Master Services Subcontract Agreement, by and between Illumina, Inc. and the Registrant, dated November 1, 2017

Page 1

Exhibit 10.13

[***] = Certain confidential information contained in this document, marked by brackets, is filed with the Securities and Exchange Commission pursuant to Rule 406 of the Securities Act of 1933, as amended.

MASTER SERVICES SUBCONTRACT AGREEMENT

THIS AGREEMENT, made effective as of the 1st day of November 2017 (“Effective Date”) entered into by and between Personalis, Inc. a corporation organized and existing under the laws of the State of California with offices at 1330 O’Brien Drive, Menlo Park, CA 94025 (hereinafter referred to as the “Company” or “Personalis”), and Illumina, Inc. a corporation organized and existing under the laws of the State of Delaware with offices at 5200 Illumina Way, San Diego, CA 92122 (hereinafter referred to as the “Subcontractor”).

WITNESS THAT

WHEREAS, Company has entered into Contract Number [***] (“Client Contract”) with the US Department of Veterans Affairs (“Client”) and,

WHEREAS, the Subcontractor is willing to undertake the performance of the sequencing activities as subcontractor for Company under the Client Contract as set forth in the applicable Appendices, and

NOW THEREFORE the parties hereby agree as follows:

ARTICLE 1 - THE WORK (SERVICES)

Page 2

ARTICLE 2 - SUBCONTRACT DOCUMENTS

ARTICLE 3 - SUBCONTRACT TERM

Page 3

ARTICLE 4 - SUBCONTRACT PRICE

ARTICLE 5 - PAYMENT PROVISIONS

ARTICLE 6 - COMMUNICATIONS

Page 4

ARTICLE 7– SAMPLES/RESULTS/RESEARCH USE ONLY

Page 5

ARTICLE 8 - INSURANCE AND RISK ALLOCATION

Page 6

insurance acquired or maintained by them. Client and Company’s insurance shall be excess and non-contributory. Subcontractor and insurers agree to waive any and all rights of subrogation against the Client and Company.

Page 7

party’s prior written consent, and (v) providing all reasonable assistance to the indemnifying party (provided that the indemnifying party reimburses the indemnified party for its reasonable out-of-pocket expenses incurred in providing such assistance).

EXCEPT FOR A BREACH OF THE CONFIDENTIALITY OR INFRINGEMENT INDEMNITY PROVISION OF THIS AGREEMENT NEITHER PARTY’S TOTAL AND CUMULATIVE LIABILITY TO THE OTHER PARTY OR ANY THIRD PARTY ARISING UNDER OR IN CONNECTION WITH THIS AGREEMENT, WHETHER IN CONTRACT, TORT (INCLUDING NEGLIGENCE), STRICT LIABILITY OR OTHERWISE, SHALL IN NO EVENT EXCEED [***]. THE LIMITATIONS SET FORTH IN THIS SECTION SHALL APPLY EVEN IF A PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES, AND NOTWITHSTANDING ANY FAILURE OF ESSENTIAL PURPOSE OF ANY LIMITED REMEDY.

ARTICLE 9 - SUBCONTRACTOR’S RESPONSIBILITIES

9.3.1    The Stated Purpose of the Confidentiality Agreement shall be modified to include the exchange of INFORMATION (as defined in the Confidentiality Agreement) under this Agreement.

9.3.2    COMPANY INFORMATION under this Agreement, shall include confidential and proprietary technical, business, marketing, financial, intellectual property, now-how and other information of the Client.

9.3.3    The term of the Confidentiality Agreement, for purposes of this Agreement, is extended to terminate [***] after the effective date of expiration or termination of this Agreement or [***] after the expiration or termination date of any Purchase Order issued hereunder, whichever is later.

Page 8

9.3.4    The restricted use agreed to under the Confidentiality Agreement shall expire [***] after the expiration or termination of this Agreement.

9.3.5    The final sentence of Paragraph 10 of the Confidentiality Agreement shall not apply to any Client information that is required to be returned to the Client or is required by the Client to be destroyed.

9.3.6    Paragraphs 11 and 12 of the Confidentiality Agreement are not applicable to this Agreement.

9.3.7 Paragraph 16(b) of the Confidentiality Agreement is modified to say, “Except as expressly agreed to in the Master Services Subcontract Agreement, this Agreement contains the entire agreement between the parties regarding confidential treatment and restricted use of INFORMATION disclosed in connection with the Stated Purpose, and supersedes all other prior oral arguments and understandings with respect thereto.”

ARTICLE 10 - WORK BY OTHERS

[INTENTIONALLY OMITTED AND RESERVED.]

ARTICLE 11 - COMPANY RESPONSIBILITIES AND AUTHORITY

ARTICLE 12 - CHANGES AND CLAIMS

Page 9

ARTICLE 13 - WARRANTY AND GUARANTEE

ARTICLE 14 - SUSPENSION AND TERMINATION

Page 10

Page 11

For clarity, Company must choose the remedy available under paragraph (4) or paragraph (5), but not both paragraphs.

ARTICLE 15 - MISCELLANEOUS PROVISIONS

[INTENTIONALLY OMITTED AND RESERVED.]

Page 12

ARTICLE 16 - EXPORT COMPLIANCE

Company and Subcontractor confirm reading this document in full and confirm that they understand the terms of this Agreement. Company and Subcontractor freely enter into this Agreement. The Agreement becomes effective on the latest date of execution indicated below.

Page 1 of 14

APPENDIX A – CUSTOMER FLOWDOWN CLAUSES

All costs associated with the obligations set forth herein shall be the responsibility of the subcontractor unless expressly stated otherwise in an SOW.

SECTION I – CONTRACT SECURITY

This Section I (Contract Security) and its applicability shall be interpreted based upon the following:

The VA has clarified that: (i) a System of Records is not being designed, developed, or operated under the Contract, (ii) Subcontractor will not have logical (technical) or physical access to any VA Information System, (iii) Subcontractor is not designing, developing, or operating a VA Information System, and (iv) DNA samples proved by the VA under the Contract are not themselves considered by the VA to be VA Sensitive Information.

With respect to Section A.3(b) of this Section 1 (Contract Security), relating to co-mingling of data, (i) VA and Subcontractor are under the understanding that Subcontractor’s production and data management process does not represent co-mingling of data as defined by the section, and (ii) VA and Subcontractor have established that Subcontractor’s data segregation and separation practices are adequate since (a) the data for each DNA sample is located in a folder structure unique to that DNA sample, (b) no data from other DNA samples of other customers of Subcontractor reside in the same folder, and (c) the data for each DNA sample is 100% tracked by a dedicated database that associates each DNA sample with its project.

A. VA INFORMATION AND INFORMATION SYSTEM SECURITY/PRIVACY

1. GENERAL

Contractors, contractor personnel, subcontractors, and subcontractor personnel shall be subject to the same Federal laws, regulations, standards, and VA Directives and Handbooks as VA and VA personnel regarding information and information system security.

2. ACCESS TO VA INFORMATION AND VA INFORMATION SYSTEMS

a.    A contractor/subcontractor shall request logical (technical) or physical access to VA information and VA information systems for their employees, subcontractors, and affiliates only to the extent necessary to perform the services specified in the contract, agreement, or task order.

b.    All contractors, subcontractors, and third-party servicers and associates working with VA information are subject to the same investigative requirements as those of VA appointees or employees who have access to the same types of information. The level and process of background security investigations for contractors must be in accordance with VA Directive and Handbook 0710, Personnel Suitability and Security Program. The Office for Operations, Security, and Preparedness is responsible for these policies and procedures.

c.    Contract personnel who require access to national security programs must have a valid security clearance. National Industrial Security Program (NISP) was established by Executive Order 12829 to ensure that cleared U.S. defense industry contract personnel safeguard the classified information in their possession while performing work on contracts, programs, bids, or research and development efforts. The Department of Veterans Affairs does not have a Memorandum of Agreement with Defense Security Service (DSS). Verification of a Security Clearance must be processed through the Special Security Officer located in the Planning and National Security Service within the Office of Operations, Security, and Preparedness.

Page 2 of 14

d.    Custom software development and outsourced operations must be located in the U.S. to the maximum extent practical. If such services are proposed to be performed abroad and are not disallowed by other VA policy or mandates, the contractor/subcontractor must state where all non-U.S. services are provided and detail a security plan, deemed to be acceptable by VA, specifically to address mitigation of the resulting problems of communication, control, data protection, and so forth. Location within the U.S. may be an evaluation factor.

e.    The contractor or subcontractor must notify the Contracting Officer immediately when an employee working on a VA system or with access to VA information is reassigned or leaves the contractor or subcontractor’s employ. The Contracting Officer must also be notified immediately by the contractor or subcontractor prior to an unfriendly termination.

3. VA INFORMATION CUSTODIAL LANGUAGE

a.    Information made available to the contractor or subcontractor by VA for the performance or administration of this contract or information developed by the contractor/subcontractor in performance or administration of the contract shall be used only for those purposes and shall not be used in any other way without the prior written agreement of the VA. This clause expressly limits the contractor/subcontractor’s rights to use data as described in Rights in Data - General, FAR 52.227-14(d) (1).

b.    VA information should not be co-mingled, if possible, with any other data on the contractors/ subcontractor’s information systems or media storage systems in order to ensure VA requirements related to data protection and media sanitization can be met. If co-mingling must be allowed to meet the requirements of the business need, the contractor must ensure that VA’s information is returned to the VA or destroyed in accordance with VA’s sanitization requirements. VA reserves the right to conduct on site inspections of contractor and subcontractor IT resources to ensure data security controls, separation of data and job duties, and destruction/media sanitization procedures are in compliance with VA directive requirements.

c.    Prior to termination or completion of this contract, contractor/subcontractor must not destroy information received from VA, or gathered/created by the contractor in the course of performing this contract without prior written approval by the VA. Any data destruction done on behalf of VA by a contractor/ subcontractor must be done in accordance with National Archives and Records Administration (NARA) requirements as outlined in VA Directive 6300, Records and Information Management and its Handbook 6300.1 Records Management Procedures, applicable VA Records Control Schedules, and VA Handbook 6500.1, Electronic Media Sanitization. Self-certification by the subcontractor that the data destruction requirements above have been met must be sent to the VA Contracting Officer within 30 days of termination of the contract.

d.    The contractor/subcontractor must receive, gather, store, back up, maintain, use, disclose and dispose of VA information only in compliance with the terms of the contract and applicable Federal and VA information confidentiality and security laws, regulations and policies. If Federal or VA information confidentiality and security laws, regulations and policies become applicable to the VA information or information systems after execution of the contract, or if NIST issues or updates applicable FIPS or Special Publications (SP) after execution of this contract, the parties agree to negotiate in good faith to implement the information confidentiality and security laws, regulations and policies in this contract.

e.    The contractor/subcontractor shall not make copies of VA information except as authorized and necessary to perform the terms of the agreement or to preserve electronic information stored on contractor/subcontractor electronic storage media for restoration in case any electronic equipment or data used by the contractor/subcontractor needs to be restored to an operating state. If copies are made for restoration purposes, after the restoration is complete, the copies must be appropriately destroyed.

f.    If VA determines that the contractor has violated any of the information confidentiality, privacy, and security provisions of the contract, it shall be sufficient grounds for VA to withhold payment to the contractor or third party or terminate the contract for default or terminate for cause under Federal Acquisition Regulation (FAR) part 12.

Page 3 of 14

g.    If a VHA contract is terminated for cause, the associated BAA must also be terminated and appropriate actions taken in accordance with VHA Handbook 1600.01, Business Associate Agreements. Absent an agreement to use or disclose protected health information, there is no business associate relationship.

h.    The contractor/subcontractor must store, transport, or transmit VA sensitive information in an encrypted form, using VA-approved encryption tools that are, at a minimum, FIPS 140-2 validated.

i.    The contractor/subcontractor’s firewall and Web services security controls, if applicable, shall meet or exceed VA’s minimum requirements. VA Configuration Guidelines are available upon request.

j.    Except for uses and disclosures of VA information authorized by this contract for performance of the contract, the contractor/subcontractor may use and disclose VA information only in two other situations: (i) in response to a qualifying order of a court of competent jurisdiction, or (ii) with VA’s prior written approval. The contractor/subcontractor must refer all requests for, demands for production of, or inquiries about, VA information and information systems to the VA contracting officer for response.

k.    Notwithstanding the provision above, the contractor/subcontractor shall not release VA records protected by Title 38 U.S.C. 5705, confidentiality of medical quality assurance records and/or Title 38 U.S.C. 7332, confidentiality of certain health records pertaining to drug addiction, sickle cell anemia, alcoholism or alcohol abuse, or infection with human immunodeficiency virus. If the contractor/subcontractor is in receipt of a court order or other requests for the above mentioned information, that contractor/subcontractor shall immediately refer such court orders or other requests to the VA contracting officer for response.

I.    For service that involves the storage, generating, transmitting, or exchanging of VA sensitive information but does not require C&A or an MOU-ISA for system interconnection, the contractor/subcontractor must complete a Contractor Security Control Assessment (CSCA) on a yearly basis and provide it to the COR.

4. INFORMATION SYSTEM DESIGN AND DEVELOPMENT

SECTION 4 REMOVED

5. INFORMATION SYSTEM HOSTING, OPERATION, MAINTENANCE, OR USE

SECTION 5 REMOVED

6. SECURITY INCIDENT INVESTIGATION

a.    The term “security incident” means an event that has, or could have, resulted in unauthorized access to, loss or damage to VA assets, or sensitive information, or an action that breaches VA security procedures. The contractor/subcontractor shall immediately notify the COR and simultaneously, the designated ISO and Privacy Officer for the contract of any known or suspected security/privacy incidents, or any unauthorized disclosure of sensitive information, including that contained in system(s) to which the contractor/subcontractor has access.

b.    To the extent known by the contractor/subcontractor, the contractor/subcontractor’s notice to VA shall identify the information involved, the circumstances surrounding the incident (including to whom, how, when, and where the VA information or assets were placed at risk or compromised), and any other information that the contractor/subcontractor considers relevant.

c.    With respect to unsecured protected health information, the business associate is deemed to have discovered a data breach when the business associate knew or should have known of a breach of such information. Upon discovery, the business associate must notify the covered entity of the breach. Notifications need to be made in accordance with the executed business associate agreement.

Page 4 of 14

d.    In instances of theft or break-in or other criminal activity, the contractor/subcontractor must concurrently report the incident to the appropriate law enforcement entity (or entities) of jurisdiction, including the VA OIG and Security and Law Enforcement. The contractor, its employees, and its subcontractors and their employees shall cooperate with VA and any law enforcement authority responsible for the investigation and prosecution of any possible criminal law violation(s) associated with any incident. The contractor/subcontractor shall cooperate with VA in any civil litigation to recover VA information, obtain monetary or other compensation from a third party for damages arising from any incident, or obtain injunctive relief against any third party arising from, or related to, the incident.

7. LIQUIDATED DAMAGES FOR DATA BREACH

a.    Consistent with the requirements of 38 U.S.C. §5725, a contract may require access to sensitive personal information. If so, the contractor is liable to VA for liquidated damages in the event of a data breach or privacy incident involving any SP1the contractor/subcontractor processes or maintains under this contract.

b. The contractor/subcontractor shall provide notice to VA of a “security incident” as set forth in the Security Incident Investigation section above. Upon such notification, VA must secure from a non-Department entity or the VA Office of Inspector General an independent risk analysis of the data breach to determine the level of risk associated with the data breach for the potential misuse of any sensitive personal information involved in the data breach. The term ‘data breach’ means the loss, theft, or other unauthorized access, or any access other than that incidental to the scope of employment, to data containing sensitive personal information, in electronic or printed form, that results in the potential compromise of the confidentiality or integrity of the data. Contractor shall fully cooperate with the entity performing the risk analysis. Failure to cooperate may be deemed a material breach and grounds for contract termination.

c.    Each risk analysis shall address all relevant information concerning the data breach, including the following:

(1)    Nature of the event (loss, theft, unauthorized access);

(2)    Description of the event, including:

(a)    date of occurrence;

(b)    data elements involved, including any PII, such as full name, social security number, date of birth, home address, account number, disability code;

(3)    Number of individuals affected or potentially affected;

(4)    Names of individuals or groups affected or potentially affected;

(5)    Ease of logical data access to the lost, stolen or improperly accessed data in light of the degree of protection for the data, e.g., unencrypted, plain text;

(6)    Amount of time the data has been out of VA control;

(7)    The likelihood that the sensitive personal information will or has been compromised (made accessible to and usable by unauthorized persons);

(8)    Known misuses of data containing sensitive personal information, if any;

Page 5 of 14

(9)    Assessment of the potential harm to the affected individuals;

(10)    Data breach analysis as outlined in 6500.2 Handbook, Management of Security and Privacy Incidents, as appropriate; and

(11)    Whether credit protection services may assist record subjects in avoiding or mitigating the results of identity theft based on the sensitive personal information that may have been compromised.

d.    Based on the determinations of the independent risk analysis, the contractor shall be responsible for paying to the VA liquidated damages in the amount of $37.50 per affected individual to cover the cost of providing credit protection services to affected individuals consisting of the following:

(1)    Notification;

(2)    One year of credit monitoring services consisting of automatic daily monitoring of at least 3 relevant credit bureau reports;

(3)    Data breach analysis;

(4)    Fraud resolution services, including writing dispute letters, initiating fraud alerts and credit freezes, to assist affected individuals to bring matters to resolution;

(5)    One year of identity theft insurance with $20,000.00 coverage at $0 deductible; and

(6)    Necessary legal expenses the subjects may incur to repair falsified or damaged credit records, histories, or financial affairs.

8. SECURITY CONTROLS COMPLIANCE TESTING

On a periodic basis, VA, including the Office of Inspector General, reserves the right to evaluate any or all of the security controls and privacy practices implemented by the contractor under the clauses contained within the contract. With 10 working-days’ notice, at the request of the government, the contractor must fully cooperate and assist in a government-sponsored security controls assessment at each location wherein VA information is processed or stored, or information systems are developed, operated, maintained, or used on behalf of VA, including those initiated by the Office of Inspector General. The government may conduct a security control assessment on shorter notice (to include unannounced assessments) as determined by VA in the event of a security incident or at any other time.

9. TRAINING

a.    All contractor employees and subcontractor employees requiring access to VA information and VA information systems shall complete the following before being granted access to VA information and its systems:

(1)    Sign and acknowledge (either manually or electronically) understanding of and responsibilities for compliance with the Contractor Rules of Behavior, Appendix E relating to access to VA information and information systems;

(2)    Successfully complete the VA Cyber Security Awareness and Rules of Behavior training and annually complete required security training;

(3)    Successfully complete the appropriate VA privacy training and annually complete required privacy training; and

(4)    Successfully complete any additional cyber security or privacy training, as required for VA personnel with equivalent information system access [to be defined by the VA program official and provided to the contracting officer for inclusion in the solicitation document – e.g., any role-based information security training required in accordance with NIST Special Publication 800-16, Information Technology Security Training Requirements.]

Page 6 of 14

b.    The subcontractor shall provide to the contracting officer and/or the COR a copy of the training certificates and certification of signing the Contractor Rules of Behavior for each applicable employee within 1 week of the initiation of the contract and annually thereafter, as required.

c.    Failure to complete the mandatory annual training and sign the Rules of Behavior annually, within the timeframe required, is grounds for suspension or termination of all physical or electronic access privileges and removal from work on the contract until such time as the training and documents are complete.

CONTRACTOR RULES OF BEHAVIOR

This User Agreement contains rights and authorizations regarding my access to and use of any information assets or resources associated with my performance of services under the contract terms with the Department of Veterans Affairs (VA). This User Agreement covers my access to all VA data whether electronic or hard copy (“Data”), VA information systems and resources (“Systems”), and VA sites (“Sites”). This User Agreement incorporates Rules of Behavior for using VA, and other information systems and resources under the contract.

1.    GENERAL TERMS AND CONDITIONS FOR ALL ACTIONS AND ACTIVITIES UNDER THE CONTRACT:

a.    I understand and agree that I have no reasonable expectation of privacy in accessing or using any VA, or other Federal Government information systems.

b.    I consent to reviews and actions by the Office of Information & Technology (OI&T) staff designated and authorized by the VA Chief Information Officer (CIO) and to the VA OIG regarding my access to and use of any information assets or resources associated with my performance of services under the contract terms with the VA. These actions may include monitoring, recording, copying, inspecting, restricting access, blocking, tracking, and disclosing to all authorized Ol&T, VA, and law enforcement personnel as directed by the VA CIO without my prior consent or notification.

c.    I consent to reviews and actions by authorized VA systems administrators and Information Security Officers solely for protection of the VA infrastructure, including, but

not limited to monitoring, recording, auditing, inspecting, investigating, restricting access, blocking, tracking, disclosing to authorized personnel, or any other authorized actions by all authorized Ol&T, VA, and law enforcement personnel.

d.    I understand and accept that unauthorized attempts or acts to access, upload, change, or delete information on Federal Government systems; modify Federal government systems; deny access to Federal government systems; accrue resources for unauthorized use on Federal government systems; or otherwise misuse Federal government systems or resources are prohibited.

e.    I understand that such unauthorized attempts or acts are subject to action that may result in criminal, civil, or administrative penalties. This includes penalties for violations of Federal laws including, but not limited to, 18 U.S.C. §1030 (fraud and related activity in connection with computers) and 18 U.S.C. §2701 (unlawful access to stored communications).

f.    I agree that Ol&T staff, in the course of obtaining access to information or systems on my behalf for performance under the contract, may provide information about me including, but not limited to, appropriate unique personal identifiers such as date of birth and social security number to other system administrators, Information Security Officers (ISOs), or other authorized staff without further notifying me or obtaining additional written or verbal permission from me.

Page 7 of 14

g.    I understand I must comply with VA’s security and data privacy directives and handbooks. I understand that copies of those directives and handbooks can be obtained from the Contracting Officer’s Technical Representative (COR). If the contractor believes the policies and guidance provided by the COR is a material unilateral change to the contract, the contractor must elevate such concerns to the Contracting Officer for resolution.

h.    I will report suspected or identified information security/privacy incidents to the COR and to the local ISO or Privacy Officer as appropriate.

2.    GENERAL RULES OF BEHAVIOR

a.    Rules of Behavior are part of a comprehensive program to provide complete information security. These rules establish standards of behavior in recognition of the fact that knowledgeable users are the foundation of a successful security program. Users must understand that taking personal responsibility for the security of their computer and the information it contains is an essential part of their job.

b.    The following rules apply to all VA contractors. I agree to:

(1)    Follow established procedures for requesting, accessing, and closing user accounts and access. I will not request or obtain access beyond what is normally granted to users or by what is outlined in the contract.

(2)    Use only systems, software, databases, and data which I am authorized to use, including any copyright restrictions.

(3)    I will not use other equipment (OE) (non-contractor owned) for the storage, transfer, or processing of VA sensitive information without a VA CIO approved waiver, unless it has been reviewed and approved by local management and is included in the language of the contract. If authorized to use OE IT equipment, I must ensure that the system meets all applicable 6500 Handbook requirements for OE.

(4)    Not use my position of trust and access rights to exploit system controls or access information for any reason other than in the performance of the contract.

(5)    Not attempt to override or disable security, technical, or management controls unless expressly permitted to do so as an explicit requirement under the contract or at the direction of the COR or ISO. If I am allowed or required to have a local administrator account on a government-owned computer, that local administrative account does not confer me unrestricted access or use, nor the authority to bypass security or other controls except as expressly permitted by the VA CIO or CIO’s designee.

(6)    Contractors’ use of systems, information, or sites is strictly limited to fulfill the terms of the contract. I understand no personal use is authorized. I will only use other Federal government information systems as expressly authorized by the terms of those systems. I accept that the restrictions under ethics regulations and criminal law still apply.

(7)    Grant access to systems and information only to those who have an official need to know.

(8)    Protect passwords from access by other individuals.

(9)    Create and change passwords in accordance with VA Handbook 6500 on systems and any devices protecting VA information as well as the rules of behavior and security settings for the particular system in question.

(10)    Protect information and systems from unauthorized disclosure, use, modification, or destruction. I will only use encryption that is FIPS 140-2 validated to safeguard VA sensitive information, both safeguarding VA sensitive information in storage and in transit regarding my access to and use of any information assets or resources associated with my performance of services under the contract terms with the VA.

Page 8 of 14

(11)    Follow VA Handbook 6500.1, Electronic Media Sanitization to protect VA information. I will contact the COR for policies and guidance on complying with this requirement and will follow the COR’s orders.

(12)    Ensure that the COR has previously approved VA information for public dissemination, including e-mail communications outside of the VA as appropriate. I will not make any unauthorized disclosure of any VA sensitive information through the use of any means of communication including but not limited to e-mail, instant messaging, online chat, and web bulletin boards or logs.

(13)    Not host, set up, administer, or run an Internet server related to my access to and use of any information assets or resources associated with my performance of services under the contract terms with the VA unless explicitly authorized under the contract or in writing by the COR.

(14)    Protect government property from theft, destruction, or misuse. I will follow VA directives and handbooks on handling Federal government IT equipment, information, and systems. I will not take VA sensitive information from the workplace without authorization from the COR.

(15)    Only use anti-virus software, antispyware, and firewall/intrusion detection software authorized by VA. I will contact the COR for policies and guidance on complying with this requirement and will follow the COR’s orders regarding my access to and use of any information assets or resources associated with my performance of services under the contract terms with VA.

(16)    Not disable or degrade the standard anti-virus software, antispyware, and/or firewall/intrusion detection software on the computer I use to access and use information assets or resources associated with my performance of services under the contract terms

with VA. I will report anti-virus, antispyware, firewall or intrusion detection software errors, or significant alert messages to the COR.

(17)    Understand that restoration of service of any VA system is a concern of all users of the system.

(18)    Complete required information security and privacy training, and complete required training for the particular systems to which I require access.

3.    ADDITIONAL CONDITIONS FOR USE OF NON- VA INFORMATION TECHNOLOGY RESOURCES

a.    When required to complete work under the contract, I will directly connect to the VA network whenever possible. If a direct connection to the VA network is not possible, then I will use VA approved remote access software and services.

b.    Remote access to non-public VA information technology resources is prohibited from publicly-available IT computers, such as remotely connecting to the internal VA network from computers in a public library.

c.    I will not have both a VA network line and any kind of non-VA network line including a wireless network card, modem with phone line, or other network device physically connected to my computer at the same time, unless the dual connection is explicitly authorized by the COR.

d.    I understand that I may not obviate or evade my responsibility to adhere to VA security requirements by subcontracting any work under any given contract or agreement with VA, and that any subcontractor(s) I engage shall likewise be bound by the same security requirements and penalties for violating the same.

Page 9 of 14

4.    STATEMENT ON LITIGATION

This User Agreement does not and should not be relied upon to create any other right or benefit, substantive or procedural, enforceable by law, by a party to litigation with the United States Government.

5.    ACKNOWLEDGEMENT AND ACCEPTANCE

I acknowledge receipt of this User Agreement. I understand and accept all terms and conditions of this User Agreement, and I will comply with the terms and conditions of this agreement and any additional VA warning banners, directives, handbooks, notices, or directions regarding access to or use of information systems or information. The terms and conditions of this document do not supersede the terms and conditions of the signatory’s employer and VA.

Print or type your full name

Signature

Last 4 digits of SSN

Date

Office Phone

Position Title

Contractor’s Company Name

Please complete and return the original signed document to the COR within the timeframe stated in the terms of the contract.

CONTRACTOR AND SUBCONTRACTOR PERSONNEL SECURITY REQUIREMENTS:

As stated above, all costs associated with the obligations set forth herein shall be the responsibility of the subcontractor unless expressly stated otherwise in a task order. To the extent that contractor incurs expense on behalf of subcontractor under this section, contractor may retain the amounts for the expenses incurred from payments due to subcontractor or, at contractor’s option, may invoice subcontractor for these expenses.

SECTION II – CONFIDENTIALITY AND NON-DISCLOSURE

All samples and data provided by the Government and all data first produced or delivered during this contract is the sole property of the VA. The subcontractor recognizes that in the performance of this subcontract it may receive or have access to sensitive or confidential information, including personal information of VA employees and information proprietary in nature by system contractors, equipment manufacturers and other private or public entities. The subcontractor shall restrict access to sensitive or confidential information to the minimum number of employees necessary for subcontract performance.

The subcontractor shall indoctrinate its employees and all lower-tier subcontractor employees working on this subcontract on the laws, rules and regulations governing access to sensitive and/or confidential information. All persons concerned shall understand that unauthorized access to or use of sensitive or confidential information related to this subcontract shall result in immediate termination of the individual or individuals from the subcontract and be subject to legal prosecution to the fullest extent of the law.

Page 10 of 14

The contractor is required to conduct an appropriate background investigation on all of its employees and subcontractor employees working on this contract and who require access to government computer systems.

SECTION III – ADDITIONAL FLOWDOWN CLAUSES

The clauses from the prime contract have been modified by contractor to reflect the contractual relationship between the contractor and subcontractor and to reflect the applicable obligations.

52.204-10 REPORTING EXECUTIVE COMPENSATION AND FIRST-TIER SUBCONTRACT AWARDS (OCT 2016) Subcontractor shall provide the information required for contractor to submit the information required under (d)(2) of this clause and will provide information required under (d)(3) if the circumstances in (d)(3)(i) and (ii) are applicable.

52.203-99 PROHIBITION ON CONTRACTING WITH ENTITIES THAT REQUIRE CERTAIN INTERNAL CONFIDENTIALITY AGREEMENTS (DEVIATION) (FEB 2015)

(a)    The subcontractor shall not require employees or subcontractors seeking to report fraud, waste, or abuse to sign or comply with internal confidentiality agreements or statements prohibiting or otherwise restricting such employees or subcontractors from lawfully reporting such waste, fraud, or abuse to a designated investigative or law enforcement representative of a Federal department or agency authorized to receive such information.

(b)    The subcontractor shall notify employees that the prohibitions and restrictions of any internal confidentiality agreements covered by this clause are no longer in effect.

(c)    The prohibition in paragraph (a) of this clause does not contravene requirements applicable to Standard Form 312, Form 4414, or any other form issued by a Federal department or agency governing the nondisclosure of classified information.

(d)(1) In accordance with section 743 of Division E, Title VII, of the Consolidated and Further Continuing Resolution Appropriations Act, 2015 (Pub. L. 113-235), use of funds appropriated (or otherwise made available) under that or any other Act may be prohibited, if the Government determines that the Contractor is not in compliance with the provisions of this clause.

(2) The Government may seek any available remedies in the event the contractor fails to comply with the provisions of this clause.

(End of Clause)

52.216-19 ORDER LIMITATIONS (OCT 1995)

(a) Minimum order. When the contractor requires supplies or services covered by this contract in an amount of less than 1 each, the contractor is not obligated to purchase, nor is the subcontractor obligated to furnish, those supplies or services under the contract.

(b) Maximum order. The subcontractor is not obligated to honor—

(1) Any order for a single item in excess of 500 each per month;

(2) Any order for a combination of items in excess of 500 each per month; or

(3) A series of orders from the same ordering office within 30 days that together call for quantities exceeding the limitation in paragraph (b)(1) or (2) of this section.

Page 11 of 14

(c) RESERVED

(d) Notwithstanding paragraphs (b) and (c) of this section, the subcontractor shall honor any order exceeding the maximum order limitations in paragraph (b), unless that order (or orders) is returned to the contractor within 2 days after issuance, with written notice stating the subcontractor’s intent not to ship the item (or items) called for and the reasons. Upon receiving this notice, the contractor or the Government may acquire the supplies or services from another source.

(End of Clause)

52.217-9 OPTION TO EXTEND THE TERM OF THE CONTRACT (MAR 2000)

(a) The contractor may extend the term of this subcontract by written notice to the subcontractor within 45 days, which must be mutually approved by both parties.

(b) If the contractor exercises this option, the extended subcontract shall be considered to include this option clause.

(c) The total duration of this subcontract, including the exercise of any options under this clause, shall not exceed five (5) years.

(End of Clause)

VAAR 852.203-70 COMMERCIAL ADVERTISING (JAN 2008)

The subcontractor agrees that it will not advertise the award of the subcontract in his/her commercial advertising in such a manner as to state or imply that Personalis or the Department of Veterans Affairs endorses a product, project or commercial line of endeavor.

52.252-2 CLAUSES INCORPORATED BY REFERENCE (FEB 1998)

This subcontract incorporates one or more clauses by reference, with the same force and effect as if they were given in full text. The full text of a clause may be accessed electronically at this/these address(es): http://www.acquisition.gov/far/index.html

http://www.va.gov/oal/librarv/vaar/

52.204-9    PERSONAL IDENTITY VERIFICATION OF CONTRACTOR PERSONNEL (JAN 2011) (required only if Subcontractor requires routine physical access to a Federally-controlled facility and/or routine access to a Federally-controlled information system)

52.203-17    CONTRACTOR EMPLOYEE WHISTLEBLOWER RIGHTS AND REQUIREMENT TO INFORM EMPLOYEES OF WHISTLEBLOWER RIGHTS (APR 2014)

52.227-14 RIGHTS IN DATA—GENERAL (MAY 2014)

(This clause is applicable to Subcontractor to the extent that it is applicable to Contractor. Subcontractor shall provide the data and rights therein necessary to fulfill Contractor’s prime contract obligations.)

52.227-16 ADDITIONAL DATA REQUIREMENTS (JUN 1987)

(This clause is applicable to Subcontractor to the extent that it is applicable to Contractor. Subcontractor shall provide the data and rights therein necessary to fulfill Contractor’s prime contract obligations.)

52.203-13 Contractor Code of Business Ethics and Conduct (OCT 2015) (Pub. L. 110-252, Title VI, Chapter 1 (41 U.S.C. 251 note))

Mandatory written disclosures required by FAR clause 52.203-13 to the Department of Veterans Affairs, Office of Inspector General (OIG) must be made electronically through the VA OIG Hotline at http://www.va.gov/oig/contacts/hotline.asp and clicking on “FAR clause 52.203-13 Reporting.” If you experience difficulty accessing the website, call the Hotline at ###-###-#### for further instructions.

Page 12 of 14

52.203-19, Prohibition on Requiring Certain Internal Confidentiality Agreements or Statements (JAN 2017) (section 743 of Division E, Title VII, of the Consolidated and Further Continuing Appropriations Act, 2015 (Pub. L. 113-235) and its successor provisions in subsequent appropriations acts (and as extended in continuing resolutions)).

52.219-8, Utilization of Small Business Concerns (NOV 2016) (15 U.S.C. 637(d)(2) and (3)), in all subcontracts that offer further subcontracting opportunities.

52.222-17, Nondisplacement of Qualified Workers (MAY 2014) (E.O. 13495). Flow down required in accordance with paragraph (1) of FAR clause 52.222-17.

52.222-21, Prohibition of Segregated Facilities (APR 2015).

52.222-26 Equal Opportunity (SEP 2016) (E.O. 11246)

52.222-35 Equal Opportunity for Veterans (OCT 2015) (38 U.S.C. 4212)

52.222-36 Affirmative Action for Workers with Disabilities (Oct 2010) (29 U.S.C. 793)

52.222-37, Employment Reports on Veterans (FEB 2016) (38 U.S.C. 4212).

52.222-40 Notification of Employee Rights Under the National Labor Relations Act (DEC 2010) (E.O. 13496). Flow down required in accordance with paragraph (1) of FAR clause 52.222-40.

52.222-41 Service Contract Labor Standards (MAY 2014) (41 U.S.C. chapter 67).

52.222-50 Combating Trafficking in Persons (MAR 2015) (22 U.S.C. chapter 78 and E.O. 13627), Alternate I (MAR 2015) of 52.222-50 (22 U.S.C. chapter 78 and E.O. 13627).

52.222-51, Exemption from Application of the Service Contract Labor Standards to Contracts for Maintenance, Calibration, or Repair of Certain Equipment—Requirements (MAY 2014) (41 U.S.C. chapter 67).

52.222-53, Exemption from Application of the Service Contract Labor Standards to Contracts for Certain Services—Requirements (MAY 2014) (41 U.S.C. chapter 67).

52.222-54 Employee Eligibility Verification (OCT 2015) (E. O. 12989).

52.222-55, Minimum Wages Under Executive Order 13658 (DEC 2015).

52.222-59, Compliance with Labor Laws (Executive Order 13673) (OCT 2016) (Applies at $50 million for solicitations and resultant contracts issued from October 25, 2016 through April 24, 2017; applies at $500,000 for solicitations and resultant contracts issued after April 24, 2017).

Note to paragraph (e)(1)(xvii): By a court order issued on October 24, 2016, 52.222-59 is enjoined indefinitely as of the date of the order. The enjoined paragraph will become effective immediately if the court terminates the injunction. At that time, DoD, GSA, and NASA will publish a document in the Federal Register advising the public of the termination of the injunction.

Page 13 of 14

52.222-60, Paycheck Transparency (Executive Order 13673) (OCT 2016)).

52.222-62 Paid Sick Leave Under Executive Order 13706 (JAN 2017) (E.O. 13706).

52.224-3, Privacy Training (JAN 2017) (5 U.S.C. 552a), Alternate I (JAN 2017) of 52.224-3.

52.226-6, Promoting Excess Food Donation to Nonprofit Organizations (MAY 2014) (42 U.S.C. 1792). Flow down required in accordance with paragraph (e) of FAR clause 52.226-6.

52.247-64 Preference for Privately Owned U.S.-Flag Commercial Vessels (Feb 2006) (46 U.S.C. Appx. 1241(b) and 10 U.S.C. 2631). Flow down required in accordance with paragraph (d) of FAR clause 52.247-64.

52.227-17 RIGHTS IN DATA - SPECIAL WORKS (DEC 2007)

(a) Definitions. As used in this clause—

“Data” means recorded information, regardless of form or the media on which it may be recorded. The term includes technical data and computer software. The term does not include information incidental to subcontract administration, such as financial, administrative, cost or pricing, or management information. “Unlimited rights” means the rights of the Government to use, disclose, reproduce, prepare derivative works, distribute copies to the public, and perform publicly and display publicly, in any manner and for any purpose, and to have or permit others to do so.

(b) Allocation of Rights.

(1) The Government and contractor shall have—

(i) Unlimited rights in all data delivered under this subcontract, and in all data first produced in the performance of this subcontract, except as provided in paragraph (c) of this clause.

(ii) The right to limit assertion of copyright in data first produced in the performance of this subcontract, and to obtain assignment of copyright in that data, in accordance with paragraph (c)(1) of this clause.

(iii) The right to limit the release and use of certain data in accordance with paragraph (d) of this clause.

(2) The subcontractor shall have, to the extent permission is granted in accordance with paragraph (c)(1) of this clause, the right to assert claim to copyright subsisting in data first produced in the performance of this contract.

(c) Copyright—

(1) Data first produced in the performance of this contract.

(i) The subcontractor shall not assert or authorize others to assert any claim to copyright subsisting in any data first produced in the performance of this subcontract without prior written permission of the Contracting Officer. When copyright is asserted, the subcontractor shall affix the appropriate copyright notice of 17 U.S.C. 401 or 402 and acknowledgment of Government sponsorship (including prime contract number) to the data when delivered to the contractor for delivery to the Government, as well as when the data are published or deposited for registration as a published work in the U.S. Copyright Office. The subcontractor grants to the Government, contractor and others acting on their behalf, a paid-up, nonexclusive, irrevocable, worldwide license for all delivered data to reproduce, prepare derivative works, distribute copies to the public, and perform publicly and display publicly, by or on behalf of the Government or contractor.

(ii) If the Government desires to obtain copyright in data first produced in the performance of this contract and permission has not been granted as set forth in paragraph (c)(1)(i) of this clause, the Contracting Officer (through the contractor) shall direct the subcontractor to assign (with or without registration), or obtain the assignment of, the copyright to the Government or its designated assignee.

Page 14 of 14

(2) Data not first produced in the performance of this contract. The subcontractor shall not, without prior written permission of the Subcontract Administrator, incorporate in data delivered under this contract any data not first produced in the performance of this contract and that contain the copyright notice of 17 U.S.C. 401 or 402, unless the subcontractor identifies such data and grants to the Government, or acquires on its behalf, a license of the same scope as set forth in paragraph (c)(1) of this clause.

(d) Release and use restrictions. Except as otherwise specifically provided for in this contract, the subcontractor shall not use, release, reproduce, distribute, or publish any data first produced in the performance of this contract, nor authorize others to do so, without written permission of the Contracting Officer or contractor.

(e) Indemnity. The Contractor shall indemnify the Government and contractor and their officers, agents, and employees acting for them against any liability, including costs and expenses, incurred as the result of the violation of trade secrets, copyrights, or right of privacy or publicity, arising out of the creation, delivery, publication, or use of any data furnished under this subcontract; or any libelous or other unlawful matter contained in such data. The provisions of this paragraph do not apply unless the Government or contractor provides notice to the subcontractor as soon as practicable of any claim or suit, affords the subcontractor an opportunity under applicable laws, rules, or regulations to participate in the defense of the claim or suit, and obtains the subcontractor’s consent to the settlement of any claim or suit other than as required by final decree of a court of competent jurisdiction; and these provisions do not apply to material furnished to the subcontractor by the Government and incorporated in data to which this clause applies.

Page 1 of 5

Appendix B

Subcontractor Pricing and Services Description

I. SUBCONTRACT PRODUCT& PRICING INFORMATION

All prices are inclusive of shipping and taxes; provided that, Company is responsible for the costs of shipping the Samples to Subcontractor.

The pricing stated above commencing on the Effective Date of the Agreement and valid through December 31, 2021 or later if the US Department of Veteran Affair Contract # VA240-17-D-0107 is extended.

Subcontractor Qualifications

The Subcontractor shall have the following qualification, capabilities, and be able to document the following:

FastTrack Genotyping Services Description and Specifications:

1.    Samples. Customer agrees to supply Illumina with a complete and accurate sample manifest in accordance with Section 5 of this Service Description.

If Illumina determines in its sole discretion that any of the Samples do not meet the criteria set forth in this Service Description, Illumina will so inform Customer. At such time, Customer will be provided the option to (a) replace such Samples, or (b) proceed with such Samples as-is. In both (a) and (b), Customer shall pay Illumina full price for the Services to be performed with respect to such Samples, even if no successful Results are obtained for those Samples.

Page 2 of 5

2.    Results. IIlumina shall deliver to Customer the Results as described below: SNP genotyping calls and scores for the assays performed on each Sample.

3.    Delivery Dates. The delivery date(s) for the Results will be established at the start of the project, based on the number of Samples and current laboratory queue.

3.1    Delivery Timeframes:

4.    SNP Selection Process. For any custom assays that are to be developed by Illumina for supply of genotyping data, Customer agrees that, within 14 days of receipt of the purchase order, it will identify for Illumina a set of SNP loci (“Loci”) in accordance with the SNP Selection guidelines set forth in Section 5 of in this Service Description. Illumina and Customer must mutually agree upon the final Loci. Illumina will attempt to develop a functional SNP assay for each SNP locus provided by the Customer and agreed upon by Illumina. Upon the delivery of Loci by the Customer to Illumina, the Customer shall identify any of such Loci which are not publicly available.

5.    Sample Requirements. Illumina’s experience shows that Samples conforming to the following requirements are likely to yield excellent genotyping data.

Manifest Columns:

Before shipping your Samples to Illumina, please forward a file containing the Sample Manifest to your Illumina contact for review.

Page 3 of 5

Queries for SNP selection can be submitted to obtain designability information. In addition, for human studies, data from the currently supported dbSNP version will be returned. The following input file types are supported:

can be used to query SNPs for human studies. As with the gene list, the distance upstream and downstream (in base pairs) can also be designated in the input format.

Page 4 of 5

In addition to data on designability and minor allele frequency provided through Illumina’s Assay Design Tool (ADT), Illumina’s Fast-Track Genotyping Services is able to provide the following additional support in SNP selection:

that give optimal spacing balanced with minor allele frequency (and, if desired, mandatory SNPs).

As part of the SNP selection process, SNP sequences are analyzed for assay fitness. Examples of some criteria considered for assay design ability include:

All SNP classes use the Infinium chemistry. The following SNPs require a minimum of one bead type: A/C, A/G, T/C, and T/G. SNPs requiring two bead types include A/T and C/G SNPs

After analysis Customer will receive a file of the markers and their design score for the Illumina assay along with minor allele frequency and any additional supported information requested (e.g., annotation or tag selection) when available. The Customer will be given the opportunity to review, approve and edit the selected SNPs.

After Customer approval of the SNPs, oligo manufacturing will begin. The number of SNPs present in the final data set will depend on the assay conversion rate. It is expected that some assays will fail, and therefore no data will be delivered for these SNPs.

For Custom Infinium projects, the minimum manufacturing locus conversion rate is 80%. The assay success rate depends on the markers that are selected during the design phase. If a majority of chosen markers have previously been validated on the Infinium platform (design score of 1.1) the final locus conversion rate may be very high. Selected markers with low design scores will however reduce the locus conversion rate.