annual Reports on Form 10-K, Quarterly Reports on Form 10-Q, Current Reports on Form 8-K, proxy statements, and registration statements — and disclosures required by the listing rules and requirements of the Nasdaq Stock Market (ticker symbol: PTRA).
Penterra shall use commercially reasonable efforts to minimize the scope of any such disclosure, and where practicable and consistent with applicable law, shall seek confidential treatment for financially sensitive terms and other proprietary information pursuant to SEC rules and regulations, including Rule 24b-2 under the Securities Exchange Act of 1934 and the applicable provisions of Regulation S-K.
Penterra shall use reasonable efforts to provide Veridian with advance notice of any public disclosure that would include Confidential Information of Veridian, to the extent such notice is practicable and not prohibited by applicable law or regulation.
Section 3.8 — Publication Disclosures
Investigators and study personnel may publish or present Study Data and results of the CLARION trial in peer-reviewed journals, academic presentations, posters, and other scientific fora, subject to the terms and conditions set forth in Exhibit G (Intellectual Property and Publication Rights) of the Agreement. As provided in Exhibit G, all proposed publications and presentations are subject to: (i) a sixty (60) day Sponsor review period, during which Penterra may review the proposed publication for accuracy, inclusion of Confidential Information, and patentable subject matter; and (ii) an additional ninety (90) day delay, at Penterra's request, to permit the preparation and filing of patent applications directed to any patentable inventions disclosed in the proposed publication.
Publications and presentations that are made in compliance with the procedures set forth in Exhibit G shall not constitute a breach of the confidentiality obligations of this Exhibit F. Notwithstanding the foregoing, investigators and study personnel shall not include in any publication or presentation any Confidential Information of the Disclosing Party other than Study Data and results, unless specifically authorized in writing by the Disclosing Party.
ARTICLE 4 — EXCLUSIONS FROM CONFIDENTIAL INFORMATION
Section 4.1 — Standard Exclusions
The confidentiality and non-use obligations set forth in this Exhibit F shall not apply to any information that the Receiving Party can demonstrate by competent written evidence (including contemporaneous records, documents, or other tangible proof):
(a) Public Domain — At Time of Disclosure. Was in the public domain at the time of disclosure by the Disclosing Party, through no act, fault, or omission of the Receiving Party;
(b) Public Domain — Subsequent Entry. Subsequently entered the public domain after the time of disclosure, through no act, fault, breach, or omission of the Receiving Party or any person or entity to whom the Receiving Party disclosed such information;
(c) Prior Possession. Was rightfully in the Receiving Party's possession, without any restriction on disclosure or use, prior to receipt from the Disclosing Party, as demonstrated by the Receiving Party's written records existing prior to the date of disclosure;
(d) Independent Development. Was independently developed by the Receiving Party without use of, reference to, reliance on, or derivation from the Disclosing Party's Confidential Information, as demonstrated by the Receiving Party's written records, laboratory notebooks, or other contemporaneous documentation;
(e) Third-Party Disclosure. Was rightfully obtained by the Receiving Party from a third party who was lawfully in possession of such information and who was not, at the time of disclosure to the Receiving Party, under any obligation of confidentiality, non-disclosure, or non-use to the Disclosing Party with respect to such information; or
(f) Required Disclosure. Is required to be disclosed by applicable law, regulation, or valid order of a court or governmental authority of competent jurisdiction, subject to the Receiving Party's compliance with the notification and protective-order requirements set forth in Section 3.6 of this Exhibit F.
The burden of establishing any of the foregoing exclusions shall rest with the Receiving Party claiming the exclusion.
Section 4.2 — Combination of Information
Any combination of features, elements, or components of Confidential Information shall not be deemed to fall within the exclusions set forth in Section 4.1 merely because individual features, elements, or components of such combination are in the public domain or are in the Receiving Party's possession. Such combination shall be excluded from the obligations of this Exhibit F only if the specific combination itself, as an integrated whole, is in the public domain or was independently developed by or rightfully obtained by the Receiving Party.
ARTICLE 5 — DATA PROTECTION AND HIPAA COMPLIANCE
Section 5.1 — HIPAA Framework
The parties acknowledge and agree that the conduct of Protocol PPC-4871-III at the Participating Sites may involve the creation, receipt, maintenance, use, transmission, and disclosure of PHI, as defined under HIPAA (45 C.F.R. Parts 160 and 164), with respect to the trial subjects enrolled in the CLARION trial. Each party recognizes its respective obligations under HIPAA and agrees to comply with all applicable provisions thereof in the performance of its obligations under the Agreement and this Exhibit F.
Each Participating Site Institution and its investigators, sub-investigators, study coordinators, and other study personnel shall comply in all material respects with the HIPAA Privacy Rule (45 C.F.R. Part 164, Subparts A and E) and the HIPAA Security Rule (45 C.F.R. Part 164, Subparts A and C) with respect to all PHI of trial subjects that is created, received, maintained, or transmitted in connection with the CLARION trial. Each Participating Site shall be responsible for ensuring that its workforce members who have access to PHI in connection with the trial have received appropriate training on HIPAA requirements and the institution's privacy and security policies.
Section 5.2 — Research Authorization
Each Participating Site shall obtain a valid HIPAA research authorization from each trial subject (or the subject's legally authorized representative) prior to any use or disclosure of the subject's PHI for purposes of the CLARION trial, unless a valid waiver of authorization has been obtained from the applicable IRB or Privacy Board in accordance with 45 C.F.R. § 164.512(i)(1)(i) and the criteria set forth in 45 C.F.R. § 164.512(i)(2).
The form of research authorization shall be consistent with the requirements of 45 C.F.R. § 164.508, including the core elements and required statements specified therein, and shall be included in or appended to the informed consent form approved by the applicable IRB for the CLARION trial. The research authorization shall clearly describe:
(a) The specific PHI to be used or disclosed;
(b) The persons or class of persons authorized to make the requested use or disclosure;
(c) The persons or class of persons to whom the PHI may be disclosed (including Penterra, Meridian CRO, Pinnacle Data Solutions, the FDA, and other applicable recipients);
(d) The purpose of the use or disclosure;
(e) An expiration date or event;
(f) The subject's right to revoke the authorization in writing; and
(g) The potential for re-disclosure of the information by the recipient and the fact that such information may no longer be protected by HIPAA.
Section 5.3 — Minimum Necessary Standard
All uses and disclosures of PHI in connection with the CLARION trial shall be limited to the minimum amount of PHI necessary to accomplish the intended purpose of the use or disclosure, consistent with the minimum necessary standard set forth in 45 C.F.R. § 164.502(b) and the requirements of 45 C.F.R. § 164.514(d).
Sponsor and Meridian CRO shall receive only the minimum PHI necessary for protocol administration, subject enrollment verification, safety monitoring and reporting, data management and quality assurance, and regulatory compliance. Where De-Identified Data (as defined in Section 1.4) or a limited data set (as defined in 45 C.F.R. § 164.514(e)) is sufficient to accomplish the intended purpose, PHI shall not be disclosed.
Each Participating Site shall implement policies and procedures to identify the categories of persons within its workforce who need access to trial-related PHI to carry out their duties, the categories or types of PHI to which each such person needs access, and the conditions or limitations applicable to such access.
Section 5.4 — De-Identification and Limited Data Sets
To the extent practicable, Study Data shared between the parties and their respective subcontractors in connection with the CLARION trial shall be de-identified in accordance with 45 C.F.R. § 164.514(a) through (c) prior to transmission. The parties shall work cooperatively to identify opportunities for the use of De-Identified Data in lieu of PHI for data analyses, publications, presentations, regulatory submissions, and other purposes where individual subject identification is not required.
Where a limited data set (as defined in 45 C.F.R. § 164.514(e)) is used for purposes of research, public health, or health care operations in connection with the CLARION trial, the disclosing party and the recipient shall enter into a data use agreement meeting the requirements of 45 C.F.R. § 164.514(e)(4). Such data use agreement shall: (i) establish the permitted uses and disclosures of the limited data set; (ii) identify who is permitted to use or receive the data; and (iii) provide that the recipient will not use or further disclose the information other than as permitted by the data use agreement or as otherwise required by law.
Section 5.5 — Business Associate Obligations
To the extent that any party to the Agreement, or any subcontractor or agent thereof, acts as a Business Associate (as defined in 45 C.F.R. § 160.103) of a Participating Site or any other Covered Entity (as defined in 45 C.F.R. § 160.103) with respect to PHI created, received, maintained, or transmitted in connection with the CLARION trial, the applicable parties shall execute a Business Associate Agreement ("BAA") that complies with the requirements of 45 C.F.R. § 164.504(e) and the HITECH Act.
The BAA shall be substantially in the form attached hereto as Attachment F-1 or shall be separately negotiated and executed by the applicable Participating Site and Penterra (and/or Meridian CRO, as applicable) prior to site activation and first patient enrollment at each Participating Site.
The BAA shall address, at a minimum, the following subjects:
(a) The permissible uses and disclosures of PHI by the Business Associate;
(b) The requirement that the Business Associate implement administrative, physical, and technical safeguards to protect the confidentiality, integrity, and availability of PHI in accordance with the HIPAA Security Rule;
(c) The obligation to report to the Covered Entity any use or disclosure of PHI not provided for by the BAA, including breaches of unsecured PHI;
(d) The requirement that the Business Associate ensure that any subcontractors that create, receive, maintain, or transmit PHI on behalf of the Business Associate agree to the same restrictions, conditions, and safeguards;
(e) The obligation to make PHI available to the Covered Entity and to trial subjects in accordance with the HIPAA Privacy Rule, including rights of access and amendment;
(f) Termination provisions, including the right of the Covered Entity to terminate the BAA upon a material breach; and
(g) The obligation to return or destroy PHI upon termination of the BAA, to the extent feasible.
Section 5.6 — Breach Notification
In the event of a breach of unsecured PHI (as defined in 45 C.F.R. § 164.402), the party experiencing or discovering the breach shall notify the other party without unreasonable delay and in no event later than ten (10) calendar days following the date on which the breach is discovered or reasonably should have been discovered.
The breaching party shall cooperate fully with the non-breaching party in investigating the breach, mitigating the harmful effects thereof, and complying with all applicable breach notification requirements under 45 C.F.R. Part 164, Subpart D (including notification to affected individuals, the Secretary of the United States Department of Health and Human Services, and, where required, prominent media outlets), and any applicable state breach notification laws.
The notification required under this Section 5.6 shall include, to the extent known at the time of notification:
(a) The nature of the PHI involved in the breach, including the types of identifiers and other information involved;
(b) The identity of each unauthorized person who used the PHI or to whom the disclosure was made, if known;
(c) Whether the PHI was actually acquired or viewed by the unauthorized person, or whether the opportunity for such acquisition or viewing existed;
(d) The extent to which the risk of harm has been mitigated, including the steps taken or proposed to be taken to mitigate such risk; and
(e) A description of what the breaching party is doing or proposes to do to investigate the breach, prevent future breaches, and protect against any further unauthorized use or disclosure.
The breaching party shall supplement the initial notification with additional information as it becomes available, and shall provide periodic updates to the non-breaching party regarding the status of the investigation and remediation.
ARTICLE 6 — DATA SECURITY OBLIGATIONS
Section 6.1 — Administrative Safeguards
Each party shall implement and maintain administrative safeguards consistent with the requirements of 45 C.F.R. § 164.308, as applicable to the party's role and responsibilities in connection with the CLARION trial. Such administrative safeguards shall include, at a minimum:
(a) Security Management Process. Designation of a qualified security official who shall be responsible for the development, implementation, and oversight of security policies and procedures governing the protection of Confidential Information and PHI;
(b) Workforce Training. Implementation of a comprehensive workforce training program to ensure that all employees, investigators, study coordinators, and other personnel who have access to Confidential Information or PHI are trained on the party's confidentiality and data security policies and obligations, including training on the recognition and reporting of security incidents and breaches. Training shall be provided upon initial hiring or engagement and at regular intervals thereafter (no less frequently than annually);
(c) Access Management. Implementation of access controls, including policies and procedures for granting, modifying, and revoking access to Confidential Information and PHI, to ensure that access is limited to authorized personnel who have a legitimate need to know;
(d) Risk Assessment. Conduct of periodic risk assessments (no less frequently than annually) to identify and address threats and vulnerabilities to the confidentiality, integrity, and availability of Confidential Information and PHI, and implementation of appropriate measures to reduce identified risks to a reasonable and appropriate level; and
(e) Contingency Planning. Development and maintenance of contingency plans, including data backup procedures, disaster recovery plans, and emergency mode operation plans, to protect against the loss, destruction, or unavailability of Confidential Information and PHI.
Section 6.2 — Physical Safeguards
Each party shall implement and maintain physical safeguards consistent with the requirements of 45 C.F.R. § 164.310, as applicable. Such physical safeguards shall include, at a minimum:
(a) Facility Access Controls. Implementation of facility access controls to limit physical access to electronic information systems, servers, workstations, and storage areas (including file cabinets, locked offices, and secure rooms) that contain or process Confidential Information or PHI. Access controls shall include measures such as key card access systems, visitor logs, security personnel, and locked enclosures, as appropriate;
(b) Workstation Security. Implementation of workstation security measures, including policies governing the use and positioning of workstations that access Confidential Information or PHI, the use of screen locks and automatic logoff functions, and restrictions on the use of personal devices for accessing trial-related data; and
(c) Device and Media Controls. Implementation of policies and procedures governing the receipt, removal, transfer, and disposal of hardware and electronic media (including hard drives, USB drives, laptops, and mobile devices) that contain Confidential Information or PHI, including procedures for the secure disposal or sanitization of media prior to re-use or disposal, using methods that render the information irretrievable.
Section 6.3 — Technical Safeguards
Each party shall implement and maintain technical safeguards consistent with the requirements of 45 C.F.R. § 164.312, as applicable. Such technical safeguards shall include, at a minimum:
(a) Access Controls. Implementation of unique user identification for each individual authorized to access electronic systems containing Confidential Information or PHI, together with role-based access controls, multi-factor authentication (where technically feasible), and automatic session termination after a defined period of inactivity;
(b) Encryption. Encryption of PHI and Confidential Information both in transit and at rest, using industry-standard encryption protocols. At a minimum, data at rest shall be encrypted using AES-256 (Advanced Encryption Standard with a 256-bit key length) or an equivalent or stronger algorithm. Data in transit shall be encrypted using Transport Layer Security (TLS) version 1.2 or higher, or an equivalent or stronger protocol;
(c) Audit Controls. Implementation of hardware, software, and procedural mechanisms to record and examine access to electronic information systems that contain or process PHI and Confidential Information, including the capture of user identity, date and time of access, actions performed, and records accessed or modified;
(d) Integrity Controls. Implementation of electronic mechanisms to corroborate that PHI, Study Data, and other Confidential Information stored in electronic form have not been improperly altered, deleted, or destroyed, whether through electronic checksums, digital signatures, version control systems, or other appropriate methods; and
(e) Transmission Security. Implementation of security measures to protect PHI and Confidential Information during electronic transmission, including encryption (as specified in subsection (b) above), integrity controls, and endpoint authentication, to guard against unauthorized access to information during transmission over electronic communications networks.
Section 6.4 — 21 C.F.R. Part 11 Compliance
All electronic records and electronic signatures created, maintained, modified, archived, retrieved, or transmitted in connection with the CLARION trial shall comply with the requirements of 21 C.F.R. Part 11 (Electronic Records; Electronic Signatures), as interpreted and enforced by the FDA. Without limiting the foregoing, the following requirements shall apply:
(a) System Validation. All electronic systems used to create, modify, maintain, archive, retrieve, or transmit electronic records in connection with the CLARION trial — including the EDC platform operated by Pinnacle Data Solutions, Inc. — shall be validated to ensure accuracy, reliability, consistent intended performance, and the ability to discern invalid or altered records;
(b) Record Copies. Electronic systems shall be capable of generating accurate and complete copies of records in both human-readable and electronic form, suitable for inspection, review, and copying by the FDA;
(c) Record Protection and Retrieval. Electronic records shall be protected to enable their accurate and ready retrieval throughout the record-retention period specified in Section 7.1 of this Exhibit F and as required by applicable FDA regulations;
(d) Access Limitation. System access shall be limited to authorized individuals. Access authority levels shall be established and maintained to restrict system access to those functions and data elements appropriate to each individual's role in the CLARION trial;
(e) Audit Trails. The electronic systems shall use secure, computer-generated, time-stamped audit trails to independently record the date and time of operator entries and actions that create, modify, or delete electronic records. Record changes shall not obscure previously recorded information. Such audit trail documentation shall be retained for a period at least as long as that required for the subject electronic records and shall be available for agency review and copying;
(f) Authority Checks and Operational System Checks. The electronic systems shall employ authority checks to ensure that only authorized individuals can use the system, electronically sign a record, access the operation or computer system input or output device, alter a record, or perform the operation at hand. Operational system checks shall be used to enforce permitted sequencing of steps and events, as appropriate; and
(g) Electronic Signatures. Electronic signatures used in connection with the CLARION trial shall meet the requirements of 21 C.F.R. Part 11, Subpart C, including requirements for signature manifestations, signature/record linking, controls for identification codes and passwords, and the use of non-biometric or biometric electronic signatures, as applicable.
Section 6.5 — Incident Response
Each party shall maintain and implement a written information security incident response plan that is appropriate to the nature and scope of the party's involvement in the CLARION trial and the types of Confidential Information and PHI that the party creates, receives, maintains, or transmits.
In the event of a suspected or confirmed security incident involving Confidential Information or PHI related to the CLARION trial, the affected party shall promptly:
(a) Investigate the incident to determine its scope, cause, and impact;
(b) Take reasonable and appropriate steps to contain the incident and prevent further unauthorized access, use, or disclosure of Confidential Information or PHI;
(c) Remediate identified vulnerabilities and implement measures to prevent the recurrence of similar incidents;
(d) Notify the other party of the incident within the timeframe specified in Section 5.6 (for breaches of unsecured PHI) or within fifteen (15) calendar days of discovery (for security incidents involving Confidential Information other than PHI); and
(e) Cooperate fully with the other party in any investigation and remediation of the incident, including by providing access to relevant records, personnel, and systems to the extent reasonably necessary to assess the scope and impact of the incident.
Each party shall maintain records of all security incidents, including the facts surrounding the incident, the steps taken to investigate and remediate the incident, and the outcome of the investigation, and shall make such records available to the other party upon reasonable request.
ARTICLE 7 — DOCUMENT RETENTION AND RETURN/DESTRUCTION OF CONFIDENTIAL INFORMATION
Section 7.1 — Document Retention Period
Each Participating Site shall retain source documents, study records, informed consent forms, IRB correspondence, and all other documentation related to the CLARION trial for a minimum period of fifteen (15) years following study completion (currently projected for August 2028), or for such longer period as may be required by: (a) applicable federal or state law or regulation, including 21 C.F.R. § 312.62; (b) the applicable IRB or institutional policies; (c) the Protocol; or (d) written instruction from Penterra — whichever period is longer.
Sponsor shall retain study documentation, including the clinical study report, statistical analyses, regulatory submissions, and all records relating to IND 157823 and Protocol PPC-4871-III, in accordance with the requirements of 21 C.F.R. § 312.62, ICH E6(R2) Section 8, and Penterra's standard document retention policies.
No Participating Site shall destroy or dispose of any study documentation without providing at least ninety (90) days' prior written notice to Penterra and affording Penterra a reasonable opportunity to retrieve or copy such documentation.
Section 7.2 — Return or Destruction Upon Termination or Expiration
Upon the expiration or termination of the Agreement for any reason, or upon the written request of the Disclosing Party (subject to the retention obligations of Section 7.1), the Receiving Party shall, at the Disclosing Party's election:
(a) Promptly return to the Disclosing Party all tangible and electronic copies of Confidential Information in the Receiving Party's possession or control, including all copies, reproductions, extracts, summaries, compilations, notes, and derivative works that contain or reflect Confidential Information; or
(b) Destroy all such Confidential Information using secure methods appropriate to the medium (including shredding for paper documents and secure deletion, degaussing, or physical destruction for electronic media), and certify such destruction in writing.
The Receiving Party shall provide written certification to the Disclosing Party within thirty (30) days of the date of return or destruction, signed by an authorized officer or representative of the Receiving Party, confirming that all Confidential Information has been returned or destroyed in accordance with this Section 7.2.
Notwithstanding the foregoing, the Receiving Party may retain one (1) archival copy of Confidential Information, in secure storage with restricted access, solely for the following purposes:
(a) Compliance with legal, regulatory, or institutional obligations, including compliance with 21 C.F.R. Part 312 and ICH E6(R2);
(b) Compliance with the Receiving Party's reasonable document retention policies, to the extent required by law or institutional governance;
(c) As required under applicable law or regulation; or
(d) To fulfill the retention obligations specified in Section 7.1 of this Exhibit F.
Any retained copies shall remain subject to the confidentiality and data protection obligations of this Exhibit F for the full duration of the ten-year confidentiality term (or, in the case of trade secrets, for such longer period as the information remains a trade secret).
Section 7.3 — Backup and Archival Systems
The parties acknowledge that Confidential Information may reside in automated backup, archival, or disaster recovery systems maintained in the ordinary course of business. Such information shall not be required to be returned or affirmatively destroyed from backup or archival systems that are not reasonably accessible in the ordinary course of business, provided that: