Research and Training Addendum

This Research and Training Addendum (the "Addendum") is entered into between the customer organisation that accepts it (the "Customer") and GetClinic Inc., a Delaware corporation, 74 E Glenwood Ave, Unit STE 5895, Smyrna, DE 19977, United States ("GetClinic"). It forms part of the Tulparus Terms of Service or the Cloud Services Agreement, whichever applies to the Customer (the "Agreement"). Capitalised terms used but not defined in this Addendum have the meanings given in the Agreement and the Data Processing Terms.

1. Purpose and acceptance

1.1 Purpose. Under the Agreement, the Data Processing Terms and the Business Associate Agreement, GetClinic does not use Customer Data to train or improve models. This Addendum sets out the only conditions on which GetClinic may do so.

1.2 Off by default. Training Use is off for every Organisation until the Customer switches it on under section 3. Nothing in this Addendum applies to a case unless every condition in section 4 is met for that case.

1.3 Acceptance. The Customer accepts this Addendum:

(a) in the Service, when an administrator changes the Training Policy from Off under section 3.2, in which case the Service records the version of this Addendum, the administrator who accepted it and the time; or

(b) by signing an Order Form that includes it.

Acceptance by Order Form does not switch Training Use on. The Training Policy stays Off until an administrator changes it in the Service.

2. Definitions

2.1 "Training Use" means the use of Examples by GetClinic to develop, train, tune, validate and evaluate models, under this Addendum.

2.2 "Training Policy" means the learning setting of the Organisation in the Service, with the modes Off, Per case and Whole organisation.

2.3 "Case Decision" means the decision recorded for a case in the Service: not decided, opted in or opted out.

2.4 "Research Consent" means the consent of the patient whose case it is (the proband), or of the patient's representative, recorded in the Service under the consent scope for research, as granted and not withdrawn or superseded.

2.5 "Accepted Outcome" means a statement of what a case turned out to be (confirmed diagnosis, partially explained, no diagnosis, or diagnosis revised), recorded in the Service with its source and accepted by a curator of the Customer who did not record it.

2.6 "Example" means the de-identified, coded record built from one eligible case under section 5.

2.7 "Training Set" means a set of Examples built at one time, with a manifest of its contents, held in the Training Store.

2.8 "Training Store" means the separate storage location for Training Sets described in section 6.

2.9 "Models" means the models, rule sets and parameters that GetClinic develops, including those trained, tuned or evaluated with Examples.

3. Switching Training Use on and off

3.1 Who may change the Training Policy. Only a User who holds the permission to manage the Organisation may change the Training Policy. The change requires a recent sign-in with a second factor. An API key, an integration and an AI Feature cannot change it.

3.2 Modes.

(a) Off. No case of the Organisation is used. This is the default.

(b) Per case. A case is used only where a User has opted it in.

(c) Whole organisation. Every case is used unless a User has opted it out.

In every mode, an opt-out of a case prevails.

3.3 Who may record a Case Decision. Only a User whose role allows the recording of consent may opt a case in or out. The decision requires a recent sign-in with a second factor. A Case Decision does not change the case, its Outputs or its reports.

3.4 Organisations that cannot take part. Training Use is available only to Organisations set up for clinical use. Demonstration, test and synthetic organisations never contribute Examples.

3.5 Switching off. The Customer may switch the Training Policy to Off, or opt any case out, at any time and without giving reasons. Section 9 describes the effect.

3.6 Records. Every change of the Training Policy and every Case Decision is recorded in the audit trail of the Organisation, with the User and the time.

4. Eligibility of a case

4.1 Conditions. A case is used only if, when a Training Set is built, all of the following are true:

(a) the Training Policy is Per case and the case is opted in, or the Training Policy is Whole organisation and the case is not opted out;

(b) the patient's Research Consent is granted;

(c) the case has at least one Accepted Outcome, and no two Accepted Outcomes of the case conflict;

(d) the case has been reported or closed; and

(e) no erasure of the case or of the patient's data has been requested.

4.2 Derived, not stored. Eligibility is worked out again from these records each time it is read and each time a Training Set is built. No User and no GetClinic operator can mark a case as eligible.

4.3 Visibility. The Service shows for each case whether it can be used, and which conditions are not met.

4.4 Relatives. Data about relatives is never part of an Example. A relative's consent is therefore not a condition.

5. What an Example contains

5.1 Content. An Example contains only:

(a) a random identifier created for the Example, which is not derived from any information about the patient or the case;

(b) the Accepted Outcomes of the case as codes: outcome kind, gene identifiers (HGNC), disease identifiers, the ACMG classification of the finding, the basis of confirmation and the kind of source;

(c) the proband's confirmed phenotype terms as HPO identifiers, each with its recorded state (present, absent, unknown or not tested), kept distinct;

(d) the proband's sex at birth; and

(e) the proband's age when the case was created, in a five-year band, with an open top band of 85 years and over.

5.2 Small groups. Where fewer than 5 Examples in a Training Set share the same diseases, age band and sex, the age band and sex are removed from those Examples.

5.3 Never included. An Example never contains names, dates of birth or any other date, record or sample numbers, addresses or any other location, contact details, free text of any kind (including clinical notes, history, referral letters, comments and feedback comments), document content, sequencing or variant files, variant positions or descriptions, pedigree structure, data about relatives, the content of AI Feature conversations, or any identifier of the Customer, its Organisation, its Users or the case.

5.4 No new categories without acceptance. GetClinic will not add a category of data to Examples unless the Customer accepts a new version of this Addendum that describes it.

5.5 De-identification before use. Examples are built inside the Service from the structured case record and are de-identified before they are written to the Training Store. The link between an Example and its case is kept only in the Customer's Organisation records in the Service. It is never copied to the Training Store, never given to the people or systems that use Training Sets, and is deleted on erasure under section 9.3.

5.6 Partitions. Each Example is assigned once, and permanently, to a training, validation or test part. The test part is used only to evaluate Models and never to train them.

6. Where Examples are processed

6.1 Location. Training Sets are stored and processed in GetClinic's environment in Amazon Web Services, in the United States (region us-east-1). Where the Organisation's Data Location is outside the United States, no Example is built from its cases until the parties have signed a written agreement that allows Examples to be transferred to the Training Store (section 7.6 of the Terms of Service or section 6.6(b) of the Cloud Services Agreement); until then its cases are not eligible under section 4. Examples are not taken from a private or air-gapped installation.

6.2 Training Store. The Training Store is separate from the storage of the Service, is encrypted with its own key, has no public access, and cannot be read by any Organisation, User or AI Feature of the Service. Only GetClinic's model training systems can read it, and only the Service's Training Set builder can write to it. Training Sets are written once and are not changed afterwards.

6.3 No outside providers. Examples and Training Sets are not sent to any third-party AI provider or model provider. Training runs in GetClinic's own environment.

6.4 Security. The Security Measures apply to the Training Store and to Training Use.

7. Permitted use and restrictions

7.1 Permitted use. GetClinic may use Examples only for Training Use for the following purposes:

(a) training and evaluating the models that rank and compare candidate genes and diseases;

(b) training and evaluating the ranking of candidates across the Service's channels; and

(c) evaluating the ordering of suggested next actions.

7.2 Restrictions. GetClinic will not:

(a) attempt to identify any patient, relative, User or organisation from an Example, or combine Examples with other data for that purpose;

(b) sell, rent or license Examples or Training Sets, or disclose them to any third party, except to a Sub-processor that hosts them under the Data Processing Terms;

(c) use Examples or Training Sets for advertising or marketing, or for decisions about any individual, including decisions on insurance, employment or credit;

(d) publish Examples or Training Sets; or

(e) give any Covered Person, or any person in a country of concern under 28 CFR Part 202, access to Examples, Training Sets or Models trained with them.

7.3 Model release. A Model trained or tuned with Examples is released to the Service only after it has passed GetClinic's evaluation on held-out data, never because its training loss is lower. Section 3.6 of the Terms of Service or of the Cloud Services Agreement (versions) applies to that release. A Model trained with Examples does not change the case from which an Example was built, or its Outputs or reports.

8. Ownership and confidentiality

8.1 Customer Data. As between the parties, the Customer continues to own Customer Data, including the case records from which Examples are built.

8.2 Models. GetClinic owns the Models, including Models trained, tuned or evaluated with Examples, and all improvements to the Service resulting from Training Use. The Customer acquires no right in the Models by reason of Training Use.

8.3 Licence. The Customer grants GetClinic a non-exclusive, worldwide, royalty-free licence to use Examples for Training Use under this Addendum. The licence is irrevocable for Training Sets built before the Customer switches the Training Policy to Off, opts a case out, or the case otherwise stops being eligible, and ends for later Training Sets at that time.

8.4 No disclosure through Models. GetClinic will not design, train or release a Model to reproduce, or to output, an Example or any Customer Data. The outputs of Models in the Service are ranks, scores, similarities and orderings, not records of other customers' cases. GetClinic will not offer any person a way to query a Model for whether a particular case was used in training.

8.5 Confidentiality. Examples and Training Sets are the Customer's confidential information under the Agreement for as long as GetClinic holds them, except that this section does not restrict Training Use under this Addendum.

9. Withdrawal and its effect

9.1 What counts as withdrawal. Any of the following removes a case from Training Use:

(a) the Customer switches the Training Policy to Off;

(b) a User opts the case out, or, under the Per case mode, clears the opt-in;

(c) the patient's Research Consent is withdrawn and the withdrawal is recorded in the Service; or

(d) an erasure of the case, the patient's data or the Organisation is requested.

9.2 Effect on later Training Sets. From the time of withdrawal, the case is excluded from every Training Set built after that time.

9.3 Erasure. When a case, a patient's data or the Organisation is erased, the Service deletes the link between each affected Example and its case and places the Example identifier on a list of excluded Examples. Every later Training Set excludes those Examples.

9.4 Training Sets already built. A Training Set built before the withdrawal is not rewritten. Its Examples were de-identified when it was built, and after erasure under section 9.3 nothing links them to a case.

9.5 Models already trained. Models trained, tuned or evaluated before the withdrawal are not withdrawn, retrained or deleted because of it. A Model holds no patient-level records.

9.6 Notice to patients. The Customer will explain the effect of this section to patients when it obtains Research Consent.

10. Records

10.1 Records in the Organisation. The audit trail of the Organisation records each change of the Training Policy, each Case Decision, each Accepted Outcome and its review, and, for each Training Set, that the Organisation's cases were read and how many of its cases were included.

10.2 Records kept by GetClinic. GetClinic keeps, for each Training Set, a manifest of its format, its counts of Examples by part, the counts of excluded cases by reason across all customers (counts below 5 are not shown), the knowledge snapshot used and the time up to which the exclusion list was applied. GetClinic records, for each Model version trained or evaluated with Examples, the Training Sets it used. Manifests contain no Customer, Organisation, User or case identifier.

10.3 Information on request. On request, and no more than once a year unless a supervisory authority requires it, GetClinic will tell the Customer which Training Sets included Examples from its Organisation and which Model versions used those Training Sets.

11. Customer responsibilities

11.1 Research Consent. The Customer will record Research Consent only where the patient, or the patient's representative, has given a consent that covers the use of de-identified data from the case by a technology provider to develop and evaluate decision-support software, and that meets the law and the research ethics rules that apply to the Customer.

11.2 Ethics approval. Where the law or the Customer's institutional rules require approval of a research ethics committee or institutional review board for this use, the Customer will obtain it before it switches the Training Policy from Off, and will keep the Training Policy Off for any case outside the scope of that approval.

11.3 Information to patients. The Customer will inform patients about Training Use, the role of GetClinic and the effect of withdrawal, as the law that applies to it requires.

11.4 Accurate records. The Customer will keep Research Consent records accurate and current, and will record a withdrawal of consent without undue delay. GetClinic relies on those records and does not verify them.

11.5 Accepted Outcomes. The Customer is responsible for the accuracy of the outcomes its Users record and accept.

11.6 Local law. The Customer will not switch the Training Policy from Off where the law that applies to it does not allow the disclosure of Examples to GetClinic for Training Use.

12. Data protection

12.1 Building Examples. GetClinic builds Examples from Customer Personal Data as the Customer's processor, on the Customer's documented instruction given by this Addendum under section 3.2 of the Data Processing Terms. This Addendum is the enablement of research and model training referred to in section 8.2 of the Data Processing Terms.

12.2 GetClinic's role in Training Use. GetClinic decides how Training Sets are used to develop its Models. To the extent Examples are personal data, GetClinic is a separate controller of them for Training Use. While the link under section 5.5 exists, GetClinic treats Examples as pseudonymised personal data and applies to them the safeguards of this Addendum, including data minimisation, pseudonymisation and the restrictions in section 7.2.

12.3 GDPR, UK GDPR and Swiss law.

(a) The Customer is responsible for the lawful basis of the disclosure of Examples to GetClinic and for a condition under Article 9 of the GDPR (or the corresponding provision of the UK GDPR or Swiss law), which will be the patient's explicit consent recorded as Research Consent, or another condition available under Article 9(2)(j) and Article 89 of the GDPR and the national law that applies to the Customer.

(b) For transfers of Examples from the European Economic Area for Training Use, the standard contractual clauses adopted by Commission Implementing Decision (EU) 2021/914, Module One, apply and are incorporated by reference, with the options in section 12.2 of the Data Processing Terms to the extent they apply to Module One. Sections 12.3 and 12.4 of the Data Processing Terms apply to transfers from the United Kingdom and Switzerland in the same way.

(c) After erasure under section 9.3, GetClinic can no longer link an Example to a person, and section 9.4 applies.

12.4 KVKK.

(a) Genetic and health data are special categories of personal data under Article 6 of the KVKK. The Customer will record Research Consent for a patient in Türkiye only where the patient has given explicit consent (açık rıza) that covers Training Use.

(b) Where the Customer is established in Türkiye, the Customer will not switch the Training Policy from Off, and GetClinic will not include Examples of the Customer, until the parties have signed the standard contract for transfers between controllers published by the Personal Data Protection Authority, in the manner described in section 12.5 of the Data Processing Terms, and the Customer has notified the Authority.

12.5 HIPAA. Where the Business Associate Agreement applies:

(a) this Addendum is Covered Entity's permission under section 3.4(c) of the Business Associate Agreement for Business Associate to de-identify PHI and to use the de-identified data to train and improve models;

(b) Examples are de-identified under the safe harbor method of 45 CFR 164.514(b)(2): they contain none of the identifiers listed there, ages are given only in five-year bands with the top band covering 85 years and over, and no date or geographic information is included;

(c) the Example identifier is a re-identification code permitted by 45 CFR 164.514(c): it is random, not derived from information about the individual, not used or disclosed for any other purpose, and the means of linking it to a case is not disclosed;

(d) because Examples are de-identified, Training Use does not use a limited data set and does not require a data use agreement or an authorisation of the individual under 45 CFR 164.508;

(e) Covered Entity will not switch the Training Policy from Off, and will opt a case out, where Covered Entity has actual knowledge that the Example of a case could be used, alone or with other information, to identify the individual; and

(f) GetClinic will not use the expert determination method of 45 CFR 164.514(b)(1), a limited data set or an authorisation for Training Use unless the parties agree it in writing.

12.6 Other US law. The Customer is responsible for any consent or notice that state law requires for the research use of genetic information, and for the Research Consent it records meeting that law.

12.7 No sale. GetClinic does not sell Customer Data, Examples or Training Sets, and does not receive anything of value from any third party in exchange for them. Training Use is not a sale or sharing of personal information under any US state privacy law.

13. General

13.1 Term. This Addendum applies from acceptance until the Agreement ends. Sections 7, 8, 9, 10.2 and 12 survive for as long as GetClinic holds Training Sets or Models trained with Examples.

13.2 New versions. GetClinic may publish a new version of this Addendum. A new version applies to the Customer only when an administrator of the Customer accepts it in the Service or the parties sign it. Until then the version the Customer accepted continues to apply. Where a new version is required to switch the Training Policy from Off, the Service asks for its acceptance.

13.3 End of the Agreement. When the Agreement ends, the Organisation's cases are excluded from every later Training Set, and section 9 applies as if the Training Policy had been switched to Off.

13.4 Order of precedence. For Training Use, this Addendum takes precedence over the Agreement. It does not reduce the protection of the Data Processing Terms or the Business Associate Agreement for Customer Personal Data or PHI held in the Service.

13.5 Liability. Each party's liability under this Addendum is subject to the limitations of liability of the Agreement. A breach of section 7.2 by GetClinic is a breach of the Data Processing Terms involving Customer Data for those limitations.