Clinical Trial Collaboration and Supply Agreement by and between Amgen Inc. and IDEAYA Biosciences, Inc. made as of July 26, 2022

EX-10.1 2 idya-ex10_1.htm EX-10.1 EX-10.1

Exhibit 10.1

CLINICAL TRIAL COLLABORATION AND SUPPLY AGREEMENT

This CLINICAL TRIAL COLLABORATION AND SUPPLY AGREEMENT (this “Agreement”), made as of July 26, 2022 (the “Effective Date”), is by and between Amgen Inc., a Delaware corporation, having its principal place of business at One Amgen Center Drive, Thousand Oaks, CA 91362 (“Amgen”), and IDEAYA Biosciences, Inc., having its principal place of business at 7000 Shoreline Court, Suite 350, South San Francisco, California 94080 (“Ideaya”). Amgen and Ideaya are sometimes each referred to herein individually as “Party” and collectively “Parties”.

RECITALS

A. Amgen and Ideaya are both research–based pharmaceutical companies involved in the research, development, manufacture and sale of medicines for use in humans and are particularly interested in cancer research.

B. Ideaya is developing the Ideaya Compound (as defined below) for the treatment of cancer.

C. Amgen is developing the Amgen Compound (as defined below) for the treatment of cancer.

D. The Parties desire to collaborate for the conduct of a certain clinical trial in which the Amgen Compound and the Ideaya Compound (collectively, “Compounds”) would be dosed concurrently or in combination in accordance with the Development Plan (as defined below), the Protocol (as defined below) and the terms of this Agreement.

E. Amgen and Ideaya desire to agree on various terms and conditions to govern the Parties’ respective rights and obligations in connection with the collaboration, including with regard to the performance of the clinical trial, supply of Compounds for the trial and the ownership, use and publication of the results of such trial.

NOW, THEREFORE, in consideration of the premises and of the following mutual promises, covenants and conditions, the Parties, intending to be legally bound, mutually agree as follows:

Definitions.

For all purposes of this Agreement, and all amendments hereto, the capitalized terms, whether used in the singular or plural, defined in this Article 1 and throughout this Agreement will have the meanings herein specified.

1.1

“Adverse Event”, “AE” shall have the meanings provided to such terms in the International Conference on Harmonization (“ICH”) guideline for industry on Clinical Safety Data Management (E2A, Definitions and Standards for Expedited Reporting).

1.2

“Affiliate” means with respect to a particular Party, a firm, corporation or other entity which directly or indirectly owns or controls said Party, or is owned or controlled by said Party, or is under common ownership or control with said Party. The word “control” means (a) the direct or indirect ownership of fifty percent (50%) or more of the outstanding voting securities of a legal entity, or (b) possession, directly or indirectly, of the power to direct the management or policies of a legal entity, whether through the ownership of voting securities, contract rights, voting rights, corporate governance or otherwise.

1.3

“Agreement” has the meaning set forth in the preamble, and includes the Appendices attached hereto, the Related Agreements and any and all amendments of any of the foregoing hereafter signed by the Parties with reference to this Agreement and made part hereof.

1.4

“Amgen” has the meaning set forth in the preamble.

1.5

“Amgen Class Compound” means a small molecule methylthioadenosine

[***] Certain information in this document has been excluded pursuant to Regulation S-K, Item 601(b)(10). Such excluded information is not material and would likely cause competitive harm to the registrant if publicly disclosed.

cooperative protein arginine methyltransferase 5 (PRMT5) inhibitor.

1.6

“Amgen Clinical Data” shall have the meaning set forth in Section 3.8.

1.7

“Amgen Compound” means the Amgen small molecule methylthioadenosine cooperative protein arginine methyltransferase 5 (PRMT5) inhibitor known as AMG 193, including any metabolites, prodrugs, isomers, enantiomers, esters, salts, hydrates, solvates, or polymorphs thereof, and any drug candidate or product containing any of the foregoing as the sole active ingredients.

1.8

“Amgen Indemnitees” has the meaning set forth in Section 15.2.1.

1.9

“Amgen Sole Inventions” has the meaning set forth in Section 10.2.

1.10

“Anti-Corruption Laws” means the U.S. Foreign Corrupt Practices Act, as amended, the UK Bribery Act 2010, as amended, and any other applicable laws, rules and regulations relating to or concerning public or commercial bribery or corruption.

1.11

“Applicable Law” means all federal, state, local, national and regional statutes, laws, rules, regulations and directives applicable to a particular activity hereunder, including performance of clinical trials, medical treatment and the processing and protection of personal and medical data, that may be in effect from time to time, including those promulgated by the United States Food and Drug Administration (“FDA”), the European Medicines Agency (“EMA”) and any successor agency to the FDA or EMA or any agency or authority performing some or all of the functions of the FDA or EMA in any jurisdiction outside the United States or the European Union (each a “Regulatory Authority” and collectively, “Regulatory Authorities”), and including (a) cGMP and GCP (each as defined below), (b) Data Protection Laws (as defined below), (c) export control and economic sanctions regulations which prohibit the shipment of United States-origin products and technology to certain restricted countries, entities and individuals, (d) Anti-Corruption Laws, (e) laws and regulations governing payments to healthcare providers, and (f) any United States or other country’s or jurisdiction’s successor or replacement statutes, laws, rules, regulations and directives relating to the foregoing.

1.12

“Background IP” means, with respect to a Party, any intellectual property rights Controlled by such Party that cover inventions other than Inventions.

1.13

“Business Day” means any day other than a Saturday, Sunday or any public holiday in the country where the obligations are to be performed.

1.14

“Calendar Quarter” means a three-month period beginning on January, April, July or October 1st.

1.15

“CDA” has the meaning set forth in Section 9.1.

1.16

“cGMP” means the current Good Manufacturing Practices officially published and interpreted by EMA, FDA and other applicable Regulatory Authorities that may be in effect from time to time and are applicable to the Manufacture of the Compounds.

1.17

“Clinical Data” means all data (including raw data) and results generated under the Study, including the sample analysis data and results as described in Section 3.8 (Ownership of Clinical Data).

1.18

“Clinical Quality Agreement” means that certain clinical quality agreement relating to this Agreement to be entered into by the Parties in accordance with Section 2.8 (Clinical Quality Agreement and Pharmacovigilance Agreement).

1.19

“Combination” means the combination of the Ideaya Compound and the Amgen Compound administered separately, simultaneously or sequentially for treatment of patients in the Study.

1.20

“Combination Clinical Data” shall have the meaning as set forth in Section 3.8.

1.21

“Commercially Reasonable Efforts” means, with respect to a Party, the level of effort and resources normally devoted by such Party to conduct or support the conduct (including manufacturing and supply of clinical materials) of a clinical trial for a biopharmaceutical product or compound that is owned by it or to which it has rights, which is of similar market potential, and profit potential at a similar stage in its development or product life, based on conditions then prevailing.

1.22

“Competitive Program” means, with respect to the Study, (i) in the case of Amgen, a program for the clinical development or commercialization of the Ideaya Class Compound, and (ii) in the case of Ideaya, a program for the clinical development or commercialization of the Amgen Class Compound.

1.23

“Compounds” has the meaning set forth in the introduction.

1.24

“Confidential Information” means any proprietary information, data or materials, including Know-How, furnished to one Party by the other Party, or provided by a Third Party on behalf of, or as part of a collaboration with, the other Party, in each case, as provided pursuant to this Agreement, except to the extent that it can be established by the receiving Party that such proprietary information or materials: (a) was already known to, or was otherwise in the possession of the receiving Party (or its Affiliates), other than under an obligation of confidentiality, at the time of disclosure by the other Party; (b) was generally available to the public or otherwise part of the public domain at the time of its disclosure to the receiving Party; (c) became generally available to the public or otherwise part of the public domain after its disclosure and other than through any act or omission of the receiving Party in breach of this Agreement; (d) was disclosed to the receiving Party (or its Affiliates), other than under an obligation of confidentiality, by a Third Party who had no obligation to the disclosing Party not to disclose such information to others; or (e) was subsequently discovered or developed by or for the receiving Party or its Affiliates without the use of the Confidential Information.

1.25

“Control” means, as to any patent right or other intellectual property right, the possession (whether by ownership or license, other than by a license granted pursuant to this Agreement) by a Party or its Affiliates of the ability to grant to the other Party access, ownership, a license or a sublicense as required herein to such patent right or other intellectual property right, without (a) violating the terms of any agreement or other arrangement with any Third Party in existence as of the time such Party or its Affiliates would first be required hereunder to grant the other Party such access, ownership, license or sublicense, and (b) violating any Applicable Law. “Controlled”, “Controls” and “Controlling” have their correlative meanings.

1.26

“Covered Individuals and Entities” (or, in the singular, “Covered Individual and Entity”) means any one or more of an HCP, HCI, Payor, Purchaser, Healthcare Industry Professional Society and Trade Association, and entities owned or operated by one or more HCP, HCI, Payor, Purchaser, or Healthcare Industry Professional Society and Trade Association.

1.27

“Data Protection Law” means (a) any applicable law, statute, declaration, decree, directive, legislative enactment, order, ordinance, regulation, rule or other binding restriction which relates to the protection of individuals with regards to the processing of Personal Data, including the United States Health Insurance Portability and Accountability Act of 1996 and its implementing regulations (“HIPAA”), the EU General Data Protection Regulation 2016/679 (the “GDPR”) and any member state implementing legislation or regulation related thereto, the Privacy and Electronic Communications Directive 2002/58/EC, the UK Data Protection Act 2018 (“DPA”), the UK General Data Protection Regulation as defined by the DPA as amended by the Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (together with the DPA, the “UK GDPR”), the Privacy and Electronic Communications Regulations 2003, and any supranational or national legislation relating to the protection of Personal Data, in each case as amended, consolidated, re-enacted or replaced from time to time, and (b) any binding code of practice or guidance published by a relevant regulatory body from time to time.

1.28

“Database Lock” means that all Clinical Data has been received and processed, all queries have been resolved, all external data (e.g. lab results) have been integrated into the main database for the Study, the completion of the final quality audit ensuring that all Clinical Data is present, correspondent and accurate and that the edit access of the database has been removed.

1.29

“Defending Party” has the meaning set forth in Section 15.2.3.

1.30

“Delivery” has the meaning set forth in Section 8.3.1.

1.31

“Development Plan” means the plan specifying each Party’s general tasks and activities for the conduct of the Study, as agreed by the Parties, and including, at a minimum, (a) a summary-level outline of the Study to be performed to evaluate the safety and efficacy of the Combination and (b) an estimated number of patients to be enrolled in the Study. A copy of the initial draft of the Development Plan will be attached hereto as Appendix B. The Development Plan, as amended, forms an integral part of this Agreement. In the event of any conflict, inconsistency or discrepancy between the terms of this Agreement and the terms of the Development Plan, the terms of this Agreement shall prevail to the extent of such conflict, inconsistency or discrepancy.

1.32

“Direct Costs” means the third party pass-through expenses incurred by Amgen in conducting activities under the Development Plan including the conduct of the Study, such costs to include all out-of-pocket expenses (other than Amgen Compound manufacturing expenses) that are directly attributable or reasonably allocable to the conduct of the Combined Therapy Clinical Trials, such as (i) Contract Research Organization (“CRO”) fees and expenses (including any fees allocated to payment of employees or contractors of the applicable CRO), (ii) per patient study participation fees, and (iii) clinical site fees and costs, without any profit, overhead, or general administration charges or mark-up applied by Amgen.

1.33

“Disclosure Laws” has the meaning set forth in Section 5.2.

1.34

“Disclosure Subject” has the meaning set forth in Section 5.2.

1.35

“Dispute” has the meaning set forth in Section 16.8 (Dispute Resolution, Jurisdiction and Governing Law).

1.36

“Effective Date” has the meaning set forth in the preamble.

1.37

“Efficacy Result” shall mean a finding or suggestion in the course of the Study with respect to the efficacy of the Combination in treating Study subjects compared to the Ideaya Compound as a monotherapy or the Amgen Compound as a monotherapy.

1.38

“EMA” has the meaning set forth in the definition of “Applicable Law”.

1.39

“EU” means the European Union, comprised of those countries, nations, states or other territories under the scope of the EMA (or any successor agency thereto), as such scope may change from time to time.

1.40

“Executive Officers” shall have the meaning as set forth in Section 3.10.

1.41

“FDA” has the meaning set forth in the definition of “Applicable Law”.

1.42

“Final Study Report” means the study report from the Study by the study investigators, including completed case report forms for all patients who participated in the Study, as such study report is in the form that would be filed with the FDA and is in conformity with the requirements of “Clinical Study Reports” as outlined in the guideline “ICH E3 Guidance, Structure and Content of Clinical Study Reports”.

1.43

“Good Clinical Practices” or “GCP” means, as to the United States and the European Union, applicable good clinical practices as reflected in the relevant ICH guidances and all addenda as in effect in the United States and the European Union, respectively, during the Term and, with respect to any other jurisdiction, clinical practices equivalent to good clinical practices as then in effect in the United States or the European Union.

1.44

“Good Laboratory Practices” or “GLP” means, as to the United States and the European Union, applicable good laboratory practices as in effect in the United States, under 21 CFR Part 58 and the European Union, respectively, during the Term and, with respect to any other jurisdiction, laboratory practices equivalent to good laboratory practices as then in effect in the United States or the European Union.

1.45

“Good Manufacturing Practices” or “GMP” means, as to the United States and the European Union, applicable good manufacturing practices as in effect in the United States under 21 CFR Parts 210 and 211 and all applicable guidelines in the European Union, respectively, during the Term and, with respect to any other jurisdiction, manufacturing practices equivalent to good manufacturing practices as then in effect in the United States or the European Union.

1.46

“Governmental Authority” means any government administrative agency, commission or other governmental authority, body or instrumentality, or any multi-national, federal, state, local, domestic or foreign governmental regulatory body.

1.47

“Government Official” means: (a) any officer or employee of a Governmental Authority or any department, agency or instrument of a government, (b) any Person acting in an official capacity for or on behalf of a Governmental Authority or any department, agency, or instrument of a government, (c) any officer or employee of a business owned in whole or part by a government, (d) any officer or employee of a public international organization such as the World Bank or United Nations, (e) any officer or employee of a political party or any Person acting in an official capacity on behalf of a political party, (f) any candidate for political office, or (g) any Person who holds himself out to be the authorized intermediary of any of the foregoing; who, when such Government Official is acting in an official capacity, or in an official decision-making role, has responsibility for performing regulatory inspections, government authorizations or licenses, or otherwise has the capacity to make decisions with the potential to affect the business of either of the Parties.

1.48

“GSK” means GlaxoSmithKline Intellectual Property (No. 4) Limited.

1.49

“GSK Agreement” means that certain Collaboration, Option and License Agreement, dated as of June 15, 2020, by and between Ideaya and GSK.

1.50

“Healthcare Industry Professional Society and Trade Association” means a non-profit or tax exempt healthcare industry organization seeking to further a particular profession, the interests of individuals engaged in that profession, or the public interest (examples of such include the American Society of Hematology, the North American Society for Dialysis and Transplantation, the American Society of Hypertension, the American Cancer Society and the American Society of Clinical Oncology).

1.51

“Healthcare Institution” or “HCI” means a facility that provides health maintenance, or treats illness and injury, and can include any hospital, convalescent hospital, dialysis center, health clinic, nursing home, extended care facility, or other institution devoted to the care of sick, infirm, or aged persons, and is in a position to purchase or influence a purchasing decision for any human therapeutic product marketed, distributed, or sold or any service related thereto provided by or on behalf of a Party or any of its Affiliates.

1.52

“Healthcare Professional” or “HCP” means any person licensed to prescribe a Party’s product, as well as anyone working for a person licensed to prescribe a Party’s product and/or in a position to influence a purchasing decision, including physicians and other providers (e.g., nurses, pharmacists, dialysis providers, and other medical office personnel).

1.53

“HIPAA” has the meaning set forth in the definition of “Applicable Law”.

1.54

“ICC” shall have the meaning as set forth in Section 16.8.2.

1.55

“Ideaya” has the meaning set forth in the preamble.

1.56

“Ideaya Class Compound” means a small molecule small molecule inhibitor targeting methionine adenosyltransferase 2a (MAT2A).

1.57

“Ideaya Clinical Data” has the meaning set forth in Section 3.8.

1.58

“Ideaya Compound” means the Ideaya small molecule inhibitor targeting methionine adenosyltransferase 2a (MAT2A) known as IDE397, including any metabolites, prodrugs, isomers, enantiomers, esters, salts, hydrates, solvates, or polymorphs thereof, and any drug candidate or product containing any of the foregoing as the sole active ingredients.

1.59

“Ideaya Indemnitees” has the meaning set forth in Section 15.2.1 (Indemnification by Amgen).

1.60

“Ideaya Sole Inventions” has the meaning set forth in Section 10.3.

1.61

“IND” means (a) an Investigational New Drug Application as defined in the United States Food, Drug and Cosmetic Act, as amended, and regulations promulgated thereunder, or any successor application or procedure required to initiate clinical testing of a drug in humans in the United States, (b) a counterpart of such an Investigational New Drug Application that is required in any other country before beginning clinical testing of a drug in humans in such country, including, for clarity, a “clinical trial application” in the European Union, and (c) all supplements and amendments to any of the foregoing.

1.62

“Indemnified Party” and “Indemnifying Party” have the meaning set forth in Section 15.2.3.

1.63

“Indemnify” has the meaning set forth in Section 15.2.1 (Indemnification by Amgen).

1.64

“Inventions” means all inventions and discoveries, whether or not patentable, which are conceived or reduced to practice in the design or performance of the Study by or on behalf of a Party (including by a Third Party (such as a contractor) on behalf of, or as part of a collaboration with, a Party).

1.65

“Invoice” means an original or electronically signed (through a validated system, e.g. DocuSign) invoice sent by Amgen to Ideaya with respect to any payment due under this Agreement. Amgen understands that Ideaya will provide Amgen with the correct purchase order number prior to Amgen providing the first Invoice and whenever such purchase order number changes. Notwithstanding the foregoing, nothing herein shall prevent Amgen from sending Ideaya the first Invoice if such purchase order number is not received by Amgen within [***] days following the Effective Date.

1.66

“Joint Oversight Committee” or “JOC” has the meaning set forth in Section 3.10.

1.67

“Jointly Owned Invention” has the meaning set forth in Section 10.1.1.

1.68

“Joint Patent Application” has the meaning set forth in Section 10.1.2.

1.69

“Joint Patent” means a patent that issues from a Joint Patent Application.

1.70

“Know-How” means any proprietary invention, innovation, improvement, development, discovery, computer program, device, trade secret, method, know-how, process, technique

or the like, including manufacturing, use, process, structural, operational and other data and information, whether or not written or otherwise fixed in any form or medium, regardless of the media on which contained and whether or not patentable or copyrightable.

1.71

“Liability” has the meaning set forth in Section 15.2.1 (Indemnification by Amgen).

1.72

“Manufacture,” “Manufactured,” or “Manufacturing” means all stages of the manufacture of the Compounds including the planning, purchasing, manufacture, processing, compounding, storage, filling, packaging, waste disposal, labeling, leafleting, testing, quality assurance, quality control, sample retention, stability testing, release, dispatch and supply.

1.73

“Manufacturer’s Release” or “Release” has the meaning ascribed to such term in the Clinical Quality Agreement.

1.74

“Manufacturing Site” means the facilities where the Compounds are manufactured, as such Manufacturing Sites may change from time to time in accordance with Section 8.6 (Changes to Manufacturing).

1.75

“Material Safety Issue” means a Party’s good faith belief that there is an unacceptable risk for harm in humans based upon: (i) pre‑clinical safety data, including data from animal toxicology studies, or (ii) the observation of serious Adverse Events in humans after the Amgen Compound or the Ideaya Compound, either as a single agent or in combination with another pharmaceutical agent (including in the Combination), has been administered to or taken by humans (including during the Study).

1.76

“Material Transfer Agreement” means that certain Material Transfer Agreement, dated as of July 26, 2022, between the Parties.

1.77

“Non-Conformance” means an event that deviates from an approved cGMP requirement, such as a procedure, Specification, or operating parameter or that requires an investigation to assess impact to Ideaya Compound quality. Classification of the Non-Conformance is detailed in the Clinical Quality Agreement.

1.78

“Other Party” has the meaning set forth in Section 15.2.3.

1.79

“Party” has the meaning set forth in the preamble.

1.80

“Person” means an individual, corporation, partnership, limited liability company, limited partnership, trust, business trust, association, joint stock company, joint venture, pool, syndicate, “group” as defined in Section 13(d)(3) of the U.S. Securities Exchange Act of 1934, as amended, sole proprietorship, unincorporated organization, Governmental Authority or any other form of entity not specifically listed herein.

1.81

“Personal Data” has the meaning given in applicable Data Protection Laws.

1.82

“Pharmacovigilance Agreement” means that certain pharmacovigilance agreement to be entered into by the Parties setting forth the Parties’ safety-related obligations for the Compounds.

1.83

“Preclinical Data” has the meaning set forth in the Material Transfer Agreement.

1.84

“Protocol” means the written documentation that describes the Study and sets forth specific activities to be performed as part of the Study conduct.

1.85

“Project Manager” has the meaning set forth in Section 3.10 (Joint Oversight Committee).

1.86

“Regulatory Approvals” means, with respect to the Compounds, any and all permissions (other than the manufacturing approvals) required to be obtained from Regulatory Authorities and any other competent authority for the development, registration, importation and distribution in the United States, Europe and in other applicable countries for use in the Study.

1.87

“Regulatory Authorities” has the meaning set forth in the definition of “Applicable Law”.

1.88

“Regulatory Documentation” means, with respect to a given Compound, all submissions to Regulatory Authorities in connection with such Compound for use in the Study, including all INDs and amendments thereto, drug master files, correspondence with regulatory agencies, periodic safety update reports, adverse event files, complaint files, inspection reports and manufacturing records, in each case, together with all supporting documents (including documents that include applicable Clinical Data).

1.89

“Related Agreements” means the Material Transfer Agreement, the Pharmacovigilance Agreement, the Clinical Quality Agreement, and any agreements between the Parties entered into pursuant to Section 11.3.2.

1.90

“Representative” has the meaning set forth in Section 14.6.6.

1.91

“Request” has the meaning set forth in Section 16.8.2.

1.92

“Response Period” has the meaning set forth in Section 3.5 (Regulatory Matters).

1.93

“Rules” has the meaning as set forth in Section 16.8.2.

1.94

“Sample” means a biological specimen collected under the Study from an appropriately consented study subject (including fresh or archived tumor samples, serum, peripheral blood mononuclear cells, plasma, and whole blood for RNA and DNA sample isolation).

1.95

“Shortage” has the meaning set forth in Section 8.10 (Shortage; Allocation).

1.96

“Sole Invention” means an Amgen Sole Invention or an Ideaya Sole Invention, as applicable.

1.97

“Specifications” means the written specifications established for the characteristics, quality and quality control testing procedures for the Ideaya Compound as set forth in the Clinical Quality Agreement.

1.98

“Standard Contractual Clauses” means, (a) in respect of transfers of Personal Data subject to the GDPR, the standard contractual clauses for the transfer of Personal Data to third countries set out in Commission Decision 2021/914 of 4 June 2021, specifically including Module 1 (Controller to Controller); and (b) in respect of transfers of Personal Data subject to the UK GDPR, the International Data Transfer Addendum to the EU Commission Standard Contractual Clauses (version B.1.0) issued by the UK Information Commissioner, in each case as amended, updated or replaced from time to time.

1.99

“Study” means that arm of that certain individual clinical trial as described in the Protocol that utilizes the Amgen Compound and the Ideaya Compound as more fully described in the Protocol.

1.100

“Study Completion” has the meaning set forth in Section 3.6 (Final Study Report).

1.101

“Term” has the meaning set forth in Section 6.1 (Term).

1.102

“Territory” means all countries and territories in the world.

1.103

“Third Country” means (a) in relation to Personal Data subject to the GDPR, any country outside of the scope of the data protection laws of the European Economic Area, excluding countries approved as providing adequate protection for Personal Data by the European Commission from time to time; and (b) in relation to Personal Data transfers subject to the UK GDPR, any country outside of the scope of the data protection laws of the UK, excluding countries approved as providing adequate protection for Personal Data by the relevant competent authority of the UK from time to time.

1.104

“Third Party” means any entity other than Amgen, Ideaya or their respective Affiliates.

1.105

“Toxicity and Safety Data” means all clinical adverse event information and/or patient-related safety data included in the Clinical Data for the Study.

1.106

“U.S.” means the United States of America and its territories and possessions.

1.107

“VAT” has the meaning set forth in Section 8.17.

Scope of the Agreement.

2.1

Contribution. Each Party will contribute to the Study such resources to the extent necessary to fulfill its obligations set forth in this Agreement.

2.2

Sponsorship. Amgen will act as the sponsor of the Study and will hold the IND relating to the Study.

2.3

Performance. Each Party agrees to act in good faith in performing its obligations under this Agreement and the Related Agreements and will notify the other Party as promptly as possible in the event of any production delay that is likely to adversely affect supply of its Compound contemplated by this Agreement.

2.4

Compliance. Each Party agrees to process, store, test, release, deliver and supply its Compound for purposes of the Study: (i) in material compliance with its internal specifications; and (ii) in compliance with all Applicable Law, including cGMP and health, safety and environmental protections.

2.5

Subcontractors. Each Party will have the right to subcontract or delegate any portion of its obligations hereunder to subcontractors, provided that such Party will remain solely and fully responsible for the performance of such subcontractors. Each Party will ensure that each of its subcontractors is subject to written obligations to perform its obligations pursuant to the terms of this Agreement and the Related Agreements, including the Appendices attached hereto and thereto, including provisions obligations to maintain the confidentiality of Confidential Information no less protective than those contained in this Agreement and to assign intellectual property rights to enable such Party to comply with its obligations under this Agreement. Each Party will use reasonable efforts to obtain and maintain copies of material documents relating to the obligations performed by such subcontractors that are held by or under the control of such subcontractors to be provided to the other Party, to the extent required under this Agreement.

2.6

Bioanalytical Work. Amgen or a third-party vendor designated by Amgen will be responsible for overall bioanalytical work of Samples from Study subjects on the Combination or on either the Amgen Compound or Ideaya Compound separately as set forth in the Protocol. Amgen shall not be responsible for any costs associated with the transfer, analysis or validation of bioanalytical methods from Ideaya to Amgen or to such third party vendor, as applicable. For the avoidance of doubt, Amgen shall be responsible, at its own expense, for the delivery of such Samples to any third party vendor and any other related logistical matters. Such vendor will provide the processed results of their bioanalytical work of such Samples to Amgen, a summary of which processed results will be included in the Final Study Report or similar report, along with the bioanalytical work of the Ideaya Compound and Amgen Compound performed by or on behalf of Amgen. Any uses of the Samples not set forth in

the Protocol must be in accordance with the applicable informed consent forms and, if done during the term of this Agreement, approved by the JOC. For any approved additional Sample studies Amgen shall conduct or have conducted such studies on such Samples and shall promptly provide a copy of the processed results thereof to Ideaya. For the avoidance of doubt, all bioanalytical work and results for the Combination, Ideaya Compound and Amgen Compound, including those of additional Sample studies conducted during the term of this Agreement are deemed Clinical Data.

2.7

No Further Obligation. Other than as may be agreed to by the Parties (including pursuant to this Section 2.7), this Agreement does not create any obligation on the part of Ideaya to provide the Ideaya Compound for any activities other than the Study, nor does it create any obligation on the part of Amgen to provide the Amgen Compound for any activities other than the Study. Nothing in this Agreement will (i) prohibit either Party from performing clinical studies other than the Study relating to its respective Compound, either individually or in combination with any other compound or product (other than the other Party’s Compound), in any therapeutic area, so long as such Party does not use or rely on the Confidential Information solely owned by the other Party to this Agreement, or (ii) create an exclusive relationship between the Parties with respect to either Compound. The Parties agree that in the event one Party would like to conduct additional clinical studies using the Combination, at the request of such Party, the other Party will discuss in good faith the possibility of conducting such additional study or studies, but such other Party shall be under no obligation to do so. If such additional study or studies is of mutual interest to both Parties, such collaboration to implement an additional study or studies will be addressed in a separate agreement.

2.8

Clinical Quality Agreement and Pharmacovigilance Agreement. The Parties shall use Commercially Reasonable Efforts to execute the Clinical Quality Agreement as required by either Party as promptly as practicable, within [***] days following the Effective Date, but in no event later than the date on which the first shipment of the Ideaya Compound is supplied for use in the Study. For the avoidance of doubt, the understanding of the Parties relating to quality assurance of the Ideaya Compound shall be set forth in the Clinical Quality Agreement. The Parties shall use Commercially Reasonable Efforts to execute the Pharmacovigilance Agreement as promptly as practicable, but in any event prior to first patient first visit of the Study.

Conduct of the Study.

3.1

Conduct. Amgen will perform the Study and will have authority over and ultimate responsibility for the design, conduct and control of the Study in accordance with this Agreement, the Development Plan, the Protocol, and all Applicable Law, subject to Section 4.1 (Protocol and Modifications), (i) through clinical trial sites selected by Amgen and (ii) in accordance with this Agreement, the Protocol and all Applicable Law, including GCP. In addition, Amgen will:

3.1.1

carry out diligently the work detailed in the Protocol in accordance with the provisions of the Protocol and with scientific and technological standards consistent with, or more stringent than, those accepted and commonly used in the pharmaceutical industry; and

3.1.2

comply with all Applicable Law and Amgen’s internal clinical trial and compliance policies related to Amgen’s obligations as sponsor of the Study.

3.2

License Grant for Study Conduct. Each Party hereby grants, and shall cause its Affiliates to grant (effective as of the Effective Date), to the other Party and the other Party’s Affiliates a non-exclusive, non-transferable (except in accordance with Section 16.5), royalty-free license under any intellectual property rights Controlled by such Party, including any rights in such Party’s Background IP and such Party’s rights in any intellectual property rights claiming or covering its Sole Inventions, to use such Party’s Compound in the Territory, solely to the extent needed to conduct the Study, subject to and in accordance with the terms and conditions of this Agreement.

3.3

Record-Keeping. Amgen will maintain reports and all related documentation, to the extent related to the Study, in good scientific manner and in sufficient detail, and in compliance with

Applicable Law, for a time period required by Applicable Law, taking into account all applicable minimum archiving periods. Amgen will provide to Ideaya all information and documentation, to the extent related to the Study, reasonably requested by Ideaya, and will reasonably cooperate with Ideaya to enable Ideaya to:

3.3.1

seek from any Regulatory Authority any approval, authorization or license in connection with the Ideaya Compound, the Study, or the Combination in connection with the performance of the Study;

3.3.2

comply with any of its legal, regulatory and/or contractual obligations or any request by any Regulatory Authority related to the Ideaya Compound or the Combination; and

3.3.3

determine whether the Study has been performed in accordance with this Agreement.

3.4

Duration of Clinical Trial. Amgen will use Commercially Reasonable Efforts to complete the Study within the time frame set forth in the Protocol.

3.5

Regulatory Matters. Amgen will diligently execute its obligations as the Study sponsor arising from or in connection with its interactions with any Regulatory Authority and/or ethics committee with jurisdiction over the Study. Further, Amgen will ensure that all Regulatory Approvals from any Regulatory Authority and/or ethics committee with jurisdiction over the Study are obtained prior to initiating performance of the Study. Ideaya will have the right (but not the obligation) to participate in any discussions with a Regulatory Authority regarding matters related to the Ideaya Compound (including in the Combination). Ideaya will promptly authorize the FDA to cross reference the Ideaya IND(s) for the Ideaya Compound solely for purposes of conducting the Study. As required, Ideaya will file its clinical, non-clinical and CMC data for the Ideaya Compound with the applicable Regulatory Authority or permit cross reference to such data where applicable, referencing Amgen’s IND for the Study as appropriate (however, Amgen will have no right to directly access the specific data and information contained within the Ideaya IND(s) for the Ideaya Compound and, similarly, Ideaya will have no right of access to specific information contained within Amgen’s IND(s) for the Amgen Compound; and in no event will either Party be required to disclose to the other Party information regarding the chemical structure of its Compound). If Amgen receives any comments or other inquiries from a Regulatory Authority that pertain to the Combination (other than solely to the Amgen Compound) or that pertain to the Ideaya Compound (including in the Combination), Amgen will promptly provide such comments and/or inquiries to Ideaya, subject to Amgen’s right to redact any Third Party proprietary information or information relating to other Amgen compounds. To the extent a comment or other inquiry from a Regulatory Authority pertains specifically to the Ideaya Compound, Ideaya will provide its response to Amgen no later than [***] Business Days (or sooner if required by the Regulatory Authority) from the date that Ideaya receives such comments or other inquiries from Amgen (“Response Period”), so that Amgen can forward such response to the Regulatory Authority on Ideaya’s behalf. In the event that it will take Ideaya more than [***] Business Days to provide a response (or, if an earlier response is required by the Regulatory Authority and Ideaya is unable to respond sooner within the requisite Regulatory Authority timeline), Ideaya will promptly notify Amgen within the Response Period, and such notice by Ideaya will provide Amgen with the reason the response cannot be provided in the Response Period and with the timeframe on which Ideaya will provide its response. In any event, Ideaya will endeavor to promptly provide such response to Amgen. Ideaya will also be permitted to respond directly to such Regulatory Authority; provided, however, that prior to providing its response to such Regulatory Authority, Ideaya will (i) provide Amgen with Ideaya’s proposed response in writing; (ii) consider Amgen’s reasonable comments thereto; and (iii) provide Amgen with a final copy of Ideaya’s response for Amgen’s records; provided, however, that Ideaya will have the right to redact any proprietary information that is not related to the Study or the Combination (such as CMC or critical material information). Subject to the conditions set forth in the foregoing sentence, if Ideaya elects to respond directly to such Regulatory Authority, Ideaya will be responsible for providing its response within the time deadline prescribed by such Regulatory Authority (if none, Ideaya will nonetheless provide such response promptly). With respect to any comments or other inquiries (or portions thereof) that do not pertain specifically to the Ideaya Compound, Amgen will prepare the response and provide

Ideaya with an opportunity to review (subject to Amgen’s right to redact any proprietary information not specifically related to the Combination). Amgen shall take into account, in good faith, any reasonable comments to such draft response to the extent received from Ideaya within [***] Business Days (or sooner if required by the Regulatory Authority) following Amgen’s provision of the draft response to Ideaya. Subject Ideaya’s rights in this Section 3.5, the Parties acknowledge and agree that Amgen shall be responsible for all communications with Regulatory Authorities with respect to the Study and the Combination prior to Study Completion. Thereafter each Party shall have the right to lead communications with Regulatory Authorities relating to the Study and the Combination in connection with obtaining and maintaining Regulatory Approvals with respect to its respective Compound. Amgen and Ideaya will use Commercially Reasonable Efforts to assist one another, as necessary, in the performance of their regulatory obligations under this Section 3.5.

3.6

Final Study Report. Amgen will provide Ideaya with (i) an electronic draft of the Final Study Report of the Study for Ideaya to provide comments to Amgen within [***] days of receipt of the draft of the Final Study Report from Amgen, which comments Amgen shall consider in good faith; and (ii) a final version of the Final Study Report promptly following Study Completion, but in any event within [***] months after Study Completion. “Study Completion” will have the meaning as set forth in the Protocol or shall be deemed to have occurred upon Database Lock for the Study, whichever is sooner. Amgen will not include any statements relating to the Ideaya Compound which have not been approved by Ideaya, unless otherwise required by Applicable Law.

3.7

Access to Clinical Data. Subject to the provisions in Section 3.9, each Party shall have access to all Clinical Data (including patient records which have been de-identified in accordance with 45 CFR §164.514(b)), as and to the extent allowed in trial site agreements. Amgen shall make such Clinical Data, to the extent available and in its possession, available to Ideaya on a quarterly basis within a reasonable period of time, but not to exceed [***] Business Days, after the expiration of the calendar quarter in which such Clinical Data is available to Amgen. Amgen shall require that Study investigators obtain patient authorizations and consents required by Regulatory Authorities for clinical trial participation as well as under HIPAA, the GDPR or any other similar Applicable Law in connection with the Study, to permit such sharing of Clinical Data from the Study with Ideaya.

3.8

Ownership of Clinical Data. As between Ideaya and Amgen, (a) Ideaya shall own the particular Clinical Data to the extent that it relates to the Ideaya Compound but does not relate to the Amgen Compound or the Study (“Ideaya Clinical Data”), and Amgen shall own the particular Clinical Data to the extent that it relates to Amgen Compound but does not relate to the Ideaya Compound or the Study (“Amgen Clinical Data”), and (b) both Parties shall jointly own any and all Clinical Data that is not Amgen Clinical Data or the Ideaya Clinical Data (“Combination Clinical Data”), provided that each Party shall not use or disclose such Combination Clinical Data except as permitted under this Agreement. Each Party shall, and does hereby, assign, and shall cause its Affiliates to so assign, to the other Party, without additional compensation, such right, title and interest in and to any Clinical Data as is necessary to fully effect the foregoing ownership, and agrees to execute all instruments as may be reasonably necessary to effect same. All Clinical Data owned by one Party shall be the Confidential Information of such Party and all Combination Clinical Data shall be considered Confidential Information of each Party subject to the restrictions set forth in Article 9 (Confidentiality).

3.9

Use of Clinical Data.

3.9.1

Use of a Party’s Own Clinical Data. Ideaya may use and analyze the Ideaya Clinical Data for any purpose without obligation or accounting to Amgen, who shall hold the Ideaya Clinical Data in confidence pursuant to this Agreement. Amgen may use and analyze Amgen Clinical Data for any purpose without obligation or accounting to Ideaya, who shall hold Amgen Clinical Data in confidence pursuant to this Agreement. Notwithstanding the above or anything to the contrary herein, either Party may share Clinical Data solely owned by the other Party (x) as required by a Regulatory Authority or as may otherwise be required by Applicable Law in connection with such Party’s Compound (including, for clarity, in the case of Regulatory Documentation with respect to such Party’s Compound submitted by or on behalf of such Party at such Party’s sole discretion) and not the other Party’s

Compound, (y) as may be necessary to comply with such Party’s internal policies and procedures with respect to pharmacovigilance and adverse event reporting in connection with such Party’s Compound and not the other Party’s Compound, or (z) with Third Parties or Affiliates any Toxicity and Safety Data where because of severity, frequency or lack of reversibility either Party needs to use such Toxicity and Safety Data with respect to its own Compound to ensure patient safety.

3.9.2

Use of Combination Clinical Data by Ideaya. As between Ideaya and Amgen, Ideaya and its Affiliates and (sub)licensees have the rights in the Territory to use, analyze and exploit the Combination Clinical Data for all purposes, including but not limited to the development and commercialization of a product for the diagnosis, treatment, palliation or prevention of a disease or medical or aesthetic condition in humans or animals and in connection with the independent development, commercialization or other exploitation of the Ideaya Compound (alone or in combination with other drugs or other pharmaceutical agents), and/or for inclusion in the safety database for the Ideaya Compound, in each case without the consent of, or any obligation to account to, Amgen; provided that nothing in the foregoing grants or shall grant, or is intended or shall be construed as granting, Ideaya or its Affiliates or (sub)licensees, any right or license, expressly or impliedly, to use, analyze, or exploit the Combination Clinical Data in connection with the Amgen Compound, including to make, have made, use, sell, offer for sale, or import the Amgen Compound anywhere in the Territory. The results of all such analyses or uses shall be owned by Ideaya, including any intellectual property rights arising out of same, unless the Parties shall have agreed otherwise in a writing separate from this Agreement; provided that Ideaya and its Affiliates and (sub)licensees shall not have any right or license, expressly or impliedly, to use, analyze, or exploit such results in connection with the Amgen Compound, including to make, have made, use, sell, offer for sale, or import the Amgen Compound anywhere in the Territory. The Ideaya rights in this subsection are subject to the disclosure limitation in Section 3.9.4 below and the confidentiality obligations in Article 9.

3.9.3

Use of Combination Clinical Data by Amgen. As between Amgen and Ideaya, Amgen and its Affiliates and (sub)licensees have the rights in the Territory to use, analyze and exploit the Combination Clinical Data for all purposes, including but not limited to the development and commercialization of a product for the diagnosis, treatment, palliation or prevention of a disease or medical or aesthetic condition in humans or animals and in connection with the independent development, commercialization or other exploitation of the Amgen Compound (alone or in combination with other drugs or other pharmaceutical agents), and/or for inclusion in the safety database for the Amgen Compound, in each case without the consent of, or any obligation to account to, Ideaya; provided that nothing in the foregoing grants or shall grant, or is intended or shall be construed as granting, Amgen or its Affiliates or (sub)licensees any right or license, expressly or impliedly, to use, analyze, or exploit the Combination Clinical Data in connection with the Ideaya Compound, including to make, have made, use, sell, offer for sale, or import the Ideaya Compound anywhere in the Territory. The results of all such analyses or uses shall be owned by Amgen, including any intellectual property rights arising out of same, unless the Parties shall have agreed otherwise in a writing separate from this Agreement; provided that Amgen and its Affiliates and (sub)licensees shall not have any right or license, expressly or impliedly, to use, analyze, or exploit such results in connection with the Ideaya Compound, including to make, have made, use, sell, offer for sale, or import the Ideaya Compound anywhere in the Territory. The Amgen rights in this subsection are subject to the disclosure limitation in Section 3.9.4 below and the confidentiality obligations in Article 9.

3.9.4

Limitation on Disclosure of Data. The Parties agree that, prior to the publication of the Combination Clinical Data such Combination Clinical Data will be deemed to be Confidential Information of each of the Parties subject to Article 9

(Confidentiality), and accordingly neither Party (or its Affiliate or sublicensee) shall publicly disclose such Confidential Information except as otherwise permitted under this Agreement. For clarity, that the restriction in this Section 3.9.4 shall not apply to patent applications and related filings that are otherwise permitted under this Agreement or the Material Transfer Agreement.

3.10

Joint Oversight Committee. The Parties shall form a joint oversight committee (the “Joint Oversight Committee” or “JOC”), made up of an equal number of representatives from Amgen and Ideaya. The JOC will be responsible for overseeing the collaboration between the Parties hereunder and coordinating all planning, regulatory and other activities relating to the Study under, and pursuant to, this Agreement with respect to the Study. This includes, but is not limited to, (i) the review and approval of the draft Protocol as further outlined in Section 4.1, (ii) the review and approval of written amendments or modifications to the Development Plan (including approval of estimated supply quantities and schedule and Direct Costs for the Development Plan, as well as updates thereto), (iii) the oversight and monitoring of the progress and conduct of the Study, review of the enrollment and results and the review and approval of study drug supply requests, (iv) sharing of information and data relating to such Party’s Study Compound with the other Party to the extent that such information and data relates to the safety profile of such Party’s Study Compound, or to the extent that such information and data is reasonably required to inform the Development Plan for the Combination, (v) discussion and attempt to resolve any issues arising in the conduct of the Study or in connection with the collaboration hereunder, as presented to it by either of the Parties, (vi) disagreements with respect to activities under Appendix C, and (vii) final approval of draft publications, press releases, data publications or external communications related to the Combination. The JOC may delegate any portion of its responsibilities to one or more subcommittee or working team, including a financial working team. Each Party shall designate a project manager (the “Project Manager”) who shall be responsible for implementing and coordinating activities, and facilitating the exchange of information between the Parties, with respect to the Study. Each Project Manager shall be responsible for liaising with its respective functional areas in order to effectively communicate with the other Project Manager. The JOC shall meet as soon as practicable after the Effective Date, and then no less than once a Calendar Quarter, and more often as reasonably considered necessary at the request of either party, to provide an update on progress of the ongoing Study; provided that the Parties may mutually agree to meet less often than once a Calendar Quarter. Prior to any such meeting, the Amgen Project Manager shall provide an update in writing to the Ideaya Project Manager, which update shall contain information about, but not be limited to overall Study progress, recruitment status, final analysis and other information relevant to the conduct of the Study. The JOC will attempt to reach decisions by consensus, except that Ideaya will determine in its sole discretion the dose and dosing regimen for the Ideaya Compound, and Amgen will determine in its sole discretion the dose and dosing regimen for the Amgen Compound. When consensus is not achieved on any matter, the matter will be escalated to the Senior Vice President of Global Development Oncology of Amgen and the Chief Executive Officer of Ideaya or their duly authorized respective designees with equivalent decision-making authority with respect to matters under this Agreement (the “Executive Officers”); provided, however, that (1) in the event that the matter relates solely to the Ideaya Compound, Ideaya shall have final decision-making authority; and (2) in the event that the matter relates solely to the Amgen Compound, Amgen shall have final decision-making authority. In addition to a Project Manager, each Party shall designate an alliance manager (the “Alliance Manager”) who shall endeavor to ensure clear and responsive communication between the Parties and the effective exchange of information and shall serve as the primary point of contact for any issues arising under this Agreement. The Alliance Managers shall have the right to attend all JOC meetings and may bring to the attention of the JOC any matters or issues either of them reasonably believes should be discussed and shall have such other responsibilities as the Parties may mutually agree in writing. A Party’s Project Manager and Alliance Manager may be the same person. The JOC shall not have any authority to amend, modify or interpret this Agreement, or otherwise to impose any obligation on either Party without the relevant Party’s prior written consent.

Protocol and Related Documents.

4.1

Protocol and Modifications. The protocol outline (the “Protocol Outline”) has been agreed to by the Parties as of the Effective Date and is attached as Appendix A. Based on the Protocol Outline, Amgen will create the first draft of the Protocol and provide it to Ideaya for review and comment. The JOC will agree on and approve the final Protocol for the Study. To the extent any changes need to

be made to the Protocol, Amgen will have the final decision regarding the contents of the Protocol; provided that any material changes (other than relating solely to the Amgen Compound) to the Protocol for the Study, and any changes (whether or not material) relating to the Ideaya Compound, including dose and dosing regimen for the Ideaya Compound, will require Ideaya’s prior written consent. Ideaya will provide such consent, or a written explanation for why such consent is being withheld, within [***] Business Days of receiving Amgen’s request therefor; provided, however, that if any material change (other than relating solely to the Amgen Compound) to the Protocol for the Study is safety-related, Ideaya will provide such consent or a written explanation for why such consent is being withheld, within [***] Business Days of receiving Amgen’s request. The parties acknowledge that the Development Plan, Protocol Outline and Protocol and all amendments shall be considered Confidential Information of each Party subject to Article 9 (Confidentiality).

4.2

Investigator’s Brochure. Ideaya will provide the current redacted version of its investigator’s brochure for the Ideaya Compound to Amgen promptly and will thereafter, until the conclusion of the Study under this Agreement, provide to Amgen, upon reasonable request, the latest redacted investigator’s brochure for the Ideaya Compound or any amendments thereto in accordance with Ideaya’s customary practices for same (subject to any applicable confidentiality obligations relating to other combination therapy trials involving the Ideaya Compound and a third party’s compound that prevent Ideaya from sharing such documents with Amgen). All such disclosures and information are Confidential Information of Ideaya subject to Article 9 (Confidentiality). Amgen shall, and shall require that any clinical trial sites for the Study shall, use any such data provided pursuant to this Section 4.2 solely (a) to evaluate the safety and efficacy of the Ideaya Compound and the Combination for use in the Study, (b) to meet any regulatory requirements pertaining to the conduct of the Study, and (c) enable Amgen to draft and update as necessary the investigator’s brochure for the Study. Amgen’s right to use the investigator’s brochure provided by Ideaya shall terminate upon the completion of patient visits or termination of this Agreement and shall not be used for purposes of conducting any other clinical studies.

4.3

Informed Consent Form. Amgen will prepare a template patient informed consent form for the Study in consultation with Ideaya (it being understood that the portion of the informed consent form relating to the Ideaya Compound will be provided by Ideaya) to provide to Study investigators. Amgen will be responsible for ensuring that, the terms of all informed consent forms: (i) do not conflict with the terms of this Agreement, and (ii) do not prohibit Amgen from providing Ideaya with access to and use of Clinical Data, Samples, and other applicable information and documents resulting from the Study as required pursuant to this Agreement (and in no event less than the same use rights thereto granted to Amgen) and in line with Applicable Laws. Notwithstanding the foregoing, Amgen’s obligations in the preceding sentence are limited to the application of Commercially Reasonable Efforts in view of providing Ideaya with access to and use of Clinical Data and Samples. Any material changes to such form proposed by Amgen or by a Regulatory Authority or other Third Party that relate to the Ideaya Compound will be subject to Ideaya’s written consent, not to be unreasonably withheld. Ideaya will provide such consent, or a written explanation for such consent being withheld, (i) within [***] Business Days of receiving Amgen’s request therefor, if such changes are proposed by Amgen; and (ii) within [***] Business Days of receiving Amgen’s request therefor, if such changes are proposed by a Regulatory Authority or other Third Party.

Reporting Obligations.

5.1

Financial Disclosure Reporting. Amgen will be responsible for reporting payments and other transfers of value made to health care professionals (e.g., investigators, steering committee members, data monitoring committee members, consultants, etc.) in connection with the Study in accordance with reporting requirements under Applicable Law (including the Physician Payment Sunshine Act and state gift laws, and the European Federation of Pharmaceutical Industries and Associations Disclosure Code) and Amgen’s applicable policies. Ideaya shall provide all information in its possession and control that is reasonably required for such reporting, including information regarding the value of the Ideaya Compound provided for use in the Study. Such information shall be provided to Amgen’s point of contact who is identified to Ideaya in writing upon the execution of this Agreement and thereafter promptly following any change to such point of contact. Ideaya shall provide the necessary information regarding the value of the Ideaya Compound within [***] Business Days following the execution of this Agreement. In the event that, at any time during the term of this Agreement, the value

of the Ideaya Compound provided hereunder changes, Ideaya shall notify Amgen of such revised value, and the effective date of such revised value, within [***] Business Days following such change in value.

5.2

Disclosure Laws. Notwithstanding anything to the contrary in this Agreement, Ideaya acknowledges and agrees that (i) Amgen is permitted to publicly disclose information regarding this Agreement to comply with Applicable Law (including the Physician Payment Sunshine Act and related requirements (collectively, “Disclosure Laws”)) and (ii) this information may include without limitation payments, or other transfers of value, made on behalf or at the request of Amgen to physicians, teaching hospitals, and other persons or entities that are the subject of the Disclosure Laws (each a “Disclosure Subject”). Ideaya agrees to promptly respond to, and cooperate with, the reasonable requests of Amgen regarding collection of information regarding and compliance with Disclosure Laws.

5.3

Adverse Event Reporting. Amgen, as the sponsor of the Study, will be solely responsible for compliance with all Applicable Law pertaining to safety reporting for the Study and related activities. The Parties shall start to negotiate a Pharmacovigilance Agreement promptly following the Effective Date, and execute the Pharmacovigilance Agreement within [***] days following the Effective Date, but in any event before administration to the first patient in the Study, to ensure the exchange of relevant safety data within appropriate timeframes and in appropriate format to enable the Parties to fulfill local and international regulatory reporting obligations and to facilitate appropriate safety reviews. The Pharmacovigilance Agreement will include safety data exchange procedures governing the coordination of collection, investigation, reporting, and exchange of information concerning adverse experiences, pregnancy reports, and any other safety information arising from or related to the use of the Ideaya Compound and the Amgen Compound in the Study, consistent with Applicable Law and in accordance with the terms of the Pharmacovigilance Agreement. Such guidelines and procedures shall be in accordance with, and enable the Parties and their Affiliates to fulfill local and international regulatory reporting obligations to, Government Authorities. Amgen will be responsible for reporting adverse events associated with the Compounds arising from the Study to the FDA, for Amgen’s IND.

Term and Termination.

6.1

Term. The term of this Agreement (the “Term”) will commence on the Effective Date and will continue in full force and effect until (i) expiration upon the completion of all activities outlined in the Development Plan, including the completion of all activities outlined in the Protocols, the completion of the Study by all centers participating in the Study, delivery of all Clinical Data to the Parties, including all completed case report forms, all final analyses and the Final Study Report contemplated by the Study to both Parties, and the completion of any statistical analyses and bioanalyses contemplated by the applicable Protocol or otherwise agreed to by the Parties in the Development Plan to be conducted under this Agreement; (ii) terminated by either Party pursuant to this Article 6; or (iii) terminated by mutual written agreement of the Parties.

6.2

Termination Due to MTA. If the results of the research performed pursuant to the MTA do not support proceeding to the clinical development of the Combination, either Party may terminate the Study and this Agreement, upon [***] days’ prior written notice to the other Party, provided that such notice be delivered to such other Party prior to the first dosing of the first patient in the Study.

6.3

Termination for Discontinuation of Compound Development. Either Party shall have the right to terminate this Agreement immediately upon written notice to the other Party in the event that it determines in its sole discretion to discontinue development of its Compound; provided, however, that if a third party collaborator or partner of Ideaya is developing or commercializing the Ideaya Compound, Ideaya shall be deemed to be continuing development of the Ideaya Compound for purposes of this Section 6.3.

6.4

Termination by Either Party. In the event that either Party reasonably believes that such Party’s Compound is being used in an unsafe manner and the other Party does not agree on incorporation of changes into the Protocol reasonably requested by such Party to address such issue (to the extent such agreement is required under Section 4.1), the applicable Party may immediately terminate this Agreement and, if applicable, the supply of such Party’s Compound, upon written notice to the other Party.

6.5

Termination by Ideaya. In the event that Ideaya reasonably believes that the Ideaya Compound is not being used as described in the Protocol and Amgen fails to remedy such issue within [***] Business Days after receipt of written notice thereof from Ideaya, Ideaya may immediately terminate this Agreement and the supply of the Ideaya Compound upon written notice to Amgen.

6.6

Termination for Breach. Either Party may terminate this Agreement if the other Party commits a material breach of this Agreement, and such material breach is not cured within [***] days after receipt of written notice thereof from the other Party; provided that if such material breach cannot reasonably be cured within [***] days, the Parties shall mutually agree on a reasonable additional period of time for the breaching Party to cure such breach, and the other Party shall not terminate this Agreement until such agreed-upon reasonable additional time period expires.

6.7

Termination for Safety Concern. Either Party may terminate this Agreement immediately upon written notice to the other party if the terminating Party determines in good faith, based on a review of the Clinical Data or other Study-related Know-How or information, that the Study may adversely affect patient safety due to the existence of a Material Safety Issue that warrants termination of the Study; provided that prior to delivery of such notice of termination, such Party shall notify the other Party, and within [***] hours of such notice, the Parties shall discuss whether an amendment to the Protocol for the Study would be reasonably likely to address the issue; provided further that if the Parties are unable to agree on such an amendment to the Protocol for the Study, then this Agreement shall terminate upon the end of such [***] hour period.

6.8

Termination for Regulatory Concern. Either Party may terminate this Agreement (in whole or in part on a country-by-country basis) immediately upon written notice to the other Party in the event that a Regulatory Authority with jurisdiction over the Study or over the terminating Party takes any action, or raises any objection, that prevents the terminating Party from using or supplying its Compound for purposes of the Study.

6.9

Termination Under Section 14.6 (Compliance and Anti-Corruption). Either Party shall be entitled to terminate this Agreement immediately upon written notice to the other Party, if such other Party breaches its representations, warranties, covenants or agreements set forth in Section 14.6 (Compliance and Anti-Corruption). In case of such a breach, the non-terminating Party shall have no claim against the terminating Party for compensation for any loss of whatever nature by virtue of the termination of this Agreement in accordance with this Section 6.9. To the extent (and only to the extent) that Applicable Law provides for any such compensation to be paid to the non-terminating Party upon the termination of this Agreement, the non-terminating Party hereby expressly agrees (to the extent possible under Applicable Law) to waive or to repay to the Party terminating this Agreement any such compensation or indemnity.

6.10

Effects of Termination. In the event that this Agreement is terminated, Amgen shall, at no additional cost to Ideaya and at Ideaya’s option, either (i) immediately return all unused Ideaya Compound to Ideaya or (ii) destroy any and all unused Ideaya Compound pursuant to Ideaya’s instructions and provide written certification of such destruction, provided, that in the event of termination by Amgen pursuant to Section 6.6 (Termination for Breach) or Section 6.9 (Termination Under Section 14.6 (Compliance and Anti-Corruption)), the costs for such destruction shall be reimbursed by Ideaya. Further, in the event of termination of this Agreement, Amgen shall promptly commence wind down activities to stop the Study as soon as reasonably practicable, in accordance with customary industry practices and taking into account ethical considerations, unless the Parties agree otherwise or unless required otherwise by the applicable Regulatory Authority(ies) or Applicable Law, and the reasonable out-of-pocket costs in connection with such wind down activities shall be born as follows: costs shall be (i) equally shared in the case of termination pursuant to Section 6.2 (Termination Due to MTA) or Section 6.7 (Termination for Safety Concern), (ii) born by the terminating Party in the case of termination pursuant to Section 6.3 (Termination for Discontinuation of Compound Development), (iii) born by Amgen in the case of termination pursuant to Section 6.5 (Termination by Ideaya), (iv) born by the non-terminating Party in the case of termination pursuant to Section 6.4 (Termination by Either Party), (v) born by the breaching Party in the case of termination pursuant to Section 6.6 (Termination for Breach) or Section 6.9 (Termination Under Section 14.6 (Compliance and Anti-Corruption)), and (vi) borne by the Party whose Compound caused the termination in the case of

termination pursuant to Section 6.8 (Termination for Regulatory Concern). Except in the case of termination by Amgen pursuant to Section 6.6 (Termination for Breach) or Section 6.9 (Termination under Section 14.6 (Compliance and Anti-Corruption)), upon termination of this Agreement, Amgen will provide Ideaya with a copy of any Clinical Data not yet provided, (including any Final Study Report, if applicable, to the extent a Final Study Report is prepared in connection with the wind down of the Study), as soon as reasonably practicable, and the terms of Section 3.6 (Final Study Report), Section 3.7 (Access to Clinical Data), Section 3.8 (Ownership of Clinical Data) and Section 3.9 (Use of Clinical Data) shall apply mutatis mutandis.

6.11

Treatment of Confidential Information. Upon termination of this Agreement, if requested by either Party, each Party and its Affiliates will promptly return to the other Party or destroy any Confidential Information of the other Party (other than Jointly Owned Inventions and Combination Clinical Data) furnished to the receiving Party by the other Party, except as required by Applicable Law and except that the receiving Party will have the right to retain one copy for record-keeping purposes.

6.12

Surviving Provisions. The provisions of Sections 3.2 (Record-Keeping), 3.5 (Regulatory Matters), 3.7 (Clinical Data), 3.8 (Ownership of Clinical Data), 6.9 (Termination Under Section 14.6 (Compliance and Anti-Corruption)), 6.10 (Effect of Termination), 6.11 (Treatment of Confidential Information), 6.12 (Surviving Provisions), 8.12 (Records), 14.6 (Compliance and Anti-Corruption), 14.7, 14.8, and 14.9, and Articles 1 (Definitions), 5 (Reporting Obligations) (as to Subsection 5.3 solely as to adverse event reporting required for any SADRs/SAEs arising from the Study and occurring post-termination), 7 (Costs of Study), 9 (Confidentiality), 10 (Intellectual Property), 11 (Data Security and Privacy), 13 (Publications), 15 (Insurance; Indemnification; Limitation of Liability) and 16 (Miscellaneous) will survive the expiration or termination of this Agreement. In addition, any obligation that is expressly indicated, or by its nature is intended, to survive the termination or expiration of this Agreement, shall survive the termination or expiration of this Agreement. Termination of this Agreement will be without prejudice to any claim or right of action of either Party against the other Party for any prior breach of this Agreement.

Costs of Study.

7.1

Except as expressly set forth herein, the Parties will equally share the Direct Costs of the Study to the extent consistent with the budget set forth in the Development Plan; provided that each Party shall be responsible for its own internal costs and expenses to support the Study. Within [***] days after the end of each calendar quarter during the Term, Amgen will prepare a detailed accounting of the total Direct Costs during such Calendar quarter and shall send a copy of such accounting to Ideaya; provided, however, that a preliminary estimate of such Direct Costs shall be provided by Amgen to Ideaya as promptly as practicable following the end of each calendar quarter. Amgen shall determine (within [***] days thereafter) the appropriate reimbursement from Ideaya so that the total Direct Costs for the quarter are shared equally by the Parties, and such reimbursement shall be made by Ideaya within [***] days of such determination and receipt of a respective Invoice; provided that if Amgen submits an accounting for Direct Costs that materially (greater than [***] deviation) exceeds Amgen’s estimated Direct Costs set forth in the Development Plan for the applicable activities or tasks under the Development Plan, then the Parties shall discuss in good faith such cost overrun, and Ideaya shall not be required to bear its 50% share of the overrun except on good cause shown by Amgen (or as otherwise agreed by the JOC).

7.2

The Parties further agree that (i) Ideaya shall provide the Ideaya Compound for use in the Study, as described in Article 8 below, at no cost to Amgen; and (ii) Amgen shall provide the Amgen Compound for use in the Study, as described in Article 8 (Supply and Use of the Ideaya Compound for the Study), at no cost to Ideaya. In addition, Ideaya shall be one hundred percent (100%) responsible for any reimbursement of reasonable and appropriate expenses related to adverse events experienced by any patients in the Study that are solely attributable to the Ideaya Compound. Amgen shall be one hundred percent (100%) responsible for any reimbursement of reasonable and appropriate expenses related to adverse events experienced by any patients in the Study that are solely attributable to any Amgen Compound. To the extent that it is not possible to attribute an adverse event to either solely to the Ideaya Compound or solely to an Amgen Compound, the Parties shall each bear fifty percent (50%) of the reimbursement expenses related to such adverse event.

Supply and Use of the Ideaya Compound for the Study.

Ideaya will supply Amgen with Ideaya Compound for the Study, that conform to the Ideaya Compound specifications and Ideaya’s IND for the Ideaya Compound and have been manufactured in accordance with the provisions of this Agreement, cGMP and all applicable laws and regulations relating to drugs intended for investigational use in humans, and Ideaya will, upon request, provide Amgen with all related and necessary documentation pursuant to the following terms and conditions:

8.1

Supply of Ideaya Compound. Following the execution by the Parties of the Clinical Quality Agreement as required by either Party, Ideaya will use Commercially Reasonable Efforts to supply, or cause to be supplied, the quantities of Ideaya Compound as are set forth in the Development Plan on the timelines set forth in the Development Plan, or as otherwise agreed by the Parties in each case, for use in the Study. Amgen will provide Ideaya quarterly written updates (due on the first business day of each calendar month) on the supply quantities set forth in the Development Plan, including updates to patient enrollment numbers. In the event that Amgen determines that the quantities of Compounds set forth in the Development Plan are not sufficient to complete the Study, Amgen will so notify Ideaya promptly, and the Parties will discuss in good faith regarding manufacturing lead times and additional quantities of Ideaya Compound to be provided and the schedule on which such additional quantities may be provided by Ideaya. Primary contact persons for each Party for supply-related matters under this Agreement are listed in the Development Plan.

8.2

Minimum Shelf Life Requirements. Ideaya will use Commercially Reasonable Efforts to supply the Ideaya Compound hereunder with adequate shelf life remaining at the time of Delivery, provided, that Ideaya will use Commercially Reasonable Efforts to supply the Ideaya Compound with no less than [***] months remaining shelf life. If Ideaya Compound is only available with less than [***] months remaining shelf life, Ideaya will promptly notify Amgen and both Parties will work in good faith to meet the requirements of the Study.

8.3

Provision of Compounds.

8.3.1

Ideaya will deliver the Ideaya Compound [***] (INCOTERMS 2020) to the location designated by Amgen in the Development Plan (“Delivery” with respect to such Ideaya Compound). Title and risk of loss for the Ideaya Compound will transfer from Ideaya to Amgen [***]. [***] Amgen will: (i) take delivery of the Ideaya Compound supplied hereunder; (ii) perform the acceptance procedures allocated to it under the Clinical Quality Agreement; and (iii) subsequently label and pack (in accordance with Section 8.4 (Labeling and Packaging; Use, Handling and Storage)), and ship the Ideaya Compound to the Study sites, in compliance with cGMP, GCP and other Applicable Law and the Clinical Quality Agreement; and (iv) provide, from time to time at the reasonable request of Ideaya, the following information: any applicable chain of custody forms, in-transport temperature recorder(s), records and receipt verification documentation, such other transport or storage documentation as may be reasonably requested by Ideaya, and usage and inventory reconciliation documentation related to the Ideaya Compound. Ideaya shall, from time to time at the reasonable request of Amgen, provide Amgen the following information: any applicable chain of custody forms, in-transport temperature recorder(s), records and receipt verification documentation, such other transport or storage documentation as may be reasonably requested by Amgen, and usage and inventory reconciliation documentation related to the Ideaya Compound. Amgen agrees (i) to obtain all required licenses, certificates and permits in connection with the shipment of Ideaya Compound to Amgen; (ii) to comply with all Regulatory Approvals, including all approvals and licenses, or other requirements for importation of Ideaya Compound; (iii) to maintain the necessary records to comply with all Regulatory Approvals and other Applicable Laws; (iv) to not reverse engineer, replicate, modify, analyze, export, transfer, or otherwise exploit the Ideaya Compound except as authorized in writing by Ideaya and in compliance with Applicable Laws; and (v) not to transfer or dispose of Ideaya Compound in violation of the export laws of the country from which the Ideaya Compound is shipped. Amgen will be responsible for providing Ideaya with any

information reasonably necessary in order to enable Ideaya to fulfill any shipment of Ideaya Compound, and to comply with all labeling and other applicable legal requirements in the countries in which the Study will be conducted. Amgen will pay all taxes, import duties, sales, use or privilege taxes, value-added taxes, excise or similar taxes or duties levied upon either Party or any Affiliate thereof by any jurisdiction, political subdivision or agency for the supply of Ideaya Compound under this Agreement. Ideaya will be responsible for obtaining all required documents and approvals in order for Ideaya Compound to clear customs from the countries from which Ideaya Compound will be shipped; provided, however, that upon Ideaya’s request, Amgen shall reasonably cooperate and provide Ideaya with any information necessary to assist Ideaya in obtaining such customs clearance at Ideaya’s expense. Amgen will be responsible for obtaining all required documents and approvals in order for Ideaya Compound to clear customs in the countries to which Ideaya Compound will be used; provided, however, that upon Amgen’s request, Ideaya shall reasonably cooperate and provide Amgen with any information necessary to assist Amgen in obtaining such customs clearance at Amgen’s expense.

8.3.2

Amgen is solely responsible, at its own cost, for supplying (including all Manufacturing, acceptance and release testing) the Amgen Compound for the Study, and the subsequent handling, storage, transportation, warehousing and distribution of the Amgen Compound supplied hereunder. Amgen will ensure that all such activities are conducted in compliance with cGMP, GCP and other Applicable Law.

8.4

Labeling and Packaging; Use, Handling and Storage.

8.4.1

Ideaya will provide the Ideaya Compound in tablets in bottles in the same form that Ideaya manufactures for its own development purposes. Amgen will be responsible for labeling clinical packaging Ideaya Compound for use in the Study, as set forth more particularly in the Clinical Quality Agreement.

8.4.2

Amgen will (i) use the Ideaya Compound solely for purposes of performing the Study; (ii) not use the Ideaya Compound in any manner inconsistent with this Agreement; and (iii) use, store, transport, handle and dispose of the Ideaya Compound in compliance with Applicable Law and the Clinical Quality Agreement, as well as all reasonable instructions of Ideaya related to the Ideaya Compound.

8.5

Product Specifications. The process for provision of documents and progression on activities related to the product specifications will be conducted in accordance with the provisions set forth in the Clinical Quality Agreement.

8.6

Changes to Manufacturing. Each Party may make changes from time to time to the Manufacturing process and/or Manufacturing Site for its respective Compound without notice to the other Party; provided that such changes will be in accordance with the Clinical Quality Agreement including any notice requirement contained therein.

8.7

Product Testing; Noncompliance. The process for activities regarding product testing and noncompliance will be handled in accordance with the provisions set forth in the Clinical Quality Agreement.

8.8

Resolution of Discrepancies. The process for resolution of discrepancies will be handled in accordance with the provisions set forth in the Clinical Quality Agreement.

8.9

Investigations. The process for investigations of any Non-Conformance will be handled in accordance with the provisions set forth in the Clinical Quality Agreement.

8.10

Shortage; Allocation. In the event of a supply interruption or shortage of Ideaya

Compound as determined by Ideaya pursuant to its standard internal processes and policies (“Shortage”), such that Ideaya reasonably believes that it will not be able to fulfill its supply obligations hereunder with respect to the Ideaya Compound for the Study, Ideaya will provide prompt written notice to Amgen thereof (including the quantity of Ideaya Compound that Ideaya reasonably estimates it will be able to supply) and, upon Amgen’s request, the Parties will promptly discuss such situation and actions being taken to address the potential shortage (including but not limited to rationing, expediting, overtime, and priority transportation modes). Notwithstanding anything to the contrary contained herein, in the event of a shortage of the Ideaya Compound, (i) Ideaya will have sole discretion, subject to Applicable Law, to determine the quantity of Ideaya Compound it will be able to supply as a result of such Shortage; provided, however, that Ideaya shall consider in good faith the needs of patients who are actively being treated with Ideaya Compound, including Study patients, in making such determination; and (ii) Ideaya will not be deemed to be in breach of this Agreement for failure to supply any other quantities of Ideaya Compound hereunder as a result of a Shortage. In the event that Ideaya is unable to fulfill its supply obligations for any reason, Amgen shall be relieved of its obligations to conduct the Study under this Agreement to the extent such performance is affected by Ideaya’s failure to supply; provided that such obligations shall be relieved only during the period of the shortfall.

8.11

Regulatory Responsibility. The responsibilities of the Parties with respect to communication and filings with Regulatory Authorities related to the supply of Compounds hereunder in connection with the Study will be as set forth in the Clinical Quality Agreement entered into by the Parties in connection herewith.

8.12

Records.

8.12.1

Amgen will keep complete and accurate records pertaining to its use and disposition of Ideaya Compound (including its storage, shipping (cold chain) and chain of custody activities) and, upon reasonable request of Ideaya, will make such records available for review by Ideaya for the purpose of conducting investigations for the determination of Ideaya Compound safety and/or efficacy and Amgen’s compliance with this Agreement with respect to the Ideaya Compound.

8.12.2

Each Party will maintain complete and accurate records pertaining to its Manufacture of its Compound supplied hereunder in accordance with the Clinical Quality Agreement, and, upon request of the other Party, will make such records available for review by such other Party as set forth in the Clinical Quality Agreement.

8.13

Quality. Quality matters related to the Manufacture of the Compounds will be governed by the terms of the Clinical Quality Agreement in addition to the relevant quality terms of this Agreement.

8.14

Quality Control. Each Party will implement and perform operating procedures and controls for sampling, stability and other testing of its Compound, and for validation, documentation and release of its Compound and such other quality assurance and quality control procedures as are required by the Specifications, cGMPs and the Clinical Quality Agreement.

8.15

Audits and Inspections. Audit and inspection rights as they relate to supply and manufacturing issues will be governed by the terms of the Clinical Quality Agreement. Upon the request of Amgen, not to be unreasonably withheld, Ideaya shall permit Amgen at Amgen’s expense to conduct a co-audit with Ideaya of manufacturing and testing sites, either routine to confirm compliance with the Clinical Quality Agreement, Specifications or cGMPs, or “for cause”, in the case of a quality or regulatory event, which events may include clinical withdrawal of the supplied Product, repeated product complaints, and repeated rejection from import testing.

8.16

Recalls. Recalls of the Compounds will be governed by the terms of the Clinical Quality Agreement.

8.17

VAT. It is understood and agreed between the Parties that any payments made and any

other consideration given under this Agreement are each exclusive of any value added or similar tax (“VAT”), which shall be added thereon as applicable and at the relevant rate. Where VAT is properly charged by the supplying Party and added to a payment made or other consideration provided (as applicable) under this Agreement, the Party making the payment or providing the other consideration (as applicable) will pay the amount of VAT properly chargeable only on receipt of a valid tax invoice from the supplying Party issued in accordance with the laws and regulations of the country in which the VAT is chargeable. Each Party agrees that it shall provide to the other Party any information and copies of any documents within its possession or control to the extent reasonably requested by the other Party for the purposes of (i) determining the amount of VAT chargeable on any supply made under this Agreement, (ii) establishing the place of supply for VAT purposes, or (iii) complying with its VAT reporting or accounting obligations.

Confidentiality.

9.1

Confidentiality. Prior to the Effective Date of this Agreement, Ideaya and Amgen entered into a Confidential Disclosure Agreement, dated April 7, 2022, by and between Ideaya and Amgen (as may be amended from time to time, the “CDA”). Any Confidential Information relating thereto previously disclosed by the Parties pursuant to the CDA shall now be Confidential Information for purposes of this Agreement, the Parties shall treat it as such in accordance with the terms hereof. Amgen and Ideaya agree to hold in confidence any Confidential Information of, or provided by the other Party, or provided by a Third Party on behalf of, or as part of a collaboration with, the other Party, and neither Party will use any such Confidential Information or disclose any such Confidential Information of the other Party to any Third Party except to fulfill such Party’s obligations to perform the Study under this Agreement or, with respect to Combination Clinical Data, to exercise its rights under Section 3.9. Except as otherwise permitted by this Agreement, each Party may share Confidential Information of the other Party (for the avoidance of doubt, including Amgen Clinical Data and Ideaya Clinical Data, but excluding Combination Clinical Data) to only those of its and its Affiliates’ respective officers, directors, employees, agents, representatives, consultants or subcontractors who need to know such information for purposes of performing obligations or exercising rights under this Agreement and who are bound by written obligations of confidentiality and non-use no less restrictive than those contained herein. Except with respect to Combination Clinical Data, any and all information arising from the performance of this Agreement (i) to the extent relating solely to the Amgen Compound will be deemed to be Confidential Information of Amgen for purposes of this Agreement, (ii) to the extent relating solely to the Ideaya Compound will be deemed to be Confidential Information of Ideaya for purposes of this Agreement, and (iii) to the extent relating to both the Amgen Compound and the Ideaya Compound will be deemed to be Confidential Information of each of the Parties for purposes of this Agreement.

9.2

Data Security Measures. Each Party will take reasonable precautions to protect the other Party’s Confidential Information including, without limitation, safeguarding it in a manner at least as secure as it uses to protect its own Confidential Information of like nature, but in any event in a manner not less than reasonable care. The receiving Party will use industry standard encryption technology when transmitting the disclosing Party’s Confidential Information by email or other information or file-sharing means to any Third Party or back to the disclosing Party; alternatively, at a minimum, Confidential Information of the disclosing Party may be transmitted by the receiving Party using password-protection when transmitting or a secure data room. Notwithstanding the foregoing, failure by either Party to use encryption technology in its transmission of Confidential Information shall not be deemed a waiver and will not affect the confidential status of such information.

9.3

Authorized Disclosure. Notwithstanding any other provision of this Agreement, each Party may disclose particular Confidential Information belonging to the other Party to the extent such disclosure is reasonably necessary in the following instances:

9.3.1

filing and prosecuting patent applications for Jointly Owned Inventions, and enforce any resulting patents in accordance with Article 10 (Intellectual Property), provided that each Party can decline the disclosure of structural or functional features of its Compound that have not yet been disclosed to the public previously;

9.3.2

prosecuting or defending litigation;

9.3.3

complying with Applicable Law or the rules or regulations of any securities exchange on which such Party’s stock is listed;

9.3.4

disclosure, in connection with the performance of this Agreement, to Affiliates, permitted (sub)licensees, contractors, ethics committees, CROs, academic institutions, consultants, agents, investigators, and employees and contractors engaged by Trial Sites and investigators involved with the Study, each of whom prior to disclosure must be bound by terms of confidentiality and non-use at least as protective of Confidential Information as those set forth in this Article 9;

9.3.5

disclosure of the Combination Clinical Data, Jointly Owned Inventions and Joint Patents to Regulatory Authorities in connection with the development, manufacture or commercialization of the Combination, Amgen Compound or the Ideaya Compound;

9.3.6

disclosure of relevant safety information contained within the Clinical Data to investigators, ethics committees and Regulatory Authorities that are involved in other clinical trials of Amgen Compound with respect to Amgen, and the Ideaya Compound with respect to Ideaya, and, in the event of a Material Safety Issue, to Third Parties that are collaborating with Amgen or Ideaya, respectively in the conduct of such other clinical trials of Amgen Compound or the Ideaya Compound, in each case solely to the extent necessary for the conduct of such clinical trials or to comply with Applicable Law and regulatory requirements; and

9.3.7

disclosure to (i) actual or bona fide potential, sublicensees, licensees or collaborators of the terms of this Agreement and (ii) actual or bona fide potential acquirers, licensees, merger partners, or investors of Combination Clinical Data, Jointly Owned Inventions and resulting patents, and the terms of this Agreement, in each case, under confidentiality and non-use obligations at least as protective of Confidential Information as those set forth in this Agreement.

Notwithstanding the foregoing, if a Party is required or otherwise intends to make a disclosure of any other Party’s Confidential Information pursuant to Section 9.3.2 or Section 9.3.3, it shall give advance notice to such other Party of such impending disclosure and endeavor in good faith to secure confidential treatment of such Confidential Information or reasonably assist the Party that owns such Confidential Information in seeking a protective order or other confidential treatment. Confidential Information that is disclosed by judicial or administrative process shall remain otherwise subject to the confidentiality and non-use provisions of Section 9.1, and the Party disclosing Confidential Information pursuant to Applicable Law shall take all steps reasonably necessary, including obtaining an order of confidentiality, to ensure the continued confidential treatment of such Confidential Information.

9.4

Combination Clinical Data. Preclinical Data and Combination Clinical Data shall be treated as Confidential Information of each Party and shall not be disclosed to Third Parties except to the extent: (i) authorized under Section 9.1 or Section 9.3 to be disclosed, (ii) required to be filed with a Regulatory Authority or included in a product’s label or package insert, (iii) disclosed pursuant to Articles 10, 11, 12 and 13; or (iv) a patent application filing otherwise permitted under this Agreement or the Material Transfer Agreement. For clarity, each Party may freely share Preclinical Data and Combination Clinical Data with its and its Affiliates’ respective officers, directors, employees, agents, representatives, consultants or subcontractors for all purposes under confidentiality and non-use obligations at least as protective of Preclinical Data and Combination Clinical Data and Confidential Information as those set forth in this Agreement.

9.5

Joint and Sole Inventions. For clarity, (i) Inventions that both constitute Confidential Information and are jointly owned by the Parties will be the Confidential Information of both Parties and each Party will have the right to use such Confidential Information consistent with Articles 10, 11, 12,

and 13; and (ii) Inventions that both constitute Confidential Information and are solely owned by one Party will be the Confidential Information of such Party and use of such Confidential Information shall be consistent with Articles 10, 11 and 12.

9.6

Terms of This Agreement. The Parties agree that the terms of this Agreement are the Confidential Information of both Parties, and are subject to the obligations and exceptions in this Article 9. If either Party is required by Applicable Law or the rules to file or otherwise disclose the terms of this Agreement in accordance with Section 9.3.3, the Party proposing to make such public disclosure shall give the other Party reasonable advance notice and shall consider in good faith such Party’s reasonable input on such disclosure (including redactions to the terms of the Agreement).

9.7

Procedures with Respect to Competitive Program.

9.7.1

In the event Amgen (or an Affiliate of Amgen) has or acquires, whether by license or otherwise, rights to a Competitive Program, Amgen shall, within [***] days after the Effective Date, or the date of acquisition of such rights, as applicable, use commercially reasonable efforts to adopt reasonable procedures to (i) prevent use of Ideaya’s Confidential Information in such Competitive Program and (ii) otherwise ensure compliance with Amgen’s obligations under Section 3.9 (Use of Clinical Data). At Ideaya’s request, Amgen shall provide Ideaya with a summary of such procedures and shall consider Ideaya’s comments with respect thereto.

9.7.2

In the event Ideaya (or an Affiliate of Ideaya) has or acquires, whether by license or otherwise, rights to a Competitive Program, Ideaya shall, within [***] days after the Effective Date, or the acquisition of such rights, as applicable, use commercially reasonable efforts to adopt reasonable procedures to (i) prevent use of Amgen’s Confidential Information in such Competitive Program and (ii) otherwise ensure compliance with Ideaya’s obligations under Section 3.9 (Use of Clinical Data). At Amgen’s request, Ideaya shall provide Amgen with a summary of such procedures and shall consider Amgen’s comments with respect thereto.

9.8

Confidentiality Term. The confidentiality obligations of the Parties pursuant to this Article 9 will survive the expiration or termination of the Agreement for a period of [***] years.

Intellectual Property.

10.1

Joint Ownership and Prosecution.

10.1.1

Each Party shall promptly disclose in writing to the other Party any Invention of which it becomes aware. Subject to Sections 10.2 (Inventions Owned by Amgen) and 10.3 (Inventions Owned by Ideaya), all rights to all Inventions, including any Inventions relating to or covering the combined use of the Amgen Compound and the Ideaya Compound (each a “Jointly Owned Invention”) will belong jointly to Amgen and Ideaya. Amgen and Ideaya will each be entitled to use Jointly Owned Inventions without restriction in accordance with the terms and conditions of this Agreement and without accounting or financial payment to the other Party and without the consent of the other Party and each Party may use, exploit, assign or grant licenses (with right to sublicense through multiple tiers), to any Third Parties for use and exploitation in the Territory, under its interests in such Jointly Owned Inventions and Joint Patents. Notwithstanding the foregoing, Ideaya covenants and agrees that it and its Affiliates, and permitted sublicensees and assignees will not use Jointly Owned Inventions to research, develop or commercialize (directly or indirectly) the Amgen Compound, and Amgen covenants and agrees that it and its Affiliates, and permitted sublicensees and assignees will not use Jointly Owned Inventions to research, develop or commercialize (directly or indirectly) the Ideaya Compound. For those countries where a specific license is required for a joint owner of a Jointly Owned Invention to practice such Jointly Owned Invention in such countries, (i) Ideaya hereby grants to

Amgen a perpetual, irrevocable, non-exclusive, worldwide, royalty-free, fully paid-up license, transferable and sublicensable, under Ideaya’s right, title and interest in and to all Jointly Owned Inventions to use such Inventions in accordance with the terms and conditions of this Agreement and (ii) Amgen hereby grants to Ideaya a perpetual, irrevocable, non-exclusive, worldwide, royalty-free, fully paid-up license, transferable and sublicensable, under Amgen’s right, title and interest in and to all Jointly Owned Inventions to use such Inventions in accordance with the terms and conditions of this Agreement. For clarity, except as expressly provided herein, the terms of this Agreement do not provide Amgen or Ideaya with any rights, title or interest or any license to the other Party’s Background IP or Sole Inventions or intellectual property rights covering or claiming such Sole Inventions. For the avoidance of doubt, either Party may rely on an Efficacy Result in making a decision to pursue research or development with its respective Compound, either alone or in combination with other compounds (excluding the other Party’s respective Compound), and such reliance shall not be deemed a violation of any restriction set forth in this Agreement.

10.1.2

Subject to Sections 10.2 (Inventions Owned by Amgen) and 10.3 (Inventions Owned by Ideaya), promptly following the Effective Date, patent representatives of each of the Parties shall meet (in person or by telephone) to discuss the patenting strategy for any Jointly Owned Inventions. In particular, the Parties shall discuss which Party will file a patent application (including any provisional, substitution, divisional, continuation, continuation in part, reissue, renewal, reexamination, extension, supplementary protection certificate and the like) in respect of any Jointly Owned Invention (each, a “Joint Patent Application”) and whether the Parties wish to appoint joint patent counsel. In any event, the Parties shall consult and reasonably cooperate with one other in the preparation, filing, prosecution (including prosecution strategy) and maintenance of such patent application as promptly as practicable and shall equally share the expenses associated with the Joint Patent Applications. Drafting, filing and prosecution of Joint Patent Applications will be through counsel acceptable to both Parties. The Parties will instruct such counsel to provide Amgen and Ideaya with copies of all office actions and correspondence and communications from the relevant patent offices issued in connection with a Joint Patent Application or Joint Patent. The Parties will instruct such counsel to provide Amgen and Ideaya with as much prior notice as practicable to review and comment on any communication with or submission to any patent office (including any patent application for a Jointly Owned Invention), and each Party will provide such comments (if any) within [***] days (or such shorter period as may be required by applicable circumstances) following receipt of such communication or submission. In the event that one Party (the “Filing Party”) wishes to file a patent application (including any provisional, substitution, division, continuation, continuation in part, reissue, renewal, reexamination, extension, supplementary protection certificate and the like) in respect of any Jointly Owned Invention and the other Party (the “Non-filing Party”) responds in writing (within [***] Business Days following notice by the Filing Party of its intent to file) that the Non-filing Party does not want to file any patent application for such Jointly Owned Invention or does not want to file in a particular country, the Non-filing Party shall execute such documents and perform such acts at the Filing Party’s expense as may be reasonably necessary to effect an assignment of such Jointly Owned Invention to the Filing Party (in such country or all countries, as applicable) in a timely manner to allow the Filing Party to prosecute such patent application. Likewise, if a Party (the “Opting-out Party”) wishes to discontinue the prosecution and maintenance of a Joint Patent Application, the other Party, at its sole option (the “Continuing Party”), may continue such prosecution and maintenance. In such event, the Opting-out Party shall execute such documents and perform such acts at the Continuing Party’s expense as may be reasonably necessary to effect an assignment of such Joint Patent Application to the Continuing Party (in such country or all countries, as applicable) in a timely manner to allow the Continuing Party to prosecute and maintain such patent application. Any Joint Patent Application or Jointly Owned Invention so assigned shall thereafter be owned solely by the Continuing Party or Filing Party (as applicable), and the Opting-out Party or Non-filing Party (as

applicable) shall have no right to practice under such Joint Patent Application or any patent claiming such Jointly Owned Invention in the applicable country or countries and, for the avoidance of doubt, any such patent, when issued, shall not be a Joint Patent. The Filing Party or Continuing Party (as applicable) hereby grants to the Opting-out Party or Non-Filing Party (as applicable) a perpetual, irrevocable, non-exclusive, royalty-free fully paid-up license under such solely owned patent applications and patents to practice any Invention claimed therein solely for the purposes of developing and commercializing its respective Compound (but not for use with the Filing Party or Continuing Party’s Compound), which license shall not be transferable or sublicensable to any Third Party except to (A) Affiliates of the Opting-out Party or Non-Filing Party (as applicable) and (B) Third Parties engaged in developing, manufacturing or marketing that Party’s Compound for or on behalf of that Party or its Affiliates. For purposes of this Section 10.1.2, “prosecution” includes defense of invalidity, declaratory judgment, revocation, reexamination, nullity, opposition, or other proceeding in which the validity of a Joint Patent is challenged in an administrative or legal proceeding, other than such administrative or legal proceeding that is related to an infringement action brought by a Party or a declaratory action defended by a Party. The Parties agree to act as promptly as possible in connection with decisions, responses and requests pursuant to this Section 10.1.2.

10.1.3

Amgen will have the sole right to initiate legal action to enforce all Joint Patents against infringement or misappropriation by Third Parties where such infringement or misappropriation results from the development or sale of an Amgen Compound, or defend any declaratory judgment action relating thereto, at its sole expense. Ideaya will have the sole right to initiate legal action to enforce all Joint Patents against infringement or misappropriation by Third Parties where such infringement or misappropriation results from the development or sale of an Ideaya Compound, or defend any declaratory judgment action relating thereto, at its sole expense. In the event that legal action to enforce Joint Patents will involve infringement or misappropriation resulting from the development or sale of a molecule or molecules that is/are or include(s) both an Amgen Compound and an Ideaya Compound, the Parties shall work together promptly to coordinate such action and shall, unless one Party elects not to pursue such legal action, share the costs and expenses of such litigation equally. For clarity, if the alleged infringer is selling or intending to sell only one of either an Amgen Compound or an Ideaya Compound, then the foregoing obligation to share the costs and expenses of such litigation shall not apply.

10.1.4

If one Party brings any enforcement or declaratory judgment action against a Third Party with respect to any Joint Patent, the second Party agrees to be joined as a party plaintiff where necessary to confer standing and to give the first Party reasonable assistance and authority to file and prosecute the action. The costs and expenses of the Party bringing the action under this Section 10.1.4 will be borne by such Party, and any damages or other monetary awards recovered (including but not limited to payments made pursuant to a settlement, consent judgment, or other voluntary final disposition) will be shared as follows: (i) the amount of such recovery actually received by the Party controlling such action will be first applied to the out-of-pocket costs of each Party in connection with such action; and then (ii) any remaining proceeds will be divided evenly between Amgen and Ideaya. A settlement or consent judgment or other voluntary final disposition of a suit under this Section 10.1.4 may be entered into without the consent of the Party not bringing the suit; provided, that such settlement, consent judgment or other disposition does not (a) admit the invalidity or unenforceability of the relevant Joint Patent, (b) result in any adverse impact on the Party not bringing suit, or (c) result in any adverse impact on or admit the invalidity or unenforceability of any Background IP owned by the Party not bringing suit, and provided further, that any rights granted under the relevant Joint Patent to continue the infringing activity in such settlement, consent judgment or other disposition will be limited to those rights that the granting Party otherwise has the right to grant, and further provided that the non-granting Party will be given at least [***]

days prior notice of the terms of such settlement and an opportunity to comment on such terms.

10.1.5

Orange Book Listings and Comparable Ex-U.S. Patent Linkage Listings. The Parties shall jointly determine whether to file and list the applicable Joint Patents, if any, covering a Jointly Owned Invention in any jurisdiction, such as the U.S. FDA’s “Orange Book” listing in the US.

10.2

Inventions Owned by Amgen. Notwithstanding Section 10.1 (Joint Ownership and Prosecution), the Parties agree that all rights to Inventions to the extent relating solely to the Amgen Compound, including any novel method-of-treatment and use involving the Amgen Compound (but not the Ideaya Compound), are the sole and exclusive property of Amgen (the “Amgen Sole Inventions”) and Ideaya hereby assigns and agrees to assign all rights therein to Amgen. Amgen will be entitled to file in its own name relevant patent applications and to own resultant patent rights for any such Invention. For the avoidance of doubt, any Invention generically encompassing the Amgen Compound (and not the Ideaya Compound) within its scope, even where such Amgen Compound is not disclosed per se, is the exclusive property of Amgen.

10.3

Inventions Owned by Ideaya. Notwithstanding Section 10.1 (Joint Ownership and Prosecution), the Parties agree that all rights to Inventions to the extent relating solely to the Ideaya Compound, including any novel method-of-treatment and use involving the Ideaya Compound (and not the Amgen Compound), are the sole and exclusive property of Ideaya (the “Ideaya Sole Inventions”) and Amgen hereby assigns and agrees to assign all rights therein to Ideaya. Ideaya will be entitled to file in its own name relevant patent applications and to own resultant patent rights for any such Invention. For the avoidance of doubt, any Invention generically encompassing the Ideaya Compound within its scope (and not the Amgen Compound), even where such Ideaya Compound is not disclosed per se, is the exclusive property of Ideaya.

10.4

Patent Filings. Except as expressly provided in Section 10.1.2, (i) Amgen agrees to make no patent application based on Ideaya Confidential Information, and to give no assistance to any Third Party for such application without Ideaya’s prior written authorization, and (ii) Ideaya agrees to make no patent application based on Amgen Confidential Information, and to give no assistance to any Third Party for such application without Amgen’s prior written authorization.

10.5

Mutual Freedom to Operate for Combination Inventions.

10.5.1

Amgen hereby grants to Ideaya a non-exclusive, worldwide, royalty-free, fully paid-up license, transferable and sublicensable, to any patent Controlled by Amgen that (a) is in Amgen’s Background IP and (b) claims or covers the Combination solely for purposes of conducting the Study during the Term.

10.5.2

Ideaya hereby grants to Amgen a perpetual, irrevocable, non-exclusive, worldwide, royalty-free, fully paid-up license, transferable and sublicensable, to any patent Controlled by Ideaya that (a) is in Ideaya’s Background IP and (b) claims or covers the Combination solely for purposes of conducting the Study during the Term.

10.5.3

For clarity, the terms of this Section 10.5 do not provide Ideaya or Amgen with any rights, title or interest or any license to the other Party’s Background IP which does not claim, specifically or in generic terms, the Combination (i.e., intellectual property Controlled by either Party which does not constitute an Invention and does not claim the Combination) except as necessary to conduct the Study.

Data Security and Privacy.

11.1

Data Security. The Parties agree to comply with the Information Security Requirements Schedule attached as Appendix D to this Agreement.

11.2

Data Protection and Privacy. Each Party, as applicable, agrees that:

11.2.1

to the extent that Ideaya and Amgen process Personal Data contained in the Clinical Data for the purposes of the Study, Ideaya and Amgen shall be considered to be joint controllers and shall jointly determine the purposes and means of processing with respect to such Personal Data. Each shall comply with the terms and conditions set out in the Joint Controller Addendum attached to this Agreement as Appendix C;

11.2.2

to the extent that either Party processes Personal Data contained in the Clinical Data, otherwise than for the purposes of the Study, such Party shall process such Personal Data as an independent data controller, and not as a processor or joint controller; and

11.2.3

such Party shall comply with GDPR and all applicable Data Protection Laws applicable to a controller, which shall include without limitation employing and maintaining appropriate Security to protect such data. “Security” means technological, physical and administrative controls, including, but not limited to, policies, procedures, organizational structures, hardware and software functions, as well as physical security measures, the purpose of which is, in whole or part, to ensure the confidentiality, integrity or availability of Personal Data.

11.3

Data Transfers. If, in connection with this Agreement or the Pharmacovigilance Agreement, either Party is required to transfer or otherwise disclose to the other Party Personal Data in respect of which the Parties are independent controller under Section 11.2.2 that has not been anonymized in accordance with applicable Data Protection Laws (e.g., in connection with the Pharmacovigilance Agreement), the Parties agree to comply with the following:

11.3.1

In the event of the actual or reasonably suspected unauthorized access, acquisition, alteration, and/or deletion of Personal Data resulting from a breach or violation of Security, each Party shall notify the other of such incident without undue delay (but in no event later than [***] hours after discovery). In such event, each Party shall be responsible for fulfilling any reporting and notification obligations required under GDPR and other Applicable Law (inclusive of Data Protection Laws) with regard to the data processing operations it carries out.

11.3.2

The Parties hereby incorporate the Standard Contractual Clauses necessary to effectuate the compliant onward transfer of Personal Data to Third Countries attached hereto as Appendix E. In addition, the Parties agree to cooperate with each to effectuate the compliant transfer of Personal Data applicable to other jurisdictions, which may include executing additional data transfer agreements.

11.3.3

To the extent required under GDPR and Applicable Law (inclusive of Data Protection Laws) and upon a Party’s reasonable request, the other Party shall make available to the requesting Party documentation reasonably necessary to demonstrate the other Party’s compliance with its obligations under GDPR and Applicable Law (inclusive of Data Protection Laws) and such Party’s obligations set out in this Agreement.

11.4

Each Party agrees to promptly negotiate and agree in good faith modifications or supplements to this Agreement, upon the other Party’s request, to the extent required for the Parties to collect, process and disclose Personal Data in connection with the Agreement in compliance with applicable Data Protection Law, including:

11.4.1

to address changes to or the legal interpretation of Data Protection Law;

11.4.2

to comply with the GDPR, any national legislation implementing it and any guidance on the interpretation of their respective provisions;

11.4.3

if the Standard Contractual Clauses relied upon or any other mechanisms or findings of adequacy are invalidated or amended,

11.4.4

if changes to the membership status of a country in the EU or the European Economic Area require such modification; or

11.4.5

if a Party processes Personal Data on behalf of the other Party.

Reprints. Consistent with applicable copyright and other Applicable Law, each Party may use, refer to, and disseminate reprints of scientific, medical and other published articles and materials from journals, conferences and/or symposia relating to the Study which disclose the name of a Party, provided (a) such use does not constitute an endorsement of any commercial product or service by the other Party and (b) each Party, at its own cost, obtains any necessary Third Party permissions for the right to use or reprint.

Publications.

13.1

Amgen will register the Study with the FDA’s Clinical Trials Registry (www.clinicaltrials.gov) and is committed to timely publication of the Combination Clinical Data in accordance with Section 3.9.4. Such publication of the Combination Clinical Data in a registry will be in accordance with Amgen’s publication policies and practices applicable to such publication. Notwithstanding Article 9 herein, the publication of the Combination Clinical Data in a registry by Amgen will be in accordance with the timelines required by applicable competent Regulatory Authorities. Amgen will use Commercially Reasonable Efforts to submit the primary results of the Study as well as the Preclinical Data, if applicable (the “Relevant Data”), for publication within [***] months of Study Completion, after taking appropriate action to secure intellectual property rights (if any) arising from the Study and the Preclinical Data, and subject to Ideaya’s prior review and approval (not to be unreasonably withheld, delayed, or conditioned) of any such publications under Section 13.2. Ideaya agrees not to publish the Relevant Data prior to the earlier of (a) publication of the Relevant Data by Amgen or (b) [***] months after Study Completion. Amgen will use Commercially Reasonable Efforts to publish or present scientific papers dealing with the Study and the Preclinical Data, which publications will be developed in accordance with accepted scientific practice and its internal policies and practices. Ideaya’s publications will be developed in accordance with accepted scientific practice and its internal policies and practices. For avoidance of doubt as to whether a publication is an Amgen publication or a Ideaya publication, Amgen publications will be identified as such in Amgen’s internal publication plan and Ideaya publications will be identified as such in Ideaya’s internal publication plan. In the event a Party creates a full or abridged Study name for the Study, it will own such Study name and may use the name to reference or register the Study as contemplated under this Section 13.1. Both Parties shall have the right to use and reference the Study name of the other Party internally or publicly during the Term, as contemplated and in accordance with the terms of this Agreement. Following expiration or early termination of this Agreement, each Party shall have the right to reference the Study name of the other Party, but agrees to not use or register such Study name in connection with any other study name relating to its Compound alone or with any other Third Party compound.

13.2

The Parties agree that prior to submission of any Relevant Data for publication or presentation or any other dissemination of results including oral dissemination, the publishing Party will invite the other to comment on the content of the material to be published or presented according to the following procedure:

13.2.1

At least [***] days prior to submission for publication of any paper, letter or any other publication, or submission for presentation of any abstract, poster, talk or any other presentation, the publishing Party will provide to the other Party the full details of the proposed publication or presentation in electronic version (e.g., cd-rom or email attachment). For the avoidance of doubt, “full details” includes the list of authors, journal title, conference identity, and draft of publication or presentation, as applicable.

13.2.2

The other Party shall provide comments, if any, to the publishing Party within [***] days of such receipt.

13.2.3

The publishing Party will remove Confidential Information of the other Party (other than Combination Clinical Data or Preclinical Data) pursuant to this Agreement before finalizing the publication or presentation.

13.2.4

If the other Party reasonably believes in good faith that such publication or presentation may jeopardize or adversely impact any of its patent rights, such other Party shall, within [***] days of receipt of the notice from the publishing Party, notify the publishing Party of such belief and the publishing Party will not submit data for publication/presentation for an additional [***] days in order to allow for actions to be taken to preserve rights for patent protection.

13.2.5

Each Party’s contribution shall be acknowledged in any publication by co-authorship or acknowledgment, in accordance with International Committee of Medical Journal Editors (ICMJE) guidelines. Authorship of publications by either Party shall be determined in accordance with ICMJE authorship guidelines.

13.3

Amgen agrees to include in all press releases, presentations and publications it makes related to the Relevant Data specific mention, if applicable, of the Ideaya Compound and the support and involvement of Ideaya in the Study. Ideaya agrees to include in all press releases, presentations and publications it makes related to the Relevant Data specific mention, if applicable, of the Amgen Compound and Amgen’s sponsorship of the Study.

13.4

Each Party may disclose the existence and terms of this Agreement to the extent required by Applicable Law, including the rules of any stock exchange or quotation system on which such Party’s securities are listed. Except as otherwise expressly permitted in this Agreement, neither Party will, and each Party will cause any Third Party collaborator(s) for its respective compound not to make any press or other public announcement concerning any aspect of this Agreement or the Study, or make use of the name of the other Party (or the name of the other Party’s Third Party collaborator(s) for its Compound) in any press release, advertising or publicity in connection with this Agreement, without the prior written consent of the other Party.

Representations and Warranties; Disclaimers.

14.1

Each of Amgen and Ideaya represents and warrants to the other that it has the full right and authority to enter into this Agreement.

14.2

Neither Party undertakes that the Study will lead to any particular result, nor is the success of the Study guaranteed. Neither Party accepts any responsibility for any use that the other Party may make of the Clinical Data nor for advice or information given in connection therewith.

14.3

No conflict.

14.3.1

Amgen Compounds and Rights. Amgen hereby represents and warrants to Ideaya that Amgen has the full right, power and authority to grant all of the licenses and other material rights granted to Ideaya under this Agreement.

14.3.2

Ideaya Compounds and Rights. Ideaya hereby represents and warrants to Amgen that Ideaya has the full right, power and authority to grant all of the licenses and other material rights granted to Amgen under this Agreement.

14.4

No Adverse Proceedings. Each Party represents and warrants to the other Party as of the Effective Date that, except as otherwise notified to the other Party, there is not pending or, to the knowledge of such Party, threatened, against such Party, any claim, suit, action or

governmental proceeding that would, if adversely determined, materially impair the ability of such Party to perform its obligations under this Agreement.

14.5

Compound Safety Issues. Each Party represents and warrants as of the Effective Date that, to the best of its knowledge, it is not aware of any material safety issue with respect to its Compound that is not reflected in the investigator’s brochure for its Compound existing as of the Effective Date.

14.6

Compliance and Anti-Corruption. Each of the Parties hereby represents, warrants, covenants and agrees with the other Party that, in connection with the Study or any other activities to take place pursuant to this Agreement:

14.6.1

Each Party shall carry out its activities in material compliance with Anti-Corruption Laws.

14.6.2

As part of the obligation set forth in Section 14.6.1, each Party shall not directly or indirectly pay, offer or promise to pay, or authorize such payment, offer or promise of, any money or anything else of value, to any Person or Government Official for the purpose of unlawfully (i) influencing the acts of such Person or Government Official; (ii) inducing such Person or Government Official to use his or her influence with any Governmental Authority; (iii) obtaining or retaining business; (iv) securing any improper advantage; (v) or acting in any way that would otherwise violate any Anti-Corruption Laws, in each case, in connection with this Agreement.

14.6.3

Each Party shall not, directly or indirectly, solicit, receive, or agree to accept any payment of money or anything else of value in violation of Applicable Laws, including but not limited to Anti-Corruption Laws.

14.6.4

Each Party shall maintain complete and accurate books, accounts, invoices and reasonably detailed records of its activities in connection with the Study or any other activities that take place pursuant to this Agreement, including all records required to establish compliance with Sections 14.6.2 and 14.6.3. Each Party shall maintain such books, accounts, invoices and records in accordance with such Party’s normal business practices in effect from time to time.

14.6.5

Each Party shall not knowingly use in connection with the Study, or the performance of its obligations hereunder, any employee, consultant, or investigator who has been debarred pursuant to section 306 of the U.S. Federal Food, Drug, and Cosmetic Act, 42 U.S.C. §1320a-7(a), or other applicable local law or foreign equivalent, excluded from participation in any federal healthcare program under 42 C.F.R. Part 1001 et seq., or disqualified as a clinical investigator pursuant to 21 C.F.R. 312.70, has been convicted of a criminal offense that falls within the scope of 42 U.S.C. §1320a-7(a), but has not yet been excluded, debarred, suspended, or otherwise declared ineligible, or who has notified such Party that he or she is the subject of such debarment, exclusion, or disqualification proceedings by any Governmental Authority.

14.6.6

To the extent that any officer, director, employee, Affiliate, agent, representative, consultant or subcontractor acting for or on behalf of a Party in connection with the subject matter of this Agreement (each, a “Representative”) takes any action, or fails to take any action, that would constitute a breach of the obligations set forth in Sections 14.6.1 to 14.6.5 by such Representative (as if such Representative were a party to this Agreement), it will constitute a breach of such obligations as if such Party had taken, or failed to take, such action itself.

14.6.7

Each Party shall promptly provide the other Party with written notice upon becoming aware of any breach or violation by a Party or its Representative of any representation, warranty or undertaking set forth in Sections 14.6.1 to 14.6.6.

14.7

Each Party understands, acknowledges, represents, and warrants that any payment or anything of value provided by either Party to the other Party is not intended, and shall not be construed, to induce the prescription or purchase of any product, or require any Covered Individual or Entity to promote, purchase, prescribe or otherwise recommend any product.

14.8

In the event one or more Covered Individuals and Entities contributes to or performs any of a Party’s obligations hereunder, payments made by or on behalf of such Party to each such Covered Individual and Entity or other compensation or consideration received by each such Covered Individual and Entity on account of its contributions to or performance of any of such Party’s obligations hereunder shall (a) comply with all Applicable Law, (b) represent fair market value, (c) not be determined in a manner that takes into account the volume or value of any future business that might be generated between the Parties, and (d) not be construed to require a Covered Individual or Entity to promote, purchase, prescribe, or otherwise recommend any product being marketed or under development, including but not limited to the Amgen Compound or Ideaya Compound. If any of the Parties is or becomes a Covered Individual and Entity, or is or becomes, owned, operated or controlled by one or more Covered Individual and Entity (the “Covered Party”), it shall notify the other Party of such and, upon receipt of such notification, the other Party will have the right, upon notice to the Covered Party, to request any modifications that it determines are necessary or required to comply with its or, as applicable, one or more of its Affiliate’s requirements for interactions with a Covered Individual and Entity. The Parties agree to negotiate in good faith with respect to any such modifications. If the Parties are unable to reach an agreement with respect to any such modification within [***] days of Covered Party’s receipt of such notice, the other Party will have the right to terminate this Agreement immediately.

14.9

EXCEPT AS EXPRESSLY PROVIDED HEREIN, (A) IDEAYA MAKES NO WARRANTIES, EXPRESS OR IMPLIED, INCLUDING ANY WARRANTY OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE, WITH RESPECT TO THE IDEAYA COMPOUND; AND (B) AMGEN MAKES NO WARRANTIES, EXPRESS OR IMPLIED, INCLUDING ANY WARRANTY OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE, WITH RESPECT TO THE AMGEN COMPOUND.

Insurance; Indemnification; Limitation of Liability.

15.1

Insurance. Each Party warrants that it maintains a policy or program of insurance or self-insurance at levels sufficient to support the indemnification obligations assumed herein. Upon request, a Party will provide evidence of such insurance.

15.2

Indemnification.

15.2.1

Indemnification by Amgen. Amgen agrees to defend, indemnify and hold harmless (“Indemnify”) Ideaya, its Affiliates, and its and their employees, directors, officers, subcontractors and agents (the “Ideaya Indemnitees”) from and against any loss, damage, reasonable costs and expenses (including reasonable attorneys’ fees and expenses) incurred in connection with any claim, proceeding, or investigation by a Third Party (a “Liability”) arising out of this Agreement or the Study, to the extent that such Liability arises or results from (i) negligence or willful misconduct on the part of Amgen or its Affiliates, and its and their employees, directors, officers, subcontractors and agents (“Amgen Indemnitees”); (ii) a breach on the part of Amgen or any Amgen Indemnitee of any of its representations and warranties or any other covenants or obligations of Amgen under this Agreement or the Related Agreements; (iii) a breach of Applicable Law by Amgen or any Amgen Indemnitee; or (iv) any injury to a subject in the Study to the extent solely attributable to the Amgen Compound.

15.2.2

Indemnification by Ideaya. Ideaya agrees to Indemnify the Amgen Indemnitees from and against any Liability arising out of this Agreement or the Study, to the extent that such Liability arises or results from (i) negligence or willful misconduct on the part of Ideaya or any Ideaya Indemnitee; (ii) a breach on the part of Ideaya of any of its representations and warranties or any other covenants or

obligations of Ideaya under this Agreement or the Related Agreements; (iii) a breach of Applicable Law by Ideaya or any Ideaya Indemnitee; or (iv) any injury to a subject in the Study to the extent solely attributable to the Ideaya Compound.

15.2.3

Procedure. In the event that a Party seeks indemnification hereunder with respect to a Third Party claim, the Party seeking indemnification (the “Indemnified Party”) shall promptly notify the other Party (the “Indemnifying Party”) in writing of any Third Party claim in respect of which it intends to claim indemnification under this Article 15. Any failure to provide the Indemnifying Party with any such notice will not relieve the Indemnifying Party from any liability that it may have to the Indemnified Party under this Article 15 except to the extent that the ability of the Indemnifying Party to defend such claim is materially prejudiced by the Indemnified Party’s failure to give such notice. The Indemnifying Party will have the right to assume the defense of any suit or claim related to the Liability if it has assumed responsibility for the suit or claim in writing. The Indemnified Party will have the right to participate in the defense thereof and to employ counsel, at its own expense, separate from the counsel employed by the Indemnifying Party; provided, that the Indemnified Party will have the right to employ counsel to represent it at the expense of the Indemnifying Party if the Indemnified Party has been advised by its counsel that there are one or more legal defenses available to it that are different from or additional to those available to the Indemnifying Party or that there is otherwise a potential conflict between the interests of the Indemnified Party and the Indemnifying Party, in which event the reasonable fees and expenses of such separate counsel will be paid by the Indemnifying Party. If the Indemnifying Party does not assume control of the defense of a Third Party claim within [***] days after the receipt by the Indemnifying Party of the notice required pursuant to this Section 15.2.3, the Indemnified Party will have the right to defend such claim in such manner as it may deem appropriate at the reasonable cost and expense of the Indemnifying Party. The Party controlling such defense (the “Defending Party”) shall keep the other Party (the “Other Party”) not formally participating in the defense advised of the status of such action, suit, proceeding or claim and the defense thereof. The Other Party shall cooperate as may be reasonably requested in order to ensure the proper and adequate defense of any action, suit, proceeding or claim and the Defending Party shall consider recommendations made by the Other Party with respect thereto. The Defending Party shall not agree to any settlement of such action, suit, proceeding or claim, without the prior written consent of the Other Party, which consent shall not be unreasonably withheld; provided that the Defending Party, solely to the extent the Defending Party is also the Indemnifying Party, may, without the prior written consent of the Indemnified Party, agree to any settlement of such action, suit, proceeding or claim or consent to any judgment in respect thereof solely to the extent that such settlement includes only the payment of monetary damages (which are fully paid by the Indemnifying Party), does not impose any injunctive or equitable relief upon the Indemnified Party, does not require any admission or acknowledgment of liability or fault of the Indemnified Party and contains a complete and unconditional release of the Indemnified Party from all liability with respect thereto and does not impose any liability or obligation on the Indemnified Party.

15.2.4

Separate Defense of Claim. In the event that the Parties cannot agree as to the application of Sections 15.2.1 or 15.2.2 to any particular Liability or Third Party claims, the Parties may conduct separate defenses of such Liability and Third Party claim. Each Party further reserves the right to claim indemnity from the other in accordance with Sections 15.2.1 or 15.2.2 upon resolution of the underlying Third Party claim, notwithstanding the provisions of Section 15.2.3.

15.3

limitation of liability. Other than with respect to The Obligations of either party under SECTIONS 9.1, 9.2 and 9.4 (cONFIDENTIALITY), SECTION 10.1.1 (Solely with respect to the third sentence thereoF), SECTION 15.2.1 (iNDEMNIFICATION BY AMGEN) OR SECTION 15.2.2 (iNDEMNIFICATION BY

Ideaya), respectively, and except in the case of THE WILLFUL BREACH, WILLFUL MISCONDUCT, OR GROSS NEGLIGENCE BY A PARTY, the liability of either Party to the other under or in connection with this Agreement or arising in any other way out of the subject matter of this Agreement will not extend to the loss of business or profit or to any incidental or consequential losses or damages, regardless of the cause of action (whether in contract, tort, breach of warranty or otherwise), REGARDLESS OF ANY NOTICE OF THE POSSIBILITY OF SUCH DAMAGES.

Miscellaneous.

16.1

Use of Name. Except as otherwise provided herein (including in Section 12 (Reprints) and Section 13.4), neither Party will have any right, express or implied, to use in any manner the name or other designation of the other Party or any other trade name, trademark or logo of the other Party for any purpose in connection with the performance of this Agreement.

16.2

Force Majeure. If the performance of this Agreement by one of the Parties is prevented, hindered or delayed by reason of any cause beyond such Party’s control (e.g., war, pandemic, riots, fire, strike, governmental laws, terrorism), such Party will be excused from performance to the extent that it is necessarily prevented, hindered or delayed by such force majeure and the non-performing Party notifies the other Party of such force majeure within [***] days after such occurrence by giving written notice to the other Party stating the nature of the event, its anticipated duration, and any action being taken to avoid or minimize its effect. The suspension of performance will be of no greater scope and no longer duration than is necessary and the non-performing Party will use Commercially Reasonable Efforts to remedy its inability to perform.

16.3

Entire Agreement; Modification. The Parties agree to the full and complete performance of the mutual covenants contained in this Agreement. This Agreement, together with the Related Agreements, in each case, when executed, constitutes the sole, full and complete agreement by and between the Parties with respect to the subject matter of this Agreement and all prior agreements, understandings, promises and representations, whether written or oral, with respect thereto are superseded by this Agreement. All Exhibits attached hereto are incorporated herein as part of this Agreement. In the event of a conflict between a Related Agreement and this Agreement, the terms of this Agreement shall control. No amendment, change, addition, deletion or modification to or of this Agreement will be valid unless reduced to a written agreement that explicitly references this Agreement that is signed by the Parties hereto. Any term or condition of this Agreement may be waived at any time by the Party that is entitled to the benefit thereof, but no such waiver shall be effective unless set forth in a written instrument duly executed by or on behalf of the Party waiving such term or condition. The waiver by either Party of any right hereunder or of the failure to perform or of a breach by the other Party shall not be deemed a waiver of any other right hereunder or of any other breach or failure by said other Party whether of a similar nature or otherwise.

16.4

Performance by Affiliates. Each Party will have the right to exercise its rights and perform its obligations hereunder through its Affiliates; provided, however, that such Party will be responsible for its Affiliates’ performance hereunder.

16.5

Assignment. Neither Party will assign or transfer this Agreement or any rights or obligations hereunder, without the prior written consent of the other Party; provided, however, that either Party may assign this Agreement, or the rights and obligations hereunder, without prior written consent of the other Party to any Affiliate (so long as such entity remains an Affiliate of the relevant Party), or to any third party in connection with the transfer or sale of all or substantially all of the business to which this Agreement relates. Any assignment not in accordance with this Section 16.5 (Assignment) will be void ab initio. Subject to the foregoing, the rights and obligations of the Parties under this Agreement will be binding upon and inure to the benefit of the successors and permitted assigns of the Parties.

16.6

Invalid Provision. If any provision of this Agreement is held to be illegal, invalid or unenforceable, the remaining provisions will remain in full force and effect and will not be affected by the illegal, invalid or unenforceable provision. In lieu of the illegal, invalid or unenforceable provision,

the Parties will negotiate in good faith to agree upon a reasonable provision that is legal, valid and enforceable to carry out as nearly as practicable the original intention of the entire Agreement.

16.7

No Additional Obligations. Amgen and Ideaya have no obligation to renew this Agreement or apply this Agreement to any clinical trial other than the Study. Neither Party is under any obligation to enter into another type of agreement at this time or in the future.

16.8

Dispute Resolution, Jurisdiction and Governing Law.

16.8.1

Any claim, dispute or controversy arising out of or relating to this Agreement, including the breach, termination or validity hereof or thereof (each, a “Dispute”), that cannot be resolved by the JOC shall be referred for resolution to the respective Executive Officers of each Party. The Executive Officers shall attempt in good faith to resolve such Dispute by unanimous consent.

16.8.2

In the event that no resolution is made by the Executive Officers (or their designee) in good faith negotiations within [***] Business Days after such Dispute is referred to them, then (whether or not the Executive Officers actually engaged in discussions of the Dispute) such Dispute will be resolved by the courts of competent jurisdiction located in the State of New York, USA without giving effect to its choice of law principles. This Agreement is governed by and shall be construed and interpreted in accordance with the laws of the State of New York, USA, without giving effect to conflicts of law principles.

16.8.3

Nothing contained in this Agreement will deny either Party the right to seek injunctive or other equitable relief from a court of competent jurisdiction in the context of a bona fide emergency or prospective irreparable harm, and such an action may be filed or maintained notwithstanding any ongoing discussions between the Parties.

16.9

Notices. All notices or other communications that are required or permitted hereunder will be in writing and delivered personally, sent by email or facsimile (and promptly confirmed by personal delivery or overnight courier), or sent by internationally-recognized overnight courier addressed as follows:

If to Ideaya, to:

7000 Shoreline Court, Suite 350

South San Francisco, CA 94080

Attention: Legal Department

Email: ***@***

If to Amgen, to:

One Amgen Center Drive

Thousand Oaks, California ###-###-####

Attention: Corporate Secretary

Facsimile: 805 ###-###-####

Email: ***@***

16.10

Relationship of the Parties. The relationship between the Parties is and will be that of independent contractors, and does not and will not constitute a partnership, joint venture, agency or fiduciary relationship. Neither Party will have the authority to make any statements, representations or commitments of any kind, or take any actions, which are binding on the other Party, except with the prior written consent of the other Party to do so. All persons employed by a Party will be the employees of such Party and not of the other Party and all costs and obligations incurred by reason of any such employment will be for the account and expense of such Party.

16.11

Further Assurances. Each of Amgen and Ideaya agrees to duly execute and deliver, or cause to be duly executed and delivered, such further instruments and do and cause to be done such further acts and things, including, without limitation, the filing of such additional assignments, agreements, documents and instruments, as the other Party may at any time and from time to time reasonably request in connection with this Agreement or to carry out more effectively the provisions and purposes of, or to better assure and confirm unto such other Party its rights and remedies under, this Agreement.

16.12

Counterparts and Due Execution. This Agreement and any amendment may be executed in two (2) or more counterparts (including by way of facsimile or electronic transmission), each of which will be deemed an original, but all of which together will constitute one and the same instrument, notwithstanding any electronic transmission, storage and printing of copies of this Agreement from computers or printers. When executed by the Parties, this Agreement will constitute an original instrument, notwithstanding any electronic transmission, storage and printing of copies of this Agreement from computers or printers. Signatures to this Agreement or its amendments, transmitted by email in “portable document format” (“.pdf”), via DocuSign, or by any other electronic means intended to preserve the original graphic and pictorial appearance (the “Electronic Delivery”) of this Agreement, or its amendment, shall have the same effect as physical delivery of the paper document bearing original signature.

16.13

Construction. Except where the context otherwise requires, wherever used, the singular will include the plural, the plural the singular, the use of any gender will be applicable to all genders, and the word “or” is used in the inclusive sense (and/or). Whenever this Agreement refers to a number of days, unless otherwise specified, such number refers to calendar days. The captions of this Agreement are for convenience of reference only and in no way define, describe, extend or limit the scope or intent of this Agreement or the intent of any provision contained in this Agreement. The term “including” as used herein will be deemed to be followed by the phrase “without limitation” or like expression. The term “will” as used herein means will. References to “Article,” “Section” or “Appendix” are references to the numbered articles and sections of this Agreement and the appendices attached to this Agreement, unless expressly stated otherwise. Except where the context otherwise requires, references to this “Agreement” will include the appendices attached to this Agreement. The language of this Agreement will be deemed to be the language mutually chosen by the Parties and no rule of strict construction will be applied against either Party hereto.

[Remainder of page intentionally left blank.]

IN WITNESS WHEREOF, the respective representatives of the Parties have executed this Clinical Trial Collaboration and Supply Agreement as of the Effective Date.

IDEAYA BIOSCIENCES, INC.

/s/ Yujiro Hata

Signature

Yujiro Hata

Name

Chief Executive Officer

Title

AMGEN Inc.

/s/ Jean-Charles Soria

Signature

Jean-Charles Soria

Name

SVP, Global Development Oncology

Title

Appendix A

Protocol Outline

[***]

Appendix B

Development Plan

[***]

Appendix C

JOINT CONTROLLER ADDENDUM

Introduction

1.1

For the purposes of this Appendix C (the “Joint Controller Addendum”, or the “JCA”), Ideaya and Amgen will during the term of the Agreement process, as joint controllers, Personal Data contained in the Clinical Data (the “Joint Personal Data”) as described in Exhibit 1 below, which defines notably the purpose, scope, modalities and means of the Processing of the Joint Personal Data, as well as categories of Data Subjects concerned by the Processing.

1.2

This Joint Controller Addendum specifies the Parties’ respective data protection obligations which arise from their processing of the Joint Personal Data under the Agreement. This Joint Controller Addendum is issued under and is incorporated into the Agreement. Notwithstanding anything to the contrary set out in the Agreement, in the event that any provision of this Joint Controller Addendum is inconsistent with any term(s) of the Agreement, this Joint Controller Addendum will prevail with regard to the processing of the Joint Personal Data.

Definitions

2.1

For the purposes of this Joint Controller Addendum, the following expressions bear the following meanings unless the context otherwise requires or unless otherwise defined in the Agreement:

Under this JCA, the Parties agree that the terms “Personal Data Breach”, “Data Subject”, “Controller”, “processing”, “Processor”, “Supervisory Authority” and “Third Party(ies)” shall have the meaning assigned to them in the GDPR.

“Joint Controller” means a Controller which, jointly with one or several other Controller(s), determines the purpose(s) and means of the Processing as set out in Article 26 of the GDPR and/or UK GDPR. Ideaya, on the one hand, and Amgen on the other hand, are Joint Controllers of the Processing, the purpose of which is detailed in Exhibit 1 to this JCA;

“Regulator” means a data protection supervisory authority which has jurisdiction over the Data Controller or the Data Processor’s Processing of Personal Data; and

"Subprocessor" means any natural or legal person engaged by a Processor for the performance of all or part of the Processing operated on behalf of either of the Joint Controllers.

Obligations as Joint Controllers

3.1

The Parties agree that, for the purposes of the Agreement, they will Process the Joint Personal Data as described in Exhibit 1 below, which defines notably the purpose, scope, modalities and means of the processing, as well as categories of Data Subjects concerned by the processing.

3.2

Subject to the allocation of responsibilities set out in section 4 below, each Joint Controller shall:

3.2.1

ensure that the Joint Personal Data processed by such Party or its affiliates or subcontractors in connection with this JCA is processed lawfully, fairly, strictly for the purpose(s) set forth in the Agreement and in a transparent manner, in accordance with the Data Protection Laws;

3.2.2

ensure that it implements the necessary measures to comply with the Data Protection Law in its role as Joint Controller, including but not limited to the obligation to maintain a record of the processing in its own register of processing activities;

3.2.3

maintain all relevant documentation to be able to demonstrate its compliance with the Data Protection Laws and with the provisions of this JCA;

3.2.4

immediately inform the other Party, as the case may be, of its inability to comply with its obligations under the Data Protection Laws or this JCA for whatever reason, or of its Processors’ inability to comply with its obligations as Processor in the context of this JCA, with due justification as to the nature, cause and expected consequences of such inability;

3.2.5

immediately inform the other Party if it has reason to believe that all or part of the processing infringes the Data Protection Law or any relevant applicable law; in such a case, the Parties shall cooperate in good faith to determine whether the processing must be regarded as a breach of the Data Protection Law, and whether, as a result, the processing should be suspended, amended and re-initiated or alternatively if the processing should be terminated;

3.2.6

process and retain the Joint Personal Data only for the term(s) of retention as set out in Exhibit 1 and in any event for no longer than any statutory or professional retention periods under Data Protection Laws or other mandatory laws or regulations; and

3.2.7

subject to Section 2.5 of the Agreement, be entitled to use the Processors it usually uses for the regular operation of its activities and ensure compliance with Article 28 of the GDPR or equivalent provisions under the Data Protection Law; in this respect, the relevant Party shall make the list of such Processors and their respective Subprocessors available to the other Party upon request.

3.3

For the sake of clarity, the Joint Controllership is limited to the processing of the Joint Personal Data required for the purposes of the Study and does not extend to any Processing undertaken by either Party outside the scope of the Joint Clinical Data or the Study.

Data Transfers

4.1

The Parties hereby incorporate the Standard Contractual Clauses necessary to effectuate the compliant onward transfer of Joint Personal Data to Third Countries attached to the Agreement as Appendix E.

Allocation of responsibilities of the Joint Controllers

5.1

Under this JCA, the Joint Controllers intend to determine the way in which they allocate their respective responsibilities as Joint Controllers for the processing of the Joint Personal Data. In this respect, the Parties agree as set out below.

[***]

Liability

6.1

The liability of the Parties with respect to Data Subjects shall be governed by Art 82 GDPR (or equivalent provisions under Applicable Data Protection Laws). This Joint Controller Addendum shall not be a basis for any claims of Data Subjects or other third parties against a Party.

6.2

As between the Parties, each Joint Controller shall indemnify and hold harmless the other Joint Controller against any claim, demand, proceeding, action, liability, suit, expense, fine, penalty, damage, loss and/or cost (including without limitation legal and other professional advisers fees) incurred by the other Joint Controller (each a “Claim”), to the extent arising out of or in connection with such Joint Controller’s failure to comply with Data Protection Laws and with this JCA; provided, however, that the obligations under this Section 6 of this JCA shall be subject to the limitations set forth in Section 15.3 of the Agreement.

Costs

7.1

Each Party shall be responsible for all costs and expenses incurred by such Party in the performance of its obligations under this JCA.

Exhibit 1 to Appendix C

Description of the Processing of Personal Data

Purpose(s) of the Processing

Conduct of the Study in accordance with the Agreement and the Protocol.

Categories of Data Subjects

The personal data transferred concern the following categories of data subjects:

•

clinical trial participants;

•

clinical investigators and site staff; and

•

vendor staff and consultants.

Type of Personal Data

The personal data transferred concern the following categories of data:

•

patient health data (encoded with subject ID) (including pharmacovigilance data);

•

business contact information of clinical site investigators and site staff delegates (first and last name, address, phone, fax, email and relevant information contained in CVs in support of regulatory submissions); and

•

business contact information of data exporter’s vendors and consultants (first and last name, address, phone, fax and email in support of regulatory submissions).

Terms of retention of the categories of Personal Data

Personal Data will be retained for the duration of the Agreement and as required or permitted to fulfill legal requirements and in line with Applicable Laws.

Appendix D

Information Security Requirements Schedule

This Information Security Requirements Schedule (“Information Security Schedule”) supplements (and is not intended, and shall not be interpreted, to limit the terms of the Agreement) and is governed by the terms and conditions of the Agreement to which it is attached. Any defined terms not otherwise defined herein shall have the meanings set forth in the Agreement. In addition to requirements set forth in the Agreement, each Party shall handle, treat, store, access (or limit access), and otherwise protect (1) the other Party’s Confidential Information (or similarly defined term in the Agreement); and (2) Personal Data disclosed, transferred, or otherwise made available by the other Party (collectively “Protected Information”) in accordance with the terms of this Information Security Schedule.

Information Security Program Requirements Standards. Each Party shall implement, and warrants that it will implement throughout the Term of the Agreement, a documented information security program that is based on one or more of the following industry standard information security frameworks (each an “Information Security Industry Standard”):

(a)

International Organization for Standardization (“ISO”) / International Electrotechnical Commission (“IEC”) ISO/IEC 27002 - Information technology – Security techniques – Code of practice for information security controls; or

(b)

American Institute of Certified Public Accountants (“AICPA”) Trust Services Principles, Criteria and Illustrations; or

(c)

Information Security Forum (“ISF”) Standards of Good Practice (“SoGP”) for Information Security; or

(d)

National Institute of Standards and Technology (“NIST”) Special Publication 800-53 - Security and Privacy Controls for Federal Information Systems and Organizations; or

(e)

Information Systems Audit and Control Association (“ISACA”) Control Objectives for Information and related Technology (COBIT).

ACCESS TO ELECTRONIC INFORMATION SYSTEMS OR PROTECTED INFORMATION. In the event either Party or its Representatives, including any subcontractors, have access to the other Party’s Electronic Information Systems (“EIS”) or access to the other Party’s Protected Information that is collected, transferred, or stored by the other Party, such Party shall at all times implement Security (as such term is defined herein. For purposes of this Information Security Schedule, the term “Security” means the applicable Party’s technological, physical, administrative and procedural safeguards, including but not limited to policies, procedures, standards, controls, hardware, software, firmware and physical security measures, the function or purpose of which is, in whole or part, to protect the confidentiality, integrity or availability of information and data) satisfactory to the other Party to protect EIS and the other Party’s Protected Information.

SECURITY. Each Party agrees that, commencing upon the date such Party is retained by the other Party to perform its obligations under the Agreement, and continuing as long as such Party controls, possesses, stores, transmits or processes the

other Party’s Protected Information, such Party shall employ, maintain and enforce reasonable and appropriate Security designed to protect all the other Party’s Protected Information from unauthorized use, alteration, access or disclosure, and unlawful destruction, and to protect the confidentiality, integrity and availability of such Protected Information. Such Security shall include, but not be limited to, the following:

(i)

To the extent such Party does not already employ one, such Party shall develop and maintain a reasonable and appropriate written data security policy that requires implementation of technological, physical, administrative and procedural controls to protect the confidentiality, integrity and availability of the other Party’s Protected Information that encompasses access, retention, transport and destruction, and that provides for disciplinary action in the event of its violation;

(ii)

Such Party shall implement reasonable restrictions regarding physical and electronic access to the other Party’s Protected Information, including but not limited to physical access controls, secure user authentication protocols, secure access control methods (including privileged access), network security and intrusion prevention protection, malware protection, controls for patch management and updates, and use of industry standard encryption where appropriate or required by Applicable Laws (or such similar term in the Agreement);

(iii)

Such Party shall prevent terminated employees from accessing the other Party’s Protected Information by immediately terminating their physical and electronic access to such information;

(iv)

Such Party shall employ assessment, logging, monitoring and auditing procedures to ensure internal compliance with these safeguards;

(v)

Such Party shall conduct an assessment of these safeguards at least annually.

(vi)

Controls for, at the other Party’s direction, (a) preserving the other Party’s Protected Information and data and any information transmitted through EIS in accordance with the other Party’s instructions and requests, including without limitation any retention schedules and/or litigation hold orders provided by the other Party to such Party, independent of where the information is stored, (b) complying with the obligations in Section 10.5 of the Agreement;

(vii)

Methods for limiting access to the other Party’s Protected Information and to EIS only to such Party’s Representatives, including subcontractors, who have a need for such access in order to perform services or supply goods under the Agreement, which shall include without limitation (a) permitted access methods, (b) an authorization process for users’ access and privileges; and (c) maintenance of a list of authorized users.

Without limiting any rights and remedies hereunder, each Party shall have the right to audit and monitor the other Party’s compliance with the requirements of this Information Security Schedule. Upon reasonable notice to the other Party, once per year during the Term of the Agreement (and except as otherwise stated in this Information Security Schedule), each Party (or any vendor selected by such Party) may

undertake an assessment and audit of the audited Party’s Security and the audited Party’s compliance with all Applicable Laws as relevant to the audited Party’s actions related to the auditing Party’s Protected Information in connection with this Agreement. The auditing Party shall have the right to revoke or limit the audited Party’s access to the auditing Party’s Protected Information or to EIS at any time for any reason. In addition to its other obligations hereunder, upon the auditing Party’s request, the audited Party shall immediately return to the auditing Party any hardware and software provided to the audited Party by or on behalf of the auditing Party.

INFORMATION SECURITY INCIDENT MANAGEMENT. Each Party shall establish and implement access and activity audit and logging procedures, including without limitation access attempts and privileged access. Each Party shall ensure Incident response planning and notification procedures exist (and such Party implements) to monitor, react to, notify and investigate any Incident. For purposes of this Schedule, the term “Incident” shall mean any actual or reasonably suspected: (1) unauthorized use, alteration, disclosure or theft of or access to the other Party’s Protected Information by such Party or one or more of its Representatives, (2) accidental or unlawful destruction of the other Party’s Protected Information by such Party or one or more of its Representatives; or (3) loss of the other Party’s Protected Information by such Party or one or more of its Representatives, including without limitation, any of the foregoing described in (1) – (3) caused by or resulting from a failure, lack or inadequacy of security measures of such Party or one or more of its Representatives. Without limiting the other Party’s rights or remedies hereunder, such other Party shall have the right to terminate the Agreement, in whole or in part, in the event of any Incident.

Without limiting each Party’s obligations regarding the other Party’s Protected Information, with respect to each Incident, each Party shall:

(i)

immediately conduct a reasonable investigation of the reasons for and circumstances surrounding such Incident, including without limitation performing a root cause analysis on the Incident, informing the other Party of the root cause analysis and remedial actions and schedule to prevent the same or similar Incident. The Party shall consider in good faith all comments that the other Party provides with respect to the investigation, remedial actions or schedule;

(ii)

take all necessary actions to prevent, contain, and mitigate the impact;

(iii)

without limiting any other notification obligations under the Agreement, provide notice to the other Party promptly by electronic mail at (A) if to the Company, ***@*** or (B) if to Ideaya, ***@*** (“Incident Notice”), but in no event later than twenty-four (24) hours, after such Party or its Representatives discovered or became aware of an Incident. The Incident Notice shall contain at a minimum the following information:

(a)

Description of the Incident, including information related to what (if any) of the other Party’s Protected Information or applications, was the subject of or affected by the Incident;

(b)

Actions taken by such Party to remediate the Incident and any countermeasures implemented by such Party to prevent future Incidents;

(c)

The name and contact information of such Party’s staff member that can act as a liaison between the Parties; and

(d)

Any other relevant information (including indicators of compromise) that can help the other Party protect itself from the Incident.

(iv)

collect and preserve all evidence concerning the discovery, cause, vulnerability, exploit, remedial actions and impact;

(v)

at the other Party’s request, provide notice in a manner and format reasonably specified by the other Party to governmental authorities and/or affected individuals;

(vi)

provide the other Party with: (i) weekly written status reports concerning mitigation and remediation activities and (ii) any documents and information reasonably requested by the other Party;

(vii)

at the other Party’s request, reasonably cooperate and coordinate with the other Party concerning the other Party’s investigation, enforcement, monitoring, document preparation, notification requirements and reporting concerning Incidents and the Parties’ compliance with Applicable Laws and/or relevant industry standards; and reasonably cooperate with the other Party in the event that the other Party notifies third parties of the Incident.

•

ENCRYPTION. Each Party shall encrypt all the other Party’s Protected Information at rest or in transit between the Parties and between such Party and all third parties (including such Party’s Representatives). ‘Encryption’ must utilize, (1) for data at rest, encryption consistent with National Institute of Standards and Technology (“NIST”) Special Publication 800-111 and (2) for data in transit, encryption that complies with Federal Information Processing Standard 140-2 and such other encryption standards as the US Secretary of Health and Human Services formally publish, from time to time, as being adequate to render data unusable, unreadable, or indecipherable.

Appendix E

Standard Contractual Clauses

Each, a “Party”; together, “the Parties”.

SECTION I

Clause 1

Purpose and scope

(a)

The purpose of these standard contractual clauses is to ensure compliance with the requirements of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (General Data Protection Regulation) for the transfer of personal data to a third country.

(b)

Parties:

(i)

Ideaya Biosciences, Inc., a Delaware corporation, having its principal office at 7000 Shoreline Court, Suite 350, South San Francisco, California 94080 (hereinafter “data exporter”), and

(ii)

Amgen Inc. a Delaware Corporation, having its principal office at One Amgen Center Drive, Thousand Oaks, California 91320 USA, receiving the personal data from the data exporter, directly or indirectly via another entity also Party to these Clauses, as listed in Annex I.A. (hereinafter “data importer”).

have agreed to these standard data protection clauses (hereinafter “Clauses”).

(c)

These Clauses apply with respect to the transfer of personal data as specified in Annex I.B.

(d)

The Appendix to these Clauses containing the Annexes referred to therein forms an integral part of these Clauses.

Clause 2

Effect and invariability of the Clauses

(a)

These Clauses set out appropriate safeguards, including enforceable data subject rights and effective legal remedies, pursuant to Article 46(1) and Article 46 (2)(c) of Regulation (EU) 2016/679 and, with respect to data transfers from controllers to processors and/or processors to processors, standard contractual clauses pursuant to Article 28(7) of Regulation (EU) 2016/679, provided they are not modified, except to select the appropriate Module(s) or to add or update information in the Appendix. This does not prevent the Parties from including the standard contractual clauses laid

down in these Clauses in a wider contract and/or to add other clauses or additional safeguards, provided that they do not contradict, directly or indirectly, these Clauses or prejudice the fundamental rights or freedoms of data subjects.

(b)

These Clauses are without prejudice to obligations to which the data exporter is subject by virtue of Regulation (EU) 2016/679.

Clause 3

Third party beneficiaries

(a)

Data subjects may invoke and enforce these Clauses, as third party beneficiaries, against the data exporter and/or data importer, with the following exceptions:

(i)

Clause 1, Clause 2, Clause 3, Clause 6, Clause 7;

(ii)

Clause 8.5(e) and Clause 8.9(b);

(iii)

Clause 12(a) and (d);

(iv)

Clause 13;

(v)

Clause 15.1(c), (d) and (e);

(vi)

Clause 16(e);

(vii)

Clause 18(a) and (b).

(b)

Paragraph (a) is without prejudice to rights of data subjects under Regulation (EU) 2016/679.

Clause 4

Interpretation

(a)

Where these Clauses use the terms defined in Regulation (EU) 2016/679, those terms shall have the same meaning as in that Regulation.

(b)

These Clauses shall be read and interpreted in the light of the provisions of Regulation (EU) 2016/679.

(c)

These Clauses shall not be interpreted in a way that conflicts with rights and obligations provided for in Regulation (EU) 2016/679.

Clause 5

Hierarchy

In the event of a contradiction between these Clauses and the provisions of related agreements between the Parties, existing at the time these Clauses are agreed or entered into thereafter, these Clauses shall prevail.

Clause 6

Description of the transfer(s)

The details of the transfer(s), and in particular the categories of personal data that are transferred and the purpose(s) for which they are transferred, are specified in Annex I.B.

Clause 7

Docking Clause

(a)

An entity that is not a Party to these Clauses may, with the agreement of the Parties, accede to these Clauses at any time, either as a data exporter or as a data importer, by completing the Appendix and signing Annex I.A.

(b)

Once it has completed the Appendix and signed Annex I.A, the acceding entity shall become a Party to these Clauses and have the rights and obligations of a data exporter or data importer in accordance with its designation in Annex I.A.

(c)

The acceding entity shall have no rights or obligations arising under these Clauses from the period prior to becoming a Party.

SECTION II – OBLIGATIONS OF THE PARTIES

Clause 8

Data protection safeguards

The data exporter warrants that it has used reasonable efforts to determine that the data importer is able, through the implementation of appropriate technical and organisational measures, to satisfy its obligations under these Clauses.

8.1 Purpose limitation

The data importer shall process the personal data only for the specific purpose(s) of the transfer, as set out in Annex I.B. It may only process the personal data for another purpose:

(i)

where it has obtained the data subject’s prior consent;

(ii)

where necessary for the establishment, exercise or defence of legal claims in the context of specific administrative, regulatory or judicial proceedings; or

(iii)

where necessary in order to protect the vital interests of the data subject or of another natural person.

8.2 Transparency

(a)

In order to enable data subjects to effectively exercise their rights pursuant to Clause 10, the data importer shall inform them, either directly or through the data exporter:

(i)

of its identity and contact details;

(ii)

of the categories of personal data processed;

(iii)

of the categories of personal data processed;

(iv)

where it intends to onward transfer the personal data to any third party/ies, of the recipient or categories of recipients (as appropriate with a view to providing meaningful information), the purpose of such onward transfer and the ground therefore pursuant to Clause 8.7.

(b)

Paragraph (a) shall not apply where the data subject already has the information, including when such information has already been provided by the data exporter, or providing the information proves impossible or would involve a disproportionate effort for the data importer. In the latter case, the data importer shall, to the extent possible, make the information publicly available.

(c)

On request, the Parties shall make a copy of these Clauses, including the Appendix as completed by them, available to the data subject free of charge. To the extent necessary to protect business secrets or other confidential information, including personal data, the Parties may redact part of the text of the Appendix prior to sharing a copy, but shall provide a meaningful summary where the data subject would otherwise not be able to understand its content or exercise his/her rights. On request, the Parties shall provide the data subject with the reasons for the redactions, to the extent possible without revealing the redacted information.

(d)

Paragraphs (a) to (c) are without prejudice to the obligations of the data exporter under Articles 13 and 14 of Regulation (EU) 2016/679.

8.3 Accuracy and data minimisation

(a)

Each Party shall ensure that the personal data is accurate and, where necessary, kept up to date. The data importer shall take every reasonable step to ensure that personal data that is inaccurate, having regard to the purpose(s) of processing, is erased or rectified without delay.

(b)

If one of the Parties becomes aware that the personal data it has transferred or received is inaccurate, or has become outdated, it shall inform the other Party without undue delay.

(c)

The data importer shall ensure that the personal data is adequate, relevant and limited to what is necessary in relation to the purpose(s) of processing.

8.4 Storage limitation

The data importer shall retain the personal data for no longer than necessary for the purpose(s) for which it is processed. It shall put in place appropriate technical or organisational measures to ensure compliance with this obligation, including erasure or anonymisation of the data and all back-ups at the end of the retention period.

8.5 Security of processing

(a)

The data importer and, during transmission, also the data exporter shall implement appropriate technical and organisational measures to ensure the security of the personal data, including protection against a breach of security leading to accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access (hereinafter “personal data breach”). In assessing the appropriate level of security, they shall take due account of the state of the art, the costs of implementation, the nature, scope, context and purpose(s) of processing and the risks involved in the processing for the data subject. The Parties shall in particular consider having recourse to encryption or pseudonymisation, including during transmission, where the purpose of processing can be fulfilled in that manner.

(b)

The Parties have agreed on the technical and organisational measures set out in Annex II. The data importer shall carry out regular checks to ensure that these measures continue to provide an appropriate level of security.

(c)

The data importer shall ensure that persons authorised to process the personal data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality.

(d)

In the event of a personal data breach concerning personal data processed by the data importer under these Clauses, the data importer shall take appropriate measures to address the personal data breach, including measures to mitigate its possible adverse effects.

(e)

In case of a personal data breach that is likely to result in a risk to the rights and freedoms of natural persons, the data importer shall without undue delay notify both the data exporter and the competent supervisory authority pursuant to Clause 13. Such notification shall contain i) a description of the nature of the breach (including, where possible, categories and approximate number of data subjects and personal data records concerned), ii) its likely consequences, iii) the measures taken or proposed to address the breach, and iv) the details of a contact point from whom more information can be obtained. To the extent it is not possible for the

data importer to provide all the information at the same time, it may do so in phases without undue further delay.

(f)

In case of a personal data breach that is likely to result in a high risk to the rights and freedoms of natural persons, the data importer shall also notify without undue delay the data subjects concerned of the personal data breach and its nature, if necessary in cooperation with the data exporter, together with the information referred to in paragraph (e), points ii) to iv), unless the data importer has implemented measures to significantly reduce the risk to the rights or freedoms of natural persons, or notification would involve disproportionate efforts. In the latter case, the data importer shall instead issue a public communication or take a similar measure to inform the public of the personal data breach.

(g)

The data importer shall document all relevant facts relating to the personal data breach, including its effects and any remedial action taken, and keep a record thereof.

8.6 Sensitive data

Where the transfer involves personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, genetic data, or biometric data for the purpose of uniquely identifying a natural person, data concerning health or a person’s sex life or sexual orientation, or data relating to criminal convictions or offences (hereinafter “sensitive data”), the data importer shall apply specific restrictions and/or additional safeguards adapted to the specific nature of the data and the risks involved. This may include restricting the personnel permitted to access the personal data, additional security measures (such as pseudonymisation) and/or additional restrictions with respect to further disclosure.

8.7 Onward transfers

The data importer shall not disclose the personal data to a third party located outside the European Union (in the same country as the data importer or in another third country, hereinafter “onward transfer”) unless the third party is or agrees to be bound by these Clauses, under the appropriate Module. Otherwise, an onward transfer by the data importer may only take place if:

(i)

it is to a country benefitting from an adequacy decision pursuant to Article 45 of Regulation (EU) 2016/679 that covers the onward transfer;

(ii)

the third party otherwise ensures appropriate safeguards pursuant to Articles 46 or 47 of Regulation (EU) 2016/679 with respect to the processing in question;

(iii)

the third party enters into a binding instrument with the data importer ensuring the same level of data protection as under these Clauses, and the data importer provides a copy of these safeguards to the data exporter;

(iv)

it is necessary for the establishment, exercise or defence of legal claims in the context of specific administrative, regulatory or judicial proceedings;

(v)

it is necessary in order to protect the vital interests of the data subject or of another natural person; or

(vi)

where none of the other conditions apply, the data importer has obtained the explicit consent of the data subject for an onward transfer in a specific situation, after having informed him/her of its purpose(s), the identity of the recipient and the possible risks of such transfer to him/her due to the lack of appropriate data protection safeguards. In this case, the data importer shall inform the data exporter and, at the request of the latter, shall transmit to it a copy of the information provided to the data subject.

Any onward transfer is subject to compliance by the data importer with all the other safeguards under these Clauses, in particular purpose limitation.

8.8 Processing under the authority of the data importer

The data importer shall ensure that any person acting under its authority, including a processor, processes the data only on its instructions.

8.9 Documentation and compliance

(a)

Each Party shall be able to demonstrate compliance with its obligations under these Clauses. In particular, the data importer shall keep appropriate documentation of the processing activities carried out under its responsibility.

(b)

The data importer shall make such documentation available to the competent supervisory authority on request.

Clause 9

Intentionally omitted.

Clause 10

Data subject rights

(a)

The data importer, where relevant with the assistance of the data exporter, shall deal with any enquiries and requests it receives from a data subject relating to the processing of his/her personal data and the exercise of

his/her rights under these Clauses without undue delay and at the latest within one month of the receipt of the enquiry or request. The data importer shall take appropriate measures to facilitate such enquiries, requests and the exercise of data subject rights. Any information provided to the data subject shall be in an intelligible and easily accessible form, using clear and plain language.

(b)

In particular, upon request by the data subject the data importer shall, free of charge:

(i)

provide confirmation to the data subject as to whether personal data concerning him/her is being processed and, where this is the case, a copy of the data relating to him/her and the information in Annex I; if personal data has been or will be onward transferred, provide information on recipients or categories of recipients (as appropriate with a view to providing meaningful information) to which the personal data has been or will be onward transferred, the purpose of such onward transfers and their ground pursuant to Clause 8.7; and provide information on the right to lodge a complaint with a supervisory authority in accordance with Clause 12.1(c)(i);

(ii)

rectify inaccurate or incomplete data concerning the data subject;

(iii)

erase personal data concerning the data subject if such data is being or has been processed in violation of any of these Clauses ensuring third-party beneficiary rights, or if the data subject withdraws the consent on which the processing is based.

(c)

Where the data importer processes the personal data for direct marketing purposes, it shall cease processing for such purposes if the data subject objects to it.

(d)

The data importer shall not make a decision based solely on the automated processing of the personal data transferred (hereinafter “automated decision”), which would produce legal effects concerning the data subject or similarly significantly affect him / her, unless with the explicit consent of the data subject or if authorised to do so under the laws of the country of destination, provided that such laws lays down suitable measures to safeguard the data subject’s rights and legitimate interests. In this case, the data importer shall, where necessary in cooperation with the data exporter:

(i)

inform the data subject about the envisaged automated decision, the envisaged consequences and the logic involved; and

(ii)

implement suitable safeguards, at least by enabling the data subject to contest the decision, express his/her point of view and obtain review by a human being.

(e)

Where requests from a data subject are excessive, in particular because of their repetitive character, the data importer may either charge a reasonable fee taking into account the administrative costs of granting the request or refuse to act on the request.

(f)

The data importer may refuse a data subject’s request if such refusal is allowed under the laws of the country of destination and is necessary and proportionate in a democratic society to protect one of the objectives listed in Article 23(1) of Regulation (EU) 2016/679.

(g)

If the data importer intends to refuse a data subject’s request, it shall inform the data subject of the reasons for the refusal and the possibility of lodging a complaint with the competent supervisory authority and/or seeking judicial redress.

Clause 11

Redress

(a)

The data importer shall inform data subjects in a transparent and easily accessible format, through individual notice or on its website, of a contact point authorised to handle complaints. It shall deal promptly with any complaints it receives from a data subject.

(b)

In case of a dispute between a data subject and one of the Parties as regards compliance with these Clauses, that Party shall use its best efforts to resolve the issue amicably in a timely fashion. The Parties shall keep each other informed about such disputes and, where appropriate, cooperate in resolving them.

(c)

Where the data subject invokes a third-party beneficiary right pursuant to Clause 3, the data importer shall accept the decision of the data subject to:

(i)

lodge a complaint with the supervisory authority in the Member State of his/her habitual residence or place of work, or the competent supervisory authority pursuant to Clause 13;

(ii)

refer the dispute to the competent courts within the meaning of Clause 18.

(d)

The Parties accept that the data subject may be represented by a not-for-profit body, organisation or association under the conditions set out in Article 80(1) of Regulation (EU) 2016/679.

(e)

The data importer shall abide by a decision that is binding under the applicable EU or Member State law.

(f)

The data importer agrees that the choice made by the data subject will not prejudice his/her substantive and procedural rights to seek remedies in accordance with applicable laws.

Clause 12

Liability

(a)

Each Party shall be liable to the other Party/ies for any damages it causes the other Party/ies by any breach of these Clauses.

(b)

Each Party shall be liable to the data subject, and the data subject shall be entitled to receive compensation, for any material or non-material damages that the Party causes the data subject by breaching the third-party beneficiary rights under these Clauses. This is without prejudice to the liability of the data exporter under Regulation (EU) 2016/679.

(c)

Where more than one Party is responsible for any damage caused to the data subject as a result of a breach of these Clauses, all responsible Parties shall be jointly and severally liable and the data subject is entitled to bring an action in court against any of these Parties.

(d)

The Parties agree that if one Party is held liable under paragraph (c), it shall be entitled to claim back from the other Party/ies that part of the compensation corresponding to its / their responsibility for the damage.

(e)

The data importer may not invoke the conduct of a processor or sub-processor to avoid its own liability.

Clause 13

Supervision

(a)

The supervisory authority of one of the Member States in which the data subjects whose personal data is transferred under these Clauses in relation to the offering of goods or services to them, or whose behaviour is monitored, are located, as indicated in Annex I.C, shall act as competent supervisory authority.

(b)

The data importer agrees to submit itself to the jurisdiction of and cooperate with the competent supervisory authority in any procedures aimed at ensuring compliance with these Clauses. In particular, the data importer agrees to respond to enquiries submit to audits and comply with the measures adopted by the supervisory authority, including remedial and compensatory measures. It shall provide the supervisory authority with written confirmation that the necessary actions have been taken.

SECTION III – LOCAL LAWS AND OBLIGATIONS IN CASE OF ACCESS BY PUBLIC AUTHORITIES

Clause 14

Local laws and practices affecting compliance with the Clauses

(a)

The Parties warrant that they have no reason to believe that the laws and practices in the third country of destination applicable to the processing of the personal data by the data importer, including any requirements to disclose personal data or measures authorising access by public authorities, prevent the data importer from fulfilling its obligations under these Clauses. This is based on the understanding that laws and practices that respect the essence of the fundamental rights and freedoms and do not exceed what is necessary and proportionate in a democratic society to safeguard one of the objectives listed in Article 23(1) of Regulation (EU) 2016/679, are not in contradiction with these Clauses.

(b)

The Parties declare that in providing the warranty in paragraph (a), they have taken due account in particular of the following elements:

(i)

the specific circumstances of the transfer, including the length of the processing chain, the number of actors involved and the transmission channels used; intended onward transfers; the type of recipient; the purpose of processing; the categories and format of the transferred personal data; the economic sector in which the transfer occurs; the storage location of the data transferred;

(ii)

the laws and practices of the third country of destination– including those requiring the disclosure of data to public authorities or authorising access by such authorities – relevant in light of the specific circumstances of the transfer, and the applicable limitations and safeguards;

(iii)

any relevant contractual, technical or organisational safeguards put in place to supplement the safeguards under these Clauses, including measures applied during transmission and to the processing of the personal data in the country of destination.

(c)

The data importer warrants that, in carrying out the assessment under paragraph (b), it has made its best efforts to provide the data exporter with relevant information and agrees that it will continue to cooperate with the data exporter in ensuring compliance with these Clauses.

(d)

The Parties agree to document the assessment under paragraph (b) and make it available to the competent supervisory authority on request.

(e)

The data importer agrees to notify the data exporter promptly if, after having agreed to these Clauses and for the duration of the contract, it has reason to believe that it is or has become subject to laws or practices not in line with the requirements under paragraph (a), including following a change in the laws of the third country or a measure (such as a disclosure request) indicating an application of such laws in practice that is not in line with the requirements in paragraph (a).

(f)

Following a notification pursuant to paragraph (e), or if the data exporter otherwise has reason to believe that the data importer can no longer fulfil its obligations under these Clauses, the data exporter shall promptly identify appropriate measures (e.g. technical or organisational measures to ensure security and confidentiality) to be adopted by the data exporter and/or data importer to address the situation. The data exporter shall suspend the data transfer if it considers that no appropriate safeguards for such transfer can be ensured, or if instructed by the competent supervisory authority to do so. In this case, the data exporter shall be entitled to terminate the contract, insofar as it concerns the processing of personal data under these Clauses. If the contract involves more than two Parties, the data exporter may exercise this right to termination only with respect to the relevant Party, unless the Parties have agreed otherwise. Where the contract is terminated pursuant to this Clause, Clause 16(d) and (e) shall apply.

Clause 15

Obligations of the data importer in case of government access requests

15.1 Notification

(a)

The data importer agrees to notify the data exporter and, where possible, the data subject promptly (if necessary with the help of the data exporter) if it:

(i)

receives a legally binding request from a public authority, including judicial authorities, under the laws of the country of destination for the disclosure of personal data transferred pursuant to these Clauses; such notification shall include information about the personal data requested, the requesting authority, the legal basis for the request and the response provided; or

(ii)

becomes aware of any direct access by public authorities to personal data transferred pursuant to these Clauses in accordance with the laws of the country of destination; such notification shall include all information available to the importer.

(b)

If the data importer is prohibited from notifying the data exporter and/or the data subject under the laws of the country of destination, the data importer agrees to use its best efforts to obtain a waiver of the prohibition, with a view to communicating as much information as possible, as soon as possible. The data importer agrees to document its best efforts in order to be able to demonstrate them on request of the data exporter.

(c)

Where permissible under the laws of the country of destination, the data importer agrees to provide the data exporter, at regular intervals for the duration of the contract, with as much relevant information as possible on the requests received (in particular, number of requests, type of data requested, requesting authority/ies, whether requests have been challenged and the outcome of such challenges, etc.).

(d)

The data importer agrees to preserve the information pursuant to paragraphs (a) to (c) for the duration of the contract and make it available to the competent supervisory authority on request.

(e)

Paragraphs (a) to (c) are without prejudice to the obligation of the data importer pursuant to Clause 14(e) and Clause 16 to inform the data exporter promptly where it is unable to comply with these Clauses.

15.2 Review of legality and data minimisation

(a)

The data importer agrees to review the legality of the request for disclosure, in particular whether it remains within the powers granted to the requesting public authority, and to challenge the request if, after careful assessment, it concludes that there are reasonable grounds to consider that the request is unlawful under the laws of the country of destination, applicable obligations under international law and principles of international comity. The data importer shall, under the same conditions, pursue possibilities of appeal. When challenging a request, the data importer shall seek interim measures with a view to suspending the effects of the request until the competent judicial authority has decided on its merits. It shall not disclose the personal data requested until required to do so under the applicable procedural rules. These requirements are without prejudice to the obligations of the data importer under Clause 14(e).

(b)

The data importer agrees to document its legal assessment and any challenge to the request for disclosure and, to the extent permissible under the laws of the country of destination, make the documentation available to the data exporter. It shall also make it available to the competent supervisory authority on request.

(c)

The data importer agrees to provide the minimum amount of information permissible when responding to a request for disclosure, based on a reasonable interpretation of the request.

SECTION III – FINAL PROVISIONS

Clause 16

Non-compliance with the Clauses and termination

(a)

The data importer shall promptly inform the data exporter if it is unable to comply with these Clauses, for whatever reason.

(b)

In the event that the data importer is in breach of these Clauses or unable to comply with these Clauses, the data exporter shall suspend the transfer of personal data to the data importer until compliance is again ensured or the contract is terminated. This is without prejudice to Clause 14(f).

(c)

The data exporter shall be entitled to terminate the contract, insofar as it concerns the processing of personal data under these Clauses, where:

(i)

the data exporter has suspended the transfer of personal data to the data importer pursuant to paragraph (b) and compliance with these Clauses is not restored within a reasonable time and in any event within one month of suspension;

(ii)

the data importer is in substantial or persistent breach of these Clauses; or

(iii)

the data importer fails to comply with a binding decision of a competent court or supervisory authority regarding its obligations under these Clauses.

In these cases, it shall inform the competent supervisory authority of such non-compliance. Where the contract involves more than two Parties, the data exporter may exercise this right to termination only with respect to the relevant Party, unless the Parties have agreed otherwise.

(d)

Personal data that has been transferred prior to the termination of the contract pursuant to paragraph (c) shall at the choice of the data exporter immediately be returned to the data exporter or deleted in its entirety. The same shall apply to any copies of the data. The data importer shall certify the deletion of the data to the data exporter. Until the data is deleted or returned, the data importer shall continue to ensure compliance with these Clauses. In case of local laws applicable to the data importer that prohibit the return or deletion of the transferred personal data, the data importer warrants that it will continue to ensure compliance with these Clauses and will only process the data to the extent and for as long as required under that local law.

(e)

Either Party may revoke its agreement to be bound by these Clauses where (i) the European Commission adopts a decision pursuant to Article 45(3) of Regulation (EU) 2016/679 that covers the transfer of personal data to which these Clauses apply; or (ii) Regulation (EU) 2016/679 becomes part of the legal framework of the country to which the personal data is transferred. This is without prejudice to other obligations applying to the processing in question under Regulation (EU) 2016/679.

Clause 17

Governing law

These Clauses shall be governed by the law of one of the EU Member States, provided such law allows for third-party beneficiary rights. The Parties agree that this shall be the law of the Netherlands.

Clause 18

Choice of forum and jurisdiction

(a)

Any dispute arising from these Clauses shall be resolved by the courts of an EU Member State.

(b)

The Parties agree that those shall be the courts of the Netherlands.

(c)

A data subject may also bring legal proceedings against the data exporter and/or data importer before the courts of the Member State in which he/she has his/her habitual residence.

(d)

The Parties agree to submit themselves to the jurisdiction of such courts.

APPENDIX to Appendix E

ANNEX 1

A. LIST OF PARTIES

Data exporter(s):

Name: Amgen Inc.

Address: One Amgen Center Drive, Thousand Oaks, California ###-###-####

Contact person’s name, position and contact details: ***@***

Activities relevant to the data transferred under these Clauses: Collection of personal data of the categories of data subjects listed below for the purposes of conducting clinical trials.

Role: Controller

Data importer(s):

Name (written out in full): Ideaya Biosciences, Inc.

Address: 7000 Shoreline Court, Suite 350, South San Francisco, California 94080

Contact person’s name, position and contact details: ***@***.

Activities relevant to the data transferred under these Clauses: N/A

Role: Controller

B. DESCRIPTION OF THE TRANSFER

Categories of data subjects whose personal data is transferred

The personal data transferred concern the following categories of data subjects:

•

Clinical trial participants

•

Clinical investigators and site staff

•

Vendor staff and consultants

Categories of personal data transferred

The personal data transferred concern the following categories of data:

•

Patient health data (encoded with subject ID) (including pharmacovigilance data)

•

Business contact information of clinical site investigators and site staff delegates (first and last name, address, phone, fax, email and relevant information contained in CVs in support of regulatory submissions)

•

Business contact information of data exporter’s vendors and consultants (first and last name, address, phone, fax and email in support of regulatory submissions)

Sensitive data transferred and applied restrictions or safeguards that fully takes into consideration the nature of the data and the risks involved, such as for instance strict purpose limitation, access restrictions (including access only for staff having followed specialised training), keeping a record of access to the data, restrictions for onward transfers or additional security measures.

The special categories of Patient Personal Data transferred may include patient health data (encoded with subject ID) (including pharmacovigilance data).

Data importer, taking into account the nature, scope, context, and purposes of the Processing, as well as the risk for the rights and freedoms of natural persons, takes appropriate technical and organizational measures that meet or exceed the requirements set forth in Appendix D to the Agreement (“Information Security Requirements Schedule”). Specific technical and organizational measures can be requested from data importer.

The frequency of the transfer

Continuous basis.

Nature of the transfer, Purpose(s) of the transfer and further processing

The transfer of Personal Data is made to comply with its reporting regulatory obligations and to ensure high standards of quality and safety of health care and of medicinal products; and, if applicable, for other purposes required or allowed by law or consented to by the data subjects.

The period for which the personal data will be retained, or, if that is not possible, the criteria used to determine that period

Personal Data will be retained for the duration of the Agreement and as required or permitted to fulfill legal requirements and in line with applicable law.

For transfers to (sub-) processors, also specify subject matter, nature and duration of the processing

The subject matter, nature, and duration of the Processing is defined under the Agreement and this Appendix to Appendix E.

C. COMPETENT SUPERVISORY AUTHORITY

Identify the competent supervisory authority/ies in accordance with Clause 13:

Autoriteit Persoonsgegevens.

ANNEX 2

TECHNICAL AND ORGANISATIONAL MEASURES INCLUDING TECHNICAL AND ORGANISATIONAL MEASURES TO ENSURE THE SECURITY OF THE DATA

Description of the technical and organizational measures implemented by the data importer, including any relevant certifications:

SUPPLEMENTARY PROVISIONS

Measures Supplementary to Clause 15 of the Clauses.

1.1.

In addition to the obligations imposed on the data importer under clause 15.1 of the Clauses, the data importer shall promptly notify the requesting third party (including any public authority) and, where legally permissible, the data exporter and/or the competent supervisory authority, of the incompatibility of the third party’s request, order or direct access with the data importer’s obligations under the Clauses and/or the related agreements between the Parties.

1.2.

Any personal data transmitted in plain text in the normal course of business under the Clauses and the related agreements between the Parties may only be accessed by a third party (including any public authority) with the express or implied agreement of the data exporter and/or the data subject for a specific access to such personal data.

Measures Supplementary to Clause 14 of the Clauses.

2.1.

The data importer warrants to the data exporter that:

it has not purposefully created back doors or similar programming that could be used to access its systems and/or personal data;

it has not purposefully created or changed its business processes in a manner that facilitates access to personal data or its systems;

national law or government policy does not require the data importer to create or maintain back doors or to facilitate access to personal data or its systems or for the data importer to be in possession or to hand over the encryption key; and

all information on the laws in the third country of destination provided by the data importer to the data exporter pursuant to clause 14(c) of the Clauses, to the best of the data importer’s knowledge, is true, accurate and not misleading.

2.2.

The data importer further warrants to the data exporter that the warranties given pursuant to the Clauses and paragraph 2.1 above were true, accurate and not misleading when given and will remain so throughout each duration of the related agreements between the Parties (each a “Contract Period”). The warranties given by the data importer under the Clauses and paragraph 2.1 above shall be deemed to be repeated on each day of the relevant Contract Period by reference to the facts and circumstances then subsisting. Any reference made to the date of the related agreements between the Parties or this Annex IV (Supplementary Provisions) (whether express or implied) in relation to such repeated warranties shall be construed as a reference to the date of such repetition.

2.3.

The data importer shall immediately notify the data exporter in writing where the data importer becomes aware of any fact or circumstance which renders any of the warranties provided by the data importer pursuant to the Clauses and/or paragraph 2.1 above untrue, inaccurate or misleading. If the data importer so notifies the data exporter, clause 14(f) of the Clauses shall apply.

Effectiveness of Technical Measures

3.1.

The data importer agrees that transfer of personal data shall be conditional upon the implementation of the specific technical measures identified by the Parties in Annex II of the Clauses, and any failure by the data importer to implement such specific technical measures shall entitle the data exporter with immediate effect to suspend the data transfer or to terminate at no cost to the data exporter the related agreements between the Parties by notifying the data importer. The data importer shall implement such additional specific technical measures as may be notified by the data exporter to the data importer from time to time.

3.2.

The Parties agree that, should the Clauses become invalidated or revoked, the Parties shall collaborate in good faith and take all reasonable steps as may be required in order to execute an alternative, valid transfer mechanism within 90 days of the invalidation of the Clauses.

UK Addendum to the EU Commission Standard Contractual Clauses

Date of this Addendum:

The Clauses are dated July 26, 2022 This Addendum is effective from the same date as the Clauses.

Background:

The Information Commissioner considers this Addendum provides appropriate safeguards for the purposes of transfers of personal data to a third country or an international organisation in reliance on Articles 46 of the UK GDPR and, with respect to data transfers from controllers to processors and/or processors to processors.

Interpretation of this Addendum

Where this Addendum uses terms that are defined in the Annex those terms shall have the same meaning as in the Annex. In addition, the following terms have the following meanings:


This Addendum	This Addendum to the Clauses
The Annex	The Standard Contractual Clauses set out in the Annex of Commission Implementing Decision (EU) 2021/914 of 4 June 2021
UK Data Protection Laws	All laws relating to data protection, the processing of personal data, privacy and/or electronic communications in force from time to time in the UK, including the UK GDPR and the Data Protection Act of 2018.
UK GDPR	The United Kingdom General Data Protection Regulation, as it forms part of the law of England and Wales, Scotland and Northern Ireland by virtue of section 3 of the European Union (Withdrawal) Act of 2018
UK	The United Kingdom of Great Britain and Northern Ireland

This Addendum shall be read and interpreted in the light of the provisions of UK Data Protection Laws, and so that if fulfils the intention for it to provide the appropriate safeguards as required by Article 46 GDPR.

This Addendum shall not be interpreted in a way that conflicts with rights and

obligations provided for in UK Data Protection Laws.

Any references to legislation (or specific provisions of legislation) means that legislation (or specific provision) as it may change over time. This includes where that legislation (or specific provision) has been consolidated, re- enacted and/or replaced after this Addendum has been entered into.

Hierarchy

In the event of a conflict or inconsistency between this Addendum and the provisions of the Clauses or other related agreements between the Parties, existing at the time this Addendum is agreed or entered into thereafter, the provisions which provide the most protection to data subjects shall prevail.

Incorporation of the Clauses

This Addendum incorporates the Clauses which are deemed to be amended to the extent necessary so they operate:

for transfers made by the data exporter to the data importer, to the extent that UK Data Protection Laws apply to the data exporter’s processing when making that transfer; and

to provide appropriate safeguards for the transfers in accordance with Articles 46 of the UK GDPR Laws.

The amendments required by Section 7 above, include (without limitation):

References to the “Clauses” means this Addendum as it incorporates the Clauses

Clause 6 Description of the transfer(s) is replaced with:

“The details of the transfers(s) and in particular the categories of personal data that are transferred and the purpose(s) for which they are transferred) are those specified in Annex I.B where UK Data Protection Laws apply to the data exporter’s processing when making that transfer.”

References to “Regulation (EU) 2016/679” or “that Regulation” are replaced by “UK Data Protection Laws” and references to specific Article(s) of “Regulation (EU) 2016/679” are replaced with the equivalent Article or Section of UK Data Protection Laws. In particular:

N/A

References to Regulation (EU) 2018/1725 are removed.

References to the “Union”, “EU” and “EU Member State” are all replaced with the “UK”

Clause 13(a) and Part C of Annex II are not used; the “competent supervisory authority” is the Information Commissioner;

Clause 17 is replaced to state “These Clauses are governed by the laws of England and Wales”.

Clause 18 is replaced to state:

“Any dispute arising from these Clauses shall be resolved by the courts of England and Wales. A data subject may also bring legal proceedings against the data exporter and/or data importer before the courts of any country in the UK. The Parties agree to submit themselves to the jurisdiction of such courts.”

The footnotes to the Clauses do not form part of the Addendum.

Amendments to this Addendum

The Parties may agree to change Clause 17 and/or 18 to refer to the laws and/or courts of Scotland or Northern Ireland.

The Parties may amend this Addendum provided it maintains the appropriate safeguards required by Art 46 UK GDPR for the relevant transfer by incorporating the Clauses and making changes to them in accordance with Section 7 above.

Executing this Addendum

The Parties may enter into the Addendum (incorporating the Clauses) in any way that makes them legally binding on the Parties and allows data subjects to enforce their rights as set out in the Clauses. This includes (but is not limited to):

By adding this Addendum to the Clauses and including in the following above the signatures in Annex 1A:

“By signing we agree to be bound by the UK Addendum to the EU Commission Standard Contractual Clauses dated:” and add the date (where all transfers are under the Addendum)

“By signing we also agree to be bound by the UK Addendum to the EU Commission Standard Contractual Clauses dated” and add the date (where there are transfers both under the Clauses and under the Addendum) (or words to the same effect) and executing the Clauses; or

By amending the Clauses in accordance with this Addendum, and executing those amended Clauses.