DATA USE AND LICENSE AGREEMENT

Definitions. For purposes of this Agreement, the following terms shall have the following meanings:

“CCPA” shall mean the California Consumer Privacy Act and its implementing regulations, as amended from time to time.

“CMIA” shall mean the California Confidentiality of Medical Information Act and its implementing regulations, as amended from time to time.

“De-Identified Health Information” shall mean health information that has been processed to remove or obscure any personal identifiers, in compliance HIPAA, CCPA, CMIA, and other applicable laws, so that the information does not identify individuals and there is no reasonable basis to believe that the information can be used to identify an individual.

“HIPAA” shall mean the Health Insurance Portability and Accountability Act and its implementing regulations, as amended from time to time.

“Recipient’s IT Assets” means, without limitation, Recipient’s information technology systems, servers, assets, or other electronic storage media.

Data Transfer. The parties hereby acknowledge that Recipient is already in possession of de-identified patient information (including dicom imaging files and certain de-identified patient information) that was obtained by recipient in the ordinary course of its business as a clinical medical center and as a former cooperating entity with QT Imaging Inc., which is now part of Recipient. This former cooperation was in the form of Discloser providing to QT Imaging Inc.: (a) clinical validation evidence for QT Imaging Inc.; (b) performing clinical trials for QT Imaging Inc. and (c) providing clinical data for QT Imaging Inc. to use in its applications to the United Stated

▇▇▇.▇▇▇▇▇▇▇▇▇.▇▇▇

Three ▇▇▇▇▇▇▇▇ Landing, ▇▇▇▇▇ ▇▇▇, ▇▇▇▇▇▇, ▇▇ ▇▇▇▇▇

Grant of License. Subject to the terms and conditions of this Agreement, Discloser hereby grants to Recipient a perpetual, non-exclusive, royalty-free, worldwide license to use, sublicense, reproduce, modify, display, adapt, publish, distribute, and create derivative works of the De-Identified Health Information for any and all lawful purposes, including, but not limited to, conducting research, education, marketing, and product development and entering into agreements with third parties related to the same. Recipient acknowledges that such De-Identified Health Information shall be used respecting the limitations imposed by applicable privacy laws and regulations. As between Recipient and Discloser, all right, title and interest in any aggregation of or derivations of the De-Identified Health Information and all intellectual property rights therein, belong to and are retained solely by Recipient. Further, Recipient shall be permitted to aggregate data received from external sources with the De-Identified Health Information and to use and disclose such integrated data, provided that the integrated data remains de-identified in accordance with applicable laws.

Discloser Representations and Warranties. Discloser represents, warrants, and covenants to Recipient that prior to disclosing the De-Identified Health Information to Recipient:

It has obtained any necessary authorizations, consents, and other permissions that may be required under applicable laws, including federal and state privacy and security laws, any requirements under an informed consent pursuant to a clinical trial or subject to any requirements from an Institutional Review Board, and/or HIPAA, to the extent applicable, to allow Recipient to legally use the De-Identified Health Information as permitted by this Agreement;

It, in cooperation with Recipient and any third party, has de-identified the De-Identified Health Information in accordance with all applicable laws, regulations, and standards relating to the privacy, data protection, including without limitation, HIPAA, specifically 45 C.F.R. § 164.514, CCPA, CMIA, and any amendments thereto or regulations promulgated thereunder, or other applicable state laws depending on the source of such data;

▇▇▇.▇▇▇▇▇▇▇▇▇.▇▇▇

Three ▇▇▇▇▇▇▇▇ Landing, ▇▇▇▇▇ ▇▇▇, ▇▇▇▇▇▇, ▇▇ ▇▇▇▇▇

It has implemented and shall maintain all administrative, physical, and technical safeguards required to protect the De-Identified Health Information against unauthorized access, use, or disclosure; and

It will not provide De-Identified Health Information that infringes a patent, trademark, trade secret, copyright or other proprietary rights of another person or entity or that violates any rights of privacy or publicity, or that defame or libel any person or entity, or offer De-Identified Health Information that Discloser does not have a right to make available under any law or under contractual or fiduciary relationships.

Prohibition of Transfer of Identifiable Health Information.

Prohibition of Transfer. Discloser covenants that it shall not upload, transfer, store, process, or otherwise place any identifiable health information, as defined HIPAA, CCPA, CMIA, or any other applicable state law and their accompanying regulations, on Recipient’s IT Assets. Discloser acknowledges and agrees that the insertion of identifiable health information into Recipient’s IT Assets is strictly prohibited and would constitute a material breach of this Agreement.

Maintaining Data Integrity. Discloser shall implement and maintain appropriate safeguards designed to ensure that no identifiable health information is inadvertently or purposefully placed upon Recipient’s IT Assets. These safeguards shall include, but are not limited to, data de-identification protocols, and periodic audits of data to be provided to Recipient under this Agreement.

Immediate Notification and Remediation. In the event that Discloser becomes aware, or has reason to believe, that any identifiable health information may have been transmitted to Recipient’s IT Assets, Discloser shall immediately notify Recipient and take all necessary steps to remove such information and rectify the situation, including assisting with any necessary forensic investigations, at Discloser’s sole expense.

Recipient Obligations. Recipient agrees to:

Use the De-Identified Health Information only for lawful purposes and in compliance with the terms of this Agreement.

Use any clinical information or data obtained from Discloser in compliance with any Institutional Review Board (“IRB”) regulations or that the use of such clinical data will be certified as exempt from any IRB review, if Recipient uses such information for clinical trial, clinical studies, publications, or for regulatory submission purposes.

Implement and maintain appropriate security measures to protect the De-Identified Health Information from unauthorized use or disclosure as may be required by applicable law or regulation;

Not to re-identify, or attempt to re-identify, the de-identified data without prior written consent from Discloser and in full compliance with applicable laws and regulations; and

Notify Discloser upon becoming aware of the occurrence of any inadvertent re-identification of the Data.

Recipient acknowledges that by the end of April 2024, it does not have any identifiable patient data on any of its IT assets, including any off-site or back-up assets in the cloud or elsewhere.

No Warranty. Except for the representations, warranties, and covenants expressly provided in this Agreement, the De-Identified Health Information is provided “AS IS” and Discloser makes no other warranties, express or implied, as to the accuracy, completeness, or fitness for a particular purpose of the De-Identified Health Information.

▇▇▇.▇▇▇▇▇▇▇▇▇.▇▇▇

Three ▇▇▇▇▇▇▇▇ Landing, ▇▇▇▇▇ ▇▇▇, ▇▇▇▇▇▇, ▇▇ ▇▇▇▇▇

Term and Termination. This Agreement shall be effective as of the Effective Date and shall continue until terminated by either party upon one hundred twenty (120) days’ written notice to the other party. This Agreement may also be terminated at any time by the mutual written agreement of the parties. In the event that either party substantially fails to perform any of its material obligations under this Agreement, the other party may give written notice to the non-performing party specifying the obligation(s) not performed and demanding performance within thirty (30) days. If at the end of the thirty (30) day period the non-performing party has not performed the specified obligation(s), the party giving notice may terminate this Agreement immediately upon additional written notice to the non-performing party within fifteen (15) days following the end of such thirty (30) day cure period. Upon termination or expiration of this Agreement, Recipient shall maintain the license set forth in Section 3 with respect to De-Identified Health Information provided up until the Termination Date, but there shall be no further transfer of new De-Identified Health Information between the parties.

Indemnification. Discloser shall indemnify, defend, and hold harmless Recipient, its officers, directors, employees, agents, successors, and assigns from and against any and all claims, actions, demands, liabilities, losses, damages, actions, judgments, penalties, settlements, fines, costs, and expenses of whatever kind (including lawyers’ fees) arising out of or in connection with: (a) any breach by Discloser of any provision in this Agreement; (b) any third-party claim that the use of the De-Identified Health Information by Recipient in accordance with the rights granted to it under this Agreement infringes upon, violates, or contravenes any law, regulation, or rights of a third party; or (c) any breach by Recipient of applicable law. However, Discloser will not be obligated to indemnify Recipient to the extent that any such claim arises from Recipient’s violation of Section 6. This Section 9 shall survive termination of the Agreement.

Independent Contractors. The parties to this Agreement are independent contractors with respect to all matters contained herein and are not agents of the other. Nothing in this Agreement is intended or shall be construed to create any employer/employee relationship, joint venture relationship, or to allow the parties to exercise control over one another or the manner in which their employees or agents perform their obligations under this Agreement.

Notice. All notices, consents, waivers and other communications required or permitted under this Agreement shall be sufficiently given for all purposes hereunder if in writing and (i) hand delivered, (ii) sent by certified or registered mail, return receipt requested and proper postage prepaid, or (iii) sent by a nationally recognized courier service, in each case to the address and to the attention of the person (by name or title) set forth on, or to such other address and to the attention of such other person as a party may designate by written notice to the other party:

▇▇▇.▇▇▇▇▇▇▇▇▇.▇▇▇

Three ▇▇▇▇▇▇▇▇ Landing, ▇▇▇▇▇ ▇▇▇, ▇▇▇▇▇▇, ▇▇ ▇▇▇▇▇

No Third-Party Beneficiaries. Nothing in this Agreement shall confer upon any person, other than the parties and their respective successors or assigns, any rights, remedies, obligations, or liabilities whatsoever.

Assignment; Binding Effect. Neither of the parties may assign its respective rights and duties under this Agreement without the prior written consent of the other party, and any assignment without such prior written consent shall be null and void. Notwithstanding the foregoing, Company may assign this Agreement, in whole or in part, without the other party’s prior written consent to any successor in interest or third party that acquires all or substantially all of the Company’s assets. This Agreement shall be binding upon and inure to the benefit of the parties, and their respective successors and permitted assigns.

Authority. Each party represents and warrants to the other party that it has the capacity to enter into this Agreement; that this Agreement is a valid and binding agreement enforceable against such party; and that the execution of this Agreement and performance its duties hereunder does not violate or conflict with any court order, governmental order, agreement, instrument or commitment by which such party is otherwise bound.

Waiver. Any waiver by a party of a breach of any provision of this Agreement shall not operate or be construed as a waiver of any other provision hereof and shall not be effective at any time unless in writing and signed by the parties. A waiver of any of the terms and conditions hereto shall not be construed as a general waiver, and such waiving party shall be free to reinstate any such term or condition, with or without notice to the other party.

Entire Agreement; Amendment. This Agreement constitutes the entire agreement of the parties with respect to the subject matter hereof and supersedes any and all prior or contemporaneous agreements between the parties hereto, whether oral or written, with respect to such subject matter. This Agreement may be amended or modified only in a written instrument signed by the parties hereto.

Governing Law. This Agreement shall be governed by and construed in accordance with the laws of the State of California, without regard to conflicts-of-law principles that would require the application of any other law.

Venue; Waiver of Jury Trial. Each of the parties hereby irrevocably and unconditionally (i) consents to submit to the exclusive jurisdiction of the courts of California for any action or proceeding arising out of or relating to this Agreement and the transactions contemplated hereby (and agrees not to commence any such action or proceeding relating thereto except in such courts);

▇▇▇.▇▇▇▇▇▇▇▇▇.▇▇▇

Three ▇▇▇▇▇▇▇▇ Landing, ▇▇▇▇▇ ▇▇▇, ▇▇▇▇▇▇, ▇▇ ▇▇▇▇▇

Construction. This Agreement shall be interpreted without regard to any presumption or rule requiring construction against the party causing this Agreement to be drafted.

Counterparts; Facsimile Signatures. This Agreement may be executed in two (2) or more counterparts, each of which shall be deemed to be an original of this Agreement and all of which, when taken together, shall be deemed to constitute one and the same agreement. Any party may deliver an executed copy hereof by facsimile or electronic transmission to the other parties, and any such delivery shall have the same force and effect as delivery of a manually signed copy of this Agreement.

▇▇▇.▇▇▇▇▇▇▇▇▇.▇▇▇

Three ▇▇▇▇▇▇▇▇ Landing, ▇▇▇▇▇ ▇▇▇, ▇▇▇▇▇▇, ▇▇ ▇▇▇▇▇

▇▇▇.▇▇▇▇▇▇▇▇▇.▇▇▇

Three ▇▇▇▇▇▇▇▇ Landing, ▇▇▇▇▇ ▇▇▇, ▇▇▇▇▇▇, ▇▇ ▇▇▇▇▇