Document:

Exhibit 10.15

 

		 ;rz.fi _,i Sccurlf)' ' 'e.Yi' ¥ Adm1nis11· 1.lon IOTA NUMllllR-OTHER TltANSACTION AGREE MENT REOUISITION NUMBER 70T020209NTOIA00921192090IA079 I lSSlJf,O TO]ISSUED BY Nu.int; &. Addr s!-.;Ak:lear. LLCNunu; & Addrc!is: 65 b.lSl 55•h Street, 17''1 l'loor·fr;l11$f >ol'lation Sccu1·ity Atl111iu• tr;1tlon Nt>w York, NY L002270 I S 12"' Str<-.:1 t:.IN:7.7· 1733•t25/\rlingl on, V/\ 20598 DIJNS:962·10948:1En1ai1: (ik1r ia.Uria( t$.1.d h:o...1nil I .l)C;tliorl of Eo1i1y. N YC (HadquarlCr.s) --· l'mgrdm 1'SA PRE./® Al'l'LICATION E::XPA:llSIO:'>i l'criod of Per fclnn11rtc1:: 0 1 20 2020 100 I 19 2030 (01\P, lhfee. }'l'!ilr b;,\$e-r1eriOll, lwO, lw<i -re r optiOI! l't:I iolh, t'l d lhn•t'> UllC' }'t'il.f OpllOll . PSC R499 I FISCAL DATA A<: ounting I.inc: Obligated : lPURPOSE Th\.: purpOf>C of this .AgtC\:lllCnt is to i;; tablisli the tusks uc•:t>s ury tn <l·vclt)p, d<:lhrcr. n{l d deploy hio1nctrit· vc11ing apphca1ic1n ;cnpnhilili cs 10 cx.p;nld' th.p11l1tic '!=. cnrolllnenl oppor111ni1jes {Or 'J'SA Prc/Q.(1 ;\pplicntion Pros,t'ittn 11 n:ttuircd under the TS.I\ Moderoizmio111\ct of201&. Section t•>37(d). 11.R. 302. j AU'rHORIZl•:DSICNAl'URf,;.<;-1d1tL\ u(;z,-<1 t/..U;.,01-011-2020 ... --·Date ·--i-th:i11 n1's Sign<l1ure Oah: 1g OfTtccr's Signiiturc yC·\.D. 1J-TYrEO NAME ANO TITLETYf'EO NAME AND TITLf ···. --····--· 

 

     

     

    

		ARTICLE I -PARTIES This Other Transaction Agreement (hereinafter referred to as "Agreement" or "OTA"} is entered into between the United States of America (hereinafter referred to as the ''Government'') Transportation Security Administration (hereinafter referred to as "TSA") and Alclcar, LLC. The TSA and Alclear, LLC agree to cooperate in good faith and to perform their respective obl igations using their cooperative good faith efforts i n executing the purpose of this Agreement. ARTICLE II -AUTHORITY TSA and Alclear, LLC enter into this Agreement under the authority of the Aviation and Transportation Security Act, Pub. L. 107-71, 115 Stat. 597,specifically 49 U.S.C. l 14(m), and l 06(1) and (m), which authorizes agreements and other transactions on such terms and conditions as the Administrato r determines necessary. ARTICLE Ill -SCOPE The purpose of this Agreement is to establish the tasks necessary to develop, del iver, and deploy biometric vetting application capabi lities to expand the public 's enrollment opportun ities for TSA Pre./® Application Program as required under the TSA Modern ization Act of 2018, Section 1937(d), H.R. 302. This includes the ability to offer convenient and accessible enrollment options, reliably perfonn identity validation and verification as well as vet the applicant by means of the applicant's biometric data by conducting a criminal history records check through the Federa l Bureau of Investigation (FBI}. At a minimum , Alclear, LLC must del iver the following: l. the ability to offer start-to-finish on line or mobile enrollment capability; reliably perfonn identity validation and verification at standards comparable to NIST 800-63A as indicated in the Statement of Work; protect privacy and data security including any persona ll y identifiab l e information in a manner consistent with section 552a of the Privacy Act of 1974 (5 U.S.C. 552) and vet the applicant by mean s of the applicant's biometric data by conduct ing a criminal history records check through the FBJ. To accomplish these general requirements, Alclear, LLC must meet the specific requirements found in the following attachments: Attachment #01 -Statemen t of Work (SOW) Attachment #02 -TSA Pre./ ® Expansion Requirements Matrix Attachment #03 -Site Survey Attachment #04 -Enroll ment Locations Attachment #05 -Fee Coll ecti on Requirements 

 

     

     

    

		Attachment #06 -TSA Pre../ ® Licens i ng Agreement Attachment #07 -TSA Pre../ ® Creative Toolkit Attachment #08 -Privacy Act and Paperwork Reduction Statement Attachment #09 -Name Entry Policy Attachment# 10 -Required Enrollment Documentation Attachment # 1 l -TSA MD 3700.4, FINAL, 08 1209v.4 Attachment # 12-TSA MD 1400.3, FINAL, 140408 Attachment # 13-TSA-MD-2800-71 Attachment # 14 - l I 042. l Safeguarding Sensitive Bui Unclass ified (For Official Use Only) Information Attachment # 15 -4300A Sensitive Systems Policy Attachment# 16 -43008.000 OHS National Security Systems Policy Cover page Attachment# 17 -4300B.OOO_Table of Contents Attachment# 18 -43008. l 00 -National Security Systems Policy Attachment #19-4300B .101 - Risk Management Framework Attachment #20 -43008. 102 -National Security Systems Security Control Guidance Attachment #2 1 -43008 .103-l - System Securi ty Plans FINAL Attachment #22 -4300B. 103.2 - Risk Assessment Repo11s Attachment #23 -43008. l03-3 - Security Assessment Reports Attachment #24-4300B .103-4 - Plans of Action and Milestones Attachment #25 -43008. 106 - User Minimum Requirements Attachment #26 -43008. l 07 - Decommi ssion ing Strategy Attachment #27 -4300B .108-I - NSS References Attachment #28 -43008. 108.2 - NSS Po licy Change Request Attachment #29 -43008.200 COMSEC Attachment #30 -TSA Prev'® Expansion -Volume 3 Element Matrix Attachment #3 1 -Outsourcing Rap8ack Guide Attachment #32 -Outsourcing Agreement_ V l .O ARTICLE IV - RESPONSIBILITIES The parties agree to cooperate, act in good faith, and to meet their respect ive obligations in furtherance of the purposes of this OTA and TSA Prev'® Application Expansion Statement of Work (SOW) and SOW Attachments and other relevant documents, which are incorporated by reference by this article. ARTICLE V-EFFECTIVE DATE AND TERM The effective date of this Agreement is the date on wh ich it is signed by the TSA or Alclear, LLC, wh i chever is later. This agreement will conti nue in effect for a three (3)-year base period, with two (2), two-year options and three (3), one-year options for a potential total period of 

 

     

     

    

		performance of Ten Years (10) from the effective date, unless earlier term i nated by the parties as provided herein . A lclcar, LLC agrees to meet the following timcl incs : No later than 90 days from OTA award, the Entity must be ready to begin integration/interface testing with TSA and TSA-required systems (to include TSA and pay.gov testing) as referenced in SOW Section 4.7. 1 No later than 270 days from OTA award, the Entity must achieve Authority to Operate (ATO) from TSA as referenced in SOW Section 4.7.I. *No later than 270 days from OTA award, the Entity must achieve approval to begin enrolling applicants (i.e., launch operations) from TSA. In order to receive approval to launch operations, the Entity must provide evidence that all operations and technology are established and meeting the requirements described in SOW Section 4.7. ARTICL E V.1-EFFECTIVE DATE ANO TERM OPTIONS The Government wi ll provide the Entity a written notice of exercise of an option at least 30 days before the OTA expires. lfthe Government extends, then the extended OTA shall be considered to include all extension periods. The total duration of this OTA, includ i ng the exercise of any options under this tenn, shall not exceed 120 months. ARTICLE VI -ACCEPTANCE AND TESTING A lclcar, LLC will perform in accordance to the Statement of Work (SOW), SOW attachments, and related attachments. ARTICLE VII - FUNDING AND LIMITATIONS The Entity shall collect and remit fee payment to TSA, pursuant to 6 U.S.C. 469, for each application that it submits. The Entity shall remit fees to TSA in form and manner consistent with SOW Attachment #05 - Fee Collection Requirements, describing requi rements for the collection of government funds. ARTICLE VIU -BILLING PROCEDURE AN D PAYMENT This Agreement docs not involve any payments from the Government to Alclcar, LLC -rather, the Entity shall remi t the specified fees amounts to TSA in accordance with Articl e VII of this agreement, as paym ent for TSA to complete process ing of each subm itted appl ication . A lclear, LLC is also required to provide a fee to the FBI for conducting a criminal history records check. 

 

     

     

    

		No appropriated or other Government funding wi ll be obligated under th i s Agreement. A lclear, LLC agrees to provide these enrollment capabilities, throughout the life of this agreement , at no cost to the government. Beyond the TSA and FBI fees, Alclear, LLC is encouraged to establish novel business models and pricing mechani sms to recover the costs of its efforts and continue to expand enrollments. Add itionally, TSA docs not provide for any government reimbursement of any cost incurred in making necessary sn1dies or designs for the preparation of the systems or i ncurred in obtaining services or supplies. ARTICLE IX - AUDITS TSA shall have the right to examine or audit relevant financial records for each Alclear, LLC facil ity, whi le this Agreement, or any part thereof, rema ins in force and effect, and for a period of three years after expi ration or termination of the tenns of this Agreement. For each facility, A lclcar, LLC shall mainta in: proj ect records, technology maintenance records, and data associated with this TSA Pre./® Appl ication Expansion while this Agreement, or any pan thereof, remains in force and effect, and for a per i od or three years afler any resulting final termination settlement. Ifthis Agreement is completely or partially tenninated, the records relating to the work terminated shall be made avai lable for three years after any resulting final termination settlement. Records relating to appeals under the "Disputes" provision in Article XII regarding this Agreement shall be made avai lable unt il such appeals arc finally resolved. As used in this prov ision, "records" i ncludes books, documents and other data, rega rdless or type and regardless of whether such items are in written fonn, in the form of computer or other electronic data, or in any other form that relate to this TSA Pre,; ® Application Expansion for each facility. Alclear, LLC shall also main tain all records and other evidence sufficient to reflect fees collected from the public, and fees forward to TSA as payment for TSA vetting and program maintenance, in accordance with Attachment 4in the conduct ofTSA Pre./® Application Expansion. The Contracting Officer, Contracting Officer's Representative, or the authorized representat ives of these officers shall have the right to examine and audit those records at any time. This right of examination shall include inspection at all reasonable times at Alclear, LLC's offices directly responsi ble for managing the TSA Pre./® Application Expansion. The Comptroller General of the United States shall also have access to, and the right to examine, any records invo lving transactions related to this Agreemen t. This a1iicle shall not be construed to require Alclear, LLC, or its contractors or subcontractors who are associated with or engaged in activities relating to this OTA, to create or maintain any record that they do not maintain in the ordinary course of business pursuant to a prov ision of law, provided that those entities maintain records which conform to generally accepted account ing procedures. ARTICLE X - AUTHORIZED REPRESENTATIVES 

 

     

     

    

		TSA Contacts: G loria Uria, OTA Contracting Officer E-ma il :G loria.Uria@tsa.dhs.gov Telephone : 571-227-2429 Megan Kesler OTA Contract Specialist E-ma il: Megan .Kesler@tsa.dhs.gov Telephone: 571-227-2007 Pablo Landrau, COR E-mai l: Pablo.Landrau@L a.dhs .gov Telephone: 571-227-3140 Alclear, LLC Contacts (Please include telephone numbers and emai l addresses.) The COR is responsible for the techn ical adm in istration and liaison of this Agreement. The COR i s not authorized to change the scope of work, to make any comm itment or otherwise obl igate the TSA,or authorize any changes which affect the liability of the TSA. Alclear, LLC will infonn the Contracting Officer in the event that the COR takes any action which is interpreted by A lclear, LLC as a change in scope or liability to either pa1ty. ARTICLE XI - LIMITATIONS ON LIABILITY Subject to the provisions of Federal law, including the Federal Torts Claims Act, each party expressly agrees without exception or reservation that it shall be solely and exclusively l iable for the acts or omissions of its own agents and/or employees and that neither party looks to the other to save or hold it ha1mlcss for the consequences of any act or omission on the pa1t of one or more of its own agents or employees, subject to the same cond itions provided above. Alclear, LLC has the aftirmative duty to notify the TSA Contracting Officer in the event that Alclear, LLC believes that any act or om ission of a TSA agent or employee would increase A lclear, LLC costs and cause Alckar, LLC to seek compensation from TSA beyond TSA's liability as stated in Article IV (Responsibilities), or Article VI (Funding And Li mitations). Claims against either party for damages of any natu re whatsoever pursued under this Agreement shall be limited to direct damages not to exceed the aggregate outstan ding amount of funding obligated under this Agreement at the time the dispute arises.IfAlclear, LLC receives any communication which it interprets as instructions to change the work encompassed in this Agreement, or to incur costs not covered by fund ing obligated at that ti me, Alclear, LLC must not act on that communicat ion, and must contact the Contracting Officer verbally and in writing immediately. In no event, beyond the Entity's liabilities under the Protection of Information (Article XVIII), shall either party be liable to the other for consequential, punitive, specia l and incidental damages, clai ms for lost profi ts, or other indirect damages. 

 

     

     

    

		No third pa1iy shall assert any rights under this Agreement unless expressly provided herein. ARTICLE XII - DISPUTES Where possible, disputes shall be resolved by in forma l discussion between the Contracting Officer for TSA and an authorized representative of Alclear, LLC. All disputes arising under or related to this Agreement shall be resolved under this Article. Disputes, as used in this Agreement, mean a written demand or written assertion by one of the parties seeking, as a matter of right, the adjustment or interpretation of Agreement terms,or other relief arising under this Agreement.The dispute shall be made in writing and signed by a duly authorized representative of Alclear, LLC or the TSA Contracting Officer. At a minimum, a dispute under this Agreement shall i nclude a statement of facts, adequate supporting data, and a request for relief. In the event the parties are unable to resolve any disagreement through good faith negotiations, Alclear, LLC may submit the d ispute to the Deputy Assistant Administrator for Contracting and Procurement. Ifthe decision of the Deputy Assistant Administrator for Contracting and Procurement is unsatisfactory, the decision may be appealed to the TSA Assistant Administrator for Contracting and Procurement. The part ies agree that the TSA Assistant Administrator/Head of the Contracting Activity for Contracti ng and Procurement's decision shall be final and not subject to further jud icial or administrative review and shall be enforceable and binding upon the parties. ARTICLE XIII -TERM INATION In add ition to any other tenn ination rights provided by th is Agreement, either party may terminate th i s Agreement at an y time prior LO its expiration date, with or without cause, by giving the other party at least thirty (30) days' prior written notice of termination. Upon receipt ofa notice of tennination, the receiving party shall take immediate steps to stop the accrual of any additional obligations that might require payment. IfAlclear, LLC exercises its right to withdraw voluntarily from the project, Alclear, LLC agrees to reimburse the United States Government for all monies disbursed to it under this Agreement. ARTICLE XIV-SUSPENSION In add ition to any other termination rights provided by th is Agreement, the Government reserves the right to suspend work of the provider until the performance flaw is corrected and confirmed by the Government. This suspension will be at no cost to the Government. If performance issues continue to occur and are not corrected in a timely manner, the Government will proceed wi th the termination in accordance with Article XIII. ARTICLE XV - CHANGES AND/OR MODIFICATIONS Changes or modifications to this Agreement shall be in writing and signed by the TSA Contracting Officer and the authorized representative of Alclear, LLC. The modification shall 

 

     

     

    

		cite the subject provision to this Agreement and shall state the exact nature of the modif ication . No oral statement by any person shall be interpreted as modifying or otherwise affecting the terms of this Agreement. Reasonable administrative mod ifications such as changes in address changes, Key Personnel, name of the TSA Contracti ng Officer, etc. may be issued unilaterally by TSA. A ll changes or mod ification to this Agreement will be at no cost to the Government . The Contracting Officer may at any ti me, by wri llen order, unilaterall y direct changes within the general scope of this agreement in order to correct a security weakness, revise the schedule for specific activity, change operational parameters, adapt to new threats, or provide for more efficient operations,and shall mod ify the contract accord ingly. I f any such change cannot be accommod ated by the performer within the time allowed by the Contracting Officer, the Governmen t may suspend the performer's right to conduct any operations under this agreemen t, until the change can be implemented, for a fixed period, or permanen tly. A RTICLE XVI -NEW OR U PGRA DED TECH NOLOGIES, SOLUTIONS, AND PROVIDERS The Government encow·ages Alclear, LLC to continuously propose to TSA technological and process i mprovements to further enhance TSA Pre./® enrollments . To that end, the Government reserves the right to modify th is and other OTAs to incorporate these improvements, if in the best interest of the government . All changes or modification to th is Agreement will be at no cost to the Government . ARTICLE XVII - CONSTRUCTION OF THE AGREEMENT This Agreement is issued pursuant to the authority of the Aviation and Transportation Security Act, Pub. L. 107-71, 1 15 Stat. 597, specifically 49 O.S.C. l 14(m), and 106(1) and (m) and is not a procu rement contract, grant,cooperative agreement, or other financial assistance. I t is not i ntended to be, nor shall it be construed as a partnership, corporatio n, or other business organization. Both parties agree to provide their best efforts to achieve the objectives of this Agreement. The Agreement constitutes the entire a1:,JTeement behveen the parties with respect to the subject matter and supersedes all prior agreements, understandi ng, negotiations and discussions whether oral or written of the parties. Each pa11y acknowledges that there arc no exceptions taken or reserved under this Agreement . A RTICLE XVIII - PROTECTION OF IN FORMATION/EMPLOYEE ACCESS/SAFEGUARDING SENSITIVE INFORMATION Applicability. This article applies to Alclear, LLC, its subcontractors, and Entity employees (hereafter referred to collectively as "OTA Entity"). The OTA Entity shall insert the substance of th is article in all subcontracts. 

 

     

     

    

		Definitions Sensitive Information, as used in this a1ticle, means any information, the loss, misuse, disclosure,or unautho rized access to or modification of which could adversely affect the national or homeland security interest, or the conduct of Federa l programs, or the pr ivacy to which individuals are entitled under section 552a of title 5, United States Code (the Privacy Act), but which has not been specifically authori zed under criteria established by an Execut ive Order or an Act of Congress to be kept secret in the interest of nationa l defense, homeland security or foreign pol icy. This definition includes the following categories of infonn ation: )"Personally Identifiab l e Information (Pll)" means i nfonnat ion that can be used to distinguish or trace an individual's identity, such as name, social security num ber, or biometric records, either alone, or when combined with other personal or identifying information that is linked or linkable to a specific individual, such as date and place of birth, or mother's maiden name. The definition of PII is not anchored to any singl e category of infonnat ion or technology. Rather, it requires a case-by-case assessment of the specific risk that an individua l can be identified . In perfonning this assessment, it is important for an agency to recognize that non-personally identifiable information can become personally identifiable information whenever additional information is made publ icly avai lable-in any medium and from any source-that, combined with other available information, could be used to identify an individual. Pll is a subset of sensitive i nfonnat ion. Examples of Pll incl ude, but are not l imited to: name, date of birth, mailing address, telephone number, Social Security number (SSN), email address, zip code, account numbers, certificate/license numbers, vehicle identifiers including license plates, uniform resource locators (URLs), static Internet protocol addresses, biometr ic identifiers such as fingerprint, vo iceprint, iris scan, photograph ic facial images, or any other un ique identifying number or characteristi c,and any in fonnation where it is reasonably foreseeable that the info1mation will be linked with other information to identify the individual. Protected Critical Infrastructure Information (PCII) as set out in the Critical Infrastructure Information Act of2002 (Title II, Subtitle B, of the Homeland Security Act, Public Law 107-296, 196 Stat. 2 135), as amended, the implementing regulations thereto (Title 6. Code of Federa l Regulations, Part 29) as amended, the applicable PCll Procedures Manual,as amended , and any supplementary guidance officially communicated by an authorized official of the Department of Homeland Security (including the PCII Program Manager or his/her designee); Sensitive Security Information (SSI), as defined in Title 49. Code of Federal Regulations. Pait 1520,as amended, "Policies and Procedures of Safeguarding and Contro l of SSI," as amended, and any supplementary guidance officially commun icated by an authorized omcial or the Department of Homeland Security (including the Assistant Secretary for the Transportation Security Administration or his/her designee); Information designated as ''For Official Use Only," which is unclassified information ofa sensitive nature and the unauthorized disclosure of which could adversely impact a 

 

     

     

    

		person's privacy or wel fare, the conduct of Federa l programs, or other programs or operations essential to the national or homeland securit y interest; and Any information that is designated "sensitive" or subject to other controls, safe1:,'Uards or protections in accordance with subsequently adopted homeland security information handling procedures . "Sensitive lnfom1ation Incident" is an incident that includes the known, potential , or suspected exposure,loss of control, compromise, unauthorized disclosure, unauthorized acquisition, or unautl1orized access or attempted access of any Govenunent system, OTA Enti ty system, or sensitive infonnation. Sensitive Persona lly Identifiable lnfonnation (SPll)" is a subset of Pll, wh ich if lost, comprom ised or discl osed without authorization, could result in substantial harm, embarrassment , inconvenience, or unfairness lo an indiv idual. Some fonns of PII are sensitive as stand-alone elements. Examples of such PU include: Social Security numbers (SSN), driver's license or state identification number, Alien Registration Num bers (A-number), financia l account number, and biometr ic identifiers such as fingerprint, voiceprint, or iris scan. Add itiona l examples include any groupings of infonnation that contain an individua l 's name or other unique identifier plus one or more of the following elements: (I) (2) (3) (4) (5) (6) (7) Truncated SSN (such as last 4 digits) Date of birth (month, day, and ye.ar) Citizensh ip or immigration status Ethnic or religious affi liation Sexual orientation Criminal History Medical Information System authentication informa tion such as mother's maiden name,account passwords or persona l identification numbers (PIN) Other PII may be "sensitive" depending on its context,such as a l ist of empl oyees and their perfonnance ratings or an unlisted home address or phone number. In contrast,a business card or public telephone directory of agency employees contains Pil but is not sensitive. "Information Technology Resources" include, but are not l imited to,computer equ ipment, networking equipment,telecommunications equipment, cabl ing, network dri ves, computer drives, network software, computer software, software programs, intranet sites, and internet sites. PROTECTION OF INFORMATION The parties agree that they shall take appropriate measures to protec t proprie tary, pri vileged , or otherwise confidential infonnat i on that may come into their possession as a result of this Agreement. Records and Release of Information 

 

     

     

    

		Pursuant to 49 U.S .C. § I l4(r), Sensitive Securi ty lnfonnation and Nondisclosure of Security Activities, Sensitive Security Infonnation (SSI) is a category of sensitive but unclassified (SBU) infonnation that must be protected because it is information that, if publicly released, would be detrimental to the security of transportation. Under 49 Code of Federa l Regulations Part I520.5(a), the SSI Regulation also prov ides additional reasons for protecting information as SS! beyond the cond ition that the release of the information wou ld be detrimental to the security of transportation. SSI may not be disclosed except in accordance with the provisions or that rule. Title 49 of the Code of Federal Regulations, Part 1520 defines the scope, categorization, handling requirements and disposition of info1mation deemed SSI is the 49 C.F.R.Part 1520 (http://ecfr.gpoaccess.gov/) .All members assigned to work under th is Agreement are subj ect to the provisions of 49 CFR Part I520, Protection of Sensitive Security Information, and shall safeguard and handle any SSI in accordance with the pol icies and procedures outlined in 49 Part 1520, as well as the DHS and TSA policies and procedures for handling and safeguarding SSL A ll members assigned to work under this Agreement must complete the TSA mandated SSI Awareness Training course prior to accessing SSI, and on an annual basis for the duration of the OTA or for the duration of the requester's need for access to SS!, whichever is later. The Agreement Holder shall place this requi rement in all contracts, sub-contracts, joint venture agreements, and teaming agreements related to the perfonnance of this agreement.For purposes of this OTA, the OTA Agreemen t ho l der (OTA Entity) wou ld fall under the provis ion of 49 CFR § I520.7(k): Each person employed by, contracted to, or actingfor a covered person, including a grantee of DHS or DOT. and including a person formerly in such position . Pursuant to 49 C.F.R. Part !520.9(a)(3), the Agreement Holder must contact SSI@tsa.dhs .gov for gu idance on handling requests to access to SSI (before using SS! materials) for any other purpose besides activities falling within the scope of the agreement by other persons, including requests from expe1ts, consultants, and legal counsel ("requesters") hired by the Agreement Holder. The Agreement Holder shall include the Contracting Officer (CO) and Contracting Officer Representative (COR) as a carbon copy "cc" recipient of its contact to SSl@tsa.dhs.gov. The TSA SSI office must first make a determination as to whether the requesters are a "covered person" with a "need to know" under 49 C.F.R. Parts 1520.7 and I520. I I.Further recipients of SSI shall be provided NDAs, in accordance with these contract provisions, and with a copy of the SS/ Quick Reference Guide/or DHS Employees and Contrac/ors. (Non-Disclosure Agreements (N DAs). The Contracting Officer will provide the non-disclosure Conn (DHS Fonn 1 1000-6), as necessary, to the Agreement hol der when circumstances warrant. NDAs are required to be signed by all OTA personnel when access to SSI is necessary for perfonnance of the a1:,1feement. By sign ing the NOA, the recipient certifies in writing that they will take the necessary steps to prevent the unauthorized disclosure and use of information. Bre.ach. In accordance wi th 49 C.F.R . Part l 520.9(c), the Agreement holder agrees that in the event of any actual or suspected breach of SSI (i.e., loss of control,compromise, unauthorized disclosure, access for an unau thorized purpose, or other unautho rized access, whether physical or electronic), the Agreement hol der shall immediatel y, and in no event later than one hour of discovery, report the breach to the Contracting Officer and the COR. The Agreement holder is responsi ble for positively verifying that notification is received and acknowledged by at least one of the foregoing Government officials. 

 

     

     

    

		Background. Members assigned to work under th is Agreement must obtai n speci fi e authorization in order to obtain SSL SSI will not be available or otherwise provided or disclosed to any person not specifically authorized to receive it. As part of this OTA, SSI may only be accessed by ind ividuals which have successfu lly passed a Security Threat Assessment. This assessment may include a criminal h isto1y records check (CHRC) and/or a check against terrorism databases. In fonnation Requirements. Cons i stent with the criteria release described above, the Agreement Holder shall provide the appropriate infonnation to the TSA COR as identified below. Note that this requirement applies likewise to all contracts, sub-contracts, joint venture agreements,and teaming agreements related to the performance of th is agreement. This information wi ll be hand led in accord ance with the applicable Privacy Act system of records notice (SORN), Transportation Security Threat Assessmen t System (T-STAS) noted below . The Agreement Holder shall provide the following information for all employees who require access to SSI in a single password protected Microsoft Excel spreadsheet emai led to the COR. The password for the password protected spreadsheet shall be sent to the COR in a separate emai l,at the same time. Employee Full Name Employee Gender: (i.e., Male or Fema le) Employee Birth Date Employee Citizenship Social Security Num ber (for U .S. Citizens and Legal Permanent Residents only) Known Traveler Number (KTN), if available Privacy Act Statement. TSA will use the information provided to conduct a security threat assessment on individua ls who seek access to Sensitive Security Information (SSI). The informat ion will be shared with in OHS with personnel who need the inform ation to perform their officia l duties. Additionally, OHS may share the informat ion wi th law enforcement, i ntelligence, or other governmen t agenci es as necessa ry to identi fy and respond to potential or actual threats to transportation security in accordance with the routine uses identified in the appl icable Privacy Act system of records notice (SORN), DHS!fSA 002, Transportation Security Threat Assessment System (T-STAS). This SORN was last publ ished in the Federa l Register on August I I , 20 14,and can be found at 79 FR 46862-46866. Authority: 49 USC 114. Furnish ing this information is voluntary. However, fai lure to furnish the requested i nfonnat ion may delay or prevent the completion of your securi ty threat assessment, wi thout which you may not be granted access to the SSL fV.Notificat ion of Assessment. Individuals who receive a successfu l Security Threat Assessment will be eligible to receive SSL If it is determined that covered individuals arc not eligible to receive access to part icular SS!based on the threat assessment,the TSA Contacting Officer or COR wi ll prov ide the company po i nt of contact with noti fication that the indi vi dual does not qualify to receive SSL Appeal of the determina tion will not be pennitted due to the time sensitive nature of the acquisition process, however, the potential OTA Entity may nom inate 

 

     

     

    

		another individual to receive SSI access . In the event thal an indi vidua l is determined to be a security threat and the individual believes that the results of the screening are inaccurate , he or she may request access to their records by submitting a Privacy Act Request through TSA's Freedom oflnformation Act (FOIA) internet site at: hnps://www.tsa.gov/foia/reguests. However, due to the demanding acquisition schedule, TSA wi ll not delay an acquis ition to resolve these issues. Publicity and Dissemination of Agreement Information The Agreement holder shall not publish , permit to be published, or distribute for public consumption, any information, oral or written, concerning the results or conclusions made pursuant to the performance of this Agreement without the prior written consent of the Contracting Officer. The Agreement holder shall submit any request for public release at least ten (I0) business days in advance of the planned release. Under no circumstances shall the Agreement holder release any requested submi ttal prior to TSA approval. Any material proposed lo be published or distributed shall be submi tted v ia emai l to lhe Contracting Officer. The Contracting Officer will follow the procedu res in Management Directives 1700.3 and 1700.4. The Office of the Administra tor retains the authority to deny publication authorization. Any conditions on the approval for release will be clearly described. Notice of disapproval will be accompanied by an explanation of the basis or bases for disapproval. Any contact with or by a Media firm or personnel related to this Agreement and in accordance wilh the terms of this Agreement shall be referred to lhe Contracting Officer. OTA ENTITY EMPLOYEE ACCESS OTA Entity employees working on this contract must complete such forms as may be necessary for security or other reasons, including the conduct of background investigations to determine suitability. Completed forms shall be submitted as directed by the Contracting Officer. Upon the Contracting Officer's request, the OTA entity's employees shall be fingerprinted, or subj ect to other in vestigations as required . All OTA entity employees requiring recurring access to Government facilities or access to sensitive infonnation or IT resources are required to have a favorably adjudicated background investigation prior to commencing work on th is contract unless this requirement is wa ived under Departmental procedures. The Contracting Officer may require the OTA Entity to prohib it individuals from working on the contract if the government deems their initial or continued employmen t contrary to the public interest for any reason, including, but not limited to, carelessness, insubordination , incompetence, or security concerns. Work under this contract may involve access to sensitive information. Therefore, the OTA Entity shall not disclose, orally or in wri ting, any sensitive information to any person un less authorized i n writing by the Contracting Officer. For those OTA Entity employees authorized access to sensitive infonnation, the OTA Entity shall ensure that these persons receive training concerning the protection and disclosure of sensitive information both during and after contract 

 

     

     

    

		perfonnance. The OTA Entity shall include the substance of this article in all subcontracts at any tier where the subcontractor may have access to Government facil ities, sensitive information, or rcsomccs. Before receiving access to IT resources under this OTA the individual m ust receive a security briefing, which the Contracting Officer's Technical Representative (COR) will arrange, and complete any nondisclosure agreement furnished by DHS. The OTA Entity shall have access only to those areas of OHS information technology resources expl icitly stated in this contract or approved by the COR in writing as necessary for perfonnance or the work under th is contract. Any attempts by OTA Entity personnel to gain access to any information technology resources not expressly authorized by the statement of work,other terms and conditions in this contract, or as approved in writing by the COR, is strictly prohibited. In the event of violation of this provision, DHS will take appropriate actions with regard to the contract and the individua l(s) involved. OTA Entity access to OHS networks from a remote location is a temporary privilege for mutual convenience wh ile the OTA Entity perfonns business for the OHS Componen t. It is not a ri ght, a guarantee of access, a condition of the contract, or Government Furnished Equipment (GFE).OTA Entity access will be termina ted for unauthorized use. The OTA Entity agrees to hold and save OHS hannless from any unautho rized use and agrees not to request additional time or money under the contract for any delays resu lting from unauthorized use or access. Non -U .S. citizens shall not be authorized to access or assist in the development,operation, management or maintenance ofOepartment IT systems under the contract, unless a waiver has been granted by the Head of the Component or designee, with the concunence of both the Depaitment's Chief Security Officer (CSO) and the Chieflnformation Officer (CIO) or their designces. Within OHS Headq uarters, the waiver may be granted only with the approval of both the CSO and the CIO or their designees. In order for a waiver to be granted: ) The individual must be a legal permanent resident of the U.S. or a citizen of Ireland, Israel, the Republic of the Philippines,or any nation on the Allied Nations List main tained by the Depaltment of State; There must be a compelling reason for using this ind ividual as opposed to a U.S. citizen; and The waiver must be in the best interest of the Governmen t. OTA Entity's shall identify in their proposals the names and citizenship of all non-U.S . citizens proposed to work under the contract. Any additions or deletions ofnon-U.S. citizens after contract award sha ll also be reported to the contracting officer. Applicability. This article applies to Alclear, LLC, its subcontractors, and Entity employees (hereafter referred to collectively as "OTA Entity"). The OTA Entity shall insert the substance of this article i n all subcontracts. 3.Safeguarding of Sensitive Information 

 

     

     

    

		Authorities . The OTA Entity shall follow all current versions of Government policies and guidance accessible at http://www.d bs.gov/dhs-securi ty-and-trainin g-req uirements-contractors, or available upon request from the Contracting Officer, includ ing but not l imited to: ( l ) OHS Management Directive 1 1042.l Safeguarding Sensitive But Unclass ified (for Official Use Only) Information DHS Sensitive Systems Policy Directive 4300A DHS 4300A Sensitive Systems Handbook and Attachmen ts DHS Security Authorization Process Guide DHS Handbook for Safeguarding Sensitive Persona lly Identifiable Information OHS Instmction Handbook 121-0 1-007 Department of Homelan d Security Personnel Suitabi lity and Security Program DHS lnfonnation Securi ty Perfonnance Plan (current fi scal year) DHS Privacy Incident Handling Guidance Federal Information Processing Standard (FIPS) 140-2 Security Requirements for Cryptogra ph ic Modu les accessible at http://csrc.nist.gov/groups/STM/cmvp/standards.html National Institute of Standards and Technology (N IST) Special Publication 800-53 Securi ty and Privacy Controls for Federal Information Systems and Organizat i ons accessible at btto ://csrc.ni st.gov/publ i cati ons/PubsSPs.html NIST Special Publication 800-88 Gu idelines for Media Sanitization accessible at http ://csrc.nist.gov/pub!ications/PubsSPs.htmI Handling of Sensitive Information. OTA Entity compliance with the po licies and procedures descri bed below, is required . Department of Homeland Security (DHS) policies and procedures on OTA Entity personnel security requirements are set forth in var ious Management Directives (MDs), Directives, and lnstmctions. MD I 1042.I , Safeguarding Sensitive But Unclassified (For Official Use Only) Information describes how OTA Entity must handle sensitive but uncl assi fied informat i on. DHS uses the tenn "FOR OFFICIAL USE ONLY" to identify sensitive but unclassified information that is not otherwise categorized by statute or regula tion. Examples of sensitive information that are categorized by statute or regula tion are PCII, SSI, etc. The DHS Sensitive Systems Policy Directive 4300A and the DHS 4300A Sensitive Systems Handbook provide the policies and procedures on security for Information Technology (IT) resources. The DHS Handbook for Safeguarding Sensitive Personally Identifiable Inf ormation provides guidel ines to help safeguard SPll in both paper and electronic form. DHS Instruction Handbook J 21-01-007 Department of Homeland Security Personnel Suitability and Security Program establ ishes procedu res, program responsibi lities, minimum standards, and reporting protocols for the DHS Personnel Suitability and Security Program. The OTA Entity shall not use or redistribute any sensitive in formation processed, stored, and/or transm itted by the OTA Entity except as specifi ed in the contract. All OTA Entity employees with access to sensitive infonnation shall execute DHS Form 11000-6, Department ofHom.e/and Security Non-Disclosure Agreement (NDA). as 

 

     

     

    

		a condition of access to such in formation . The OTA Entity shall maintain signed copies of the NDA for all employees as a record of compliance. The OTA Entity shall provide copies of the signed NDA to the Contracting Officer's Representative (COR) no later than two (2) days after execution of the form. The OTA Entity's invoicing, bi ll ing, and other recordkeeping systems main tained to support financial or other administrative functions shall not main tain SPll. It is acceptable to maintain in these systems the names, titles and contact information for the COR or other Government personnel associated with the administration of the contract, as needed. Au thority to Operate. The OTA Entity shall not input, store, process, output, and/or transm it sensi tive information within an OTA Entity IT system wi thout an Authori ty to Operate (ATO) signed by the Headq ua1iers or Component CIO, or designee, in consultation with the Headqua1iers or Component Privacy Officer. Un less otherwise specified in the ATO letter, the ATO is valid for three (3) years. The OTA Entity shall adhere to current Government policies , procedures, and gu idance for the Security Authorization (SA) process as defined below. ) Complete the Securi ty Authorizati on process. The SA process shall proceed according to the DHS Sensitive Systems Policy Directive 4300A (Version 11.0, April 30, 2014), or any successor publication, DHS 4300A Sensitive Systems Handbook (Version 9.1, Ju ly 24, 2012), or any successor publ ication, and the Security Awhorization. Process Guide including templates. Security Authorization Process Documentation. SA documentation shall be developed using the Government provided Requirements Traceability Matrix and Goverrunent security documentation templates. SA documentation consists of the following: Security Plan, Contingency Plan, Contingency Plan Test Results, Configuration Management Plan, Security Assessment Plan, Security Assessment Report, and Author ization to Operate Letter. Addit ional documen ts that may be required include a Plan(s) or Action and Mi lestones and lntercoru1ec tion Security Agreement(s) . During the development of SA documentation, the OTA Entity shall submit a signed SA package, validated by an independent third party, to the COR for acceptance by the Headquarters or Component CIO, or dcsignee, at least thi1ty (30) days prior to the date of operation of the IT system. The Government is the final authori ty on the compliance of the SA package and may limit the number of resubmissions of a modified SA package. Once the ATO has been accepted by the Headquarters or Component CIO, or designee, the Contracting Officer shall incorporate the ATO into the contract as a compliance document. The Government's acceptance of the ATO does not alleviate the OTA Entity's responsibi lity to ensure the IT system controls are implemented and operating effectivel y. Independent Assessmen t. OTA Entities shall have an independent th ird pa1ty validate the security and privacy controls in place for the system(s). The independent th ird party shall review and analyze the 

 

     

     

    

		SA package, and report on technical, operationa l, and management level deficiencies as outlined in NIST Special Publication 800-53 Security and Privacy Controlsfor Federal Infonnation Systems and Organizations. TSA reserves the right to serve as the independent party to review and analyze security and pr ivacy controls. The OTA Entity shall address all deficiencies before subm itting the SA package to the Government for acceptance. Support the completion of the Privacy Threshold Analysis (PTA) as needed. As part of the SA process, the OTA Entity may be required to support the Government in the completion of the PTA. The requirement to complete a PTA is triggered by the creation, use, modification, upgrade, or disposition of a OTA Entity IT system that will store, maintain and use Pll,and must be renewed at l east every three (3) years. Upon review of the PTA, the DHS Privacy Office determines whether a Privacy Impact Assessment (PIA) and/or Privacy Act System of Records Notice (SORN), or modifications thereto, are required . The OTA Entity shall provide all support necessary to assist the Department in completing the PIA in a timely manner and shall ensure that project management plans and schedules include time for the completion of the PTA, PIA, and SORN (to the extent required) as milestones . Support in this context includes responding timely to requests for information from the Government about the use, access, storage, and maintenance of Pll on the OTA Entity's system, and providing timely review of relevant compliance documents for factual accuracy . Information on the DHS privacy compl iance process, including PTAs, PIAs, and SORNs, is accessible at http://www.dhs .gov/privacy-compliance. Renewal of ATO. Unless otherwise specified in the ATO letter, the ATO shall be renewed every three (3) years. The OTA Entity is required to update its SA package as part of the ATO renewa l process. The OTA Enti ty shall update its SA package by one of the following methods: (1) Updating the SA documentation in the DHS automated infonnation assurance tool for acceptance by the Headqua1ters or Component CIO, or designee, at least 90 days before the ATO expiration date for review and ver ification of security controls; or (2) Submitting an updated SA package directly to the COR for approval by the Headquarters or Component CIO, or designee, at least 90 days before the ATO expiration date for review and verification of security controls. The 90-day review process is independent of the system production date and therefore it is important that the OTA Entity build the review into project schedules. The reviews may include onsite visits that involve physical or logical inspection of the OTA Entity environment to ensure controls arc in place. Security Review. The Government may elect to conduct random period ic reviews to ensure that the security requi rements contained in this contract are being implemented and enforced. The OTA Entity shall afford DHS, the Office of the Inspector General, and other Government organizations access to the OTA Entity's facilities, installations, operations, documentation, databases and personnel used in the performance of this 

 

     

     

    

		contract. The OTA Enti ty shall, th rough the Contracting Officer and COR, contact the Headqua1iers or Component CIO, or designee, to coordinate and pa1iicipate in review and inspection activity by Government organizations external to the OHS. Access shall be provided, to the extent necessary as determ ined by the Government, for the Government to carry out a program of inspection, investigation, and audit to safeguard against threats and haza rds to the integrity, availabil ity and confiden tiality of Government data or the function of computer systems used in perfonnance of this contract and to preserve evidence of computer crime. Continuous Monitoring. All OTA Entity-operated systems that input,store, process, output, and/or transm it sensitive infonnat ion sha ll meet or exceed the continuous monitoring requi rements identified in the Fiscal Year 2014 DHS Information Security Pe1formance Plan, or successor publ ication . The plan is updated on an ann ual basis. The OTA Entity shall also store monthly continuous monitoring data at its location for a period not less than one year from the date the data is created. The data shall be encrypted in accordance with FfPS 140-2 Security Requirements.for Ciyptographic Modules and shall not be stored on systems that arc shared with other commercial or Governmen t entities. The Government may elect to perform continuous mon itoring and IT securi ty scanning of OTA Entity systems from Government tools and in frastructure. Revocation of ATO. In the event of a sensitive informat ion inciden t, the Governmen t may suspend or revoke an ex isting ATO (either in part or in whole). Ifan ATO is suspended or revoked in accordance with this provision, the Contracting Officer may direct the OTA Entity to take add itiona l security measures to se.cure sensitive i nfonnat ion. These measu res may i nclude restricting access to sensi ti ve infonnation on the OTA Entity IT system under this contract. Restricting access may include disconnecting the system processing, storing, or transmitting the sensitive information from the Internet or other networks or applying additional security controls. Federal Reporting Requirements. OTA Entity's operating infonn ation systems on behal f or the Government or operating systems contai n i ng sensitive in fonnation shall comply with Federal reporting requirements. Annual and qua1ierly data collection will be coordinated by the Gove1mnent. OTA Entity's shall provide the COR with requested information wi thin three (3) business days of recei pt of the request. Report ing requirements arc determined by the Government and arc defined in the Fiscal Year 2014 DHS hiformation Security Pe1formance Plan, or successor publication. The OTA Entity shall prov ide the Government wi th all in fonnation to full y satisfy Federal reporting requirements for OTA Entity systems. Sensitive Informa tion Incident Reporting Requirements. All known or suspected sensitive infonnation incidents shall be repo1ied to the Headqua1iers or Component Security Operations Center (SOC) within one hour of discovery in accordance with 4300A Sensitive Systems Handbook !11.cide11t Response and 

 

     

     

    

		Reporting requirements . When notifying the Headquarters or Component SOC, the OTA Entity shall also notify the Contracting Officer, COR, Headqua1iers or Component Privacy Officer,and US-CERT using the contact information identified in the contract. Ifthe incident is reported by phone or the Contracting Officer's email address is not immediately avai lable, the OTA Entity sha ll contact the Contracting Officer immediately after reporting the incident to the Headquarte rs or Component SOC. The OTA Entity shall not includ e any sensitive information i n the subject or body of any e-mail. To transmit sensitive info1mation, the OTA Entity shall useFJPS 140-2 Security Requireme ntsfor Cryptographic lvfodules compliant encryption methods to protect sensitive information in attachments to email. Passwords shall not be communicated in the same emai l as the attachment. A sensitive information incident shall not, by itself, be interpreted as evidence that the OTA Entity has failed to provide adequate informat ion securi ty safeguards for sensitive information,or has otherw ise failed to meet the requirements of the contract. If a sensitive informa tion incident involves PI! or SPII, in addition to the reporting requirements in 4300A Sensitive Systems Handbook Incident Response an.d Reporting, OTA Entity's shall also provide as many of the following data clements that arc ava ilable at the time the incident is reported, with any rema ining data elements provided with in 24 hours of subm ission of the i n i tial incident report : Data Universal Numbering System (DUNS); Contract numbers affected unless all contracts by the company are affected; (iii)Facil ity CAGE code if the location of the event is different than the prime OTA Entity location; (iv) (v) (vi) (vii) Point of contact (POC) if d ifferent than the POC recorded in the System for Awa rd Management (address,position, telephone, email); Contracting Officer POC (address, telephone,email); Contract clearance level; Name of subcon tractor and CAGE code if this was an incident on a subcontractor network; Governmen t programs, platfonns or systems involved; Location(s) of incident; Date and time the incident was discovered ; Server names where sensitive informa tion resided at the time of the incident, both at the OTA Entity and subcontractor level; )Description of the Government PIT and/or SPII contained within the system; )Number of peopl e potent ially affected and the estimate or actual number of records exposed and/or contain ed with in the system; and Any additional information relevant to the incident. Sensitive Information incident Response Requirements . (I) All determ inations related to sensitive information incidents, including response activities, notification s to affected individuals and/or Federal agencies, and related services (e.g., credit monitori ng) will be mad e in wri ting by the Contract ing Officer in consultation with the Headquarters or Component CIO and Headquarters or Component Privacy Officer. 

 

     

     

    

		The OTA Entity shall prov ide full access and coopera ti on for all activities determined by the Government to be required to ensure an effective incident respon se, including providing all requested images, log files, and event information to facilitate rapid resolution of sensitive information incidents. Incident response activities determined to be required by the Government may includ e, but are not limited to, the following: Inspecti ons, Investigations, (iii)Forensic review s, and (iv)Data analyses and processing. The Government, at its sole discretion, may obtain the assistance from other Federal agencies and/or third-party firms to aid in incident response activities. Add itional Pl! and/or SP!! Notificat ion Requirements . ( l) The OTA Entity shall have in place procedures and the capabi lity to notify any individual whose Pll resided in the OTA Entity IT system at the time of the sensitive information incident not later than 5 business days after being directed to notify i ndividua l s, un less otherwise approved by the Contract i ng Oflicer. The method and content of any notification by the OTA Entity shall be coordinated with, and subject to prior written approval by the Contracting Officer, in consultation with the Headquarters or Component Privacy Officer, utilizing the DHS Privacy incident Handling Guidance. The OTA Entity shall not proceed with notification unless the Contracting Officer, in consultat ion with the Headquarters or Component Privacy Officer, has determined in writing that notification is appropriate. Subj ect to Government analysis of the incident and the tenns of its instructions to the OTA Entity regarding any resulting notification, the notification method may consist of letters to affected individuals sent by first class mail,electronic means, or general public notice, as approved by the Government. Notification may require the OTA Entity's use of address verification and/or address location services. At a minimum, the notification shall incl ude: A brief description of the incident; A description of the types of PI! and SPII involved; (iii)A statement as to whether the PII or SPll was encrypted or protected by other means; Steps individuals may take to protect themse lves; What the OTA Entity and/or the Government are doi ng to investigate the incident, to mitigate the incident, and to protect against any future incidents; and Information identifying who individuals may contact for additional info1mation. Credit Monitoring Requir ements. In the event that a sensitive information incident involves Pl! or SPII, the OTA Enti ty may be requ i red to,as directed by the Contracting Officer: (I)Provide notification to affected individuals as described above; and/or Provide credit monitoring services to individual s whose data was under the control of the OTA Entity or resided in the OTA Entity IT system at the time of the 

 

     

     

    

		sensitive information inciden t for a period begi nn ing the date of the incident and extending not less than 18 months from the date the individual is notified . Credit monitoring services shall be provided from a company with which the OTA Entity has no affi liation. At a minimum, credit monitoring services shall include: Triple credit bureau monitoring ; (ii)Dai ly customer service; A lerts prov ided to the individua l for changes and fraud; and Assistance to the individual with eru-ollment in the services and the use of fraud alerts; and/or Establish a dedicated call center. Call center services shall include: A dedicated telephone number to contact customer service within a fixed period; lnfonnation necessa ry for registrants/enrollees to access credit reports and credit scores; Weekly reports on call center volume, issue escalation (i.e., those calls that cannot be handled by call center staff and must be resolved by call center management or OHS, as appropriate),and other key metrics; Escalation of calls that cannot be handled by call center staff to call center managemen t or OHS, as appropriate; Customized FAQs, approved in writing by the Contracting Officer in coordination with the Headquarters or Component Chief Privacy Officer; and Information for registrants to contact customer service representat ives and fraud reso lution representat ives for credit monitoring assistance. Certification of Sanitization of Government and Government-Activity-Re lated Files and Jnfonnation. As part of contract closeout, the OTA Entity shall submit the certification to the COR and the Contracting Officer following the template provided in NIST Special Publication 800-88 Guidelinesfor Media Sanitization. (End of clause) The parties agree that they shall take appropriate measures to protect proprietary, privil eged,or otherwise confidential information that may come into their possession as a result of this Agreement. ARTICLE XIX-RIGHTS IN DATA The Government espouses no ownership rights in data or software, created or produced by performers under this agreement, including tools provided to the Government. Applicant data is not data created or produced under the OTA; applicant data wi ll be considered TSA data. The Government reserves the right to order access to or del ivery of, and license to review all Entity data or software produced or uti lized under the OTA for purposes of audi t and compl iance. Such l icense shall provide a right of use, solel y for the purposes of this OTA . ARTICLE XX PRIVA CY ACT 

 

     

     

    

		The Entity agrees to-Comply with the Privacy Act of 1974 (the Act) and the agency rules and regulations issued under the Act in the design, developmen t, or operation of any system of records on individuals to accompl ish an agency function when the contract specifically identifies-The systems of records; and The design, development, or operation work that the Entity is to perform; Include the Privacy Act notification contained in this contract in every solicitation and resulting subcontract and in every subcontract awarded without a solicitation, when the work statement i n the proposed subcontract requires the redesign, developm ent,or operation or a system of records on individuals that is subject to the Act; and Include this clause, including th is paragraph (3), in all subcontracts awarded under th is contract which requ ires the design, development, or operation of such a system of records. In the event of violations of the Act, a civi l action may be brought against the agency involved when the violation concerns the design, development, or operation of a system of records on individuals to accomplish an agency function, and criminal penalties may be imposed upon the officers or employees of the agency when the violation concerns the operation of a system of record s on individuals to accompl ish an agency function. For purposes of the Act, when the contract is for the operation of a system of records on individuals to accomplish an agency function, the Entity is considered to be an employee of the agency. (c)(l) "Operation ofa system of records," as used in this clause,means performance of any of the activities associated with maintaining the system of records, including the collection, use, and dissemina tion ofrecords. "Record," as used in this clause, means any item, collection, or grouping of information about an i ndividua l that i s maintained by an agency, incl udin g, but not l imited to, educati on, fmancial transactions, medical history, and criminal or employmen t history and that contains the person's name, or the identifying number, symbol,or other identifying particular assigned to the individual, such as a fingerprint or voiceprint or a photograph. "System of records on individuals," as used in this clause, means a group of any records under the contro l of any agency from which information i s retrieved by the name of the individual or by some identifying number, symbol, or other identifying pait icular assigned to the individual. PRIVACY ACT NOTIFICATION The Entity wi ll be required to design, develop, or operate a system of re.cords on individuals, to accomplish an agency function subject to the Privacy Act of 1974, Pub l ic Law 93-579, December 31, 1974 (5 U.S.C.552a) and applicable agency regulations. Violation of the Act may involve the imposition of criminal pen alties. 

 

     

     

    

		ARTICLE XX.I -DATA STORAGE AND USAGE All appl icant data collected and stored by the Entity for the purpose of applying for TSA Prev'® must be held in a separate database that can follow TSA prescribed data reten tion requirements. Data received and collected for the benefit of the Government shall be maintained in accordance with National Archives and Record s Adm in istration (NARA) guidelines. The Entity shall not use data collected from TSA applicants for any purpose other than subm ission to TSA unless the Entity obtains express perm i ssion from TSA as well as from each individua l appl icant after complet ion of the enrollment process for TSA Prev'®. The Entity must clearl y distinguish the completion of the enro llment process for TSA Prev'® before requesting permission from applicants to continue communication regarding any other marketing opportunities not affiliated with TSA Prev'®. Any such marketing communications would require the appl icants to affirmatively opt-in to such additional marketing. Entities are prohibited from us i ng, in any capacity, infonnat ion pertai n i ng to an appl icant's eligibi lity determ ination for TSA Prev'®. All prohibitions must be cl early stated in Terms and Conditions which are presented to applicants at the beginning of the enrollment process prior to the collection of information. TSA recognizes that the Entity may perform other functions for appl icants that rely on uti lizing the same applicant data clements. All concepts that require us ing appl icant data for purposes outside of submission to TSA require written approval from TSA. Additionally, the Entity must obtain and store wri tten authorization from each appl i cant to use the appl icant's biographic or biometric data for any purposes beyond those d irectly related to TSA Prev'® and must segregate TSA data from other data that the Entity may maintain on the same applicant even where the same data element (e.g., name) appears. The Entity shall operate a "system of records" wi thin the Privacy Act of I 974, 5 U.S.C. 552a, that limits the authorized disclosure and use ofTSA data. ARTICLE XX.II - INTERRELAT IONSHIPS OF ENTITY The Government has entered into other contractua l relationships in order to provide technical support services in the conduct of studies, analyses and engineering activities separate from the work to be performed under th is Agreement, yet having links and interfaces to them. Furth er, the Governmen t may extend these ex isting relationships or enter into new relationships. The Performer may be required to coordinate with such other Entiry(s) through the Program Manager in providing suitable, non-conflicting technical interfaces and in avoidance of duplication of effort. By suitable tasking, such other Entity(s) may be requested to assist the Government in the technical review of the Performer's technical efforts. Information on reports provided under this SOW and related documents may, at the discretion of the Government, be provided to such other Entity(s) for the purpose of such review. A Non-Disclosure Agreement (NDA),DHS Fonn 11000-6, shall be signed by all Entity employees assigned to perform services und er this OTA prior to any work. 

 

     

     

    

		ARTICLE XXI II - LIMITATION OF ASSIGNMENT Alclear, LLC may not assi!:,'11 its rights or obligations under this Agreement to any other entity or person without the prior written consent of the TSA. ARTICLE XXIV - PUBLICITY All publicity or public affairs activities related to the subject matter of this Agreement must be coordinated with the TSA Office of Strategic Communication and Public Affairs. ARTICLE XXV -THE LICENSING OF THE TSA PRE./®TRADEMARK l . The TSA Pre./® trademark constitutes OHS-owned intellectual property, and is used in connection with the Department's effo1is to facilitate expedited security screening experiences for selected travelers of participating airlines. DHS hereby confers to the OTA Entity a nonexclusive, nontransferable, royalty free use of the TSA Pre./® trademark, including the right to copy, display and distribute, for the sole and exclusive purpose of including the trademark on materials authorized by OHS as part of OTA Entity's marketing to prospective TSA Pre./® Program members. The OTA Entity shall be allowed to use the DHS "TSA Pre./®" trademark for advertising and promotional purposes in support of the TSA Pre./® Application Program and prospective members. Such use of this trademark shall include,but is not limited to : customer communications, advertising and marketing efforts and materials, interna l materia ls, lega l disclosures,customer statement marketing (e.g. statement message, statement ad, statement insert, etc.), d irect mail, letters, emails, flyers,postcards, online webpages, online secure session pages, interna l communication, training tools/reference materia ls, account agreements, terms and conditions disclosures, Guide to Benefits, or other uses as specifically authorized in writing by TSA. Any partnership marketing efforts or promotiona l tie-ins i nvolving the TSA Pre./® Application Program must be reviewed and approved by TSA prior to implementation . Market ing messaging must maintain the integrity of the product (expedited a irpo1t security screening) and product extensions or enhancements that infer an association with security screening services or expedi ted screening for a purpose other than aviation security will not be allowed (e.g., expedited screen ing or entry services where TSA Pre./® enrollment or status is used in place of or to expedite a non-aviation security screening. For example, TSA Pre./® "fast lanes" or "TSA Pre./® VIP lanes" at large events, stadiums, etc.). Inaddition, the OTA Entity shall provide to TSA all marketing and advertis ing plans for review and approval prior to launch to ensure acceptab le positioning/p lacement of the TSA Pre./® brand within the media marketplace and for max imum synergy with TSA -led efforts . To maintai n the legal protections associated with the trademark,TSA on beha l f of OHS must control the use of the trademark. OTA Entity agrees that no modifications to DHS Materials, if provided, will be published without TSA review and prior written approval from TSA (email communication is sufficient) other than the inclusion of Alclear, LLC's logos and other necessary data. OTA Entity also agrees that it shall not use the trademark in a manner or context that reflects unfa vorably upon any component of OHS or which will diminish or damage the goodwill associated with the TSA Pre./® trademark. Accordingly, such marketing materials 

 

     

     

    

		shall be "non-controversial ," mean ing the advertisements wi ll be consistent with normal standards for mainstream public advertising, as well as DHS and TSA media policy. In addition, the term precludes any political advertising, including but not limited to those pertaining to candidates, issues, parties, campaign comm ittees, specific elections, etc., or any other advertising that may create a sense of sponsorship or imply endorsement by the government. Add itionally, to protect and ensure the Governments interest against dilution of the TSA Pre./® trademark, i.e., dil ution by "blurring"and/or diluti on by "tarnishment", for Material s created by OTA Entity rega rding participation in the TSA Pre./® Program, OTA Entity agrees to release the Materials only after obtaining TSA's prior written approval (email communication is sufficient). TSA prior approva l is not needed for each individual item, provided that the use is substantially the same as pr ior approved materials. TSA will provide approva l for classes of items associated with advertising. 2. OTA Entity will represent itself as an independent entity,and not as an affiliate of the TSA or OHS. Any use of the TSA Pre./® trademark on OTA En ti ty Materials shall incl ude the following or sim ilar cred it, as appropriate: "OTA Entity is not a government entity or affi liated with the Federal government. OTA Entity provides pre-enrollment services for the Transportation Security Adm in istration's TSA Pre./® Risk Based Screening Program. The TSA Pre./® trademark is used under l icense wi th the permission of the U.S . Department of Homeland Security."(The notice must be displayed in a type font of legible size). The OTA Entity is authorized by TSA to sub-license the TSA Pre./® trademark to other organizations or agencies. OTA Entity will provide the TSA POC below with b i-annual reports listing all organizations with whom the OTA Entity has partnered to market the TSA Pre./® Program. The OTA Entity acknowledges that use of the Mark docs not constitute an endorsement by OHS. TSA or the U.S. Government of OTA Entity and that OTA Entity wi ll not state or imply that TSA , OHS or any entity or the U .S. Government endorses the OTA Enti ty or the goods and services associated with OTA Entity. OTA Entity shall abide by the TSA Pre./® License agreement. (See SOW attachment # 6). ARTICLE XXVI - SURVIVAL OF PROVISIONS In the event of the completion of the performance of the scope of work of the OTA, or the termination of th is OTA, wh ichever event occurs first, the following prov isions shall remain in full force and effect : A rticle I-Parti es; Article IV Respon sibil ities; Article VII -Fund ing and Limitations; Article - Audits; Aiticle XII - Disputes ; Article XI-Limitation of Liability; Aiticle XVII - Protection of Informat ion; A11icle XX-Privacy Act; A11icle XXV-Publicity; A11icle 

 

     

     

    

		XXV I -The Licensing of the TSA Pre./® Tradem ark; Article XXIX -Requ ired Federal Procurement Provisions; and Article XXVII -Survival of Provisions . ARTICLE XXVII - FL0\\1DO\\'N PROVISIONS A ll clauses within the Statement of Work (SOW), SOW attachments, and related documents !low down in the provisions of the OTA . A ll SOW,SOW Attachments, and related documents flow down to subcontractors,suppliers, and all partners and affiliates, etc., of Alclear, LLC. ARTI CLE XXVIII - INSURAN CE Alclear, LLC must arrange insurance or otherwise for the foll protect ion of Alclear, LLC from and against all liabil ity to the th ird parties out of, or rel ated to, it's performance or this OTA . The Department of Homeland Security (OHS) has not determ ined at th is point that the TSA Pre./® Application Expansion initiative satisfies the technical criteria for SAFETY Act Designation and presumptively satisfies the criteria for SAFETY Act Certification. ARTICLE XXIX - SECTION 504 COMPLIANCE (APR 2017) Alclear, LLC shall comply fully with Section 504 of the Rehabil itation Act of 1973, as amended, which prohibits discrimination against q ua lified individuals wi th disabil ities. No otherwise q ua lified individu al with a disabi lity shall, solely by reason of his or her disability, be excluded from part icipat ion in, be den ied the benefits ot or be subjected to discrimination under any program or activity for which the En ti ty/Provider is awarded a contract and/or receives Federal fmancial assistance from the Transportation Security Administration. This includes, but is not limited to, providing reasona ble accommoda tions and effective commun ication to persons with d isabilities and ensuring physical accessibi lity to all part icipants. The Entity/Prov ider shall ensure this requirement flows to all affected subcontracts. ARTICLE XXX - INFORMATION TECHNOLOGY SECURITY AND PRIVACY TRAINING Applicabil ity. This clause applies to the OTA Entity, its subcontractors, and OTA Entity employees (hereafter referred to collectively as "OTA Entity"). The OTA Entity shall inse1t the substance of this article in all subcontracts. Security Training Requ i rements. All users of Federal information systems are required by Title 5, Code of Federal Regu lations, Part 930.30 I, Subpa1t C, as amended, to be exposed to security awareness materials annually or whenever system security changes occur, or when the user's responsibil ities change. The Department of Homeland Security (OHS) requires that OTA Entity empl oyees take an annual Information Technology Securi ty Awareness Train ing course before accessing sensi ti ve infonnation under the contract. Unless otherwise specified, the training shall be completed within thirty (30) days of contract award and be completed on an annual basis thereafter not later 

 

     

     

    

		than October 31st of each yea r. Any new OTA En ti ly employees assigned lo the contract shall complete the training before accessing sensitive infonnation wider the contract. The training is accessible at http://www.dhs.gov/dhs-security-and-training-reguiremen ts-contractors. The OTA Entity shall maintain copies of training certificates for all Entity and subcontractor employees as a record of compliance. Un less otherwise specified, initial training certificates for each OTA Entity and subcontractor employee shall be provided to the Contracting Officer's Representative (COR) not l ater lhan thirly (30) days alter contract award. Subsequent train i ng cerlilicales to satisfy the annual training requirement shall be submitted to the COR via e-mail notification not later than October 31st of each year. The e-mail notification shall state the required training has been completed for all Enti ty and subcontractor employees. (2) The OHS Rules of Behavior apply to every OHS employee, OTA Entity and subcontractor that will have access to OHS systems and sensitive i nfonnalion. The OHS Rules of Behavior shall be signed before accessing OHS systems and sensitive info1mation . The OHS Rules of Behavior is a document that informs users of their respon sibilities when accessing OHS systems and holds users accountable for actions taken wh ile accessing OHS systems and using OHS Information Technology resources capable of inputting, storing, processing, outputting, and/or transm itting sensitive information. The OHS Rules of Behavior is access ible at hllp://www .dhs.go v/dhs-security-and -lrain i ng -requi remen ts-conl raclors. Unless otherwise specified, the OHS Rules of Behavior shall be signed within thirty (30) days of contract award. Any new OTA Entity employees assigned to the contract shall also si!:,'11 the OHS Rules of Behavior before accessing OHS systems and sensitive information. The OTA Entity shall maintain signed copies of the OHS Rules of Behavior for all Entity and subcontractor employees as a record of compliance. Un l ess otherw ise speci fied, the OTA Entity shall e-mai l copies of the signed OHS Rules of Behavior to lhe COR not later than thirty (30) days aner con tract award for each employee. The OHS Rules of Behavior will be reviewed annually and the COR will provide notification when a review is required. Privacy Training Requirements. All OTA Entity and subcontractor employees that wi ll have access to Personally Identifiabl e Information (Pll) and/or Sensitive Pll (SPll) are required to take Pri vacy at OHS: Protecting Personal Jnfom1at i on before accessing Pll and/or SPll. The train ing is accessible at http ://www.dbs.gov/dhs-securi ty-aad-trainin !!-rea uiremeats-contractors. Training shall be completed within thirty (30) days of contract award and be completed on an annual basis thereafter not later than October 31st of each year. Any new OTA Entity employees assigned to the contract shall a lso complete the trainin g before accessing Piland/or SPII. The OTA Entity shall maintain copies of training certificates for all OTA Entity and subcontractor employees as a record or complian ce. I nitial training certi ficates for each OTA Enlity and subcontractor employee shall be provided to the COR not later than thirty (30) days after contract award. Subsequent training certificates to satisfy the annual training requirement shall be submitted to the COR via e-mai l notification not later than October 31st of each year. Thee mai l notification shall state the required training has been completed for all OTA Entity and subcontractor employees . ARTICLE XXXI - EMPLOYMENT ELIGIBILITY VERIFICATION 

 

     

     

    

		The OTA Entity is required to enro ll in the E-Veri fy program within 30 days of OTA award, i f not enrolled at the time of award.For each employee assigned to the OTA, the OTA Entity shall in itiate verification with in 90 calendar days after date of OTA award or within 30 calendar days of the employee's assignment to the OTA, wh ichever date is later. ARTICLE XXXII REQUIRED FEDERAL PROCUREMENT PROVISIONS The Entity and its subcontractors shall comply with the following: 1.0 Title VI of the Civi l Rights Act of 1964 relating to nondiscrimination in Federa lly assisted program. 2.0 Contracts awarded by the Provider of this Proj ect must compl y with all prov isions established by laws and statutes.EX-4.2

 Exhibit 4.2 

AMENDED AND RESTATED INVESTORS’ RIGHTS AGREEMENT 

THIS AMENDED AND RESTATED INVESTORS’ RIGHTS
AGREEMENT (this “Agreement”) is made and entered into as of April 15, 2021, by and among Janux Therapeutics, Inc., a Delaware corporation (the “Company”), and the
investors set forth on the Schedule of Investors attached hereto as Schedule A (each, an “Investor” and collectively, the “Investors”). This Agreement amends and restates and supersedes in its entirety
that certain Amended and Restated Investors’ Rights Agreement executed by the Company and certain of the Investors on March 1, 2021 (the “Prior Agreement”). 

RECITALS 

WHEREAS, the Company and certain of the Investors are parties to that certain Series B
Preferred Stock Purchase Agreement, dated as of even date herewith (the “Purchase Agreement”); 

WHEREAS, the Company and certain of the undersigned Investors together constitute the Requisite Holders (as defined in
the Prior Agreement) and desire to, on behalf of the undersigned and all other parties to the Prior Agreement, amend and restate and supersede in its entirety the Prior Agreement and to accept the rights and covenants herein, in lieu of their rights
and covenants under the Prior Agreement; 
 WHEREAS, the obligations in the Purchase
Agreement are conditioned upon execution and delivery of this Agreement; and 
 WHEREAS,
in connection with the consummation of the Financing, the Company and the Investors have agreed to the registration rights, information rights, and other rights as set forth below. 

NOW, THEREFORE, in consideration of the foregoing recitals and the mutual promises, representations,
warranties, and covenants hereinafter set forth and for other good and valuable consideration, the receipt and sufficiency of which are hereby acknowledged, the parties hereto agree as follows: 

AGREEMENT 
 1.
REGISTRATION RIGHTS. 
 1.1 Definitions. For purposes of this Agreement: 

(a) The term “Avalon” means Avalon Ventures XI, L.P., a Delaware limited partnership. 

(b) The term “Affiliate” means, with respect to any specified Person, any other Person who, directly or
indirectly, controls, is controlled by, or is under common control with such Person, including, without limitation, any general partner, managing member, officer, director or trustee of such Person, or any venture capital fund or other investment
fund now or hereafter existing that is controlled by one (1) or more general partners, managing members or investment adviser of, or shares the same management company or investment adviser with, such Person. 

(c) The term “Board of Directors” means the Board of Directors of the Company. 

(d) The term “Bregua” means Bregua Corporation, a company formed under the laws of the British Virgin Islands.

 (e) The term “BVF” means, collectively, Biotechnology Value Fund, L.P., Biotechnology Value Fund II, L.P.
and Biotechnology Value Trading Fund OS, L.P. 

 (f) The term “Common Stock” means the Common Stock, $0.001
par value per share, of the Company. 
 (g) The term “EcoR1” means, collectively, EcoR1 Capital Fund, L.P.,
EcoR1 Capital Fund Qualified, L.P. and EcoR1 Venture Opportunity Fund, L.P. 
 (h) The term “Exchange Act”
means the Securities Exchange Act of 1934, as amended. 
 (i) The term “Form
S-3” means such form under the Securities Act as in effect on the date hereof or any registration form under the Securities Act subsequently adopted by the SEC which permits inclusion or
incorporation of substantial information by reference to other documents filed by the Company with the SEC. 
 (j) The term
“Holder” means any individual or entity owning or having the right to acquire Registrable Securities or any assignee thereof in accordance with Section 1.12 hereof. 

(k) The term “Janus” means Janus Henderson Biotech Innovation Master Fund Limited, Janus Henderson Horizon
Fund—Biotechnology Fund, Janus Henderson Global Life Sciences Fund and Janus Henderson Capital Funds Plc—Janus Henderson Global Life Sciences Fund (each, together with its (i) permitted transferees and (ii) other entities under
management by Janus Capital Management LLC, a “Janus Investor”). 
 (l) The term
“Logos” means Logos Opportunities Fund II, L.P. 
 (m) The term “New Securities”
means, collectively, equity securities of the Company, whether or not currently authorized, as well as rights, options, or warrants to purchase such equity securities, or securities of any type whatsoever that are, or may become, convertible or
exchangeable into or exercisable for such equity securities; provided, however, that New Securities shall exclude: (i) Exempted Securities (as defined in the Restated Certificate); and (ii) shares of Common Stock issued in
the Company’s first underwritten public offering of its Common Stock under the Securities Act. 
 (n) The term
“OrbiMed” means OrbiMed Private Investments VIII, LP. 
 (o) The term “Person” means
any individual, corporation, partnership, trust, limited liability company, association or other entity. 
 (p) The term
“Preferred Stock” means the Series Seed Preferred Stock, par value $0.001 per share, of the Company, the Series Seed 2 Preferred Stock, par value $0.001 per share, of the Company, the Series A Preferred Stock, par value
$0.001 per share, of the Company and the Series B Preferred Stock. 
 (q) The term “Qualifying IPO” means the
firmly underwritten initial public offering of shares of Common Stock at a per share price not less than one and one-quarter (1.25) times the Series B Original Purchase Price (as defined in the Restated
Certificate) resulting in proceeds to the Company of at least $50,000,000 in the aggregate (after deducting any underwriting or similar commissions, compensation or concessions paid or allowed by the Company in connection with such offering and any
expenses payable by the Company in connection with such offering). 
 (r) The term “RA Capital” means,
collectively, RA Capital Healthcare Fund, L.P. and RA Capital Nexus Fund II, L.P. 
 (s) The terms “register”,
“registered” and “registration” refer to a registration effected by preparing and filing a registration statement or similar document in compliance with the

  
 2 

 
Securities Act, and the declaration or ordering of effectiveness of such registration statement or document by the SEC. 

(t) The term “Registrable Securities” means: (i) the Common Stock issuable or issued upon conversion of the
Preferred Stock; (ii) any Common Stock, or any Common Stock issued or issuable (directly or indirectly) upon conversion and/or exercise of any other securities of the Company, acquired by the Investors after the date hereof and (iii) any
Common Stock of the Company issued as (or issuable upon the conversion or exercise of any warrant, right or other security which is issued as) a dividend or other distribution with respect to, or in exchange for or in replacement of the shares
referenced in clause (i) or (ii) above, excluding in all cases, however, any Registrable Securities sold by a person in a transaction in which his or her rights under this Section 1 are not assigned and excluding Registrable Securities
that have been sold in an offering registered under the Securities Act or in an open-market transaction under Rule 144 of the Securities Act occurring after the Company’s initial public offering. 

(u) The number of shares of “Registrable Securities then outstanding” shall be determined by the number of
shares of Common Stock outstanding which are, and the number of shares of Common Stock issuable pursuant to then-exercisable or then-convertible securities which are, Registrable Securities. 

(v) The term “Registration Expenses” means all expenses incurred by the Company in complying with Sections 1.2,
1.3 and 1.4 hereof, including, without limitation, all registration and filing fees, printing expenses, fees and disbursements of counsel for the Company, reasonable fees and disbursements (up to a maximum of $50,000 in connection with any single
registration) of a single special counsel for the Holders selected by Holders of a majority of the Registrable Securities to be registered, blue sky fees and expenses and the expense of any special audits incident to or required by any such
registration (but excluding the compensation of regular employees of the Company which shall be paid in any event by the Company). 
 (w)
The term “Requisite Holders” means the holders of a majority of the Registrable Securities then outstanding, which must include the holders of at least a majority of the then-outstanding shares of Common Stock issued or
issuable upon conversion of the Series A Preferred Stock and Series B Preferred Stock, voting together as a single class on an as-if-converted to Common Stock
basis. 
 (x) The term “Restated Certificate” means the Amended and Restated Certificate of Incorporation of
the Company filed with the Secretary of the State of Delaware on or about the date hereof (as amended from time to time). 
 (y) The
term “SEC” means the Securities and Exchange Commission. 
 (z) The term “Securities
Act” means the Securities Act of 1933, as amended. 
 (aa) The term “Selling Expenses” means all
underwriting discounts and selling commissions applicable to a sale of Registrable Securities. 
 (bb) The term
“Stockholders’ Agreement” means that certain Amended and Restated Stockholders Agreement, dated as of the date hereof, by and between the Company, the Investors and certain holders of Common Stock of the Company. 

(cc) The term “Preferred Directors” means the four (4) members of the Board of Directors that the holders
of Preferred Stock, voting as a separate class, are entitled to elect in accordance with the Restated Certificate. 
 (dd) The term
“Series B Preferred Stock” means the Series B Preferred Stock, par value $0.001 per share, of the Company. 

  
 3 

 1.2 Demand Registration. 

(a) After the earlier of (i) four (4) years after the date of this Agreement or (ii) six (6) months after the effective date
of the Company’s initial public offering, if the Company receives a written request from the holders of not less than a majority of the Registrable Securities then outstanding that the Company file a registration statement under the Securities
Act (provided that the anticipated aggregate offering price would exceed $5,000,000), then the Company shall: 
 (i) within
thirty (30) days of the receipt thereof, give written notice of such request to all Holders; and 
 (ii) effect, as soon as
practicable after receipt of such request, the registration under the Securities Act of that number of Registrable Securities which the Holders requested to be registered, subject to the limitations of Section 1.2(b), within thirty
(30) days of the mailing of such notice by the Company. 
 (b) If the Holders initiating the registration request hereunder (the
“Initiating Holders”) intend to distribute the Registrable Securities covered by their request by means of an underwriting, they shall so advise the Company as a part of their request made pursuant to Section 1.2(a) and
the Company shall include such information in the written notice referred to in Section 1.2(a). The underwriter(s) will be selected by the Board of Directors (including a majority of the Preferred Directors) and shall be reasonably acceptable
to a majority in interest of the Initiating Holders. In such event, the right of any Holder to include its Registrable Securities in such registration shall be conditioned upon such Holder’s participation in such underwriting and the inclusion
of such Holder’s Registrable Securities in the underwriting (unless otherwise mutually agreed by a majority in interest of the Initiating Holders and such Holder) to the extent provided herein. All Holders proposing to distribute their
securities through such underwriting shall (together with the Company as provided in Section 1.5(f)) enter into an underwriting agreement in customary form with the underwriter or underwriters selected for such underwriting; provided, however,
that no Holder (or any of their assignees) shall be required to make any representations, warranties or indemnities, except as they relate to such Holder’s ownership of shares and authority to enter into the underwriting agreement and to such
Holder’s intended method of distribution, and the liability of such Holder shall be several and not joint, and limited to an amount equal to the net proceeds from the offering received by such Holder. Notwithstanding any other provision of this
Section 1.2, if the underwriter advises the Initiating Holders in writing that marketing factors require a limitation of the number of shares to be underwritten, then the Initiating Holders shall so advise all Holders of Registrable Securities
which would otherwise be underwritten pursuant hereto, and the number of shares of Registrable Securities that may be included in the underwriting shall be allocated among all Holders thereof, including the Initiating Holders, in proportion (as
nearly as practicable) to the amount of Registrable Securities of the Company owned by each Holder or in such proportion as shall mutually be agreed to by all such selling Holders; provided, however, that the number of shares of
Registrable Securities to be included in such underwriting shall not be reduced unless all other securities are first entirely excluded from the underwriting. 

(c) The Company shall not be obligated to effect, or to take any action to effect, any registration pursuant to this Section 1.2:

 (i) After the Company has effected two (2) registrations pursuant to this Section 1.2 and such registrations have been
declared or ordered effective requested to be registered; provided, however, that any registration that is withdrawn or closed at the request of the Initiating Holders (other than as a result of a material adverse change affecting the
Company) shall count as one (1) of the two (2) required registrations pursuant to this Section 1.2(c)(i); or 
 (ii)
If the Company delivers notice to the Initiating Holders within thirty (30) days of such Initiating Holders’ registration request that the Company intends to file the first registration statement for a public offering of securities of
the Company (other than a registration statement relating either to the sale of securities to employees of the Company pursuant to a stock option, stock purchase or similar plan or a transaction pursuant to Rule 145 of the Securities Act
(“SEC Rule 145”)) within sixty (60) 

  
 4 

 
days from the date of such notice; provided, that the Company is actively employing in good faith commercially reasonable efforts to cause such registration statement to become effective.

 1.3 Company Registration. 

(a) If (but without any obligation to do so) the Company proposes to register (including for this purpose a registration effected by the
Company for stockholders other than the Holders) any of its stock or other securities under the Securities Act in connection with the public offering of such securities solely for cash (other than a registration statement relating either to the sale
of securities to employees of the Company pursuant to a stock option, stock purchase or similar plan or an SEC Rule 145 transaction), the Company shall, at such time, promptly give each Holder written notice of such registration. Upon the written
request of each Holder given within twenty (20) days after mailing of such notice by the Company, the Company shall cause to be registered under the Securities Act all of the Registrable Securities that each such Holder has requested to be
registered. 
 (b) If the registration statement under which the Company gives notice under this Section 1.3 is for an
underwritten offering, the Company shall so advise the Holders of Registrable Securities. In such event, the right of any such Holder to be included in a registration pursuant to this Section 1.3 shall be conditioned upon such Holder’s
participation in such underwriting and the inclusion of such Holder’s Registrable Securities in the underwriting to the extent provided herein. All Holders proposing to distribute their Registrable Securities through such underwriting shall
enter into an underwriting agreement in customary form with the underwriter or underwriters selected for such underwriting by the Company; provided, however, that no Holder (or any of their assignees) shall be required to make any
representations, warranties or indemnities except as they relate to such Holder’s ownership of shares and authority to enter into the underwriting agreement and to such Holder’s intended method of distribution, and the liability of such
Holder shall be several and not joint and limited to an amount equal to the net proceeds from the offering received by such Holder. Notwithstanding any other provision of the Agreement, if the underwriter determines in good faith that marketing
factors require a limitation of the number of shares to be underwritten, the number of shares that may be included in the underwriting shall be allocated: (i) first, to the Company; (ii) second, to the Holders on a pro rata basis based on
the total number of Registrable Securities held by the Holders; and (iii) third, to any stockholder of the Company (other than a Holder) on a pro rata basis. No such reduction shall reduce the amount of securities of the selling Holders
included in the registration below thirty percent (30%) of the total amount of securities included in such registration, unless such offering is the Company’s initial public offering of shares of Common Stock registered under the Securities Act
and such registration does not include shares of any other selling stockholders, in which event any or all of the Registrable Securities of the Holders may be excluded in accordance with the immediately preceding sentence. In no event will shares of
any other selling stockholder be included in such registration which would reduce the number of shares which may be included by Holders without the written consent of Holders of not less than a majority of the Registrable Securities proposed to be
sold in the offering. If any Holder disapproves of the terms of any such underwriting, such Holder may elect to withdraw therefrom by written notice to the Company and the underwriter, delivered at least ten (10) business days prior to the
effective date of the registration statement. Any Registrable Securities excluded or withdrawn from such underwriting shall be excluded and withdrawn from the registration. For any Holder which is a partnership, limited liability company or
corporation, the partners, retired partners, managers, members and stockholders of such Holder, or the estates and family members of any such partners, members and retired partners and any trusts for the benefit of any of the foregoing persons shall
be deemed to be a single “Holder”, and any pro rata reduction with respect to such “Holder” shall be based upon the aggregate amount of shares carrying registration rights owned by all entities
and individuals included in such “Holder”, as defined in this sentence. 
 1.4 Form
S-3 Registration. In the event that the Company receives a written request from the Holders that the Company effect a registration on Form S-3 and any related
qualification or compliance with respect to all or a part of the Registrable Securities owned by such Holders, the Company will: 
 (a)
promptly give written notice of the proposed registration, and any related qualification or compliance, to all other Holders; and 

  
 5 

 (b) as soon as practicable, and in any event within forty five (45) days after
such request, effect such registration and all such qualifications and compliances as may be so requested and as would permit or facilitate the sale and distribution of all or such portion of such Holder’s or Holders’ Registrable
Securities as are specified in such request, together with all or such portion of the Registrable Securities of any other Holder or Holders joining in such request as are specified in a written request given within fifteen (15) days after
receipt of such written notice from the Company; provided, however, that the Company shall not be obligated to effect any such registration, qualification or compliance, pursuant to this Section 1.4: (i) if Form S-3 is not available for such offering by the Holders; (ii) if the Holders, together with the holders of any other securities of the Company entitled to inclusion in such registration, propose to sell
Registrable Securities and such other securities (if any) at an aggregate price to the public of less than $1,000,000; (iii) if the Company has, within the twelve (12) month period preceding the date of such request, already effected two
(2) registrations on Form S-3 for the Holders pursuant to this Section 1.4; or (iv) in any particular jurisdiction in which the Company would be required to qualify to do business or to execute
a general consent to service of process in effecting such registration, qualification or compliance. 
 (c) Subject to the foregoing,
the Company shall file a Form S-3 registration statement covering the Registrable Securities and other securities so requested to be registered as soon as practicable after receipt of the request or requests
of the Holders. Registrations effected pursuant to this Section 1.4 shall not be counted as demands for registration or registrations effected pursuant to Sections 1.2 or 1.3, respectively. 

1.5 Obligations of the Company. Whenever required under this Section 1 to effect the registration of any Registrable Securities,
the Company shall, as expeditiously as reasonably possible: 
 (a) prepare and file with the SEC a registration statement with respect
to such Registrable Securities, use its best efforts to cause such registration statement to become effective, and, upon the request of the Holders of a majority of the Registrable Securities registered thereunder, keep such registration statement
effective for a period of up to one (1) year or until the distribution contemplated in the registration statement has been completed; provided, however, that (i) such one (1) year period shall be extended for a period of
time equal to the period any Holder refrains from selling any securities included in such registration at the request of the Company or any underwriter for the Company; and (ii) in the case of any registration of Registrable Securities on Form S-3 which are intended to be offered on a continuous or delayed basis, such one (1) year period shall be extended, if necessary, to keep the registration statement effective until all such Registrable
Securities are sold; 
 (b) prepare and file with the SEC such amendments and supplements to such registration statement and the
prospectus used in connection with such registration statement as may be necessary to comply with the provisions of the Securities Act with respect to the disposition of all securities covered by such registration statement; 

(c) furnish to the Holders such numbers of copies of a prospectus, including a preliminary prospectus, in conformity with the
requirements of the Securities Act, and such other documents as they may reasonably request in order to facilitate the disposition of Registrable Securities owned by them; 

(d) use its best efforts to register and qualify the securities covered by such registration statement under such other securities or
blue sky laws of such jurisdictions as shall be reasonably requested by the Holders; provided, however, that the Company shall not be required in connection therewith or as a condition thereto to qualify to do business or to file a
general consent to service of process in any such states or jurisdictions, unless the Company is already subject to service in such jurisdiction and except as may be required by the Securities Act; 

(e) in the event of any order suspending the effectiveness of a registration statement, use its best efforts to obtain the withdrawal of
such order at the earliest possible time; 

  
 6 

 (f) in the event of any underwritten public offering, enter into and perform its
obligations under an underwriting agreement, in usual and customary form, with the managing underwriter of such offering; 
 (g)
notify each Holder of Registrable Securities covered by a registration statement at any time when a prospectus relating thereto is required to be delivered under the Securities Act of the happening of any event as a result of which the
prospectus included in such registration statement, as then in effect, includes an untrue statement of a material fact or omits to state a material fact required to be stated therein or necessary to make the statements therein not misleading in the
light of the circumstances then existing; 
 (h) notify each Holder of Registrable Securities covered by a registration statement of:
(i) the effectiveness of such registration statement; (ii) the filing of any post-effective amendments to such registration statement; or (iii) the filing of a supplement to such registration statement; 

(i) promptly make available for inspection, upon reasonable notice during the Company’s regular business hours, by each Holder of
Registrable Securities covered by a registration statement, any underwriter participating in any distribution pursuant to such registration statement, and any attorney, accountant or other agent retained by such Holder or underwriter, all financial
and other records, pertinent corporate documents and properties of the Company, and cause the Company’s officers, directors, employees and independent accountants to supply all information reasonably requested by any such Holder, underwriter,
attorney, accountant or agent in connection with such registration statement; 
 (j) upon the transfer of shares by a Holder in
connection with a registration hereunder, furnish unlegended certificates representing ownership of the Registrable Securities being sought in such denominations as shall be requested by the Holders or the underwriters; 

(k) cause all such Registrable Securities registered pursuant hereunder to be listed on each securities exchange on which similar
securities issued by the Company are then listed; 
 (l) provide a transfer agent and registrar for all Registrable Securities
registered pursuant hereunder and a CUSIP number for all such Registrable Securities, in each case not later than the effective date of such registration; and 

(m) furnish, at the request of any Holder, on the date that such Holder’s Registrable Securities are delivered to the underwriters
for sale in connection with a registration pursuant to this Agreement, if such securities are being sold through underwriters, or, if such securities are not being sold through underwriters, on the date that the registration statement with respect
to such securities becomes effective: (i) an opinion, dated as of such date, of the counsel representing the Company for the purposes of such registration, in form and substance as is customarily given to underwriters in an underwritten public
offering and reasonably satisfactory to a majority in interest of the Holders requesting registration, addressed to the underwriters and to the Holders requesting registration of Registrable Securities; and (ii) a “comfort” letter
dated as of such date, from the independent certified public accountants of the Company, in form and substance as is customarily given by independent certified public accountants to underwriters in an underwritten public offering and reasonably
satisfactory to a majority in interest of the Holders requesting registration, addressed to the underwriters and to the Holders requesting registration of Registrable Securities. 

In addition, the Company shall ensure that, at all times after any registration statement covering a public offering of securities of the
Company under the Securities Act shall have become effective, its insider trading policy shall provide that the Company’s directors may implement a trading program under Rule 10b5-1 of the Exchange Act.

 1.6 Furnish Information. 

  
 7 

 (a) It shall be a condition precedent to the obligations of the Company to take any
action pursuant to this Section 1 with respect to the Registrable Securities of any selling Holder that such Holder shall furnish to the Company such information regarding itself, the Registrable Securities held by it, and the intended method
of disposition of such securities as is reasonably required to effect the registration of such Holder’s Registrable Securities. 

(b) The Company shall have no obligation with respect to any registration requested pursuant to Section 1.2 if, due to the
operation of Section 1.6(a), the number of shares or the anticipated aggregate offering price of the Registrable Securities to be included in the registration does not equal or exceed the number of shares or the anticipated aggregate offering
price required to originally trigger the Company’s obligation to initiate such registration as specified in Section 1.2(a). 

1.7 Expenses of Registration. Except as specifically provided herein, all Registration Expenses incurred in connection with any
registration, qualification or compliance pursuant to Section 1.2, Section 1.3 or Section 1.4 herein shall be borne by the Company. All Selling Expenses incurred in connection with any registrations hereunder, shall be borne by the
Holders of the securities so registered pro rata on the basis of the number of shares so registered. 
 1.8 Indemnification. In
the event any Registrable Securities are included in a registration statement under this Section 1: 
 (a) To the extent
permitted by law, the Company will indemnify and hold harmless each Holder, the partners, members, officers, directors and stockholder of each such Holder, legal counsel and accountants for each such Holder, any underwriter (as defined in the
Securities Act) for such Holder and each person, if any, who controls such Holder or underwriter within the meaning of the Securities Act or the Exchange Act, against any losses, claims, damages, or liabilities (joint or several) to which they may
become subject under the Securities Act, the Exchange Act or other federal or state law, insofar as such losses, claims, damages, or liabilities (or actions in respect thereof) arise out of or are based upon any of the following statements,
omissions or violations (collectively a “Violation”): (i) any untrue statement or alleged untrue statement of a material fact contained in such registration statement, including any preliminary prospectus or final prospectus
contained therein or any amendments or supplements thereto; (ii) the omission or alleged omission to state therein a material fact required to be stated therein, or necessary to make the statements therein not misleading; or (iii) any
violation or alleged violation by the Company of the Securities Act, the Exchange Act, any state securities law or any rule or regulation promulgated under the Securities Act, the Exchange Act or any state securities law; and the Company will pay to
each such Holder, underwriter or controlling person any legal or other expenses reasonably incurred by them in connection with investigating or defending any such loss, claim, damage, liability, or action; provided, however, that the
indemnity agreement contained in this Section 1.8(a) shall not apply to amounts paid in settlement of any such loss, claim, damage, liability, or action if such settlement is effected without the consent of the Company (which consent shall not
be unreasonably withheld), nor shall the Company be liable in any such case for any such loss, claim, damage, liability, or action to the extent that it arises out of or is based upon a Violation which occurs solely in reliance upon and in
conformity with written information furnished expressly for use in connection with such registration by any such Holder, underwriter or controlling person, except to the extent such information has been corrected in a subsequent writing prior to or
concurrently with the sale of Registrable Securities to the Person asserting the claim. 
 (b) To the extent permitted by law, each
selling Holder will, severally but not jointly, indemnify and hold harmless the Company, each of its directors, each of its officers who has signed the registration statement, each person, if any, who controls the Company within the meaning of the
Securities Act, any underwriter, any other Holder selling securities in such registration statement and any controlling person of any such underwriter or other Holder, against any losses, claims, damages, or liabilities (joint or several) to which
any of the foregoing persons may become subject, under the Securities Act, the Exchange Act or other federal or state law, insofar as such losses, claims, damages, or liabilities (or actions in respect thereto) arise out of or are based upon any
Violation, in each case to the extent (and only to the extent) that such Violation occurs solely in reliance upon and in conformity with written information furnished by such Holder expressly for use in connection with such registration and has not
been corrected in a 

  
 8 

 
subsequent writing prior to or concurrently with the sale of Registrable Securities to the Person asserting the claim; and each such Holder will pay any legal or other expenses reasonably
incurred by any person intended to be indemnified pursuant to this Section 1.8(b), in connection with investigating or defending any such loss, claim, damage, liability, or action; provided, however, that the indemnity agreement
contained in this Section 1.8(b) shall not apply to amounts paid in settlement of any such loss, claim, damage, liability or action if such settlement is effected without the consent of the Holder, which consent shall not be unreasonably
withheld; and provided further that, in no event shall any indemnity under this Section 1.8(b) exceed the net proceeds from the offering received by such Holder. 

(c) Promptly after receipt by an indemnified party under this Section 1.8 of notice of the commencement of any action (including
any governmental action) for which a party may be entitled to indemnification hereunder, such indemnified party will, if a claim in respect thereof is to be made against any indemnifying party under this Section 1.8, deliver to the indemnifying
party a written notice of the commencement thereof and the indemnifying party shall have the right to participate in, and, to the extent the indemnifying party so desires, jointly with any other indemnifying party similarly noticed, to assume the
defense thereof with counsel mutually satisfactory to the parties; provided, however, that an indemnified party (together with all other indemnified parties which may be represented without conflict by one counsel) shall have the right
to retain one separate counsel, with the fees and expenses to be paid by the indemnifying party, if representation of such indemnified party by the counsel retained by the indemnifying party would be inappropriate due to actual or potential
differing interests between such indemnified party and any other party represented by such counsel in such proceeding. The failure to deliver written notice to the indemnifying party within a reasonable time of the commencement of any such action,
if prejudicial to its ability to defend such action, shall relieve such indemnifying party of any liability to the indemnified party under this Section 1.8, but the omission to deliver written notice to the indemnifying party will not relieve
it of any liability that it may have to any indemnified party otherwise than under this Section 1.8. 
 (d) If the
indemnification provided for in this Section 1.8 is held by a court of competent jurisdiction to be unavailable to an indemnified party with respect to any loss, liability, claim, damage, or expense referred to therein, then the indemnifying
party, in lieu of indemnifying such indemnified party hereunder, shall contribute to the amount paid or payable by such indemnified party as a result of such loss, liability, claim, damage, or expense in such proportion as is appropriate to reflect
the relative fault of the indemnifying party on the one hand and of the indemnified party on the other in connection with the statements or omissions that resulted in such loss, liability, claim, damage, or expense as well as any other relevant
equitable considerations. The relative fault of the indemnifying party and of the indemnified party shall be determined by reference to, among other things, whether the untrue or alleged untrue statement of a material fact or the omission to state a
material fact relates to information supplied by the indemnifying party or by the indemnified party and the parties’ relative intent, knowledge, access to information, and opportunity to correct or prevent such statement or omission;
provided, however, that, in any such case (x) no Holder will be required to contribute any amount in excess of the public offering price of all such Registrable Securities offered and sold by such Holder pursuant to such
registration statement, and (y) no Person guilty of fraudulent misrepresentation (within the meaning of Section 11(f) of the Securities Act) will be entitled to contribution from any Person who was not guilty of such fraudulent
misrepresentation; and provided further that in no event shall a Holder’s liability pursuant to this Section 1.8(d), when combined with the amounts paid or payable by such Holder pursuant to Section 1.8(b), exceed the proceeds from
the offering received by such Holder (net of any Selling Expenses paid by such Holder), except in the case of willful misconduct or fraud by such Holder. 

(e) Notwithstanding the foregoing, to the extent that the provisions relating to indemnification and contribution contained in the
underwriting agreement entered into in connection with the underwritten public offering are in conflict with the foregoing provisions, the provisions in the underwriting agreement shall control; provided, however, that any matter expressly provided
for or addressed by the foregoing provisions that is not expressly provided for or addressed by the underwriting agreement shall be controlled by the foregoing provisions. 

  
 9 

 (f) The obligations of the Company and Holders under this Section 1.8 shall
survive the completion of any offering of Registrable Securities in a registration statement under this Section 1 and otherwise shall survive the termination of this Agreement or any provision(s) of this Agreement. 

1.9 Reports Under the Exchange Act. With a view to making available to the Holders the benefits of Rule 144 promulgated under the
Securities Act (“SEC Rule 144”) and any other rule or regulation of the SEC that may at any time permit a Holder to sell securities of the Company to the public without registration or pursuant to a registration on Form S-3, the Company agrees to: 
 (a) make and keep available adequate current public information, as
those terms are understood and defined in SEC Rule 144, at all times after the effective date of the first registration statement filed by the Company for the offering of its securities to the general public (other than a registration statement
relating either to the sale of securities to employees of the Company pursuant to a stock option, stock purchase or similar plan or an SEC Rule 145 transaction); 

(b) take such action, including the voluntary registration of its Common Stock under Section 12 of the Exchange Act, as is
necessary to enable the Holders to utilize Form S-3 for the sale of their Registrable Securities, such action to be taken as soon as practicable after the end of the fiscal year in which the first registration
statement filed by the Company for the offering of its securities to the general public (other than a registration statement relating either to the sale of securities to employees of the Company pursuant to a stock option, stock purchase or similar
plan or an SEC Rule 145 transaction) is declared effective; 
 (c) file with the SEC in a timely manner all reports and other
documents required of the Company under the Securities Act and the Exchange Act; and 
 (d) furnish to any Holder, so long as the
Holder owns any Registrable Securities, forthwith upon request: (i) a written statement by the Company that it has complied with the reporting requirements of SEC Rule 144 (at any time after ninety (90) days after the effective date of the
first registration statement filed by the Company), the Securities Act and the Exchange Act (at any time after it has become subject to such reporting requirements), or that it qualifies as a registrant whose securities may be resold pursuant to
Form S-3 (at any time after it so qualifies); (ii) a copy of the most recent annual or quarterly report of the Company and such other reports and documents so filed by the Company; and (iii) such other
information as may be reasonably requested in availing any Holder of any rule or regulation of the SEC which permits the selling of any such securities without registration or pursuant to such form. 

1.10 Market Stand-Off Agreement. Each Holder hereby agrees that such Holder shall not sell,
transfer, make any short sale of, grant any option for the purchase of, or enter into any hedging or similar transaction with the same economic effect as a sale, any Common Stock (or other securities) of the Company held by such Holder (other than
those included in the registration) for a period specified by the representative of the underwriters of Common Stock (or other securities) of the Company not to exceed one hundred eighty (180) days following the effective date of a registration
statement of the Company filed under the Securities Act relating to the initial public offering of shares of Common Stock registered under the Securities Act; provided, however, that all officers and directors of the Company and
holders (individually and together with their affiliates and affiliated investment funds) of at least one percent (1%) of the Company’s voting securities enter into similar agreements. The Company may impose stop-transfer instructions with
respect to the shares of Common Stock (or other securities) subject to the foregoing restriction until the end of such one hundred eighty (180) day (or other) period. Each Holder agrees that any transferee of any shares of Registrable
Securities shall be bound by this Section 1.10. The underwriters of the Company’s stock are intended third-party beneficiaries of this Section 1.10 and shall have the right, power and authority to enforce the provisions hereof as
though they were parties hereto. Any discretionary waiver or termination of the restrictions of any or all of such agreements by the Company or the underwriters shall apply pro rata to all Company stockholders that are subject to such agreements,
based on the number of shares subject to such agreements. Notwithstanding the foregoing, the obligations in this Section 1.10 shall not apply to transactions (including, without limitation, any swap, hedge or similar agreement or arrangement)
relating to shares or other securities acquired by a Holder either in the Initial Public Offering 

  
 10 

 
or on the open market or in other transactions following the Initial Public Offering or that otherwise do not involve or relate to securities of the Company owned by a Holder prior to the Initial
Public Offering, or to the sale of any shares to an underwriter pursuant to an underwriting agreement. 
 1.11 Limitation on Subsequent
Registration Rights. After the date of this Agreement, the Company shall not, without the prior written consent of the Requisite Holders, enter into any agreement with any holder or prospective holder of any securities of the Company that would
grant such holder registration rights pari passu with or senior to those granted to the Holders hereunder or would allow such holder or prospective holder to initiate a demand for registration of any securities held by such holder or
prospective holder. 
 1.12 Assignment of Registration Rights. The rights to cause the Company to register Registrable Securities
pursuant to this Section 1 may be assigned (but only with all related obligations) by a Holder to one or more transferees or assignees of such securities (an “Assignee”): (i) to whom such Holder transfers such
securities pursuant to Section 3.2 hereof; (ii) who is an employee, Affiliate or affiliated partnership managed by such Holder; or (iii) who, after such assignment or transfer, acquires at least ten percent (10%) (subject to
appropriate adjustment for stock splits, stock dividends, combinations and other recapitalizations) of the Registrable Securities held by the Holder as of the date of this Agreement, provided that: (a) the Company is, within a reasonable
time after such transfer, furnished with written notice of the name and address of such Assignee and the securities with respect to which such registration rights are being assigned; and (b) such Assignee agrees in writing to be bound by and
subject to the terms and conditions of this Agreement, including, without limitation, the provisions of Section 1.10. 
 1.13
Termination of Registration Rights. No Holder shall be entitled to exercise any right provided for in this Section 1 after five (5) years following the consummation of the sale of securities pursuant to a Qualifying IPO or, as to any
Holder, such earlier time at which all Registrable Securities held by such Holder (and any affiliate of the Holder with whom such Holder must aggregate its sales under SEC Rule 144) can be sold in any three (3) month period without registration
in compliance with SEC Rule 144. 
 2. ADDITIONAL COVENANTS. 

2.1 Delivery of Financial Statements. The Company shall deliver to each Investor: 

(i) as soon as practicable, but in any event within ninety (90) days after the end of each fiscal year of the Company, (a) an
income statement and cash flow statement for such fiscal year, and a comparison between (1) the actual amounts as of and for such fiscal year and (2) the comparable amounts for the prior year and as included in the Budget (as defined in
Section 2.1(v) below) for such year, with an explanation of any material differences between such amounts and a schedule as to the sources and applications of funds for such year, (b) a balance sheet of the Company and statement of
stockholder’s equity as of the end of such year, and (c) a capitalization table as of the end of such year, such year-end financial reports to be in reasonable detail, prepared in accordance with
generally accepted accounting principles in the United States, and audited and certified by independent public accountants of regionally recognized standing selected by the Company and approved by the Board of Directors (including a majority of the
Preferred Directors); 
 (ii) as soon as practicable, but in any event within forty-five (45) days after the end of each of the
first three (3) quarters of each fiscal year of the Company, an unaudited income statement and cash flow statement for the relevant fiscal quarter, schedule as to the sources and application of funds for such fiscal quarter, and an unaudited
balance sheet and a statement of stockholder’s equity as of the end of such fiscal quarter, all prepared in accordance with generally accepted accounting principles in the United States, except for any otherwise applicable footnote disclosures;

 (iii) as soon as practicable, but in any event within forty-five (45) days after the end of each of the first three
(3) quarters of each fiscal year of the Company, a statement showing the number of shares of each class and series of capital stock and securities convertible into or exercisable for shares of capital stock outstanding at the end of the period,
the Common Stock issuable upon conversion 

  
 11 

 
or exercise of any outstanding securities convertible or exercisable for Common Stock and the exchange ratio or exercise price applicable thereto, and the number of shares of issued stock options
and stock options not yet issued but reserved for issuance, if any, all in sufficient detail as to permit the Investors to calculate their respective percentage equity ownership in the Company; 

(iv) as soon as practicable, but in any event within thirty (30) days of the end of each month, an unaudited income statement and
schedule as to the sources and application of funds and balance sheet for and as of the end of such month, in reasonable detail, prepared in accordance with generally accepted accounting principles, except for any otherwise applicable footnote
disclosures; and 
 (v) as soon as practicable, but in any event at least thirty (30) days prior to the end of each fiscal year,
a budget and business plan for the next fiscal year (collectively, the “Budget”), approved by the Board of Directors (including a majority of the Preferred Directors) and prepared on a quarterly basis, including balance
sheets, income statements, and statements of cash flow for such months and, promptly after prepared, any other budgets or revised budgets prepared by the Company; and 

(vi) such other information relating to the financial condition, business, prospects, or corporate affairs of the Company as any
Investor may from time to time reasonably request; provided, however, that the Company shall not be obligated under this Subsection 2.1(vi) to provide information (i) that the Company reasonably determines in good faith to be a trade
secret or confidential information (unless covered by an enforceable confidentiality agreement, in a form acceptable to the Company); or (ii) the disclosure of which would adversely affect the attorney-client privilege between the Company and
its counsel. 
 If, for any period, the Company has any subsidiary whose accounts are consolidated with those of the Company, then in
respect of such period the financial statements delivered pursuant to the foregoing sections shall be the consolidated and consolidating financial statements of the Company and all such consolidated subsidiaries. 

2.2 Right of First Refusal. Subject to the terms and conditions specified in this Section 2.2, the Company hereby grants to each
Investor a right of first refusal with respect to future sales by the Company of New Securities. For purposes of this Section 2.2, the term “Investor” shall include any general partners and Affiliates of an Investor, and
each Investor shall be entitled to apportion the right of first refusal hereby granted to it among itself and its partners and Affiliates in such proportions as it deems appropriate. Subject to Section 2.2(d), each time the Company proposes to
offer any New Securities, the Company shall first make an offering of such New Securities to each Investor in accordance with the following provisions: 

(a) The Company shall deliver a notice by certified mail (the “Notice”) to each Investor stating: (i) its
bona fide intention to offer such New Securities; (ii) the number of such New Securities to be offered; and (iii) the price and terms, if any, upon which it proposes to offer such New Securities. 

(b) Within thirty (30) calendar days after receipt of the Notice, each Investor may elect to purchase or obtain, at the price and
on the terms specified in the Notice, up to that portion of such New Securities which equals the proportion that the number of Registrable Securities then held by such Investor bears to the total number of Registrable Securities then outstanding
(such Investor’s “Pro Rata Amount”). The Company shall promptly, in writing, inform each Investor that elects to purchase all of the New Securities available to it (each, a “Participating
Investor”) of any other Investor’s failure to do likewise. During the ten (10) day period commencing after receipt of such notice, each Participating Investor shall be entitled to obtain that portion of the New Securities for
which Investors were entitled to, but did not, subscribe equal to the proportion that the number of Registrable Securities then held by such Participating Investor bears to the total number of Registrable Securities then held by all Participating
Investors who wish to purchase some of the unsubscribed New Securities. 
 (c) If all New Securities that Investors are entitled to
obtain pursuant to Section 2.2(b) are not subscribed for as provided in Section 2.2(c), the Company may, during the sixty (60) day period following the expiration of the period provided in Section 2.2(c), offer the remaining
unsubscribed portion 

  
 12 

 
of such New Securities to any person or persons at a price not less than that, and upon terms no more favorable to such person or persons than those, specified in the Notice. If the Company does
not enter into an agreement for the sale of the New Securities within such period, or if such agreement is not consummated within thirty (30) days of the execution thereof, the right provided hereunder shall be deemed to be revived and such New
Securities shall not be offered unless first reoffered to the Investors in accordance herewith. 
 (d) The rights of first refusal
granted under this Section 2.2, including notice with respect thereto, may be waived pursuant to Section 5.5 of this Agreement. Notwithstanding the foregoing, if any of the waiving Investors purchase New Securities covered by the waiver
(any such purchase of New Securities, a “Waiver Purchase”), then each Investor shall have the right to purchase up to the same percentage of its Pro Rata Amount of the New Securities purchased by the waiving Investor who
purchased the highest percentage of its respective Pro Rata Amount of the New Securities (such right, a “ROFR Revival Right”). The rights of first refusal of each Investor under this Section 2.2 may be transferred to the
same parties, subject to the same restrictions, as any transfer of registration rights pursuant to Section 1.12. 
 2.3 Inspection
Rights. Subject to the execution of reasonable nondisclosure agreements (if appropriate), each Investor shall have the right to visit and inspect any of the properties of the Company, to discuss the affairs, finances and accounts of the Company
with its officers, and to review such information as is reasonably requested all at such reasonable times (during normal business hours) and as often as may be reasonably requested for any purpose reasonably related to such Investor’s interest
as a stockholder of the Company; provided, however, that the Company shall not be obligated under this Section 2.3 to provide access to a competitor of the Company or to provide information which the Board of Directors determines
in good faith is confidential (unless covered by an enforceable confidentiality agreement, in form acceptable to the Company) or attorney-client privileged and should not, therefore, be disclosed. For the purposes of this Agreement, no person or
entity or any of its Affiliates that is a venture capital or other investment fund or professional investment manager whose primary business is making investments in operating companies shall be deemed a competitor of the Company. 

2.4 Observation Rights. Each of Avalon, Bregua, EcoR1, RA Capital, Janus, BVF, Surveyor and OrbiMed shall have the right, for so long as
such Investor continues to own shares of Preferred Stock, to designate one (1) individual (each, an “Observer”) who shall be entitled to notice of, to attend, and participate in, as a nonvoting observer, and to any
documentation distributed to members before, during and after, all meetings of the Board of Directors, including executive sessions of the Board of Directors, at the same time and in the same manner as provided to the Board of Directors. The Company
reserves the right to exclude any such Observer from any meeting or portion thereof of the Board of Directors, and to withhold access to any material or portion thereof provided to the directors, if the Board of Directors believes, in good faith, in
reliance upon the advice of counsel, and after discussing with such Observer, that: (i) access to such information or attendance at such meeting could adversely affect the attorney-client privilege between the Company and its counsel; or
(ii) access to such information or attendance at such meeting could result in a conflict of interest between Avalon, Bregua, EcoR1, RA Capital, Janus, BVF, Surveyor or OrbiMed, as applicable, and the Company. Each of Avalon, Bregua, EcoR1, RA
Capital, Janus, BVF, Surveyor and OrbiMed agrees, and any representative of Avalon, Bregua, EcoR1, RA Capital, Janus, BVF, Surveyor or OrbiMed will agree, to hold any confidential information provided to or learned by it in connection with its
rights under this Section 2.4 in accordance with the confidentiality obligations in Section 2.5 below. The Company shall reimburse each Observer for all reasonable
out-of-pocket travel expenses incurred (consistent with the Company’s travel policy) in connection with attending meetings of the Board of Directors. 

2.5 Confidentiality. Each Investor agrees that such Investor will keep confidential and will not disclose, divulge, or use for any
purpose (other than to monitor or make decisions with respect to its investment in the Company) any confidential information obtained from the Company pursuant to the terms of this Agreement (including notice of the Company’s intention to file
a registration statement), unless such confidential information (a) is known or becomes known to the public in general (other than as a result of a breach of this Section 2.5 by such Investor),(b) is or has been
independently developed or conceived by such Investor without use of the Company’s confidential information, or (c) is or has been made known or 

  
 13 

 
disclosed to such Investor by a third party without a breach of any obligation of confidentiality such third party may have to the Company; provided, however, that an Investor may
disclose confidential information (i) to its attorneys, accountants, consultants, and other professionals to the extent reasonably necessary to obtain their services in connection with monitoring its investment in the Company; (ii) to any
prospective purchaser of any Registrable Securities from such Investor, if such prospective purchaser agrees to be bound by the provisions of this Section 2.5 (iii) to any Affiliate, partner, member, stockholder, or wholly
owned subsidiary of such Investor in the ordinary course of business, provided that such Investor informs such person that such information is confidential and directs such person to maintain the confidentiality of such information;
(iv) to the extent required in connection with any routine or periodic examination or similar process by any regulatory or self-regulatory body or authority not specifically directed at the Company or the confidential information obtained from
the Company pursuant to the terms of the Agreement, including, without limitation, quarterly or annual reports; or (v) as may otherwise be required by law, regulation, rule, court order or subpoena, provided that, with respect to this
clause (v), such Investor promptly notifies the Company of such disclosure and takes reasonable steps to minimize the extent of any such required disclosure. 

2.6 Material Non-Public Information. The Company understands and acknowledges that in the
regular course of Surveyor’s business, Surveyor and its Affiliates will invest in companies that have issued securities that are publicly traded (each, a “Public Company”). Accordingly, the Company covenants and agrees
that before providing any material non-public information about a Public Company (“Public Company Information”) to Surveyor or its representatives (or any of their respective
Affiliates), the Company shall provide notice to Surveyor’s Compliance Officer at SCComplianceAppvl@citadel.com if the Company becomes aware of any materials that the Company may provide to Surveyor which may include Public Company
Information (which notice shall include a brief high level description of such Public Company Information) and Surveyor shall determine whether to receive such materials. The Company shall not disclose Public Company Information to Surveyor or its
representatives (or any of their respective Affiliates) without prior written authorization from Surveyor’s Compliance Officer listed above and Surveyor shall not be entitled to any of the rights under this Agreement with respect to such Public
Company Information until such authorization is granted. The Company may withhold or redact the applicable portions of any reports or information provided to Surveyor that the Company reasonably believes constitutes Public Company Information;
provided, that the Company has provided advance notice of such Public Company Information to Surveyor’s Compliance Officer pursuant to the terms of the second sentence of this Section 2.6 and such Compliance Officer has not provided
written instructions to the Company requesting that such information be disclosed to Surveyor or its representatives (or any of their respective Affiliates). In addition, the Company understands and acknowledges that in no event shall any
Investor’s confidentiality and non-use obligations hereunder be deemed or construed as limiting such Investor’s or its representatives’ (or any of their respective Affiliates’) ability to
trade any security of a Public Company. “Surveyor” means Citadel Multi-Strategy Equities Master Fund Ltd. 
 2.7
Termination of Certain Covenants. The covenants set forth in this Section 2 shall terminate and be of no further force or effect upon the earlier of: (i) the consummation of the sale of securities pursuant to a Qualifying IPO;
(ii) the first date upon which none of the Registrable Securities are outstanding; or (iii) a Liquidation (as defined in the Restated Certificate). 

3. RESTRICTIONS ON TRANSFER. 

3.1 General Restrictions. Each Holder agrees not to make any disposition of all or any portion of its Registrable Securities unless and
until: 
 (a) There is then in effect a registration statement under the Securities Act covering such proposed disposition and such
disposition is made in accordance with such registration statement; or 
 (b) (i) The transferee has agreed in writing to
be bound by the terms of this Agreement; (ii) such Holder shall have notified the Company of the proposed disposition and shall have furnished the Company with a detailed statement of the circumstances surrounding the proposed disposition; and
(iii) if reasonably requested by the Company, such Holder shall have furnished the Company with an opinion of 

  
 14 

 
counsel, reasonably satisfactory to the Company, that such disposition will not require registration of such shares under the Securities Act. 

3.2 Exceptions. Notwithstanding the provisions of Section 3.1, no such restriction shall apply to a transfer by a Holder that is:
(i) a partnership transferring to its partners or former partners in accordance with partnership interests; (ii) a corporation transferring to a wholly owned subsidiary or a parent corporation that owns all of the capital stock of the
Holder; (iii) a limited liability company transferring to its members or former members in accordance with their interest in the limited liability company; (iv) an individual transferring to the Holder’s family member or trust for the
benefit of an individual Holder or such Holder’s family member(s), (v) made pursuant to SEC Rule 144 or (vi) made by a Holder to any other Affiliate of such Holder; provided, however, that in each case other than
(v) above the transferee will agree in writing to be subject to the terms of this Agreement to the same extent as if he, she or it were an original Holder hereunder. 

3.3 Legends. Each certificate representing Registrable Securities shall be stamped or otherwise imprinted with legends substantially
similar to the following (in addition to any legend required under applicable state securities laws): 
 THE SECURITIES REPRESENTED BY THIS
CERTIFICATE HAVE NOT BEEN REGISTERED UNDER THE SECURITIES ACT OF 1933, AS AMENDED (THE “SECURITIES ACT”). THEY MAY NOT BE SOLD, OFFERED FOR SALE, PLEDGED OR HYPOTHECATED IN THE ABSENCE OF A REGISTRATION STATEMENT IN EFFECT WITH RESPECT TO
THE SECURITIES UNDER THE SECURITIES ACT OR AN OPINION OF COUNSEL SATISFACTORY TO THE COMPANY THAT SUCH REGISTRATION IS NOT REQUIRED OR UNLESS SOLD PURSUANT TO RULE 144 OF THE SECURITIES ACT. 

THE SALE, PLEDGE, HYPOTHECATION OR TRANSFER OF THE SECURITIES REPRESENTED BY THIS CERTIFICATE IS SUBJECT TO THE TERMS AND CONDITIONS OF THAT
CERTAIN AMENDED AND RESTATED INVESTORS’ RIGHTS AGREEMENT BY AND BETWEEN THE STOCKHOLDER AND THE COMPANY. COPIES OF SUCH AGREEMENT MAY BE OBTAINED UPON WRITTEN REQUEST TO THE SECRETARY OF THE COMPANY. 

3.4 Removal of Legends. The Company shall be obligated to promptly reissue unlegended certificates at the request of any Holder thereof
if the Company has completed the initial public offering of shares of Common Stock registered under the Securities Act and the Holder shall have obtained an opinion of counsel (which counsel may be counsel to the Company) reasonably acceptable to
the Company to the effect that the securities proposed to be disposed of may lawfully be so disposed of without registration, qualification and legend. In addition, any legend endorsed on an instrument pursuant to applicable state securities laws
and the stop-transfer instructions with respect to such securities shall be removed upon receipt by the Company of an order of the appropriate blue sky authority authorizing such removal. 

4. ADDITIONAL COVENANTS 

4.1 Insurance. The Company shall obtain, within ninety (90) days of the date hereof, from financially sound and reputable insurers
Directors and Officers liability insurance in an amount and on terms and conditions satisfactory to the Board of Directors, including a majority of the Preferred Directors, and will use commercially reasonable efforts to cause such insurance
policies to be maintained until such time as the Board of Directors, including a majority of the Preferred Directors, determines that such insurance should be discontinued. Notwithstanding any other provision of this Section 4.1 to the
contrary, for so long as a Preferred Director is serving on the Board of Directors, the Company shall not cease to maintain a Directors and Officers liability insurance policy in an amount of at least three (3) million dollars unless approved
by a majority of the Preferred Directors, shall include each Investor entitled to designate a 

  
 15 

 
Preferred Director pursuant to the Stockholders’ Agreement as additional insureds in such policy, and shall annually, within one hundred twenty (120) days after the end of each fiscal
year of the Company, deliver to the Investors a certification that such a Directors and Officers liability insurance policy remains in effect. 

4.2 Employee Agreements. Unless otherwise approved by the Board of Directors, including a majority of the Preferred Directors, the
Company will cause each Person now or hereafter employed by it or by any subsidiary (or engaged by the Company or any subsidiary as a consultant/independent contractor) with access to confidential information and/or trade secrets to enter into a
nondisclosure, proprietary rights assignment and non-solicitation agreement. In addition, the Company shall not amend, modify, terminate, waive, or otherwise alter, in whole or in part, any of the
above-referenced agreements or any restricted stock agreement between the Company and any employee, without the consent of the Board of Directors, including a majority of the Preferred Directors. 

4.3 Employee Stock. Unless otherwise approved by the Board of Directors, including a majority of the Preferred Directors, all employees
of the Company who purchase, receive options to purchase, or receive awards of shares of the Company’s capital stock after the date hereof shall be required to execute restricted stock or option agreements, as applicable, providing for
(i) vesting of shares over a four (4) year period, with the first twenty-five percent (25%) of such shares vesting following twelve (12) months of continued employment or service, and the remaining shares vesting in equal monthly
installments over the following thirty-six (36) months, and (ii) a market stand-off provision substantially similar to that in Section 1.10. Without the
prior approval by the Board of Directors, including a majority of the Preferred Directors, the Company shall not amend, modify, terminate, waive or otherwise alter, in whole or in part, any stock purchase, stock restriction or option agreement with
any existing employee or service provider if such amendment would cause it to be inconsistent with this Section 4.3. In addition, unless otherwise approved by the Board of Directors, including a majority of the Preferred Directors, the Company
(x) shall not offer or allow any acceleration of vesting, and (y) shall retain (and not waive) a “right of first refusal” on employee transfers until the Company’s initial public offering and shall have the right to
repurchase unvested shares at cost upon termination of employment of a holder of restricted stock. 
 4.4 Board Matters. The Company
shall reimburse the nonemployee directors for all reasonable out-of-pocket travel expenses incurred (consistent with the Company’s travel policy) in connection with
attending meetings of the Board of Directors. 
 4.5 Successor Indemnification. If the Company or any of its successors or assignees
consolidates with or merges into any other Person and is not the continuing or surviving corporation or entity of such consolidation or merger, then to the extent necessary, proper provision shall be made so that the successors and assignees of the
Company assume the obligations of the Company with respect to indemnification of members of the Board of Directors as in effect immediately before such transaction, whether such obligations are contained in the Company’s Bylaws, the Restated
Certificate, or elsewhere, as the case may be. 
 4.6 Expenses of Counsel. In the event of a transaction which is a Company
Transaction (as defined in the Stockholder Agreement), the reasonable fees and disbursements, not to exceed $50,000, of one counsel for the Investors (“Investor Counsel”), in their capacities as stockholders, shall be borne
and paid by the Company. At the outset of considering a transaction which, if consummated would constitute a Company Transaction, the Company shall obtain the ability to share with the Investor Counsel (and such counsel’s clients) and shall
share the confidential information (including, without limitation, the initial and all subsequent drafts of memoranda of understanding, letters of intent and other transaction documents and related noncompete, employment, consulting and other
compensation agreements and plans) pertaining to and memorializing any of the transactions which, individually or when aggregated with others would constitute a Company Transaction. The Company shall be obligated to share (and cause the
Company’s counsel and investment bankers to share) such materials when distributed to the Company’s executives and/or any one (1) or more of the other parties to such transaction(s). In the event that Investor Counsel deems it
appropriate, in its reasonable discretion, to enter into a joint defense (or common interest) agreement or other arrangement to enhance the ability of the parties to protect their communications and other reviewed materials under the attorney client
privilege, the Company shall, and shall direct its counsel 

  
 16 

 
to, execute and deliver to Investor Counsel and its clients such an agreement in form and substance reasonably acceptable to Investor Counsel and the Company’s counsel. In the event that one
(1) or more of the other party or parties to such transactions require the clients of Investor Counsel to enter into a confidentiality agreement and/or joint defense (or common interest) agreement in order to receive such information, then the
Company shall share whatever information can be shared without entry into such agreement and shall, at the same time, in good faith work expeditiously to enable Investor Counsel and its clients to negotiate and enter into the appropriate
agreement(s) without undue burden to the clients of Investor Counsel. 
 4.7 Indemnification Matters. The Company hereby acknowledges
that one (1) or more of the Preferred Directors nominated to serve on the Board of Directors by one (1) or more Investors may have certain rights to indemnification, advancement of expenses and/or insurance provided by one (1) or more
of the Investors and certain of their Affiliates (collectively, the “Investor Indemnitors”). The Company hereby agrees (a) that it is the indemnitor of first resort (i.e., its obligations to any such Preferred Director are
primary and any obligation of the Investor Indemnitors to advance expenses or to provide indemnification for the same expenses or liabilities incurred by such Preferred Director are secondary), (b) that it shall be required to advance the full
amount of expenses incurred by such Preferred Director and shall be liable for the full amount of all expenses, judgments, penalties, fines and amounts paid in settlement by or on behalf of any such Preferred Director to the extent legally permitted
and as required by the Restated Certificate or Bylaws of the Company (or any agreement between the Company and such Preferred Director), without regard to any rights such Preferred Director may have against the Investor Indemnitors, and,
(c) that it irrevocably waives, relinquishes and releases the Investor Indemnitors from any and all claims against the Investor Indemnitors for contribution, subrogation or any other recovery of any kind in respect thereof. The Company further
agrees that no advancement or payment by the Investor Indemnitors on behalf of any such Preferred Director with respect to any claim for which such Preferred Director has sought indemnification from the Company shall affect the foregoing and the
Investor Indemnitors shall have a right of contribution and/or be subrogated to the extent of such advancement or payment to all of the rights of recovery of such Preferred Director against the Company. The Preferred Directors and the Investor
Indemnitors are intended third-party beneficiaries of this Section 4.7 and shall have the right, power and authority to enforce the provisions of this Section 4.7 as though they were a party to this Agreement. 

4.8 Right to Conduct Activities. The Company hereby agrees and acknowledges that each of Avalon, Bregua, RA Capital, OrbiMed,
Correlation Ventures II, L.P., Surveyor, Janus and each Janus Investor, Samsara Biocapital, L.P., 436, L.P., BVF, EcoR1, Logos and Hartford Healthcare Endowment, LLC (together with their Affiliates) (each a “Fund”) is a
professional investment organization, and as such reviews the business plans and related proprietary information of many enterprises, some of which may compete directly or indirectly with the Company’s business (as currently conducted or as
currently propose to be conducted). Nothing in this Agreement shall preclude or in any way restrict the Investors from evaluating or purchasing securities, including publicly traded securities, of a particular enterprise, or investing or
participating in any particular enterprise whether or not such enterprise has products or services which compete with those of the Company; and the Company hereby agrees that, to the extent permitted under applicable law, each Fund shall not be
liable to the Company for any claim arising out of, or based upon, (i) the investment by a Fund in any entity competitive with the Company, or (ii) actions taken by any partner, officer, employee or other representative of a Fund to assist
any such competitive company, whether or not such action was taken as a member of the board of directors of such competitive company or otherwise, and whether or not such action has a detrimental effect on the Company; provided, however, that
the foregoing shall not relieve (x) any of the Investors from liability associated with the unauthorized disclosure of the Company’s confidential information obtained pursuant to this Agreement, or (y) any director or officer of the
Company from any liability associated with his or her fiduciary duties to the Company. 
 4.9 Termination of Certain Covenants. The
covenants set forth in this Section 4, except for the covenants set forth in Sections 4.6, 4.7 and 4.8, shall terminate and be of no further force or effect upon the earliest of: (i) the consummation of the sale of securities pursuant to a
Qualifying IPO; (ii) the first date upon which none of the Registrable Securities are outstanding; or (iii) a Liquidation. 

  
 17 

 5. MISCELLANEOUS. 

5.1 Successors and Assigns. Except as otherwise provided herein, the terms and conditions of this Agreement shall inure to the benefit
of and be binding upon the respective successors and assigns of the parties (including transferees of any shares of Registrable Securities). Nothing in this Agreement, express or implied, is intended to confer upon any party other than the parties
hereto or their respective successors and assigns any rights, remedies, obligations, or liabilities under or by reason of this Agreement, except as expressly provided in this Agreement. 

5.2 Aggregation of Stock. All shares of Registrable Securities held or acquired by affiliated entities or persons shall be aggregated
together for the purpose of determining the availability of any rights under this Agreement. 
 5.3 Notices. All notices required or
permitted hereunder shall be in writing and shall be deemed effectively given: (i) upon personal delivery to the party to be notified; (ii) when sent by electronic mail or confirmed facsimile, if sent during normal business hours of the
recipient or, if not, then on the next business day; (iii) five (5) days after having been sent by registered or certified mail, return receipt requested, postage prepaid; or (iv) one (1) day after deposit with a nationally recognized
overnight courier, specifying next day delivery, with written verification of receipt. All communications shall be sent to the Company and to each of the Investors, as applicable, at the respective addresses set forth on the signature page of this
document or at such other address(es) as the Company or any such Investor may designate by ten (10) days advance written notice to the other parties hereto. 

5.4 Expenses. If any action at law or in equity is necessary to enforce or interpret the terms of this Agreement, the prevailing party
shall be entitled to reasonable attorneys’ fees, costs and necessary disbursements in addition to any other relief to which such party may be entitled. 

5.5 Amendments and Waivers. Except as expressly provided herein, any term of this Agreement may be amended and the observance of any
term of this Agreement may be waived (either generally or in a particular instance and either retroactively or prospectively), only with the written consent of the Company and the Requisite Holders. Notwithstanding the foregoing, (a) this
Agreement may not be amended, modified or terminated and the observance of any term hereof may not be waived with respect to any Investor without the written consent of such Investor, unless such amendment, modification, termination, or waiver
applies on its face to all Investors in the same fashion (it being agreed that a waiver of the provisions of Section 2.2 with respect to a particular transaction shall be deemed to apply to all Investors in the same fashion if such waiver does
so by its terms, notwithstanding the fact that certain Investors may nonetheless, by agreement with the Company, purchase securities in such transaction) and (b) if the second sentence of Section 2.2(d) is amended, terminated or waived
pursuant to the provisions of this Section 5.5, and an Investor purchases New Securities in an offering that is made in connection with such amendment, termination or waiver which would constitute a Waiver Purchase, then each Investor shall
have a ROFR Revival Right. Any amendment or waiver effected in accordance with this paragraph shall be binding upon each holder of any Registrable Securities then outstanding, each future holder of all such Registrable Securities, and the Company.

 5.6 Severability. If one or more provisions of this Agreement are held by a court of competent jurisdiction to be unenforceable
under applicable legal requirements, the parties agree to promptly renegotiate such provision in good faith. In the event that the parties cannot reach a mutually agreeable and enforceable replacement in writing for such provision, then:
(i) such provision shall be excluded from this Agreement; (ii) the balance of the Agreement shall be interpreted as if such provision were so excluded; and (iii) the balance of the Agreement shall be enforceable in accordance with its
terms. 
 5.7 Governing Law. This Agreement shall be governed by and construed under the laws of the State of Delaware without
reference to its principles of conflict of laws. 
 5.8 Entire Agreement. This Agreement, together with the exhibits and schedules
hereto, constitutes the entire agreement among the parties, and no party shall be liable or bound to any other party 

  
 18 

 
in any manner by any warranties, representations, or covenants except as specifically set forth herein or therein. 

5.9 Counterparts; Execution by Facsimile. This Agreement may be executed in two or more counterparts, each of which shall be deemed an
original, but all of which together shall constitute one and the same instrument. Delivery of an executed counterpart of this Agreement by facsimile (or similar electronic means) shall be equally as effective as delivery of an original executed
counterpart of this Agreement. 
 5.10 Effect on Prior Agreement. Upon the execution and delivery of this Agreement, all provisions
of, rights granted and covenants made in the Prior Agreement are hereby waived, released and superseded in their entirety by this Agreement and shall have no further force or effect, including, without limitation, all rights of first refusal and any
notice period under Section 2.2 of the Prior Agreement applicable to the transactions contemplated by the Purchase Agreement. 

[REMAINDER OF PAGE INTENTIONALLY LEFT BLANK] 

  
 19 

 IN WITNESS WHEREOF, the
parties have executed this AMENDED AND RESTATED INVESTORS’ RIGHTS AGREEMENT as of the date first written
above. 
  

			
	COMPANY:
	
	JANUX THERAPEUTICS, INC.
	
	 /s/ David Campbell

	Name:	 	David Campbell, Ph.D.
	Title:	 	President and Chief Executive Officer
		
	Address:	 	11099 North Torrey Pines Road Suite 290
		 	La Jolla, California 92037

 [Signature Page to Amended and Restated Investors’ Rights Agreement] 

 
			
	INVESTOR:
	
	AVALON VENTURES XI, L.P.
		
	By:	 	Avalon Ventures XI GP, LLC
	Its:	 	General Partner
	
	 /s/ Tighe Reardon

	Name:	 	Tighe Reardon
	Title:	 	Authorized Signatory
		
	Address:	 	1134 Kline Street,
		 	La Jolla, California 92037

 [Signature Page to Amended and Restated Investors’ Rights Agreement] 

 
			
	INVESTOR:
	
	ABV SPV I, LP
		
	By:	 	Avalon Ventures XI GP, LLC
	Its:	 	General Partner
	
	 /s/ Tighe Reardon

	Name:	 	Tighe Reardon
	Title:	 	Authorized Signatory
		
	Address:	 	1134 Kline Street
		 	La Jolla, California 92037

 [Signature Page to Amended and Restated Investors’ Rights Agreement] 

 
			
	INVESTOR:
	
	BREGUA CORPORATION
	
	 /s/ Klaus Dorner

	Name:	 	Klaus Dorner
	Title:	 	Director
		
	Address:	 	
	
	 Wickhams Cay, P.O. Box 146

	 Road Town, Tortola VG 1110, BVI

	 Tel.:

	e-mail:

 [Signature Page to Amended and Restated Investors’ Rights Agreement] 

 
			
	INVESTOR:
	
	CORRELATION VENTURES II, L.P.
	As nominee for:
	    Correlation Ventures II, L.P.
	    Correlation Ventures Executives Fund II, L.P.
	        By: Correlation Ventures II GP, LLC
	
	 /s/ David Coats

	Name:	 	David Coats
	Title:	 	Managing Member
		
	Address:	 	9255 Town Centre Drive, Suite 350
		 	San Diego, CA 92121

 [Signature Page to Amended and Restated Investors’ Rights Agreement] 

 
					
	INVESTORS:
	
	RA CAPITAL HEALTHCARE FUND, L.P.
		
	    	 	By: RA Capital Healthcare Fund GP, LLC
		 	Its General Partner
			
		 	By:	 	 /s/ Rajeev Shah

		 	Name:	 	Rajeev Shah
		 	Title:	 	Manager
			
		 	Address:	 	RA Capital Management, L.P.
		 		 	200 Berkeley Street
		 		 	18th Floor
		 		 	Boston, MA 02116
		 		 	Attn: General Counsel
		 		 	Email: legal@racap.com
	
	RA CAPITAL NEXUS FUND II, L.P.
		
		 	By: RA Capital Nexus Fund II GP, LLC
		 	Its General Partner
			
		 	By:	 	 /s/ Rajeev Shah

		 	Name:	 	Rajeev Shah
		 	Title:	 	Manager
			
		 	Address:	 	RA Capital Management, L.P.
		 		 	200 Berkeley Street
		 		 	18th Floor
		 		 	Boston, MA 02116
		 		 	Attn: General Counsel
		 		 	Email: legal@racap.com

 [Signature Page to Amended and Restated Investors’ Rights Agreement] 

 
					
	INVESTOR:
	
	ORBIMED PRIVATE INVESTMENTS VIII, LP
		
	    	 	By: OrbiMed Capital GP VIII LLC,
		 	Its General Partner
		
		 	By: OrbiMed Advisors LLC,
		 	Its Managing Member
			
		 	By:	 	 /s/ Carl Gordon

		 	Name:	 	Carl Gordon
		 	Title:	 	Member
			
		 	Address:	 	c/o OrbiMed Advisors LLC
		 		 	601 Lexington Avenue, 54th Floor
		 		 	New York, NY 10022
		 		 	Tel: +1 (212) 739-6400
		 		 	Email: Legal@OrbiMed.com
		 		 	Attention: General Counsel

 [Signature Page to Amended and Restated Investors’ Rights Agreement] 

 
					
	INVESTOR:
	
	 THE BIOTECH GROWTH TRUST PLC

		
	    	 	By: OrbiMed Capital LLC, solely in its capacity as Portfolio Manager
			
		 	By:	 	 /s/ C. Scotland Stevens

		 	Name:	 	C. Scotland Stevens
		 	Title:	 	Member
			
		 	Address:	 	 601 Lexington Avenue, 54th Floor

		 		 	 New York, NY 10022

		 		 	 Tel: +1 (212) 739-6400

		 		 	 Email: Legal@OrbiMed.com

		 		 	 Attention: General Counsel

 [Signature Page to Amended and Restated Investors’ Rights Agreement] 

 
					
	INVESTOR:
	
	 ORBIMED GENESIS MASTER FUND, L.P.

		
	    	 	By: OrbiMed Genesis GP LLC,
		 	Its General Partner
		
		 	By: OrbiMed Advisors LLC,
		 	Its Managing Member
			
		 	By:	 	 /s/ C. Scotland Stevens

		 	Name:	 	C. Scotland Stevens
		 	Title:	 	Member
			
		 	Address:	 	 601 Lexington Avenue, 54th Floor

		 		 	 New York, NY 10022

		 		 	 Tel: +1 (212) 739-6400

		 		 	 Email: Legal@OrbiMed.com

		 		 	 Attention: General Counsel

 [Signature Page to Amended and Restated Investors’ Rights Agreement] 

 
			
	INVESTORS:
	
	SAMSARA BIOCAPITAL, L.P.
		
	By:	 	Samsara BioCapital GP, LLC,
		 	General Partner
		
	By:	 	 /s/ Srinivas Akkaraju

	Name:	 	Srinivas Akkaraju
	Title:	 	Managing General Partner
	
	436, L.P.
		
	By:	 	436 GP, LLC,
		 	General Partner
		
	By:	 	 /s/ Srinivas Akkaraju

	Name:	 	Srinivas Akkaraju, MD, PhD
	Title:	 	Managing Member
	
	Address: 628 Middlefield Road
		 	    Palo Alto, CA 94301
	Email:

 [Signature Page to Amended and Restated Investors’ Rights Agreement] 

 
			
	INVESTOR:
	
	CITADEL MULTI-STRATEGY EQUITIES MASTER FUND LTD.
	By: Citadel Advisors LLC, its portfolio manager
		
	By:	 	 /s/ Shellane Mulcahy

		
	Name:	 	Shellane Mulcahy
		
	Title:	 	Authorized Signatory
	
	Address:
	c/o Citadel Advisors LLC
	601 Lexington Avenue
	New York, New York 10022
	Attention: Harry Greenbaum
	
	With copies to:
	
	Choate, Hall & Stewart, LLP
	Two International Place
	Boston, MA 02100
	Attention: Brian P. Lenihan and Tobin P. Sullivan

 [Signature Page to Amended and Restated Investors’ Rights Agreement] 

 
			
	INVESTOR:
	
	HARTFORD HEALTHCARE ENDOWMENT, LLC
		
	By:	 	 /s/ David Holmgren

	Name:	 	David J. Holmgren
	Title:	 	Chief Investment Officer
	
	Address:
	
	80 Seymour Street - Cheney Bldg
	Hartford, CT 06102

 [Signature Page to Amended and Restated Investors’ Rights Agreement] 

 
			
	INVESTORS:
	
	JANUS HENDERSON GLOBAL LIFE SCIENCES FUND
	
	By: Janus Capital Management LLC, its investment advisor
		
	By:	 	 /s/ Andrew Acker

	Name:	 	Andrew Acker
	Title:	 	Authorized Signatory
	
	JANUS HENDERSON CAPITAL FUNDS PLC ON BEHALF OF ITS SERIES JANUS HENDERSON GLOBAL LIFE SCIENCES FUND
	
	By: Janus Capital Management LLC, its investment advisor
		
	By:	 	 /s/ Andrew Acker

	Name:	 	Andrew Acker
	Title:	 	Authorized Signatory
	
	JANUS HENDERSON BIOTECH INNOVATION MASTER FUND LIMITED
	
	By: Janus Capital Management LLC, its investment advisor
		
	By:	 	 /s/ Andrew Acker

	Name:	 	Andrew Acker
	Title:	 	Authorized Signatory
	
	JANUS HENDERSON HORIZON FUND - BIOTECHNOLOGY FUND
	
	By: Janus Capital Management LLC, its investment advisor
		
	By:	 	 /s/ Andrew Acker

	Name:	 	Andrew Acker
	Title:	 	Authorized Signatory
	
	Address:
	
	Janus Capital Management LLC,
	151 Detroit Street
	Denver, CO 80206
	Attn: Andrew Acker
	Attn: Angela Morton
	
	with a copy, which shall not constitute notice, to:
	
	Perkins Coie LLP
	3150 Porter Drive
	Palo Alto, CA 94306
	Attn: Adrian Rich (Email: arich@perkinscoie.com)

 [Signature Page to Amended and Restated Investors’ Rights Agreement] 

 
			
	INVESTORS:
	
	ECOR1 CAPITAL FUND, L.P.
	By: EcoR1 Capital, LLC, its General Partner
		
	By:	 	 /s/ Oleg Nodelman

	Name:	 	Oleg Nodelman,
	Title:	 	Manager
	
	ECOR1 CAPITAL FUND QUALIFIED, L.P.
	By: EcoR1 Capital, LLC, its General Partner
		
	By:	 	 /s/ Oleg Nodelman

	Name:	 	Oleg Nodelman,
	Title:	 	Manager
	
	ECOR1 VENTURE OPPORTUNITY FUND, L.P.
	By: Biotech Opportunity GP, LLC, its General Partner
		
	By:	 	 /s/ Oleg Nodelman

	Name:	 	Oleg Nodelman,
	Title:	 	Manager
	
	Address:
	
	357 Tehama Street #3
	San Francisco, CA 94103
	Attn: Scott Perlen 

 [Signature Page to Amended and Restated Investors’ Rights Agreement] 

 
			
	INVESTOR:
	
	LOGOS OPPORTUNITIES FUND II, L.P.
	By: Logos Opportunities II GP, LLC
	Its General Partner
		
	By:	 	 /s/ Graham Walmsley

	Name:	 	Graham Walmsley
	Title:	 	Managing Member
		
	Address:	 	c/o Logos Capital
		 	1 Letterman Drive
		 	Building D, Suite D3-700
		 	San Francisco, CA 94129
		 	Attn: Virginia Yee
		 	Email: 
		
	By:	 	 /s/ Arsani William

	Name:	 	Arsani William
	Title:	 	Managing Partner
		
	Address:	 	c/o Logos Capital
		 	1 Letterman Drive
		 	Building D, Suite D3-700
		 	San Francisco, CA 94129
		 	Attn: Virginia Yee
		 	Email:

 [Signature Page to Amended and Restated Investors’ Rights Agreement] 

 
			
	INVESTORS:
	
	BIOTECHNOLOGY VALUE FUND, L.P.
		
	By:	 	 /s/ Mark Lampert

	Name:	 	Mark Lampert
	Title:	 	Chief Executive Officer BVF I GP LLC, itself
		 	General Partner of Biotechnology Value Fund, L.P.
	
	BIOTECHNOLOGY VALUE FUND II, L.P.
		
	By:	 	 /s/ Mark Lampert

	Name:	 	Mark Lampert
	Title:	 	Chief Executive Officer BVF II GP LLC, itself
		 	General Partner of Biotechnology Value Fund II, L.P.
	
	BIOTECHNOLOGY VALUE TRADING FUND OS, L.P.
		
	By:	 	 /s/ Mark Lampert

	Name:	 	Mark Lampert
	Title:	 	President BVF Inc., General Partner of BVF Partners L.P.,
		 	itself sole member of BVF Partners OS Ltd., itself GP of Biotechnology Value Trading Fund OS, L.P.
	
	Address:
	
	c/o BVF Partners L.P. 44 Montgomery St., 40th Floor
	San Francisco, CA 94104
	Attn: James Kratky, CFO, CCO
	Email: 

 [Signature Page to Amended and Restated Investors’ Rights Agreement] 

 SCHEDULE A 

SCHEDULE OF INVESTORS 
 Avalon Ventures XI,
L.P. 
 ABV SPV I, LP 
 Bregua Corporation 

Correlation Ventures II, L.P. 
 RA Capital Healthcare Fund, L.P.

 RA Capital Nexus Fund II, L.P. 
 OrbiMed Private Investments
VIII, LP 
 The Biotech Growth Trust PLC 
 OrbiMed Genesis
Master Fund, L.P. 
 WS Investment Company, LLC (2018A) 
 Janus
Henderson Global Life Sciences Fund 
 Janus Henderson Capital Funds plc - Janus Henderson Global Life Sciences Fund 

Janus Henderson Biotech Innovation Master Fund Limited 
 Janus
Henderson Horizon Fund - Biotechnology Fund 
 Biotechnology Value Fund, L.P. 

Biotechnology Value Fund II, L.P. 
 Biotechnology Value Trading
Fund OS, L.P. 
 EcoR1 Capital Fund, L.P. 
 EcoR1 Capital Fund
Qualified, L.P. 
 EcoR1 Venture Opportunity Fund, L.P. 

Citadel Multi-Strategy Equities Master Fund Ltd. 
 Samsara
Biocapital, L.P. 
 436, L.P. 
 Logos Opportunities Fund II,
L.P. 
 Hartford Healthcare Endowment, LLC 

 JANUX THERAPEUTICS, INC. 

AMENDMENT TO 
 AMENDED AND
RESTATED INVESTORS’ RIGHTS AGREEMENT 
 This AMENDMENT TO THE
AMENDED AND RESTATED INVESTORS’ RIGHTS AGREEMENT (this “Amendment”) is made as of June 4, 2021 by and
among JANUX THERAPEUTICS, INC., a Delaware corporation (the “Company”), and the undersigned persons and entities (the “Requisite Holders”). 

RECITALS: 
 A. The
Company and the Requisite Holders are bound by the terms of that certain Amended and Restated Investors’ Rights Agreement, dated April 15, 2021, by and among the Company and the investors listed on Schedule A attached thereto (the
“Rights Agreement”). 
 B. The Company and the Requisite Holders constitute the requisite parties to amend the
Rights Agreement pursuant to the terms thereof. 
 C. The Company and the Requisite Holders desire to amend the Rights Agreement as
provided herein. 
 AGREEMENT: 

In consideration of the foregoing, and for other good and valuable consideration, the receipt and sufficiency of which are hereby
acknowledged, the parties to this Amendment, intending to be legally bound and to bind all other parties to the Rights Agreement (and their respective successors and assigns), agree as follows: 

1. Amendments to Rights Agreement. 

(a) Section 1.1(q) of the Rights Agreement is hereby deleted in its entirety and replaced with: 

“The term “Qualifying IPO” means the firmly underwritten initial public offering of shares of Common Stock at a
per share price not less than the Series B Original Purchase Price (as defined in the Restated Certificate) resulting in proceeds to the Company of at least $50,000,000 in the aggregate (after deducting any underwriting or similar commissions,
compensation or concessions paid or allowed by the Company in connection with such offering and any expenses payable by the Company in connection with such offering).” 

2. Remaining Provisions. Upon the effectiveness of this Amendment, each reference in the Rights Agreement to “this Agreement,”
“hereunder,” “hereof,” “herein,” or words of like import shall mean and be a reference to the Rights Agreement as amended by this Amendment, and each reference to the Rights Agreement in any other document, instrument
or agreement executed or delivered in connection with the Rights Agreement shall mean and be a reference to the Rights Agreement as amended by this Amendment. All provisions of the Rights Agreement not specifically amended by this Amendment shall
remain in full force and effect. 
 3. Miscellaneous. This Amendment may be executed in one or more counterparts, each of which shall be
deemed an original, but all of which together shall constitute one and the same instrument. Counterparts may be delivered via facsimile, electronic mail (including PDF or any electronic signature complying with the U.S. federal ESIGN Act of 2000,
e.g., www.docusign.com) or other transmission method and any counterpart so delivered shall be deemed to have been duly and validly delivered and be valid and effective for all purposes.  

 
This Amendment shall be binding on all parties to the Rights Agreement (including those who are not signatories of this Amendment) pursuant to the applicable provisions of the Rights Agreement.

 [Signature pages follow] 

 The undersigned have executed this AMENDMENT TO
THE AMENDED AND RESTATED INVESTORS’ RIGHTS AGREEMENT to be effective as of the date first written above. 

 

			
	COMPANY:
	
	JANUX THERAPEUTICS, INC.
	
	 /s/ David Campbell

	Name:	 	David Campbell, Ph.D.
	Title:	 	President and Chief Executive Officer
		
	Address:	 	11099 North Torrey Pines Road Suite 290
		 	La Jolla, California 92037

 [Signature Page to Amendment to Amended and Restated Investors’ Rights Agreement] 

 
			
	INVESTOR:
	
	AVALON VENTURES XI, L.P.
		
	By:	 	Avalon Ventures XI GP, LLC
	Its:	 	General Partner
	
	 /s/ Jay Lichter

	Name:	 	Jay Lichter
	Title:	 	Authorized Signatory
		
	Address:	 	1134 Kline Street,
		 	La Jolla, California 92037

 [Signature Page to Amendment to Amended and Restated Investors’ Rights Agreement] 

 
			
	INVESTOR:
	
	ABV SPV I, LP
		
	By:	 	Avalon Ventures XI GP, LLC
	Its:	 	General Partner
	
	 /s/ Jay Lichter

	Name:	 	Jay Lichter
	Title:	 	Authorized Signatory
		
	Address:	 	1134 Kline Street
		 	La Jolla, California 92037

 [Signature Page to Amendment to Amended and Restated Investors’ Rights Agreement] 

 
			
	INVESTOR:
	
	BREGUA CORPORATION
	
	 /s/ Klaus Dorner

	Name:	 	Klaus Dorner
	Title:	 	Director
		
	Address:	 	
	
	Wickhams Cay, P.O. Box 146
	Road Town, Tortola VG 1110, BVI
	 Tel.: 
 e-mail: 

 [Signature Page to Amendment to Amended and Restated Investors’ Rights Agreement] 

 
			
	INVESTOR:
	
	CORRELATION VENTURES II, L.P.
	As nominee for:
		 	Correlation Ventures II, L.P.
		 	Correlation Ventures Executives Fund II, L.P.
		 	    By: Correlation Ventures II GP, LLC
	
	 /s/ David Coats

	Name: David Coats
	Title: Managing Member
		
	Address:	 	 9255 Town Centre Drive, Suite 350
 San Diego, CA
92121

 [Signature Page to Amendment to Amended and Restated Investors’ Rights Agreement] 

 
			
	INVESTORS:
	
	RA CAPITAL HEALTHCARE FUND, L.P.
		
	 By:
	 	RA Capital Healthcare Fund GP, LLC
	 Its General Partner

		
	 By:
	 	 /s/ Rajeev Shah

	 Name:
	 	Rajeev Shah
	 Title:    
	 	Manager
		
	 Address:
	 	 RA Capital Management, L.P.

		 	 200 Berkeley Street

		 	 18th Floor

		 	 Boston, MA 02116

		 	 Attn: General Counsel

		 	 Email: legal@racap.com

	
	RA CAPITAL NEXUS FUND II, L.P.
		
	 By:
	 	RA Capital Nexus Fund II GP, LLC
	 Its General Partner

		
	 By:
	 	 /s/ Rajeev Shah

	 Name:
	 	Rajeev Shah
	 Title:
	 	Manager
		
	 Address:
	 	 RA Capital Management, L.P.

		 	 200 Berkeley Street

		 	 18th Floor

		 	 Boston, MA 02116

		 	 Attn: General Counsel

		 	 Email: legal@racap.com

 [Signature Page to Amendment to Amended and Restated Investors’ Rights Agreement] 

 
			
	INVESTOR:
	
	ORBIMED PRIVATE INVESTMENTS VIII, LP
		
	By:	 	OrbiMed Capital GP VIII LLC,
	Its General Partner
		
	By:	 	OrbiMed Advisors LLC,
	Its Managing Member
		
	By:	 	 /s/ Carl Gordon

	Name:	 	Carl Gordon
	Title:	 	Member
		
	Address:	 	 c/o OrbiMed Advisors LLC

		 	 601 Lexington Avenue, 54th Floor

		 	 New York, NY 10022

		 	 Tel: +1 (212) 739-6400

		 	 Email: Legal@OrbiMed.com

		 	 Attention: General Counsel

 [Signature Page to Amendment to Amended and Restated Investors’ Rights Agreement] 

 
			
	INVESTOR:
	
	THE BIOTECH GROWTH TRUST PLC
	
	 By: OrbiMed Capital LLC, solely in its

	 capacity as Portfolio Manager

		
	 By:
	 	 /s/ C. Scotland Stevens

		 	Name: C. Scotland Stevens
		 	Title: Member
		
	Address:	 	
		 	 601 Lexington Avenue, 54th Floor

		 	 New York, NY 10022

		 	 Tel: +1 (212) 739-6400

		 	 Email: Legal@OrbiMed.com

		 	 Attention: General Counsel

 [Signature Page to Amendment to Amended and Restated Investors’ Rights Agreement] 

 
			
	INVESTOR:
	
	ORBIMED GENESIS MASTER FUND, L.P.
	
	 By: OrbiMed Genesis GP LLC,

its General Partner

	
	 By: OrbiMed Advisors LLC,

its Managing Member

		
	 By:
	 	 /s/ C. Scotland Stevens

		 	Name: C. Scotland Stevens
		 	Title: Member
		
	Address:	 	
		 	 601 Lexington Avenue, 54th Floor

		 	 New York, NY 10022

		 	 Tel: +1 (212) 739-6400

		 	 Email: Legal@OrbiMed.com

		 	 Attention: General Counsel

 [Signature Page to Amendment to Amended and Restated Investors’ Rights Agreement] 

 
			
	INVESTOR:
	
	CITADEL MULTI-STRATEGY EQUITIES MASTER FUND LTD.
	By: Citadel Advisors LLC, its portfolio manager
		
	By:	 	 /s/ Christopher Ramsay

		
	Name:	 	Christopher Ramsay
		
	Title:	 	Authorized Signatory
	
	Address:
	
	 c/o Citadel Advisors LLC
 601
Lexington Avenue

	New York, New York 10022
	Attention: Harry Greenbaum
	
	With copies to:
	
	Choate, Hall & Stewart, LLP
	Two International Place
	Boston, MA 02100
	Attention: Brian P. Lenihan and Tobin P. Sullivan 

 [Signature Page to Amendment to Amended and Restated Investors’ Rights Agreement] 

 
			
	INVESTOR:
	
	ECOR1 CAPITAL FUND, L.P.
	By: EcoR1 Capital, LLC, its General Partner
		
	By:	 	 /s/ Oleg Nodelman

	Name:	 	Oleg Nodelman,
	Title:	 	Manager
	
	ECOR1 CAPITAL FUND QUALIFIED, L.P.
	By: EcoR1 Capital, LLC, its General Partner
		
	By:	 	 /s/ Oleg Nodelman

	Name:	 	Oleg Nodelman,
	Title:	 	Manager
	
	ECOR1 VENTURE OPPORTUNITY FUND, L.P.
	By: Biotech Opportunity GP, LLC, its General Partner
		
	By:	 	 /s/ Oleg Nodelman

	Name:	 	Oleg Nodelman,
	Title:	 	Manager
	
	Address:
	
	357 Tehama Street #3
	San Francisco, CA 94103
	Attn: Scott Perlen 

 [Signature Page to Amendment to Amended and Restated Investors’ Rights Agreement]

Source: [{"source": "alea-institute/alea-institute/kl3m-data-edgar-agreements/train-00328-of-00352.parquet"}, [{"source": "alea-institute/alea-institute/kl3m-data-edgar-agreements/train-00328-of-00352.parquet"}]]