1. Background

These terms and conditions (”Agreement”) apply to laboratory services performed by iCellate and provided via the websites genemate.icellate.se and lams.icellate.se (“Portal”). iCellate Medical AB, org.nr. 556860-8284 (“Company”) provides and assumes responsibility for laboratory services (“Services”). By accepting these terms and conditions, the user of the Services (“Customer”) understands what the Services consist of.

The Company may update the terms and conditions during the duration of the Agreement, in which case the Customer shall be notified upon logging in to the Portal or via email.

2. Definitions

In order to avoid confusion and unnecessary repititions we have compiled definitions of terms central to the terms and conditions. The same definitions apply to the application, the website, and in this document.

”Account” refers to the account that the Customer creates in the Portal through completing the information asked for by the Company and thereafter accepting the terms and conditions.

”Party” refers either to the Customer or the Company.

”Parties” refers to both the Customer and the Company.

”Patient Information” refers to all personal data and other information that directly or indirectly relates to the patient.

”Personal Data” refers to all information that directly or indirectly can be related back to an individual.

”Personal Data Controller” refers to the person who solely or together with others decides how and why personal data is processed.

”Personal Data Assisstant” refers to the person who processes Personal Data on behalf of the Personal Data Controller.

”Data Protection Officer” refers to the person at the Company who ensures compliance with applicable legislation regarding Personal Data.

3. Services

The Company provides cancer diagnositc Services via blood, saliva, or tissue sample.

The Company offers the following Services:

1. CellMate® – analysis of circulating tumor cells (CTCs) and DNA sequencing of identified CTCs.
2. OncoMate® – analysis and sequencing of circulating tumor DNA (ctDNA).
3. GeneMate® – sequencing av genomic DNA (gDNA).

iCellate performs sequencing in its laboratory on an Illumina Nextseq 550 Dx. The choice of panel is made by the Customer at the time of ordering.

Services include clinical interpretation of sequencing data. The Company does not provide, however, clinical recommendations.

The Company communicates with the Customer exclusively via the Portal for test orders and delivery of results. The Company consults on questions regarding the test result upon request by the Customer.

The content of the Services and updates thereto are available in the Portal and are also specified on the Company’s website, www.icellate.se.

In order for the Company to provide Services, the Customer must provide the Company with Personal Data and Patient Information relating to the individual whose sample is sent to the Company. Personal Data and Patient Information will be processed in accordance with applicable legislation, at any given time, to the processing.

More information about data processing is discussed in section 7.

4. Company responsibility

The Company shall deliver Services according to the Agreement with the limitations set forth herein.

The Company is responsible for delivery of the Portal and the Services in accordance with current legislation. The Company is not responsible for any unforeseen loss of data.

In the case of a Service error for which the Company is responsible, the Company has the right to correct the error at its own expense, provided that it can be done within a reasonable timeframe and without significant inconvenience to the Customer.

If it is not possible to correct the error, or if the error cannot be remedied within a reasonable time and at a reasonable cost or inconvenience to the Company, the Customer is entitled to a reasonable price reduction.

5. Customer responsibility

The customer is responsible for providing the Company with access to correct and complete patient and contact information.

6. Subcontractors

Both Parties commit to ensure that only authorized persons have access to and use the material and/or Personal Data and Patient Information within the framework of this Agreement.

The Company commits to ensure that only authorized laboratory personnel perform analyses of the material.

7. Handling of Personal Data and Patient Information

1) In the case that the Customer is a healthcare provider, the Customer is the Personal Data Controller, and the Company is the Personal Data Assistant.

2) In the case that the Customer is a private individual, the Company is the Personal Data Controller.

The Company is the Personal Data Controller for Personal Data that arises as a result of the Company’s analyses, storage of patient blood or tissue, and related sequencing.

The Company is responsible for processing the Personal Data of the persons concerned in accordance with applicable law and the Customer's instructions.

The Company may only process and store Personal Data and Patient Information regarding the individual on behalf of the Customer and perform the Service and in accordance with the Customer's written instructions and the terms set out in the Agreement. The Company shall immediately inform the Customer if the Company considers that an instruction is contrary to applicable laws and regulations.

The Company shall take the technical and organizational measures required by the applicable data protection regulations and thereby take all measures regarding security in connection with the processing in accordance with Article 32 of the GDPR. The Company shall further:

1. assist the Customer in ensuring that the Customer's obligations under Articles 32-36 of the GDPR are fulfilled, taking into account the type of processing and the information the Company has available and
2. in consideration of the nature of the processing, assist the Customer through technical and organizational measures, to the extent possible, so that the Customer can fulfill their obligation to respond to the request for the exercise of the data subject's rights in accordance with Chapter III of the GDPR.

The Company shall provide the Customer with access to all information required to demonstrate that the Company's obligations set forth in Article 28 of the GDPR have been fulfilled and to enable and contribute to audits, including inspections, conducted by the Customer or by an auditor authorized by the Customer. The Company shall ensure that the Customer can fulfill any obligation to enable data portability regarding Personal Data and Patient Information that the Company processes on behalf of the Customer.

The Customer understands that the Company conducts activities that are covered by secrecy according to law (so-called healthcare confidentiality) and will handle Personal Data and Patient Information in accordance with this. The Company shall take the necessary measures to prevent Personal Data and Patient Information from being disclosed to unauthorized persons, for example by employees or others whom the Company may supervise in this regard. This obligation applies even after the Agreement has ceased to apply.

The Company may engage other Personal Data Assistants ("Sub-Assistants") in order to be able to provide Services to the Customer in an efficient manner. The Customer hereby agrees that the Company hire these Sub-Assistants in EU-member countries or in countries outside the EU area. Such transfers do not affect the requirements for the Company's data security or confidentiality, rather these remain unchanged.

The Customer hereby agrees that the Company and any other contracted partners process Personal Data, including sensitive Personal Data, for the purpose of delivering the Services to the Customer. Such sensitive Personal Data may, for example, include medical records such as patient history, prescribed medicines and test results.

In the event that the Company engages a Sub-Assistant, the Sub-Assistant shall by a written agreement be bound by the same data protection obligations as the Company towards the Customer and in particular provide sufficient guarantees to implement appropriate technical and organizational measures so that the processing of Personal Data and Patient Information meets applicable data protection regulations. If the hired Sub-Assistant does not fulfill their obligations in terms of data protection, the Company shall be fully responsible for the performance of the Sub-Assistant's obligations.

The Company does not disclose or sell Personal Data on to third parties, except in the case that the Company hires a third party to perform services for the Company, such as a sequencing subcontractor. However, these partners are bound by the same obligation and may never disclose or disseminate the information to another party.

The Company has the right to disclose Patient Information and Personal Data if requested by a government agency with the support of law or authority decisions.

Personal Data is stored in accordance with the consent given (see point 7 below). The consent is valid until the Customer withdraws the consent.

Within three months of the termination of the Agreement, the Company shall – unless otherwise agreed or prescribed by other legislation – immediately and securely delete all Personal Data that the Customer requests or that the Company has an obligation to delete in accordance with applicable law and thereafter ensure that no Personal Data remains with any subcontractors.

Anyone who has registered an Account has the right to request information once a year about which Personal Data the Company processes. Further information can be obtained by contacting the Company's Data Protection Officer by mail at the address provided on icellate.se.

8. Patient consent

The Customer hereby understands that the test that relates to inherited cancer risk (GeneMate®) can lead to the detection of an increased risk of cancer and that the test may lead to the revelation previously unknown family ties.

Furthermore, the Customer understands that the samples sent to the Company will be stored in the Company's biobank at Industrivägen 1 in Solna. Analysis results will be retained until further notice. The company shall take the technical and organizational measures required in accordance with the applicable Data Protection Regulations and thereby take all measures regarding security in connection with this type of processing. The Customer has the right to withdraw consent at any time for sample storage in said biobank. In that case, the Customer's samples and analytical results will be destroyed or deidentified, and the Customer will be notified. If the Customer wishes to withdraw consent, the Customer must contact the person responsible for Personal Data via info@icellate.se.

9. Termination

The Parties enter into Agreement when the Customer has accepts this Agreement via the Portal. The Agreement is valid until further notice.

The Customer has the right to terminate the Agreement with immediate effect at any time and without stating reasons.

The Company has the right to terminate the Agreement at any time if the Customer acts in violation of any of the terms of this Agreement.

Termination by any of the Parties or any other notice shall be expressed by letter or e-mail.

The Company has the right to terminate the Agreement with immediate effect if the Customer commits a breach of contract and does not within thirty (30) days from written notice cease or correct wrongdoing.

10. Force Majeure

A Party is free from liability to perform its obligations under the Agreement, if performance is hindered by a labor dispute or becomes impossible due to a relationship beyond the Party's control such as government decisions, war, or other unforeseen circumstances, internal unrest, sabotage, natural events, fire, restrictions on energy supply, non-delivery from subcontractors or other similar circumstances.

11. Changes

The Company has the right to change the range of services. The Customer will be notified of such changes via the Portal and/or email.

The Company has the right to implement amendments and additions to the Agreement. Such changes and additions are published in and communicated via the Portal. Customers who do not accept the new terms have the right to immediately terminate the Agreement prematurely within ten (10) days in accordance with clause 7 above. If the Customer has not terminated the Agreement within this time, the Customer is deemed to have accepted the new terms.

12. Governing law and dispute

The Agreement is governed by Swedish law and any disputes that arise due to or in connection with the agreement shall primarily be resolved through negotiation between the parties or mediation in accordance with the rules of the Stockholm Chamber of Commerce Arbitration Institute ("SCC").

If the dispute cannot be resolved through mediation, it shall be settled through arbitration through the Stockholm Chamber of Commerce's Arbitration Institute ("SCC").

13. Effective version

These terms of use for the Company's laboratory services are effective from June 1, 2020 and replace all previously applicable general terms and conditions.