8-K

UNITED STATES

SECURITIES AND EXCHANGE COMMISSION

Washington, D.C. 20549

FORM 8-K

Current Report

Pursuant to Section 13 or 15(d) of the Securities Exchange Act of 1934

Date of Report (Date of earliest event reported)

July 24, 2020

MATEON THERAPEUTICS, INC.

(Exact name of registrant as specified in its charter)

Delaware	000-21990	13-3679168
(State or other jurisdiction of incorporation)	(Commission File Number)	(IRS Employer Identification No.)

29397 Agoura Road Suite 107

Agoura Hills, CA 91301

(Address of principal executive offices and Zip Code)

Registrant’s telephone number, including area code

(650) 635-7000

(Former name or former address, if changed since last report.)

Check the appropriate box below if the Form 8-K filing is intended to simultaneously satisfy the filing obligation of the registrant under any of the following provisions (see General Instruction A.2. below):

[  ]	Written communications pursuant to Rule 425 under the Securities Act (17 CFR 230.425)
[  ]	Soliciting material pursuant to Rule 14a-12 under the Exchange Act (17 CFR 240.14a-12)
[  ]	Pre-commencement communications pursuant to Rule 14d-2(b) under the Exchange Act (17 CFR 240.14d-2(b))
[  ]	Pre-commencement communications pursuant to Rule 13e-4(c) under the Exchange Act (17 CFR 240.13e-4(c))

Securities registered pursuant to Section 12(b) of the Act:

Title of class	Trading Symbols	Name of each exchange on which registered
N/A

Indicate by check mark whether the registrant is an emerging growth company as defined in Rule 405 of the Securities Act of 1933 (§230.405 of this chapter) or Rule 12b-2 of the Securities Exchange Act of 1934 (§240.12b-2 of this chapter).

Emerging growth company [  ]

If an emerging growth company, indicate by check mark if the registrant has elected not to use the extended transition period for complying with any new or revised financial accounting standards provided pursuant to Section 13(a) of the Exchange Act. [  ]

Item 1.01 Entry into a Material Definitive Agreement.

Expanded Access Program (EAP) Master Service Agreement between myTomorrow and Mateon Therapeutics Inc. (“Mateon”).

Mateon’s ongoing phase 2 development of OT-101 (Trabedersen) as an immunotherapy for the treatment of cancer shares commonality with potential covid-19 therapies on the basis of the transforming growth factor beta (TGF-β) inhibition mechanism.

Recognizing this potential and the urgency of the global situation early on, Mateon’s has engaged myTomorrows as a regulatory intelligence asset and pre-approval access expert. With regard to the former, myTomorrows will provide regulatory guidance in support of Mateon’s research objectives and Clinical Trial Application (CTA) in the U.K. In parallel to the Clinical Trial launch, myTomorrows will also develop and run an Expanded Access Program for OT-101 in both the U.K. and U.S.

myTomorrows operates as an integrated end-to-end platform serving patients, healthcare providers, and drug developers. myTomorrows offers direct support as a single point of contact for patients with a life-threatening disease where there are limited or no standard approved therapies. These patients and their physicians are provided a personalized report detailing relevant Clinical Trials and pre-approval treatment options. myTomorrows also serves as a global partner for companies developing drugs to treat patients with unmet medical needs through program management at all phases — from patient identification for Clinical Trials to the distribution of investigational drugs around the world.

myTomorrows directly engages with physicians and patients. Requests for access may come in directly to myTomorrows by phone, email, or through an online portal. Physicians and patients will be directed to a member of our Medical team who will guide them through the access process. The response time for an inquiry is no longer than one business day.

An Expanded Access Program (EAP), also known as Early Access Program or Managed Access Program, facilitate access to pre-approval drugs outside of a Clinical Trial. They are typically an option for patients who have high unmet medical need, no suitable options amongst registered drugs and cannot participate in a Clinical Trial.

Item 9.01 Financial Statements and Exhibits.

(d) Exhibits.

Exhibit No.	Description	Incorporation by reference
10.1	Expanded Access Program MSA	Filed herewith.
10.2	Statement of Work	Filed herewith.
10.3	Addendum #1	Filed herewith.
10.4	Data Processing Agreement	Filed herewith

2

SIGNATURE

Pursuant to the requirements of the Securities Exchange Act of 1934, the registrant has duly caused this report to be signed on its behalf by the undersigned hereunto duly authorized.

	Mateon Therapeutics, Inc.
Date: August 3, 2020		/s/ Vuong Trieu
	By:	Vuong Trieu
		Chief Executive Officer

3

EX-10.1

Exhibit 10.1

EXPANDED ACCESS PROGRAM (EAP) MASTER SERVICES AGREEMENT

This EAP MASTER SERVICES AGREEMENT (together with any Statements of Work (as defined in Section 1), the “Agreement”) is effective this 30^th day of May 2020 (“Effective Date”) by and between Mateon Therapeutics INC., a Delaware corporation with its principal office at 29397 Agoura Rd., Suite 107, Agoura Hills, CA 91301, USA (“Mateon”) and IMPATIENTS N.V., acting under the trade name myTomorrows, a company formed and registered under the laws of The Netherlands, and located at Anthony Fokkerweg 61, 1059 CP, Amsterdam, The Netherlands (“Impatients”).

1. Agreement Structure. From time to time, Mateon may request that Impatients provide certain Expanded Access Program related activities with respect to the Product on behalf of Mateon (“Services”). This Agreement contains general terms and conditions under which Mateon would engage Impatients and under which Impatients would provide Services.

1.1. Statements of Work. The Services will be defined in one or more statements of work referencing this Agreement (each, a “Statement of Work”) before any Services are provided. Neither Mateon nor Impatients is obligated to execute any Statement of Work. Once executed, each Statement of Work becomes part of this Agreement, although the terms in a Statement of Work will apply only to Services described in that Statement of Work. A Statement of Work may not change any term in this Agreement.

2. Definitions. The following terms when used in this Agreement, shall the have meanings set forth in this Section:

2.1.	“Affiliate” means, as to any person or entity, any other person or entity, which controls, is controlled by, or is under common control with such person or entity. A person or entity shall be regarded as in control of another entity only if it owns or controls, directly or indirectly, at least fifty percent (50%) of the equity securities or other ownership interests in the subject entity entitled to vote in the election of directors or with the power to direct or elect management of such subject entity.
2.2.	“Applicable Laws” means any international, US, EU, national, local, regional or provincial laws, regulations, ordinances, regulatory guidance, guidelines or other requirements of the Regulatory Authorities, including but not limited to Directive 2001/83/EC (“Medicinal Products for Human Use Directive”), Commission Directive 2005/28/EC (“GCP Directive”), Regulation (EU) 2016/679 (“GDPR”), the United States Foreign Corrupt Practices Act, the UK Bribery Act 2010 and the OECD Anti-Bribery Convention and any applicable national laws, regulations and guidance, as amended from time to time.
2.3.	“Business Day” means any calendar day other than a Saturday, Sunday or any official holiday in the Netherlands.
2.4.	“Expanded Access Approvals” means the permissions, exemptions, approvals, authorizations and/or waivers required by Regulatory Authorities for medical treatments, not the subject of a Marketing Authorization, to be provided to a pharmacy or wholesale or to be delivered to a physician, as the case may be, in any applicable country in the Territory, to be administered to and/or used by a patient.

2.5.	“Expanded Access Program” or “EAP” means the activities required to enable Expanded access to investigational medical treatments and for the collection and analysis of RWD (as defined below). This includes activities directed to (i) the education of physicians regarding the possibility of Expanded access to investigational medical treatments that are not yet the subject of a Marketing Authorization through named-patient use, hospital exemption or compassionate use, (ii) patient enrollment, (iii) the securing of Expanded Access Approvals, for the use of such treatments, (iv) the collection and analysis of patient level data for research purposes, (v) pharmacovigilance registration and/or (vi) the collection of data, including but not limited to patient-reported outcomes and doctor-reported experiences.
2.6.	“Field” means the treatment of COVID-19 patients with hypoxemic respiratory failure
	for whom there are no appropriate alternative therapies.
2.7.	“Good Manufacturing Practice” or “GMP” means the current good manufacturing practices applicable from time to time to the manufacturing of a Product or any intermediate thereof pursuant to Applicable Laws.
2.8.	“Marketing Authorization” or “MA” means all approvals from the relevant Regulatory Authority necessary to place a pharmaceutical Product on the market in a country or region.
2.9.	“Manufacturer” means the legal entity that physically manufactures and/or fills and/or finishes and/or labels and/or stockpiles cGMP grade Product.
2.10.	“Product” means the product referred to as TGF-β inhibitor OT-101, that is supplied, ready packed and labelled, quality tested and QP released in accordance with applicable pharmaceutical laws and regulations.
2.11.	“Real World Data” or “RWD” means data relating to patient health status and/or the delivery of health care routinely collected from a variety of sources.
2.12.	“Real World Evidence” or “RWE” means the clinical evidence about the usage and potential benefits or risks of a medical product derived from analysis of RWD.
2.13.	“Regulatory Authority” means any applicable supra-national, federal, national, regional, state, provincial, or local governmental or regulatory authority, agency, department, bureau, commission, council or other entities (e.g., FDA, EMA and PMDA) regulating or otherwise exercising authority with respect to activities contemplated under this Agreement.
2.14.	“Territory” means the United States of America.

3. Performance of the Services.

3.1. Provision of Services. Impatients agrees to provide all Services identified in any Statement of Work: (a) within the time specified in the relevant Statement of Work (if applicable); and (b) in accordance with the terms of this Agreement and any Applicable Laws.

3.2.	Subcontracting. Impatients may subcontract the performance of specific obligations of Impatients under a Statement of Work to an Affiliate of Impatients or to a qualified non-affiliate third party, including consultants (collectively “Subcontractors”); provided, that (a) such Subcontractor performs those Services in accordance with the Applicable Laws and in a manner consistent with the terms and conditions of this Agreement; and (b) Impatients remains liable for the performance of such Subcontractor.
3.3.	Audits. Impatients will allow representatives of regulatory agencies, with reasonable advance notice and during normal business hours of Impatients, , to review Impatients’ Records with respect to the Services, except for Records that may not be shared due to Applicable Laws, including but not limited to data privacy laws.
3.4.	Personnel. Subject to the provisions of Section 3.2 of this Agreement, Impatients will engage, and will require its Subcontractors to engage, an appropriate number of employees with the proper education, training and experience (“Impatients Personnel”) to enable the performance of the Services in compliance with the Applicable Laws and this Agreement. Impatients shall ensure that all Impatients Personnel are required to comply with the obligations imposed by this Agreement and with the Applicable Laws.

4. Regulatory, Quality and Pharmacovigilance.

4.1. Regulatory.

(i)	Scope. Mateon will be the approve for all content of any communications with Regulatory Authorities and physicians with respect to matters relating to Services, unless specified otherwise (for example when the treating physician obtains expanded access approval directly from the competent authority). With Mateon’s prior approval, Impatients will interact with Regulatory Authorities and/or Ethics Committees / Institutional Review Boards (IRBs) as required by local regulation on Mateon`s behalf. With Mateon’s prior approval, Impatients will also support treating physicians to interact directly with competent authorities. The purpose of this section is to describe how Mateon will maintain control of the content of interactions with Regulatory Authorities and treating physicians and at the same time enable Impatients to manage or execute certain of those interactions on Mateon`s behalf.
(ii)	Impatients will on Mateon’s behalf work with physicians and treatment centers to file applications within the Field for Expanded Access Approvals and shall on Mateon’s behalf communicate with the Regulatory Authorities, to secure Expanded Access Approvals for the Product in the Territory.
(iii)	Impatients will notify Mateon by telephone and email immediately but no later than one (1) Business Day after Impatients receives any communication from any Regulatory Authority relating to the Services and will provide Mateon with copies of such communication. Unless prohibited by the Applicable Laws, Impatients will consult in advance with Mateon regarding the response to any inquiry or observation from any Regulatory Authority relating to the Services and will comply with all requests and comments by Mateon with respect to all communications with any Regulatory Authority relating to the Services.

(iv)

For the avoidance of doubt, Impatients will only use materials and/or information for all communications relating to the Services, including, but not limited, to competent authorities, Regulatory Authorities, or physicians, regardless of whether such materials and information will be communicated in writing or verbally, that have been reviewed and approved by Mateon per Mateon’s internal procedures and policies. Impatients will not make any changes or alteration to these materials and/or information unless approved by Mateon.

(v)

If Impatients receives written or electronic correspondence from any Regulatory Authority relating to the withdrawal, suspension, or revocation of a regulatory approval or Expanded Access Approval for Product in the Field, the prohibition or suspension of the supply of a Product in the Field, or the initiation of any investigation, review, or inquiry by such Regulatory Authority concerning the safety and quality of a Product in the Field, Impatients shall notify Mateon and provide copies of such written or electronic correspondence within one (1) Business Day.

4.2.	Quality. Mateon shall be responsible for manufacturing and distribution, including, but not limited to, labeling and packaging, testing and QP release, compliant to GMP and GDP regulations and other Applicable Laws. If quality or distribution complaints related to the Product are received by Impatients or Impatients is notified of a temperature excursion related to the Product that occurred during transport to the customer, Impatients shall notify Mateon on the information received without undue delay. In case of a recall related to the Product, Mateon shall be responsible for the execution of the recall and the communication with the competent authorities. If requested by Mateon, Impatients may provide reasonable support for the handling of complaints or the communication of the recall. Any costs incurred by Impatients for support shall be borne by Mateon.
4.3.	Pharmacovigilance. Mateon shall be responsible for the performance of pharmacovigilance obligations with respect to the Product. If potential safety information related to the Expanded Access Program is received by Impatients, Impatients shall instruct the providing HCP to promptly report to Mateon using the SAE report form and notify Mateon on the information received within one (1) Business Day. An ICSR report will be processed in the format required for authority reporting by Mateon (or its specialized third-party service provider).
4.4.	Information. Mateon, at its discretion, will provide Impatients with all relevant information required to provide the Services.

5. Mutual Representations and Warranties. The parties represent and warrant to each other, as of the Effective Date, as follows:

5.1. Organization of Parties. Each party is and will remain a corporation or company duly organized, validly existing and in good standing under the laws of its jurisdiction of organization, and has the requisite power and authority, corporate or otherwise, to execute, deliver, and perform this Agreement.

5.2.	Enforceability of this Agreement. The execution and delivery of this Agreement by both parties has been authorized by all requisite corporate or company action. This Agreement is and will remain a valid and binding obligation of both parties, enforceable in accordance with its terms, subject to laws of general application relating to bankruptcy, insolvency and the relief of debtors.
5.3.	Absence of Other Contractual Restrictions. Parties are under no contractual or other obligation or restriction that is inconsistent with the terms of this Agreement or any Statement of Work, or that would impede the diligent and complete fulfilment of the parties’ obligations hereunder. Parties will not enter into any agreement, either written or oral, that would conflict with parties’ responsibilities under this Agreement or any Statement of Work.
5.4.	Compliance. Each party shall comply and shall cause its and its Affiliates’ employees and contractors to comply with all Applicable Laws, the terms of this Agreement and the Statements of Work in the performance of its obligations under this Agreement and shall perform its obligations under this Agreement with requisite care, skill and diligence.
5.5.	Conflicts with Rights of Third Parties. The conduct and provision of Services will not violate any patent, trade secret or other proprietary or intellectual property right of any third party.
5.6.	Absence of Debarment. Impatients, its Affiliates, Impatients Personnel, Subcontractors and each of their respective officers and directors, as applicable: (a) have not been debarred or disqualified by any governmental authority or regulatory agency, and are not subject to a pending debarment or disqualification, and will not use in any capacity in connection with Services any person who has been debarred or disqualified or is subject to a pending debarment or disqualification by any governmental or regulatory agency; and (b) have not been convicted of a criminal offense related to the provision of healthcare items or services and are not subject to any such pending action. Impatients will notify Mateon immediately if Impatients, its Affiliates, any Impatients Personnel, any Subcontractor or any of their respective officers or directors, as applicable, is subject to the foregoing, or if any action, suit, claim, investigation, or proceeding relating to the foregoing is pending, or to the best of Impatients’ knowledge, is threatened.

6. Compensation.

6.1.	Fees. As full consideration for Services, Mateon will pay Impatients the amounts set forth in the applicable Statement of Work in accordance with the payment schedule set forth in such Statement of Work. Impatients will invoice Mateon for all amounts due in USD. All payments will be made by Mateon within thirty (30) days after its receipt of an invoice.
6.2.	Expenses. Reasonably incurred expenses shall be reimbursed by Mateon.

6.3. Fair Market Value. Impatients shall comply with all Applicable Laws and industry standards, which govern the marketing and advertising of pharmaceutical products, and Interactions with Healthcare Professionals. Impatients shall include information relating to any payments to a health care professional (“HCP”) or other transfers of value, including any payments through its subcontractors (collectively “HCP Payments”), in its invoices provided to Mateon. If and when applicable, Impatients shall report and demonstrate that all HCP Payments reflect the fair market value of the services provided by the HCPs in its invoices. Impatients will maintain financial records of any HCP Payments in accordance with the requirements of Section 7, including copies of invoices relating to any such HCP Payments. Impatients shall not make any payment or other transfer of value on Mateon’s behalf (including any HCP Payments) that exceed fair market value. Impatients agrees that the compensation being paid under this Agreement and under any Statement of Work constitutes the fair market value of the Services to be provided hereunder. No amounts paid under this Agreement are intended to be for, nor shall they be construed as, an offer or payment made in exchange for any explicit or implicit agreement for, past, present or future purchasing, recommending, leasing or other use of any Mateon or any Mateon Affiliate’s product or service.

7. Proprietary Rights.

7.1.	Materials. All documentation, information, and biological, chemical or other materials controlled by Mateon and furnished to Impatients by or on behalf of Mateon (collectively, with all associated intellectual property rights, the “Materials”) will remain the exclusive property of Mateon. Impatients will use Materials only as necessary to perform Services.
7.2.	Deliverables.

(i)

Ownership. Mateon will own all rights throughout the world to all inventions, discoveries, improvements, ideas, processes, formulations, products, computer programs, works of authorship, databases, trade secrets, know-how, information, data, documentation, reports, applications, permissions, exemptions, approvals, authorizations and/or waivers, research, creations and all other products and/or materials related to the Product (whether or not patentable or subject to copyright or trade secret protection) (collectively, with all associated intellectual property rights, the “Deliverables”). Impatients will assign and does assign to Mateon all right, title and interest in and to all Deliverables and will promptly disclose to Mateon all Deliverables. For purposes of the copyright laws of the Applicable Laws, Deliverables constitute “works made for hire,” except to the extent such Deliverables cannot by law be “works made for hire”.

(ii)

Impatients Property. Notwithstanding the foregoing, Impatients will retain full ownership rights in and to all templates, programs, methodologies, processes, technologies, know-how and all other materials developed or licensed by Impatients and its Affiliates prior to or apart from performing its obligations under this Agreement (collectively, with all associated intellectual property rights, the “Impatients Property”), regardless of whether such Impatients Property is used in connection with Impatients’ performance of its obligations under this Agreement.

7.3. Work at Third Party Facilities. Impatients agrees not to accept or use any funds, space, personnel, facilities, equipment or other resources of a third party in performing Services or take any other action that could result in a third party owning or having a right in any Deliverables.

7.4.

Records; Storage. Impatients will maintain all materials, data and documentation obtained or generated by Impatients solely related to the Product and in the course of preparing for and providing Services, including computerized records and files (collectively, the “Records”) as required by the Applicable Laws and in a secure area reasonably protected from fire, theft and destruction. All Records, other than financial records of Impatients, will be the property of Mateon. Impatients will not transfer, deliver or otherwise provide any Records to any party other than Mateon or its Affiliates, without the prior approval of Mateon, unless Impatients is obligated to do so under any Applicable Laws or by court order.

7.5.

Record Retention. All Records will be retained by Impatients for a minimum period of five (5) years following completion of the applicable Statement of Work, or longer if required by the Applicable Laws. Impatients will, at the direction and written request of Mateon, promptly deliver Records to Mateon or its designee, or dispose of the Records, unless the Records are required to be retained by Impatients by Applicable Laws. In no event will Impatients dispose of any Records without first giving Mateon thirty (30) days’ prior written notice of its intent to do so.

8. Confidentiality and Data Protection.

8.1.	Definition. “Confidential Information” means any and all non-public scientific, technical, financial regulatory or business information, or data in whatever form (written, oral or visual) that is furnished or made available by or on behalf of one party (the “Discloser”) to the other (the “Recipient”) or developed by Impatients in connection with Services. Confidential Information includes (x) Materials, Deliverables, Records, scientific data and medical data insofar as this is permitted by Applicable Laws, investigator brochures, protocols and correspondence with or from institutional review boards and other entities with oversight responsibilities for clinical studies that are the subject of Services, including ethics committees and data safety monitoring committees; (y) development and marketing plans, regulatory and business strategies, financial information, and forecasts; and (z) all information of third parties that a party has an obligation to keep confidential, whether or not, in each case, such materials or information are marked or identified as confidential.
8.2.	Obligations. During the term of this Agreement and for a period of ten (10) years thereafter, Recipient agrees to (a) hold in confidence all Discloser’s Confidential Information, and not disclose Discloser’s Confidential Information except as expressly provided in Section 8.3, without the prior written consent of Discloser; (b) use Discloser’s Confidential Information solely to carry out Recipient’s rights or obligations under this Agreement; (c) treat Discloser’s Confidential Information with the same degree of care Recipient uses to protect Recipient’s own confidential information but in no event with less than a reasonable degree of care; and (d) reproduce Discloser’s Confidential Information solely to the extent necessary to carry out Recipient’s rights or obligations under this Agreement, with all such reproductions being considered Discloser’s Confidential Information.
8.3.	Permitted Disclosures. Recipient may provide Discloser’s Confidential Information to its and its affiliates’ directors, employees, consultants, contractors and agents on a need to know basis and solely as necessary to carry out Recipient’s rights or obligations under this Agreement; provided, that Recipient remains liable for the compliance of such affiliates, directors, employees, consultants, contractors and agents with the terms of this Agreement. Recipient may also disclose Discloser’s Confidential Information to third parties only to the extent such disclosure is required (i) to comply with the Applicable Laws; or (ii) by a governmental authority or by order of a court of competent jurisdiction; provided, that Recipient provides prior written notice of such disclosure to Discloser, takes all reasonable and lawful actions to avoid or minimize the degree of such disclosure, and cooperates reasonably with Discloser in any efforts to seek a protective order.

8.4. Exceptions. Recipient’s obligations of non-disclosure and non-use under this Agreement will not apply to any portion of Discloser’s Confidential Information that Recipient can demonstrate, by competent proof:

(i)	is generally known to the public at the time of disclosure or becomes generally known through no wrongful act on the part of Recipient;
(ii)	is in Recipient’s possession at the time of disclosure other than as a result of Recipient’s breach of any legal obligation;
(iii)	becomes known to Recipient on a non-confidential basis through disclosure by sources other than Discloser having the legal right to disclose such Confidential Information; or
(iv)	is independently developed by Recipient without reference to or reliance upon Discloser’s Confidential Information.

8.5. Data Protection.

(a)

Each party may collect, use and store personal data, as this term is defined in the Applicable Laws, relating to its directors, officers, employees, contractors and agents for the purposes of performance of Services in this Agreement. Each party may also provide to the other party such personal data for these purposes. Each party shall ensure its compliance with all Applicable Laws with respect to such personal data. Each party agrees to obtain the necessary consents from its directors, officers, employees, contractors, and agents to the disclosure, collection, use, storage of their personal data to the other party and to the transfer of such personal data outside of the EU where the laws of which may not provide the same level of data protection as do the laws of the EU. Each party shall ensure that its directors, officers, employees, contractors and agents are aware that their personal data will be collected, used and stored for the above-mentioned purposes, that those data may be made available to the other party and transferred outside the EU and that they consent to such collection, use, storage and potential transfer. Additionally, each party agrees to secure all Confidential Information in their control using appropriate security controls that are in alignment with legally mandated controls.

(b)

Mateon shall be the “controller” for any personal data relating to the Services and Impatients shall be the “processor” of this personal data as these terms are defined in Article 4 of the General Data Protection Regulation EU 2016/279 (“GDPR”). Impatients shall process such personal data on behalf of Mateon solely for the purposes of performance of this Agreement and the Services, in accordance with the Applicable Laws and the Data Processing Agreement, which is entered into separately by the Parties.

9. Indemnification, Insurance and Remedies.

9.1.	Indemnification by Impatients. Impatients will indemnify, defend and hold harmless Mateon, its Affiliates, and its and their respective officers, directors, employees and agents (collectively, the “Mateon Indemnitees”) against any third party claims, including reasonable attorneys’ fees for defending those claims, to the extent such claims arise out of or relate to (a) the performance of Services by any Impatients Indemnitee (as defined in Section 7.2) or any injury or harm to Impatients’ Personnel alleged by such Impatients’ Personnel to have occurred on Mateon’s or its Affiliates’ premises during the course of performance of Services (except to the extent such claims result from Mateon’s breach of this Agreement, breach of the Applicable Laws or a Mateon Indemnitee’s negligence or willful misconduct); (b) any Impatients Indemnitee’s negligence or willful misconduct in performing obligations under this Agreement; or (c) Impatients’ breach of this Agreement or the Applicable Laws.
9.2.	Indemnification by Mateon. Mateon will indemnify, defend and hold harmless Impatients, its Affiliates, and its and their respective officers, directors, employees and agents (collectively, the “Impatients Indemnitees”) against any third party claims, including reasonable attorneys’ fees for defending those claims, to the extent such claims arise out of or relate to (a) the use of the Deliverables by Mateon or its Affiliates (except to the extent such claims result from Impatients’ breach of this Agreement, breach of the Applicable Laws or an Impatient Indemnitee’s negligence or willful misconduct); (b) any Mateon Indemnitee’s negligence or willful misconduct in performing obligations under this Agreement; or (c) Mateon’s breach of this Agreement or the Applicable Laws. Mateon shall further indemnify, defend and hold harmless the Impatients Indemnitees for any third-party claims, suits, demands, judgments, actions, liabilities, (including strict liability and infringement of a third party’s patent rights) expenses (including reasonable attorney’s fees) and damages solely relating to the Product.
9.3.	Indemnification Procedures. Each party must notify the other party within thirty (30) days after receipt of any claims made for which the other party might be liable under Section 9.1 or 9.2, as applicable. The indemnifying party will have the sole right to defend, negotiate, and settle such claims. The indemnified party will be entitled to participate in the defense of such matter and to employ counsel at its expense to assist in such defense; provided, however, that the indemnifying party will have final decision-making authority regarding all aspects of the defense of the claim. The indemnified party will provide the indemnifying party with such information and assistance as the indemnifying party may reasonably request, at the expense of the indemnifying party. Neither party will be responsible or bound by any settlement of any claim or suit made without its prior written consent; provided, however, that the indemnified party will not unreasonably withhold or delay such consent.
9.4.	Waiver of Consequential or Punitive Damages/Limitation of Liability. Save as for gross negligence or intentional wrongdoing by a party, neither party, nor any of their respective directors, officers, employees or agents shall have any liability towards the other party, for any indirect or consequential damages claimed by the other party, including but not limited to the loss of opportunity, loss of use, and/or loss of revenue or profit, in connection with or arising out of this Agreement, any Statement of Work or breach thereof.

9.5.

Insurance. During the term of this Agreement and for a period of at least two (2) years after termination or expiration of this Agreement, each party will maintain any and all insurance coverage required by the Applicable Laws and sufficient to cover the other party’s liability that may arise under this Agreement or any Statement of Work. Each party shall on request provide the other party with a Certificate of Insurance evidencing such insurance coverage.

9.6.

Remedies. Each party agrees that (i) the other party may be irreparably injured by a breach of this Agreement; (ii) money damages would not be an adequate remedy for any such breach; and (iii) the other party will be entitled to seek equitable relief, including injunctive relief and specific performance, without having to post a bond, as a remedy for any such breach. The provisions of this Section 9.6 are not exclusive, and each party may seek any other right or remedy that it may have under this Agreement or otherwise.

10. Term and Termination.

10.1.	Term. This Agreement will become legally effective on the Effective Date and, unless earlier terminated pursuant to the terms hereof, shall continue in full force and effect for an initial period of three (3) (“Initial Term”). This Agreement will automatically extend by subsequent periods of one (1) year each following the end of a term (“Subsequent Term”; Initial Term and Subsequent Term each referred to as a “Term”).
10.2.	Early Termination. Mateon may terminate this Agreement or a Statement of Work at any time upon forty-five (45) days’ prior written notice to Impatients. Impatients may terminate this Agreement or a Statement of Work at any time after the first six months following the Effective Date and upon thirty (30) days’ prior written notice to Mateon.
10.3.	Termination for Breach. Either party may terminate this Agreement or any Statement of Work for material breach of this Agreement or breach of the Applicable Laws if the breaching party fails to cure such breach no later than sixty (60) days after receiving written notice. In the event a party breaches a material obligation under this Agreement or any Statement of Work that cannot be cured (e.g. breach of confidentiality obligations), this Agreement or any Statement of Work may be terminated with immediate effect upon written notice to the breaching party.
10.4.	Effect of Termination. Upon termination of this Agreement or any Statement of Work, as applicable, neither Impatients nor Mateon will have any further obligations, except for the following:

(i)	Impatients will terminate services in progress in accordance with a schedule agreed to by Mateon, unless Mateon specifies in the notice of termination that services in progress should be completed;
(ii)	Impatients will deliver to Mateon all Deliverables, whether completed or not;
(iii)	As directed by Mateon, Impatients will either return to Mateon any Materials and Mateon Records in its possession or control or arrange for their secure destruction;

(iv)	Mateon will pay Impatients for all work performed under an applicable Statement of Work until the moment of termination, pay all outstanding and correct invoices and reimburse incurred expenses as authorized in the applicable Statement of Work;
(v)	Recipient will promptly return to Discloser all of Discloser’s Confidential Information (including all copies) except for one (1) copy which Recipient may retain solely for compliance purposes, subject to confidentiality obligations that survive termination; and
(vi)	Sections 3.1, 3.3, 4, 6, 7, 8, 9, and 10 survive termination or expiration.

11. Miscellaneous.

11.1.	Independent Contractor. Impatients is an independent contractor and not an agent or employee of Mateon. Impatients will not in any way represent itself to be an agent, employee, partner or joint ventures of or with Mateon, and Impatients has no authority to obligate or bind Mateon by contract or otherwise. Impatients is responsible for, and will withhold and/or pay, all contributions required by the Applicable Laws. No Impatients employees or other Impatients Personnel will be entitled to any benefits applicable to or available to employees of Mateon. Impatients understands and agrees that it is solely responsible for such matters and that it will indemnify Mateon and hold Mateon harmless from all claims and demands in connection with such matters.
11.2.	Publicity. Except to the extent required by the Applicable Laws, Impatients will not make any public statement or release concerning this Agreement or the transactions contemplated by this Agreement or use Mateon’s name or the name of any Affiliate of Mateon in any form of advertising, promotion, or publicity without obtaining the prior written consent of Mateon.
11.3.	Notices. All notices must be in writing and sent to the addresses specified below, or at such other address as a party may specify in writing under this procedure. Notices shall be given (a) by personal delivery, with receipt acknowledged; (b) by prepaid certified or registered mail, return receipt requested; or (c) by prepaid recognized express delivery service. Notices will be effective upon receipt or at a later date stated in the notice. Party addresses for notices are:

To Mateon:	Mateon therapeutics INC. 23397 Agoura Rd., Suite 107 Agoura Hills, CA 91301 United States of America Attn: XX
With a copy to:	XXX
To Impatients:	Impatients N.V. Anthony Fokkerweg 61 1059 CP Amsterdam The Netherlands Attn: Corporate Development, D. Akkaya
With a copy to:	Impatients N.V. Anthony Fokkerweg 61 1059 CP Amsterdam The Netherlands Attn: General Counsel, P.E. de Ridders

11.4.	Assignment. Neither this Agreement nor any rights or obligations hereunder may be assigned, or duties delegated (other than explicitly specified) by either party without the prior written consent of the other party, which consent shall not be unreasonably withheld. Notwithstanding the foregoing, each party may assign this Agreement, without the written consent of the other party to: (a) an Affiliate; and/or (b) an entity that acquires all or substantially all of the stock, business or assets of such party to which this Agreement pertains (whether by merger, reorganization, acquisition, sale or otherwise). Any assignment in violation of this clause shall be null and void. Any permitted assignee shall, upon the request of the other party hereto, expressly acknowledge, by written agreement, its assumption of all obligations and liabilities under this Agreement. No assignment, delegation or transfer will relieve either party of the performance of any accrued obligation that such party may then have under this Agreement.
11.5.	Entire Agreement. This Agreement, together with the attached Appendices and any fully-signed Statements of Work, each of which are incorporated into this Agreement, constitute the entire agreement between the parties with respect to the specific subject matter of this Agreement and all prior agreements, oral or written, with respect to such subject matter are superseded.
11.6.	Remedy; Waiver. Exercise by any party of any of its rights under this Agreement shall not be deemed to limit any other right or remedy that such party may have in law or equity. The waiver by either party of a breach of any of the provisions of this Agreement by the other party shall not be construed as a waiver of any succeeding breach of the same or other provisions; nor shall any delay or omission by either party in exercising any right that it may have under this Agreement operate as a waiver of any breach or default by the other party.
11.7.	No Modification. This Agreement (including, but not limited to, any Statement(s) of Work) may be changed only by a writing signed by authorized representatives of each party.
11.8.	Severability; Reformation. Each provision in this Agreement is independent and severable from the others, and no provision will be rendered unenforceable because any other provision is found by a proper authority to be invalid or unenforceable in whole or in part. If any provision of this Agreement is found by such an authority to be invalid or unenforceable in whole or in part, such provision will be changed and interpreted so as to best accomplish the objectives of such unenforceable or invalid provision and the intent of the parties, within the limits of the Applicable Laws.
11.9.	Event of Conflict. All terms and conditions of this Agreement will apply to any Statement of Work. In the event of any conflict between the terms and conditions of this Agreement and any Statement of Work, the terms and conditions of this Agreement will take precedence over any Statement of Work; provided, however, that the parties may agree that a specific term of this Agreement shall not apply or shall be modified or amended with respect to a particular Statement of Work (and only with respect to that Statement of Work) by signing a Statement of Work where the parties intend to waive such specific term, for the limited purpose of that particular Statement of Work. No other terms, including, without limitation, any terms or conditions set forth in any document issued by either party, are effective unless accepted by the other party in writing.

11.10.

Governing Law. This Agreement and any disputes arising out of or relating to this Agreement will be governed by, construed and interpreted in accordance with the laws of the Netherlands, without regard to any choice of law principle that would require the application of the law of another jurisdiction. All parties consent to the exclusive jurisdiction of the courts of Amsterdam in the Netherlands and waive any objection to the propriety or convenience of such venues. The parties expressly reject any application to this Agreement of (a) the United Nations Convention on Contracts for the International Sale of Goods; and (b) the 1974 Convention on the Limitation Period in the International Sale of Goods, as amended by that certain Protocol, done at Vienna on April 11, 1980.

11.11.

Counterparts. This Agreement may be executed in any number of counterparts, each of which will be deemed to be an original and all of which together will constitute one and the same instrument

IN WITNESS WHEREOF, each party has caused this Agreement to be executed by its duly authorized representative as of the Effective Date.

MATEON THERAPEUTICS, INC.		IMPATIENTS N.V.
By:	/s/ Vuong Trieu	By:	/s/ Pieter Erik de Ridders
Name:	Vuong Ttrieu	Name:	Pieter Erik de Ridders
Title:	CEO	Title:	General Counsel

EX-10.2

Exhibit 10.2

STATEMENT OF WORK #1

This EAP STATEMENT OF WORK #1 (the “Statement of Work”) is effective this 30^th day of May 2020 (“SOW Effective Date”) by and between Mateon Therapeutics INC., a Delaware corporation with its principal office at 29397 Agoura Rd., Suite 107, Agoura Hills, CA 91301, USA (“Mateon”) and IMPATIENS N.V. acting under the trade name myTomorrows, a company formed and registered under the laws of the Netherlands, and located at Anthony Fokkerweg 61, 1059 CP, Amsterdam, The Netherlands (“Impatients”) will be incorporated into the Expanded Access Program (EAP) Master Services Agreement between Mateon and Impatients dated 30^h May 2020 (the “Agreement”). Capitalized terms used in this Statement of Work will have the same meaning as set forth in the Agreement.

Mateon hereby engages Impatients to provide Services, as follows:

1. Services.

Impatients shall support Mateon with the setting up and executing of a Free of Charge Expanded Access Program in the Territory. The Services shall include:

● Site management / physician engagement services

● Patient qualification; eligibility check can be done by Mateon responsible medical person or myTomorrows

● Guide and support physicians with per patient applications to regulatory authorities

● Physician education, support, and training for approved EAP patient cases

● Multi-lingual service provision

● Forwarding of orders to Mateons’ supply chain department

● Forwarding safety reports and product complaints sent to Impatients as required to Mateon applicable department

● Project management & reporting

2. RWD Services.

● Database set-up

● Database programing

● Protocol development

● Data monitoring

3. Fees

Set-up Fee

Mateon will pay to Impatients a set-up fee in the amount of USD 30,000 (thirty thousand US dollar), payable in two tranches: (i) first tranche of USD 15,000 (fifteen thousand US dollar) payable upon signature of this Statement of Work; (ii) second tranche of USD 15,000 (fifteen thousand US dollar) payable upon treatment of the first patient.

Patient Fee

At the end of each month, Impatients will invoice Mateon a fee of USD 2,250 (two thousand two hundred and fifty US dollar) for each patient treat with the Product under Expanded Access.

RWD Service Fee

The RWD collection shall be free of charge, provided that and for as long as Castor EDC provides the EDC to Impatients on a free of charge basis for COVID-19 related research. Parties will mutually agree on a fee or discontinuation of the RWD services in case Castor will charge Impatients for the use of the EDC.

SOW#1 Mateon & Impatients (MyTomorrows)

Page 1 | 2

MATEON THERAPEUTICS, INC.		IMPATIENTS N.V. acting under the trade name myTomorrows
By:	/s/ Vuong Trieu	By:	/s/ Pieter Erik de Ridders
Print Name:	Vuong Trieu	Print Name:	Pieter Erik de Ridders
Title:	CEO	Title:	General Counsel
Date:	24 July 2020	Date:	23 July 2020

SOW#1 Mateon & Impatients (MyTomorrows)

Page 2 | 2

EX-10.3

Exhibit 10.3

ADDENDUM #1 FOR RELATED SERVICES TO THE AGREEMENT

This ADDENDUM #1 FOR RELATED SERVICES TO THE AGREEMENT (the “Addendum”) is effective this 20^th day of July 2020 (“Addendum Effective Date”) by and between Mateon Therapeutics INC., a Delaware corporation with its principal office at 29397 Agoura Rd., Suite 107, Agoura Hills, CA 91301, USA (“Mateon”) and IMPATIENS N.V. acting under the trade name myTomorrows, a company formed and registered under the laws of the Netherlands, and located at Anthony Fokkerweg 61, 1059 CP, Amsterdam, The Netherlands (“Impatients”) will be incorporated into the Expanded Access Program (EAP) Master Services Agreement between Mateon and Impatients dated 30^th May 2020 (the “Agreement”). Capitalized terms used in this Statement of Work will have the same meaning as set forth in the Agreement.

In addition to the EAP services that follow from the Agreement, Mateon wishes to hereby separately engage Impatients for the provision of the following Services (as defined below):

1. Services.

Impatients shall, at its sole discretion, support Mateon with the application process for a clinical trial of the Product in the United Kingdom (“Services”). The Services shall include:

● Regulatory writing support

● Submission support

2. Fees.

Impatients shall provide the Services under this Addendum free of charge.

MATEON THERAPEUTICS, INC.		IMPATIENTS N.V. acting under the trade name myTomorrows
By:	/s/ Vuong Trieu	By:	/s/ Pieter Erik de Ridders
Print Name:	Vuong Trieu	Print Name:	Pieter Erik de Ridders
Title:	General Counsel	Title:	General Counsel
Date:	24 July 2020	Date:	23 July 2020

Addendum #1 For Related Services to the Agreement between Mateon & Impatients (MyTomorrows)

Page 1 | 1

EX-10.4

Exhibit 10.4

DATA PROCESSING AGREEMENT

THIS DATA PROCESSING AGREEMENT (“Data Processing Agreement”) is made and entered into on 23 July 2020 (“Effective Date”) by and between

1.	Mateon Therapeutics INC., a company organized and existing under the laws of Delaware and having its registered office at 29397 Agoura Rd., Suite 107, Agoura Hills, CA 91301, USA (“Controller”); and
2.	Impatients N.V., acting under the name myTomorrows, a company organized and existing under the laws of the Netherlands and having its registered office at Anthony Fokkerweg 61, 1059 CP Amsterdam, the Netherlands (“Processor”);

Each of the above parties are individually referred to as “Party” and jointly as “Parties”.

RECITALS

A.	WHEREAS, Controller and Processor entered into a service agreement as of 23 July 2020 (“Agreement”) pursuant to which Processor agreed to provide certain services to Controller as specified in the Agreement, including any statements of work, and Privacy Annex (Annex 1) to this Data Processing Agreement (“Services”);
B.	WHEREAS, Controller engages Processor to on behalf of Controller process Personal Data defined in the Privacy Annex (Annex 1) and any other personal data processed by Processor on behalf of Controller pursuant to the Agreement (“Personal Data”);
C.	WHEREAS, this Data Processing Agreement includes the terms and conditions governing the processing of Personal Data by Processor on behalf of Controller with the aim to ensure the Parties comply with Applicable Laws as defined below.

NOW, THEREFORE, the Parties agree as follows:

1. DEFINITIONS AND INTERPRETATION

1.1. For the purposes of this Data Processing Agreement, the following terms shall have the following definitions and interpretation:

“Applicable Laws” means any EU, EU Member State, national, regional and local laws, rules, regulations, declarations, requirements, guidelines approved by supervisory or other competent bodies and polices that apply to or govern the processing of Personal Data as set out in the Privacy Annex (Annex 1), including the General Data Protection Regulation (EU) 2016/679 (“GDPR”) and relevant national laws, as amended from time to time.

“EEA” means European Economic Area.

“Personal Data Breach” means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, Personal Data transmitted, stored or otherwise processed.

“Subprocessor” means any data processor (including any third party and any Processor Affiliate) engaged by Processor to process personal data on behalf of Controller.

Page 1 of 7

“Supervisory Authority” means (a) an independent public authority which is established by a Member State pursuant to Article 51 GDPR; and (b) any similar regulatory authority responsible for the enforcement of Applicable Laws.

1.2 Other terms like “process/processing”, “data subject”, “(data) processor”, “(data) controller”, “data protection impact assessment”, etc. shall have the meaning ascribed to them in the Applicable Laws with regard to the Personal Data.

2. PROCESSING OF PERSONAL DATA

2.1. Processor shall provide the Services and shall process the Personal Data within the context of the Agreement on behalf of Controller and for the specific purposes as set out in the Privacy Annex (Annex 1) to this Data Processing Agreement.

2.2. Processor represents and warrants that it shall not process, transfer, modify, amend or alter the Personal Data or disclose or permit the disclosure of the Personal Data to any third party other than in accordance with the Controller’s documented instructions (in the Principal Agreement or otherwise), unless processing is required by EU or Member State law to which Processor is subject, in which case Processor shall to the extent permitted by such law inform Controller of that legal requirement before processing that Personal Data. Processor shall not process Personal Data for own purposes, except where it is regarded as data controller for the processing of Personal Data.

2.3. Controller represents and warrants that it is fully authorized and entitled to provide the Personal Data to Processor for processing and let Processor process the Personal Data for the purposes of the Agreement and for the specific purposes as set out in the Privacy Annex (Annex 1) and in execution of the Services.

3. DATA SUBJECT RIGHTS

3.1. Processor shall promptly, and in any case within five (5) working days, notify Controller if it receives a request from a data subject under any Applicable Laws in respect of Personal Data, including requests by a data subject to exercise rights in Chapter III of GDPR, and shall provide full details of that request.

3.2. Processor shall provide all reasonable assistance to Controller to enable Controller to comply with any exercise of rights by a data subject under any Applicable Laws in respect of Personal Data and comply with any assessment, enquiry, notice or investigation under Applicable Laws in respect of Personal Data or this Data Processing Agreement.

4. SECURITY OF PERSONAL DATA

4.1. Without prejudice to any other security requirements agreed upon between the Parties, Processor shall protect the processing of Personal Data and ensure a level of security of the Personal Data appropriate to the risk in accordance with Article 32 GDPR, among others by taking appropriate technical and organisational measures, that in view of the current state of the art and the related costs are in line with the nature of the Personal Data to be processed, the scope, context and purposes of the processing of the Personal Data, as well as the risk varying according to likelihood and severity for the rights and freedoms of data subjects. These measures encompass, where appropriate:

4.1.1. the ability to ensure the ongoing confidentiality, integrity, availability and resilience of processing systems and services;

4.1.2. the ability to restore the availability and access to Personal Data in a timely manner in the event of a physical or technical incident;

Page 2 of 7

4.1.3. a process for regularly testing, assessing and evaluating the effectiveness of technical and organisational measures for ensuring the security of processing.

4.2. The Parties acknowledge that security requirements are constantly changing, and that effective security requires frequent evaluation and regular improvements of outdated security measures. Processor shall therefore continuously evaluate the technical and organisational measures as described herein and shall tighten, supplement and improve these security measures to maintain compliance with Applicable Laws.

5. PERSONAL DATA BREACHES

5.1. Processor shall notify Controller without unreasonable delay upon becoming aware of a Personal Data Breach in connection with the processing of Personal Data and shall provide Controller with information to allow Controller to meet any obligations to report a Personal Data Breach under the Applicable Laws. Such notification shall as a minimum:

5.1.1. describe the nature of the Personal Data Breach, the data subjects concerned, and the Personal Data records concerned;

5.1.2. communicate the name and contact details of Processor’s data protection officer or other relevant contact form whom more information may be obtained;

5.1.3. describe the likely consequences of the Personal Data Breach; and

5.1.4. describe the measures taken or proposed to address the Personal Data Breach.

5.2. Processor shall provide all reasonable assistance and shall take all reasonably steps to assist in the investigation, mitigation and remediation of each Personal Data Breach to enable Controller to (i) perform a thorough investigation into the Personal Data Breach, (ii) formulate a correct response; and (iii) to take further steps in respect of the Personal Data Breach in order to meet any requirements under the Applicable Laws.

6. SUBPROCESSORS

6.1. From the Effective Date of this Data Processing Agreement, Processor may use the Subprocessors set out in the Privacy Annex (Annex 1). Processor may use additional Subprocessors to process Personal Data only with the prior written approval of Controller, which approval shall not be unreasonably withheld.

7. INTERNATIONAL TRANSFERS

7.1. If and insofar the Personal Data is processed outside of the EEA, the Parties shall only process the Personal Data when there is an adequate level of protection in place.

8. CONFIDENTIALITY

8.1. In accordance with the confidentiality provisions of the Agreement, Processor shall keep Personal Data confidential. For the avoidance of doubt, all Personal Data shall be considered as Confidential Information in the Agreement.

9. DATA PROTECTION IMPACT ASSESSMENT AND PRIOR CONSULTATION

9.1. Processor shall provide reasonable assistance to Controller with any data protection impact assessments which are required under Article 35 GDPR and with any prior consultations to any Supervisory Authority of Controller or any of its affiliates which are required under Article 36 GDPR, in each case in relation to processing of Personal Data by Processor on behalf of Controller and taking into account the nature of the processing and information available to Processor.

Page 3 of 7

10. PROVISION OF INFORMATION AND AUDITS

10.1. Processor shall make available to Controller on request any relevant information that is reasonably necessary to demonstrate compliance with this Data Processing Agreement.

10.2. Processor shall allow for and reasonably contribute to audits of the processing of Personal Data and the premises where such processing takes place. Processor shall provide all reasonable cooperation to Controller in respect of any such audit and shall at the request of Controller, provide Controller with evidence of compliance with its obligations under this Data Processing Agreement. Processor shall immediately inform Controller if, in its opinion, an instruction pursuant to this Clause 10 infringes any Applicable Laws.

11. INDEMNITY AND LIABILITY

11.1. Notwithstanding any provisions of the Agreement or this Data Processing Agreement to the contrary, each Party shall indemnify, defend and hold harmless the other Party from any claims (including third party claims), suits, demands, judgements, actions, liabilities, expenses (including reasonable attorney’s fees) and damages of any kind relating to its breach of this Data Processing Agreement, and/or its negligence or wilful misconduct.

11.2. Notwithstanding any provisions of the Agreement or this Data Processing Agreement to the contrary, the limitation of liability set forth in the Agreement shall also apply to this Data Processing Agreement.

12. DURATION AND TERMINATION

12.1. This Data Processing Agreement shall remain in full force and effect for the duration that Processor processes Personal Data on behalf of Controller under the Agreement.

12.2. Any obligation imposed on either Party under this Data Processing Agreement, or any provision that by their nature is intended to survive this Data Processing Agreement shall survive any termination or expiration of this Data Processing Agreement.

13. STORAGE, RETURN AND DESTRUCTION

13.1. Processor shall store the Personal Data no longer than strictly necessary (i) for the provision of Services; (ii) if a storage period is agreed between the Parties, no longer than this storage period; or (iii) to comply with statutory obligations.

13.2. Processor shall promptly, of the earlier of: (i) no longer processing of Personal Data; or (ii) termination of the Agreement, at the choice of Controller either: (a) return a complete copy of all Personal Data to Controller and securely wipe all other copies of Personal Data processed by Processor or any Subprocessor; or (b) securely wipe all copies of Personal Data processed by Processor or any Subprocessor; and in each case provide written confirmation to Controller that it has complied with this Clause 13, except insofar Processor is required by Applicable Laws to retain such Personal Data.

14. MISCELLANEOUS

14.1. Modifications or amendments of this Data Processing Agreement shall only be effective if made in writing and signed by an authorized representative of both Parties.

14.2. If any provision of this Data Processing Agreement is invalid or unenforceable, then the remainder shall remain valid and in force.

14.3. In the event of inconsistencies between the provisions of this Data Processing Agreement and the Agreement and/or any Scope of Work, the provisions of this Data Processing Agreement shall prevail with regard to the Parties’ data protection obligations.

Page 4 of 7

14.4. This Data Processing Agreement shall be governed by and in accordance with the laws of the Netherlands, without giving effect to any choice of law principles that would require the application of the laws of a different jurisdiction. Any disputes arising out or in connection with this Data Processing Agreement shall be brought exclusively before the competent court of Amsterdam, the Netherlands.

IN WITNESS WHEREOF, the Parties hereto have executed this Data Processing Agreement as of the Effective Date by their duly authorized signatories.

Impatients N.V.		Mateon Therapeutics INC.
Signature:	/s/ Vuong Trieu	Signature:	/s/ Peter Erik de Ridders
By:	Vuong Trieu	By:	Pieter Erik de Ridders
Title:	CEO	Title:	General Counsel
Date:	24 July 2020	Date:	23 July 2020

Page 5 of 7

PRIVACY ANNEX (ANNEX 1)

1. SUBJECT MATTER OF THE PROCESSING OF PERSONAL DATA

Processor and Controller have entered into the Agreement pursuant to which Processor agreed to provide certain Services to Controller, wherein Processor, as a service provider to Controller, shall conduct Expanded Access Program management and RWD collection management for (potential) patients on behalf of Controller. In providing these Services, Processor shall process Personal Data of these (potential) patients. This Annex 1 states which Personal Data will be processed by Processor and for what purposes.

2. NATURE AND PURPOSE OF THE PROCESSING OF PERSONAL DATA

Controller shall obtain the necessary consent of the (potential) patients participating in Expanded Access Programs, to be processed by Processor for the following purposes:

● Expanded Access Program management on Mateon’s behalf for the Services as specifically described in the Agreement (and separate Statements of Work).

● RWD collection management on Mateon’s behalf for the Services as specifically described in the Agreement (and separate Statements of Work).

3. CATEGORIES OF PERSONAL DATA TO BE PROCESSED

Processor shall process the following (categories of) Personal Data in the performance of the Services to Controller under the Agreement:

● Personal identification data including first name, last name, initials, date of birth, sex/gender, email address, phone number, city of residence, country of residence.

● Technical/device data including browser, IP-address, usernames.

● Personal medical data including relevant health care information (e.g. weight, heart rate, disability), relevant demographics, relevant disease history, dosing, safety data, effectiveness data, ethnic origin (if necessary).

4. CATEGORIES OF DATA SUBJECTS TO WHOM THE PERSONAL DATA RELATES

Processor shall process the Personal Data of the following (categories of) data subjects in the execution of the Services to Controller under the Agreement:

● Patients participating in an Expanded Access Program

● Patients participating in RWD collection.

5. LIST OF SUBPROCESSORS

Processor uses the following Subprocessors in the execution of the Services to Controller under the Agreement:

Name	Description	Location
Microsoft Azure / Dynamics 365	Provides applications and servers that myTomorrows uses for general day-to-day business and performance of its day-to-day services to clients (e.g. emails and storage).	EU
Castor EDC	Provides an application and servers for the collection and management of data that is used by myTomorrows in the performance of the Services, including RWD collection.	EU

Page 6 of 7

6. DATA PROTECTION CONTACTS

All notices, requests, demands and approvals under this Data Processing Agreement and with regard to any privacy matters shall be sent to the following contacts:

myTomorrows
Name:	Pieter Erik de Ridders
Function:	General Counsel and Data Protection Officer
Email:	pietererik.deridders@mytomorrows.com
Phone:	+31 (0)88 525 3 888
Mateon Therapeutics
Name:
Function:
Email:
Phone:

Page 7 of 7