Document:

EX-10.18

 Exhibit 10.18 

 

CERTAIN CONFIDENTIAL PORTIONS OF THIS EXHIBIT HAVE BEEN OMITTED AND REPLACED WITH “[***]”. SUCH IDENTIFIED INFORMATION HAS BEEN
EXCLUDED FROM THIS EXHIBIT BECAUSE IT IS (I) NOT MATERIAL AND (II) WOULD LIKELY CAUSE COMPETITIVE HARM TO THE COMPANY IF DISCLOSED. 

FIRST AMENDMENT TO 

COLLABORATION AGREEMENT 

THIS FIRST AMENDMENT (this “Amendment”), dated 8TH April 2019 (the “First Amendment
Effective Date”), by and between GLAXOSMITHKLINE INTELLECTUAL PROPERTY (NO.3) LIMITED, a company registered in England
and Wales (registered number 11480952) with a registered office at 980 Great West Road, Brentford, Middlesex TW8 9GS, United Kingdom (“GSK”) and 23ANDME, INC., a company formed
under the laws of Delaware whose principal place of business is at 899 West Evelyn Ave., Mountain View, CA 94041 (“23andMe”) hereby amends the Collaboration Agreement by and between GSK and 23andMe, dated July 24, 2018 (the
“Agreement”). 
 BACKGROUND 
  

	A.	 GSK and 23andMe each have an ongoing research and development program with respect to the Target CD96 and
intend to combine these programs into a Joint Development Program for which GSK will be the Lead Party; 

  

	B.	 GSK intends to exchange certain GSK Data with 23andMe and the Parties wish to incorporate the new
principles for such exchange into the Data Access Plan; 

  

	C.	 GSK and 23andMe intend to generate Data derived from the combination of certain Level 2 Data, Level 3
Data and Level 4 Data, which may include both 23andMe Data and GSK Data, and have further considered the plans for access to such Data, the principles for which they wish to reflect in an updated Data Access Plan. 

NOW, THEREFORE, in consideration of the mutual covenants set forth in this Amendment, and
for other good and valuable consideration, the receipt of which is hereby acknowledged, GSK and 23andMe hereby agree as follows: 
  

	1	 Capitalized terms used in this Amendment shall have the meanings set forth in the Agreement and the terms and
conditions of this Amendment shall be construed as set forth in Section 21.18 of the Agreement, unless otherwise specifically indicated in this Amendment. 

 

	2	 The Agreement is hereby amended with respect to the CD96 Program as follows: 

 

	 	(a)	 Section 5.1(b) is deleted and replaced in its entirety with: 

“GSK Contributed Program. GSK’s (a) late pre-clinical phase program
directed to [***] is hereby incorporated into the Collaboration as a Joint Development Program as of the Effective Date (the “[***] Program”) and GSK’s late pre-clinical phase
program directed to [***] (the “[***] Program”) is hereby incorporated into the Collaboration as a Joint Development Program as of the First Amendment Effective Date, and in each case GSK shall be the Lead Party with respect
thereto (collectively, the “GSK Contributed Programs”), subject to the terms and conditions generally applicable to all Collaboration 

 
Programs, including as set forth in this Article 5. Joint Development Costs for each GSK Contributed Programs will be shared on [***] basis between the Parties following the date upon
which the Parties agree upon the applicable plan and budget for such GSK Contributed Program under this Section 5.1(b), or in the case of [***], following the date of the [***], subject in each case to any rights of 23andMe
to exercise its Opt-Out Option, Reduction Option, or Development Exit Option. The Parties shall discuss plans and budget for the GSK Contributed Programs for a period of [***] following the Effective Date in
the case of the [***] Program, and following the First Amendment Effective Date in the case of the GSK [***] Program. After such [***] periods, GSK shall have [***] days to develop the applicable Joint Development Plan for the applicable GSK
Contributed Program and to present such Joint Development Plan to the JDC. The JDC shall review and approve the Joint Development Plan, including any amendments mutually agreed by the Parties, and shall submit the Joint Development Plan to the JSC
for approval in accordance with Section 5.4. 23andMe shall have no obligation with respect to any costs incurred for activities conducted prior to the date upon which the JSC approves the Joint Development Plan in
connection with the applicable GSK Contributed Program.”; 
  

	 	(b)	 In Sections 5.2(b) and 5.2(c) the term “the GSK Contributed Program” is deleted and
replaced in each place with “any GSK Contributed Programs”; 

  

	 	(c)	 Section 10.3 is deleted and replaced in its entirety with: 

“Option Exercise Fees. In the event that GSK exercises an Option with respect to a 23andMe
Pre-Existing Program pursuant to Section 5.1(c), then neither (i) the Option exercise with respect to the 23andMe Pre-Existing Program for which [***] is the
Target (the “23andMe [***] Program”) and the first other Option exercise (chosen from the other available 23andMe Pre-Existing Programs at GSK’s discretion, and which, for clarity,
may occur before or after the Option exercise with respect to the 23andMe Pre-Existing Program for which [***] is the Target) shall not require payment of an Option Exercise Fee. For each other Option exercise
with respect to any 23andMe Pre-Existing Program, GSK shall pay 23andMe the following fees (each an “Option Exercise Fee”), in each case in accordance with the payment and invoicing terms and
conditions set forth in Section 10.17: 
 (a) [***] United States Dollars ($[***]) if, at the time of the Option
exercise, such 23andMe Pre-Existing Program is an LSR Program; 
 (b) [***] United States Dollars
($[***]) if, at the time of the Option exercise, such 23andMe Pre-Existing Program is an ESR Program; and 

(c) [***] United States Dollars ($[***]) if such 23andMe Pre-Existing Program is a Pre-ESR Program.” 
  

	 	(d)	 Schedule 1.56 is deleted and replaced in its entirety with: 

 

					
	 “
	  	Schedule 1.56	  	

 GSK Contributed Programs 

Part A — [***] Compounds as of the Effective Date 
  

	 	•	 	 [***] 

  
 2 

	 	•	 	 [***] 

  

	 	•	 	 [***] 

Part B — [***] Compounds as of the First Amendment Effective Date 

 

	 	•	 	 [***]” 

  

	3	 The Parties hereby agree that pursuant to Section 5.1(c)(i) the Option with respect
to the 23andMe [***] Program is deemed to have been exercised by GSK and the assumption by GSK of the role of Lead Party for the combined GSK [***] Program and the 23andMe [***] Program has been made without the need to provide any further written
notice to 23andMe. 

  

	4	 The Agreement is hereby amended with respect to the Data Access Plan as follows: 

 

	 	(a)	 Section 1.68 is deleted and replaced in its entirety with: 

“Data Access Plan” means the principles for access by a Party to data and information generated as a result of the use of the
23andMe Databases and 23andMe Data Mining Technologies or the GSK Additional Databases, as applicable, in connection with the Target Discovery Plan and other activities under this Agreement, as set forth on Schedule 1.68 and as amended in
writing from time to time by the JRC pursuant to Section 3.2(x).” 
  

	 	(b)	 Section 2.2 is deleted and replaced in its entirety with: 

“Mining of Data Sources to Discover Targets. As part of the Collaboration and as set forth in the applicable Plan, the Parties
shall utilize the 23andMe Databases and apply the 23andMe Data Mining Technologies and their respective capabilities to discover biological Targets of potential therapeutic use. GSK may also, in its discretion and to the extent legally able to do
so, bring into the Collaboration selected data sources in its possession or control, including from [***] for use in identifying Targets and validating Collaboration Targets (where any such data sources shall constitute “GSK Additional
Databases”), provided that if GSK provides GSK Additional Databases for use and access thereof by 23andMe in connection with activities under this Agreement, then prior to any such use or access, the Data Access Subcommittee shall
review the proposed GSK Additional Databases, and shall specify the conditions of such use and access (the “GSK Database Access Rules”). The GSK Database Access Rules shall be (a) generally aligned with the principles
set forth in the Data Access Plan, and (b) in compliance with any requirements and restrictions imposed by (i) the terms of the applicable patient consents, (ii) any Third Party agreement terms applicable to the GSK Additional
Databases, and (iii) any requirements imposed by applicable Law.” 
  

	 	(c)	 a new Section 3.2(x) is inserted: 

“Responsibilities of the JRC. The JRC shall oversee, review and coordinate the conduct and progress of the discovery and Research
activities described in Article 4 and Section 5.3 with the objective of identifying and validating Targets, including by designating Targets as Identified Targets, and to identify Development Candidates for Non-Clinical GLP Studies pursuant to the Early Collaboration Program Plan. The JRC shall be responsible for: .... 

(x) reviewing and approving any amendments to the Data Access Plan.” 

  
 3 

	 	(d)	 Section 3.11 is deleted and replaced in its entirety with: 

“Most Conservative Approach and Internal Policies. With respect to all Target Discovery Activities, Research and Development
conducted by 23andMe under this Agreement, whether as the Lead Party or otherwise, 23andMe shall adhere to the GSK Specified Internal Policies and to the requirements of the Data Access Plan. With respect to any data derived from the 23andMe
Databases and provided to GSK, GSK shall adhere to its standard information security policies and to the requirements of the Data Access Plan. In addition, to the extent GSK personnel directly access the 23andMe Databases, GSK shall comply with the
23andMe Specified Internal Policies with respect to such activities. For all other activities, each Party shall comply with its own Internal Policies in performing its activities under this Agreement. In the event of a conflict between the
Parties’ Internal Policies in the case in which one Party is required hereunder to comply with the policies of the other Party, the Parties acknowledge and agree that the Internal Policies of the Party embodying the Most Conservative Approach
will be followed by both Parties with respect to all issues relating to Joint Product Development; provided that the Most Conservative Approach may not serve as the basis for mandating the performance of additional activities hereunder (including
under a Joint Development Plan) or an increase in budget. Each Party will provide the other with copies of relevant Internal Policies promptly following the Effective Date or from
time-to-time as additional Internal Policies become relevant, and will provide updates of such Internal Policies as appropriate.” 

 

	 	(e)	 Section 14.8(d) and (e) are deleted and replaced in its entirety with:

  

	 	“Information	 Technology Requirements. 

 
 ...... 

(d) Both Parties agree to maintain reasonable security measures, in line with industry best practices for systems storing, accessing, or
otherwise processing any Data (irrespective of levels or classifications as defined in the Data Access Plan) of this Agreement. Such security measures shall be subject to mutual reporting, review and oversight by the Data Access Committee. Parties
agree to coordinate in good faith regarding any requested updates or modifications to the security practices of the other Party as applicable to the Collaboration, and acknowledge that the discovery of any serious security vulnerability or security
incident may result in a delay or interruption in Data transfer, as set forth in the Data Access Plan. 
 (e) 23andMe shall seek independent
third party accreditation for any system(s) accessing, storing and/or otherwise processing any level or classification of Data defined in the Data Access Plan to verify such system(s) are compliant with accepted data security standards (e.g.,
ISO27001, ENISA, HITRUST) no later than December 31, 2019, and shall deliver such certificates of accreditation to GSK upon request. 23andMe shall provide periodic updates to the Data Access Subcommittee regarding its progress towards achieving
compliance with such accepted data security standards. Each Party may, upon reasonable notice, audit GSK systems used for the storage and/or otherwise processing any level of Data defined in the Data Access Plan to verify such system(s) are
compliant 

  
 4 

 
with accepted data security standards. Such audit (i) shall be conducted at reasonable times during regular business hours and upon at least [***] days’ prior notice to GSK no more than
twice per year (with an additional audit right in response to a security incident pertaining to 23andMe Data but limited to confirming the security incident and applicable vulnerability has been remedied, as forth in the Data Access Plan), and
(ii) may not be exercised with respect to Data Packages which are instead subject only to the Data Package Audit Right as set forth in Section 5.1(c)(iii).” 

 

	 	(f)	 Schedule 1.68 is deleted and replaced in its entirety with Annexure A to this Amendment.

  

	 	(g)	 Schedule 4.1 paragraph 1 is deleted and replaced in its entirety with: 

“Initial Target Discovery Plan Outline 

The following outlined plan is intended to cover the first 3 months following the Effective Date (post formation of the JRC). 

1. GSK members of the JRC will select GSK scientific members who will obtain access to Level 2 and Level 3 Data (as defined in the
Data Access Plan). 23andMe will provide training (regarding Level 2 and Level 3 Data) to the selected GSK scientific members.” 
  

	5	 This Amendment may be signed in counterparts, each and every one of which shall be deemed an original,
notwithstanding variations in format or file designation which may result from the electronic transmission, storage and printing of copies of this Amendment from separate computers or printers. Signatures transmitted via PDF or other electronic form
shall be treated as original signatures. 

  

	6	 This Amendment and any dispute arising from the performance or breach hereof shall be governed by and construed
in accordance with the laws of the State of Delaware, without reference to conflicts of laws principles. 

 [Signature
Page Follows] 

  
 5 

 IN WITNESS WHEREOF, the
Parties have by duly authorized persons executed this First Amendment to Collaboration Agreement as of the date first written above. 
  

									
	 GLAXOSMITHKLINE INTELLECTUAL

PROPERTY (NO.3) LIMITED
	 		  	23ANDME INC.
					
	Sign:	 	
                     

	 	        	  	Sign:	  	
                     

					
	Print Name:	 	
                     

	 		  	Print Name:	  	
                     

		 	 Authorised Signatory
 For and on behalf of

The Wellcome Foundation Limited
 Corporate Director

 
 Authorised Signatory

For and on behalf of
 Edinburgh Pharmaceutical Industries
Limited
 Corporate Director
	 		  		  	

									
	Title:	 	  
	 		  	Title:	  	  

  
 6 

 ANNEXURE A TO AMENDMENT 

Schedule 1.68 
 Data
Access Plan 
 Part A — 23andMe Data 
 Data
Levels 
 “Level 1 Data” means [***]. 

“Level 2 Data” means [***]. 

“Level 3 Data” means [***]. 

“Level 4 Data” means [***]: 
  

	1.	 [***]. 

  

	2.	 [***]. 

  

	3.	 [***]. 

“Derived Data” means [***]. 
  

	 	•	 	 For the avoidance of doubt, [***]. 

 

	 	•	 	 Level 4 Data associated with Collaboration Programs or Unilateral Programs 

 

	 	•	 	 [***] 

  

	 	•	 	 [***] 

  

	 	•	 	 [***] 

  

	 	•	 	 [***] 

Access Management 
  

	 	•	 	 Prior to providing access to any Data to GSK, including any Data that the Parties intend to be included in any
Derived Data, 23andMe shall [***]. 

  

	 	•	 	 GSK shall [***]. 

  

	 	•	 	 GSK further agrees that [***]. 

 

	 	•	 	 GSK shall maintain [***]: 

 

	 	•	 	 [***] 

  

	 	•	 	 [***] 

  

	 	•	 	 GSK shall require that [***]. 

 Identification of Individuals 

GSK will not deliberately identify or attempt to identify any individual data subjects included in any data provided by 23andMe under the Agreement. If GSK
receives or obtains any data from 23andMe that reveals the identity of a 23andMe Customer, GSK will promptly, within [***] of discovery, notify both 23andMe and any relevant third party vendor. GSK will then cooperate with 23andMe, at its own cost,
to remedy the disclosure and minimize the risk of recurrence. 
 Security Breach 

 

	 	•	 	 [***] 

  

	 	•	 	 [***] 

  

	 	•	 	 [***] 

  

	 	•	 	 [***] 

Data Destruction 
  

	 	•	 	 Upon the expiration or termination of the Discovery Term for any reason, GSK shall only keep any Level 2
Data, Level 3 Data, Level 4 Data and Derived Data required for a Collaboration Program or with respect to which it otherwise has rights, and as soon as reasonably practical securely dispose of all other such information, including all
copies thereof, and certify in writing to 23andMe that such information has been disposed of securely using destruction methods that meet or exceed current industry standards, to 23andMe’s reasonable satisfaction. 

 

	 	•	 	 When media or storage devices are to be disposed of or reused, GSK will implement industry-standard procedures to
prevent any subsequent retrieval of 23andMe data before devices are withdrawn from the inventory. When media are to leave the physically secured premises as a result of maintenance operations, GSK will implement encryption of 23andMe Data stored on
the media or storage device. 

  

	 	•	 	 Parties shall establish a mutually agreed to method and process of secure destruction through the Data Access
Subcommittee with respect to [***]. 

 Virus controls 
  

	 	•	 	 GSK will ensure that Independent Testing is performed at least annually to verify the GSK’s information
systems are free of Known Vulnerabilities that may be used to gain unauthorized access to the GSK’s Information Systems or 23andMe Data. 

  

	 	•	 	 “Known Vulnerability” means those vulnerabilities documented and compiled by independent third parties,
including the NIST National Vulnerability Database, a U.S. government repository of standards based vulnerability management data found at the nvd.nist.gov website, and other sites such as the Open Web Application Security Project (OWASP) found at
the www.owasp.org website, United States Computer Emergency Readiness Team (US-CERT) found at the www.us-cert.gov website, and UK National Cyber Security Centre (NC SC)
found at the www.ncsc.gov.uk website. 

	 	•	 	 “Independent Testing” means testing via any automated tools, by a qualified independent third party; or
alternatively, by an internal group with expertise in security vulnerability assessment and independent from the development and support organization. 

  

	 	•	 	 “GSK Information System” means all hardware, software, operating systems, database systems, software
tools and network components used by or on behalf of GSK to receive or Process 23andMe Data. 

  

	 	•	 	 “Processing” (and its conjugates, including “Process”) shall mean any operation or set of
operations that is performed upon any information or data, including without limitation collection, recording, retention, alteration, use, disclosure, access, transfer, storage, or destruction of 23andMe Data. 

Short-term access (1-6 months) 
  

	 	•	 	 [***] 

  

	 	•	 	 [***] 

  

	 	•	 	 [***] 

  

	 	•	 	 [***] 

  

	 	•	 	 [***] 

  

	 	•	 	 [***] 

  

	 	•	 	 [***] 

  

	 	•	 	 [***] 

  

	 	•	 	 [***] 

  

	 	•	 	 [***] 

  

	 	•	 	 [***] 

  

	 	•	 	 [***] 

  

	 	•	 	 [***] 

  

	 	•	 	 [***] 

  

	 	•	 	 [***] 

  

	 	•	 	 [***] 

  

	 	•	 	 For Level 2 Data: 

 

	 	•	 	 [***] 

  

	 	•	 	 [***] 

	 	•	 	 [***] 

  

	 	•	 	 [***] 

  

	 	•	 	 [***] 

  

	 	•	 	 [***] 

  

	 	•	 	 [***] 

  

	 	•	 	 [***] 

  

	 	•	 	 [***] 

  

	 	•	 	 [***] 

  

	 	•	 	 [***] 

  

	 	•	 	 [***] 

  

	 	•	 	 [***] 

  

	 	•	 	 [***] 

  

	 	•	 	 [***] 

  

	 	•	 	 [***] 

  

	 	•	 	 [***] 

  

	 	•	 	 [***] 

  

	 	•	 	 [***] 

  

	 	•	 	 [***] 

Long-term access (>6 months) 
  

	 	•	 	 [***] 

  

	 	•	 	 [***] 

  

	 	•	 	 [***] 

  

	 	•	 	 [***] 

  

	 	•	 	 [***] 

  

	 	•	 	 [***] 

  

	 	•	 	 [***] 

  

	 	•	 	 [***] 

 Part B — GSK Data 

1 Overview 
  

	 	(a)	 For the purposes of this Data Access Plan and any GSK Database Access Rules the GSK information
classifications will be as follows: 

 (i) [***]; 

(ii) [***]; or 
 (iii) [***]. 

 

	 	(b)	 This Part B of the Data Access Plan is intended to apply rules for access to and use of Data provided by GSK to
23andMe, whether on 23andMe systems, or accessed on or downloaded from GSK systems, and classified by GSK at the time of transmission or provision to 23andMe, respectively, as [***], for use under the Collaboration and is without limitation to the
obligations of 23andMe under Article 17 (Confidentiality) of the Agreement with respect to any such Data that falls within the definition of “Confidential Information” under the Agreement. 

 

	 	(c)	 Notwithstanding the foregoing, the Data Access Subcommittee shall have the authority, at its discretion and
following consultation between the Parties, to approve the technical means to be implemented for compliance with the rules set forth in this Part B of the Data Access Plan. 

 

	 	(d)	 GSK shall be solely responsible, at its reasonable discretion, for determining and applying one of the
classifications set forth above to GSK Data. However, for clarity, the Parties intend that: 

 (i) [***]; 

(ii) [***]. 
  

	 	(e)	 Notwithstanding the foregoing, if 23andMe reasonably disputes the classification of any GSK Data, the dispute
shall be escalated to the Data Access Subcommittee and the Data Access Subcommittee shall assign a classification to such GSK Data. In the absence of agreement at the Data Access Subcommittee, GSK shall have the right to make the final
determination. 

  

	 	(f)	 For clarity, 23andMe may elect, at its sole discretion, not to receive or access GSK Data, including on the
basis that it believes it is able to obtain the same or substantially similar data from a different source or with less restrictive access provisions. 

2 Access terms and conditions 
  

	 	(a)	 GSK shall classify GSK Data as [***], and notify 23andMe of such classification at the time GSK makes such Data
available for 23andMe access, or if GSK fails to so classify at the time of initial access, or later desires to apply a different classification, at such later time that GSK otherwise determines and notifies 23andMe of such classification. In the
absence of any such classification, such Data shall be considered [***] if it falls within any of Section 1(d)(ii)(A) through (C) above, and otherwise will only be subject to the obligations of 23andMe under Article 17
(Confidentiality) of the Agreement and not be subject to any other obligations set forth in this Part B of the Data Access Plan. For clarity, if GSK first classifies any GSK Data as (i) [***] (as applicable), and later reclassifies such GSK Data
under a more restrictive classification (i.e. [***] (if applicable)), 23andMe shall not be deemed to be in breach of this Part B or incur any liability with respect 

	 	
to the treatment of such GSK Data if (A) prior to such reclassification, 23andMe has complied with the obligations set forth for the initial classification (i.e. GSK Protected
Information or GSK Specified Confidential Information, as applicable), and (ii) following such reclassification, 23andMe complies with the obligations set forth for the reclassification (i.e. [***], as applicable). 

 

	 	(b)	 [***]. 

  

	 	(c)	 References to “GSK Data” in this Part B or in Appendix A shall mean, collectively, all [***].

  

	 	(d)	 Access to [***] through the exchange of GSK unstructured files (e.g., Word, Excel, PowerPoint, PDF etc.) will
be subject to the terms and conditions in Appendix B to this Data Access Plan. [***] 

  

	 	(e)	 Access to [***] through the exchange of GSK unstructured files (e.g., Word, Excel, PowerPoint, PDF etc.) will
be subject to the terms and conditions in Appendix C to this Data Access Plan. [***]. 

  

	 	(f)	 Access to [***] through the exchange of GSK unstructured files (e.g. Word, Excel, PowerPoint, PDF etc.) will be
subject to further terms and conditions. 

  

	 	(g)	 Access to [***] in GSK systems via GSK onsite network or using a GSK managed device (e.g. laptop) will be
subject to further terms and conditions. 

  

	 	(h)	 For the purposes of Appendices A, B and C of this Data Access Plan: 

 

	 	(i)	 “23andMe Information System” means all hardware, software, operating systems, database systems,
software tools and network components used by or on behalf of 23andMe to receive or Process GSK Data. 

  

	 	(ii)	 “Processing” (and its conjugates, including “Process”) shall mean any operation or set of
operations that is performed upon any information or data, including without limitation collection, recording, retention, alteration, use, disclosure, access, transfer, storage, or destruction of GSK Data. 

 

	 	(iii)	 “Security Incident” means a reasonably suspected or actual unauthorized use, disclosure, modification
or destruction or, or interference with GSK Data. 

 3 Data privacy 

 

	 	(a)	 Access to personal information, other than basic personal data elements of GSK personnel (e.g. name, work
contact details, network or user identification number, gender and title) for the legitimate purpose of day-to-day business activities, will be subject to further terms
and conditions. 

  

	 	(b)	 23andMe will not deliberately identify or attempt to identify any individual data subjects included in any
information provided by GSK under the Agreement. If 23andMe receives or obtains any information from GSK that reveals the identity of a patient or other individual data subject, 23andMe will promptly, within [***] of discovery, notify GSK. 23andMe
will then cooperate with GSK, at its own cost, to remedy the disclosure and minimize the risk of recurrence. 

 Appendix A to Data Access Plan 

Remote Access to GSK Data 
  

	1	 General requirements 

 

	 	(a)	 [***] 

  

	 	(i)	 [***] 

  

	 	(ii)	 [***] 

  

	 	(b)	 [***] 

  

	 	(c)	 [***] 

  

	2	 Retention and return of GSK Data 

[***] 
  

	3	 Background screening 

 

	 	(a)	 [***]: 

  

	 	(i)	 [***] 

  

	 	(ii)	 [***] 

  

	 	(iii)	 [***] 

  

	 	(iv)	 [***] 

  

	 	(v)	 [***] 

  

	 	(vi)	 [***] 

  

	 	(b)	 [***] 

  

	4	 Access 

  

	 	(a)	 [***] 

  

	 	(b)	 [***] 

  

	5	 Incident management 

 

	 	(a)	 [***] 

  

	 	(i)	 [***] 

  

	 	(ii)	 [***] 

[***] 
  

	 	(iii)	 [***] 

  

	 	(iv)	 [***] 

  

	 	(v)	 [***] 

  

	 	(vi)	 [***]. 

  

	 	(b)	 [***] 

  

	 	(i)	 [***] 

  

	 	(ii)	 [***] 

  

	 	(iii)	 [***] 

 6 Reviews 
  

	 	(a)	 [***] 

  

	 	(b)	 [***] 

 Appendix B to Data Access Plan 

Exchange of [***] in Unstructured Files 
  

	 	1	 [***] 

  

	 	2	 [***] 

  

	 	3	 [***] 

 Appendix C to Data Access Plan 

Exchange of [***] in Unstructured Files 
  

	1	 General requirements 

 

	 	(a)	 [***] 

  

	 	(b)	 [***] 

  

	 	(c)	 [***] 

  

	2	 Retention and return of GSK Data 

[***] 
  

	 	(a)	 [***] 

  

	 	(b)	 [***] 

  

	 	(c)	 [***] 

  

	3	 Encryption 

[***] 
  

	4	 Security Incident reporting and incident response 

 

	 	(a)	 [***] 

  

	 	(b)	 [***] 

  

	 	(c)	 [***] 

  

	5	 Information protection policies 

 

	 	(a)	 [***] 

  

	 	(i)	 [***] 

  

	 	(ii)	 [***] 

  

	 	(iii)	 [***] 

  

	 	(iv)	 [***] 

  

	 	(b)	 [***] 

  

	6	 Physical and environmental security 

 

	 	(a)	 [***] 

  

	 	(b)	 [***] 

  

	7	 Disposal of media 

[***] 
  

	8	 Network security 

[***] 
  

	9	 Access control 

23andMe will ensure that: 
  

	 	(a)	 [***] 

	 	(b)	 [***] 

  

	 	(c)	 [***] 

  

	 	(d)	 [***] 

  

	 	(e)	 [***] 

  

	 	(f)	 [***] 

  

	 	(g)	 [***] 

  

	10	 Virus controls 

 

	 	(a)	 [***] 

  

	 	(b)	 [***] 

  

	 	(c)	 [***] 

  

	11	 Personnel 

  

	 	(a)	 [***] 

  

	 	(b)	 [***] 

  

	 	(c)	 [***] 

  

	12	 Security reviews 

 

	 	(a)	 [***] 

  

	 	(b)	 [***]EX-10.19

 Exhibit 10.19 

 

CERTAIN CONFIDENTIAL PORTIONS OF THIS EXHIBIT HAVE BEEN OMITTED AND REPLACED WITH “[***]”. SUCH IDENTIFIED INFORMATION HAS BEEN
EXCLUDED FROM THIS EXHIBIT BECAUSE IT IS (I) NOT MATERIAL AND (II) WOULD LIKELY CAUSE COMPETITIVE HARM TO THE COMPANY IF DISCLOSED. 

SECOND AMENDMENT TO 

COLLABORATION AGREEMENT 

THIS SECOND AMENDMENT
(this “Amendment”), dated January 13, 2021 (the “Amendment Effective Date”), by and between GLAXOSMITHKLINE INTELLECTUAL PROPERTY
(NO.3) LIMITED, a company registered in England and Wales (registered number 11480952) with a registered office at 980 Great West Road, Brentford, Middlesex TW8 9GS, United Kingdom (“GSK”) and
23ANDME, INC., a company formed under the laws of Delaware whose principal place of business is at 223 N Mathilda Ave., Sunnyvale, CA 94086 (“23andMe”), hereby amends the Collaboration Agreement by and
between GSK and 23andMe, dated July 24, 2018 (as amended by the First Amendment dated April 8, 2019) (the “Agreement”). 

BACKGROUND 
  

	A.	 GSK and 23andMe wish to amend the Agreement to provide a mechanism for recruiting additional customers
in order to supplement the data in the 23andMe Databases; 

  

	B.	 GSK and 23andMe wish to amend the Agreement to set out terms governing 23andMe’s conduct of certain
COVID-19 Studies; and 

  

	C.	 GSK and 23andMe wish to amend the Agreement to correct for certain informalities, and to streamline the
process for updating certain aspects of the Data Access Plan and documenting Unilateral Programs, all as set forth herein. 

 NOW,
THEREFORE, in consideration of the mutual covenants set forth in this Amendment, and for other good and valuable consideration, the receipt and sufficiency of which is hereby acknowledged, GSK and 23andMe hereby agree as follows: 

 

	1	 Capitalized terms used in this Amendment shall have the meanings set forth in the Agreement and the terms and
conditions of this Amendment shall be construed as set forth in Section 21.18 of the Agreement, unless otherwise specifically indicated in this Amendment. 

 

	2	 The Agreement is hereby amended to account for 23andMe’s new address as follows: 

23andMe’s notice information in Section 21.9 is hereby amended and restated in its entirety as follows: 

If to 23andMe: 

 23andMe, Inc. 

223 N Mathilda Ave. 
 Sunnyvale,
CA 94086 
 Attn: Kathy Hibbs, Chief Legal and Regulatory Officer 

With a copy to: 
 Cooley LLP 

3175 Hanover Street 
 Palo Alto,
CA 94304 
 Attention: Kate Hillier 

Facsimile: 650-849-7400 

 

	3	 The Agreement is hereby amended to account for additional customer recruitment activities as follows:

 Article 4 (Target Identification and Early Discovery Program) is hereby amended to add a new
Section 4.6 as follows: 
 Section 4.6 Customer Recruitment. 

(a) From time to time, either Party may propose that 23andMe undertake efforts to recruit additional 23andMe Customers in order to supplement
the data in the 23andMe Databases in order to support Target Discovery Activities, a Collaboration Program in the Early Research Phase, or a Joint Collaboration Program. The Parties, through the JRC or JDC, as applicable, shall discuss such proposal
and, if agreed, prepare a proposal that includes (i) a description of the relevant recruitment activities (“Customer Recruitment Activities”), (ii) the applicable recruitment criteria, (iii) a budget for such activities,
and (iv) whether, notwithstanding Section 2.6 and Articles 13 and 17, either Party or both Parties shall have the right to publish and/or share certain individual level data in connection with such Customer Recruitment Activities (such
description, criteria, budget, and publication rights, the “Customer Recruitment Proposal”). 
 (b) The JRC or JDC, as
applicable, shall submit the Customer Recruitment Proposal to the JSC for approval. If so approved by the JSC, the costs associated with the Customer Recruitment Activities shall be subject to the cost-sharing provisions set forth in
Section 4.4, Section 5.3(b), or Section 5.4(d), as applicable. 

(c) In each case, only those operating costs and expenses incurred by a Party and directly relating to the approved Customer Recruitment
Activities shall be subject to cost-sharing, and such costs will not include costs generally associated with business functions, lab supplies, equipment, software or hardware, or capital where such costs are not specific to the Customer Recruitment
Activities (i.e. costs for any of the foregoing that are used in connection with 23andMe’s general business or projects or collaborations being conducted with Third Parties). 

  
 2 

 (d) 23andMe shall genotype all viable samples collected from recruited 23andMe Customers and
shall add all genotype and phenotype data collected from such 23andMe Customers to the 23andMe Databases, all in accordance with 23andMe’s standard processes and procedures. The updated 23andMe Databases shall be made available to GSK in
accordance with the terms and conditions of the Agreement, including the Data Access Plan. 
  

	4	 The Agreement is hereby amended to account for the COVID-19 study to be
performed by 23andMe, as follows: 

 (A) Article 4 (Target Identification and Early Discovery Program) is hereby
amended to add a new Section 4.7 as follows: 
 Section 4.7 23andMe
COVID-19 Study 
 (a) Background. As of the Amendment Effective Date, 23andMe has
(i) completed a study, at its own cost, aimed at identifying patients with certain genetic profiles that result in a higher susceptibility to infection by the novel coronavirus disease denoted as COVID-19
by the World Health Organization (the “COVID-19 Study”), (ii) shared with GSK the [***] (collectively, the “COVID-19 Study Results”),
and (iii) published certain findings from the COVID-19 Study Results (available at https://www.medrxiv.org/content/10.1101/2020.09.04.20188318v1). 23andMe has also announced a data access program to make
the same COVID-19 Study Results that were previously shared with GSK (or a portion thereof) available to qualified researchers under the terms of a data transfer agreement. 23andMe agrees that the data
transfer agreement between 23andMe and each such qualified researcher will be in substantially the same terms with respect to restrictions on data use and transfer, intellectual property and publication rights as those set forth in the form
disclosed by 23andMe to GSK prior to the Amendment Effective Date. The Parties acknowledge and agree that all activities conducted by or on behalf of the Parties in connection with the COVID-19 Study,
including the data sharing and publication activities in accordance with the above, are permitted under the Agreement. Except as set forth in the foregoing, each Party’s rights to publish the COVID-19
Study Results shall be subject to the terms and conditions set forth in the Agreement. 
 (b) GSK Patent. All Know-How invented, discovered, created or developed in the course of performing the COVID-19 Studies, [***], will be owned solely by 23andMe and deemed 23andMe Background IP.
23andMe acknowledges and agrees that (i) GSK has filed a patent application based on the COVID-19 Study Results and data obtained by GSK via accessing 23andMe Databases, with short title “Medical
Use” and US Provisional Application Serial Number 63/074,425 (the “GSK Patent”), (ii) GSK is and will remain the sole and exclusive owner of the GSK Patent (and any Patents that issue therefrom), and (iii) 23andMe shall assign
all right, title or interest in or to inventions claimed or disclosed in the GSK Patent (or any Patents that issue therefrom) to GSK. For clarity, GSK will control the 

  
 3 

 
filing, prosecution, maintenance, enforcement and defense of all such Patents using counsel of its choice and at its sole cost. 23andMe shall, and shall procure that its personnel shall, at
GSK’s cost, reasonably cooperate with GSK in respect of the GSK Patent, including executing such documents and taking such additional action as GSK may reasonably request in connection with the execution and delivery of assignments as may be
required to give effect to this Section 4.7(b) and the preparation, filing, recordation, procurement, defense and enforcement of the GSK Patent (and any Patents that issue therefrom). 23andMe hereby represents and warrants to GSK that 23andMe
has not disclosed any COVID-19 Study Results in the public domain that would, to 23andMe’s knowledge, materially affect prosecution of the GSK Patent. 

(c) Material Benefit. GSK acknowledges and agrees that the following potential for Material Benefit occurred with respect to the GSK
Independent Program identified below based on the COVID-19 Study Results made available to GSK or from GSK’s accessing 23andMe Databases: 

 

	 	•	 	 Name of Product/GSK Independent Program: [***] and [***], and any other Covered product which is
directed against the Target known as [***] “GSK Asset”) 

  

	 	•	 	 Development Event: [***] 

The Parties further agree that, for the purposes of the Agreement, such development event will be considered to have resulted from GSK’s
accessing the 23andMe Databases or the 23andMe Data Mining Technologies for Validation Activities pursuant to Section 4.5(a). Accordingly, if a GSK Asset is approved with a label including any [***] in one or more countries (thereby resulting
in the achievement of a Material Benefit with respect to the GSK Asset), the GSK Asset will become an Impacted Product and subject to the royalty payments set forth in Section 4.5(a). For clarity, (i) the royalty term will be as set forth
in Section 4.5(a) and will not run with the term of the GSK Patent, and (ii) the Parties’ acknowledgement of the development event described in this Section 4.7(c) is independent of the fact that the GSK Patent was filed and is
not dependent on whether or not such Patent ultimately issues. 
 (d) Continued Applicability of Exclusivity Terms. Except as
expressly set forth in this Section 4.7, nothing in this Section 4.7 is intended to limit or supersede the terms of Section 2.6(a) or Article 13. For the avoidance
of doubt, nothing in this Section 4.7 limits or supersedes in any manner whatsoever the terms of Sections 2.6(a)(ii) and 2.6(a)(iii). 
  

	2	 The Agreement is hereby amended to provide a definition for the term “Patent Costs” as follows:

 (A) Section 1.205 is deleted in its entirety and replaced with the following: 

  
 4 

 “Patent Costs” means the reasonable out-of-pocket fees and expenses paid to outside legal counsel and experts, and filing and maintenance expenses, incurred after the Effective Date in connection with the establishment and maintenance of Collaboration
Patents, including translation costs and the costs of patent interference, reexamination, reissue, opposition, revocation and other similar proceedings (but excluding litigation costs), if relevant, and incurred in accordance with Article 14
of the Agreement. 
 (B) Subpart (f) of the definition of “Development Costs” in the Financial Appendix
is deleted in its entirety and replaced with the following: 
 (f) Patent Costs; 

 

	3	 The Agreement is hereby amended to streamline the process for updating the Data Access Plan for the purpose of
permitting the use of alternative technology and systems as follows: 

 (A) Section 3.2(b)(x) (as
added in the First Amendment) is hereby deleted in its entirety. 
 (B) Section 3.1(b) is amended by adding new
subsections (b)(xii) and (b)(xiii) as follows: 
 (b) Responsibilities of the JSC. The JSC shall be responsible for:
..... 
 (xii) reviewing and approving any amendments to the Data Access Plan, and 

(xiii) in connection with the Data Access Plan, approving the use of alternative technology and systems for the purpose of data
transfer, storage, access, encryption, processing or querying, analysis and visualization, as may be recommended by the Data Access Subcommittee from time to time (upon which approval, the Data Access Plan will be deemed to be amended to include the
use of such system as approved). 
  

	4	 The Agreement is hereby amended to provide a mechanism for formally documenting certain facts, matters or
circumstances that may result in the achievement of a Material Benefit as follows: 

 (A)
Section 4.5 is amended to add the following: 
 (e) Documenting Potential for Material Benefit.
If, in connection with a GSK Independent Program other than a GSK Unilateral Program, GSK accesses the 23andMe Databases or the 23andMe Data Mining Technologies for Validation Activities in connection with a Target other than an Identified
Target or Collaboration Target, the JRC will, if applicable, complete the form attached hereto as Schedule 4.5-A with respect to any identified potential for Material Benefit and provide such completed
form to the JSC for review and approval. GSK shall promptly notify 23andMe with respect to [***], as specified in such approved form, is commenced. 

  
 5 

 (B) A new Schedule 4.5-A is hereby added to
the Agreement in the form of Annexure A to this Amendment. 
  

	5	 The Agreement is hereby amended to provide a mechanism for formally documenting Unilateral Programs as follows:

 (A) Section 7.1 is amended to add the following: 

(c) Documenting Unilateral Programs. Both 23andMe Unilateral Programs and GSK Unilateral Programs shall be documented
using the form attached hereto as Schedule 7.1. The Party pursuing the Unilateral Program shall submit a completed form for such Unilateral Program to the JSC prior to commencing research and development activities with respect to such
Unilateral Program. 
 (B) A new Schedule 7.1 is hereby added to the Agreement in the form of Annexure B to this Amendment. 

 

	6	 This Amendment may be signed in counterparts, each and every one of which shall be deemed an original,
notwithstanding variations in format or file designation which may result from the electronic transmission, storage and printing of copies of this Amendment from separate computers or printers. Signatures transmitted via PDF or other electronic form
shall be treated as original signatures. 

  

	7	 This Amendment and any dispute arising from the performance or breach hereof shall be governed by and construed
in accordance with the laws of the State of Delaware, without reference to conflicts of laws principles. 

  
 6 

 IN WITNESS WHEREOF, the Parties have by duly authorized persons executed this Second Amendment
to Collaboration Agreement as of the date first written above. 
  

									
	 GLAXOSMITHKLINE INTELLECTUAL

PROPERTY (No.3) LIMITED
	 		  	23ANDME, INC.
					
	Sign:	 	
                     

	 	        	  	Sign:	  	
                     

			
	Print Name:	 		  	Print Name:
				
	Title: Authorised signatory for and behalf	 		  	Title:	  	
	Of Edinburgh Pharmaceuticals Industries Limited	 		  		  	
					
	Sign:	 	
                     

	 		  		  	
				
	Print Name:	 		  		  	
				
	 Title: Authorised signatory for and behalf of

The Wellcome Foundation Limited
	 		  		  	

  
 7 

 ANNEXURE A TO AMENDMENT 

Schedule 4.5-A 

Form for Recording Potential for Material Benefit 

In accordance with Section 4.5(a) of the Collaboration Agreement by and between GlaxoSmithKline Intellectual Property (No.3) Limited (“GSK”)
and 23andMe, Inc. (“23andMe”), dated July 24, 2018 (“Agreement”), a Material Benefit is achieved only if one or more of the events set forth in Schedule 4.5 of the Agreement occurs. Each of the three Material Benefit
events listed in Schedule 4.5 is comprised of a development event followed by the occurrence of a further event (e.g., regulatory approval – see Schedule 4.5 for details). The purpose of this form is to document that a potential
for Material Benefit has been identified which shall, if the other required event also occurs, result in the achievement of a Material Benefit, subject to and in accordance with the terms of Section 4.5. Nothing in this form is intended to, or
does, modify any of the terms in the Agreement relating to the determination of if or when a Material Benefit is achieved. All capitalized terms used herein have the meanings set forth in the Agreement. 

Name of GSK Independent Program: 
 Primary Indication
Summary for GSK Independent Program: 
 Stage of GSK Independent Program (at time of access of 23andMe Databases or 23andMe Data Mining Technologies):
[***] 
 Reasoning for potential Material Benefit suggestion: [***] 
  

									
	On behalf of GSK:	 	        	  	On behalf of 23andMe:
	  
	 		  	  

					
	Name:	 	
                    
 
	 		  	Name:	  	
                    
 

					
	Title:	 	
                    
 
	 		  	Title:	  	
                    
 

			
	GSK JSC Representative	 		  	23andMe JSC Representative

  
 [***] 

 ANNEXURE B TO AMENDMENT 

Schedule 7.1 
 Form
for Memorializing a Unilateral Program 
 Acknowledgement of Unilateral Program 

The Parties hereby acknowledge and agree that the Identified Target below is the Unilateral Target of the Party listed below and may be pursued by such
Party as a Unilateral Program in accordance with the terms and conditions of the Collaboration Agreement by and between GlaxoSmithKline Intellectual Property (No.3) Limited (“GSK”) and 23andMe, Inc. (“23andMe”), dated
July 24, 2018 (“Agreement”). All capitalized terms used herein have the meanings set forth in the Agreement. 
 Name of Target:
                                        

 Unilateral Party: [GSK/23andMe] 
 Decision
Date:
                                         
    
  

											
	On behalf of GSK:	 	        	 		  	On behalf of 23andMe:
	  
	 		 		  	  

						
	Name:	 	
                    
 
	 		 		  	Name:	  	
                    
 

						
	Title:	 	
                    
 
	 		 		  	Title:	  	
                    
 

				
	GSK JSC Representative	 		 		  	23andMe JSC Representative

Source: [{"source": "alea-institute/alea-institute/kl3m-data-edgar-agreements/train-00327-of-00352.parquet"}, [{"source": "alea-institute/alea-institute/kl3m-data-edgar-agreements/train-00327-of-00352.parquet"}]]