APPLICATION SERVICE PROVIDER AGREEMENT

EXHIBIT 10.11

CONFIDENTIAL TREATMENT REQUESTED

This Application Services Provider Agreement (“Agreement”) is entered into this 19th day of September, 2014 (“Effective Date”) by and between DNAnexus, Inc., a Delaware corporation, with its principal place of business at ▇▇▇▇ ▇. ▇▇ ▇▇▇▇▇▇ ▇▇▇▇, ▇▇▇▇▇ ▇▇▇, ▇▇▇▇▇▇▇▇ ▇▇▇▇, ▇▇ ▇▇▇▇▇ (“Vendor”) and Natera, Inc., with its principal place of business at ▇▇▇ ▇▇▇▇▇▇▇▇▇▇ ▇▇▇▇, ▇▇▇▇▇ ▇▇▇, ▇▇▇ ▇▇▇▇▇▇, ▇▇ ▇▇▇▇▇ (“▇▇▇▇▇▇”) for the provision of services in accordance with the following terms and conditions. When used herein the term “Agreement” includes the body of this Agreement and any and all Statements of Work entered into by the Parties (as defined below) and all exhibits attached hereto. In the event of a conflict between the body of this Agreement and any Statement of Work or exhibit, the body of this Agreement will govern. Vendor and ▇▇▇▇▇▇ may be referred to in this Agreement individually as a “Party” and together as the “Parties.” The Parties had previously entered into a Pilot Agreement (the “Pilot Agreement”), which is hereby terminated as of the Effective Date (provided that any provisions identified in Section 7.2 (Effect of Termination of Expiration) of the Pilot Agreement as surviving termination shall continue to govern as between the parties with regard to the subject matter of the Pilot Agreement).

R E C I T A L S

WHEREAS, the Parties have determined to further their business relationship based upon the success of the Pilot Agreement;

WHEREAS, Vendor is in the business of providing a platform as a service (“PaaS”), and such PaaS is routinely maintained and modified by Vendor, typically without version releases or bundled updates; and

WHEREAS, ▇▇▇▇▇▇ desires to access and use Vendor’s PaaS product pursuant to the terms and conditions set forth herein.

NOW, THEREFORE, for good and valuable consideration, the receipt and sufficiency of which is hereby acknowledged, the Parties hereby agree as follows:

A G R E E M E N T

1. Definitions

1.1 “Content” means, without limitation, any and all information, data, analysis, software (including APIs, source code and/or object code, as applicable), algorithms, work flows, data flows, processes and procedures, software results, ideas, plans, sketches, texts, files, links, images, photos, video, sound, inventions (whether or not patentable), notes, works of authorship, articles, feedback, or other materials.

1.2 “Developments” means all Content created by Vendor, its contractors or agents specifically in connection with the performance of this Agreement and having exclusive and unique applicability to the ▇▇▇▇▇▇ Source Code.

1.3 “Documentation” means the designated user manuals, handbooks, or online materials furnished by Vendor that describe the features, functionality or operation of the Services.

1.4 “▇▇▇▇▇▇ Content” means (a) any Content provided by ▇▇▇▇▇▇ or ▇▇▇▇▇▇ Users, or imported or uploaded to, or otherwise used by or on behalf of ▇▇▇▇▇▇ or ▇▇▇▇▇▇ Users in connection with, the Vendor Services, including, without limitation, ▇▇▇▇▇▇ Source Code; (b) any analysis, summary, modification, report or results regarding NGS Data or other data from ▇▇▇▇▇▇ or ▇▇▇▇▇▇ Users; and (c) any Developments. For the avoidance of doubt, ▇▇▇▇▇▇ Content does not include Vendor System and modifications and improvements made thereto.

1.5 “▇▇▇▇▇▇ Source Code” means all proprietary source code of ▇▇▇▇▇▇ which ▇▇▇▇▇▇ provides or grants access to Vendor in connection with the performance of this Agreement.

1.6 “▇▇▇▇▇▇ Users” means individuals, laboratories, institutions or other entities to whom or to which ▇▇▇▇▇▇ delivers NGS Data and/or analysis via the Vendor System. “▇▇▇▇▇▇ Users” includes internal users of the Vendor System at ▇▇▇▇▇▇ and third parties to whom or to which ▇▇▇▇▇▇ delivers NGS Data and/or analysis via the Vendor System. All information relating to ▇▇▇▇▇▇ Users shall be deemed ▇▇▇▇▇▇ Confidential Information.

1.7 “NGS Data” means results regarding next-generation sequencing and array data.

1.8 “Vendor System” means the technology, including the website at ▇▇▇▇▇://▇▇▇▇▇▇▇▇.▇▇▇ (“Site”) and the services and other items provided through the Site under this Agreement, including (1) the DNAnexus genomic information management and analysis services, software, reports and documentation provided via login, (2) the DNAnexus application programming interface (“API”) and software development kit (“SDK”) and (3) the DNAnexus App Library (“Library”) and any software or services that may be provided by DNAnexus or third parties through the Library (“Add-ons”); hardware, software, and networks used by Vendor to deliver the Vendor Service to ▇▇▇▇▇▇ in accordance with this Agreement.

2. Term. The term of this Agreement shall commence on the Effective Date and continue in full force for three (3) years (the “Initial Term”). Upon the expiration of the Initial Term, this Agreement shall automatically renew for successive one (1) year terms (each a “Renewal Term”), unless either Party terminates the Agreement according to Section 24.3 (Termination for Convenience). The Initial Term and any Renewal Terms are referred to herein collectively as the “Term.” Pursuant to Section 15.2 (Fees During Renewal Terms), such notice shall identify any fee increase applicable to the Renewal Term that is about to commence.

3. Vendor; No Subcontracting. Vendor shall perform the obligations described in this Agreement and in the Statement(s) of Work itself and through its direct wholly-owned subsidiaries, provided such subsidiaries are disclosed in writing to ▇▇▇▇▇▇. Subject to Section 25.5 (Assignment), Vendor may not assign, delegate or subcontract this Agreement nor any of its rights, duties or obligations under this Agreement without ▇▇▇▇▇▇’▇ prior express written consent. Notwithstanding the foregoing, Vendor may use subcontractors for code development, quality assurance, and other generic functions that do not require or allow access to ▇▇▇▇▇▇ Confidential Information or its facilities or relate to the direct performance of the Services. Any purported assignment or delegation not permitted by this Agreement nor consented to by ▇▇▇▇▇▇ shall be void at ▇▇▇▇▇▇’▇ option, which voiding ▇▇▇▇▇▇ may enforce by injunctive relief, and shall constitute a material breach of this Agreement. Vendor acknowledges that ▇▇▇▇▇▇ has entered this Agreement in reliance on Vendor’s ability and agreement to personally perform Vendor’s obligations hereunder. Notwithstanding any ▇▇▇▇▇▇ consent to any subcontracting: (1) Vendor shall remain responsible for any and all performance required under this Agreement, including, but not limited to, the obligation to properly supervise, coordinate, and perform all work required hereunder, and no subcontract shall bind or purport to bind ▇▇▇▇▇▇; (2) Vendor shall ensure its subcontractors comply with all relevant terms and conditions of this Agreement; (3) any breach by a Vendor subcontractor of this Agreement shall constitute a breach by Vendor of this Agreement for which Vendor shall remain liable; and (4) any consent to subcontracting shall be subject to ▇▇▇▇▇▇’▇ right under Section 11.4 (Vendor Personnel) to approve or disapprove any Vendor Personnel assigned to provide work hereunder.

4. ▇▇▇▇▇▇. Subject to the limitations, if any, set forth in Exhibit B relating to the scope of the license granted by Vendor to the Services, the rights and obligations of ▇▇▇▇▇▇ may be, in whole or in part, exercised or fulfilled by ▇▇▇▇▇▇ and its respective affiliates, subsidiaries, and contractors.

5. Services. Vendor will provide ▇▇▇▇▇▇ with access to and use of the Vendor System and certain hosted applications and furnish certain professional services, including, but not limited to, Support Services (as defined below), maintenance, customization, implementation, and training services (collectively, the “Services” or “Vendor Services”), all as more particularly described herein. Vendor will provide the Services to ▇▇▇▇▇▇ in accordance with industry standards and in any event in a manner consistent with the highest level of service that it provides to its other customers. The Services to be provided by Vendor are set forth in this Agreement, Exhibit B, such Statements of Work as the Parties may mutually agree upon from time-to-time or as the Parties may otherwise agree from time to time. Subject to the terms and conditions of this Agreement, Vendor grants to ▇▇▇▇▇▇ a non-exclusive, non-transferable (except as provided in Section 25.5), revocable (solely as provided elsewhere in this agreement), limited license to access and use the Services and Documentation (as defined below) in accordance with the Documentation for its business activities, including without limitation the provision of the Services to its customers in the ordinary course of its business, during the Term. ▇▇▇▇▇▇ will be responsible for managing access to the Services by ▇▇▇▇▇▇ Users and for changing settings in accordance with the Documentation, and will designate a named super-User (which ▇▇▇▇▇▇ may change upon prior written notice to Vendor) to be responsible to notify Vendor of any changes in authorized users and ▇▇▇▇▇▇ changes to settings that affect use of the Vendor System by ▇▇▇▇▇▇ Users. ▇▇▇▇▇▇ shall use all reasonable efforts consistent with industry standards to ensure that use of the Services by its customers complies with the terms of this Agreement.

6. Restrictions. ▇▇▇▇▇▇ shall use the Services solely in accordance with this Agreement, applicable laws and regulations, including without limitation HIPAA and export control laws. ▇▇▇▇▇▇ will not, and will not permit any third party to:

6.1 translate, modify, adapt, enhance, decompile, disassemble or reverse engineer the Vendor System or otherwise determine or attempt to determine source code or protocols from the executable code of the Vendor System or create any derivative works based upon the Vendor System;

6.2 extract ideas, algorithms, procedures, workflows or hierarchies from the Vendor System or otherwise use the Vendor System for the purpose of creating another product or service

6.3 rent, lease or otherwise charge third parties for access to ▇▇▇▇▇▇’▇ user accounts or for sharing through the Site, except to the extent ▇▇▇▇▇▇ does so with Vendor’s prior approval (for example, through the Library) provided, that ▇▇▇▇▇▇’▇ charging end users for the delivery of NGS Data and/or analysis via the Vendor System shall not be subject to this restriction;

6.4 introduce any virus, malware or spyware into the Vendor System;

6.5 adversely impact the speed, security or integrity of the Vendor System;

6.6 access or use ▇▇▇▇▇▇ Content without the prior agreement of ▇▇▇▇▇▇ Users to the scope and nature of that access or use;

6.7 circumvent or render ineffective technological and other measures implemented to protect and control the Vendor System and ▇▇▇▇▇▇ Content or

6.8 use any Free and Open Source Software (“▇▇▇▇”) in a way that would cause the non-▇▇▇▇ portions of the Vendor System to be subject to any ▇▇▇▇ licensing terms or obligations. Free and Open Source Software means any software that is subject to terms that, as a condition of use, copying modification or redistribution, require such software or derivative works thereof to be disclosed and/or distributed in source code form, to be licensed for purposes of making derivative works, or to be redistributed free of charge, including without limitation software distributed under the GNU General Public License or GNU Lesser/Library GPL.

7. Access and Security Guidelines. ▇▇▇▇▇▇ will assign each ▇▇▇▇▇▇ User a unique user identification name and password (“UserID”) for access to and use of the Vendor System. ▇▇▇▇▇▇’▇ super-User who will be assigned a unique UserID for purposes of communicating with Vendor regarding the management and administration of the ▇▇▇▇▇▇ Users and the Services. ▇▇▇▇▇▇ agrees (a) not to authorize a third party other than ▇▇▇▇▇▇ User to use its account, usernames or passwords at any time; (b) to instruct ▇▇▇▇▇▇ Users not to share passwords or UserIDs and otherwise maintain the confidentiality of the user ID(s) and password(s) necessary for access to the Vendor System; (c) to notify Vendor promptly of any actual or suspected unauthorized use of its account, usernames or passwords and (d) to provide complete, accurate and up-to-date information, including, for example, email addresses used to provide notices to ▇▇▇▇▇▇ under this Agreement. Vendor reserves the right to terminate any username and password, which Vendor reasonably determines, after consultation with ▇▇▇▇▇▇’▇ super-User, may have been used by an unauthorized third party or by any user or individual other than the ▇▇▇▇▇▇ User to whom such username and password was originally assigned. Vendor may monitor use of the API and ▇▇▇▇▇▇ Software on the Site or in the Vendor System for the purpose of providing the Services, including for quality assurance, improvement of the Services and verification of compliance with this Agreement. ▇▇▇▇▇▇ represents and warrants that it understands the security and architectural implications of installing applications with access to ▇▇▇▇▇▇ Content. Vendor disclaims any responsibility for any use or misuse of ▇▇▇▇▇▇ Content accessed by applications installed by or on behalf of ▇▇▇▇▇▇.

8. Service Levels. Vendor shall provide the Services, not including any Support Services or other professional or consulting services, in accordance with the service levels (“Service Levels”) set forth in Exhibit C (Service Levels) and any applicable Statement of Work.

9. Software. To the extent Vendor delivers any software to ▇▇▇▇▇▇ in connection with this Agreement for installation on ▇▇▇▇▇▇ servers, ▇▇▇▇▇▇ will have a non-exclusive, non-transferable (except as provided in Section 25.5), non-sublicensable, revocable (solely as provided elsewhere in this Agreement), limited license to use the software solely in connection with the Services as contemplated hereunder. ▇▇▇▇▇▇ shall not disassemble, decompile, or reverse engineer the software or remove any proprietary notices thereon. The software will be deemed part of and included in the definition of the Services.

10. Third Party Intellectual Property. “Third Party Intellectual Property” shall mean intellectual property, including software, licensed, made, conceived, or developed by a third party and provided by Vendor through the App Library. All such Third Party Intellectual Property shall be deemed part of and included in the definition of “Services” and subject to all terms and conditions of this Agreement relating to the Services.

10.1 Disclaimer. Notwithstanding any term in this Agreement, Vendor makes no representation, warranty, promise or endorsement regarding Third Party Intellectual Property provided in connection with the Services.

10.2 End-User License Agreement. ▇▇▇▇▇▇ agrees that use of Third Party Intellectual Property, such as a third party Add-on, may be subject to an End-User License Agreement or “▇▇▇▇”, which provides the terms and conditions of use established by the owner of the Third Party Intellectual Property (“Third Party Provider”). ▇▇▇▇▇▇ shall be

presumed to have reviewed applicable terms and policies, including privacy and data gathering practices, and to have made necessary and appropriate investigation before using any Third Party Intellectual Property.

10.3 Relationship of the Parties. ▇▇▇▇▇▇ agrees that any purchase of a Third Party Product by ▇▇▇▇▇▇ is from the Third-Party Provider, with Vendor acting as an agent for the Third Party Provider, and that the Third Party Provider, and not Vendor, is solely responsible for the Third Party Intellectual and any obligations in the ▇▇▇▇. ▇▇▇▇▇▇ also agrees that Vendor is a third-party beneficiary of the ▇▇▇▇ and that, upon ▇▇▇▇▇▇’▇ acceptance of its terms, Vendor will have the right to enforce the ▇▇▇▇ against ▇▇▇▇▇▇.

11. Services and Deliverables. The provisions of this Section shall apply to the extent the Parties enter into a Statement of Work, as defined below, for the provision of professional services. Acceptance testing under Section 11.5 to 11.7 shall not be required or available with respect to modifications of the Site, API or SDK notwithstanding the terms of Section 11, unless otherwise provided in a Statement of Work.

11.1 Statement(s) of Work. Vendor will provide the Services, have the obligations to ▇▇▇▇▇▇, produce and deliver the deliverables (“Deliverables”), achieve the “Milestones,” and retain the responsibilities described in one or more sequentially numbered, written statements of work that specifically reference this Agreement and are attached hereto as part of Exhibit A (each, a “Statement of Work”). The terms “Services”, “Deliverables” and “Milestones” have the meanings set forth in such Statement(s) of Work. For the avoidance of doubt, the term “Services” shall include both the specific services described in a Statement of Work, as well as the general meaning for such term contained in this Agreement. Each Statement of Work will be effective and become valid and enforceable only when signed by ▇▇▇▇▇▇ and Vendor. If a conflict arises between the body of this Agreement and a Statement of Work or other attachment, exhibit, or schedule hereto, except with regard to an express amendment to this Agreement, the body of this Agreement shall control.

11.2 Change Orders. ▇▇▇▇▇▇ may desire to make significant custom modifications to the Services following execution of a Statement of Work. If so, ▇▇▇▇▇▇ will submit a written change order to Vendor describing such changes in appropriate detail (a “Change Order”). If a Change Order does not require Vendor to incur any additional material costs or expenses, then Vendor will make such modification within a commercially reasonable period after Vendor’s receipt of ▇▇▇▇▇▇’▇ Change Order. If a Change Order does require that Vendor incur additional material costs or expenses, then Vendor in good faith will provide ▇▇▇▇▇▇ with a written assessment of such costs and expenses and the time required to perform the modifications required by the Change Order. ▇▇▇▇▇▇ will notify Vendor in writing after receipt of the Change Order response from Vendor as to whether ▇▇▇▇▇▇ wishes Vendor to implement such Change Order based on such response. ▇▇▇▇▇▇ will compensate Vendor for implementation of a Change Order in accordance with the terms and conditions of the relevant Change Order and Vendor’s statement, as provided prior to Vendor’s implementation of the Change Order, if any. Vendor’s implementation of a Change Order shall not delay the performance of Services and/or the delivery of Deliverables not reasonably affected by a Change Order.

11.3 ▇▇▇▇▇▇ Cooperation. ▇▇▇▇▇▇ acknowledges that Vendor’s ability to perform the Services will require ▇▇▇▇▇▇ to perform certain tasks, which shall be mutually agreed upon and set forth in the applicable Statement(s) of Work. ▇▇▇▇▇▇ hereby agrees to perform its obligations in accordance with such requirements in a commercially reasonable manner. Furthermore, the Parties acknowledge that ▇▇▇▇▇▇’▇ failure to perform its obligations may adversely affect Vendor’s ability to meet its performance obligations hereunder and the Parties hereby agree to negotiate in good faith to arrive at an equitable adjustment to the terms of this Agreement to compensate Vendor for such additional effort and costs directly caused by ▇▇▇▇▇▇’▇ delay or failure to perform.

11.4 Vendor Personnel. Vendor agrees that all Vendor Personnel assigned to perform under this Agreement must have experience performing the tasks to which they will be assigned under this Agreement. In the event that, as a result of the actions, inaction, or replacement of Vendor Personnel, additional or accelerated work is required to perform this Agreement, Vendor shall perform all such work at no additional charge to ▇▇▇▇▇▇. Vendor shall promptly fill any Vendor Personnel vacancy with Vendor Personnel having qualifications at least equivalent to those of the Vendor Personnel being replaced. As used herein, “Vendor Personnel” shall mean all of Vendor’s employees, agents, and subcontractors who perform services related to the performance of Vendor’s obligations under this Agreement.

11.5 Acceptance Criteria. The Services, Deliverables and Milestones under a Statement of Work may be subject to acceptance testing by ▇▇▇▇▇▇, in its sole discretion, to verify that they satisfy the acceptance criteria mutually agreed to by the Parties (the “Acceptance Criteria”). Such Acceptance Criteria shall be based, at a minimum, on conformance of the Services and Deliverables to the specifications set forth in Exhibit B, Exhibit C, the relevant Statement(s) of Work, the requirements of this Agreement, and, solely to the extent not inconsistent with the foregoing, the Documentation (the “Specifications”).

11.6 Acceptance Testing. When Vendor notifies ▇▇▇▇▇▇ that a Service, Deliverable or Milestone (if the Statement of Work provides for Milestones) has been completed as provided under a Statement of Work, ▇▇▇▇▇▇ shall test or evaluate the Services, Deliverables and/or Milestones to determine whether they comply in all material respects with the Acceptance Criteria. Upon completion of ▇▇▇▇▇▇’▇ review and testing, ▇▇▇▇▇▇ shall notify Vendor whether it has accepted the applicable Services, Milestones and/or Deliverables (“Accept” or “Acceptance”), or whether it has identified discrepancies with the Acceptance Criteria (“Reject” or “Rejection”). If ▇▇▇▇▇▇ does not perform acceptance testing or provide a written Rejection following acceptance testing notice to Vendor within [*] business days (or such other time as may be agreed upon by the Parties in writing) of ▇▇▇▇▇▇’▇ receipt of such Service, Deliverable or Milestone, ▇▇▇▇▇▇ may not later Reject such item under this Section and any fees associated with Acceptance shall become due. Vendor shall implement the Services under the Statement of Work if either ▇▇▇▇▇▇ has not Rejected the Services, Milestones and/or Deliverables or if ▇▇▇▇▇▇ chooses not to perform acceptance testing within [*] business days of original Vendor notification to ▇▇▇▇▇▇. If ▇▇▇▇▇▇ Rejects the Services, Milestones and/or Deliverables, ▇▇▇▇▇▇ shall provide a written list of items that must be corrected. On receipt of ▇▇▇▇▇▇’▇ notice, Vendor shall promptly commence, at no additional charge to ▇▇▇▇▇▇, all reasonable efforts to complete, as quickly as possible, such necessary corrections, repairs and modifications to the Services, Milestones and/or Deliverables as will permit them to be ready for retesting, but in no event shall such corrective measures exceed [*] days (or such other time as the Parties may agree upon in writing) from receipt of ▇▇▇▇▇▇’▇ notice. The testing and evaluation process shall resume, as set forth above, with ▇▇▇▇▇▇ having an additional [*] business day testing period. If ▇▇▇▇▇▇ Accepts the Services, Milestones and/or Deliverables, it shall issue a written “Acceptance Notice”. The date of such Acceptance Notice shall be deemed the “Acceptance Date.” If ▇▇▇▇▇▇ determines that the Services, Milestones and/or Deliverables, as revised, still do not comply in all material respects with the Acceptance Criteria after one attempt by Vendor at correction, ▇▇▇▇▇▇ may either (a) afford Vendor the opportunity to repeat the correction and modification process as set forth above at no additional cost or charge to ▇▇▇▇▇▇, or (b) depending on the nature and extent of the failure in ▇▇▇▇▇▇’▇ sole judgment, terminate the relevant Statement(s) of Work or this Agreement in accordance with Section 24 (Termination) as a non-curable default with respect to (i) the Statement(s) of Work relating to the Service(s), Milestone(s) and/or Deliverables(s) that is (are) not performing or conforming as required herein, or (ii) this entire Agreement if the failure materially affects the function or desirability of the Services, Milestones and/or Deliverables to ▇▇▇▇▇▇ as a whole. The foregoing procedure shall be repeated until the Service and/or Deliverables pass the applicable Specifications, or ▇▇▇▇▇▇ elects to terminate the Agreement and/or Statement(s) of Work as provided above.

11.7 Failed Acceptance Testing. In the event of a termination under Section 11.6 (Acceptance Testing), Vendor shall pay to ▇▇▇▇▇▇, within [*] business days of written notice of termination, all sums paid to Vendor by ▇▇▇▇▇▇ under this Agreement for the Services, Milestones and/or Deliverables as to which the termination applies. If Vendor fully performs by making complete reimbursement to ▇▇▇▇▇▇ as provided herein, the reimbursement remedy shall be ▇▇▇▇▇▇’▇ sole remedy and shall preclude any other remedy available under this Agreement or at law or in equity for failure of acceptance testing. In the event ▇▇▇▇▇▇ fails to Reject a Service, Milestone or Deliverable or otherwise respond to Vendor within the testing period provided above, ▇▇▇▇▇▇ may not later Reject the Service, Milestone or Deliverable under Section 11.6 (Acceptance Testing) or receive a refund of fees paid as provided in this Section 11.7 (Failed Acceptance Testing) and any fees associated with Acceptance shall become due and payable.

12. Subsequent Versions or New Products. If, during the Term, Vendor makes available any future update, version, or release of the Services, excluding Third Party Intellectual Property, for which an additional charge is required (i.e., ▇▇▇▇▇▇ would not otherwise be entitled to receive the version without charge under this Agreement), Vendor shall waive such charge and provide the update, version, or release to ▇▇▇▇▇▇. During the Term, if functions or modules not included in the version of the Services marketed by Vendor as of the Effective Date, and not otherwise provided to ▇▇▇▇▇▇ under this Agreement, are subsequently made generally available to any of Vendor’s other clients, the Parties shall negotiate in good faith the price of the functions or modules.

13. Documentation. At no additional charge to ▇▇▇▇▇▇, Vendor shall provide ▇▇▇▇▇▇ with all Documentation relating to the Services. If the Documentation for the Services is revised or supplemented at any time, Vendor shall promptly deliver a copy of such revised or supplemental Documentation to ▇▇▇▇▇▇, at no additional cost to ▇▇▇▇▇▇. ▇▇▇▇▇▇ may, at any time, reproduce copies of all Documentation and other materials provided by Vendor, distribute such copies to ▇▇▇▇▇▇ personnel, and incorporate such copies into its own technical manuals, provided that such reproduction, distribution and incorporation relate to ▇▇▇▇▇▇’▇ and its personnel’s use of the Services as permitted in this Agreement, and all copyright and trademark notices, if any, are reproduced thereon. To the maximum extent available, Vendor shall deliver the Documentation in electronic form to ▇▇▇▇▇▇.

* CERTAIN INFORMATION HAS BEEN OMITTED AND FILED SEPARATELY WITH THE SECURITIES AND EXCHANGE COMMISSION. CONFIDENTIAL TREATMENT HAS BEEN REQUESTED WITH RESPECT TO THE OMITTED PORTIONS.

14. Support Services. Vendor shall provide the support and maintenance services described in this Section 14 (Support Services) and the applicable Statement(s) of Work (collectively, the “Support Services”).

14.1 Support Responsibilities. In addition to any warranty obligations of Vendor under this Agreement, Vendor shall:

(a) Correct any failure of the Services, and Deliverables to perform in accordance with the Specifications, including without limitation, defect repair, programming corrections, and remedial programming, and provide such services and repairs required to maintain the Services, and Deliverables so that they operate properly, continuously and in accordance with the Specifications.

(b) Provide email support twenty-four (24) hours a day, seven (7) days a week, three hundred and sixty-five (365) days a year.

(c) Respond to and then continuously work to remedy issues of Service Unavailability, as defined in Section 6.2 of Exhibit C (Service Level Agreement):

(i) within one hour of ▇▇▇▇▇▇’▇ support request made during a support window consisting of the hours of 9:00 am to 5:00 pm Pacific Time on Monday through Friday excluding New Year’s Day, President’s Day, Memorial Day, Independence Day, Labor Day, Columbus Day, Thanksgiving Day and the following day, Christmas Day and the following day, and New Year’s Eve. Vendor shall respond to Service Unavailability support requests made outside the support window and to all other issues within one business day. Section 14.1(c)(i) shall remain in effect until Vendor notifies ▇▇▇▇▇▇ no later than sixty (60) days after the Effective Date of this Agreement that a longer support window is available, at which point Section 14.1(c)(ii) will take effect.

(ii) Upon notice given to ▇▇▇▇▇▇ no later than sixty (60) days after the Effective Date of this Agreement and continuing for the Term of the Agreement, respond to and then continuously work to remedy issues of Service Unavailability, as defined in Section 6.2 of Exhibit C (Service Level Agreement) within one hour of ▇▇▇▇▇▇’▇ support request made twenty-four (24) hours a day, seven (7) days a week, three hundred and sixty-five (365) days a year. Any support request regarding issues of Service Unavailability shall be made to the customer support contact selected by Vendor.

(d) Provide online access to technical support bulletins and other user support information and forums.

(e) Provide phone support during Vendor’s normal business hours.

14.2 Vendor’s Changes and Upgrades. Vendor may from time to time make material enhancements and changes to the Services. In the event of such enhancements or changes, (a) the new version of the Services will include at least the functionality, level or quality of services that ▇▇▇▇▇▇ previously received and shall continue to comply with all of the requirements of this Agreement, (b) ▇▇▇▇▇▇ shall be provided, at least [*] days in advance of any such changes, written notice and a demonstration of such changes, and (c) Vendor will not enhance or change the Services in such manner as ▇▇▇▇▇▇, having objectively considered data, reasonably determines will [*], or otherwise have a [*] on the functionality or operation of, ▇▇▇▇▇▇’▇ products. During the Term, ▇▇▇▇▇▇ shall receive access to all new versions, releases, updates, enhancements of the Services that Vendor makes available to its other licensees without additional charge within [*] days of their general availability.

14.3 Support Not to be Withheld. Support under this Agreement will not be withheld due to any unrelated dispute arising under this Agreement, another agreement between the Parties, or any other unrelated dispute between the Parties.

15. Fees and Expenses.

15.1 Fees for Services. The fees for the Services and/or Deliverables shall be as set forth in Exhibit B and the applicable Statements of Work. The Parties will agree as to fees with respect to any Renewal Term.

15.2 Fees During Renewal Terms. Vendor’s fees hereunder as set forth in Exhibit B and the applicable Statements of Work shall be fixed during the Initial Term. Thereafter, Vendor may increase such fees for a Renewal Term by providing notice to ▇▇▇▇▇▇ at least [*] days prior to the commencement of such Term.

* CERTAIN INFORMATION HAS BEEN OMITTED AND FILED SEPARATELY WITH THE SECURITIES AND EXCHANGE COMMISSION. CONFIDENTIAL TREATMENT HAS BEEN REQUESTED WITH RESPECT TO THE OMITTED PORTIONS.

15.3 Responsibility for Costs. Except for any reimbursable expenses specified in a Statement of Work, or as otherwise approved in writing by ▇▇▇▇▇▇, Vendor shall be responsible for all costs and expenses incidental to the provision of the Services, including but not limited to, all costs for Third Party Intellectual Property and equipment provided by Vendor, and all fees, fines, licenses, bonds or taxes required of or imposed against Vendor including but not limited to corporate income tax, sales and excise taxes or amounts levied thereof, and all other of Vendor’s costs of doing business. Vendor shall supply copies of third parties’ invoices and other reasonable supporting documentation in substantiation of any reimbursable expenses, as ▇▇▇▇▇▇ may request from time to time. No payments will be made for services rendered or expenses incurred by Vendor other than the Services or Deliverables unless such services are approved in advance in writing by ▇▇▇▇▇▇, and Vendor supplies such documentation as ▇▇▇▇▇▇ may request with respect to such costs.

15.4 Travel and Living Expenses. Unless provided for differently in a Statement of Work, in the event that ▇▇▇▇▇▇ requests Vendor to provide Services at a location away from the metropolitan area of Vendor’s regular place of business, ▇▇▇▇▇▇ will reimburse Vendor for reasonable and necessary budgeted travel and living expenses incurred by Vendor that would not have been incurred in any event if such Services had been performed at Vendor’s regular place of business. Receipts or reasonable evidence thereof are required for commercial travel, car rental, parking, and lodging. Vendor shall submit monthly expense reports to ▇▇▇▇▇▇. When Vendor employees visit more than one client on the same trip, the expenses incurred will be apportioned in relation to time spent with each client. Vendor shall obtain ▇▇▇▇▇▇’▇ prior written approval, which shall not be unreasonably withheld, before incurring any travel or living expenses exceeding, in the aggregate, [*]. All air travel shall be economy class on generally scheduled commercial flights. Vendor shall use commercially reasonable efforts to make airline reservations for travel sufficiently in advance of the travel date so as to obtain the lowest airfare.

15.5 Taxes. ▇▇▇▇▇▇ will pay or reimburse Vendor, for any and all sales, use, or similar taxes based on ▇▇▇▇▇▇’▇ receipt of the Services and Deliverables hereunder (but specifically excluding taxes in the nature of ordinary personal property taxes assessed against or payable by Vendor, taxes based upon Vendor’s net income or personnel, Vendor’s corporate franchise taxes and the like). Vendor will pay, and hold ▇▇▇▇▇▇ harmless against, any penalty, interest, or additional tax that may be assessed or levied as a result of the failure or delay of Vendor or Vendor Personnel to file any return or information required by law, rule, or regulation, other than state, city or local sales taxes. Vendor will provide reasonable assistance to ▇▇▇▇▇▇ should ▇▇▇▇▇▇ contest any taxes imposed on it which result from this Agreement. The Parties shall reasonably cooperate to more accurately determine each Party’s tax liability and to minimize such liability to the extent legally permissible.

15.6 Payment Terms. Unless provided otherwise in a Statement of Work, Vendor will invoice ▇▇▇▇▇▇ for the Services and/or Deliverables in monthly installments no later than [*] days following the end of the month in which the Services and/or Deliverables were completed or delivered. The invoice will detail the work performed during such period and the information required in Section 15.8 (Invoices). Except as provided in this Agreement or as may otherwise be provided in a Statement of Work, ▇▇▇▇▇▇ agrees to pay the amounts due Vendor hereunder within [*] days after ▇▇▇▇▇▇ receives Vendor’s invoice, except to the extent such invoices are the subject of a dispute between the Parties. While any invoice is in dispute, Vendor does not waive its right to payment.

15.7 All Fees Stated. Except as provided in this Section 15 (Fees and Expenses) or in the event of an amendment to this Agreement: there are no other fees to be paid by ▇▇▇▇▇▇ in connection with this Agreement for the Services and/or Deliverables. Any work performed by Vendor and not specifically authorized by ▇▇▇▇▇▇ in writing shall be considered gratuitous and Vendor shall have no right or claim whatsoever to any form of compensation.

15.8 Invoices. Each invoice shall fairly and accurately describe in reasonable detail the actual Services performed, the person(s) or entity(ies) who performed such Services, the dates on which such Services were performed, any Deliverables delivered in the prior month, any Milestones met in the prior month, the fees and expenses payable by ▇▇▇▇▇▇ for such Services, Deliverables and Milestones, and any reimbursable expenses. In connection with travel and living expenses, the invoices shall specify the purpose and location of the meeting for which the travel was required, the project involved, and the name of the person who called the meeting. With regard to messenger services, the invoice shall specify the person to whom the package was sent and the project involved. Vendor shall include with its invoices all supporting documentation for any out-of-pocket or third party reimbursable expenses. ▇▇▇▇▇▇ shall not be required to make payment for the out-of-pocket or third party reimbursable expenses in any invoices if such documentation is not furnished by the Vendor as herein provided and if ▇▇▇▇▇▇ provides written notice of the deficiencies in documentation, or if any invoices with respect to the same is rendered more than ninety (90) days after the expenses were incurred, in

* CERTAIN INFORMATION HAS BEEN OMITTED AND FILED SEPARATELY WITH THE SECURITIES AND EXCHANGE COMMISSION. CONFIDENTIAL TREATMENT HAS BEEN REQUESTED WITH RESPECT TO THE OMITTED PORTIONS.

which case Vendor shall be solely and exclusively responsible for payment of same at its own cost and expense. ▇▇▇▇▇▇ may refuse payment with respect to any invoice that fails to comply with the requirements contained in this Section 15.8 (Invoices), though failure of Vendor to comply with this section shall not finally relieve ▇▇▇▇▇▇ of its obligation to pay fees for other Services rendered in compliance with the remaining terms of this Agreement. Nothing contained herein shall be interpreted to mean that ▇▇▇▇▇▇ is required to pay any amount that ▇▇▇▇▇▇ disputes. While any amount is in dispute, Vendor does not waive its right to payment.

15.9 Payment Does Not Imply Acceptance. The making of any payment or payments by ▇▇▇▇▇▇, or the receipt thereof by Vendor, shall in no way affect the responsibility of Vendor to furnish the Services and Deliverables in accordance with this Agreement, and shall not imply acceptance by ▇▇▇▇▇▇ of such items or the waiver of any warranties or requirements of this Agreement.

15.10 Audits and Records. Vendor shall, at its sole cost and expense, maintain complete and accurate books and records regarding its performance of the Services and compliance with this Agreement covering all activities and transactions arising out of or relating to this Agreement and shall keep such records for not less than [*] years after termination. ▇▇▇▇▇▇ and its duly authorized representatives shall have the right, upon [*] days prior notice, during normal business hours for the Term, not more than [*] and for a period of [*] years following the termination hereof for any reason, to examine and copy (without charge to ▇▇▇▇▇▇) such books and records, and all other documents and materials in the possession or under the control of Vendor, with respect to the subject matter and terms of this Agreement that reasonably have a bearing on or pertain to matters, rights, duties or obligations covered by this Agreement. ▇▇▇▇▇▇ and its authorized representative, in a manner agreed to by the Parties, shall have access to Vendor’s facilities, shall be permitted by Vendor to interview current or former employees of Vendor with respect to matters pertinent to Vendor’s performance of this Agreement, shall have access to all necessary records, and shall be furnished, without charge, adequate and appropriate workspace in order to perform the examinations provided for under this subsection. The cost for any such on-site audit shall be borne by ▇▇▇▇▇▇. The exercise by ▇▇▇▇▇▇ of any right to audit under this or any other Section of this Agreement at any time or times or the acceptance by ▇▇▇▇▇▇ of any statement or the payment thereof by ▇▇▇▇▇▇ shall be without prejudice to any of ▇▇▇▇▇▇’▇ rights or remedies and shall not ▇▇▇ ▇▇▇▇▇▇ from thereafter disputing the accuracy of any payment or statement.

15.11 Security Audits. Vendor shall have an accredited third party vendor, reasonably acceptable to ▇▇▇▇▇▇, perform audits of Vendor’s security system in accordance with industry standards, including, without limitation, a yearly penetration test. During the Term and upon request, ▇▇▇▇▇▇ shall be provided the results of Vendor’s yearly penetration test. ▇▇▇▇▇▇ shall not cause any penetration test of the Vendor System to occur without Vendor’s prior written consent.

15.12 Compliance Audits. During the Term, to the extent Vendor engages a third party auditor, reasonably acceptable to ▇▇▇▇▇▇, to perform an SSAE 16 of Vendor’s operations, information security program, and/or disaster recovery/business continuity plan, Vendor shall promptly furnish a copy of the audit report to ▇▇▇▇▇▇ upon request. Any such audit reports shall be deemed Vendor Confidential Information.

16. Representations and Warranties.

16.1 Vendor’s Warranties. Vendor represents and warrants that: (i) it has the full power, capacity and authority to enter into and perform this Agreement and to make the grant of rights contained herein, it is the lawful owner or licensee of the Vendor System, and its performance of this Agreement does not violate or conflict with any agreement to which Vendor is a party; (ii) the Services will be performed and the Deliverables developed in a professional manner consistent with the level of care, skill, practice and judgment exercised by other professionals in performing Services of a similar nature under similar circumstances by personnel with requisite skills, qualifications and licenses needed to carry out such work and in accordance at the highest level of service that Vendor delivers to its other customers; (iii) all Services and Deliverables shall materially conform to the Specifications and requirements set forth in this Agreement at all times during the Term; (iv) to Vendor’s knowledge as of the Effective Date, the Services and the Deliverables shall not contain defamatory or indecent matter; (v) there is no pending or threatened litigation that would have a material adverse impact on its performance under the Agreement; (vi) it shall not transmit or make available any ▇▇▇▇▇▇ Confidential Information, including Personal Data, to any entity or individual outside the continental United States; (vii) the Documentation shall be complete and accurate so as to enable a reasonably skilled ▇▇▇▇▇▇ user to effectively use all of its features and functions without assistance from Vendor and, on each date on which Vendor delivers it to ▇▇▇▇▇▇, the Documentation is Vendor’s most current version thereof; provided that, without the prior written approval of ▇▇▇▇▇▇, in no event shall any Documentation reflect a material diminution in the form,

* CERTAIN INFORMATION HAS BEEN OMITTED AND FILED SEPARATELY WITH THE SECURITIES AND EXCHANGE COMMISSION. CONFIDENTIAL TREATMENT HAS BEEN REQUESTED WITH RESPECT TO THE OMITTED PORTIONS.

features or functionality of the Services from that originally licensed under this Agreement, and, accordingly, Vendor shall not change the form, features or functionality in any material adverse manner from that originally licensed under this Agreement; (viii) it shall comply with all applicable laws and regulations, including those relating to privacy and information security, in its performance of this Agreement and provision of the Services; (ix) there is no existing pattern or repetition of material customer complaints regarding the Vendor System, Services or Deliverables, including functionality or performance issues, and that Vendor’s engineers have not currently identified any repeating adverse impact on the Vendor System, Services or Deliverables, including functionality or performance, for which the root cause is believed to be a flaw or defect in the Vendor System, Services or Deliverables and Vendor shall promptly notify ▇▇▇▇▇▇ upon becoming aware of the same; (x) the Vendor System and Services does not contain any open source code or other code which may subject ▇▇▇▇▇▇’▇ source code to the terms of open source licenses that would require the distribution of ▇▇▇▇▇▇ source code under such open source licenses; and (xi) under no circumstances may ▇▇▇▇▇▇ Source Code be made available to any entity or person [*] without ▇▇▇▇▇▇’▇ prior written consent.

16.2 ▇▇▇▇▇▇’▇ Warranty. ▇▇▇▇▇▇ represents and warrants that, at all times during the term of this Agreement, ▇▇▇▇▇▇ shall have the full power to enter into and perform this Agreement and to make the grant of rights contained herein, and ▇▇▇▇▇▇’▇ performance of this Agreement shall not violate or conflict with any agreement to which ▇▇▇▇▇▇ is a party. ▇▇▇▇▇▇ warrants that it has the right to provide Vendor with ▇▇▇▇▇▇ Content and to permit Vendor to use ▇▇▇▇▇▇ Content in the manner described in this Agreement.

16.3 Third Party Services. Vendor may use third party service providers such as Amazon Web Services (“AWS”), and Vendor reserves the right, subject to Section 3 of Exhibit C, to substitute an equivalent alternate service provider [*]. Vendor makes no representations or warranties regarding AWS, its durability, or availability.

16.4 Disclaimer of Other Warranties. EXCEPT AS EXPRESSLY STATED IN THIS AGREEMENT, NEITHER PARTY MAKES ANY OTHER WARRANTIES, EXPRESS OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF FITNESS FOR A PARTICULAR PURPOSE, MERCHANTABILITY, QUIET ENJOYMENT, QUALITY OF INFORMATION, OR TITLE/NON-INFRINGEMENT, AND ANY WARRANTY THAT THE VENDOR SYSTEM OR SERVICES WILL BE ERROR-FREE, RELIABLE, COMPLETE OR SECURE; AND ALL SUCH WARRANTIES ARE HEREBY SPECIFICALLY DISCLAIMED.

17. Intellectual Property.

17.1 Vendor Intellectual Property. ▇▇▇▇▇▇ acknowledges that Vendor holds and shall retain all right, title and interest in and to the Vendor System, and all modifications and improvements thereof (specifically excluding in all cases any ▇▇▇▇▇▇ Content), and that the Vendor System is protected by intellectual property rights owned by or licensed to Vendor. Vendor grants to ▇▇▇▇▇▇ a limited, non-transferable (except as provided in Section 25.5),non-exclusive, and revocable (solely as provided elsewhere in this agreement) license during the Term to use the Vendor System solely as necessary for ▇▇▇▇▇▇ and ▇▇▇▇▇▇ Users to access and use the Services in accordance with this Agreement. Other than as expressly set forth in this Agreement, no license or other rights in the Vendor System are granted to ▇▇▇▇▇▇, and all such rights are hereby expressly reserved by Vendor.

17.2 ▇▇▇▇▇▇ Content and Developments. Notwithstanding any contrary provision, ▇▇▇▇▇▇ retains all right, title and interest in and to the ▇▇▇▇▇▇ Content, and the parties acknowledge and agree that the ▇▇▇▇▇▇ Content constitutes ▇▇▇▇▇▇ Confidential Information. Vendor may only use ▇▇▇▇▇▇ Content to provide the Services to ▇▇▇▇▇▇ in accordance with this Agreement and shall not disclose ▇▇▇▇▇▇ Content to any third party (including any assignee or successor unless provided for otherwise under the Agreement) without ▇▇▇▇▇▇’▇ prior written consent in each case. ▇▇▇▇▇▇ will be solely responsible for providing ▇▇▇▇▇▇ Content required for the testing and evaluation of the Services pursuant to any Statement of Work. ▇▇▇▇▇▇ grants to Vendor a limited, non-transferable, non-exclusive, revocable, fully-paid and royalty-free license during the Term to store and use such ▇▇▇▇▇▇ Content solely as necessary for Vendor to provide the Services to ▇▇▇▇▇▇ in accordance with this Agreement. Except for the foregoing limited license, no license or other rights in the ▇▇▇▇▇▇ Content are granted to Vendor, and all such rights are hereby expressly reserved by ▇▇▇▇▇▇. Vendor hereby assigns, transfers and conveys to ▇▇▇▇▇▇, exclusively and perpetually, all rights, titles, and interests throughout the world it may have or acquire in the Developments, including without limitation all intellectual property or other proprietary rights (including without limitation copyrights, patents rights, trade secret right, rights of reproduction, trademark rights, rights of publicity, and the right to secure registrations, renewals, reissues, and extensions thereof) (collectively “Intellectual Property Rights”) therein. No rights of any kind in and to the Developments or Intellectual Property Rights therein are reserved to or by Vendor or will revert to Vendor. Vendor agrees to execute such further

* CERTAIN INFORMATION HAS BEEN OMITTED AND FILED SEPARATELY WITH THE SECURITIES AND EXCHANGE COMMISSION. CONFIDENTIAL TREATMENT HAS BEEN REQUESTED WITH RESPECT TO THE OMITTED PORTIONS.

documents and to do such further acts, at ▇▇▇▇▇▇’▇ expense, as may be necessary to perfect, register or enforce ▇▇▇▇▇▇’▇ ownership of such rights, in whole or in part.

17.3 ▇▇▇▇▇▇ Source Code Encryption. All ▇▇▇▇▇▇ Source Code will be encrypted, at ▇▇▇▇▇▇’▇ discretion and control, using a method selected by ▇▇▇▇▇▇, at ▇▇▇▇▇▇’▇ sole discretion, subject to AWS’ policies and available technology. Vendor will not access itself or provide access to any third party (including any permitted subcontractor) to ▇▇▇▇▇▇ Source Code, without ▇▇▇▇▇▇’▇ prior written approval. Under no circumstances will Vendor store any unencrypted versions of all or any part of the ▇▇▇▇▇▇ Source Code without ▇▇▇▇▇▇’▇ prior written approval.

17.4 Use of ▇▇▇▇▇▇ Property. ▇▇▇▇▇▇ may, but is not required to (unless otherwise set forth in a Statement of Work), provide certain hardware, software, data, databases, office space, security access or other materials, intellectual property, technologies or services, other than ▇▇▇▇▇▇ Content, to Vendor in connection with this Agreement (“▇▇▇▇▇▇ Property”). ▇▇▇▇▇▇ hereby grants Vendor a non-exclusive, non-transferable, fully paid and royalty free license to use the ▇▇▇▇▇▇ Property solely for ▇▇▇▇▇▇’▇ benefit in connection with Vendor’s performance of the Services. ▇▇▇▇▇▇ may terminate the foregoing license at any time, without cause, on written notice to Vendor. Unless specifically authorized in the Statement of Work, Vendor shall use the ▇▇▇▇▇▇ Property only in the form provided by ▇▇▇▇▇▇, without modification. In addition, Vendor will maintain and use ▇▇▇▇▇▇ Property in accordance with any written instructions and/or specifications provided by ▇▇▇▇▇▇. ▇▇▇▇▇▇ Property shall be considered Confidential Information of ▇▇▇▇▇▇. Except for the limited license provided in this Section 17.4 (Use of ▇▇▇▇▇▇ Property), nothing contained in this Agreement shall be construed as granting Vendor any right, title, or interest in or to any of the ▇▇▇▇▇▇ Property.

18. Confidentiality.

18.1 Confidential Information. Except as provided in Section 18.2 (Exclusions), each Party agrees that all information supplied by one Party and its affiliates and agents (collectively, the “Disclosing Party”) to the other (“Receiving Party”) including, without limitation, (a) source code, prices, trade secrets, databases, designs and techniques, engine protocols, models, displays and manuals, and the selection, coordination, and arrangement of the contents of such materials; and (b) any unpublished information concerning research activities and plans, customers, marketing or sales plans, sales forecasts or results of marketing efforts, pricing or pricing strategies, costs, operational techniques, strategic plans, information of or relating to customers, business partners, and personnel, Personal Data (as defined below), and unpublished financial information, including information concerning revenues, profits and profit margins will be deemed confidential and proprietary to the Disclosing Party, regardless of whether such information was disclosed intentionally or unintentionally or marked as “confidential” or “proprietary” (“Confidential Information”), provided, however, that Developments shall be Confidential Information of ▇▇▇▇▇▇.

18.2 Exclusions. Confidential Information will not include any information or material, or any element thereof, whether or not such information or material is Confidential Information for the purposes of this Agreement, to the extent any such information or material, or any element thereof: (a) has previously become or is generally known, unless it has become generally known through a breach of this Agreement or a similar confidentiality or non-disclosure agreement, obligation or duty; (b) was already rightfully known to the Receiving Party prior to being disclosed by or obtained from the Disclosing Party only if evidenced by written records kept in the ordinary course of business or by proof of actual use by the Receiving Party; (c) has been or is hereafter rightfully received by the Receiving Party from a third person (other than the Disclosing Party) without restriction or disclosure and without breach of a duty of confidentiality to the Disclosing Party; or (d) has been independently developed by the Receiving Party without access to Confidential Information of the Disclosing Party. It will be presumed that any Confidential Information in a Receiving Party’s possession is not within exceptions (b), (c) or (d) above, and the burden will be upon the Receiving Party to prove otherwise by records and documentation.

18.3 Treatment of Confidential Information. Each Party recognizes the importance of the other’s Confidential Information. In particular, each Party recognizes and agrees that the Confidential Information of the other is critical to their respective businesses and that neither Party would enter into this Agreement without assurance that such information and the value thereof will be protected as provided in this Section 18 (Confidentiality) and elsewhere in this Agreement. Accordingly, each Party agrees as follows: (a) the Receiving Party will hold any and all Confidential Information it obtains in strictest confidence and will use and permit use of Confidential Information solely for the purposes of this Agreement. Without limiting the foregoing, the Receiving Party shall use at least the same degree of care to avoid disclosure or use of this Confidential Information as the Receiving Party employs with respect to its own Confidential Information of a like importance, which shall not be less than the standard of care imposed by applicable laws and regulations relating to the protection of such information and, in the absence of any legally imposed standard of care, the standard shall be that of a reasonable person under the circumstances; (b) the Receiving Party may disclose or provide access to its responsible employees who have a need to know and may make copies of Confidential Information only to the extent reasonably necessary to carry out its obligations hereunder; and (c) the Receiving Party

currently has and, for so long as it possesses Confidential Information of the Disclosing Party, will maintain in effect and enforce rules and policies to protect against access to or use or disclosure of Confidential Information other than in accordance with this Agreement, including without limitation written instruction to and agreements with employees and agents who are bound by an obligation of confidentiality no less restrictive than set forth in this Agreement to ensure that such employees and agents protect the confidentiality of Confidential Information. The Receiving Party will require its employees and agents not to disclose Confidential Information to third parties, including without limitation customers, subcontractors or consultants, without the Disclosing Party’s prior written consent; and will notify the Disclosing Party immediately of any unauthorized disclosure or use, and will cooperate with the Disclosing Party to protect all proprietary rights in and ownership of its Confidential Information.

18.4 Personal Data. In connection with this Agreement and performance of the Services, Vendor may be provided or obtain, from ▇▇▇▇▇▇ or otherwise, Personal Data, as defined below, pertaining to ▇▇▇▇▇▇’▇ current and prospective personnel, directors and officers, agents, subcontractors, investors, and customers and may need to Process such Personal Data and/or transfer it, all subject to the restrictions set forth in this Agreement and otherwise in compliance with all applicable foreign and domestic laws and regulations for the sole purpose of performing the Services. For purposes of this Agreement, “Personal Data” shall mean any information relating to an identified or identifiable individual created, received, maintained, or transmitted by Vendor in the course of the Services. For the avoidance of doubt, Personal Data shall include, but not be limited to, all “nonpublic personal information,” as defined under the ▇▇▇▇▇-▇▇▇▇▇-▇▇▇▇▇▇ Act (15 United States Code (“U.S.C.”) §6801 et seq.), “protected health information” as defined under the Health and Insurance Portability and Accountability Act of 1996 (42 U.S.C. §1320d), and “Personal Data” as that term is defined in EU Data Protection Directive (Directive 95/46/EEC) on the protection of individuals with regard to processing of personal data and the free movement of such data. “Process” or “Processing” shall mean any operation or set of operations performed upon the Personal Data, whether or not by automatic means, including collection, recording, organization, use, transfer, disclosure, storage, manipulation, combination and deletion of Personal Data.

18.5 Treatment of Personal Data. Without limiting any other warranty or obligation specified in this Agreement, and in particular the confidentiality provisions of this Section 18 (Confidentiality), during the term of this Agreement and thereafter in perpetuity, Vendor will not gather, store, log, archive, use or otherwise retain any Personal Data in any manner and will not disclose, distribute, sell, share, rent or otherwise transfer any Personal Data to any third party, except as expressly required to perform its obligations in this Agreement or as Vendor may be expressly directed in advance in writing by ▇▇▇▇▇▇. Vendor represents and warrants that Vendor will use Personal Data only in compliance with (a) this Agreement (including the Business Associate Agreement), (b) ▇▇▇▇▇▇’▇ then current privacy policy, if any, and only if disclosed to Vendor and (c) all applicable local, state, and federal laws and regulations (including, but not limited to, the ▇▇▇▇▇-▇▇▇▇▇-▇▇▇▇▇▇ Act, Fair and Accurate Credit Transaction Act, and all other current and future laws and regulations relating to spamming, privacy, and consumer protection); (a), (b), and (c), collectively, the “Personal Data Rules.” In addition, but without limitation, all ▇▇▇▇▇▇ Content will be subject to the Vendor Privacy Policy, as updated by Vendor from time to time and made available at ▇▇▇▇▇://▇▇▇▇▇▇▇▇.▇▇▇/▇▇▇▇▇▇▇ (the “Vendor Privacy Policy”); provided that, if there is a conflict between the Vendor Privacy Policy and the Personal Data Rules, the Personal Data Rules shall control. Vendor agrees to provide ▇▇▇▇▇▇ with written notice of any substantive updates to the Vendor Privacy Policy prior to posting such updates to the above URL.

18.6 Retention of Personal Data. Vendor will not retain any Personal Data for any period longer than necessary for Vendor to fulfill its obligations under this Agreement. As soon as Vendor no longer needs to retain such Personal Data in order to perform its duties under this Agreement, Vendor will promptly return or destroy or erase all originals and copies of such Personal Data.

18.7 Compelled Disclosures. To the extent required by applicable law or by lawful order or requirement of a court or governmental authority having competent jurisdiction over the Receiving Party, the Receiving Party may disclose Confidential Information in accordance with such law or order or requirement, subject to the following conditions: as soon as possible after becoming aware of such law, order or requirement and prior to disclosing Confidential Information pursuant thereto, the Receiving Party will so notify the Disclosing Party in writing and, if possible, the Receiving Party will provide the Disclosing Party notice not less than five (5) business days prior to the required disclosure. The Receiving Party will use reasonable efforts not to release Confidential Information pending the outcome of any measures taken by the Disclosing Party to contest, otherwise oppose or seek to limit such disclosure by the Receiving Party and any subsequent disclosure or use of Confidential Information that may result from such disclosure. The Receiving Party will cooperate with and provide assistance to the Disclosing Party regarding such measures. Notwithstanding any such compelled disclosure by the Receiving Party, such compelled disclosure will not otherwise affect the Receiving Party’s obligations hereunder with respect to Confidential Information so disclosed.

18.8 Return of Confidential Information. On ▇▇▇▇▇▇’▇ written request or upon expiration or termination of this Agreement for any reason, the Vendor will promptly: (a) return or destroy, at ▇▇▇▇▇▇’▇ option, all originals and copies of all documents and materials it has received containing ▇▇▇▇▇▇’▇ Confidential Information; and (b) deliver or destroy, at ▇▇▇▇▇▇’▇ option, all originals and copies of all summaries, records, descriptions, modifications, negatives, drawings, adoptions and other documents or materials, whether in writing or in machine-readable form, prepared by Vendor, prepared under its direction, or at its request from the documents and materials referred to in subparagraph (a), and provide a notarized written statement to ▇▇▇▇▇▇ certifying that all documents and materials referred to in subparagraphs (a) and (b) have been delivered to ▇▇▇▇▇▇ or destroyed, as requested by ▇▇▇▇▇▇. On termination or expiration of this Agreement, ▇▇▇▇▇▇ shall return or destroy all Vendor Confidential Information (excluding items subject to any continuing licenses to ▇▇▇▇▇▇ hereunder or that are required for use of the Deliverables), at Vendor’s option.

18.9 Non-Exclusive Equitable Remedy. Each Party acknowledges and agrees that due to the unique nature of Confidential Information there can be no adequate remedy at law for any breach of its obligations hereunder, that any such breach or threatened breach may allow a Party or third parties to unfairly compete with the other Party resulting in irreparable harm to such Party, and therefore, that upon any such breach or any threat thereof, each Party will be entitled to appropriate equitable remedies, and may seek injunctive relief from a court of competent jurisdiction without the necessity of proving actual loss, in addition to whatever remedies either of them might have at law or equity. Any breach of this Section 18 (Confidentiality) will constitute a material breach of this Agreement and be grounds for immediate termination of this Agreement in the exclusive discretion of the non-breaching Party.

18.10 Business Associate Agreement. In addition to and cumulative of the obligations set forth in this Section and elsewhere in this Agreement, the provisions of the Business Associate Agreement, attached as Exhibit D, shall govern Vendor’s responsibilities with regard to Protected Health Information. In the event of a conflict between the body of this Agreement and Exhibit D, Exhibit D shall govern with regard to Protected Health Information.

19. Security.

19.1 In General. Vendor will maintain and enforce safety and physical security procedures with respect to its access, use, and possession of ▇▇▇▇▇▇’▇ Confidential Information, including Personal Data, (a) that are compliant with the requirements of Exhibit E (Information Security Requirements) and, to the extent not inconsistent, at least equal to industry standards for such types of locations, and (b) which provide reasonably appropriate technical and organizational safeguards against accidental or unlawful destruction, loss, alteration or unauthorized disclosure or access of such information. Without limiting the generality of the foregoing, Vendor will take all reasonable measures, and in no case less than industry standard efforts, to secure and defend its location and equipment against “hackers” and others who may seek, without authorization, to modify or access Vendor systems or the information found therein. Vendor will periodically test its systems for potential areas where security could be breached. Vendor will as soon as possible report to ▇▇▇▇▇▇ any breaches of security or unauthorized access to ▇▇▇▇▇▇’▇ Confidential Information, including Personal Data, that Vendor detects or becomes aware of. Vendor will use diligent efforts to remedy such breach of security or unauthorized access in a timely manner and deliver to Natera a root cause assessment and future incident mitigation plan with regard to any breach of security or unauthorized access affecting the Confidential Information, including Personal Data. Vendor shall provide ▇▇▇▇▇▇ all written details regarding Vendor’s internal investigation regarding any security breach. Upon ▇▇▇▇▇▇’▇ request, Vendor will provide a second more in-depth investigation and results of findings. Vendor agrees not to notify any regulatory authority nor any customer or consumer, on behalf of ▇▇▇▇▇▇ unless ▇▇▇▇▇▇ specifically requests in writing that Vendor do so or Vendor is required to do so by law. Vendor and ▇▇▇▇▇▇ will work together to formulate a plan to rectify all security breaches.

19.2 Use of Personal Portable Devices. Without ▇▇▇▇▇▇’▇ prior written authorization, under no circumstances will any Vendor Personnel connect to any ▇▇▇▇▇▇ Content or access, handle, or use any ▇▇▇▇▇▇ Confidential Information and/or data, for purposes of downloading, extracting, storing or transmitting the information and/or data through personally owned, rented, or borrowed equipment, including but not limited to, laptops, personal digital assistants, instant messaging devices, Universal Serial Bus (“USB”) devices and cell phones.

19.3 Security Breach. Vendor shall notify ▇▇▇▇▇▇ of any security, or suspected security breach of any ▇▇▇▇▇▇ Confidential Information or data covered under applicable federal regulations set forth in 12 CFR Part 30, or under California Civil Code 1798.82, or any other breach of Confidential Information as soon as possible following discovery, if the information was, or is reasonably believed to have been acquired by an unauthorized person. Notification must be given in the most expedient time possible and without unreasonable delay. Written confirmation must be sent within forty-eight (48) hours of discovery or notification of the breach or suspected breach.

19.4 Additional Procedures in the Event of Security Breach of Personal Data. Upon ▇▇▇▇▇▇’▇ determination that a misuse or security breach of Personal Data has occurred or is reasonably possible Vendor shall fully cooperate with ▇▇▇▇▇▇ in rectifying any misuse, including notifying all affected ▇▇▇▇▇▇ customers. ▇▇▇▇▇▇ shall determine, in its

sole discretion, the content and means of delivery of the customer notice. Vendor will bear all costs and expenses incurred as a result of security breach caused directly or indirectly by Vendor including but not limited to, the administrative cost of opening and closing accounts, printing new checks, embossing new cards, notice, print and mailing costs, and the costs to obtain credit monitoring services and identity theft insurance for ▇▇▇▇▇▇ customers whose Personal Data has or may have been compromised.

20. Disaster Recovery/Business Continuity. Vendor shall maintain a Business Continuity and Disaster Recovery Plan for the Services (the “Plan”), and implement such plan in the event of any unplanned interruption of the Services. Within 60 days of the Effective Date, Vendor shall provide ▇▇▇▇▇▇ with a copy of Vendor’s current Plan, revision history, and any reports or summaries relating to past testing of the Plan. The Plan shall be considered Vendor Confidential Information. Vendor shall actively test, review, and update the Plan on at least an annual basis using American Institute of Certified Public Accountants standards and other reasonable industry practices as guidance. Vendor shall promptly provide ▇▇▇▇▇▇ with copies of all such updates to the Plan. All updates shall be subject to the requirements of this Section 20 (Disaster Recovery/Business Continuity). In any event, any future updates or revisions to the Plan shall be no less protective than the plan in effect as of the Effective Date. Vendor shall notify ▇▇▇▇▇▇ of the completion of any audit (e.g., ISO 9000) of the Plan and promptly provide ▇▇▇▇▇▇ with a copy of the audit report and reasonable evidence that any identified deficiencies have been corrected. Vendor shall also promptly provide ▇▇▇▇▇▇ with copies of all reports and/or summaries resulting from any testing of the Plan. If Vendor fails to reinstate the Services within the periods of time set forth in the Plan, ▇▇▇▇▇▇ may in addition to any other remedies available hereunder, in its sole discretion, immediately terminate this Agreement as a non-curable default under Section 24.2 (Material Breach). Vendor shall maintain disaster avoidance procedures designed to safeguard ▇▇▇▇▇▇’▇ data and the data processing capability, and availability of the Services, throughout the Term. Additional disaster recovery/business continuity requirements may be set forth in the individual Statement(s) of Work. Vendor shall as soon as possible notify ▇▇▇▇▇▇ of any disaster or other event in which the Plan is activated. Without limiting Vendor’s obligations under this Agreement, whenever a disaster causes Vendor to allocate limited resources between or among Vendor’s customers, Vendor shall endeavor to provide ▇▇▇▇▇▇ at least the same treatment as comparable Vendor customers with respect to such limited resources. The provisions of Section 25.7 (Force Majeure) shall not limit Vendor’s obligations under this Section 20 (Disaster Recovery/Business Continuity).

21. Indemnification.

21.1 Vendor’s Indemnification. At Vendor’s expense as provided herein, Vendor agrees to defend, indemnify, and hold harmless ▇▇▇▇▇▇ and its directors, officers, agents, employees, members, subsidiaries and successors in interest from and against any claim, action, proceeding, liability, loss, damage, cost, or expense, including, without limitation, attorneys’ fees, experts’ fees and court costs, arising out of any claim by a third party (a) related to (i) Vendor’s breach of this Agreement (including a breach of the BAA); (ii) any injury to any person or persons or damage to tangible or intangible property caused by use of the Vendor System, but only to the extent that [*]; and/or (b) that ▇▇▇▇▇▇’▇ authorized use of the Services and/or Deliverables (collectively, the “Indemnified Items”) infringe that third party’s patent, copyright, trade secret or other intellectual property rights (collectively, “Vendor Indemnified Claim(s)”), including the payment of all amounts that a court or arbitrator awards or that Vendor agrees to in settlement of any such Vendor Indemnified Claim(s) as well as any and all reasonable expenses or charges as they are incurred by ▇▇▇▇▇▇ or any other party indemnified under this Section 21 (Indemnification) in cooperating in the defense of any such Vendor Indemnified Claim(s). ▇▇▇▇▇▇ shall: (A) give Vendor prompt written notice of such Vendor Indemnified Claim; and (B) once Vendor has unconditionally accepted the tender of ▇▇▇▇▇▇’▇ defense, allow Vendor to control, and fully cooperate with Vendor (at Vendor’s sole expense) in, the defense and all related negotiations. Vendor shall not enter into any stipulated judgment or settlement that purports to bind ▇▇▇▇▇▇ (other than with respect to monetary damages which are to be paid by Vendor pursuant to this Section) without ▇▇▇▇▇▇’▇ express written authorization, which shall not be unreasonably withheld or delayed. Notwithstanding the foregoing, Vendor shall have no indemnity obligation for Vendor Indemnified Claims arising from use of the Indemnified Items in excess of the rights granted hereunder.

21.2 Infringement Claim Additional Remedy. If the Indemnified Items, or any portion of them, become or are likely to become the subject of an Vendor Indemnified Claim under Section 21.1(b) (“Infringement Claim”), then, in addition to defending the Vendor Indemnified Claim and paying any damages and attorneys’ fees as required above, Vendor shall, at its option and in its sole discretion, either [*]. Any costs associated with implementing the above alternatives will be borne by Vendor. If Vendor fails to provide one of the foregoing remedies within [*] days of notice of the Infringement Claim, ▇▇▇▇▇▇ shall have the right, at its sole option, to elect to terminate this Agreement with

* CERTAIN INFORMATION HAS BEEN OMITTED AND FILED SEPARATELY WITH THE SECURITIES AND EXCHANGE COMMISSION. CONFIDENTIAL TREATMENT HAS BEEN REQUESTED WITH RESPECT TO THE OMITTED PORTIONS.

regard to the infringing Indemnified Items and have Vendor refund to ▇▇▇▇▇▇ all one-time fees prepaid by ▇▇▇▇▇▇ for the infringing Indemnified Items (which sums shall be refunded by Vendor within [*] business days of termination).

21.3 ▇▇▇▇▇▇’▇ Indemnification. At ▇▇▇▇▇▇’▇ expense as provided herein, ▇▇▇▇▇▇ agrees to defend, indemnify, and hold harmless Vendor and its directors, officers, agents, employees, members, subsidiaries and successors in interest from and against any claim, action, proceeding, liability, loss, damage, cost, or expense, including, without limitation, attorneys’ fees, experts’ fees and court costs, arising out of any claim by a third party (a) related to (i) ▇▇▇▇▇▇’▇ breach of this Agreement and/or (ii) ▇▇▇▇▇▇’▇ violation of the law, including any law relating to Personal Data; (iii) any injury to any person or persons or damage to tangible or intangible property caused by use of the Vendor System, but only to the extent that such injury or damage is [*]; and/or (b) based on Vendor’s authorized use of the ▇▇▇▇▇▇ Content or the ▇▇▇▇▇▇ Property (collectively, “▇▇▇▇▇▇ Indemnified Claims”), including the payment of all amounts that a court or arbitrator awards or that ▇▇▇▇▇▇ agrees to in settlement of any such ▇▇▇▇▇▇ Indemnified Claims as well as any and all reasonable expenses or charges as they are incurred by Vendor or any other party indemnified under this Section 21 (Indemnification) in cooperating in the defense of any such ▇▇▇▇▇▇ Indemnified Claims. Vendor shall: (A) give ▇▇▇▇▇▇ prompt written notice of such ▇▇▇▇▇▇ Indemnified Claim; and (B) once ▇▇▇▇▇▇ has unconditionally accepted the tender of Vendor’s defense, allow ▇▇▇▇▇▇ to control, and fully cooperate with ▇▇▇▇▇▇ (at ▇▇▇▇▇▇’▇ sole expense) in, the defense and all related negotiations. ▇▇▇▇▇▇ shall not enter into any stipulated judgment or settlement that purports to bind Vendor (other than with respect to monetary damages which are to be paid by ▇▇▇▇▇▇ pursuant to this Section) without Vendor’s express written authorization, which shall not be unreasonably withheld or delayed. Notwithstanding the foregoing, ▇▇▇▇▇▇ shall have no indemnity obligation for ▇▇▇▇▇▇ Indemnified Claims arising from use of the ▇▇▇▇▇▇ Content or the ▇▇▇▇▇▇ Property in excess of the rights granted hereunder.

22. Disclaimer of Consequential Damages; Limitation of Liability. EXCEPT FOR THE OBLIGATIONS UNDER SECTIONS 17 (INTELLECTUAL PROPERTY), 18 (CONFIDENTIALITY), 21 (INDEMNIFICATION) AND 25.3 (EMPLOYMENT TAXES AND BENEFITS), AND EITHER PARTY’S INFRINGEMENT OF THE OTHER PARTY’S INTELLECTUAL PROPERTY RIGHTS, NEITHER PARTY SHALL BE LIABLE TO THE OTHER PARTY FOR ANY INCIDENTAL, CONSEQUENTIAL, OR PUNITIVE DAMAGES ARISING OUT OF OR RELATED TO THIS AGREEMENT, EVEN IF THE PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES. EXCEPT FOR THE OBLIGATIONS UNDER SECTIONS 17 (INTELLECTUAL PROPERTY), 18 (CONFIDENTIALITY) AND 21 (INDEMNIFICATION), EACH PARTY’S TOTAL CUMULATIVE LIABILITY TO THE OTHER PARTY FOR ANY CLAIM ARISING FROM OR IN CONNECTION WITH THIS AGREEMENT (UNDER ANY LEGAL THEORY INCLUDING CLAIMS IN CONTRACT OR TORT), THE SERVICES AND THE VENDOR SYSTEM, WILL NOT EXCEED [*] THE AMOUNTS ACTUALLY PAID TO VENDOR BY ▇▇▇▇▇▇ (UNDER THIS AGREEMENT OR THE PILOT AGREEMENT BETWEEN THE PARTIES) DURING THE [*] PERIOD PRECEDING THE DATE OF THE EVENT GIVING RISE TO THE LIABILITY.

22.1 No Liability for Decisions. OTHER THAN AS A RESULT OF A BREACH OF A REPRESENTATION, WARRANTY OR COVENANT HEREUNDER, VENDOR ASSUMES NO RESPONSIBILITY AND WILL HAVE NO LIABILITY OF ANY KIND FOR THE DECISIONS MADE BY ANY PARTY BASED ON USE OF THE VENDOR SYSTEM AND SERVICES, OR ANY EFFECTS THAT MAY RESULT FROM SUCH USE. VENDOR WILL NOT BE LIABLE FOR ANY DEFICIENCY IN PERFORMING UNDER THIS AGREEMENT IF SUCH DEFICIENCY RESULTS FROM ANY FAILURE TO PROVIDE COMPLETE AND ACCURATE INFORMATION TO VENDOR OR VENDOR SYSTEM (INCLUDING WITHOUT LIMITATION THE PROVISION OF SEQUENCING DATA).

23. Insurance. Vendor shall obtain, pay for, and maintain in full force and effect during the Term insurance as follows: (a) Workers’ compensation and employers’ liability insurance with limits to conform with the greater of the amount required by applicable law or [*] each accident, including occupational disease coverage; (b) Commercial general liability insurance with limits not less than [*] combined single limit for bodily injury, death, and property damage, including personal injury, contractual liability, independent contractors, broad-form property damage, and products and completed operations coverage; (c) Automobile contractual liability coverage for non-owned and hired automobile coverages with a combined single limit of liability for each accident of not less than [*]; and (d) Professional liability insurance (Errors and Omissions) with limits not less than [*] annual aggregate for all claims each policy year. To the extent any insurance coverage required under this Section is purchased on a “claims-made” basis, such insurance shall cover all prior acts of Vendor during the Term, and such insurance shall be continuously maintained until at least [*] years beyond the expiration or termination of the Term, or Vendor shall purchase “tail” coverage, effective upon

* CERTAIN INFORMATION HAS BEEN OMITTED AND FILED SEPARATELY WITH THE SECURITIES AND EXCHANGE COMMISSION. CONFIDENTIAL TREATMENT HAS BEEN REQUESTED WITH RESPECT TO THE OMITTED PORTIONS.

termination of any such policy or upon termination or expiration of the Term, to provide coverage for at least [*] years from the occurrence of either such event. Certificates of Insurance evidencing all coverages described in this Section shall be furnished to ▇▇▇▇▇▇ on written request. Vendor shall give thirty (30) days’ prior written notice to ▇▇▇▇▇▇ of cancellation, non-renewal, or material change in coverage, scope, or amount of any policy.

24. Termination.

24.1 Bankruptcy. ▇▇▇▇▇▇ may, in its sole discretion, terminate this Agreement in the event of the Vendor commencing voluntary or involuntary winding up, or upon the filing of any petition seeking the winding up of the Vendor, or upon the Vendor making a general assignment for the benefit of its creditors (each, an “Insolvency Event”). Upon the occurrence of any Insolvency Event, Vendor agrees, within the scope and limitations of the United States Bankruptcy Code and any applicable agreements between Vendor and AWS (the “AWS Agreements”), to use commercially reasonable efforts to facilitate the timely transfer of any (i) ▇▇▇▇▇▇ Content or ▇▇▇▇▇▇ Property, (ii) Developments, and (iii) Vendor System, each as stored on any AWS servers pursuant to the AWS Agreements, from such AWS servers to other AWS servers available for ▇▇▇▇▇▇ data storage pursuant to any separate agreement or agreements to be entered into between AWS and ▇▇▇▇▇▇.

24.2 Material Breach. If either Party materially defaults in the performance of any of its obligations under this Agreement, which default is capable of cure and is not substantially cured within thirty (30) days after written notice specifying the default is given to the defaulting Party, the Party not in default may, by giving written notice thereof to the defaulting Party, terminate the Agreement, as of a date specified in such notice of termination.

24.3 Termination for Convenience. Without reason, penalty or breach of this Agreement and notwithstanding the other Party’s compliance with all requirements of this Agreement, ▇▇▇▇▇▇ at any time and Vendor beginning at the start of the first Renewal Term may terminate this Agreement or any Statement of Work, Service, or Deliverable, provided that written notice is given to the other Party at least [*] prior to the date of termination if ▇▇▇▇▇▇ is the terminating Party and at least [*] prior to the date of termination if Vendor is the terminating Party. In the event of any such termination, Vendor shall be compensated for any Services rendered prior to the effective date of the termination, but any compensation allocated to Services that were yet to be rendered with regard to any canceled aspect of the Services shall then be eliminated.

24.4 Effect of Termination. Upon termination of this Agreement, unless otherwise specified by ▇▇▇▇▇▇ in writing:

(a) Vendor shall cease to perform the Services, and ▇▇▇▇▇▇ will pay to Vendor all sums due to Vendor for Services properly performed through the effective date of such expiration or termination (prorated as appropriate).

(b) Expiration or termination of this Agreement for any reason will not release either Party from any liabilities or obligations set forth in this Agreement which (i) the Parties have expressly agreed in writing will survive any such expiration or termination or (ii) remain to be performed or by their nature would be intended to be applicable following any such expiration or termination.

(c) In the case of termination of the Agreement, all Statement(s) of Work that have not been completed shall be deemed canceled as of the effective date of such termination.

(d) Vendor will cooperate with ▇▇▇▇▇▇ and take all reasonably requested steps to assist ▇▇▇▇▇▇ in making an orderly transition of the Services back to ▇▇▇▇▇▇ or its designees and will cooperate in the return of all Confidential Information, Personal Data and other related documents.

(e) All applicable licenses and other rights granted to ▇▇▇▇▇▇ with respect to the Service will immediately terminate.

(f) ▇▇▇▇▇▇ will have the right to download and delete all ▇▇▇▇▇▇ Content in the Vendor System during a 15 day period following the effective date of termination or expiration of this Agreement. Following the 15 day period, ▇▇▇▇▇▇ will lose access to all ▇▇▇▇▇▇ Content remaining in Vendor’s System, and Vendor will have no obligation to maintain or make accessible any ▇▇▇▇▇▇ Content, which Vendor may delete without restriction.

24.5 Survival. The following Sections shall survive any termination or expiration of this Agreement: 1 (Definitions), 15.10 (Audits and Records), 16 (Representations and Warranties); 17 (Intellectual Property); 18

* CERTAIN INFORMATION HAS BEEN OMITTED AND FILED SEPARATELY WITH THE SECURITIES AND EXCHANGE COMMISSION. CONFIDENTIAL TREATMENT HAS BEEN REQUESTED WITH RESPECT TO THE OMITTED PORTIONS.

(Confidentiality); 21 (Indemnification); 22 (Disclaimer of Consequential Damages; Limitation of Liability); 23 (Insurance); 24.4 (Effect of Termination); 24.5 (Survival); and 25 (General Provisions).

25. General Provisions.

25.1 Days. Unless expressly provided otherwise, all references to “days” refer to calendar days.

25.2 Independent Contractors. Vendor is an independent contractor and is not an agent or employee of, and has no authority to bind, ▇▇▇▇▇▇ by contract or otherwise. Vendor will perform the Services under the general direction of ▇▇▇▇▇▇, but Vendor will determine, in Vendor’s sole discretion, the manner and means by which the Services are accomplished, subject to the requirement that Vendor will at all times comply with applicable law and with ▇▇▇▇▇▇’▇ reasonable instructions. This Agreement will not be construed as creating an agency, partnership, joint venture or any other form of association between the parties, who will at all times be and remain independent contractors. Further, it is not the intention of this Agreement or of the Parties to confer a third party beneficiary right of action upon any third party or entity whatsoever, and nothing in this Agreement will be construed so as to confer upon any third party or entity other than the Parties hereto a right of action under this Agreement or in any manner whatsoever.

25.3 Employment Taxes and Benefits. Vendor warrants that the Services will be provided by Vendor Personnel. Vendor agrees to pay all necessary employment taxes required by law. Vendor also agrees to report Vendor Personnel’s income and withhold all required taxes from such income, as may be required by law. Vendor Personnel will not be entitled to receive any vacation or illness payments, or to participate in any plans, arrangements, or distributions by ▇▇▇▇▇▇ pertaining to any bonus, stock option, profit sharing, insurance or similar benefits for ▇▇▇▇▇▇ employees. In addition, Vendor agrees that it will provide for workers’ compensation, unemployment, and all other coverage required under applicable local, state or federal law. Vendor further agrees that it will defend (including payment of all attorneys’ fees) and indemnify ▇▇▇▇▇▇ against any claim asserted against ▇▇▇▇▇▇ for Vendor’s failure to comply with its obligations under this paragraph.

25.4 Publicity. Vendor agrees not to make, without ▇▇▇▇▇▇’▇ prior express written consent, any publication or presentation that contains any reference or discussion relating to ▇▇▇▇▇▇, ▇▇▇▇▇▇ Confidential Information or work performed by Vendor for ▇▇▇▇▇▇.

25.5 Assignment. Neither Party may assign any rights or obligations arising under this Agreement, whether by operation or law or otherwise, without the prior written consent of the other; except that either Party may assign this Agreement without consent of the other Party to a corporate affiliate of such Party or in connection with a merger, acquisition, corporate reorganization, or sale of all or substantially all of its assets (a “Corporate Transaction”). Vendor hereby agrees to provide written notice to ▇▇▇▇▇▇ promptly after the closing of any Corporate Transaction in which Vendor is the target, with such written notice to include the identity of the acquiring entity and its principal corporate affiliates. Such written notice shall be Vendor’s Confidential Information. Vendor further agrees that it will not share any ▇▇▇▇▇▇ Content with any such acquiring entity that is a competitor of ▇▇▇▇▇▇ [*]. ▇▇▇▇▇▇ shall have the right to terminate this Agreement prior to the expiration of such [*] period by providing written notice of termination to Vendor, which notice shall have immediate effect. In the event of such termination, Vendor shall not share ▇▇▇▇▇▇ Content with the acquiring entity. This Agreement shall inure to the benefit of and shall be binding on the permitted successors and assignees of the Parties. Any attempted transfer of assignment of this Agreement in violation of this Section 25.5 is null and void.

25.6 Insolvency Events. The Parties agree that the rights granted to ▇▇▇▇▇▇ hereunder, including, without limitation, those rights granted in Section 5, are rights in “intellectual property” within the scope of Section 101 (or its successors) of the United States Bankruptcy Code (the “Code”). ▇▇▇▇▇▇, as a licensee of intellectual property rights hereunder, shall have and may fully exercise all rights available to a licensee under the Code, including, without limitation, under Section 365(n) or its successors. In the event of a case under the Code involving Vendor, ▇▇▇▇▇▇ shall have the right to obtain (and Vendor or any trustee for Vendor or its assets shall, at ▇▇▇▇▇▇’▇ written request, deliver to ▇▇▇▇▇▇) a copy of all embodiments (including, without limitation, any work in progress) of any intellectual property rights granted hereunder. Vendor shall take all steps reasonably requested by ▇▇▇▇▇▇ to perfect, exercise and enforce its rights under this Section 25.6, including, without limitation, filings in the U.S. Copyright Office and U.S. Patent and Trademark Office, and under the Uniform Commercial Code.

25.7 Force Majeure. If either Party cannot perform any of its obligations because of any act of God, court order, war, or any other cause not within the Party’s reasonable control and could not be avoided through the exercise of reasonable care and diligence (a “Force Majeure Event”), then the non-performing Party will: (a) promptly notify the

* CERTAIN INFORMATION HAS BEEN OMITTED AND FILED SEPARATELY WITH THE SECURITIES AND EXCHANGE COMMISSION. CONFIDENTIAL TREATMENT HAS BEEN REQUESTED WITH RESPECT TO THE OMITTED PORTIONS.

other Party; (b) take reasonable steps to resume performance as soon as possible; and (c) not be considered in breach during the duration of the Force Majeure Event. In the event a Force Majeure Event continues for a period of [*], ▇▇▇▇▇▇ may terminate this Agreement by providing written notice to Vendor. Notwithstanding the foregoing, a Force Majeure Event will not relieve Vendor of its obligations under 18 (Confidentiality), 19 (Security), and 20 (Disaster Recovery).

25.8 Governing Law; Venue. This Agreement will be governed by and construed in accordance with the laws of the State of California without giving effect to principles of conflict of laws that would require the application of the laws of a different jurisdiction. The United Nations Convention on Contracts for the International Sale of Goods will not apply to this Agreement. Any action or proceeding arising from or relating to this Agreement must be brought in a federal or state court sitting in San Francisco, California, and each Party irrevocably submits to the jurisdiction and venue of any such court in any such action or proceeding. If a dispute arising under this Agreement results in litigation, the non-prevailing Party shall pay the court costs and reasonable attorneys’ fees of the prevailing Party.

25.9 Waivers. All waivers hereunder must be made in writing by a duly authorized representative of the Party against whom the waiver is to operate, and failure at any time to require the other Party’s performance of any obligation under this Agreement shall not affect the right subsequently to require performance of that obligation.

25.10 Waiver/Severability. Any waiver, in whole or in part, of any provision of this Agreement will not be considered to be a waiver of any other provision. If any term of this Agreement is found to be unenforceable or invalid for any reason, all other terms will remain in full force and effect.

25.11 Construction. All headings used in this Agreement are for reference purposes only and are not part of this Agreement. Neither this Agreement nor any Statement of Work will be construed in favor or against either Party by reason of the authorship of any provisions hereof.

25.12 Terminology. All personal pronouns used herein, whether used in the feminine, masculine, or neuter gender, shall include all other genders, and the singular shall include the plural and vice versa. Unless otherwise expressly stated, the words “herein,” “hereof,” and “hereunder” and other words of similar import refer to this Agreement as a whole and not to any particular Section, Subsection or other subpart. The words “include,” “includes,” “included,” “including,” “without limitation,” or the phrase “e.g.” shall not be construed as terms of limitation and shall, in all instances, be interpreted as meaning “including, but not limited to.”

25.13 Exhibits, Statement(s) of Work and Addenda. All Exhibits, Statement(s) of Work, and Addenda that are referenced herein and appended hereto, or are signed by the Parties on or after the date of this Agreement, are hereby incorporated by reference. The following Exhibits are attached hereto and incorporated herein:

	Exhibit A	Statement(s) of Work
	Exhibit B	Services; Fees
	Exhibit C	Service Levels
	Exhibit D	Business Associate Agreement
	Exhibit E	Information Security Requirements

25.14 Entire Agreement. This Agreement, as to its subject matter, exclusively and completely states the rights, duties and obligations of the Parties and supersedes all prior and contemporaneous representations, letters, proposals, discussions and understandings by or between the Parties. This Agreement may only be amended in a writing signed by both Parties. The Parties, by their representatives signing below, agree with the terms of this Agreement. In particular, no shrink-wrap, click-wrap, or other terms and conditions or agreements (“Additional Terms”) provided with any products or software hereunder shall be binding on ▇▇▇▇▇▇, even if use of such products and software requires an affirmative “acceptance” of those Additional Terms before access is permitted. All such Additional Terms shall be of no force or effect and shall be deemed rejected by ▇▇▇▇▇▇ in their entirety.

25.15 Notices. All notices under this Agreement will be in writing and will be deemed to have been duly given if delivered personally or by an internationally recognized courier service or, if between Parties located in the United States, mailed by U.S. registered or certified mail, return receipt requested, postage prepaid, to the Parties at the addresses set forth herein. All notices under this Agreement that are addressed as provided in this Section 25.15

* CERTAIN INFORMATION HAS BEEN OMITTED AND FILED SEPARATELY WITH THE SECURITIES AND EXCHANGE COMMISSION. CONFIDENTIAL TREATMENT HAS BEEN REQUESTED WITH RESPECT TO THE OMITTED PORTIONS.

(Notices), (a) if delivered personally or by a nationally recognized courier service, will be deemed given upon delivery, or (b) if delivered by mail in the manner described above, will be deemed given on the relevant Party’s receipt of the notice. All notices shall be sent by certified mail or by personal delivery, to the following addresses:

If to Vendor:	If to ▇▇▇▇▇▇:
DNAnexus, Inc.	▇▇▇▇▇▇, Inc.
▇▇▇▇ ▇ ▇▇ ▇▇▇▇▇▇ ▇▇▇▇	▇▇▇ ▇▇▇▇▇▇▇▇▇▇ ▇▇▇▇, ▇▇▇▇▇ ▇▇▇
▇▇▇▇▇ ▇▇▇	▇▇▇ ▇▇▇▇▇▇, ▇▇ ▇▇▇▇▇
▇▇▇▇▇▇▇▇ ▇▇▇▇, ▇▇ ▇▇▇▇▇	Attention: Vice President, Product
Attention: CEO	Development


With a copy to:	With a copy to:

DNAnexus, Inc.	▇▇▇▇▇▇, Inc.
▇▇▇▇ ▇ ▇▇ ▇▇▇▇▇▇ ▇▇▇▇	▇▇▇ ▇▇▇▇▇▇▇▇▇▇ ▇▇▇▇, ▇▇▇▇▇ ▇▇▇
▇▇▇▇▇ ▇▇▇	▇▇▇ ▇▇▇▇▇▇, ▇▇ ▇▇▇▇▇
▇▇▇▇▇▇▇▇ ▇▇▇▇, ▇▇ ▇▇▇▇▇	Attention: General Counsel
Attention: General Counsel

Either Party may change its address or designee for notification purposes by giving notice to the other of the new address or designee and the date upon which such change will become effective.

25.16 Agreement Drafted By All Parties. This Agreement is the result of arm’s length negotiations between the Parties and shall be construed to have been drafted by all Parties such that any ambiguities in this Agreement shall not be construed against either Party.

25.17 Counterparts. This Agreement may be executed in one or more counterparts, each of which shall be deemed an original, and will become effective and binding upon the Parties as of the Effective Date at such time as all the signatories hereto have signed a counterpart of this Agreement.

25.18 Electronic Signatures and Facsimiles - Binding. This Agreement and associated Statement(s) of Work and related documents may be accepted in electronic form (e.g., by an electronic or digital signature or other means of demonstrating assent) and Vendor’s acceptance will be deemed binding between the Parties. Each Party acknowledges and agrees it will not contest the validity or enforceability of this Agreement and associated Statement(s) of Work and related documents, including under any applicable statute of frauds, because they were accepted and/or signed in electronic form. Each Party further acknowledges and agrees that it will not contest the validity or enforceability of a signed facsimile copy of this Agreement and associated Statement(s) of Work and related documents on the basis that it lacks an original handwritten signature. Facsimile signatures shall be considered valid signatures as of the date hereof. Computer maintained records of a Party when produced in hard copy form shall constitute business records and shall have the same validity as any other generally recognized business records.

25.19 Source Code Escrow. No later than sixty (60) days after the Effective Date of this Agreement, Vendor will have deposited a copy of the Source Code (as defined below) for the Vendor System with Iron Mountain, a software escrow agent (the “Escrow Agent”), located at San Francisco, California (the “Escrow”) pursuant to a written Escrow Agreement. ▇▇▇▇▇▇ shall pay Escrow Agent’s fees for opening and maintaining the escrow account subject to the Escrow Agreement. Vendor shall continually update the Source Code by promptly depositing in the escrow each material new release, update, version, enhancement, correction, patch, and improvement of the Vendor System. In addition, Vendor shall include in the Escrow the names and contact information for the primary developers of the Vendor System. Vendor’s duty to update the Source Code shall continue through the Term or until ▇▇▇▇▇▇ ceases obtaining support from Vendor, whichever is later. The Source Code will be held in the Escrow and the events upon which ▇▇▇▇▇▇ shall have access to the Source Code shall include (collectively the “Release Conditions”): [*]. Upon the occurrence of a Release Condition (or any other release conditions that may be specified under the Escrow Agreement), ▇▇▇▇▇▇ shall be entitled to use the Source Code to perform its own support and maintenance and alter or modify the Source Code for its internal use. In addition, ▇▇▇▇▇▇ may hire, without penalty or fee, any one of the developers identified above and Vendor shall take no action to restrict ▇▇▇▇▇▇’▇ employment of that developer. Should use of the Source Code as provided in this Section involve the use or practice of any patent, copyright, trade secret, trademark or

* CERTAIN INFORMATION HAS BEEN OMITTED AND FILED SEPARATELY WITH THE SECURITIES AND EXCHANGE COMMISSION. CONFIDENTIAL TREATMENT HAS BEEN REQUESTED WITH RESPECT TO THE OMITTED PORTIONS.

other proprietary information in which Vendor has an interest, Vendor, its assignee, or successors, agree not to assert a claim for patent, copyright, trade secret, trademark or other proprietary information infringement against ▇▇▇▇▇▇ provided use of Vendor System and Source Code is in accordance with this Agreement. Should use of the Source Code as provided in this Section involve the use or practice of any patent, copyright, trade secret, trademark or other proprietary information of any Third Party, Vendor shall make all reasonable efforts to obtain for ▇▇▇▇▇▇ or assist ▇▇▇▇▇▇ in obtaining any necessary rights. Regardless of whether one of the Release Conditions occurs, ▇▇▇▇▇▇ shall have the right, at ▇▇▇▇▇▇’▇ sole expense, to require the Escrow Agent to verify the relevance, completeness, currency, accuracy, and functionality of the Source Code by, among other things, compiling the Source Code and performing test runs for comparison with the capabilities of the Vendor System. In the event such testing demonstrates the Source Code does not correspond to the Vendor System, Vendor shall reimburse ▇▇▇▇▇▇ for costs and fees incurred up to [*] in the testing and immediately deposit the correct Source Code with the Escrow Agent. “Source Code” shall mean, with respect to the Vendor System, the source code of such software and all related compiler command files, build scripts, scripts relating to the operation and maintenance of such application, application programming interface (API), graphical user interface (GUI), object libraries, and all currently written and documented instructions on building the object code of such application, such that collectively the foregoing will be sufficient to enable a person possessing reasonable skill, training, knowledge and expertise in computer software, genomics, bioinformatics and information technology to build, load and operate the machine-executable object code of such application, to maintain and support such application and to effectively use all functions and features of such software to enable ▇▇▇▇▇▇ to continue to use the Vendor System as contemplated by this Agreement.

The Parties have caused this Agreement to be executed as of the Effective Date by their duly authorized representatives.

DNANEXUS, INC.		▇▇▇▇▇▇, INC.

By:	/s/▇▇▇▇▇▇▇ ▇. ▇’▇▇▇▇▇	By:	/s/▇▇▇▇▇▇▇▇ ▇▇▇▇▇▇

Name:	▇▇▇▇▇▇▇ ▇. ▇’▇▇▇▇▇	Name:	▇▇▇▇▇▇▇▇ ▇▇▇▇▇▇

Title:	VP Sales	Title:	CTO

Date:	9/19/14	Date:	9/22/14

CONFIDENTIAL TREATMENT REQUESTED

EXHIBIT A

STATEMENT OF WORK NO. 1

This Statement of Work, effective as of the last signature date set forth below, is a part of and incorporated into the Application Services Provider Agreement (“Agreement”) between DNAnexus, Inc. (“Vendor”) and ▇▇▇▇▇▇, Inc. (“▇▇▇▇▇▇”), dated September 19, 2014. Capitalized terms not defined in this Statement of Work are as defined in the Agreement. In the event of any conflict between the body of the Agreement and this Statement of Work, the body of the Agreement shall govern.

1. Description of Services and Deliverables:

DNAnexus provides a comprehensive service for operating in the cloud. We enable ▇▇▇▇▇▇ to:

Streamline its ▇▇▇▇▇▇▇▇ ▇▇▇▇ management and analysis operations

Deploy enterprise-grade security and be ready for any future regulatory compliance requirements

Lower operating costs and avoid capital investment in computing hardware

Scale data infrastructure up and down quickly, without practical limit

Expand its market reach globally by virtualizing ▇▇▇▇▇▇’▇ data and analysis logistics in the cloud

In addition to the technical functionality provided by DNAnexus’ cloud platform, DNAnexus has invested and will continue to invest considerable resources in helping ▇▇▇▇▇▇ expand globally.

Our partnership to date has included the following areas of investment:

Consulting and implementation work

The DNAnexus Science team has assisted in a number of areas to deploy ▇▇▇▇▇▇’▇ infrastructure in the cloud, both in a consultative fashion and through direct implementation:

Overall system architecture: Design and implementation work, including setting up projects, permissions, data and metadata flow, security, upstream and downstream integration with ▇▇▇▇▇▇ systems.

Versioning architecture: Design and implementation of versioning system for data and analysis pipelines, supporting concurrent execution of production versions with future development work.

Analysis pipelines: Implementation and optimization of ▇▇▇▇▇▇ analysis pipelines.

“Czar” API server: Assistance in the design and implementation of ▇▇▇▇▇▇’▇ API server, including security design and authentication protocols.

▇▇▇▇▇▇▇▇ ▇▇▇▇ upload: Setup and installation of ▇▇▇▇▇▇▇▇ ▇▇▇▇ upload flow at ▇▇▇▇▇▇ and at partner sequencing sites including [*]. Helping diagnose and resolve upload bandwidth issues to support required throughputs.

Sales support: Assistance with selling the technical and security aspects of delivering ▇▇▇▇▇▇ algorithms and pipelines through the cloud.

Prioritized development

In order to meet aggressive timelines to support ▇▇▇▇▇▇’▇ deployment goals, DNAnexus has reprioritized engineering development efforts to match ▇▇▇▇▇▇’▇ needs. These include:

[*]

* CERTAIN INFORMATION HAS BEEN OMITTED AND FILED SEPARATELY WITH THE SECURITIES AND EXCHANGE COMMISSION. CONFIDENTIAL TREATMENT HAS BEEN REQUESTED WITH RESPECT TO THE OMITTED PORTIONS.

Going forward, DNAnexus will continue to partner with ▇▇▇▇▇▇ through consulting, implementation, and prioritized development. DNAnexus will also provide the following services:

Sales and support for partner sequencing sites

DNAnexus will work with ▇▇▇▇▇▇ to develop best practice procedures for selling, onboarding, and supporting partner sequencing sites. This includes marketing and technical collateral used in sales settings, assistance in the installation of automated ▇▇▇▇▇▇▇▇ ▇▇▇▇ upload from the partner sequencing site, testing and solving customer upload bandwidth issues, and second-line support for technical issues.

Support

DNAnexus will provide the highest level of support to ▇▇▇▇▇▇. This includes:

High-level primary and secondary support contacts at DNAnexus with a response time as provided for in this Agreement. Initial contacts will be [*] and [*], respectively.

Escalation path to [*], [*], and [*] for more urgent or high-level needs.

Automated testing

To ensure continued technology platform delivery to ▇▇▇▇▇▇, DNAnexus will deploy automated testing tailored to ▇▇▇▇▇▇ in the following way:

▇▇▇▇▇▇ to designate [*] end-to-end pipelines, which can be changed with [*] notice. For example, [*]

▇▇▇▇▇▇ to designate automated test input datasets and criteria for validation

DNAnexus will conduct internal testing on ▇▇▇▇▇▇’▇ pipelines prior to releasing any major or minor changes to production

2. Payment terms:

The Parties have caused this Agreement to be executed as of the Effective Date by their duly authorized representatives.

DNANEXUS, INC.		▇▇▇▇▇▇, INC.

By:	/s/▇▇▇▇▇▇▇ ▇. ▇’▇▇▇▇▇	By:	/s/▇▇▇▇▇▇▇▇ ▇▇▇▇▇▇

Name:	▇▇▇▇▇▇▇ ▇. ▇’▇▇▇▇▇	Name:	▇▇▇▇▇▇▇▇ ▇▇▇▇▇▇

Title:	VP Sales	Title:	CTO

Date:	9/19/14	Date:	9/22/14

* CERTAIN INFORMATION HAS BEEN OMITTED AND FILED SEPARATELY WITH THE SECURITIES AND EXCHANGE COMMISSION. CONFIDENTIAL TREATMENT HAS BEEN REQUESTED WITH RESPECT TO THE OMITTED PORTIONS.

EXHIBIT B

SERVICES; FEES

Vendor pricing is composed of two components:

Resource-based pricing: Variable compute, storage, and networking usage of the DNAnexus platform.

Per-test pricing: Additional value add per delivered test for ongoing consulting, implementation, prioritized development, and premium support.

The total ▇▇▇▇ to ▇▇▇▇▇▇ each calendar month will be based on the number of tests as well as the accrued compute, storage, and networking usage according to the below price schedules.

Resource-based pricing

All DNAnexus usage, including R&D and production pipeline execution, is charged according to the below pricing sheet:

Compute
Cost Class	Cost per virtual core hour
[*]	[*]
[*]	[*]
[*]	[*]
[*]	[*]
[*]	[*]
[*]	[*]
Data Transfer & Storage
Service	Cost
[*]	[*]
[*]	[*]
[*]	[*]
[*]	[*]

Resource-based pricing shall be updated from time to time by a signed agreement reflecting Vendor’s current list pricing.

Per-test pricing

A “production test” is composed of [*]. Accounting for number of “production tests” will be done by counting all [*] generated by the production test pipeline and applying a proportion [*] that reflects the [*], with the ratio to be reasonably agreed upon by ▇▇▇▇▇▇ and DNAnexus. At the end of each three month period, the numbers shall be adjusted to reflect the number of units billed by ▇▇▇▇▇▇ to its customers in that period.

A value add charge is applied to each execution of a billable production test, based upon the following tiers of monthly production test volumes:

Value-add price per test	Production test monthly volume
[*]	Up to [*] production tests
[*]	Each production test over [] up to []
[*]	Each production test over [*]

* CERTAIN INFORMATION HAS BEEN OMITTED AND FILED SEPARATELY WITH THE SECURITIES AND EXCHANGE COMMISSION. CONFIDENTIAL TREATMENT HAS BEEN REQUESTED WITH RESPECT TO THE OMITTED PORTIONS.

Prices in lower priced tiers apply only to the number of tests above the lower threshold associated with the tier and not exceeding any upper threshold. Example calculations are as follows:


Number of Tests in One Month	Total Per-Test Pricing Cost
9,000	[*]
10,500	[*]
30,000	[*]

Underlying resource costs for compute, storage, and network transfer are accounted for separately according to the resource-based price sheet above. Current estimates based on portions of the test pipeline currently implemented are:

[*] per test for computation

[*] per test per month for ongoing storage

[*] per test for network transfer

Based on currently implemented analysis pipelines, the combined resource-based and per-test pricing is estimated at [*] per test for compute at the highest volume tier, and [*] per test per month for ongoing storage.

Modifying analysis steps or adjusting the volume of data will alter the final pricing in accordance with the resource-based pricing scheme.

* CERTAIN INFORMATION HAS BEEN OMITTED AND FILED SEPARATELY WITH THE SECURITIES AND EXCHANGE COMMISSION. CONFIDENTIAL TREATMENT HAS BEEN REQUESTED WITH RESPECT TO THE OMITTED PORTIONS.

EXHIBIT C

SERVICE LEVELS

This Exhibit describes the performance standards and service levels to be achieved by Vendor in providing the Services, not including Support Services or any other professional or consulting services:

1. Definitions. Except as provided in this Exhibit, capitalized terms shall have the meanings set forth in the body of the Agreement. The following terms, when used in this Exhibit, shall have the following meanings:

“Host” shall be a cloud services provider, currently AWS.

“Server” shall mean the server(s) on which the Services will be hosted.

2. General Hosting Obligations. In addition to the other obligations set forth in the Agreement and this Exhibit, Vendor shall do the following:

Operate the Services on a Server owned and securely maintained by the Host.

Allow access to the Services over the Internet and provide secure and confidential storage of all information transmitted to and from the Services.

Maintain ability to redeploy at a geographically different site (e.g., different flood plain and power grid) from where the Server is located, to ensure continuous service in the event of disaster.

Review security notifications and alerts relevant to the hosting platform (e.g., Vendor notifications of bugs, attacks, patches), and apply as appropriate to maintain a reasonable level of defense.

Vendor shall provide adequate firewall protection in order to secure ▇▇▇▇▇▇, End User and Employee Information and other Confidential Information of ▇▇▇▇▇▇ and users of the Services from unauthorized access by third parties.

3. Change of Host. In the event that during the Term Vendor desires to transition to a new Host, Vendor shall provide ▇▇▇▇▇▇ with at least [*] prior written notice of the transition. Vendor shall reasonably cooperate with ▇▇▇▇▇▇ in evaluating the security and performance of the proposed new Host. ▇▇▇▇▇▇ shall have [*] from receipt of notice of the transition to object to the new Host. In the event of such objection, the parties shall meet and confer regarding alternate Hosts. If the parties are unable for any reason to reach agreement within [*] of receipt by Vendor of the objection, ▇▇▇▇▇▇ may, in its sole discretion, elect to terminate this Agreement as of the date that Vendor has indicated that it will transition without further obligation except for paying outstanding fees for past services rendered.

4. Service Monitoring & Management. Vendor will perform continuous monitoring and management of the Services to optimize availability of Services. Included within the scope of this section is the proactive monitoring of the Server and all service components of Vendor’s firewall for trouble on a 7 day by 24 hour basis, and the expedient restoration of components when failures occur within the time period set forth in Section 10 (Service Outages) of this Exhibit.

Vendor will monitor “heartbeat” signals of all servers, routers and leased lines, and HTTP availability of the Server, by proactive probing not to exceed 300-second intervals 24 hours a day using an automated tool. If a facility does not respond to a ping-like stimulus, it shall be immediately checked again. When Vendor receives a “down” signal, or otherwise has knowledge of a failure in the Server or the application software and/or hardware, Vendor personnel will:

Promptly notify ▇▇▇▇▇▇ by email, DNAnexus blog or Twitter according to mutually agreed upon procedures that an outage has occurred, providing such details as may be available, including the Vendor trouble ticket number, if appropriate, and time of outage;

Work the problems continuously until resolution, escalating to management or to engineering as required;

Promptly notify ▇▇▇▇▇▇ of final resolution, along with any pertinent findings or action taken, and requests concurrence to close the trouble ticket.

* CERTAIN INFORMATION HAS BEEN OMITTED AND FILED SEPARATELY WITH THE SECURITIES AND EXCHANGE COMMISSION. CONFIDENTIAL TREATMENT HAS BEEN REQUESTED WITH RESPECT TO THE OMITTED PORTIONS.

5. Backups. ▇▇▇▇▇▇ understands that backup services are provided according to policies and procedures of the Host. Vendor represents that files uploaded and generated successfully and any related metadata will be backed up and that genomic data are currently stored in Amazon S3. If a production file system fails, Vendor will attempt to restore from backup. ▇▇▇▇▇▇ understands that neither Vendor nor Host can recover any deleted file.

6. Service Levels.

6.1 “Monthly Uptime Percentage” is calculated by subtracting from 100% the percentage of minutes during the month in which the Services were in a state of Service Unavailability.

6.2 Subject to the exclusions in Section 6.3 below, “Service Unavailability” means that a ▇▇▇▇▇▇ User attempts to but cannot perform any one of the following:

(a) Log in to the Services;

(b) Access the API server;

(d) Run jobs on the Services.

6.3 The Service Level Commitment does not apply to any delay of service due to:

(a) maintenance activities during [*] scheduled on [*];

(b) maintenance activities for which notification is provided at least [*] in advance;

(d) factors outside of Vendor’s reasonable control, including any force majeure event; Internet access or related problems beyond the demarcation point of Service; failure of ▇▇▇▇▇▇’▇ or a third party’s, (except a third party subcontractor) equipment, software or other technology not in Vendor’s direct control, including app errors, app internal errors, faulty app, applet or workflow design; and failure of Internet-based computing and storage services, such as those provided by AWS or other cloud service provider, not in Vendor’s control.

7. Service Level Reporting. Vendor shall be responsible for monitoring Service Level performance and shall provide ▇▇▇▇▇▇ with reports showing Service Level performance at ▇▇▇▇▇▇’▇ request in the event that a Service Credit is claimed.

8. Failure to Achieve Service Levels. Failure to achieve the Service Level Commitment set forth in Section 6 of this Exhibit shall constitute a “Service Level Failure.” Following a Service Level Failure, ▇▇▇▇▇▇ will be eligible for a Service Credit of [*] of the total monthly charges for each [*] of Service Unavailability.

Service Credits will apply [*]. Service Credits will not entitle ▇▇▇▇▇▇ to any [*]. A Service Credit will be applicable and issued only if the credit amount for the applicable monthly billing cycle is greater than $10. Unless otherwise provided in this Agreement and subject to Vendor meeting its other obligations under this Agreement, including without limitation its obligations under Sections 14.1(a) and (c) of the Agreement and Section 4 of this Exhibit, ▇▇▇▇▇▇’▇ sole and exclusive remedy for any unavailability, non-performance, or other failure by Vendor to provide Service according to this Exhibit C is the receipt of a Service Credit (if eligible). Notwithstanding the foregoing, if a Service Unavailability lasts for more than [*] (an “Extreme Service Unavailability”), the Service Credit shall not be ▇▇▇▇▇▇’▇ sole and exclusive remedy, and, in addition to all other remedies available to ▇▇▇▇▇▇ under this Agreement or at law, this shall constitute a Release Condition under the Escrow, and ▇▇▇▇▇▇ shall have access to and use of one of the primary developers of the Vendor System to assist ▇▇▇▇▇▇ in seeking to remedy the Service Unavailability.

* CERTAIN INFORMATION HAS BEEN OMITTED AND FILED SEPARATELY WITH THE SECURITIES AND EXCHANGE COMMISSION. CONFIDENTIAL TREATMENT HAS BEEN REQUESTED WITH RESPECT TO THE OMITTED PORTIONS.

In the event Vendor fails to achieve the Service Level Commitment [*] in any [*] period during the Term, ▇▇▇▇▇▇ may, in its sole discretion, terminate this Agreement without further obligation except for outstanding fees due for past services rendered.

To receive a Service Credit, ▇▇▇▇▇▇ must submit a claim by email to ▇▇▇▇▇▇▇@▇▇▇▇▇▇▇▇.▇▇▇ for each Service Unavailability outage no later than [*] after outage. The claim must include: (a) the words “Service Unavailability” in the subject line; (b) the dates and times of each Service Unavailability and (c) ▇▇▇▇▇▇ or End User’s logs, redacted to omit confidential or sensitive information, that document and corroborate ▇▇▇▇▇▇’▇ or End User’s attempted activity that failed. At the end of a calendar month in which a Service Unavailability claim was made and Vendor confirms that the Service Level Commitment was not met based on ▇▇▇▇▇▇’▇ or End User’s outage reports, Vendor shall issue the Service Credit to ▇▇▇▇▇▇ within one billing cycle following the month in which the Vendor failed to meet the Service Level Commitment. ▇▇▇▇▇▇’▇ failure to make a Service Credit claim or to provide other information as required above will disqualify ▇▇▇▇▇▇ from receiving the Service Credit.

9. Corrective Action Plan. Notwithstanding Vendor’s obligation to continue to perform as required under the Agreement and this Exhibit and ▇▇▇▇▇▇’▇ remedies set forth herein, if ▇▇▇▇▇▇ does not terminate the Agreement after [*] during the Term, Vendor shall promptly investigate the root causes of such Service Level Failure and shall provide to ▇▇▇▇▇▇ (within [*] after the end of the month in which the second Service Level Failure occurred) an analysis of such root causes and a proposed corrective action plan for ▇▇▇▇▇▇’▇ review, comment and approval (the “Corrective Action Plan”). The Corrective Action Plan shall include, at a minimum: (i) a commitment by Vendor to ▇▇▇▇▇▇ to devote the appropriate time, skilled personnel, systems support and equipment, and/or resources to remedy, and prevent any further occurrences of, the Service Level Failure; (ii) a strategy for developing any programming/software updates, fixes, patches, etc. necessary to remedy, and prevent any further occurrences of, the Service Level Failure; and (iii) time frames for implementation of the Corrective Action Plan. There shall be no additional charge (other than those fees set forth in the Agreement) for Vendor’s implementation of such Corrective Action Plan in the time frames and manner set forth in the Corrective Action Plan.

10. Service Outages.

10.1 Scheduled. Other than outages due to maintenance activities set forth in Section 6.3(a) of this Exhibit, Vendor shall notify ▇▇▇▇▇▇ of scheduled outages at least [*] in advance.

10.2 Unscheduled. Promptly upon notice of an unscheduled outage, Vendor personnel shall:

Notify the person designated by ▇▇▇▇▇▇ by email, DNAnexus blog or Twitter according to predefined procedures that an outage has occurred, providing such details as may be available, including the trouble ticket number if appropriate and time of outage;

Work the problems until resolution, escalating to management or to engineering as required;

Promptly notify ▇▇▇▇▇▇ of final resolution, along with any pertinent findings or action taken.

11. Security Breaches or Denial of Service attacks. In the event of an attack or an actual, threatened or suspected breach of security against the Services and/or Server, Vendor will take whatever reasonable steps that are necessary to halt such action, including taking the Services down. Downtime due to external attacks shall not count against Availability requirement set forth above. Vendor’s actions may include, as appropriate:

Confirm the threat;

Deny access from the source of the attack;

Investigate the extent of the damage, if any;

Back-up the affected systems and those suspected to be affected;

Strengthen defenses everywhere, not just the suspected path that the attacker used;

Contact the ISP where the threat or attack originated and/or law enforcement to work with Vendor’s security team;

Produce an Incident Report within 3 business days detailing Vendor’s findings;

Re-instate the denial of access after a set time period, but continue to monitor traffic from that source until risk of further attacks is deemed to be minimized and

Apply any applicable network changes necessary to resolve a denial of service attack.

* CERTAIN INFORMATION HAS BEEN OMITTED AND FILED SEPARATELY WITH THE SECURITIES AND EXCHANGE COMMISSION. CONFIDENTIAL TREATMENT HAS BEEN REQUESTED WITH RESPECT TO THE OMITTED PORTIONS.

EXHIBIT D

BUSINESS ASSOCIATE AGREEMENT

THIS BUSINESS ASSOCIATE AGREEMENT (this “BAA”) between DNAnexus, Inc. (“DNAnexus”) and ▇▇▇▇▇▇, (“▇▇▇▇▇▇”) is made as of May 1, 2014 (the “BAA Effective Date”). The parties are also parties to an Application Service Provider Agreement (the “Agreement”).

RECITALS

▇. ▇▇▇▇▇▇ is a “Covered Entity” as that term is defined under the Health Insurance Portability and Accountability Act of 1996 (Public Law 104-91), as amended, (“HIPAA”), and the regulations promulgated thereunder by the Secretary of the U.S. Department of Health and Human Services (“Secretary”), including, without limitation, the regulations codified at 45 C.F.R. Parts 160 and 164 (“HIPAA Regulations”);

B. DNAnexus performs services for or on behalf of ▇▇▇▇▇▇, and in performing said services, DNAnexus creates, receives, maintains, or transmits PHI (as defined below);

C. The Parties intend to protect the privacy and provide for the security of PHI Disclosed by ▇▇▇▇▇▇ to DNAnexus, or received or created by DNAnexus, when providing services in compliance with HIPAA, the Health Information Technology for Economic and Clinical Health Act (Public Law 111-005) (the “HITECH Act”) and its implementing regulations and guidance issued by the Secretary, and other applicable state and federal laws, all as amended from time to time (collectively, the “Covered Laws”); and

D. The HIPAA Privacy and Security Rules require ▇▇▇▇▇▇ and DNAnexus to enter into a BAA that meets certain requirements with respect to the Use and Disclosure of PHI, which are met by this BAA.

The parties hereby agree as follows:

1. Applicability and Additional Definitions. Unless otherwise expressly defined in this BAA, all capitalized terms in this BAA will have the meanings set forth in HIPAA.

1.1. “Breach” shall have the meaning given under 45 C.F.R. § 164.402.

1.2. “Designated Record Set” shall have the meaning given such term under 45 C.F.R. § 164.501.

1.3. “Disclose” and “Disclosure” mean, with respect to PHI, the release, transfer, provision of access to, or divulging in any other manner of PHI outside of DNAnexus or to other than members of its Workforce, as set forth in 45 C.F.R. § 160.103.

1.4. “Law” means any law, regulation or statute applicable to this Agreement or the parties’ performance hereunder.

1.5. “PHI” means “protected health information” as defined in 45 C.F.R. § 160.103.

1.6. “Subcontractor” shall have the meaning given to such term under 45 C.F.R. § 160.103.

1.7. “Unsecured PHI” shall have the meaning given to such term under 45 C.F.R. § 164.402.

1.8. “Unsecured PHI” shall have the meaning given to such term under 42 U.S.C. § 17932(h), 45 C.F.R. § 164.402, and guidance issued pursuant to the HITECH Act including, but not limited to the guidance issued on April 17, 2009 and published in 74 Federal Register 19006 (April 27, 2009) by the Secretary.

1.9. “Use” or “Uses” mean, with respect to PHI, the sharing, employment, application, utilization, examination or analysis of such PHI within DNAnexus’s internal operations, as set forth in 45 C.F.R. § 160.103.

1.10. “Workforce” shall have the meaning given to such term under 45 C.F.R. § 160.103.

2. Permitted and Required Uses and Disclosures.

2.1. DNAnexus Services. DNAnexus may Use or Disclose PHI for or on behalf of ▇▇▇▇▇▇ solely as specified in the Agreement, provided such use is also permitted under this BAA, and applicable Law.

2.2. Administration and Management of DNAnexus. DNAnexus may use and disclose PHI as necessary for the proper management and administration of DNAnexus. Any Disclosures under this section will be made only if DNAnexus obtains reasonable assurances from the recipient of the PHI that (I) the recipient will hold the PHI confidentially and will Use or Disclose the PHI only as required by law or for the purpose for which it was disclosed to the recipient, and (II) the recipient will notify DNAnexus of any instances of which it is aware in which the confidentiality of the information has been breached.

3. Obligations of DNAnexus.

3.1. Limit on Uses and Disclosures. DNAnexus will use or disclose PHI only as permitted by this BAA or as required by law, provided that any such use or disclosure would not violate HIPAA if done by ▇▇▇▇▇▇, unless permitted under HIPAA for a Business Associate

3.2. Safeguards. DNAnexus will use reasonable and appropriate safeguards to prevent Use or Disclosure of the PHI other than as provided for by this BAA, consistent with the requirements of Subpart C of 45 C.F.R. Part 164 (with respect to Electronic PHI) and as further reflected in this BAA.

3.3. Reporting.

3.3.1. Reporting of Impermissible Uses and Disclosures. DNAnexus will report to ▇▇▇▇▇▇ any Use or Disclosure of PHI not permitted or required by this BAA of which DNAnexus becomes aware no later than three (3) business days after becoming aware of such Security Incident or non-permitted Use or Disclosure, in accordance with the notice provisions set forth herein. DNAnexus shall document and retain records of its investigation of any suspected Breach, including its reports to ▇▇▇▇▇▇ under this BAA.

3.3.2. Reporting of Security Incidents. Without limiting the generality of DNAnexus’ obligations under 3.3.1, DNAnexus will report to ▇▇▇▇▇▇ on no less than a quarterly basis any Security Incidents involving PHI of which DNAnexus becomes aware in which there is a successful unauthorized access, use, disclosure, modification, or destruction of information or interference with system operations in an Information System in a manner that risks the confidentiality, Integrity, or availability of such Information. No further notice will be provided, for unsuccessful attempts at such unauthorized access, use modification, or destruction, such as pings and other broadcast attacks on a firewall, denial of service attacks, port scans, unsuccessful login attempts, or interception of encrypted information where the key is not compromised, or any combination of the above, as long as no such incident results in unauthorized access, Use or Disclosure of PHI.

3.3.3. Reporting of Breaches. DNAnexus will report to ▇▇▇▇▇▇ any Breach of ▇▇▇▇▇▇’▇ Unsecured PHI that DNAnexus may discover to the extent required by 45 C.F.R. §164.410. DNAnexus will make such report without unreasonable delay, and in no case later than [*] after discovery of such Breach.

* CERTAIN INFORMATION HAS BEEN OMITTED AND FILED SEPARATELY WITH THE SECURITIES AND EXCHANGE COMMISSION. CONFIDENTIAL TREATMENT HAS BEEN REQUESTED WITH RESPECT TO THE OMITTED PORTIONS

3.4. Subcontractors. DNAnexus will ensure that any Subcontractors that create, receive, maintain, or transmit PHI on behalf of DNAnexus agree to restrictions and conditions consistent with those found in this BAA, and agree to implement reasonable and appropriate safeguards to protect PHI consistent with the requirements of this BAA.

3.5. Access to PHI. DNAnexus will make PHI In a Designated Record Set available to ▇▇▇▇▇▇ so that ▇▇▇▇▇▇ can comply with 45 C.F.R. § 164.524.

3.6. Amendment to PHI. DNAnexus will make PHI in a Designated Record Set available to ▇▇▇▇▇▇ for amendment and incorporate any amendments to the PHI, as may reasonably be requested by ▇▇▇▇▇▇ in accordance with 42 U.S.C. § 17935(e) and 45 C.F.R. § 164.526. DNAnexus shall notify ▇▇▇▇▇▇ within five (5) days of receipt of a request for access to PHI.

3.7. Accounting of Disclosures. DNAnexus will make available to ▇▇▇▇▇▇ the information required to provide an accounting of Disclosures in accordance with 42 U.S.C. § 17935(c) and 45 C.F.R. § 164.528 of which DNAnexus is aware, within thirty (30) days after such information is requested by ▇▇▇▇▇▇.

3.8. Internal Records. DNAnexus will make its internal practices, books, and records relating to the Use and Disclosure of PHI available to the Secretary of the U.S. Department of Health and Human Services (“HHS”) for purposes of determining ▇▇▇▇▇▇’▇ compliance with HIPAA. Nothing in this section will waive any applicable privilege or protection, including with respect to trade secrets and confidential commercial Information.

3.9. Restrictions and Accommodations. In the event ▇▇▇▇▇▇ agrees with an Individual to any restrictions on Use or Disclosure of PHI pursuant to 45 CFR Section 164.522(a) or if ▇▇▇▇▇▇ determines that it is obligated to accommodate a reasonable request of an Individual to receive communications of PHI pursuant to 45 CFR Section 164.522(b), ▇▇▇▇▇▇ promptly shall notify DNAnexus of the same, as well as any revocation or modification of the same, and DNAnexus thereupon shall observe such restriction or accommodation (or revocation or modification, if any, thereof) to the extent applicable to its Use or Disclosure of PHI hereunder, notwithstanding any other provision hereof, except as otherwise required by law.

3.10. Delegated Responsibilities. To the extent that DNAnexus carries out one or more of ▇▇▇▇▇▇’▇ obligations under Subpart E of 45 C.F.R. Part 164, DNAnexus must comply with the requirements of Subpart E that apply to the ▇▇▇▇▇▇ in the performance of such obligations.

3.11. Minimum Necessary. DNAnexus (and its Subcontractors) shall, to the extent practicable, limit its request, Use, or Disclosure of PHI to the minimum amount of PHI necessary to accomplish the purpose of the request, Use or Disclosure, in accordance with 42 U.S.C. § 17935(b) and 45 C.F.R. § 164.502(b)(1) or any other guidance issued thereunder.

3.12. Acknowledgement. DNAnexus acknowledges that it is obligated by law to comply, and represents and warrants that it shall comply, with all applicable provisions of the Covered Laws. DNAnexus shall comply with all applicable state privacy and security laws, to the extent that such state laws are not preempted by HIPAA or the HITECH Act.

4. ▇▇▇▇▇▇’▇ Obligations

4.1. Appropriate Use of HIPAA Accounts. ▇▇▇▇▇▇ is responsible for implementing appropriate privacy and security safeguards in order to protect PHI in compliance with HIPAA and this BAA.

4.2. Limitations in Notice of Privacy Practices. ▇▇▇▇▇▇ shall notify DNAnexus of any limitations in its Notice of Privacy Practices to the extent that such limitations affect DNAnexus’s Use or Disclosure of PHI.

4.3. Necessary Consents. ▇▇▇▇▇▇ will obtain any necessary authorizations, consents, and other permissions that may be required under applicable law prior to placing PHI in the DNAnexus System.

4.4. Change in Permissions. ▇▇▇▇▇▇ shall notify DNAnexus of any changes in or revocation of permission by an individual regarding the Use or Disclosure of PHI, to the extent that such changes may affect DNAnexus’s Use or Disclosure of PHI.

4.5. Restrictions on Disclosures. ▇▇▇▇▇▇ will not agree to any restriction requests or place any restrictions in any notice of privacy practices that violate or cause DNAnexus to violate this BAA or any applicable law.

5. Indemnification. Notwithstanding anything to the contrary which may be contained in any Agreement, including but not limited to any limitations on liability contained therein, either party (“Indemnifying Party”) hereby agrees to indemnify and hold harmless the other party (“Indemnified Party”) and its respective officers, directors, managers, members, employees and agents from and against any and all losses, damages, fines, penalties, claims or causes of action and associated expenses (including, without limitation, court costs and attorney’s fees) arising from Indemnified Party’s (including its employees, directors, officers, agents, or other members of its Workforce, and its Subcontractors) breach of this BAA or its violation of any Laws, or otherwise arising from Indemnified Party’s negligence or wrongful acts or omissions, including but not limited to failure to perform its obligations, that result in a violation of Laws.

6. Term and Termination.

6.1. Term. The term of this BAA will commence on the BAA Effective Date and will remain in effect BAA until the earliest of (a) the termination of the Agreement, (b) notification by ▇▇▇▇▇▇ that an account is no longer subject to this BAA; or (c) termination of this BAA pursuant to this BAA, which must be in a manner consistent with applicable Law.

6.2. Termination. Either party has the right to terminate this BAA in the event the other party breaches a material term of this BAA and fails to cure such breach within ten (10) days of receiving such notification, provided the non-breaching party may terminate this BAA immediately upon written notice in the event the non-breaching party reasonably determines such breach cannot be cured. A material breach of this BAA will be treated as a material breach of the Agreement.

6.3. Effect of Termination. At termination of this BAA, DNAnexus, to the extent feasible, will return or destroy all PHI that DNAnexus still maintains in any form and retain no copies of such information or, if such return or destruction is not feasible, (a) retain only that PHI which is necessary for DNAnexus to continue its proper management and administration or to carry out its legal responsibilities; (b) return to ▇▇▇▇▇▇ the remaining PHI that the DNAnexus still maintains in any form; (c) extend the protections of this BAA to the information and (d) limit further Uses and Disclosures to those purposes that make the return or destruction of the information infeasible; and (e) return to ▇▇▇▇▇▇ the PHI retained by DNAnexus when it is no longer needed by DNAnexus for its proper management and administration or to carry out its legal responsibilities.

6.4. No Agency Relationship. As set forth in the Agreement, nothing in this BAA is intended to make either party an agent of the other. Nothing in this BAA is intended to confer upon ▇▇▇▇▇▇ the right or authority to control DNAnexus’s conduct in the course of DNAnexus’s complying with the Agreement and BAA.

6.5. Nondisclosure. Each party agrees that the terms of this BAA are not publicly known and Confidential Information of each party under the Agreement.

6.6. Entire Agreement; Conflict. This BAA, together with the Agreement: (a) is intended by the parties as a final, complete and exclusive expression of the terms of their agreement; and (b) supersedes all prior agreements and understandings (whether oral or written) between the parties with respect to the subject matter hereof. If there is a conflict between the Agreement, this BAA or any other amendment or addendum to the Agreement or this BAA, the document later in time will prevail or if the documents have the same effective date, this BAA will prevail.

6.7. Counterparts and Electronic Delivery. This BAA may be executed in two or more counterparts, each of which will be deemed an original and all of which taken together will be deemed to constitute one and the same document. The parties may sign and deliver this BAA by electronic transmission.

IN WITNESS WHEREOF, the parties have executed this BAA as of the BAA Effective Date.

DNAnexus, Inc.	▇▇▇▇▇▇, Inc.



By; /s/▇▇▇▇▇▇▇ ▇. ▇’▇▇▇▇▇	By: /s/▇▇▇▇▇▇▇▇ ▇▇▇▇▇▇
Name: ▇▇▇▇▇▇▇ ▇. ▇’▇▇▇▇▇	Name: ▇▇▇▇▇▇▇▇ ▇▇▇▇▇▇
Date: 9/19/14	Date: 9/22/14

EXHIBIT E

Information Security Requirements

[Exhibit E was omitted in the original]

CONFIDENTIAL

DNAnexus, Inc.

Amendment to the Application

Service Provider Agreement dated September 19, 2014

This Amendment (“Amendment”) is made as of June 8th 2015(“Amendment Effective Date”) by and between DNAnexus, Inc., a Delaware corporation, having its principal place of business at ▇▇▇▇ ▇. ▇▇ ▇▇▇▇▇▇ ▇▇▇▇, ▇▇▇▇▇ ▇▇▇, ▇▇▇▇▇▇▇▇ ▇▇▇▇, ▇▇ ▇▇▇▇▇ (“Vendor”), and ▇▇▇▇▇▇, Inc., having its principal place of business at ▇▇▇ ▇▇▇▇▇▇▇▇▇▇ ▇▇▇▇, ▇▇▇▇▇ ▇▇▇, ▇▇▇ ▇▇▇▇▇▇, ▇▇ ▇▇▇▇▇ (“▇▇▇▇▇▇”).

Vendor and ▇▇▇▇▇▇ agree to amend the Application Service Provider Agreement having an effective date of September 19, 2014 (“Agreement”) as follows:

1. Exhibit B of the Agreement is hereby replaced with Exhibit B of this Amendment.

IN WITNESS WHEREOF, the parties have executed this Amendment as of the Amendment Effective Date.

	Vendor		▇▇▇▇▇▇, Inc.

By:	/s/▇▇▇▇▇▇▇ ▇. ▇’▇▇▇▇▇	By:	/s/▇▇▇▇▇▇▇▇ ▇▇▇▇▇▇

Name:	▇▇▇▇▇▇▇ ▇. ▇’▇▇▇▇▇	Name:	▇▇▇▇▇▇▇▇ ▇▇▇▇▇▇

Title:	VP Sales	Title:	CTO

Page 1 of 3

CONFIDENTIAL

EXHIBIT B

SERVICES; FEES

Vendor pricing is composed of two components:

Resource-based pricing: Variable compute, storage, and networking usage of the DNAnexus platform.

Per-test pricing: Additional value add per delivered test for ongoing consulting, implementation, prioritized development, and premium support.

Resource-based pricing

All DNAnexus usage, including R&D and production pipeline execution, is charged according to the below pricing sheet:

Compute
Cost Class	Cost per virtual core hour
[*]	[*]
[*]	[*]
[*]	[*]
[*]	[*]
[*]	[*]
[*]	[*]
Data Transfer & Storage
Service	Cost
[*]	[*]
[*]	[*]
[*]	[*]
[*]	[*]
[*]	[*]

Resource-based pricing shall be updated from time to time by a signed agreement reflecting Vendor’s current list pricing.

Per-test pricing

* CERTAIN INFORMATION HAS BEEN OMITTED AND FILED SEPARATELY WITH THE SECURITIES AND EXCHANGE COMMISSION. CONFIDENTIAL TREATMENT HAS BEEN REQUESTED WITH RESPECT TO THE OMITTED PORTIONS.

Page 2 of 3

CONFIDENTIAL

A value add charge is applied to each execution of a billable production test, based upon the following tiers of monthly production test volumes:

Value-add price per test	Production test monthly volume
[*]	Up to [*] production tests
[*]	Each production test over [] up to []
[*]	Each production test over [*]

Prices in lower priced tiers apply only to the number of tests above the lower threshold associated with the tier and not exceeding any upper threshold. Example calculations are as follows:


Number of Tests in One Month	Total Per-Test Pricing Cost
9,000	[*]
10,500	[*]
30,000	[*]

[*] per test for computation

[*] per test per month for ongoing storage

[*] per test for network transfer

Modifying analysis steps or adjusting the volume of data will alter the final pricing in accordance with the resource-based pricing scheme.

* CERTAIN INFORMATION HAS BEEN OMITTED AND FILED SEPARATELY WITH THE SECURITIES AND EXCHANGE COMMISSION. CONFIDENTIAL TREATMENT HAS BEEN REQUESTED WITH RESPECT TO THE OMITTED PORTIONS.

Page 3 of 3

CONFIDENTIAL

DNAnexus, Inc.

Second Amendment to the Application

Service Provider Agreement dated September 19, 2014

This Second Amendment (“Second Amendment”) is made as of December 29, 2016 (“Second Amendment Effective Date”) by and between DNAnexus, Inc., a Delaware corporation, having its principal place of business at ▇▇▇▇ ▇. ▇▇ ▇▇▇▇▇▇ ▇▇▇▇, ▇▇▇▇▇ ▇▇▇, ▇▇▇▇▇▇▇▇ ▇▇▇▇, ▇▇ ▇▇▇▇▇ (“Vendor”), and ▇▇▇▇▇▇, Inc., having its principal place of business at ▇▇▇ ▇▇▇▇▇▇▇▇▇▇ ▇▇▇▇, ▇▇▇▇▇ ▇▇▇, ▇▇▇ ▇▇▇▇▇▇, ▇▇ ▇▇▇▇▇ (“▇▇▇▇▇▇”).

Vendor and ▇▇▇▇▇▇ agree to amend the Application Service Provider Agreement having an effective date of September 19, 2014 (“Agreement”), as amended by the Amendment dated June 8, 2015, as follows:

1. Section 2 of the Agreement is hereby amended such that the first sentence thereof is deleted in its entirety and replaced with the following:

“The term of this Agreement shall commence on the Effective Date and continue in full force until December 31, 2019 (the “Initial Term”).”

2. Section 24.3 of the Agreement is hereby replaced in its entirety with the following:

“24.3 Termination for Convenience. Without reason, penalty or breach of this Agreement and notwithstanding the other Party’s compliance with all requirements of this Agreement, ▇▇▇▇▇▇ at any time and Vendor beginning at the start of the first Renewal Term may terminate this Agreement or any Statement of Work, Service, or Deliverable, provided that written notice is given to the other Party at least [*] prior to the date of termination if ▇▇▇▇▇▇ is the terminating Party and at least [*] prior to the date of termination if Vendor is the terminating Party.”

3. Section 24.4(a) of the Agreement is hereby replaced in its entirety with the following:

“(a) Vendor shall cease to perform the Services; ▇▇▇▇▇▇ will pay to Vendor all sums due to Vendor for Services properly performed through the effective date of such expiration or termination (prorated as appropriate); and, any compensation allocated to Services that were yet to be rendered with regard to any canceled aspect of the Services shall be refunded to ▇▇▇▇▇▇ (prorated as appropriate).”

4. Exhibit B of the Agreement is hereby replaced in its entirety with Exhibit B of this Amendment.

5. Exhibit C of the Agreement is hereby replaced in its entirety with Exhibit C of this Amendment.

* CERTAIN INFORMATION HAS BEEN OMITTED AND FILED SEPARATELY WITH THE SECURITIES AND EXCHANGE COMMISSION. CONFIDENTIAL TREATMENT HAS BEEN REQUESTED WITH RESPECT TO THE OMITTED PORTIONS.

Page 1 of 10

CONFIDENTIAL

IN WITNESS WHEREOF, the parties have executed this Amendment as of the Second Amendment Effective Date.

	Vendor		▇▇▇▇▇▇, Inc.

By:	/s/▇▇▇▇▇▇▇ ▇▇▇▇	By:	/s/▇▇▇▇▇▇▇▇ ▇▇▇▇▇▇

Name:	▇▇▇▇▇▇▇ ▇▇▇▇	Name:	▇▇▇▇▇▇▇▇ ▇▇▇▇▇▇

Title:	CEO	Title:	CTO

Page 2 of 10

CONFIDENTIAL

EXHIBIT B

SERVICES; FEES

Vendor pricing is composed of two components:

Resource-based pricing: Variable compute, storage, and networking usage of the DNAnexus platform.

Per-test pricing: Additional value add per delivered test for ongoing consulting, implementation, prioritized development, and premium support.

Subject to ▇▇▇▇▇▇’▇ payment of the annual license fee and the terms under “Committed Fees” below, the total ▇▇▇▇ to ▇▇▇▇▇▇ each calendar month will be based on the number of tests as well as the accrued compute, storage, and networking usage according to the below price schedules.

Committed Fees

DNAnexus will charge ▇▇▇▇▇▇ a non-refundable annual license fee of [*] (the “License Limit”) for a period of [*] commencing on January 1, 2017, and continuing for the calendar years of [*] (each a “License Year”). DNAnexus shall submit invoices to ▇▇▇▇▇▇ in advance of each License Year (December 2016 for License Year 2017, and subsequent invoices in [*] for use of [*] (“Yearly License Limit”) at Discounted Pricing. Should customer utilize services in excess of the Yearly License Limit at any point during the respective License Year, DNAnexus will charge contingent fees to ▇▇▇▇▇▇ for usage in excess of the Yearly License Limit at [*] Resource-based and [*] Per-test Pricing, until commencement of the next License Year. Notwithstanding the foregoing, in the event DNAnexus terminates the Agreement for convenience (Section 24.3), or ▇▇▇▇▇▇ terminates the Agreement pursuant to the terms of Section 24.1 or 24.2, the license fee will be refunded to ▇▇▇▇▇▇ prorated in an amount commensurate with services provided through the effective date of the termination. Notwithstanding the foregoing, once ▇▇▇▇▇▇ has [*], ▇▇▇▇▇▇ shall no longer be obligated to pay any further License Limits, and once ▇▇▇▇▇▇ has [*], any further License Limit shall be reduced by [*].

Resource-based pricing

All DNAnexus usage, including R&D and production pipeline execution, is charged according to the below pricing sheet. For future AWS compute and storage public price reductions DNAnexus will reduce compute and storage prices and pass through [*] of the AWS price reduction. For example, if AWS reduces their price for compute by 10% DNAnexus will reduce ▇▇▇▇▇▇’▇ equivalent compute price by [*]. DNAnexus and ▇▇▇▇▇▇ will review AWS price changes and update the price schedules [*] as needed.

* CERTAIN INFORMATION HAS BEEN OMITTED AND FILED SEPARATELY WITH THE SECURITIES AND EXCHANGE COMMISSION. CONFIDENTIAL TREATMENT HAS BEEN REQUESTED WITH RESPECT TO THE OMITTED PORTIONS.

Page 3 of 10

CONFIDENTIAL

The following table shall be used to calculate the weighted average price reduction in each [*] period for each DNANexus Compute Cost Class:


DNANexus Compute Cost Class	AWS Instance
[*]	[*]
[*]	[*]
[*]	[*]
[*]	[*]
[*]	[*]
[*]	[*]
[*]	[*]
[*]	[*]
[*]	[*]
[*]	[*]
[*]	[*]
[*]	[*]
[*]	[*]
[*]	[*]
[*]	[*]


Compute
Cost Class	Cost per virtual core hour
[*]	[*]
[*]	[*]
[*]	[*]
[*]	[*]
[*]	[*]
[*]	[*]
Data Transfer & Storage
Service	Cost
[*]	[*]
[*]	[*]
[*]	[*]
[*]	[*]
[*]	[*]

Resource-based pricing shall be updated from time to time by a signed agreement reflecting Vendor’s current list pricing.

* CERTAIN INFORMATION HAS BEEN OMITTED AND FILED SEPARATELY WITH THE SECURITIES AND EXCHANGE COMMISSION. CONFIDENTIAL TREATMENT HAS BEEN REQUESTED WITH RESPECT TO THE OMITTED PORTIONS.

Page 4 of 10

CONFIDENTIAL

Per-test pricing

A “production test” is composed of [*] Accounting for number of “production tests” will be done by counting all [*] generated by the production test pipeline and applying a proportion [*] that reflects the [*], with the ratio to be reasonably agreed upon by ▇▇▇▇▇▇ and DNAnexus. At the end of each three month period, the numbers shall be adjusted to reflect the number of units billed by ▇▇▇▇▇▇ to its customers in that period.

A value add charge is applied to each execution of a billable production test, based upon the following tiers of monthly production test volumes:

Value-add price per test	Production test monthly volume
[*]	Up to [*] production tests
[*]	Each production test over [] up to []
[*]	Each production test over [*]

Prices in lower priced tiers apply only to the number of tests above the lower threshold associated with the tier and not exceeding any upper threshold. Example calculations are as follows:

Number of Tests in One Month	Total Per-Test Pricing Cost
9,000	[*]
10,500	[*]
30,000	[*]

[*] per test for computation

[*] per test per month for ongoing storage

[*] per test for network transfer

Based on currently implemented analysis pipelines, the combined resource-based and per-test pricing is estimated at [*] for compute at the highest volume tier, and [*] per test per month for ongoing storage.

Modifying analysis steps or adjusting the volume of data will alter the final pricing in accordance with the resource-based pricing scheme.

* CERTAIN INFORMATION HAS BEEN OMITTED AND FILED SEPARATELY WITH THE SECURITIES AND EXCHANGE COMMISSION. CONFIDENTIAL TREATMENT HAS BEEN REQUESTED WITH RESPECT TO THE OMITTED PORTIONS.

Page 5 of 10

CONFIDENTIAL

Discounted Pricing

[*]

Discounted Resource-based pricing

[*]:

[*]
[*]	[*]
[*]	[*]
[*]	[*]
[*]	[*]
[*]	[*]
[*]	[*]
[*]	[*]
[*]
[*]	[*]
[*]	[*]
[*]	[*]
[*]	[*]
[*]	[*]
[*]	[*]

Discounted Per-test pricing

A value add charge is applied to each execution of a billable production test, based upon the following tiers of monthly production test volumes:


Value-add price per test	Production test monthly volume
[*]	Up to [*] production tests
[*]	Each production test over [] up to []
[*]	Each production test over [*]

* CERTAIN INFORMATION HAS BEEN OMITTED AND FILED SEPARATELY WITH THE SECURITIES AND EXCHANGE COMMISSION. CONFIDENTIAL TREATMENT HAS BEEN REQUESTED WITH RESPECT TO THE OMITTED PORTIONS.

Page 6 of 10

CONFIDENTIAL

EXHIBIT C

SERVICE LEVELS

“Host” shall be a cloud services provider, currently AWS.

“Server” shall mean the server(s) on which the Services will be hosted.

2. General Hosting Obligations. In addition to the other obligations set forth in the Agreement and this Exhibit, Vendor shall do the following:

Operate the Services on a Server owned and securely maintained by the Host.

Allow access to the Services over the Internet and provide secure and confidential storage of all information transmitted to and from the Services.

Maintain ability to redeploy at a geographically different site (e.g., different flood plain and power grid) from where the Server is located, to ensure continuous service in the event of disaster.

Review security notifications and alerts relevant to the hosting platform (e.g., Vendor notifications of bugs, attacks, patches), and apply as appropriate to maintain a reasonable level of defense.

4. Service Monitoring & Management. Vendor will perform continuous monitoring and management of the Services to optimize availability of Services. Included within the scope of this section is the proactive monitoring of the Server and all service components of Vendor’s firewall for trouble on a 7-day by 24-hour basis, and the expedient restoration of components when failures occur within the time period set forth in Section 10 (Service Outages) of this Exhibit.

* CERTAIN INFORMATION HAS BEEN OMITTED AND FILED SEPARATELY WITH THE SECURITIES AND EXCHANGE COMMISSION. CONFIDENTIAL TREATMENT HAS BEEN REQUESTED WITH RESPECT TO THE OMITTED PORTIONS.

Page 7 of 10

CONFIDENTIAL

Work the problems continuously until resolution, escalating to management or to engineering as required;

Promptly notify ▇▇▇▇▇▇ of final resolution, along with any pertinent findings or action taken, and requests concurrence to close the trouble ticket.

6. Service Levels.

Vendor shall make the Services (excluding any consulting or other professional services) available at a Monthly Uptime Percentage (defined below) of at least [*] during any monthly billing cycle (the “Service Level Commitment”). In the event that Vendor fails to meet the Service Level Commitment in any given month, ▇▇▇▇▇▇ will be eligible to receive a Service Credit for that month as described below. At least once annually, technical and business representatives of both parties will meet to review the Service Level terms of this Section 6 to ensure the performance metrics and delivery of the Services are in alignment with ▇▇▇▇▇▇’▇ requirements.

6.1 “Monthly Uptime Percentage” is calculated by subtracting from 100% the percentage of minutes during the month in which the Services were in a state of Service Unavailability.

6.2 Subject to the exclusions in Section 6.3 below, “Service Unavailability” means any disruption of a ▇▇▇▇▇▇ User’s access to or use of any Services or Deliverables, where disruption means an inability to access or use, or a delay in accessing or using, the Service or Deliverable, and which includes but is not limited to:

(a) General unavailability of DNANexus API servers to a ▇▇▇▇▇▇ User;

(b) Slowness of DNANexus platform causing disruption for ▇▇▇▇▇▇ “Production Review” processes or any other modules, where “slowness” is defined as a service interruption where, in any [*] interval in which at least [*] API requests from ▇▇▇▇▇▇’▇ production review user are processed, at least [*] of these API requests take more than [*];

(d) Job/subjob failures;

(e) Inability of a ▇▇▇▇▇▇ User to log in to the Services;

(f) Inability of a ▇▇▇▇▇▇ User to transfer data to and from the Services; and,

* CERTAIN INFORMATION HAS BEEN OMITTED AND FILED SEPARATELY WITH THE SECURITIES AND EXCHANGE COMMISSION. CONFIDENTIAL TREATMENT HAS BEEN REQUESTED WITH RESPECT TO THE OMITTED PORTIONS.

Page 8 of 10

CONFIDENTIAL

(g) Inability of a ▇▇▇▇▇▇ User to run jobs on the Services.

6.3 The Service Level Commitment does not apply to any delay of service due to:

(a) maintenance activities during a 30 minute window scheduled on Tuesdays from 1:00 pm to 8:00 pm Pacific Time;

(b) maintenance activities for which notification is provided at least [*] in advance;

(c) disabled log in due to lack of user log in activity during a prescribed period or due to excessive failed log in attempts or

Service Credits will apply only [*] ▇▇▇▇▇▇. Service Credits will not entitle ▇▇▇▇▇▇ to [*]. A Service Credit will be applicable and issued only if the credit amount for the applicable monthly billing cycle is greater than $10. Unless otherwise provided in this Agreement and subject to Vendor meeting its other obligations under this Agreement, including without limitation its obligations under Sections 14.1(a) and (c) of the Agreement and Section 4 of this Exhibit, ▇▇▇▇▇▇’▇ sole and exclusive remedy for any unavailability, non-performance, or other failure by Vendor to provide Service according to this Exhibit C is the receipt of a Service Credit (if eligible). Notwithstanding the foregoing, if a Service Unavailability lasts for more than [*] (an “Extreme Service Unavailability”), the Service Credit shall not be ▇▇▇▇▇▇’▇ sole and exclusive remedy, and, in addition to all other remedies available to ▇▇▇▇▇▇ under this Agreement or at law, this shall constitute a Release Condition under the Escrow, and ▇▇▇▇▇▇ shall have access to and use of one of the primary developers of the Vendor System to assist ▇▇▇▇▇▇ in seeking to remedy the Service Unavailability.

* CERTAIN INFORMATION HAS BEEN OMITTED AND FILED SEPARATELY WITH THE SECURITIES AND EXCHANGE COMMISSION. CONFIDENTIAL TREATMENT HAS BEEN REQUESTED WITH RESPECT TO THE OMITTED PORTIONS.

Page 9 of 10

CONFIDENTIAL

9. Corrective Action Plan. Notwithstanding Vendor’s obligation to continue to perform as required under the Agreement and this Exhibit and ▇▇▇▇▇▇’▇ remedies set forth herein, if ▇▇▇▇▇▇ does not terminate the Agreement after [*] Service Level Failures in any [*] period during the Term, Vendor shall promptly investigate the root causes of such Service Level Failure and shall provide to ▇▇▇▇▇▇ (within [*] after the end of the month in which the second Service Level Failure occurred) an analysis of such root causes and a proposed corrective action plan for ▇▇▇▇▇▇’▇ review, comment and approval (the “Corrective Action Plan”). The Corrective Action Plan shall include, at a minimum: (i) a commitment by Vendor to ▇▇▇▇▇▇ to devote the appropriate time, skilled personnel, systems support and equipment, and/or resources to remedy, and prevent any further occurrences of, the Service Level Failure; (ii) a strategy for developing any programming/software updates, fixes, patches, etc. necessary to remedy, and prevent any further occurrences of, the Service Level Failure; and (iii) time frames for implementation of the Corrective Action Plan. There shall be no additional charge (other than those fees set forth in the Agreement) for Vendor’s implementation of such Corrective Action Plan in the time frames and manner set forth in the Corrective Action Plan.

10. Service Outages.

10.1 Scheduled. Other than outages due to maintenance activities set forth in Section 6.3(a) of this Exhibit, Vendor shall notify ▇▇▇▇▇▇ of scheduled outages at least [*] in advance.

10.2 Unscheduled. Promptly upon notice of an unscheduled outage, Vendor personnel shall:

Work the problems until resolution, escalating to management or to engineering as required;

Promptly notify ▇▇▇▇▇▇ of final resolution, along with any pertinent findings or action taken.

Confirm the threat;

Deny access from the source of the attack;

Investigate the extent of the damage, if any;

Back-up the affected systems and those suspected to be affected;

Strengthen defenses everywhere, not just the suspected path that the attacker used;

Contact the ISP where the threat or attack originated and/or law enforcement to work with Vendor’s security team;

Produce an Incident Report within 3 business days detailing Vendor’s findings;

Re-instate the denial of access after a set time period, but continue to monitor traffic from that source until risk of further attacks is deemed to be minimized and

* CERTAIN INFORMATION HAS BEEN OMITTED AND FILED SEPARATELY WITH THE SECURITIES AND EXCHANGE COMMISSION. CONFIDENTIAL TREATMENT HAS BEEN REQUESTED WITH RESPECT TO THE OMITTED PORTIONS.

Page 10 of 10

CONFIDENTIAL

Apply any applicable network changes necessary to resolve a denial of service attack

Page 11 of 10

APPLICATION SERVICE PROVIDER AGREEMENT

Document Metadata

Document Metadata

Table of Contents

[*]
[*]	[*]
[*]	[*]
[*]	[*]
[*]	[*]
[*]	[*]
[*]	[*]
[*]	[*]
[*]
[*]	[*]
[*]	[*]
[*]	[*]
[*]	[*]
[*]	[*]
[*]	[*]

[*]
[*]	[*]
[*]	[*]
[*]	[*]
[*]	[*]
[*]	[*]
[*]	[*]
[*]	[*]
[*]
[*]	[*]
[*]	[*]
[*]	[*]
[*]	[*]
[*]	[*]
[*]	[*]

[*]
[*]	[*]
[*]	[*]
[*]	[*]
[*]	[*]
[*]	[*]
[*]	[*]
[*]	[*]
[*]
[*]	[*]
[*]	[*]
[*]	[*]
[*]	[*]
[*]	[*]
[*]	[*]