Data Usage Agreement

PLEASE READ THIS AGREEMENT CAREFULLY BEFORE SUBMITTING ORDER.

This Data Use Agreement (the “DUA”) is between you and Boca Biolistics, LLC (BBL). You, your employees and collaborators (collectively, the “Purchaser”) agree to use the clinical data (the “Data”) in accordance with this DUA, the Biospecimen Purchase Agreement, and the Terms and Conditions found on BBL’s website. If the Purchaser intends to distribute the Data, the Purchaser agrees to require the end user to agree and comply with the terms of this DUA.

BBL (or its suppliers) is a covered entity as defined in the Health Insurance Portability and Accountability Act of 1996, as amended (“HIPAA”). BBL is providing the Purchaser with a Limited Data Set of Protected Health Information (“PHI”) as defined in 45 C.F.R. §164.514(e)(2) (the “Limited Data Set”). Both BBL and the Purchaser agree to the provisions of this DUA in order to address the requirements of HIPAA and to protect the interest of both parties.

Restrictions on Use and Disclosure

The Purchaser shall have the right to use all PHI provided to it by BBL for research purposes only. The Purchaser agrees that it will not use or further disclose the PHI other than as permitted by this DUA, or as otherwise required by law or regulation. The Purchaser shall use appropriate safeguards to protect the PHI from misuse or inappropriate disclosure and to prevent any use or disclosure of the PHI.

The Purchaser will have the right to disclose non-individually identifiable information regarding the Data in a summary form that aggregates more than one individual’s clinical information for scientific journal publication and regulatory filing purposes, in all events to the extent permitted under applicable law (provided, however, that any such disclosures for patent filing purposes need not be on an aggregate basis if such information so disclosed is de-identified and such disclosures abide by applicable law). The Purchaser shall report to BBL any use or disclosure of the PHI that is not provided for in this DUA of which the Purchaser becomes aware. Purchaser will take reasonable steps to limit any further such use or disclosure.

Identification

The Purchaser will in no way identify or contact, attempt to identify or contact, or aid any person or entity in identifying or contacting any donor, donor family and/or source of the Materials (as defined in the Biospecimen Purchase Agreement). If the Purchaser discovers the identity of any donor, donor family, and/or source of the Materials, the Purchaser will ensure that it will not make use of such knowledge, will advise BBL of such discovery, will safe-guard or destroy such information as requested by BBL, and will inform no other person or entity of such discovered identity (except as may be required by applicable law).

Term and Termination

Term. The Term of this DUA shall be effective as of the receipt of the Data by the Purchaser, and shall terminate when all the PHI provided by BBL to Purchaser is destroyed or returned, or, if it is infeasible to return or destroy PHI, protections are extended to such information, in accordance with this DUA.

Termination. Should the Purchaser commit a material breach of this DUA, which is not cured within ten (10) days after the Purchaser receives notice of such breach from BBL, then BBL will discontinue disclosure of PHI. Within ten (10) days upon termination of this DUA, the Purchaser shall return or destroy all PHI received from BBL. Purchaser shall retain no copies of the PHI. In the event that that Purchaser determines that returning or destroying the PHI is infeasible and upon mutual agreement of both parties, the Purchaser shall extend the protections of this DUA to such PHI and limit further uses and disclosures of such PHI to those purposes that make the return or destruction infeasible, for so long as Purchaser maintains PHI.

Ambiguities

The parties agree that any ambiguity in this DUA shall be resolved in favor of a meaning that complies and is consistent with applicable law protecting the privacy, security and confidentiality of PHI and the Limited Data Set, including, but not limited to HIPAA.