Third Amendment to Application Service Provider Agreement, dated January 1, 2018, by and between Registrant and DNAnexus, Inc

1.

Section 1 of the Agreement is hereby amended to include the following additional definitions, which shall apply to any use of the defined terms in the Agreement:

2.

Section 18.4 (Personal Data) of the Agreement is hereby amended by replacing the reference to “EU Data Protection Directive (Directive 95/46/EEC)” with “EU Data Protection Law”

3.

Section 5 (Services) of the Agreement is hereby amended by adding the following to the end of this section:

4.

Section 18.5 (Treatment of Personal Data) is hereby amended by adding the following text to the end of this section:

5.

Section 18.6 (Retention of Personal Data) is hereby amended by adding the following text to the end of this section:

6.

Exhibit A of the Agreement is hereby amended by adding Exhibit A -- the Statement of Work No. 2 attached hereto as the Statement of Work No. 2 to the Agreement.  

7.

Exhibit B of the Agreement is hereby deleted and replaced with Exhibit B attached hereto.

8.

The Agreement is further amended by adding Exhibit F hereto (“Data Processing Addendum) as a new Exhibit F to the Agreement.

1.

Definition:  In this Addendum, "controller", "processor", "data subject", "personal data", "processing" (and "process") and "special categories of personal data" will have the meanings given in EU Data Protection Law.

2.

Relationship of the parties: Natera (the controller) appoints Vendor as a processor to process Content containing personal data of a data subject as may be provided for in the Agreement (the "Data") for the purposes described in the Agreement (or as otherwise agreed in writing by the parties) (the "Permitt Purpose").  Vendor will comply with the obligations applicable to it under Applicable Laws, including Data Protection Law.

3.

International transfers:  Vendor will not transfer the Data outside of the European Economic Area ("EEA") unless it has taken such measures as are necessary to ensure the transfer is in compliance with Applicable Law.

4.

Confidentiality of processing:  Vendor will ensure that any person it authorizes to process the Data (an "Authorized Person") will protect the Data in accordance with Vendor's confidentiality obligations under the Agreement and Applicable Law.

5.

Security:  Vendor will implement technical and organizational measures as set out in Agreement to protect the Data (i) from accidental or unlawful destruction, and (ii) loss, alteration, unauthorized disclosure of, or access to the Data (each, a "Security Incident"). 

6.

Third party processors:  Vendor may appoint one or more third party processors to process the Data for the Permitted Purpose on its behalf, provided that: (i) it engages only processors that have implemented appropriate technical and organizational measures to protect the Data, and ensure the rights of the data subjects, in accordance with Applicable Law; and (ii) Vendor will remain solely liable for any breach of this Addendum or of Applicable Law that may be caused by its processors' processing of the Data.

7.

Cooperation and data subjects' rights:  Vendor will provide reasonable and timely assistance to Natera (at Natera's expense) to enable Natera to respond to: (i) any request from a data subject to exercise any of its rights under Applicable Law (including its rights of access, correction, objection, erasure and data portability, as applicable); and (ii) any other correspondence, enquiry or complaint received from a data subject, regulator or other third party in connection with the processing of the Data.   In the event that any such request, correspondence, enquiry or complaint is made directly to Vendor, Vendor will promptly inform Natera providing full details of the same.

8.

Data Protection Impact Assessment:  If Vendor believes or becomes aware that its processing of the Data is likely to result in a high risk to data protection rights, it will inform Natera and provide reasonable cooperation to Natera (at Natera's expense) in connection with any data protection impact assessment that may be required under Applicable Law.

9.

Security incidents:  If it becomes aware of a confirmed Security Incident, Vendor will inform Natera without undue delay and will provide reasonable information and cooperation to Natera so that Natera can fulfill any data breach reporting obligations it may have under (and in accordance with the timescales required by) Applicable Law.  Vendor will further take  reasonably necessary measures and actions to remedy or mitigate the effects of the Security Incident and will keep Natera informed of all material developments in connection with the Security Incident.

10.

Data Retention:  Upon termination or expiry of the Agreement, Vendor will delete all Data in its possession or control.  This requirement will not apply to the extent that Vendor is required by applicable law or contract with its financial service partners to retain some or all of the Data, or to Data it has archived on back-up systems, which Data Vendor will securely isolate and protect from any further processing except to the extent required by such law.

11.

Audit:  Natera acknowledges that Vendor is regularly audited against SSAE-16 SOC 1 by independent third party auditors.  Upon request, Vendor will supply a summary copy of its applicable certifications to Natera which reports will be subject to the confidentiality provisions of the Agreement. Vendor will also respond to a written security questionnaire submitted to it by Natera provided that Natera will not exercise this right more than once per year.