ChilliPharm | Medical images securely stored

ChilliPharm Terms of Service

Revision date: 30th March 2020 (Version 2)

These Terms of Service, including any Schedules attached hereto and the SLA and Support Policy ( together Terms) and any other terms and conditions set forth in the Work Order (the Work Order, together with the Terms, collectively, the Agreement), sets out the terms and conditions under which ChilliBean Limited, a company registered in England and Wales with company number 04775994, with a registered office at 14 Livonia Street, London, W1F 8AG, UK (ChilliBean) will provide the Services (as defined below) to the entity executing the Agreement (Client). ChilliBean and Client are sometimes referred to herein individually as a Party or, collectively, the Parties.

The Services shall, unless otherwise agreed by ChilliBean in writing, be subject to this Agreement. By requesting ChilliBean to provide any Services, Client hereby agrees to be bound by these Terms.

1. INTERPRETATION

1.1. In this Agreement, the following definitions apply:

Affiliate: means in relation to a Party, any other entity which directly or indirectly controls, is controlled by, or is under direct or indirect common control with that Party.

Authorised Users: those individuals who are nominated by Client to use the ChilliPharm Platform, each assigned an unique account login for the ChilliPharm Platform.

Confidential Information: information of a confidential and proprietary nature including, without limitation, Client Data, information about clinical trials, information about patients and healthcare professionals participating in clinical trials, trade secrets, know-how, processes, computer programs, hardware and software requirements and specifications, hardware configurations, software source code, designs, product and/or service descriptions, test and other data, reports, analyses, recommendations, plans, proposals, financial information, business plans, customer and prospect lists, and all other technical, research and development, software and business data or other information that is furnished, disclosed or transmitted to one Party (Receiving Party) by the other Party (Disclosing Party), whether owned by the Disclosing Party or by an Affiliate, supplier, licensee, customer or other business partner of the Disclosing Party, and whether orally, electronically, in writing, in any type of storage medium or otherwise, and which the Disclosing Party designates as being confidential or which, under the circumstances surrounding its disclosure, a reasonable person would have recognised as being confidential. Notwithstanding the foregoing, Confidential Information does not include information that is (a) already known to the Receiving Party without an obligation of confidentiality, (b) already publicly known or becomes publicly known through no breach of an obligation owed by the Receiving Party to the Disclosing Party hereunder, (c) rightfully received by the Receiving Party from a third party which is not under an obligation of confidentiality with respect to such information, or (d) independently developed by or for the Receiving Party without reference to the Confidential Information.

ChilliPharm Dormant: a licence to use the ChilliPharm Platform for the dormant storage of Client Data, if specified in the Work Order.

ChilliPharm Filming Kit: iPads with covers, tripods and tripod mount adaptors for iPads, Apple travel adaptors and lightening port to Ethernet cables for wired connection capability, if specified in the Work Order. ChilliPharm Filming Kit includes ChilliPharm Training, ChilliPharm Support Services and ChilliPharm Guides.

ChilliPharm Platform: the secure web-based digital file transfer and storage solution provided by ChilliBean on a software-as-a-service basis.

ChilliPharm Video Services: video clipping and pixelation services, if specified in the Work Order.

ChilliPharm Subscription: a licence to use the ChilliPharm Platform for the relevant Subscription Period, if specified in the Work Order. ChilliPharm Subscription includes ChilliPharm Training, ChilliPharm Support Services and ChilliPharm Guides.

ChilliPharm Support Services: support services for the ChilliPharm Platform and the ChilliPharm Filming Kit described in the Support Policy.

ChilliPharm Training: training for users of the ChilliPharm Platform and ChilliPharm Filming Kit, provided either in person at meetings arranged by Client or remotely.

ChilliPharm User Guides: English language user guides for (a) Authorised Users (b) ChilliPharm Platform administrators and (iii) users of ChilliPharm Filming Kit.

Client Data: the content, data or other material (a) on the ChilliPharm Filming Kit; (b) on the ChilliPharm Platform that has been submitted to the ChilliPharm Platform by or on behalf of Client; or (iii) generated by ChilliBean in the course of providing the Video Services.

Data Processing Agreement: the terms relating to the processing of personal data set out at Schedule 1.

Force Majeure Event: an event beyond a Party’s reasonable control including but not limited to strikes, lock-outs or other industrial disputes involving the workforce of any third party, failure of a utility service, transport network or the Internet, act of God, war, riot, civil commotion, terrorism, malicious damage, compliance with any law or governmental order, rule, regulation or direction, accident, breakdown of plant or machinery, fire, flood, storm or default of suppliers.

Inappropriate Content: any material which (a) is unlawful, harmful, threatening, defamatory, obscene, infringing, harassing or racially or ethnically offensive; (b) facilitates or promotes illegal activity; (c) is sexually explicit; (d) is discriminatory based on race, gender, ethnicity, sexual orientation, disability, or any other prohibited basis; or (e) causes damage or injury to any person or property.

Security System Overview: ChilliBean’s description of applicable technical and organisational privacy and security measures for the Services at System Security.

Intellectual Property Rights: all patents, rights to inventions, utility models, copyright and related rights, trade marks, service marks, trade names, business and domain names, rights in trade dress or get-up, rights in goodwill or to sue for passing off, unfair competition rights, rights in computer software, database rights, moral rights, rights in confidential information (including know-how and trade secrets) and any other intellectual property rights, in each case whether registered or unregistered and including all applications for and renewals or extensions of such rights, and all similar or equivalent rights or forms of protection in any part of the world.

Management Fee: the fee so specified, if specified in the Work Order.

Purpose: the making, storage and use of video recordings of patient assessments for the purpose of the Trial.

Refund: a refund of pre-paid charges, excluding Set-up Fees, for: (a) any full months remaining on the outstanding Subscription Period; (b) any full months remaining on the outstanding Rental Period; and (c) any other Services not yet rendered.

Rental Period: the period during which ChilliBean is providing Client with rental of ChilliPharm Filming Kit as specified in the Work Order.

Rental Start Date: the date so specified in the Work Order.

Risk Period: the meaning given in clause 5.7.

Schedule: a schedule attached hereto and thereby made part of this Agreement.

Services: such of the following as are specified in the Work Order: ChilliPharm Subscription, ChilliPharm Filming Kit rental, ChilliPharm Video Services, ChilliPharm Dormant.

Set-up Fees: Platform Set-up Fee and/or Filming Kit Set-up Fee, if specified in the Work Order.

Site: the meaning given in clause 5.10.

SLA: the terms describing availability criteria for the ChilliPharm Platform at SLA

Software: the ChilliPharm Platform software and any software developed or used by ChilliBean in connection with the Services.

Subscription Fee: the fee so specified, if specified in the Work Order.

Subscription Period: the period during which ChilliBean is providing Client with a ChilliPharm Subscription, as specified in the Work Order.

Subscription Start Date: the date so specified in the Work Order.

Support Policy: the terms describing implementation and support services at Support Policy

Trial: the pre-clinical or clinical trial specified in the Work Order.

Trial Subjects: patients or healthy volunteers participating in the Trial.

Warranty Period: (a) for the ChilliPharm Subscription, the Subscription Period; (b) for the ChilliPharm Filming Kit, the Rental Period; (c) for ChilliPharm Dormant, the period during which ChilliBean is providing the Client with ChilliPharm Dormant; and (d) for any other Services, the period commencing on the completion of the Services and ending 90 days thereafter.

Work Order: Client’s written order for Services on ChilliBean’s template work order.

1.2. In this Agreement, the following rules apply:

(a) a reference to a Party includes its personal representatives, successors and permitted assigns;

(b) any words following the terms including, include, in particular, for example or any similar expression shall be construed as illustrative and shall not limit the sense of the words, description, definition, phrase or term preceding those terms.

(c) a reference to writing or written includes e-mails; and

(d) in the event and to the extent only of any conflict between these Terms and any Work Order, the Work Order shall prevail.

2. BASIS OF AGREEMENT

2.1. This Agreement shall come into existence when Client and ChilliBean sign a Work Order.

2.2. This Agreement and any document expressly referred to in it: (a) constitutes the entire agreement between the Parties in relation to its subject matter and supersedes all other previous negotiations, proposals or agreements; and (b) applies to the exclusion of any other terms that either Party seeks to impose or incorporate, whether by purchase order or otherwise, or which are implied by trade, custom, practice or course of dealing.

3. SERVICES

3.1. Subject to Client paying the charges in accordance with the provisions of this Agreement, ChilliBean:

(a) will supply the Services specified in the Work Order; and

(b) hereby grants to Client a non-exclusive right to use the ChilliBean Platform during the Subscription Period. This right shall be non-sublicensable save that Client may nominate Authorised Users who are not Client staff provided that they are involved in the Trial.

3.2. The existence of this Agreement shall not prevent ChilliBean from entering into similar agreements with third parties, or from independently developing, using, selling or licensing documentation, products and/or services which are similar to those provided under this Agreement.

3.3. The Client shall provide ChilliBean with reasonably necessary co-operation and access to Client Data, configuration information and such other information as may be reasonably required by ChilliBean, and ensure that such information is accurate in all material respects; for ChilliBean to provide the Services in accordance with this Agreement.

3.4. Client shall not:

(a) use the ChilliPharm Platform or the ChilliPharm Filming Kit for any reason other than the Purpose; or

(b) remove any proprietary markings, copyright notices, logos, trade marks, trade names or labels used in the Services.

3.5. Each Party shall comply with all applicable laws and regulations with respect to its activities under this Agreement.

3.6. ChilliBean may amend the Support Policy from time to time provided that any amendments shall not materially degrade the overall support provided by ChilliBean.

4. CHILLIPHARM PLATFORM

4.1. ChilliBean will make the ChilliPharm Platform available to the Authorised Users in accordance with the SLA. ChilliBean may amend the SLA from time to time provided that any amendments shall not materially degrade the overall service level provided by ChilliBean.

4.2. Client warrants that only Authorised Users will access and/or use the ChilliPharm Platform in accordance with this Agreement. Each Party will notify the other immediately if it has any reason to believe that an Authorised User’s login details are known to anyone other than the Authorised User, or if an Authorised User’s account is, or is likely to be, accessed or used in an unauthorised manner.

4.3. Insofar as any Authorised Users’ act or omission would be a breach of this Agreement if it was Client’s act or omission, Client shall be responsible for that act or omission of the Authorised User as if it was Client’s own.

4.4. Client shall not directly or indirectly:

(a) access all or any part of the Software in order to build a product or service which competes with the Services;

(b) during Client’s use of the ChilliPharm Platform, access, store, distribute or transmit any Inappropriate Content. If ChilliBean reasonably believes Client has breached this obligation, ChilliBean shall notify Client. Client shall be responsible for the prompt deletion of Inappropriate Content.

Any breach of this clause 4.4 shall be deemed to be a material breach of this Agreement.

4.5. Client shall ensure that:

(a) Client’s consent forms, agreements, privacy policies and any other terms applicable to Client’s relationships with Trial Subjects and others involved in the Trial are sufficient and effective to permit Client to use the ChilliPharm Platform in the manner Client selects; and

(b) Client networks, facilities and resources and those of any Authorised Users are compatible with, and capable of, receiving the supply of the ChilliPharm Subscription (including by permitting access to the ChilliPharm Platform).

4.6. Client hereby grants ChilliBean a licence to store, access and use the Client Data solely to fulfil ChilliBean’s obligations under this Agreement.

4.7. The minimum network and information system requirements for Client to use the ChilliPharm Platform are set out [Minimum Requirements]. Client agrees that it is Client’s responsibility to comply with these requirements.

4.8. The ChilliPharm Platform is provided on a software-as-a-service basis and is therefore updated by ChilliPharm from time to time. ChilliBean will make all proposed new features of the ChilliPharm Platform available to Client in a test environment for a minimum period of 2 weeks. Client shall test the proposed new features notified to it and notify ChilliBean in writing of any bugs or other concerns relating to the proposed new features within the test period notified by ChilliPharm. The presence of a proposed new feature in the test environment does not oblige ChilliBean to make that feature available in the live environment.

4.9. Client acknowledges that a failure to use the ChilliPharm Filming Kit in conjunction with the ChilliPharm Platform may lead to video content of variable quality and consistency for which ChilliBean has no liability.

5. CHILLIPHARM FILMING KIT

5.1. ChilliBean shall hire the ChilliPharm Filming Kit to Client for the Rental Period subject to the terms of this Agreement.

5.2. All iPads in the ChilliPharm Filming Kit will be configured such that Client Data can only be uploaded to the Trial-specific area of the ChilliPharm Platform.

5.3. ChilliBean shall use reasonable endeavours to deliver the ChilliPharm Filming Kit to the Sites and by the dates and marked for the attention of the persons agreed in writing by the Parties (Delivery) however ChilliBean shall have no liability for any delay due to unforeseen circumstances.

5.4. Client shall procure that a duly authorised representative of Client shall be present at the Delivery of the ChilliPharm Filming Kit. Acceptance of delivery by such representative shall constitute conclusive evidence that Client has examined the ChilliPharm Filming Kit and has found it to be in good condition, complete and fit in every way for the purpose for which it is intended (save as regards any latent defects not reasonably apparent on inspection). If required by ChilliBean, Client’s duly authorised representative shall sign a receipt confirming such acceptance.

5.5. Client acknowledges that:

(a) ChilliBean does not initiate any back-up or remote storage of data from the ChilliPharm Filming Kit;

(b) it is Client’s responsibility to upload data from the ChilliPharm Filming Kit to the ChilliPharm Platform as soon as possible and thereafter promptly to delete the data from the ChilliPharm Filming Kit;

(c) updates to the operating software on the iPads must be accepted by users promptly for security purposes. However, if the operating software is updated before all data then stored on the iPad has been uploaded to the ChilliPharm Platform, it may not be technically possible to upload such data to the ChilliPharm Platform or to access it in any other way. Client shall therefore ensure that all data on the iPad has been uploaded to the ChilliPharm Platform before accepting operating software updates.

5.6. The ChilliPharm Filming Kit shall at all times remain the property of ChilliBean, and Client shall have no right, title or interest in or to the ChilliPharm Filming Kit save the right to possession and use of the ChilliPharm Filming Kit during the Rental Period subject to the terms and conditions of this Agreement.

5.7. The risk of loss, theft, damage or destruction of the ChilliPharm Filming Kit shall pass to Client on Delivery. The Client shall promptly notify ChilliBean of any such of loss, theft, damage or destruction and shall pay ChilliBean for the full cost of repair or, if ChilliBean determines repair is not reasonably possible, the full cost of replacement of such ChilliPharm Filming Kit. The ChilliPharm Filming Kit shall remain at the sole risk of Client during the Rental Period and any further term during which the ChilliPharm Filming Kit is in the possession, custody or control of Client (Risk Period) until such time as the ChilliPharm Filming Kit is redelivered to ChilliBean.

5.8. In the event of the loss or theft of the ChilliPharm Filming Kit, ChilliBean reserves the right remotely to delete all Client Data from the ChilliPharm Filming Kit without any liability to Client for such loss of data.

5.9. ChilliBean has no responsibility for the connectivity of the ChilliPharm Filming Kit, no SIM card is provided with the ChilliPharm Filming Kit and all Wi-Fi and other use are Client’s responsibility.

5.10. The Client shall ensure that the ChilliPharm Filming Kit:

(a) is used only in conjunction with the ChilliPharm Platform;

(b) is kept and operated in a secure and suitable environment free from hazards including liquids;

(c) is set up and operated in a safe and proper manner by trained competent users;

(d) is used only in accordance with the User Guides;

(e) is not altered or tampered with in any way by anyone other than ChilliBean; and

(f) is kept at the site nominated by Client in the country identified on the Work Order, unless a new site is agreed by the Parties in writing (Site).

5.11. At the end of the Rental Period ChilliBean shall collect the ChilliPharm Filming Kit from the respective Sites. Client shall provide all reasonable assistance to ChilliBean in facilitating such collection and shall pay ChilliBean’s reasonable charges for the collection of the ChilliPharm Filming Kit and its return to ChilliBean. The ChilliPharm Filming Kit shall be in the same condition as it was supplied, subject to reasonable wear and tear.

5.12. Client acknowledges that access to the iPads in the ChilliPharm Filming Kit is protected by a passcode. Client shall ensure that only personnel authorised by Client have access to the passcode. Insofar as any third party uses the ChilliPharm Filming Kit during the Risk Period, and any act or omission of that third party would be a breach of this Agreement if it was Client’s act or omission, Client shall be responsible for that act or omission of the third party as if it was Client’s own.

6. CHARGES AND PAYMENT

6.1. Client shall pay ChilliBean the charges specified in the Work Order. Charges are payable by Client on the payment terms set out in the Work Order in pounds sterling.

6.2. When this Agreement is made ChilliBean shall invoice Client for all Set-up Fees. All Set-up Fees shall be non-cancellable and non-refundable.

6.3. ChilliBean shall invoice the Client for the Subscription Fee and Management Fee monthly in advance. ChilliBean shall invoice Client for all other amounts monthly in arrears.

6.4. The Subscription Fee is due from the earlier of the Subscription Start Date and the date Client starts using the ChilliPharm Platform for the Trial . Any Management Fee is due from the earlier of the Rental Start Date and the shipping date of the first items of the relevant ChilliPharm Filming Kit to be shipped.

6.5. All amounts payable are exclusive of value added tax (VAT) and other taxes, fees and governmental charges. Where any taxable supply for VAT purposes is made by ChilliBean to Client, Client shall, on receipt of a valid VAT invoice from ChilliBean, pay to ChilliBean such additional amounts in respect of VAT as are chargeable at the same time as payment is due under the Work Order. If Client believes that Client is not subject to VAT, Client shall provide ChilliBean all the information necessary for ChilliBean to be able to invoice Client without adding VAT.

6.6. Any prices for Services exclude the cost of travel, hotels, meals, and any other ancillary expenses reasonably incurred by ChilliBean’s personnel providing such Services which shall be shown separately on the Work Order. ChilliBean shall be entitled to business class travel for any flight of 5 hours or longer. Client will reimburse ChilliBean for such costs and expenses, which shall be invoiced by ChilliBean and payable on the payment terms set out in the Work Order, provided that ChilliBean must obtain Client’s prior approval for any cost or expense.

6.7. The Platform Set-up Fee includes access to the ChilliPharm User Guides, and 2 days’ ChilliPharm Training with one trainer (subject to client paying for travel as set out above), at Client’s option at Client site or remotely. Bespoke training materials and additional training including refresher training is available at Client site or remotely for an additional charge. User Guides are available in languages other than English for an additional charge.

6.8. Without limiting any of ChilliBean’s other rights or remedies, if Client fails to make any payment due to ChilliBean by the due date (Payment Default) unless and to the extent that Client has, acting reasonably and in good faith, previously notified ChilliBean that Client disputes that such payment is due, ChilliBean shall have the right to: (a) upon 10 days’ prior notice, suspend performance under this Agreement until Client remedies the Payment Default; (b) upon 20 days’ prior notice, terminate this Agreement; and (c) charge interest on the overdue amount from the Payment Date at the annual rate of 5% above the then current base lending rate of the Bank of England, accruing daily and being compounded quarterly until payment is made, whether before or after any judgment; and Client shall reimburse to ChilliBean all expenses (including reasonable legal fees) that ChilliBean may incur in collecting such late payments.

6.9. ChilliBean shall not be obliged to provide Client with any Services until ChilliBean has received all information ChilliBean requires from Client to invoice Client, including purchase order number.

6.10. All amounts due under this Agreement shall be paid in full without any set-off, counterclaim, deduction or withholding.

7. WARRANTY

7.1. ChilliBean warrants to Client that, during the Warranty Period: (a) the ChilliPharm Platform will operate substantially in accordance with the ChilliPharm Platform specification (copy available on request) subject to clause 4.8; (b) the ChilliPharm Filming Kit will conform substantially with the ChilliPharm Filming Kit (copy available on request) and (c) any other Services will be provided with reasonable skill and care, consistent with relevant industry standards.

7.2. The warranty set forth in clause 7.1 shall not apply to the extent of any use of the ChilliPharm Platform, ChilliPharm Filming Kit or other Services contrary to this Agreement, the User Guides or ChilliBean’s written instructions, or to modification, alteration or replacement of parts of the ChilliPharm Platform or ChilliPharm Filming Kit by Client or any third party not authorised by ChilliBean.

7.3. If the ChilliPharm Platform, ChilliPharm Filming Kit or other Services do not conform with the warranty set forth in clause 7.1, and Client during the Warranty Period notifies ChilliBean in writing setting out in detail the non-conformity, and returns any non-conforming ChilliPharm Filming Kit, subject to clause 5.7 ChilliBean will replace any non-conforming ChilliPharm Filming Kit (by sending to the Site to which the original ChilliPharm Filming Kit was supplied), correct any such ChilliPharm Platform non-conformance or provide Client with a workaround. If such remedies are not reasonably practicable, ChilliBean may at ChilliBean’s option, terminate this Agreement on at least five days’ notice to Client and pay any applicable Refund. The remedies set forth in this clause 7.3 constitute Client’s sole and exclusive remedy for any breach of the warranty set forth in clause 7.1 Notwithstanding the foregoing, ChilliBean:

(a) does not warrant that Client’s use of the ChilliPharm Platform and ChilliPharm Filming Kit will be uninterrupted or error-free; nor that the ChilliPharm Platform and ChilliPharm Filming Kit and/or the output or information obtained by Client through the ChilliPharm Platform and ChilliPharm Filming Kit will meet Client’s requirements; and

(b) is not responsible for any delays, delivery failures, or any other loss or damage resulting from the transfer of data over communications networks and facilities, including the Internet, and Client acknowledges that the ChilliPharm Platform and ChilliPharm Filming Kit may be subject to limitations, delays and other problems inherent in the use of such communications facilities.

8. CLIENT DATA

8.1. ChilliBean confirms that the Services are ISO 27001:2013 certified.

8.2. ChilliBean is periodically audited in relation to the United States Food and Drug Administration’s guidance on the scope of part 11 Title 21 of the Code of Federal Regulations: “Electronic Records; Electronic Signatures” and “Computerized Systems Used in Clinical Investigations”. A copy of the audit report is available to Client upon request.

8.3. As between the Parties, Client shall own all rights, title and interest in and to all Client Data and all reports and other outputs generated by Client or on Client’s behalf using the ChilliPharm Platform.

8.4. The Data Processing Agreement shall apply to the collection, use, transfer and processing of: (a) data related to Authorised Users; and (b) any personal data (as defined in the Data Processing Agreement) comprised in Client Data.

8.5. In relation to Client Data which is not personal data:

(a) Client shall have sole responsibility for the legality, reliability, integrity, accuracy and quality of such Client Data;

(b) in the event of any inability of Client to access or use such Client Data on the ChilliPharm Platform, Client’s sole and exclusive remedy shall be for ChilliBean to use reasonable commercial efforts to restore such data from ChilliBean’s latest back-up;

(c) Client agrees that the security measures provided by ChilliBean will be as specified in the Information Security Overview. ChilliBean shall not be liable for any breach of security in relation to such Client Data unless it is caused by ChilliBean’s failure to provide such security measures; and

(d) in the event of any unauthorised disclosure of such Client Data by ChilliBean, ChilliBean shall, as applicable: (i) notify Client as soon as practicable; (ii) reasonably cooperate with Client in investigating the disclosure; and (iii) provide Client with a plan describing the measures ChilliBean will undertake to prevent any future unauthorised disclosures.

8.6. ChilliBean may amend the Information Security Overview from time to time provided that any amendments shall not materially degrade the overall security measures provided by ChilliBean.

8.7. ChilliPharm shall delete any Client Data if required to do so by court order or other lawful authority.

9. INTELLECTUAL PROPERTY RIGHTS

9.1. Client acknowledges and agrees that ChilliBean and/or ChilliBean’s licensors own all Intellectual Property Rights in the Software and the Services. Except as expressly stated in this Agreement, this Agreement does not grant Client any rights to, or under Intellectual Property Rights, or any other rights or licences in respect of the Software or the Services.

9.2. Client acknowledges that ChilliBean develops the Software in response to suggestions from ChilliBean’s many users for the benefit of all users. If Client provides any suggestions to ChilliBean relating to the Software or Services, ChilliBean will own all right, title and interest in and to such suggestions, even if Client has designated such suggestions as confidential or proprietary. ChilliBean will be entitled to use such suggestions without restriction. Client hereby irrevocably assigns to ChilliBean all right, title and interest in and to such suggestions. At ChilliBean’s cost, Client agrees to provide reasonable assistance, if necessary, to document and secure ChilliBean’s rights in such suggestions. For the avoidance of doubt, Client will not acquire any Intellectual Property Rights or other rights in any software developed by ChilliBean, even if such software is developed at Client’s suggestion or specifically for the ChilliPharm Platform or Services being provided to Client.

10. INDEMNITIES

10.1. ChilliBean shall defend Client against any third party claim that Client’s use of the Software in accordance with this Agreement infringes any patent, copyright, trade mark, database right or right of confidentiality of a third party, and ChilliBean shall indemnify Client for any amounts awarded against Client in judgment or settlement of such claims.

10.2. In the defence or settlement of any claim, ChilliBean may procure the right for Client to continue using the Software, replace or modify the Software so that it becomes non-infringing or, if such remedies are not reasonably available, terminate this Agreement and pay any applicable Refund.

10.3. Notwithstanding clause 10.1, ChilliBean shall have no obligation to indemnify or defend Client for any claim based on: (a) Client’s or any third party’s modification of the Software unless such modification was authorised by ChilliBean in writing; (b) Client’s use of the Software in a manner contrary to this Agreement, the User Guides or ChilliBean’s written instructions to Client; (c) Client’s use of the Software after notice of the alleged or actual infringement from ChilliBean or any appropriate authority.

10.4. The foregoing states Client’s sole and exclusive rights and remedies, and ChilliBean’s (and ChilliBean’s employees’, agents’, sub-contractors’ and licensors’) entire obligations and liability, for infringement of the intellectual property rights of a third party.

10.5. Client shall defend and indemnify ChilliBean against any claims, actions, proceedings, losses, damages, expenses and costs (including without limitation court costs and reasonable legal fees) arising out of or in connection with: (a) any third party claims against ChilliBean as a result of any Client acts or omissions whether negligent or otherwise, subject to clause 10.1, (b) unauthorised access to the ChilliPharm Platform using the login details of Authorised Users; (c) breach of clause 4.4(b); (d) Client Data; (e) any accident involving the ChilliPharm Filming Kit during the Risk Period; (f) Client’s use of the Software in a manner contrary to this Agreement, User Guides or ChilliBean’s written instructions to Client; except to the extent that the foregoing are due to ChilliBean’s negligence or deliberate wrongdoing.

10.6. The indemnifying Party’s obligations pursuant to this clause 10 are contingent upon: (a) the indemnified Party providing notice in writing promptly after the indemnified Party becomes aware of any claim subject to indemnification pursuant to this clause 10; (b) the indemnified Party making no admissions in respect of any third party claim and complying with all reasonable instructions relating to the claim given by the indemnifying Party in relation to a third party claim; (c) the indemnified Party allowing the indemnifying Party, at the indemnifying Party’s expense, to assume full control and defence of any third party claim, with an obligation to keep the indemnified Party informed about the claim; and (d) the indemnified Party providing to the indemnifying Party all reasonable assistance and information required for the defence of such third party claim.

11. CONFIDENTIALITY

11.1. A Receiving Party shall use the Disclosing Party’s Confidential Information solely for the performance of its obligations under this Agreement, and shall keep all such Confidential Information in strict confidence. The Receiving Party shall restrict disclosure of such Confidential Information to such of the Receiving Party’s employees, agents or sub-contractors as need to know it for the purpose of discharging the Receiving Party's obligations to the Disclosing Party, and shall ensure that such employees, agents or sub-contractors are subject to obligations of confidentiality corresponding to those which bind the Receiving Party hereunder. The Receiving Party shall protect the confidentiality of the Disclosing Party’s Confidential Information using the same degree of care that the Receiving Party uses to protect its own similar information, but in no event less than a reasonable degree of care. This clause 11 is subject to clause 8 above and the Data Processing Agreement.

11.2. If the Receiving Party is required by law or governmental regulation to disclose the Disclosing Party’s Confidential Information, the Receiving Party shall, if permitted by law and to the extent practicable, provide the Disclosing Party with timely prior written notice to allow the Disclosing Party, at its expense, to seek a protective order or otherwise prevent the disclosure of such Confidential Information.

11.3. If the Parties have entered into any non-disclosure or confidentiality agreement (NDA) prior to this Agreement, the Parties agree that, notwithstanding any contrary provision in the NDA, the NDA shall terminate upon the execution of this Agreement.

12. LIMITATION OF LIABILITY

12.1. Neither Party excludes or limits liability to the other Party for: (a) death or personal injury caused by its negligence, or the negligence of its employees, agents or sub-contractors; (b) fraud or fraudulent misrepresentation; (c) breach of the terms implied by section 2 of the Supply of Goods and Services Act 1982 (title and quiet possession); or (d) payment of sums properly due and owing to the other in the normal course of the performance of this Agreement.

12.2. Subject to clause 12.1, neither Party shall be liable whether in contract, tort (including for negligence), breach of statutory duty, misrepresentation (whether innocent or negligent), restitution or otherwise in any circumstances for: (a) any loss (whether direct or indirect) of profits, business, business opportunities, revenue, turnover, reputation or goodwill; (b) any loss (whether direct or indirect) of anticipated savings or wasted expenditure (including management time); (c) any loss or liability (whether direct or indirect) under or in relation to any other contract; (d) any pure economic loss (whether direct or indirect); (e) any special, indirect or consequential loss, costs, damages, charges or expenses; and/or similar losses, however arising under or in relation to this Agreement.

12.3. Except for either Party’s liability under clause 10 (Indemnities), and subject to clause 12.1, each Party’s total liability in respect of all losses arising under or in connection with this Agreement, whether in contract, tort (including negligence), breach of statutory duty, misrepresentation (whether innocent or negligent), restitution or otherwise:

(a) relating to the obligations in the Data Processing Agreement, shall in no circumstances exceed in respect of this Agreement, 250% of the amount paid to ChilliBean under this Agreement during the 12 months immediately preceding the date on which the first cause of action relating to such obligations arose; and

(b) relating to obligations in this Agreement other than those referred to in clause 12.3(a), shall in no circumstances exceed in respect of this Agreement, 100% of the amount paid to ChilliBean under this Agreement during the 12 months immediately preceding the date on which the first cause of action relating to such obligations arose.

13.4. Except as set out in this Agreement, all warranties, conditions and other terms implied by statute or common law are, to the fullest extent permitted by law, excluded from this Agreement.

13. TERMINATION

13.1. Subject to the remainder of this clause 13, this Agreement shall expire when ChilliBean has performed and received full payment for all the Services in the Work Order.

13.2. Without limiting its other rights or remedies, either Party may terminate this Agreement with immediate effect by giving notice to the other Party if the other Party: (a) commits a material breach of this Agreement; provided that if the breach is curable, the termination shall be effective only if the breach is not cured within 30 days of receipt of such notice; or (b) suspends or ceases, or threatens to suspend or cease, to carry on all or a substantial part of its business.

13.3. On expiry or termination of this Agreement for any reason:

(a) unless ChilliBean receives, no later than 20 days after the expiry or termination of this Agreement, a signed Work Order from Client for ChilliPharm Dormant, ChilliBean shall, provided that Client has, at that time, paid all fees and charges outstanding at and resulting from expiry or termination (whether or not due at the date of expiry or termination), provide to Client, within 60 days of ChilliBean’s receipt of such request, an export of the Client Data from the ChilliPharm Platform on a physical storage device and shall delete all Client Data from the ChilliPharm Platform and ChilliPharm Filming Kit;

(b) all licences and permissions granted by ChilliBean under this Agreement shall immediately terminate;

(c) Client shall immediately cease all use of the ChilliPharm Platform and ChilliPharm Filming Kit and erase and destroy all copies, full or partial, of ChilliBean’s Confidential Information in Client’s possession or control; further at ChilliBean’s request, Client will provide written certification of such destruction to ChilliBean;

(d) Client shall immediately pay all of ChilliBean’s outstanding unpaid invoices and interest and, in respect of any Services supplied but for which no invoice has been submitted, ChilliBean shall submit an invoice, which shall be payable by Client immediately on receipt;

(e) the Parties accrued rights, remedies, obligations and liabilities as at expiry or termination shall not be affected, including the right to claim damages in respect of any breach of this Agreement which existed at or before the date of termination or expiry; and

(f) Clauses 9 (Intellectual Property Rights), 10 (Indemnities), 11 (Confidentiality), 12 (Limitation of Liability), this 13.3 (effect of expiry or termination) and 14 (General) and clauses and paragraphs of this Agreement which expressly or by implication have effect after expiry or termination shall continue in full force and effect.

14. GENERAL

14.1. If a Force Majeure Event occurs, the affected Party shall be excused from such performance while such circumstances exist, and such additional period as may be reasonably necessary to allow that Party to resume its performance. If any Force Majeure Event shall continue beyond 60 days, the non-affected Party may terminate this Agreement without penalty, and if ChilliBean is the affected Party, ChilliBean shall pay any applicable Refund.

14.2. To the extent any act or omission by Client or failure by Client to perform any obligation (Client Default) prevents or delays the performance of any of ChilliBean’s obligations: (a) ChilliBean shall without limiting ChilliBean’s other rights or remedies have the right to suspend performance of the Services until Client remedies the Client Default, and to rely on the Client Default to relieve ChilliBean from the performance of any of ChilliBean’s obligations; (b) ChilliBean shall not be liable for any costs or losses sustained or incurred by Client arising directly or indirectly from ChilliBean’s failure or delay to perform any of ChilliBean’s obligations as set out in this clause 14.2; and (c) Client shall be responsible for any costs or losses sustained or incurred by ChilliBean arising from the Client Default.

14.3. Other than as expressly set forth in this Agreement, neither Party nor any successor, receiver, or assignee thereof shall directly or indirectly assign the benefit of this Agreement without the prior written consent of the other Party. Notwithstanding the foregoing, either Party may assign the benefit of this Agreement to its Affiliates or as part of a corporate reorganisation, consolidation, merger, or sale of substantially all of its assets, equity or business to which this Agreement relates, provided that such successor agrees in writing to perform the assignor’s obligations thereunder and provided in the case of assignment by Client, that the assignee is not one of ChilliBean’s competitors. Any assignment in contravention of this clause shall be null and void.

14.4. Any notice or other communication required to be given to a Party under or in connection with this Agreement shall be in writing and: (a) if given by ChilliBean to Client, it shall be sent by email to the address provided when Client placed Client’s most recent Work Order; (b) if given by Client to ChilliBean, it shall be sent by email to legal@chillibean.com; and (c) shall be deemed to have been duly received on the next business day (in the place of receipt of the notice) after transmission. This clause 14.4 shall not apply to the service of any proceedings or other documents in any legal action.

14.5. A waiver of any right under this Agreement is only effective if it is in writing and shall not be deemed to be a waiver of any subsequent breach or default. No failure or delay by a Party in exercising any right or remedy under this Agreement or by law shall constitute a waiver of that or any other right or remedy, nor preclude or restrict its further exercise. No single or partial exercise of such right or remedy shall preclude or restrict the further exercise of that or any other right or remedy.

14.6. Unless specifically provided otherwise, rights arising under this Agreement are cumulative and do not exclude rights provided by law.

14.7. If a court or any other competent authority finds that any provision of this Agreement (or part of any provision) is invalid, illegal or unenforceable, that provision or part-provision shall, to the extent required, be deemed deleted, and the validity and enforceability of the other provisions of this Agreement shall not be affected. If any invalid, unenforceable or illegal provision of this Agreement would be valid, enforceable and legal if some part of it were deleted, the provision shall apply with the minimum modification necessary to make it legal, valid and enforceable.

14.8. Nothing in this Agreement is intended to, or shall be deemed to, constitute a partnership or joint venture of any kind between the Parties.

14.9. A person, which includes a natural person, corporate or unincorporated body (whether or not having a separate legal personality), who is not a party to this Agreement shall not have any rights under or in connection with it.

14.10. Except as set out in this Agreement, any variation to this Agreement, including the introduction of any additional terms and conditions, to this Agreement, shall only be binding when agreed in writing and signed by both Parties.

14.11. This Agreement, and any dispute or claim arising out of or in connection with this Agreement or its subject matter or formation (including non-contractual disputes or claims), shall be governed by, and construed in accordance with, the law of England and Wales, and the Parties irrevocably submit to the exclusive jurisdiction of the courts of England and Wales except in respect of breach of clause 11 (Confidentiality) and breach of either Party’s Intellectual Property Rights where the jurisdiction of the courts of England and Wales shall be non-exclusive.

Schedule 1 Data Processing Agreement

This Data Processing Agreement (DPA) forms part of the Agreement between ChilliBean Limited, a company registered in England and Wales with company 04775994, with a registered office at 14 Livonia Street, London, W1F 8AG, UK (ChilliBean) and the entity executing the Agreement (Client).

1. INTERPRETATION

1.1. Words and expressions defined in the Agreement shall have the same meaning in this Schedule and the following words and expressions shall have the following respective meanings:

Data Protection Laws: all applicable laws and regulations related to the processing of personal data as contemplated under this DPA including but not limited to the Data Protection Act 2018, the EU Directive 95/46 EC, Regulation 2016/679 (the General Data Protection Regulation or GDPR), and local data protection and privacy legislation applicable to the Parties in any relevant country in which they are established or process personal data.

Personal Data Breach: means any breach of security leading to the accidental or unauthorised destruction, loss, alteration, disclosure of, or access to, personal data.

The terms data subject, data controller, data processor, process and personal data shall have the meanings given to those terms in the applicable Data Protection Laws.

Sub-processor: third parties authorised by ChilliBean to process personal data in accordance with this Agreement.

1.2. This DPA applies only to the personal data which ChilliBean will process on behalf of Client in the course of providing the Services. The Parties acknowledge that for the purposes of the Data Protection Laws, Client is the data controller and ChilliBean is a data processor of such personal data.

2. DATA PROCESSING

2.1. This DPA is in addition to, and does not relieve, remove or replace, either Party's direct obligations under the Data Protection Laws.

2.2. To the extent ChilliBean processes personal data on behalf of Client, the subject matter and the duration of the processing are as set out in the Agreement. The Parties acknowledge the following in relation to the personal data being processed under the Agreement:

Nature of processing

Storage, editing making available Client Data to users nominated by Client; generating, storing and processing Authorised User login details to permit access to the ChilliPharm Platform

Purpose of processing

The provision of the Services by ChilliBean to Client

Types of personal data

Authorised User login details Authorised User email address Log-files/software usage Devices identifiers IP address Website usage (cookies) Location data Name Position/function Professional contact information – email Pictures/photos – Optional Avatars Filmed Trial assessments of Trial Subjects by healthcare professionals Videos Pictures/photos of Trial Subjects and healthcare professionals Clinical/medical information about Trial Subjects

Categories of data subjects

Trial Subjects; Client staff; healthcare professionals involved in the Trial

2.3. The rights and obligations of Client in connection with the data processing activities are as set out in the Agreement and below.

3. CHILLIBEAN’S OBLIGATIONS

3.1. ChilliBean shall in relation to the personal data it processes on behalf of Client:

(a) process personal data only in accordance with the Agreement and the documented instructions of Client or as required by law. ChilliBean shall notify Client of any such legal requirement unless prevented by law on important grounds of public interest. Processing initiated by or on behalf of Client shall be deemed to be processing upon the documented instructions of Client;

(b) notify Client if ChilliBean believes Client’s instructions are illegal, unless a law prevents ChilliBean from doing so;

(c) notify Client in advance if a law requires ChilliBean to disclose the personal data to a third party (unless a law prevents ChilliBean from doing so);

(d) take reasonable steps to ensure the reliability of staff having access to the personal data and ensure all staff to whom it discloses personal data are made aware that the personal data is confidential information and subject to the obligations set out in the Agreement;

(e) ensure the ongoing confidentiality, integrity, availability and resilience of processing systems and services associated with the processing of the personal data;

(f) maintain the ability to restore the availability and access to the personal data in a timely manner in the event of a physical or technical incident affecting the processing of the personal data;

(g) maintain a process for regular testing, assessment and evaluation of the security measures required by the Agreement;

(h) at all times during the term of the Agreement, have appropriate technical and organisational measures in place to prevent unauthorised or unlawful processing of personal data and accidental loss or destruction of, or damage to, personal data as specified in the Information Security Overview and ChilliBean shall maintain such security measures for as long as it is processing the personal data; ChilliBean may amend the Information Security Overview from time to time provided that any amendments shall not materially degrade the overall security measures provided by ChilliBean during the term of the Agreement;

(i) not transfer, or otherwise permit access to, outside of the EEA any personal data without Client’s prior written consent; However, Client acknowledges that Client, not ChilliBean controls the access of Authorised Users around the world to such personal data;

(j) upon the request of Client, promptly provide a written description of the technical and organisational measures employed by its permitted sub-contractors, detailed to such a level that Client can determine whether or not, in connection with personal data, its permitted sub-contractors are complying with their obligations under the Agreement;

(k) promptly refer to Client any requests, notices or other communication from the Information Commissioner’s Office or any other supervisory authority or regulator or law enforcement agency relating to personal data for Client to resolve;

(l) provide such information, access and assistance to Client as Client may reasonably require, and within the timescales reasonably specified by Client, to allow Client to: (a) ensure ChilliBean is meeting security of processing obligations; (b) carry out data protection impact assessments; and (c) comply with notices served by or other communication from the Information Commissioner’s Office or any other supervisory authority or regulator; provided that Client shall pay ChilliBean’s reasonable costs incurred on a time and materials basis in providing such information, access and assistance.

(m) within 48 hours of becoming aware and in any event as soon as reasonably practical, notify Client of any Personal Data Breach; and

(n) at Client’s option, return or delete all personal data at the end of the Agreement in accordance with clause 13.3 of the Agreement.

4. CLIENT’S OBLIGATIONS

4.1. Any instructions given by Client to ChilliBean for the processing of personal data shall comply with Data Protection Laws.

4.2. Client shall have sole responsibility for the accuracy, quality, and legality of personal data and the means by which Client acquires personal data.

4.3. Client is responsible for utilising the structures and metadata in the ChilliPharm Platform and the ChilliPharm Filming Kit iPads, to collect and store personal data in a structured way such that Client can readily locate personal data if required to comply with Data Protection Laws.

4.4. Personal data processed in the Services may come from data subjects located in countries all over the world. It is Client’s responsibility to inform data subjects, via Client’s privacy policy or otherwise, of the processing of their personal data, and Client undertakes to ensure that Client is entitled to transfer such personal data to ChilliBean for processing in accordance with this Agreement.

4.5. If Article 44 of GDPR applies to a transfer of data from the EEA to the UK because, following the UK’s departure from the European Union, the transfer is not permitted under Article 45 (transfers on the basis of an adequacy decision) or an EU decision or agreement of equivalent effect, the Parties shall enter into standard data protection clauses adopted by the EU Commission in accordance with the examination procedure referred to in Article 93(2) of GDPR.

5. LIABILITY

5.1. Client acknowledges that ChilliBean is reliant on Client for direction as to the extent to which ChilliBean is entitled to process the personal data. Consequently, ChilliBean will not be liable for any claim brought by a data subject arising from any action or omission by ChilliBean, to the extent that such action or omission resulted directly from Client’s instructions.

5.2. ChilliBean shall not be liable for any Personal Data Breach unless caused by ChilliBean’s failure to provide the security measures set out at paragraph 3.1(h).

5.3. The limitations and caps on liability set out in this Agreement apply to this DPA.

6. APPOINTMENT OF SUB-PROCESSORS

6.1. ChilliBean may appoint Sub-processors, provided that where the Sub-processor has logical access to personal data, the Sub-processor's contract: (a) is on terms which are substantially the same as those set out in this DPA; and (b) Sub-processors’ rights to process personal data under this Agreement with Client terminates on termination of this DPA for any reason.

6.2. The Sub-processors used in the provision of the Services other than individual subcontractors engaged by ChilliBean in the ordinary course of business, and their locations and processing activities, are detailed in Annex 1 to this DPA. ChilliBean may remove or appoint suitable and reliable additional and/or alternative Sub-processors at ChilliBean’s own discretion in accordance with this paragraph 6.

6.3. ChilliBean shall be liable for the acts and omissions of Sub-processors to the same extent ChilliBean would be liable if performing the services of each Sub-processor directly under the terms of this DPA, subject to the exclusions and limitations of liability set forth in this Agreement.

6.4. Subject to this paragraph 6 Client acknowledges and agrees to the use of the Sub-processor(s) listed in Annex 1 hereto.

7. DATA SUBJECT REQUESTS

7.1. If a data subject contacts ChilliBean directly with a request to access, modify or erase information held about such data subject, ChilliBean shall promptly: (a) refer the data subject to Client; and (b) advise Client of such request.

7.2. ChilliBean shall promptly respond to any reasonable request from Client to provide assistance in responding to a data subject request, provided that Client shall pay ChilliBean’s reasonable costs incurred on a time and materials basis in providing such a response.

7.3. Client acknowledges that the ability to readily find personal data in the ChilliPharm Platform is dependent upon Client’s compliance with Client’s obligations under paragraphs 4.3

8. AUDIT

8.1. Client shall be entitled to audit ChilliBean’s compliance with this DPA subject to the following conditions: (a) to be conducted at such times as agreed with ChilliBean to ensure minimal disruption to ChilliBean’s business; (b) on reasonable notice; (c) subject to ChilliBean’s obligations of confidentiality owed to third parties; (d) by a suitably qualified independent auditor; (e) the scope, methodology and timing of vulnerability scans or penetrations tests to be pre-agreed by the Parties before being undertaken and shall be subject to a separate written agreement; and (f) not more than once per year except where an additional audit is required in the same twelve month period because there has been an actual Personal Data Breach or reasonable suspicion of a Personal Data Breach.

8.2. ChilliBean shall provide all information reasonably necessary and cooperate fully with such audit.

8.3. Any such audit shall be undertaken at Client’s own cost, and Client shall reimburse ChilliBean for ChilliBean’s reasonable costs incurred on a time and materials basis in facilitating an audit.

8.4. Client agrees to provide a copy of the audit results to ChilliBean. For the avoidance of doubt, all audit results will be considered ChilliBean’s Confidential Information and subject to the provisions of clause 11 of the Agreement.

9. RETURN OF PERSONAL DATA

9.1. On termination or expiry of this Agreement or at any time during the term of the Agreement at Client’s request, ChilliBean shall return to Client all Client Data (including the personal data therein) in ChilliBean’s possession however Client acknowledges that this shall prevent ChilliBean from providing any further Services.

10. GOVERNING LAW AND JURISDICTION

10.1. This DPA shall be governed by the same law, and the Parties submit to the exclusive jurisdiction of the courts, as specified in the Agreement.

Annex 1 Sub-processors

NAME

Amazon Web Services, Inc.

LOCATION

Ireland and Germany

SUB-PROCESSING ACTIVITY

Hosting services with no logical access to Client Data.