Exhibit
10.41





 





	Horn & Co. Final, May 3, 2018	 



 





Master
Agreement for

Clinical Trials Management Services


 


This
Master Agreement for Clinical Trials Management Services (the “Agreement”) is made and entered into on May 3,2018 and effective
as of November 20,2017, (the “Effective Date”), by and between Biosight Ltd., an Israeli corporation, with offices
at 1 Hayarden St., Airport City, P.O.B 1083 Lod 7019802, Israel (hereinafter referred to as “Sponsor”) and Pharmaceutical
Research Associates, Inc., a Commonwealth of Virginia corporation, together with its Affiliates, with offices at 4130 ParkLake Avenue,
Suite 400, Raleigh, NC 27612 (hereinafter referred to as “PRA”), each hereinafter referred as “Party” and both
hereinafter referred as “Parties”.


 


PRA
is engaged in the business of providing services related to the design, implementation and management of clinical development programs
for the pharmaceutical, biotechnology and medical device industries; and


 


Sponsor
desires to engage PRA to perform such services in connection with certain pharmaceutical products under development by or under control
of Sponsor;


 


Therefore,
in consideration of the premises and mutual promises
and undertakings herein, the receipt and sufficiency of which are hereby acknowledged, the Parties intending to be legally bound do hereby
agree as follows:


 


	1.0	Definitions


 


	 	a.	Affiliates:
    With respect to either Party, an Affiliate is any entity that is controlled by, controls, or is under common control with the party
    named above including joint venture partnerships where the Party has at least 50% of the voting power,
	 	 	 
	 	b.	Amendment:
    A written specification of changes to a Task Order that is agreed to by the Parties and authorized by signature of each Party’s
    authorized representative(s), in a format substantially similar to Exhibit B attached hereto.
	 	 	 
	 	c.	Applicable
    Anti-Bribery Laws: Any bribery, fraud, kickback, or other similar anti-corruption law or regulation of any relevant country,
    including the UK Bribery Act 2010 and the US Foreign Corrupt Practices Act of 1977,
	 	 	 
	 	d.	Audit:
    A systematic and independent examination of trial related activities and documents to determine whether the evaluated trial related
    activities were conducted, and the data were recorded, analyzed and accurately reported according to the Protocol, standard operating
    procedures (SOPs), Good Clinical Practice (GCP), and the applicable regulatory requirement(s) (GCP 1.6),
	 	 	 
	 	e.	Budget
    for Services: A component of a Task Order that outlines the estimated cost of the Services based upon the Project Specifications.
	 	 	 
	 	f.	Inspection:
    The act by a regulatory authority (ies) of conducting an official review of documents, facilities, records, and any other resources
    that are deemed by the authority (ies) to be related to the clinical trial and that may be located at the site of the trial, at the
    Sponsor’s and/or contract research organization’s (CRO’s) facilities, or at other establishments deemed appropriate
    by the regulatory authority (ies) (GCP 1.29).
	 	 	 
	 	g.	Institutional
    Review Board (“IRB”): Any board, committee, or other group formally designated by an institution to review, to approve
    the initiation of, and to conduct periodic review of, biomedical research involving human subjects. The primary purpose of such review
    is to assure the protection of the rights and welfare of human subjects. The term has the same meaning as the phrase institutional
    review committee, independent ethics committee or ethics committee.


 




    	 



    	Horn & Co. Final, May 3, 2018	 



    

 


	 	h.	Early
    Development Services: A Study performed at a facility or external investigative site for Phase I to Phase IIa clinical trials
    as designated in a Task Order.
	 	 	 
	 	i.	GCP
    or Good Clinical Practice: The standard defined in the ICH Harmonised Tripartite Guideline For Good Clinical Practice E6(R1)
    Current Step 4 version dated 10 June 1996 (including the Post Step 4 corrections) together with, for Services performed in the European
    Union, such other Good Clinical Practice requirements as are specified in Directive 2001/20/EC of the European Parliament and the
    Council of 4 April 2001 relating to medicinal products for human use and in guidance published by the European Commission pursuant
    to such Directive; and for Services performed in other jurisdictions, any analogous laws and/or regulations. All, as may be updated
    or amended from time to time.
	 	 	 
	 	j.	Institution:
    Any public or private entity or agency or medical or dental facility where clinical trials are conducted.
	 	 	 
	 	k.	Investigator(s):
    Except where defined otherwise in a Task Order for Early Development Services, a third party responsible for the conduct of the clinical
    trial at a Trial Site. If a trial is conducted by a team of individuals at a Trial Site, the Investigator is the responsible leader
    of the team and may be called the principal investigator.
	 	 	 
	 	l.	Key
    Personnel: The key PRA personnel assigned to the Services including the Project Manager and others as agreed to by the Parties.
	 	 	 
	 	m.	Milestone:
    An event associated with a specific date, for which a payment will be due, as set out in the Payment Schedule of any Task Order.
	 	 	 
	 	n.	Pass-Through
    Budget: A component of a Task Order that outlines the estimated costs of pass-through expenses for goods and services incurred
    by PRA on behalf of Sponsor, in connection with the performance of the Services.
	 	 	 
	 	o.	Payment
    Schedule: A component of a Task Order that describes the timing of payments due to be made for Services delivered and pass-through
    expenses incurred,
	 	 	 
	 	p.	PRA
    Project Manager: The PRA representative assigned to lead the PRA project team, act as the principal liaison between PRA and Sponsor,
    and provide general oversight in the delivery of Services with regard to a specific Task Order.
	 	 	 
	 	q.	Project
    Schedule: A component of a Task Order that outlines the project milestones, estimated timelines and completion date for the Services
    based upon the Project Specifications,
	 	 	 
	 	r.	Project
    Specifications: A component of a Task Order that outlines the specific Services to be provided, assumptions used in preparing
    the Budget for Services, Pass-Through Budget and Project Schedule, and assignment of project-related responsibilities between the
    Parties.
	 	 	 
	 	s.	Services:
    The services to be provided by PRA and Subcontractors (if applicable) under this Agreement as specifically outlined in a Task Order
    or otherwise authorized by Sponsor.


 




    	2



    	Horn & Co. Final, May 3, 2018	 



    

 





	 	t.	Study:
    A clinical trial performed at one or more investigative sites under the supervision of one or more Investigator(s) pursuant to a
    study Protocol.
	 	 	 
	 	u.	Subcontractor:
    An individual or company engaged to conduct some elements of a Task Order, including without limitation, clinical laboratories, patient
    recruitment services, interactive voice recognition systems and other services. Investigators are not included as subcontractors.
	 	 	 
	 	v.	Task
    Order: A written specification of Services to be performed by PRA under this Agreement, including the Project Specifications,
    Project Schedule, Contact Information, Budget for Services, Pass-Through Budget, and Payment Schedule.
	 	 	 
	 	w.	Trial
    Site(s): Except where defined otherwise in a Task Order for Early Development Services, a third party location where trial-related
    activities are actually conducted following Sponsor’s written approval of such Trial Site and the terms of operation therein.


 


	2.0	Services
	 	 
	 	PRA,
    itself or through one of its Affiliates or Subcontractors (if applicable), will perform the Services in accordance with: (i) the
    Protocol, (ii) the terms and conditions of this Agreement and the associated Task Order, (ii) PRA’s standard operating procedures,
    which will be available for review upon written request of Sponsor, or when applicable and agreed under the Task Order, Sponsor’s
    standard operating procedures (iii) all applicable laws, rules and regulations including GCP, (iv) the standards and practices that
    are generally accepted in the industry and exercised by other entities engaged in performing similar services; and (v) the written
    instructions of Sponsor, from time to time. PRA shall use commercially reasonable efforts, skills and resources to diligently and
    competently perform the Services described in any Task Order issued hereunder and to meet all obligations and deadlines described
    in such Task Orders. The Parties will agree in advance on all Services to be provided and the performance of those Services will
    be authorized in writing through the execution of a Task Order. Unless otherwise agreed to by the Parties in writing, PRA will not
    begin work on any Services without an executed Task Order authorizing the Services. During the term of this Agreement PRA shall provide
    Sponsor with periodically written progress reports, as shall be further agreed between the Parties. PRA representatives conducting
    and/or supervising the Services shall be available during the term of this Agreement for meetings from time to time, as agreed under
    the Task Orders, during regular business hours for updates with Sponsor representatives.
	 	 
	2.1	Task
    Orders
	 	 
	 	PRA
    will provide Services as specified in one or more Task Orders, which will be prepared in a format substantially similar to the Form
    of Task Order, attached hereto, as appropriate. Each Task Order may include detailed information, as applicable, with respect to
    a specific project, including Project Specifications, Project Schedule, Budget for Services, Pass-Through Budget, and Payment Schedule.
    Task Orders will become effective when signed by an authorized representative of both Parties.
	 	 
	2.2	Amendments
	 	 
	 	Any
    changes to a Task Order, including but not limited to changes to the Project Specifications, Project Schedule, Budget for Services
    or Pass-Through Budget, will be agreed upon by the Parties and documented in an Amendment to the Task Order in a form substantially
    similar to that attached hereto as Exhibit B. Sponsor agrees that PRA will not perform any out-of-scope work described in an Amendment
    until it is approved in writing by both Parties.


 




    	3



    	Horn & Co. Final, May 3, 2018	 



    

 


		a.	Amendment Process. Some changes in costs associated with clinical research are not within the control of PRA and PRA will not be responsible for any such changes. Upon identification by either Party of changes to the project assumptions or other changes to the Project Specifications, the Parties will negotiate in good faith an Amendment to accommodate increases or decreases to the Project Budget, Project Schedule, and Payment Schedule that are reasonably associated with any such adjustments. Amendments will be documented in accordance with the terms of this Section 2.2. Such changes may include, but are not limited to, any of the following (in all cases, to the extent that such delays are indeed not within the control of PRA):
	 	 	 	 
	 	 	i.	delays
    in receiving from Sponsor technical information or Sponsor’s acceptance of documents submitted by PRA in a timely manner in
    the performance of its duties under this Agreement or any Task Order, or any other delay on the part of Sponsor;
	 	 	 	 
	 	 	ii.	delay
    in receipt of regulatory approval from a regulatory agency, IRB, or Ethics Committee;
	 	 	 	 
	 	 	iii.	delay
    in performance by a Subcontractor not selected by PRA;
	 	 	 	 
	 	 	iv.	delay
    in shipment of study drug, clinical samples, and/or clinical supplies;
	 	 	 	 
	 	 	v.	delay
    due to changes in standard of care, clinical landscape, regulation, or changes in medical practice affecting participating sites;
	 	 	 	 
	 	 	vi.	delay
    by reason of force majeure as defined herein;
	 	 	 	 
	 	 	vii.	Sponsor
    requested changes to the Services or the Protocol;
	 	 	 	 
	 	 	viii.	delays
    due to questions received by either Party from regulatory agencies or ethics committees regarding submission materials that relate
    to characteristics of the study drug or Protocol design;
	 	 	 	 
	 	 	ix.	delays
    due to any changes in applicable law or regulatory environment; or
	 	 	 	 
	 	 	x.	changes
    for any other reason agreed upon in writing and in advance by Sponsor to be changes outside PRA control,


 


	2.3	Project
    Staffing
	 	 	 
	 	In
    performing the Services, PRA will assign personnel who are adequately trained, qualified and experienced to conduct the work as specified
    in a Task Order. Sponsor may make reasonable requests for replacement of assigned personnel for cause, such as unsatisfactory performance
    or interpersonal conflicts. PRA will promptly respond to any such request and make reasonable efforts to correct the situation in
    order to improve performance, or to provide a replacement, at its own expense, within a mutually agreeable timeframe.
	 	 	 
	 	 	Key
    Personnel. PRA will assign a PRA Project Manager and other employees whose participation in a project is required for the duration
    of the project, who will serve as Key Personnel. For clarity, the Key Personnel are the functional team leads as determined in each
    Task Order. Key Personnel may include, without limitation, Lead Data Managers and Medical Monitors and Lead Biostatisticians. PRA
    will provide thirty (30) days notice to Sponsor, whenever possible, of any changes to the Key Personnel and PRA will make reasonable
    efforts to manage the impact in the Study, PRA will provide project-specific training to replacement Key Personnel at its own expense.
    Notwithstanding the foregoing, the following Key Personnel may not be replaced without the Sponsor’s prior written consent:
    PRA Project Manager (“PM”) and Clinical Team Manager (“CTM”), unless in circumstances (i) which are not within
    the control of PRA (as termination of the employment, sickness, absence, maternity/paternity leave of that employee, etc.,), (ii)
    promotion of such individual, or (iii) underutilization of such individual in connection with the Project on which such individual
    is assigned as a PM or CTM, the following procedure shall apply; (a) PRA will make reasonable efforts to manage the impact in the
    Study; (b) the situation shall be discussed in good faith between the parties to find a reasonable solution; and (c) the transition
    process (unless such transition process is not possible, e.g.:
    sickness, absence, etc.), and, in any case, the replacement shall be made in consultation and agreement with Sponsor. Sponsor’s
    agreement shall not be unreasonably withheld.


 




    	4



    	Horn & Co. Final, May 3, 2018	 



    

 


	 	a.	Project
    Team. PRA will assign non-Key Personnel from one or more of its offices located worldwide, as needed to perform the Services
    in accordance with the Task Order. Sponsor will receive in advance the CV of the Clinical Research Associates.
	 	 	 
	 	From
    time to time, PRA may assign some elements of the Services to contract employees. PRA agrees that any contract employees used to
    perform the Services will be adequately qualified, experienced and trained as required to perform the Services in the same manner
    as PRA qualifies and trains its own employees. PRA will remain responsible for satisfactory performance of all Services performed
    by contract employees.
	 	 	 
	 	In
    the event that any unauthorized change of PM and CTM (or the procedure above was not followed when applicable), and provided such
    authorization was not unreasonably withheld, shall directly result in a delay or have any other direct adverse effect to the Project,
    then, without derogating from any other right or remedy to which Sponsor may be entitled, PRA shall reimburse BioSight for the portion
    of Services in failure due to such unauthorized replacement.


 


	2.4	Use
    of Subcontractors
	 	 
	 	Upon
    and subject to the prior written approval of the Sponsor, PRA may use Subcontractors to conduct some elements of the Services. In
    the event that Sponsor objects, for reasonable cause, to any such Subcontractors selected and contracted directly by PRA, PRA will
    replace the Subcontractor within a mutually agreeable timeframe. Sponsor may request that PRA contracts and uses a specific subcontractor,
    but such engagement will be subject to PRA’s written consent to engage such subcontractor. Such written consent will be subject
    to PRA performing the necessary activities to qualify and approve a subcontractor, and negotiate contractual terms, and will not
    be withheld unreasonably. PRA will be responsible and retain primary liability for the performance and agrees to manage the performance
    of all Subcontractors whom have been qualified, approved and contracted by PRA according to PRA SOPs. In the unlikely event that
    PRA is unable to consent to engage with a Sponsor requested subcontractor, PRA will work with Sponsor to find a mutually acceptable
    solution for the Services, and to clarify, PRA will not be responsible for the performance of such unapproved subcontractors.
	 	 
	2.5	Applicable
    Standards
	 	 
	 	The
    Parties agree that PRA will provide the operational systems, processes and standard operating procedures to be used in performance
    of the Services unless specified otherwise in the Task Order. All Services will be conducted in accordance with GCP and applicable
    laws and regulations.


 




    	5



    	Horn & Co. Final, May 3, 2018	 



    

 


	2.6	Sponsor-Provided
    Systems
	 	 	 
	 	In
    the event that Sponsor requires PRA to use Sponsor’s information systems and associated processes, Sponsor will be responsible
    for all costs associated with installation and operation of the systems, including costs for hardware and software licenses, and
    for training of PRA personnel assigned to the project in the use of Sponsor system(s)
	 	 	 
	3.0	PAYMENT
	 	 	 
	 	The
    Parties agree that the fees and other reimbursements that PRA will receive for performing the Services hereunder will be outlined
    in each Task Order and are subject to the following terms and conditions.
	 	 	 
	3.1	Compensation
    for Services
	 	 	 
	 	For
    Services provided, Sponsor will pay PRA in accordance with the terms in this section of the Agreement and each applicable Task Order.
    The timing and frequency of payments will be governed by the Payment Schedule detailed in each Task Older.
	 	 	 
	3.2	Pass-Through
    Budget
	 	 	 
	 	a.	Pass-Through
    Expenses. In order to provide funding for pass-through expenses, exclusive of investigator grants described below, Sponsor will
    make an advance payment to PRA in an amount set forth in a Task Order immediately upon execution of the Task Order. PRA will submit
    to Sponsor monthly invoices for amounts incurred during the relevant billing period. The advance payment will be retained by PRA
    until the completion of the Services, at which time a reconciliation of expenses will be done to ensure that Sponsor pays for only
    those expenses actually incurred. The advance payment will then be applied to the final invoice, if unpaid, and any remaining advance
    payment will be refunded to Sponsor within thirty (30) days from the date of the final reconciliation.
	 	 	 
	 	b.	Sponsor
    will reimburse all travel expenses in accordance with PRA’s applicable Travel and Expense Policy (to be provided upon request).
    Each invoice will include, as necessary, a summary of all pass-through expenses. Provided however, that any such expense which exceeds
    an amount of US$ 500 (per single expense), and was not originally included in the Task Order budget, shall be subject to the advanced
    written approval of the Sponsor.
	 	 	 
	3.3	Investigator
    Grants and Reconciliation.
	 	 	 
	 	In
    order to provide for timely payments to Investigators, Sponsor will make an additional advance payment to PRA in an amount set forth
    in a Task Order immediately upon execution of a Task Order. PRA will submit to Sponsor quarterly invoices in advance for estimated
    amounts to be paid to Investigators to be incurred in the upcoming quarter to ensure that adequate funds are available to pay such
    expenses. Sponsor agrees that PRA will not make payments to Investigators without sufficient funds available. The advance payment
    will be retained by PRA until the completion of the Services, at which time a reconciliation of expenses will be done to ensure that
    Sponsor pays for only those expenses actually incurred. The advance payment will then be applied to the final invoice, if unpaid,
    and any remaining advance payment will be refunded to Sponsor within thirty (30) days from the date of the final reconciliation.
	 	 	 
	3.4	Invoices
	 	 	 
	 	a.	Invoices
    for Services and pass-through expenses will be submitted in accordance with the Payment Schedule associated with the relevant Task
    Order and will be prepared monthly, or as frequently as necessary. Any final payments specified in the Task Order will be invoiced
    upon completion of the project and delivery to Sponsor of any final study databases, reports or other deliverables as specified in
    the Project Specifications.


 




    	6



    	Horn & Co. Final, May 3, 2018	 



    

 


	 	b.	All
    invoices under this Agreement will be forwarded to the Sponsor representative designated in the relevant Task Order.
	 	 	 
	 	c.	All
    payments under this Agreement will be remitted to the PRA affiliate named in the Task Order, to the address and in the manner set
    forth in the Payment Schedule of the applicable Task Order.
	 	 	 
	3.5	Payment
    Terms
	 	 	 
	 	Sponsor
    agrees to pay for Services and pass-through expenses in accordance with the Payment Schedule outlined in each Task Order or associated
    Amendment. Sponsor will pay for all Services, pass-through expenses and other invoiced items within thirty (30) days of the last
    day of the calendar month in which the Sponsor had received the respective invoice. If Sponsor notifies PRA in writing of any deficiencies
    in the Services during such period, Sponsor will pay for the portions of the Services that conform to the Task Order within thirty
    (30) days of the last day of the calendar month in which the Sponsor had received the respective invoice and PRA will correct any
    non-conforming Services within thirty (30) days of the notice. Upon final shipment of the corrected Services, PRA will submit the
    invoice for the corrected Services to Sponsor. All payments will be made in the currency noted in the Payment Schedule of the Task
    Order. All fees for Services and pass-through expenses are exclusive of VAT (including non- refundable VAT) or similar taxes payable
    by Sponsor under applicable law, including local taxes, social taxes, charges or remittance fees over the pass-through expenses,
    which Sponsor will pay when applicable. In the event that value added tax (VAT) must be paid by PRA on pass-through expenses and
    when such VAT is not recoverable by PRA because such recovery is legally impermissible based on the facts and circumstances of the
    engagement with the third party suppliers, or when PRA considers that it would not be commercially viable to pursue the recovery,
    PRA may charge such VAT to Sponsor and if Sponsor has any question about such not recoverable VAT, PRA shall provide information.
    Each Party shall be solely responsible for the payment of all taxes imposed on its share of income arising directly or indirectly
    from its activities or receipt of payments under this Agreement. To the extent Sponsor is required to deduct and withhold taxes on
    any payment to PRA hereunder, after exhausting available legal remedies, it shall pay the amounts of such taxes to the proper governmental
    authority in a timely manner and promptly transmit to PRA an official lax certificate or other evidence of such withholding sufficient
    to enable PRA to claim such payment of taxes. PRA shall provide Sponsor any tax forms that may be reasonable necessary in order for
    Sponsor not to withhold tax or to withhold tax at a reduced rate under applicable law.
	 	 	 
	3.6	Currency
    Management.
	 	 	 
	 	The
    Parties agree that neither should receive a material benefit or detriment from currency exchange rate fluctuation between the currencies
    in which costs are incurred, and the currencies used for pricing or invoicing and payment.
	 	 	 
	 	a.	Service
    Fees: For service fees, the bid currencies will be tracked and managed against the contract currency established in each Task
    Order. On an annual basis a currency review may occur to assess the impact of currency fluctuation on the value of services using
    the average rate during the evaluation period as published by Oanda.com on the basis of the date of invoicing. For exchange rate
    fluctuations of less than 5% no adjustments will be made. Once the Parties have agreed upon the impact of any currency fluctuation
    PRA will issue an invoice or credit memo as appropriate. The Parties will also discuss at that time whether to amend the value of
    the Task Order to reflect trends in currency fluctuation.


 




    	7



    	Horn & Co. Final, May 3, 2018	 



    

 


	 	b.	Expenses.
    For pass-through expenses and investigator grants, conversion from the currency in which the payment is made to the contract currency
    will occur at the time the transaction is processed using daily exchange rates provided by Oanda.com. Due to investigator fee invoices
    being raised on a forecast of payments to be made a retrospective reconciliation will occur at the end of the project using the actual
    exchange rates applied.
	 	 	 
	 	For
    Early Development Services, the Study budget will be agreed upon in the currency of the country where the Study will be performed,
    provided however, if an exchange rate fluctuation mechanism is applicable the mechanism will be set out in the Task Order.
	 	 	 
	4.0	Term
    and Termination
	 	 	 
	4.1	Term
	 	 	 
	 	Unless
    earlier terminated, this Agreement will remain in effect for an initial term of three (3) years from the Effective Date. In the event
    of expiration or termination of this Agreement, any outstanding Task Order will continue until completion of the Services described
    in such Task Order or appropriate termination of the Task Order.
	 	 	 
	4.2	Termination
	 	 	 
	 	a.	The
    Sponsor may terminate this Agreement or any Task Order for any reason upon thirty (30) days written notice to PRA.
	 	 	 
	 	b.	Each
    Party may terminate this Agreement or any Task Order upon written notice to the other Party in the event of a material breach of
    this Agreement or any Task Order by the other Party that is not cured within sixty (60) days of receipt of written notice of breach.
	 	 	 
	 	c.	Each
    Party may terminate this Agreement or any Task Order immediately upon written notice to the other Party, if the other Party; (i)
    files a petition for bankruptcy or has an involuntary bankruptcy petition filed against it; (ii) is adjudged as bankrupt; (iii) becomes
    insolvent; (iv) has a receiver, trustee, conservator or liquidator appointed for all or a substantial part of its assets; (v) ceases
    to do business; (vi) commences any dissolution, liquidation or winding up; or (vii) makes an assignment of its assets for the benefit
    of its creditors.
	 	 	 
	 	4.3	Termination
    for Other Reasons
	 	 	 
	 	If
    PRA’s continued performance of the Services contemplated by this Agreement or any Task Order could constitute a potential or
    actual violation of legal, regulatory, ethical or scientific standards, then PRA may terminate this Agreement or any Task Order by
    giving written notice stating the effective date (which may not be less than sixty [60] days from the notice date) of such termination.
    The Parties shall use all reasonable efforts to rectify the alleged violation prior to the end of such notice period.
	 	 	 
	 	4.4	Effects
    of Termination/Expiration
	 	 	 
	 	In
    the event of termination or expiration of this Agreement or any Task Order, Sponsor will pay PRA for Services performed up to the
    effective date of termination, non-cancellable costs and expenses and any associated wind down costs incurred up to effective date
    of termination. Within thirty (30) days of either Party’s receipt of such notice, the Parties will meet to develop a plan for
    closing down this Agreement or the applicable Task Order, which will include transferring any remaining tasks or other responsibilities
    to Sponsor or its designee. In the event of termination or postponement of Early Development Services, additional terms will apply
    as set forth in the applicable Task Order.


 




    	8



    	Horn & Co. Final, May 3, 2018	 



    

 


	4.5	Survival
	 	 	 
	 	Expiration
    or termination of this Agreement will not relieve the Parties of any obligation accruing prior to such expiration or termination.
    In addition, the Sections on Payment, Term and Termination, Representations and Warranties, Debarment Certification, Ownership of
    Data and Intellectual Property, Confidential Information, Indemnification, and Employees as well as any other sections which by their
    nature should survive, will survive expiration or termination of this Agreement indefinitely, or for the period of time noted in
    the specific clause.
	 	 	 
	5.0	Representations
    and Warranties
	 	 	 
	5.1	Acknowledgments
	 	 	 
	 	Sponsor
    acknowledges and agrees that the results of the Services to be provided hereunder are inherently uncertain and that, accordingly,
    there can be no assurance, representation or warranty by PRA that the drug, compound, device or other material which is the subject
    of research covered by this Agreement or any Task Order issued hereunder can, either during the term of this Agreement or thereafter,
    will be successfully developed or, if so developed, will receive the required approval by the United States Food and Drug Administration
    (“FDA”) or other regulatory authority.
	 	 	 
	5.2	Mutual
    Representations
	 	 	 
	 	Each
    of the Parties represents, warrants and covenants to the other that: (a) it has taken all necessary actions on its part to authorize
    the execution, delivery and performance of the obligations undertaken in this Agreement, and no other corporate actions are necessary
    with respect thereto; (b) it is not a party to any agreement or understanding and knows of no law or regulation that would prohibit
    it from entering into and performing this Agreement; (c) when executed and delivered by it, this Agreement will constitute a legal,
    valid and binding obligation of it, enforceable against it in accordance with this Agreement’s terms; (d) it is duly licensed,
    incorporated, authorized or qualified to do business and is in good standing in every jurisdiction in which a license, authorization
    or qualification is required for it to perform its obligations under this Agreement; (e) it will perform its obligations hereunder
    in accordance with current industry standards, the terms of this Agreement and any Task Order issued hereunder; (f) it will perform
    its obligations hereunder in accordance with all applicable federal, international, state or local law or regulation, including all
    Applicable Anti-Bribery Laws in the countries where Services are to be performed; (g) performance of its obligations hereunder will
    not infringe or violate the rights of any third party including but not limited to property, contractual, employment, trademark,
    trade secrets, copyright, patent, proprietary information and non-disclosure rights; and (h) it will not enter into any other agreements
    which would interfere or prevent performance of the obligations described herein.
	 	 	 
	5.3	Representations
    and Warranties of Sponsor
	 	 	 
	 	a.	Sponsor
    represents and warrants that it has the right, title and interest in the drug, compound, device or other material which is the subject
    of research covered by this Agreement or any Task Order (whether such right, title and interest is held solely by Sponsor or jointly
    with others) and that it has the legal right, authority and power to perform any clinical trial which is the subject of a Task Order
    issued hereunder. 


 




    	9



    	Horn & Co. Final, May 3, 2018	 



    

 


	 	b.	If
    Sponsor requires PRA to use MedDRA to code, analyze or report data for a Study, Sponsor represents and warrants that it has a current
    and valid license agreement with the Maintenance and Support Services Organization (“MSSO”) to use MedDRA. Furthermore,
    if PRA is required to use WHO Drug, WHO Herbal or WHO ART for coding of data, Sponsor warrants and represents that it has a current
    and valid license agreement with The Uppsala Monitoring Centre for the dictionaries which PRA will be required to use. If Sponsor
    does not currently have such licenses, it represents and warrants that such licenses will be in place prior to PRA’s delivery
    of data which is coded using these dictionaries. PRA will not be liable to Sponsor for use of data coded without proper licensing,
    and Sponsor will hold PRA harmless in these occasions.
	 	 	 
	 	c.	Sponsor
    further warrants and represents that for any software application, computer system or program that is required to be used by PRA
    in the performance of Services to which PRA does not hold a license at the commencement of this Agreement or the relevant Task Order,
    Sponsor will have acquired and will maintain current and valid licenses which are necessary for the use of such applications or programs,
    and that PRA’s use of such applications or programs will not subject PRA to any liability for such use.
	 	 	 
	 	d.	Any
    drug material used in a Study that is provided by or on behalf of Sponsor will be manufactured, packaged, labeled, and shipped in
    accordance with all applicable laws, rules, and regulations, including, without limitation, applicable current Good Manufacturing
    Practices (“cGMPs”) as such cGMPs may be adopted in any nations in which such study drugs are imported or manufactured,
    as applicable.
	 	 	 
	5.4	Representations
    and Warranties of PRA
	 	 	 
	 	a.	PRA
    represents and warrants that without derogating from the representations set forth in Section 2 above, it has the experience, capability,
    and resources necessary to perform Services under this Agreement, and that the personnel assigned to perform Services rendered under
    this Agreement will be capable professionally.
	 	 	 
	 	b.	PRA
    further represents and warrants that it will make available to Sponsor or to the responsible regulatory authority relevant records,
    programs, and data as may be reasonably requested by Sponsor for purposes related to filing and prosecution of Sponsor’s related
    new drug applications.
	 	 	 
	 	c.	In
    conformity with any applicable law, including the United States Foreign Corrupt Practices Act (“USFCPA”), PRA and its
    employees and officers shall not directly or indirectly make any offers, payments, promises to pay, or authorize payment, or offer
    a gift, promise to give, or authorize the giving of anything of value for the purpose of influencing an act (including a decision
    not to act) or decision of an official of any government within the territory in which the Agreement is being executed or inducing
    such a person to use his/her influence to affect any such governmental act or decision in order to assist Sponsor (or its clients)
    in obtaining, retaining or directing business for the benefit of Sponsor (or its clients) if such action on the part of PRA would
    be in violation of such applicable law,
	 	 	 
	5.5	No
    Other Warranties
	 	 	 
	 	The
    Parties’ warranties and representations contained in this Agreement are in lieu of all other warranties expressed or implied.


 




    	10



    	Horn & Co. Final, May 3, 2018	 



    

 


	6.0	Debarment
    Certification
	 	 	 
	 	a.	PRA
    certifies that it has not been debarred under Section 306 of the Federal Food, Drug, and Cosmetic Act, 21 U.S.C. §335a(a) or
    (b) or any equivalent local law or regulation. In the event that PRA becomes debarred, PRA agrees to notify Sponsor immediately,
	 	 	 
	 	b.	PRA
    certifies that it has not and will not use in any capacity the services of any individual, corporation, partnership, or association
    which has been debarred under Section 306 of the Federal Food, Drug and Cosmetic Act, 21 U.S.C §335a (a) or (b) or any equivalent
    local law or regulation. In the event that PRA becomes aware of or receives notice of the debarment of any individual, corporation,
    partnership, or association providing services to PRA, which relate to the Services being provided under this Agreement, PRA agrees
    to notify Sponsor immediately.
	 	 	 
	7.0	Inspections
    and Audits
	 	 	 
	7.1	Audit
    by Sponsor
	 	 	 
	 	During
    the term of this Agreement, PRA will permit representatives of Sponsor who are not competitors of PRA, to examine, at a reasonable
    time during normal business hours, upon prior written notice to PRA of at least sixty (60) days for once per 12 month period routine
    audits and at least three (3) days for cause/emergency audits (which shall not be limited by number of audits): (i) the facilities
    where the Services are being, will be or have been conducted; (ii) related study documentation; and (iii) any other relevant information
    necessary for Sponsor to confirm that the Services are being or will be or have been conducted in conformance with applicable standard
    operating procedures, the specific Task Orders, this Agreement and in compliance with applicable laws and regulations. PRA will promptly
    provide copies of any materials reasonably requested by Sponsor during such audit. However, Sponsor acknowledges that such audits
    may not be possible due to reasons outside the reasonable control of PRA. In such cases, PRA will endeavor to arrange such audit
    on the first available date after the sixty (60) day notice and in any event within 75 days from the notice date.
	 	 	 
	7.2	Inspection
    by Regulatory Authorities
	 	 	 
	 	During
    the term of this Agreement, each Party will permit regulatory authorities to examine, (i) the facilities where the Services are being
    conducted; (ii) study documentation; and (iii) any other relevant information, including information that may be designated by one
    or both of the Parties as confidential, reasonably necessary for regulatory authorities to confirm that the Services are being conducted
    in compliance with applicable laws and regulations. Each Party will immediately notify the other if any regulatory authority schedules,
    or without scheduling, begins an inspection that relates to the Services or the Parties’ respective obligations hereunder.
    PRA shall disclose to Sponsor any finding from any regulatory authority that is directly related to the Services herein, and if permitted
    by the regulatory authority shall promptly provide Sponsor with a copy of the inspection report after the removal of any information
    of a confidential nature which is not related to the Services or to Sponsor’s activities or products, PRA shall reasonably
    act to contractually obtain, if PRA is responsible for contracting the Trial Sites, the cooperation of investigators and Trial Sites
    with respect to regulatory review. As part of PRA’s quality management procedures, PRA conducts periodical audits of its processes
    and systems. If such audits identify critical findings that impact the Services and/or Sponsor’s activities, PRA agrees to
    inform Sponsor of such findings.


 




    	11



    	Horn & Co. Final, May 3, 2018	 



    

 


	7.3	Audits
    of Trial Site(s) by PRA; Recruitment by Trial Sites
	 	 	 
	 	In
    connection with PRA’s provision of Services as specified in this Agreement and any associated Task Order, PRA may conduct audits
    of Trial Sites, and will conduct such audits at Sponsor’s written request and expense, Based on PRA’s observations of
    any Trial Site, PRA may recommend to Sponsor: i) that enrollment should be suspended at the Trial Site; ii) that a Trial Site’s
    non-compliance needs to be reported to regulatory authorities; and/or (iii) Trial Site’s participation in a Study needs to
    be terminated. Upon such a recommendation, PRA will present to Sponsor a basis for its decision. If Sponsor disagrees with the basis
    for PRA’s recommendation, PRA may in its discretion assign its contract with the Trial Site to Sponsor and Sponsor agrees to
    accept such assignment and to be responsible for all contractual duties and obligations to the Trial Site. Without derogating from
    the foregoing, both Parties agree to notify the other Party of instances of continued non-compliance or suspected scientific misconduct
    by Trial Sites, Investigators or Key Personnel, as it relates to the Services.
	 	 	 
	 	7.3
    (A). In the event that any Trial Site is recommended
    by PRA, or PRA accepts a Trial Site suggested by Biosight without raising concerns, and they shall not recruit the expected total
    number of patients set forth in the respective Task Order (provided no unforeseen events occurred that were outside PRA’s control
    as noted in section 2.2.a), Sponsor shall decide, in consultation and agreement with PRA, the correct course of action, and PRA shall
    bear the cost of any new or replacement Trial Sites to recruit the original amount of total patients included in the original Task
    Order, including without limitation, any reasonably identifiable delays caused by such replacement, as discussed and agreed by Sponsor
    and PRA in good faith.
	 	 	 
	8.0	Ownership
    of Data and Intellectual Property
	 	 	 
	 	All
    data (including without limitation, written, printed, graphic, video and audio material, and information contained in any computer
    database or computer readable form) generated or collected by PRA in the course of conducting the Services (the “Data”)
    and related to the Services will be Sponsor’s property. Any copyrightable work created in connection with performance of the
    Services and contained in the Data will be considered work made for hire, whether published or unpublished, and all rights therein
    will be the property of Sponsor as employer, author and owner of copyright in such work.
	 	 	 
	 	The
    underlying rights to the intellectual property and materials that are the subject of each Task Order, including, without limitation,
    all intellectual property rights in Sponsor’s drug candidates or products, are owned solely by Sponsor. Neither PRA, its Affiliates
    nor any of their respective Subcontractors will acquire any rights of any kind whatsoever with respect to Sponsor’s drug candidates
    or products as a result of conducting Services hereunder. All rights to any know-how, trade secrets, developments, discoveries, inventions
    or improvements (whether or not patentable) conceived or reduced to practice in the performance of work conducted under this Agreement
    by PRA’s or its Affiliates’ employees, or independent contractors, either solely or jointly with employees, agents, consultants
    or other representatives of Sponsor (the “Intellectual Property”), will be owned solely by Sponsor. PRA, its Affiliates
    and their respective employees and Subcontractors will sign and deliver to Sponsor all writings and do all such things as may be
    necessary or appropriate to vest in Sponsor all right, title and interest in and to such Intellectual Property, PRA will promptly
    disclose to Sponsor any such Intellectual Property arising under this Agreement. Sponsor may, in its sole discretion, file and prosecute
    in its name and at its expense, patent applications on any patentable inventions within the Intellectual Property. Upon the request
    of Sponsor, and at the sole expense of Sponsor, PRA will assist Sponsor in the preparation, filing and prosecution of such patent
    applications and will execute and deliver any and all instruments necessary to effectuate the ownership of such patent applications
    and to enable Sponsor to file and prosecute such patent applications in any country.


 




    	12



    	Horn & Co. Final, May 3, 2018	 



    

 


	 	Notwithstanding
    the foregoing, Sponsor agrees that PRA possesses or may in the future possess analytical methods, computer technical expertise and
    software, which do not relate specifically to the Sponsor’s products or Intellectual Property, and which have been independently
    developed by PRA and which will remain the sole and exclusive property of PRA, except to the extent that improvements or modifications
    include, incorporate or are based upon Sponsor’s information, in which case these will belong to Sponsor as set forth above.
    Improvements or enhancements made to PRA’s processes or methods which are independently developed incidental to the provision
    of Services hereunder and are not directly related to Sponsor’s products or Intellectual Property will remain the sole property
    of PRA. Sponsor may use this information of PRA free of charge for interpretation purposes or regulatory authorities’ purposes
    or for any purposes that are appropriate within the scope of this Agreement, to the extent necessary or desirable to commercialization
    of Sponsor’s products, if applicable. Any improvement on information of Sponsor will remain the sole property of Sponsor.
	 	 	 
	8A.	Maintenance
    and Disposition of Computer Files and Study Materials
	 	 	 
	 	PRA
    shall maintain all materials and all other Data obtained or generated by PRA in the course of providing the Services and will take
    reasonable and customary precautions, including periodic backup of computer files, to prevent the loss or alteration of Sponsor’s
    study Data, documentation, and correspondence. Upon termination of a Study PRA will send to the Sponsor the electronic Trial Master
    File.
	 	 	 
	9.0	Confidential
    Information
	 	 	 
	9.1	Sponsor
    Confidential Information
	 	 	 
	 	a.	Sponsor
    may disclose confidential information to PRA during the course of this Agreement. All information provided by or on behalf of Sponsor
    (including the study drug) or Data collected by PRA during the performance of the Services, including the study results and Sponsor’s
    Intellectual Property are deemed to be the confidential information of Sponsor and is hereinafter referred to as “Sponsor Information”.
    PRA will not disclose Sponsor Information to any person other than its employees, agents, Investigators, Trial Sites, regulatory
    authorities, IRBs (only to the extent required by applicable law) and Subcontractors involved in the Services to whom it needs to
    disclose such specific information or use any such information for any purpose other than the performance of Services without the
    prior written consent of Sponsor.
	 	 	 
	 	b.	PRA
    will require (and be responsible) that it and its Affiliates’ employees, agents, Subcontractors and shall require (and take
    any reasonable action and collaborate with the Sponsor to require) that the Investigators and Trial Sites involved in the Services
    will comply with terms substantively similar to the confidentiality provisions of this Agreement, pursuant to a form of confidentiality
    and non-use agreement approved by Sponsor in advance. PRA will disclose only the Sponsor Information to those of its employees, agents,
    Investigators, Trial Sites and Subcontractors who reasonably need to know the Sponsor Information. The disclosure to Investigators
    and Trial Sites shall be pursuant to a form of confidentiality and non-use agreement approved by Sponsor in advance.
	 	 	 
	 	c.	PRA
    will exercise due care to prevent the unauthorized disclosure and use of Sponsor Information associated with the Services.


 




    	13



    	Horn & Co. Final, May 3, 2018	 



    

 


	 	d.	This
    confidentiality, nondisclosure and nonuse provision will not apply to Sponsor Information that PRA can demonstrate by competent evidence:
	 	 	 
	 	i.	was
    known by PRA before initiation of the Services or which is independently discovered, after the initiation of the Services, without
    the aid, application of use of Sponsor Information, as evidenced by written records;
	 	 	 
	 	ii.	was
    in the public domain at the initiation of the Services or subsequently became publicly available through no fault or action of PRA,
    provided however, that Sponsor Information shall not be deemed to be in the public domain merely because any part of the Sponsor
    Information is embodied in general disclosure or because individual features, components or combinations thereof are now or become
    known to the public; or
	 	 	 
	 	iii.	was
    disclosed to PRA on a non-confidential basis by a third party authorized to disclose it,
	 	 	 
	 	e.	In
    no event will either Party be prohibited from disclosing confidential information of the other Party to the extent required by law
    to be disclosed, provided that the disclosing Party provides the non-disclosing Party with written notice thereof, prior to disclosure,
    to the extent reasonably practicable, discloses only what is required to be disclosed by law or regulation, and, at the non-disclosing
    Party’s request and expense, cooperates with the non-disclosing Party’s efforts to obtain a protective order or other
    confidential treatment of the confidential information required to be disclosed. Since a breach by PRA of any of the promises or
    agreements contained herein may result in irreparable and continuing damage to Sponsor for which there may be no adequate remedy
    at law, Sponsor shall be entitled to seek injunctive relief and/or a decree for specific performance, and such other relief as may
    be proper (including monetary damages if appropriate). Nothing in this Section shall be construed as derogating from any right or
    remedy that the Sponsor may be entitled to under applicable law or this Agreement.
	 	 	 
	9.2	PRA
    Confidential Information
	 	 	 
	 	Sponsor
    agrees that all business processes, contract terms, prices, procedures, policies, methodologies, systems, computer programs, software,
    applications, databases, proposals and other documentation generally used by PRA and not developed solely for the Sponsor pursuant
    to the provisions of Section 8.0 above, are the exclusive proprietary and confidential property of PRA (hereinafter “PRA Information”)
    or the third parties from whom PRA has secured the right of use. Sponsor agrees that all PRA Information, along with any improvement,
    alteration or enhancement made thereto during the course of the Services, will be the exclusive proprietary and confidential property
    of PRA, and will be subject to the same degree of protection as is required of PRA to protect Sponsor Information.
	 	 	 
	9.3	Disposition
    of Confidential Information
	 	 	 
	 	At
    the conclusion of a Study, or upon the written request of the Sponsor, PRA will deliver to Sponsor or destroy, as the Sponsor may
    request in its sole discretion, all Sponsor Information in its possession unless Sponsor directs otherwise. Sponsor may communicate
    any special request for the disposition of materials in writing to PRA. Sponsor will bear all costs incurred by PRA in complying
    with any such written instructions furnished by Sponsor (provided that disposal or return costs which exceed, in the aggregate, US$
    250, shall require the prior written approval of tire Sponsor). PRA will provide a written estimate to Sponsor, and Sponsor will
    provide written approval, of all such costs prior to any action by PRA. PRA shall use all reasonable efforts to destroy all notes,
    summaries, analyses and reports made by PRA’s employees, agents and consultants containing such Sponsor Information. Provided,
    however, that PRA shall be entitled to retain in confidence under this Agreement one archived copy of Sponsor Information solely
    for the purpose of administering PRA’s obligations under this Agreement and Sponsor Information contained in PRA’s electronic
    back-up files that are created in the normal course of business pursuant to PRA’s standard protocol for preserving its electronic
    records.


 




    	14



    	Horn & Co. Final, May 3, 2018	 



    

 


	9.4	Data
    Privacy
	 	 	 
	 	Definitions.
    For the purpose of this Section 9.4, ‘Personal Data’, ‘Process/Processing’, ‘Data Controller’,
    ‘Data Processor’ and ‘Data Subject’ shall have the same meaning as in Directive 95/46/EC of the European
    Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data
    and on the free movement of such data (“Directive 95/46/EC”) as implemented in the law of any EU Member State which is
    applicable to the provision of the Services or as defined in the law of any other country which is applicable to the provision of
    the Services (including, as applicable, the Regulation (EU) 2016/679 of the European Parliament and the Council of 27 April 2017
    (“GDPR”), the Health Insurance Portability and Accountability Act of 1996 (HIPAA) Privacy and Security Rules, 45 C.F.R.
    Parts 160-164, and the Health Information Technology for Economic and Clinical Health Act (HITECH), P.L. No. 111-005, Part I, Title
    XIII, Subpart D, 13401-13409, and state privacy laws) (collectively referred to as the “Applicable Data Privacy Laws”).
	 	 	 
	 	Compliance.
    Each Party warrants to the other that it will Process the Personal Data in compliance with all Applicable Data Privacy Laws.
	 	 	 
	 	Data
    Processing Agreement, attached hereto as Exhibit C, shall be incorporated into and an effective part of the Task Order and this Agreement.
    The Parties will execute the Annexes to the Data Processing Agreement with each Task Order.
	 	 	 
	 	Data
    Processing. Sponsor and PRA acknowledge that Sponsor is the Data Controller and PRA is the Data Processor with respect to the Processing
    of Personal Data relating to the Services provided under this Agreement. PRA shall Process the Personal Data only in accordance with
    the written instructions from Sponsor or as may be required or permitted by law (the instructions may be specific instructions or
    instructions of a general nature as set out in this Agreement, a Task Order, the Protocol, or as otherwise notified by Sponsor to
    PRA during the term hereof).
	 	 	 
	 	Security.
    PRA shall implement appropriate technical and organizational measures to protect the Personal Data as required by GCP and Applicable
    Data Privacy Laws.
	 	 	 
	 	Data
    Privacy Requests. PRA shall promptly notify Sponsor in writing if it receives any communication with regard to data privacy relating
    to the Services from a Data Subject, a privacy authority or other regulatory authority, and provide Sponsor with cooperation and
    assistance in relation to any such communication from Data Subjects. PRA shall be entitled to charge Sponsor for such assistance,
    at its usual hourly rate, unless the communication relates to a breach or violation by PRA of its obligations under this Section
    9.4. However, PRA and Sponsor recognize that any fees charged to the requesting Party must comply with Applicable Data Privacy Laws.
	 	 	 
	 	Security
    Breaches, If PRA becomes aware of any breach of an Applicable Data Privacy Law at PRA or its sub-processors relating to the Services,
    then it shall promptly notify Sponsor and, if requested, assist Sponsor with investigating the breach and in meeting any obligations
    under Applicable Data Privacy Law to notify Data Subjects, regulatory authorities or other required parties, as applicable. PRA shall
    be entitled to charge Sponsor for such assistance, at its usual hourly rate, unless PRA was solely responsible for such breach.
	 	 	 
	 	Data
    transfers. PRA shall only Process or otherwise transfer Personal Data outside the European Economic Area (“EEA”) (member
    states of the European Union plus, Norway, Iceland & Liechtenstein) as necessary to provide Services under this Agreement, or
    any Task Order or where otherwise instructed by Sponsor. The Sponsor acknowledges that PRA operates a global IT network with primary
    servers based in the US. In addition, some of the Services performed for the Sponsor with include cloud-based software systems. Sponsor
    hereby approves and authorizes PRA to make such transfers. PRA shall work with Sponsor to ensure the lawful export of Personal Data
    under appropriate cross border transfer mechanisms, which may be structured in a separate agreement between the Parties. In providing
    Services, it may be necessary to sub-contract certain tasks to one or more third party vendors, including cloud based service providers,
    whose servers may be located outside the EEA. Transfers of Personal Data to said vendors shall be made on the basis of Data Subject
    consent and/or through a commitment by the vendor to comply with the appropriate cross border transfer mechanisms.


 




    	15



    	Horn & Co. Final, May 3, 2018	 



    

 


	10.0	Publicity
	 	 	 
	 	Sponsor
    may use, refer to and disseminate reprints of scientific, medical and other published articles which disclose the name of PRA consistent
    with applicable international copyright laws, provided such use does not constitute an endorsement of any commercial product or service
    by PRA. Neither party will disclose publicly or utilize in any advertising or promotional materials or media the existence of this
    Agreement or its association with the other, or use of the other party’s name or the name of any of the other party’s
    Affiliates, divisions, subsidiaries, products or investigations without the prior written permission of the other party, provided
    however, that PRA may use the name of Sponsor in its list of customers. Further, either Party may make such public disclosures as
    it determines, based on advice of counsel, are reasonably necessary to comply with laws or regulations in which case the disclosing
    Party shall provide the other Party with reasonable advance notice of such required public announcement, and provided further that
    Sponsor shall be entitled to disclose the existence and terms of this Agreement in the course of due diligence enquiries subject
    to standard confidentiality undertakings.
	 	 	 
	11.0	Indemnification
	 	 	 
	11.1	Sponsor’s
    Agreement
	 	 	 
	 	a.	Sponsor
    will indemnify, defend and hold harmless PRA, its Affiliates, and their officers, directors, agents, employees, and independent contractors
    approved by Sponsor (each an “Indemnitee”) against any claim, suit, action, proceeding, arbitration or investigation,
    pending or threatened by a third party (each a “Claim”) against Indemnitees relating to the Services, including but not
    limited to court costs, reasonable legal fees, awards or settlements.
	 	 	 
	 	b.	Under
    no circumstances, however, will Sponsor accept liability on behalf of PRA, or otherwise enter into any settlement agreement that
    attributes fault or negligence to PRA without prior written consent of PRA, not to be unreasonably withheld. PRA will fully cooperate
    and aid in any such defense.
	 	 	 
	 	c.	Sponsor
    will not indemnify, defend, or hold harmless PRA against any Claim to the extent that such Claim arose as a result of PRA’s
    negligence, recklessness, intentional misconduct, or material breach of this Agreement or any Task Order hereunder. Under such circumstances
    PRA will repay to Sponsor all reasonable defense costs incurred by Sponsor on its behalf.


 




    	16



    	Horn & Co. Final, May 3, 2018	 



    

 


	11.2	PRA’s Agreement
	 	 	 	 
	 	PRA will indemnify, defend and hold harmless Sponsor and its employees, officers, and directors against any and all losses, costs, expenses and damages, including but not limited to reasonable attorney’s fees, based on a Claim resulting from PRA’s negligence, intentional misconduct, or material breach of this Agreement or any Task Order hereunder.
	 	 	 	 
	 	a.	 Under no circumstances, however, will PRA accept liability, on behalf of Sponsor or enter into any settlement agreement that attributes fault or negligence to Sponsor without prior written consent of Sponsor, not to be unreasonably withheld. Sponsor will fully cooperate and aid in any such defense.
	 	 	 	 
	 	b.	 PRA will not indemnify, defend or hold harmless Sponsor against any Claim to the extent that such Claim arose as a result of Sponsor’s negligence, recklessness, intentional misconduct, or material breach of this Agreement or any Task Order hereunder. Under such circumstances Sponsor will repay to PRA all reasonable defense costs incurred by PRA on its behalf.
	 	 	 	 
	11.3	Indemnification Procedure
	 	 	 	 
	 	Each indemnified Party shall give the indemnifying Party prompt notice of any Claim for which indemnification is sought hereunder; provided, that the failure to give such notice will not relieve the indemnifying Party of its indemnification obligation under this Section 11 except to the extent, if at all, it is prejudiced thereby. The indemnifying Party shall have the right to control the defense and settlement of a Claim, provided the indemnifying Party shall act reasonably and in good faith with respect to all matters relating to the settlement or disposition of the Claim, and the indemnified Party shall reasonably cooperate in the investigation, defense and settlement of such Claim. In the event that representation of indemnified Party and the indemnifying Party by the same counsel is a conflict of interest for such counsel, the indemnified Party may select its own independent counsel, at the indemnifying Party’s expense, without relieving the indemnifying Party of its obligations under this Section 11.
	 	 	 	 
	11.4	Limits of Liability
	 	 	 	 
	 	Both Parties’ liability for direct damages hereunder will not exceed twice the total fees for Services, excluding pass-through expenses and investigator grants, payable by Sponsor to PRA under the applicable Task Order with the exception of the indemnification obligation set forth in Section 11.2 and 11.1 (respectively) above. In no event will either Party be liable to the other for any indirect, incidental, special, or consequential damages or lost profits arising out of this Agreement or Task Order, even if a Party has been advised of the possibility of such damages, provided however, that such limitation shall not apply with respect to damages which result from breach of Sections 8 and the Confidentiality obligations under 9 hereunder.
	 	 	 	 
	11.5	Insurance
	 	 	 	 
	 	a.	 Sponsor Insurance. During the term of this Agreement, for as long as Company is conducting clinical trials, and for a period of three (3) years following the termination or completion of such clinical trials, Sponsor shall maintain in full force and effect the following program of insurance:
	 	 	 	 
	 	 	i.	products
    liability insurance covering clinical trials activity with limits of not less than Five Million Dollars ($5,000,000); and
	 	 	 	 
	 	 	ii.	Clinical
    trials insurance in compliance with local compulsory requirements
	 	 	 	 
	 	PRA may from time to time request evidence confirming such insurance.


 




    	17



    	Horn & Co. Final, May 3, 2018	 



    

 


	 	b.	 PRA Insurance. PRA shall at all times during the term of this Agreement and for an extended period of three (3) years, provide and maintain at its own expense, the following types of insurance:
	 	 	 	 
	 	 	i.	Professional
    Liability: Professional Liability covering all professional acts, errors and omissions in an amount of not less than Five Million
    Dollars ($5,000,000) per occurrence and in the aggregate.
	 	 	 	 
	 	 	ii.	General
    Liability: Commercial General Liability insurance against claims for bodily injury and property damage in an amount of not less than
    One Million Dollars ($1,000,000) per occurrence, Two Million Dollars ($2,000,000) in the aggregate, and Ten Million Dollars ($10,000,000)
    in excess or umbrella coverage.
	 	 	 	 
	 	 	iii.	Workers
    Compensation and Employers’ Liability: To comply with the statutory requirements of the state(s) in which the Services are
    performed.
	 	 	 	 
	 	 	iv.	Employer’s
    liability insurance with a limit of not less than one million dollars (US$1,000,000);
	 	 	 	 
	 	c.	 General Terms
	 	 	 	 
	 	d.	 Insurance required herein will be underwritten by insurers with A. M. Best ratings of not less than A- (Excellent).
	 	 	 	 
	 	e.	 Throughout the term, each party will provide the other party with at least thirty (30) days advance written notice of cancellation, non-renewal or material reduction of the insurance required herein.
	 	 	 	 
	 	f.	 Upon request, each will provide with a valid, current certificate of insurance as evidence of the insurance required herein.
	 	 	 	 
	 	g.	 Nothing in this Section 11.5 shall be construed as limiting each party’s obligations elsewhere under this Agreement. Such insurance may be provided on a claims-made basis (with the exception of workers compensation and employers’ liability), however, such insurance shall have a retroactive date prior to the date that any work will be performed pursuant to the Agreement.
	 	 	 	 
	12.0	Independent
    Contractor Relationship
	 	 	 	 
	 	PRA and Sponsor are independent contractors. Nothing in this Agreement will be construed to create the relationship of partners, joint venturers, or employer and employee between PRA and Sponsor or PRA’s employees. Neither Party, nor its employees, or independent contractors will have authority to act on behalf of or bind the other Party in any manner whatsoever unless otherwise authorized in this Agreement or in a separate writing signed by both Parties.
	 	 	 	 
	13.0	Employees
	 	 	 	 
	 	Neither Party, during the term of this Agreement and for twelve months thereafter, will, without the prior written consent of the other Party, directly or indirectly solicit for employment or contract, attempt to employ or contract with or assist any other entity in employing, contracting with or soliciting for employment or contract any employee or executive who is at that time employed/contracted by the other Patty and who had been employed/contracted by the other Party in connection with one or more Task Orders issued hereunder. Provided, however, that the foregoing provision will not prevent either Party from conducting solicitation via a general advertisement for employment that is not specifically directed to any such employee or from employing any such person who responds to such solicitation.


 




    	18



    	Horn & Co. Final, May 3, 2018	 



    

 


	14.0	Notices



 


Except
as otherwise provided, all communications and notices required under this Agreement will be mailed by email, first class mail or sent
via nationally recognized overnight courier to the addresses set forth below, or to such other addresses as the Parties from time to
time specify in writing.


 


	 	If
    to Sponsor:	If
    to PRA:
	 	BioSight
    Ltd.	Pharmaceutical
    Research Associates, Inc.
	 	1
    Hayarden St., Airport City	4130
    ParkLake Avenue
	 	P.O.B
    1083	Suite
    400
	 	Lod
    7019802, Israel	Raleigh,
    NC 27612
	 	 	Attn:
    Vice President of Legal Affairs


 


	15.0	Force
                                            Majeure



 


If
the performance of this Agreement by PRA or Sponsor is prevented, restricted, interfered with or delayed (either totally or in part)
by reason of any cause beyond the control of the Parties (including, but not limited to, acts of God, explosion, disease, weather, war,
insurrection, terrorism, civil strike, riots or extensive power failure), the Party so affected will, upon giving notice to the other
Party as soon as is practical, be excused from such performance to the extent of such prevention, restriction, interference or delay,
provided that the affected Party will use reasonable efforts to avoid or remove such causes of non-performance and will continue performance
whenever such causes are removed.


 


	16.0	Governing
                                            Law



 


This
Agreement will be governed in all respects by the laws of England and Wales without regard to its conflict of laws principles.


 


	17.0	Severability



 


If
any of the provisions or a portion of any provision of this Agreement is held to be unenforceable or invalid by a court of competent
jurisdiction, the validity and enforceability of the enforceable portion of any such provision and/or the remaining provisions will not
be affected thereby.


 


	18.0	Assignment



 


Neither
Party may assign this Agreement without the prior written consent of the other party, which consent will not be unreasonably withheld;
provided, however, that either party may assign all of its rights and obligations under this Agreement without consent to a successor
in interest to substantially all of the business of that party to which the subject matter of this Agreement relates upon delivery to
the other Party of notice of such assignment and provided that such assignment shall not adversely affect the non assigning Party.


 


	19.0	Waiver



 


No
waiver of any term, provision or condition of this Agreement whether by conduct or otherwise in any one or more instances will be deemed
to be construed as a further or continuing waiver of such term, provision or condition or of any other term, provision or condition of
this Agreement.


 




    	19



    	Horn & Co. Final, May 3, 2018	 



    

 


	20.0	Entire
                                            Agreement



 


This
Agreement, including all Exhibits hereto contains the full understanding of the Parties with respect to the Services and supersedes all
existing Agreements and all other oral, written or other communications between the Parties concerning the subject matter hereof. This
Agreement will not be modified in any way except in writing and signed by a duly authorized representative of Sponsor and an authorized
officer of PRA.


 


	21.0	English
                                            Language



 


The
Parties hereto confirm that this Agreement as well as any other documents relating hereto, including notices, have been and shall be
drawn up in the English language only.


 


	22.0	Counterparts



 


This
Agreement may be executed in several counterparts, each of which will be deemed an original but all of which will constitute one and
the same instrument.


 


	23.0	ARBITRATION



 


In
the event a dispute relating to this Agreement or any Task Order arises between the Parties, the Parties will use all reasonable efforts
to resolve the dispute through direct discussions for a period of thirty (30) business days. The senior management of each Party is committed
to respond to any such dispute. Subsequent to such thirty-day period, any dispute, controversy or claim arising out of or relating to
this Agreement may be settled by arbitration. If arbitration is being conducted shall be in accordance with the International Chamber
of Commerce (“ICC”) Arbitration Rules as of present in force and shall be held at London, England in the English language
by one arbitrator. The appointing authority shall be the ICC acting in accordance with the Rules adopted by the ICC for this purpose.


 


The
undersigned have executed this Agreement as of the Effective Date.


 


	 	Pharmaceutical
    Research Associates, Inc.	 	Biosight
    Ltd.
	 	 	 	 	 	 
	 	By	/s/
    Michael Wolfgang	 	By	/s/
    Ruth Ben Yakar
	 	Name	Michael
    Wolfgang	 	Name	Ruth
    Ben Yakar
	 	Title	Vice
    President of Finance	 	Title	CEO
	 	 	Date
    5/3/2018	 	 	Date
    


 


LIST
OF EXHIBITS


 


	Exhibit A:	Form of Task Order – Product Registration
	 	 
	Exhibit B:	Form of Amendment
	 	 
	Exhibit C:	Standard Contractual Clauses




 




    	20



    	Horn & Co. Final, May 3, 2018	 



    

 


EXHIBIT
A:



FORM OF TASK ORDER (Product Registration)


 


Task
Order Number: _______


 


Sponsor
Project Number: ___________


 


This
Task Order is made and entered into on <Month> <Day>, <Year>, (the “Effective Date”), by and between BioSight
Ltd., a corporation of Israel ________ with offices at Hayarden St., Airport City, P.O.B 1083 Lod 7019802, Israel (hereinafter referred
to as “Sponsor”) and Pharmaceutical Research Associates, Inc., a corporation of the Commonwealth of Virginia, with
offices at 4130 ParkLake Avenue, Suite 400, Raleigh, NC 27612 (hereinafter referred to as “PRA”).


 


WHEREAS,
Sponsor and PRA have entered into that certain Master Agreement for Clinical Trials Management Services dated the <day> of <month>,
200_ (hereinafter referred to as the “Master Agreement”); and


 


WHEREAS,
pursuant to the Master Agreement, PRA has agreed to perform certain Services in accordance with Task Orders from time to time entered
into by the Parties, as more fully provided in Section 2 of the Master Agreement, and Sponsor and PRA now desire to enter into such a
Task Order.


 


WHEREAS,
PRA and Sponsor desire that PRA provide certain Services with respect to a _________________________________________________________________,
(the “Study”) for the study of the drug _________________________________ (“Study Drug”) as set out in the Protocol
titled: _____________________, which is incorporated herein by reference (the “Protocol”).


 


NOW,
THEREFORE, in consideration of the mutual covenants contained herein, the parties hereby agree as follows:


 


1. Project
Specifications. PRA will perform the services described in the Project Specifications, attached hereto as Appendix A, in
accordance with the Project Schedule, attached hereto as Appendix B and any other documents attached to this Task Order
(“Services”).


 


2. Compensation.
For performance of these Services, Sponsor will pay to PRA the amounts described in the Budget for Services and Pass-Through Budget
set forth in Appendix C, which amounts will be payable pursuant to the Payment Schedule set forth in Appendix D.


 


3. Term
and Termination. The term of this Task Order will commence upon its execution by PRA and Sponsor and will continue until
completion of the Services described in Appendix A, provided, however, that either party may terminate this Task Order in accordance
with Section 4, Term and Termination, of the Master Agreement.


 


4. Designated
Contact Persons and Key Personnel. The PRA Project Manager and Key Personnel who will oversee the Services in accordance with
the Master Agreement are identified in Appendix E, Designated Contact Persons and Key Personnel.


 


5. Incorporation
by Reference; Conflict. The provisions of the Master Agreement are hereby expressly incorporated by reference into and made a
part of this Task Order. In the event of a conflict between the terms and conditions of this Task Order and those of the Master
Agreement, the terms of the Master Agreement will take precedence and control unless in the event that the Task Order explicitly
provides otherwise.


 




    	21



    	Horn & Co. Final, May 3, 2018	 



    

 


IN
WITNESS WHEREOF, the parties have hereunto signed this Task Order as of the Effective Date.


 


	Pharmaceutical Research Associates, Inc.	 	BioSight Ltd.
	 	 	 
	By:	                             	 	By:	                           
	Name:	 	 	Name:	 
	Title:	 	 	Title:	 
	Date:	 	 	Date:	 


 


	List
    of Appendices
	 	 
	Appendix
    A:	Project
    Specifications
	Appendix
    B:	Project
    Schedule
	Appendix
    C:	Budget
    for Services and Pass-Through Budget
	Appendix
    D:	Payment
    Schedule
	Appendix
    E:	Designated
    Contact Persons and Key Personnel Designation


 




    	22



    	Horn & Co. Final, May 3, 2018	 



    

 


EXHIBIT
B



FORM OF AMENDMENT


 


AMENDMENT
# 


 


Task
Order # 


 


Protocol
#


 


THIS
AMENDMENT #1 (“Amendment #1”), dated <Month> <Day>, <Year> (the “Effective Date”), by and
between Pharmaceutical Research Associates, Inc., together with its affiliates, with offices at 4130 ParkLake Avenue, Suite 400,
Raleigh, NC 27612 (“PRA”) and BioSight Ltd., a corporation of Israel, with offices at Hayarden St., Airport City,
P.O.B 1083 Lod 7019802, Israel (“Sponsor”).


 


W
I T N E S S E T H:


 


WHEREAS,
under the terms of a certain Master Agreement for Clinical Trials Management Services (the “Master Agreement”), dated the
____ day of ________, 201_ by and between the parties, Sponsor agreed to retain PRA, and PRA agreed to be retained by Sponsor, to perform
the Services as more particularly described in the Master Agreement pursuant to the terms of Task Orders to be issued from time to time;
and


 


WHEREAS,
the parties entered into Task Order #___, dated (the “Task Order”) for the performance of Services as more pertaining to
Sponsor’s protocol ________;


 


WHEREAS,
the parties hereto have entered into certain additional agreements with respect to modification of the Task Order, and which they desire
to memorialize in this Amendment


 


NOW,
THEREFORE, in consideration of the premises and of the following mutual promises, covenants and conditions hereinafter set forth,
the parties hereto agree as follows:


 


1. Project
Specifications. [Use the following if work is to be added to the existing scope of work. If the old scope no longer applies, and
a completely new Scope of work is necessary, the old specifications should be stricken and replaced by the new ones.] The Services
to be provided by PRA pursuant to the Task Order are hereby amended by inclusion of the Services described in Amendment Appendix
___, “Additional Project Specifications”, which is attached hereto and incorporated herein by reference.


 


2. Project
Schedule. The Project Schedule, attached to the Task Order as Appendix ___, is hereby stricken and replaced by the Amended
Project Schedule, attached hereto as Amendment Appendix ___, “Amended Project Schedule”, which is incorporated herein by
reference.


 


3. Budget
and Payment Schedule, [Each revised Budget should show the following, on one chart; Budget from the original contract, new
amounts added or subtracted, and new total budget. This should follow the format of the original contract.] Therefore, the following
changes to the Agreement are hereby made:


 


		a.	The
                                            Budget for Services, attached to the Task Order as Appendix ___, is hereby stricken and replaced
                                            by the “Amended Budget”, attached hereto as Amendment Appendix __, which is incorporated
                                            herein by reference.



 


		b.	The
                                            Payment Schedule, attached to the Task Order as Appendix ___, is hereby stricken and replaced
                                            by the “Amended Payment Schedule”, attached hereto as Amendment Appendix ___,
                                            which is incorporated herein by reference.



 


4. Designated
Contact Persons and Key Personnel. [If there have been changes to the designated people or Key Personnel members, use the
following] The staff assigned to the Study has changed, Therefore, the Designated Contact Persons and Key Personnel, attached to the
Task Order as Appendix ___, is hereby stricken and replaced by the “Amended Designated Contact Persons and Key
Personnel” attached hereto as Amendment Appendix ___, which is incorporated herein by reference.


 


5. Ratification
of Balance of Task Order. In all other respects, the terms of the Task Order are hereby ratified and affirmed by each of the
parties hereto.


 


6. Headings.
The headings in this Amendment # are for convenience of reference only and will not affect its interpretation.


 




    	23



    	Horn & Co. Final, May 3, 2018	 



    

 


IN
WITNESS WHEREOF, the parties hereto, each by a duly authorized representative, have executed this Amendment # as of the Effective Date,


 


	PHARMACEUTICAL
    RESEARCH ASSOCIATES, INC.	 	BioSight
    Ltd.
	 	 	 
	By:	                                           	 	By:	                       
	Name:	 	 	Name:	 
	Title:	 	 	Title:	 
	Date:	 	 	Date:	 


 


List
of Appendices:


 


	Amendment Appendix A:	Additional Project Specifications
	Amendment Appendix B:	Amended Project Schedule
	Amendment Appendix C:	Amended Budget
	Amendment Appendix D:	Amended Payment Schedule
	Amendment Appendix E:	Amended Contact Persons and Key Personnel




 




    	24



    	Horn & Co. Final, May 3, 2018	 



    

 


EXHIBIT
C



European Data Processing Agreement


 


This
Data Processing Agreement (“DPA”) is entered into by and between:


 


	a)	Biosight
                                            Ltd, having its principal place of business at 1 Hayarden St., Airport City, P.O.B 1083 Lod
                                            7019802, Israel (“Controller”)
	 	 
	b)	Pharm
                                            Research Associates (UK) Ltd. having its principal place of business at 500 South Oak Way,
                                            Green Park, Reading, Berkshire, RG2 6AD (“Processor” or “PRA”)



 


each
a “Party”, together the “Parties”.


 


BACKGROUND


 


Under
the Agreement for Clinical Trials Management Services concluded by and between the Parties on the date of [insert date] (the “Agreement”),
Processor agreed to provide Controller with the services as further specified in Annex 1 to this DPA (the “Services”).


 


	WHEREAS,	Controller
    is a private pharmaceutical development company
	 	 
	WHEREAS,	Processor
    is a pharmaceutical research group of companies.
	 	 
	WHEREAS,	in
    rendering the Services, Processor may from time to time be provided with, or have access to information of Controller’s Personal
    Data or personally identifiable information within the meaning of Applicable Data Protection Law;
	 	 
	WHEREAS,	Controller
    engages PRA as an appointed Processor acting on behalf of Controller;
	 	 
	WHEREAS,	this
    DPA contains the terms and conditions applicable to the collection, processing and use of such Personal Data by PRA as the appointed
    Processor of Controller with the aim to ensure that the Parties comply with Applicable Data Protection Law;
	 	 
	WHEREAS,	if
    Controller is located outside the European Union (“EU”)/European Economic Area (“EEA”) the
    Parties also wish to adduce adequate safeguards in connection with transfers of Personal Data and therefore additionally agree to
    enter into the Standard Contractual Clauses for the transfer of Personal Data to Processors established in third countries (“Standard
    Contractual Clauses”) pursuant to Commission Decision 2010/87/EC of 5 February 2010 (Part 2).
	 	 
	WHEREAS,	Controller
    also means data exporter and Processor also means data importer.
	WHEREAS,	for this purpose, the DPA consists of the following parts:






 


	 	Part
    1	Data
    Processing Agreement to comply with the requirements for the appointed Processor of Personal Data
	 	 	 
	 	Part
    1 - Annex 1	Details
    of data processing
	 	 	 
	 	Part
    1 - Annex 2	Technical
    and Organisational Security Measures
	 	 	 
	 	Part
    2	Standard
    Contractual Clauses (unmodified version)
	 	 	 
	 	Part
    2 – Appendix 1	Description
    of data processing operations
	 	 	 
	 	Part
    2 – Appendix 2	Technical
    and Organizational Security Measures


 


	WHEREAS,	in
    the event of inconsistencies between the provisions of this DPA and any other agreements between the Parties, the provisions of this
    DPA shall prevail with regard to the Parties’ data protection obligations. In case of inconsistencies between this DPA and
    the Standard Contractual Clauses, the Standard Contractual Clauses shall prevail.


 




    	25



    	Horn & Co. Final, May 3, 2018	 



    

 


Part
1 - Data Processing Agreement


 


	1.	Definitions



 


For
the purposes of this DPA:


 


	 	“Applicable
    Data Protection Law”	 	shall
    mean the international and local legislation protecting the fundamental rights and freedoms of individuals and, in particular, their
    right to privacy with respect to the Processing of Personal Data applicable to Controller and Processor; the term Applicable Data
    Protection Law shall encompass the GDPR. as of May 25, 2018;
	 	 	 	 
	 	“Controller”	 	shall
    mean the entity that determines as a legal person alone or jointly with others the purposes and means of the Processing of Personal
    Data;
	 	 	 	 
	 	“General
    Data Protection Regulation” or “GDPR”	 	shall
    mean the Regulation (EU) 2016/679 of the European Parliament and of the Council of April 27, 2016 on the protection of natural persons
    with regard to the Processing of Personal Data and on the free movement of such data which will apply as of May 25, 2018;
	 	 	 	 
	 	“Member
    State”	 	shall
    mean a country belonging to the EU;
	 	 	 	 
	 	“Personal
    Data”	 	shall
    mean any information relating to an identified or identifiable natural person (“Data Subject”); an identifiable
    person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification
    number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic,
    cultural or social identity of that natural person;
	 	 	 	 
	 	“Personal
    Data Breach”	 	shall
    mean a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure, or access
    to Personal Data transmitted, stored or otherwise Processed;
	 	 	 	 
	 	“Process/Processing”	 	shall
    mean any operation or set of operations which is performed on Personal Data or on sets of Personal Data, whether or not by automated,
    means, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use,
    disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction;
	 	 	 	 
	 	“Processor”	 	shall
    mean PRA who Processes Personal Data on behalf of Controller;
	 	 	 	 
	 	“Special
    Categories of Data”	 	shall
    mean data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership; genetic
    data, biometric data Processed for the purpose of uniquely identifying a natural person; data concerning health or data concerning
    a natural person’s sex life or sexual orientation;


 




    	26



    	Horn & Co. Final, May 3, 2018	 



    

 


	 	“Standard
    Contractual Clauses”	 	shall
    mean the Standard Contractual Clauses as adopted by the European Commission and as adapted from time to time.
	 	 	 	 
	 	“Subprocessor”	 	shall
    mean any data processor engaged by Processor who agrees to receive from Processor Personal Data exclusively intended for Processing
    activities to be carried out on behalf of Controller in accordance with its instructions, the terms of this DPA (including the Standard
    Contractual Clauses, if applicable) and the terms of the written subcontract;
	 	 	 	 
	 	“Supervisory
    Authority”	 	shall
    mean an independent public authority which is established by a Member State pursuant to Article 51 of the GDPR; and
	 	 	 	 
	 	“Technical
    and Organizational Security Measures”	 	shall
    mean those measures aimed at protecting Personal Data against accidental destruction or accidental loss, alteration, unauthorized
    disclosure or access, in particular where the Processing involves the transmission of data over a network, and against all other
    unlawful forms of Processing.


 


	2.	Details
                                            of the Processing



 


The
details of the Processing operation provided by Processor to Controller as appointed Processor (e.g., the subject-matter of the Processing,
the nature and purpose of the Processing, the type of Personal Data nod categories of Data Subjects) are specified in Part 1 Annex 1
to this DPA,


 


	3.	Rights
                                            and Obligations of Controller



 


		a.	Controller
                                            remains the responsible data controller for the Processing of the Personal Data.



 


		b.	Controller
                                            is entitled to instruct Processor in connection with the Processing of the Personal Data,
                                            generally or in the individual case. Instructions may also relate to the correction, deletion,
                                            blocking of the Personal Data. Upon request, Controller shall specify its order, instructions
                                            and comments more precisely.



 


	4.	Obligations
                                            of Processor



 


Processor
shall:


 


		a.	Comply
                                            with and act on any written instruction from and on behalf of the Controller regarding the
                                            Processing of Personal Data. Such obligation also applies to the transfer of Personal Data
                                            to a third country. Processor shall transfer Personal Data to the US via its IT Network.
                                            Instructions are provided in the Agreement, this DPA and/or otherwise in documented form.
	 	 	 
		b.	Not
                                            Process Personal Data for any other purposes other than to provide the Services to Controller.
	 	 	 
		c.	Immediately
                                            notify Controller, where Processor in its opinion believes that an instruction of Controller
                                            would result in a violation of Applicable Data Protection Law and request Controller to withdraw,
                                            amend or confirm the relevant instruction. Pending the decision on the withdrawal, amendment
                                            or confirmation of the relevant instruction, Processor shall be entitled to suspend the implementation
                                            of the relevant instruction.



 




    	27



    	Horn & Co. Final, May 3, 2018	 



    

 


		d.	Ensure
                                            that persons authorized by Processor to Process the Personal Data on behalf of Controller
                                            are suitably informed, trained and instructed in respect of Applicable Data Protection Law
                                            and have committed themselves in writing to confidentiality or are under an appropriate statutory
                                            obligation of confidentiality. Processor will procure that such authorized persons observe
                                            any Applicable Data Protection Law beyond their respective employment periods.
		e.	Implement
                                            the Technical and Organizational Security Measures which will meet the requirements of Applicable
                                            Data Protection Law as further specified in Annex 2 before Processing the Personal Data and
                                            ensure to provide sufficient guarantees to Controller on such Technical and Organizational
                                            Security Measures.
		f.	Assist
                                            Controller by appropriate Technical and Organizational Security Measures, insofar as this
                                            is possible, for the fulfillment of Controller’s obligation to respond to requests
                                            for exercising Data Subjects’ rights concerning information, access, rectification
                                            and erasure, restriction of Processing, notification, data portability, objection and automated
                                            decision-making.
		g.	Take
                                            actions requested or instructed by Controller in order to comply with Data Subject’s
                                            rights under Applicable Data Protection Law. In particular, Processor must provide the information
                                            on action taken on such request without undue delay, respectively in a timely manner.
		h.	Make
                                            available to Controller all information necessary to demonstrate compliance with the obligations
                                            laid down in this DPA and in Art. 28 GDPR.
		i.	Allow
                                            for and contribute to audits, including inspections conducted by Controller or another auditor
                                            mandated by Controller in accordance with the terms of the Agreement as set out therein or
                                            as may be otherwise specified.
		j.	Notify
                                            Controller without undue delay:



 


		(i)	about
                                            any legally binding request for disclosure of the Personal Data by a law enforcement authority,
                                            unless otherwise prohibited, such as a prohibition under criminal law to preserve the confidentiality
                                            of a law enforcement investigation;
	 	 	 
		(ii)	about
                                            any complaints and requests received directly from Data Subjects (e.g., regarding access,
                                            rectification, erasure, restriction of Processing, data portability, objection to Processing
                                            of data, automated decision-making) without responding to that request, unless it has been
                                            otherwise authorized to do so;
	 	 	 
		(iii)	after
                                            Processor becomes aware of a Personal Data Breach at Processor or its Subprocessors. In case
                                            of such Personal Data Breach, Processor will assist Controller with investigating the Personal
                                            Data Breach and Controller’s obligation under Applicable Data Protection Law to inform
                                            the Data Subjects and the Supervisory Authorities, as applicable, and to document the Personal
                                            Data Breach.



 


		k.	Assist
                                            Controller with any data protection impact assessment and with prior consultation, if any,
                                            that relate to the Services provided by Processor to Controller and the Personal Data Processed
                                            on behalf of Controller.



 




    	28



    	Horn & Co. Final, May 3, 2018	 



    

 


	5.	Subprocessing



 


		a.	Any
                                            subcontract with a third party by which any Services are subcontracted require Controller’s
                                            prior specific or general written consent and must be concluded in writing, including electronic
                                            form.
	 	 	 
		b.	In
                                            case of a general written consent from Controller, Processor must inform Controller about
                                            any intended changes concerning the addition or replacement of Subprocessors, thereby giving
                                            Controller the opportunity to object to such changes,
	 	 	 
		c.	Processor
                                            must ensure contractually that with respect to the subcontracted portion of the Services,
                                            the Subprocessor has corresponding obligations vis-à-vis Controller, in particular
                                            that Subprocessor provides sufficient guarantees to implement appropriate Technical and Organizational
                                            Security Measures in such a manner that the Processing will meet the requirements of Applicable
                                            Data Protection Law.
	 	 	 
		d.	Where
                                            Subprocessor fails to fulfill its data protection obligations, Processor shall remain fully
                                            liable to Controller for the performance of the Subprocessor’s obligations.
	 	 	 
		e.	Controller
                                            shall be entitled to conduct direct audits at Subprocessor and to issue instructions to Subprocessor
                                            directly. Controller shall be entitled to request a copy of the subprocessing agreement.
	 	 	 
		f.	Processor
                                            shall choose Subprocessor diligently.



 


	6.	Duration
                                            and termination



 


		a.	The
                                            term of this DPA is identical with the term of the relevant Agreement. Save as otherwise
                                            agreed herein, termination rights and requirements shall be the same as set forth in the
                                            relevant Agreement.
	 	 	 
		b.	Processor
                                            shall, at the choice of Controller, delete or return all Personal Data to Controller after
                                            the end of the provision of Services, and shall save one copy as required by EU or equivalent
                                            local legislation, in particular the ELI Clinical Trials Regulation 536/2014.



 


	7.	Miscellaneous



 


		a.	A
                                            Determination that any provision of the DPA is invalid or unenforceable shall not affect
                                            the other provisions of the DPA. In such case the invalid unenforceable provision shall automatically
                                            be replaced by a valid and enforceable provision that comes closest to the purpose of the
                                            original provision. The same shall apply if the DPA contains an unintended gap.



 


On
behalf of the Controller: Biosight Limited


 


Name
(written out in full): Ruth Ben Yakar


 


Position:
CEO


 


Address:
1 Hayarden St., Airport City, P.O.B 1083 Lod 701 9802, Israel


 


Signature:
/s/ Ruth Ben Yakar


 


Date:


 


On
behalf of the Processor:


 


Name
(written out in full): Chris Gray & Uri-Ben-Or


 


Position:
VP, Operations Finance – Chief Financial Officer


 


Address:
500 South Oak Way, Green Park, Reading, HG2 GAD


 


Signature:
/s/ Chris Gray - /s/ Uri-Ben-Or


 


Date:4
May 2018


 




    	29



    	Horn & Co. Final, May 3, 2018	 



    

 


Part
1 – Annex 1 – Details of Data Processing


 


	1.	The
                                            Controller is; Biosight Limited



 


Please
specify briefly your activities relevant to the transfer:


 


The
Controller is a pharmaceutical company engaged in the discovery, development, manufacturing and sale of therapeutic products and clinical
studies.


 


	2.	Tile
                                            Processor is: Pharm Research Associates (UK) Limited



 


Please
specify briefly activities relevant lo the transfer:


 


The
Processor is Contract Research Organization in the business of providing professional and state-of-the-art clinical and medical research
services.


 


	3.	Categories
                                            of Data Subjects



 


The
Personal Data transferred concern the following categories of Data Subjects:


 


Study
patient / subject


 


Investigator
/ Investigator site staff


 


	4.	Type
                                            of Personal Data



 


The
Personal Data Processed by Processor on behalf of Controller concern the following categories of Personal Data:


 


	●	health
    information
	 	 
	●	date
    of birth, where applicable
	 	 
	●	management
    of (Serious) Adverse Events
	 	 
	●	CVs
    - clinical experience and qualifications
	 	 
	●	financial
    disclosure/transparency requirements


 


	5.	Special
                                            Categories of Data (if appropriate)



 


The
Personal Data Processed by Processor on behalf of Controller concern the following Special Categories of Data:


 


Key-coded/pseudonymised
health related data of patients.


 


	6.	Processing
                                            Operations



 


The
personal data transferred will be subject to the following basic processing activities (please specify)


 


Processing
of personal data associated with the management of, and scientific analysis for clinical trials and samples.


 




    	30



    	Horn & Co. Final, May 3, 2018	 



    

 


Part
1 - Annex 2 - Technical and Organizational Security Measures


 


Description
of the Technical and Organizational Security Measures implemented by Processor in accordance with Applicable Data Protection Law:


 


This
Annex describes the Technical and Organizational Security Measures and procedures that Processor shall, as a minimum, maintain to protect
the security of Personal Data created, collected, received, or otherwise obtained.


 


Access
Control of Processing Areas


 


Processor
implements suitable measures in order to prevent unauthorized persons from gaining access to the data processing equipment where the
Personal Data is Processed. This is accomplished by;


 


	●	establishing
    security areas;
	 	 
	●	securing
    the data processing equipment;
	 	 
	●	establishing
    access authorizations for staff and third parties, including the respective documentation;
	 	 
	●	access
    to data centres is logged and monitored; and
	 	 
	●	data
    centres are protected by appropriate security measures.


 


Access
Control to Data Processing Systems


 


Processor
implements suitable measures to prevent its data processing systems from being used by unauthorized persons. This is accomplished by:


 


	●	identification
    of the terminal and/or the terminal user to the Processor systems;
	 	 
	●	automatic
    time-out of user terminal if left idle, identification and password required to reopen;
	 	 
	●	automatic
    turn-off of the user ID when several erroneous passwords are entered, log file of events (monitoring of break-in-attempts);
	 	 
	●	issuing
    and safeguarding of access/identification codes;
	 	 
	●	staff
    policies and training in respect of each staff access rights to Personal Data (if any), informing staff about their obligations;
    and
	 	 
	●	utilisation
    of audit trail.


 


Access
Control to Use Specific Areas of Data Processing Systems


 


Processor
commits that the persons entitled to use its data processing system are only able to access the data within the scope and to the extent
covered by its access permission (authorization) and that Personal Data cannot be read, copied or modified or removed without authorization.
This shall be accomplished by:


 


	●	staff
    policies and training in respect of each staff member’s access rights to the Personal Data;
	 	 
	●	allocation
    of individual user accounts;
	 	 
	●	utilisation
    of audit trail;
	 	 
	●	release
    of data to only authorized persons; and
	 	 
	●	control
    of files, controlled and documented destruction of data


 




    	31



    	Horn & Co. Final, May 3, 2018	 



    

 


Availability
Control


 


Processor
implements suitable measures to ensure that Personal Data are protected from accidental destruction or loss. This is accomplished by;


 


	●	infrastructure
    redundancy; and
	 	 
	●	data
    redundancy via data backup;


 


Transmission
Control


 


Processor
implements suitable measures to prevent the Personal Data from being read, copied, altered or deleted by unauthorized parties during
the transmission thereof or during the transport of the data media. This is accomplished by:


 


	●	use
    of appropriate firewall and encryption technologies; and
	 	 
	●	as
    far as possible, all data transmissions are logged and monitored


 


Input
Control


 


Processor
implements suitable measures to ensure that it is possible to check and establish whether and by whom Personal Data have been input into
data processing systems or removed. This is accomplished by:


 


	●	an
    authorization policy for the input of data, as well as for the reading, alteration and deletion of stored data (role based access
    management rules);
	 	 
	●	authentication
    of the authorized personnel;
	 	 
	●	utilization
    of user codes (passwords);
	 	 
	●	all
    users who have access to Personal Data shall reset their passwords as specified in the relevant password policy; and
	 	 
	●	areas
    housing the computer hardware and related equipment are capable of being locked.


 


Processor
System Administrators


 


Processor
implements suitable measures to monitor its system administrators and to ensure that they act in accordance with instructions received.
This is accomplished by;


 


	●	individual
    appointment of system administrators;
	 	 
	●	adoption
    of suitable measures to register system administrators’ access logs and keep them secure, accurate and unmodified for a reasonable
    period; and
	 	 
	●	keeping
    an updated list with system administrators’ identification details (e.g. name, surname, function or organizational area) and
    tasks assigned.


 


Separation
of Processing for Different Purposes


 


Processor
implements suitable measures to ensure that data collected for different purposes and different clients can be Processed separately.
This is accomplished by:


 


	●	access
    to data is separated through application security for the appropriate users; and
	 	 
	●	modules
    within Processor’s database separate which data is used for which purpose, i.e. by functionality and function;


 




    	32



    	Horn & Co. Final, May 3, 2018	 



    

 


Part2
- Standard Contractual Clauses


 


For
the purposes of Article 26(2) of Directive 95/46/EC for the transfer of personal data to processors established in third countries which
do not ensure an adequate level of data protection


 


Clause
1 Definitions


 


For
the purpose of the Clauses:


 


	(a)	“personal
                                            data”, “special categories of data”, “process/processing”,
                                            ‘‘controller”, “processor”, “data subject” and
                                            “supervisory authority” shall have the same meaning as in Directive 95/46/EC
                                            of the European Parliament and of the Council of 24 October 1995 on the protection of individuals
                                            with regard to the processing of personal data and on the free movement of such data;
	 	 
	(b)	“the
                                            data exporter” means the controller who transfers the personal data;
	 	 
	(c)	“the
                                            data importer” means the processor who agrees to receive from the data exporter personal
                                            data intended for processing on his behalf after the transfer in accordance with his instructions
                                            and the terms of the Clauses and who is not subject to a third country’s system ensuring
                                            adequate protection within the meaning of Article 25(1) of Directive 95/46/EC;
	 	 
	(d)	“the
                                            sub-processor” means any processor engaged by the data importer or by any other sub-processor
                                            of the data importer who agrees to receive from the data importer or from any other sub-processor
                                            of the data importer personal data exclusively intended for processing activities to be carried
                                            out on behalf of the data exporter after the transfer in accordance with his instructions,
                                            the terms of the Clauses and the Lerma of the written subcontract;
	 	 
	(e)	“the
                                            applicable data protection law” means the legislation protecting the fundamental rights
                                            and freedoms of individuals and, in particular, their right to privacy with respect to the
                                            processing of personal data applicable to a data controller in the Member Stale in which
                                            the data exporter is established;
	 	 
	(f)	‘‘technical
                                            and organisational security measures” means those measures aimed at protecting personal
                                            data against accidental or unlawful destruction or accidental loss, alteration, unauthorised
                                            disclosure or access, in particular where the processing involves the transmission of data
                                            over a network, and against all other unlawful forms of processing.



 


Clause
2 Details of the transfer


 


The
details of the transfer and in particular the special categories of personal data where applicable are specified in Appendix I which
forms an integral part of the Clauses.


 


Clause
3 Third-party beneficiary clause


 


	1.	The
                                            data subject can enforce against the data exporter this Clause, Clause 4(b) to (i), Clause
                                            5(a) to (c), and (g) to (j), Clause 6(1) and (2), Clause 7, Clause 8(2), and Clauses 9 to
                                            12 as third-party beneficiary.
	 	 
	2.	The
                                            data subject can enforce against the data importer this Clause, Clause 5(a) to (e) and (g),
                                            Clause 6, Clause 7, Clause 8(2), and Clauses 9 to 12, in cases where the data exporter has
                                            factually disappeared or has censed to exist in law unless any successor entity has assumed
                                            the entire legal obligations of the data exporter by contract or by operation of law, as
                                            a result of which it takes on the rights and obligations of the data exporter, in which case
                                            the data subject can enforce them against such entity.
	 	 
	3.	The
                                            data subject can enforce against the sub-processor this Clause, Clause 5(a) to (e) and (g),
                                            Clause 6, Clause 7, Clause 8(2), and Clauses 9 to 12, in cases where both the data exporter
                                            and the data importer have factually disappeared or ceased to exist in law or have become
                                            insolvent, unless any successor entity has assumed the entire legal obligations of the data
                                            exporter by contract or by operation of law as a result of which it takes on the rights and
                                            obligations of the data exporter, in which case the data subject can enforce them against
                                            such entity. Such third-party liability of the sub-processor shall be limited to its own
                                            processing operations under the Clauses.
	 	 
	4.	The
                                            parties do not object to a data subject being represented by an association or other body
                                            of the data subject so expressly wishes and if permitted by national law.



 




    	 



    	Horn & Co. Final, May 3, 2018	 



    

 


Clause
4 Obligations of the data exporter


 


The
data exporter agrees and warrants:


 


	(a)	that
                                            the processing, including the transfer itself, of the personal data has been and will continue
                                            to be carried out in accordance with the relevant provisions of the applicable data protection
                                            law (and, where applicable, has been notified to the relevant authorities of the Member State
                                            where the data exporter is established) and does not violate the relevant provisions of that
                                            State;
	 	 
	(b)	that
                                            it has instructed and throughout the duration of the personal data processing services will
                                            instruct the data importer to process the personal data transferred only on the data exporter’s
                                            behalf and in accordance with the applicable data protection law and the Clauses;
	 	 
	(c)	that
                                            the data importer will provide sufficient guarantees in respect of the technical and organisational
                                            security measures specified in Appendix 2 to this contract;
	 	 
	(d)	that
                                            after assessment of the requirements of the applicable data protection law, the security
                                            measures are appropriate to protect personal data against accidental or unlawful destruction
                                            or accidental loss, alteration, unauthorised disclosure or access, in particular where the
                                            processing involves the transmission of data over a network, and against all other unlawful
                                            forms of processing, and that these measures ensure a level of security appropriate to the
                                            risks presented by the processing and the nature of the data to be protected having regard
                                            to the state of the art and the cost of their implementation;
	 	 
	(e)	that
                                            it will ensure compliance with the security measures;
	 	 
	(f)	that,
                                            if the transfer involves special categories of data, the data subject has been informed or
                                            will be informed before, or as icon as possible after, the transfer that its data could be
                                            transmitted to a third country not providing adequate protection within the meaning of Directive
                                            95/46/EC;
	 	 
	(g)	to
                                            forward any notification received from the data importer or any sub-processor pursuant to
                                            Clause 5(b) and Clause 8(3) to the data protection supervisory authority if the data exporter
                                            decides to continue the transfer or to lift the suspension;
	 	 
	(h)	to
                                            make available to the data subjects upon request a copy of the Clauses, with the exception
                                            of Appendix 2, and a summary description of the security measures, as well as a copy of any
                                            contract for subprocessing services which has to be mode in accordance with the Clauses,
                                            unless the Clauses or the contract contain commercial information, in which case it may remove
                                            such commercial information;
	 	 
	(i)	that,
                                            in the event of subprocessing, the processing activity is carried out in accordance with
                                            Clause 11 by a sub-processor providing at least the same level of protection for the personal
                                            data and the rights of data subject as the data importer under the Clauses; and
	 	 
	(j)	that
                                            it will ensure compliance with Clause 4(a) to (i).



 






    	2



    	Horn & Co. Final, May 3, 2018	 



    

 


Clause
5 Obligations of the data Importer


 


The
data importer agrees and warrants:


 


	(a)	to
                                            process the personal data only on behalf of the data exporter and in compliance with its
                                            instructions and the Clauses; if it cannot provide such compliance for whatever reasons,
                                            it agrees to inform promptly the data exporter of its inability to comply, in which case
                                            the data exporter is entitled to suspend the transfer of data and/or terminate the contract;
	 	 
	(b)	that
                                            it has no reason to believe that the legislation applicable to it prevents it from fulfilling
                                            the instructions received from the data exporter and its obligations under the contract and
                                            that in the event of a change in this Legislation which is likely to have a substantial adverse
                                            effect on the warranties and obligations provided by the Clauses, it will promptly notify
                                            the change to the data exporter as soon as it is aware, in which case the data exporter is
                                            entitled to suspend the transfer of data and/or terminate the contract;
	 	 
	(c)	that
                                            it has implemented the technical and organisational security measures specified in Appendix
                                            2 before processing the personal data transferred;
	 	 
	(d)	that
                                            it will promptly notify the data exporter about:



 


		(i)	any
                                            legally binding request for disclosure of the personal data by a law enforcement authority
                                            unless otherwise prohibited, such as a prohibition under criminal law to preserve the confidentiality
                                            of a law enforcement investigation,
	 	 	 
		(ii)	any
                                            accidental or unauthorised access, and
	 	 	 
		(iii)	any
                                            request received directly from the data subjects without responding to that request, unless
                                            it has been otherwise authorised to do so;



 





	(e)	to
                                            deal promptly and properly with all inquiries from the data exporter relating to its processing
                                            of the personal data subject to the transfer and to abide by the advice of the supervisory
                                            authority with regard to the processing of the data transferred:
	 	 
	(f)	at
                                            the request of the data exporter to submit its data processing facilities for audit of the
                                            processing activities covered by the Clauses which shall be carried out by the data exporter
                                            or an inspection body composed of independent members and in possession of the required professional
                                            qualifications bound by a duty of confidentiality, selected by the data exporter, where applicable,
                                            in agreement with the supervisory authority;
	 	 
	(g)	to
                                            make available to the data subject upon request a copy of the Clauses, or any existing contract
                                            for subprocessing, unless the Clauses or contract contain commercial information, in which
                                            case it may remove such commercial information, with the exception of Appendix 2 which shall
                                            be replaced by a summary description of the security measures in those cases where the data
                                            subject is unable to obtain a copy from the data exporter.
	 	 
	(h)	that,
                                            in the event of subprocessing, it has previously informed the data exporter and obtained
                                            its prior written consent;
	 	 
	(i)	that
                                            the processing services by the sub-processor will be carried out in accordance with Clause
                                            11;
	 	 
	(j)	to
                                            send promptly a copy of any sub-processor agreement it concludes under the Clauses to the
                                            data exporter.





 




    	3



    	Horn & Co. Final, May 3, 2018	 



    




 


Clause
6 Liability


 


	1.	The
                                            parties agree that any data subject, who has suffered damage as a result of any breach of
                                            the obligations referred to in Clause 3 or in Clause 11 by any party or sub-processor is
                                            entitled to receive compensation from the data exporter for the damage suffered.



 


	2.	If
                                            a data subject is not able to bring a claim for compensation in accordance with paragraph
                                            1 against the data exporter, arising out of a breach by the data importer or his sub-processor
                                            of any of their obligations referred to in Clause 3 or in Clause 11. because foe data exporter
                                            has factually disappeared or ceased to exist in law or has become insolvent, the data importer
                                            agrees that the data subject may issue a claim against the data importer as if it were the
                                            data exporter, unless any successor entity has assumed the entire legal obligations of the
                                            data exporter by contract or by operation of law, in which case the data subject can enforce
                                            its rights against such entity.



 


The
data importer may not rely on a breach by a sub-processor of its obligations in order to avoid its own liabilities.


 


	3.	If
                                            a data subject is not able to bring a claim against the data exporter or the data importer
                                            referred to in paragraphs 1 and 2, arising out of a breach by the sub-processor of any of
                                            their obligations referred to in Clause 3 or in Clause 11 because both the data exporter
                                            and the data importer have factually disappeared or ceased to exist in law or have become
                                            insolvent, the sub-processor agrees that the data subject may issue a claim against the data
                                            sub-processor with regard to its own processing operations under the Clauses as if it were
                                            the data exporter or the data importer, unless any successor entity has assumed the entire
                                            legal obligations of the data exporter or data importer by contract or by operation of law,
                                            in which case the data subject can enforce its rights against such entity. The liability
                                            of the sub-processor shall be limited to its own processing operations under the Clauses.



 


Clause
7 Mediation and jurisdiction


 


	1.	The
                                            data importer agrees that if the data subject invokes against it third-party beneficiary
                                            rights and/or claims compensation for damages under the Clauses, the data importer will accept
                                            the decision of the data subject:



 


		(a)	to
                                            refer the dispute to mediation, by an independent person or, where applicable, by the supervisory
                                            authority;



 


		(b)	to
                                            refer the dispute to the courts in the Member State in which the data exporter is established.



 


	2.	The
                                            parties agree that the choice made by the data subject will not prejudice its substantive
                                            or procedural rights to seek remedies in accordance with other provisions of national or
                                            international law.



 


Clause
8 Cooperation with supervisory authorities


 


	1.	The
                                            data exporter agrees to deposit a copy of this contract with the supervisory authority if
                                            it so requests of if such deposit is required under the applicable data protection law.



 


	2.	The
                                            parties agree that (the supervisory authority has the right to conduct an audit of the data
                                            importer, and of any sub-processor, which has the same scope and is subject to the same conditions
                                            as would apply to an audit of the data exporter under the applicable data protection law.



 


	3.	The
                                            data importer shall promptly inform the data exporter about the existence of legislation
                                            applicable to it or any sub-processor preventing the conduct of an audit of the data importer,
                                            or any sub-processor, pursuant to paragraph 2. In such a case the data exporter shall be
                                            entitled to take the measures foreseen in Clause 5 (b).



 


Clause
9 Governing Law


 


The
Clauses shall be governed by the law of the Member State in which the data exporter is established.


 






    	4



    	Horn & Co. Final, May 3, 2018	 



    

 


Clause
10 Variation of the contract


 


The
parties undertake not to vary or modify the Clauses. This does not preclude the parties from adding clauses on business related issues
where required as long as they do not contradict the Clause.


 


Clause
11 Subprocessing


 


	1.	The
                                            data importer shall not subcontract any of its processing operations performed on behalf
                                            of the data exporter under the Clauses without the prior written consent of the data exporter,
                                            Where the data importer subcontracts its obligations under the Clauses, with the consent
                                            of the data exporter, it shall do so only by way of a written agreement with the sub-processor
                                            which imposes the same obligations on the sub-processor as arc imposed on the data importer
                                            under the Clauses. Where the sub-processor fails to fulfil its data protection obligations
                                            under such written agreement the data importer shall remain fully liable to the data exporter
                                            for the performance of the sub-processor’s obligations under such agreement.
	 	 
	2.	The
                                            prior written contract between the data importer and the sub-processor shall also provide
                                            for a third-party beneficiary clause as laid down in Clause 3 for cases where the data subject
                                            is not able to bring the claim for compensation referred to in paragraph 1 of Clause 6 against
                                            the data exporter or the data importer because they have factually disappeared or have ceased
                                            to exist in law or have become insolvent and no successor entity has assumed the entire legal
                                            obligations of the data exporter or data importer by contract or by operation of law. Such
                                            third-party liability of the sub-processor shall be limited to its own processing operations
                                            under the Clauses,
	 	 
	3.	The
                                            provisions relating to data protection aspects for subprocessing of the contract referred
                                            to in paragraph 1 shall be governed by the law of the Member State in which the data exporter
                                            is established.
	 	 
	4.	The
                                            data exporter shall keep a list of subprocessing agreements concluded under the Clauses and
                                            notified by the data importer pursuant to Clause 5(j), which shall be updated at least once
                                            a year. The list shall be available to the data exporter’s data protection supervisory
                                            authority.



 


Clause
12 Obligation after the termination of personal data processing services


 


	1.	The
                                            parties agree that on the termination of the provision of data processing services, the data
                                            importer and the sub-processor shall, at the choice of the data exporter, return all the
                                            personal data transferred and the copies thereof to the data exporter or shall destroy all
                                            the personal data and certify to the data exporter that it has done so, unless legislation
                                            imposed upon the data importer prevents it from returning or destroying all or part of the
                                            personal data transferred. In that case, the data importer warrants that it will guarantee
                                            the confidentiality of the personal data transferred and will not actively process the personal
                                            data transferred anymore.
	 	 
	2.	The
                                            data importer and the sub-processor warrant that upon request of the data exporter and/or
                                            of the supervisory authority, it will submit its data processing facilities for an audit
                                            of the measures referred to in paragraph 1.



 




    	5



    	 



    

 


Signatures:


 


On
behalf of the data exporter: Biosight Limited


 


/s/
Ruth Ben Yakar


Name
(written out in full): Ruth Ben Yakar


Position:
CEO


Address.
1 Hayarden St., Airport City, P.O.B 1083 Lod 7019802, Israel


Other
Information necessary in order for the contract to be binding (If any):


 


Signature____________________________





(stamp
of organization)


 


On
behalf of the data exporter: Importer: Pharm Research Associates (UK) Limited


 


/s/
Chris Gray - /s/ Uri-Ben-Or


Name
(written out in full): Chris Gray – Uri-Ben-Or


Position:
VP, Operations Finance – Chief Financial Officer


Address:
500 South Oak Way, Green Park, Reading, Berkshire RO2 SAD


Other
Information necessary in order for the contract to be binding (If any):


 


Signature____________________________


(stamp
of organization)


 




    	1



    	 



    

 


Part
2 - Appendix 1


 


This
Appendix forms part of the Clauses and must be completed and signed by the parties.


 


Data
exporter


 




The data exporter is: Biosight Limited

(please specify briefly your activities relevant to the transfer):


 


The
data exporter is a pharmaceutical company engaged in the discovery, development, manufacturing and sale of therapeutic products and clinical
studies.


 


Data
importer


 




The data importer is: Pharm Research Associates (UK) Limited

(please specify briefly activities relevant to the transfer):


 


The
data importer is Contract Research Organization in the business of providing professional and state-of-the-art clinical and medical research
services.


 


Data
subjects


 




The personal data transferred concern the following categories of data subjects:


 


Study
patient / subject


 


Investigator
/ investigator site staff


 


Categories
of data


 




The personal data transferred concern the following categories of data:


 


	 	●	Health
    information
	 	 	 
	 	●	Date
    of birth, where applicable
	 	 	 
	 	●	Management
    of (Serious) Adverse Events in compliance with applicable data protection law
	 	 	 
	 	●	CV
    - clinical experience and qualifications
	 	 	 
	 	●	Financial
    disclosure/transparency requirements


 


Special
categories of data (if appropriate)


 




The personal data transferred concern the following special categories of data:


 


Key-coded/pseudonymised
health related data of patients.


 


Processing
operations




 


The personal data transferred will be subject to the following basic processing activities (please
specify):


 


Processing
of personal data associated with the management of, and scientific analysis for clinical trials and samples.


 




    	2



    	 



    

 


Signatures:


 


On
behalf of the data exporter: Biosight Limited


 


/s/
Ruth Ben Yakar


Name
(written out in full): Ruth Ben Yakar


Position:
CEO


Address.
1 Hayarden St., Airport City, P.O.B 1083 Lod 7019802, Israel


Other
Information necessary in order for the contract to be binding (If any):


 


Signature____________________________


(stamp
of organization)


 


On
behalf of the data exporter: Importer: Pharm Research Associates (UK) Limited


 


/s/
Chris Gray – /s/ Uri-Ben-Or


Name
(written out in full): Chris Gray – Uri-Ben-Or


Position:
VP, Operations Finance – Chief Financial Officer


Address:
500 South Oak Way, Green Park, Reading, Berkshire RO2 SAD


Other
Information necessary in order for the contract to be binding (If any):


 


Signature____________________________


(stamp
of organization)


 






    	3



    	 



    

 








Part
2 - Appendix 2


 


This
Appendix forms part of the Clauses and must be completed and signed by the parties.


 


Description
of the technical and organizational security measures implemented by the data importer in accordance with Clauses 4(d) and 5(c).


 


Access
Control of Processing Areas


 


Data
importer implements suitable measures in order to prevent unauthorized persons from gaining access to the data processing equipment where
the Personal Data is Processed. This is accomplished by:


 


	 	●	establishing
    security areas;
	 	 	 
	 	●	securing
    the data processing equipment;
	 	 	 
	 	●	establishing
    access authorizations for staff and third parties, including the respective documentation;
	 	 	 
	 	●	access
    to data centres is logged and monitored; and
	 	 	 
	 	●	data
    centres are protected by appropriate security measures.


 


Access
Control to Data Processing Systems


 


Data
importer implements suitable measures to prevent its data processing systems from being used by unauthorized persons. This is accomplished
by:


 


	 	●	identification
    of the terminal and/or the terminal user to the data importer systems;
	 	 	 
	 	●	automatic
    time-out of user terminal if left idle, identification and password required to reopen;
	 	 	 
	 	●	automatic
    turn-off of the user ID when several erroneous passwords arc entered, log file of events (monitoring of break-in-attempts);
	 	 	 
	 	●	issuing
    and safeguarding of access/identification codes;
	 	 	 
	 	●	staff
    policies and training in respect of each staff access rights to Personal Data (if any), informing staff about their obligations;
    and
	 	 	 
	 	●	utilisation
    of audit trail.


 


Access
Control to Use Specific Areas of Data Processing Systems


 


Data
importer commits that the persons entitled to use its data processing system are only able to access the data within the scope and to
the extent covered by its access permission (authorization) and that Personal Data cannot be read, copied or modified or removed without
authorization. This shall be accomplished by;


 


	 	●	staff
    policies and training in respect of each staff member’s access rights to the Personal Data;
	 	 	 
	 	●	allocation
    of individual user accounts;
	 	 	 
	 	●	utilisation
    of audit trail;
	 	 	 
	 	●	release
    of data to only authorized persons; and
	 	 	 
	 	●	control
    of files, controlled and documented destruction of data


 




    	4



    	 



    

 


Availability
Control


 


Data
importer implements suitable measures to ensure that Personal Data are protected from accidental destruction or loss. This is accomplished
by:


 


	 	●	infrastructure
    redundancy; and
	 	 	 
	 	●	data
    redundancy via data backup;


 


Transmission
Control


 


Data
importer implements suitable measures to prevent the Personal Data from being read, copied, altered or deleted by unauthorized parties
during the transmission thereof or during the transport of the data media. This is accomplished by:


 


	 	●	use
    of appropriate firewall and encryption technologies; and
	 	 	 
	 	●	as
    far as possible, all data transmissions arc logged and monitored


 


Input
Control


 


Data
importer implements suitable measures to ensure that it is possible to check and establish whether and by whom Personal Data have been
input into data processing systems or removed. This is accomplished by:


 


	 	●	an
    authorization policy for the input of data, as well as for the reading, alteration and deletion of stored data (role based access
    management rules);
	 	 	 
	 	●	authentication
    of the authorized personnel;
	 	 	 
	 	●	utilization
    of user codes (passwords);
	 	 	 
	 	●	all
    users who have access to Personal Data shall reset their passwords as specified in the relevant password policy; and
	 	 	 
	 	●	areas
    housing the computer hardware and related equipment are capable of being locked.


 


Data
Importer System Administrators


 


Data
importer implements suitable measures to monitor its system administrators and to ensure that they act in accordance with instructions
received. This is accomplished by:


 


	 	●	individual
    appointment of system administrators;
	 	 	 
	 	●	adoption
    of suitable measures to register system administrators’ access logs and keep them secure, accurate and unmodified for a reasonable
    period; and
	 	 	 
	 	●	keeping
    an updated list with system administrators’ identification details (e.g. name, surname, function or organizational area) and
    tasks assigned.


 


Separation
of Processing for Different Purposes


 


Data
importer implements suitable measures to ensure that data collected for different purposes and different clients can be Processed separately.
This is accomplished by:


 


	 	●	access
    to data is separated through application security for the appropriate users; and
	 	 	 
	 	●	modules
    within data importer’s database separate which data is used for which purpose, i.e. by functionality and function;


 




    	5



    	 



    

 


On
behalf of the data exporter: Biosight Limited


 


/s/
Ruth Ben Yakar


Name
(written out in full): Ruth Ben Yakar


Position:
CEO


Address.
1 Hayarden St., Airport City, P.O.B 1083 Lod 7019802, Israel


Other
Information necessary in order for the contract to be binding (If any):


 


Signature____________________________


(stamp
of organization)


 


On
behalf of the data exporter: Importer: Pharm Research Associates (UK) Limited


 


/s/
Chris Gray - /s/ Uri-Ben-Or


Name
(written out in full): Chris Gray – Uri-Ben-Or


Position:
VP, Operations Finance – Chief Financial officer


Address:
500 South Oak Way, Green Park, Reading, Berkshire RO2 SAD


Other
Information necessary in order for the contract to be binding (If any):


 


Signature____________________________


(stamp
of organization)


 




    	6