Serious criteria, definitions, and guidance for reporting follow. CONFIDENTIAL Page 43 of 102 Protocol: HERCEPTIN® + E75/GM-CSF Version 3.1 ML25749 05 March 2017 An adverse event (AE) is any untoward medical occurrence in a subject participating in an investigational study or protocol regardless of causality assessment. An adverse event can be an unfavorable and unintended sign (including an abnormal laboratory finding), symptom, syndrome or disease associated with or occurring during the use of an investigational product whether or not considered related to the investigational product. Serious adverse events (SAE) are adverse events occurring at any dose which meet one or more of the following serious criteria: Results in death (i.e., the AE caused or led to death) Is life-threatening (i.e., the AE placed the subject at immediate risk of death; it does not apply to an AE which hypothetically might have caused the death if it were more severe) Requires or prolongs inpatient hospitalization (i.e., the AE required at least a 24-hour inpatient hospitalization or prolonged a hospitalization beyond the expected length of stay; hospitalizations for elective medical/surgical procedures, scheduled treatments, or routine check-ups are not SAEs by this criterion) Is disabling (i.e., the AE resulted in a substantial disruption of the subject’s ability to carry out normal life functions) Is a congenital anomaly/birth defect (i.e., an adverse outcome in a child or fetus of a subject exposed to the study drug prior to conception or during pregnancy) Does not meet any of the above serious criteria but may jeopardize the subject and may require medical or surgical intervention to prevent one of the outcomes listed above. Expected adverse events are those adverse events that are listed or characterized in the Package Insert or current Investigator Brochure. Unexpected adverse events are those not listed in the Package Insert or current IB. This includes adverse events for which the specificity or severity is not consistent with the description in the Package Insert or IB. For example, under this definition, hepatic necrosis would be unexpected if the Package Insert or Investigator Brochure only referred to elevated hepatic enzymes or hepatitis. 5.2 REPORTING OF SERIOUS ADVERSE EVENTS ASSOCIATED WITH THIS STUDY Each site PI will within 24 hours of notification of the event report any serious adverse event, whether expected or unexpected, and which is assessed by the investigator to be reasonably or possibly related to or caused by Herceptin or the vaccine components, occurring in patients enrolled at their respective study site to the Internal Review Board (IRB) of their site (see Adverse Event Reporting Algorithm, Appendix L). This will be accomplished by submitting an adverse event report memorandum to the IRB per the IRB’s site-specific standard operating procedures. The site PI will also, within 24 hours of notification of the event, forward CONFIDENTIAL Page 44 of 102 Protocol: HERCEPTIN® + E75/GM-CSF Version 3.1 ML25749 05 March 2017 a copy of the serious adverse event report (CRF Form 3.1(g)) to the CRO Quality Assurance (QA) Officer or her designee, and to the CRO Regulatory Affairs Officer. In addition, the site PI will also follow the same reporting for all hypersensitivity events of grade 2 or greater in the primary series. The QA Officer or her designee will then forward the report to the Sponsor/Investigator. The Sponsor/Investigator or sponsor’s representative will review the serious adverse event to determine the need for expedited reporting to the FDA. If expedited reporting is required, the site nurse coordinator will be notified by the QA Officer or her designee to complete an FDA Form 3500 (MedWatch) (Appendix L). The Regulatory Affairs Officer will then submit the final report to the Sponsor/Investigator or Sponsor/Investigator’s representative who will report them to the FDA. 5.2.1 FDA Form 3500A (MedWatch) Reporting Guidelines In addition to completing appropriate patient demographic and suspect medication information, the report should include the following information within the Event Description (Section 5) of the MedWatch 3500A form: • Protocol description (and number, if assigned) • Description of event, severity, treatment, and outcome if known • Supportive laboratory results and diagnostics • Investigator’s assessment of the relationship of the adverse event to each investigational product and suspect medication Follow-up information: Additional information may be added to a previously submitted report by any of the following methods: • Adding to the original FDA Form 3500A (MedWatch) report and submitting as follow-up • Adding supplemental summary information and submitting it as follow-up with the original FDA form 3500A (MedWatch) • Summarizing new information and faxing it with a cover letter including subject identifiers (i.e., D.O.B. initial, subject number), protocol description and number, if assigned, brief adverse event description, and notation that additional or follow-up information is being submitted. (The patient identifiers are important so that the new information is added to the correct initial report.) The CRO, Genentech, or Galena Biopharma may contact the reporter for additional information, clarification, or current status of the subject for whom and adverse event was reported. For questions regarding SAE reporting, you may contact the Quality Assurance (QA) Officer or her designee. CONFIDENTIAL Page 45 of 102 Protocol: HERCEPTIN® + E75/GM-CSF Version 3.1 ML25749 05 March 2017 Study Drug Relationship: The Investigator will determine which events are associated with the use of study drug. For reporting purposes, an AE should be regarded as possibly related to the use of Herceptin® or vaccine components if the Investigator believes: • There is a clinically plausible time sequence between onset of the AE and Herceptin and/or vaccine components administration; and/or • There is a biologically plausible mechanism for Herceptin and/or vaccine components to cause or contribute to the AE; and • The AE cannot be attributed solely to concurrent/underlying illness, other drugs, or procedures. 5.3 REPORTING REQUIREMENTS FOR IND HOLDERS Expedited IND Safety Reports: For Sponsored IND Studies, there are some additional reporting requirements for the FDA in accordance with the guidance set forth in 21 CFR § 600.80. Events meeting the following criteria need to be submitted to the FDA as expedited IND Safety Reports according to the following guidance and timelines: 7 Calendar-Day Telephone or Fax Report: The Sponsor is required to notify the FDA of any fatal or life-threatening adverse event that is unexpected and assessed by the investigator to be possibly related to the use of the investigational product. An unexpected adverse event is one that is not already described in the Package Insert or Investigator Brochure for Herceptin and Investigator Brochure for vaccine. Such events are to be reported by the sponsor to the FDA and Genentech within 7 calendar days of first learning of the event. 15 Calendar-Day Written Report: The Sponsor is also required to notify the FDA and all participating investigators, in a written IND Safety Report, of any serious, unexpected AE that is considered reasonably or possibly related to the use of the study agents. An unexpected adverse event is one that is not already described in the Package Insert or Investigator Brochure for Herceptin and/or Investigator Brochure for vaccine. • Written IND Safety Reports should include an Analysis of Similar Events in accordance with regulation 21 CFR § 312.32. All safety reports previously filed with the IND concerning similar events should be analyzed and the significance of the new report in light of the previous, similar reports commented on. • Written IND safety reports with Analysis of Similar Events are to be submitted to the FDA, Genentech Drug Safety, and all participating investigators within 15 calendar days of first learning of the event. The FDA prefers these reports on a MedWatch 3500A Form but alternative formats are acceptable (e.g., summary letter). CONFIDENTIAL Page 46 of 102 Protocol: HERCEPTIN® + E75/GM-CSF Version 3.1 ML25749 05 March 2017 6. INVESTIGATOR REQUIREMENTS 6.1 STUDY INITIATION Before the start of this study, the following documents must be on file with the IND sponsor, or sponsor representative, Galena Biopharma, and Genentech or a Genentech representative: • Original U.S. FDA Form 1572 for each site (for all studies conducted under U.S. Investigational New Drug [IND] regulations), signed by the Principal Investigator The names of any sub-investigators must appear on this form. Investigators must also complete all regulatory documentation as required by local and national regulations. • Current curriculum vitae of the Principal Investigator • Written documentation of IRB approval of protocol and informed consent document • A copy of the IRB approved informed consent document • A signed Clinical Research Agreement 6.2 STUDY COMPLETION The following materials are requested by Galena Biopharma and Genentech when a study is considered complete or terminated: • A summary, prepared by the Principal Investigator, of the study, and/or a study manuscript, and/or a study abstract submitted to scientific conferences. 6.3 INFORMED CONSENT An informed consent template will be provided, and the final IRB approved document must be provided to the sponsor for regulatory purposes. The informed consent document must be signed by the subject or the subject’s legally authorized representative before his or her participation in the study. The case history for each subject shall document that informed consent was obtained prior to participation in the study. A copy of the informed consent document must be provided to the subject or the subject's legally authorized representative. If applicable, it will be provided in a certified translation of the local language. Signed consent forms must remain in each subject’s study file and must be available for verification by study monitors at any time. 6.4 INSTITUTIONAL REVIEW BOARD OR ETHICS COMMITTEE APPROVAL This protocol, the informed consent document, and relevant supporting information must be submitted to the IRB for review and must be approved before the study is initiated. The CONFIDENTIAL Page 47 of 102 Protocol: HERCEPTIN® + E75/GM-CSF Version 3.1 ML25749 05 March 2017 study will be conducted in accordance with U.S. FDA, applicable national and local health authorities, and IRB requirements.