Current Schedule of Assessments for each study are contained in the study protocol. Study Day and Visit Windows Patients’ time on study will be determined in Study Days. Study Day 1 will be defined as the first day of dosing. Positive study days will count forward from Study Day 1. Study Day -1 will be the day before Study Day 1, and all subsequent negative study days will be measured backward from Study Day -1. There will be no Study Day 0. A value obtained on Study Day 1 before administration of study treatment will be considered the baseline value. If a value is not available on Study Day 1, the last available value collected prior to the first dose of study drug will be used as the baseline value. The study date and corresponding study visit will be captured on each case report form (CRF) from which study day will be calculated. Study Day will be used in the analysis of safety data and efficacy analysis. The protocol allows a 3-day window between randomization and first dose. All efficacy analyses on time-to-event endpoints will consider the date of randomization as Day 1. 4 Sample Size Phase 1 Phase 1 is designed to provide some indication of safety and tolerability of the low dose of HS-410 as a monotherapy. A sample size of 10 patients in the monotherapy setting is deemed suitable for an assessment of safety. Phase 2 Heat Biologics, Inc. Protocol HS410-101 HS410-101 SAP version 1.0 Page 15 of 25 The objective of the phase 2 study is to compare 1-year disease free survival of two doses of HS-410 + BCG versus BCG + placebo in patients with non-muscle invasive bladder cancer who have undergone TURBT. Given the phase 2 exploratory nature of the study, the overall level of significance will be 0.10, using a one sided test with no adjustment for multiplicity, 75 patients will be randomized in a 1:1:1 (low dose HS-410 plus BCG and high dose HS-410 plus BCG vs. plus BCG + placebo) ratio to yield 69 evaluable (23 patients per arm). 25 patients will be enrolled into the monotherapy arm. Under the assumption that the one-year disease-free survival rate in the control is 60%, the study will have an 80% power to detect a 30% absolute difference between the two experimental groups and the control. Patients will be followed for three years after the last patient has been enrolled and patients will be obtained from approximately 20 participating centers. 5 Statistical Considerations 5.1 General Principles All statistical analyses will be performed using SAS® Version 9.4 (or later). At the end of the study for both phase 1 and 2, individual data listings and descriptive statistics will be provided by treatment group. Descriptive statistics for continuous variables will include number of subjects (n), mean, standard deviation (SD), minimum, median, and maximum, unless specified otherwise. Descriptive statistics for categorical variables will include frequency counts and percentages [N (%)]. Unless stated otherwise, the denominator for percentage calculations will be the number of subjects in the analysis set. The mean, median (if needed), standard deviation, and any other statistics other than quantiles, will be reported to one decimal place greater than the original data. The minimum and maximum will use the same number of decimal places as the original data. P-values ≥ 0.001 will be reported to 3 decimal places; p-values less than 0.001 will be reported as “<0.001”. Estimated parameters, not on the same scale as raw observations (e.g. regression coefficients) will be reported to 3 significant figures. There will be no imputation of missing data. All data will be listed, sorted by site, treatment and subject, and when appropriate by visit number and/or visit date within subject. All summary tables will include a column for each treatment group in the order (Control, Experimental) and will be annotated with the total population size relevant to that table/treatment, including any missing observations. 5.2 Analysis Populations 5.2.1 Phase 1 Safety Population  Safety Population is defined as all patients receiving at least one dose of HS-410 5.2.2 Phase 2 Heat Biologics, Inc. Protocol HS410-101 HS410-101 SAP version 1.0 Page 16 of 25 Intent-to-Treat (ITT) Population  The intent-to-Treat (ITT) population is defined as all patients randomized into the study and who will be classified according to their assigned treatment group, regardless of the actual treatment received. This population will be used for the primary efficacy analyses, and all analyses of patient disposition, demographics and baseline disease characteristics. Safety Population  The safety population will be defined as all randomized patients who receive at least one dose of treatment (BCG, HS-410, or any combination thereof), and be referred to as the “Safety Population” Per Protocol Population  The Per Protocol (PP) population is defined as all randomized/enrolled patients in the ITT population who do not have any major protocol deviations. All major protocol deviations will be reviewed by Data Monitoring Committee (DMC) prior to database lock and unblinding. Patients will be excluded from this population if the DMC determines the major protocol deviation may impact on the efficacy outcomes of the patient. Analysis Population for Exploratory Endpoints Patients completing at least 6 weekly doses of study medication 5.3 Covariates and Subgroups There will be no covariate or subgroup analysis in the phase 1 component of this protocol. For the phase 2 component of the study, the following subgroups may be used to further summarize and evaluate the efficacy endpoints, if sufficient data are available:  Risk of recurrence (High risk vs intermediate risk)  Carcinoma in situ (yes vs no)  Patient immune response  TNM stage, grade, and severity  BCG naïve or BCG recurrent; number of prior BCG treatments  Screening TURBT characteristics (Re-resection TURBT at screening, muscle in specimen)  Number of prior TURBTs  Number and size of tumors  TIL status  Demographics  Academic vs. Community practices  Use of Blue Light cystoscopy  Use of peri-operative chemotherapy 5.4 Interim Analyses and Data Monitoring This is a phase 1/2 exploratory trial. Therefore, a formal interim analysis will not be conducted. A Data Monitoring Committee (DMC) will convene after all 10 patients are enrolled in Phase 1 to confirm the study will proceed to Phase 2. Heat Biologics, Inc. Protocol HS410-101 HS410-101 SAP version 1.0 Page 17 of 25 The data collection instrument for this study is a Heat Biologics-defined CRF. Patient data necessary for analysis and reporting will be entered/transmitted into a validated database or data system. Sponsor’s clinical data associates (or designees) will review all source-verified CRFs for logical consistency and will use automated programs to help identify missing data, selected protocol violations, out-of-range data, and other inconsistencies. Data clarification or correction will continue until appropriate resolution. Listings of patient data by dataset and/or by patient will be monitored by the DMC as per the DMC charter. 5.5 Multiple Testing The proposed phase 1/2 trial is exploratory, focused on learning and hypothesis generation. Therefore, the preservation of the overall significance level is of lesser importance. However, to address the hazards associated with multiple statistical testing, p-values will only be generated for the primary analysis comparing the two doses of the experimental vaccine to the placebo control. The secondary and exploratory endpoints will be presented as point estimates with associated 95%CI. 6 Summary of Study Data 6.1 Subject Disposition For each of the analysis populations, the number and percentage of patients by treatment group will be provided. In addition, the number of patients in the ITT Population will be summarized by study site and treatment group. The number and percentage of patients discontinuing treatment will be summarized according to reasons of discontinuation as documented in the CRF (e.g. dosing noncompliance, AE, prohibited medications, consent withdrawal). In addition, the number and percentage of patients entering long-term follow-up and completing/discontinuing the follow-up will be presented. 6.2 Protocol Deviations Major protocol deviations could impact the analysis. Protocol deviations specified in Protocol Section 13.3 will be captured in the CRF and reviewed by a medical monitor for determination of impact on patient inclusion in the Per Protocol population:  Entered into the study without meeting eligibility criteria  Developed withdrawal criteria during the study and was not withdrawn  Received wrong treatment or incorrect dose  Received excluded concomitant treatment  Failed to collect data necessary to interpret primary endpoints Protocol deviations will be listed by treatment group, patient number, and categorized according to the deviation reasons. If a significant number of deviations occur, a summary table will be produced showing the number of patients for each deviation reason. Study withdrawal by reasons collected in Heat Biologics, Inc. Protocol HS410-101 HS410-101 SAP version 1.0 Page 18 of 25 the CRF (e.g., eligibility criteria violation, prohibited concomitant treatment, etc.) will also be summarized. 6.3 Demographic and Baseline Variables For both the phase 1 and 2 parts of the study, the following patient baseline demographics and disease status variables will be summarized by treatment group for the ITT Population: Demography: Age, sex, race and ethnicity Stratification factors: Risk of recurrence (High risk vs intermediate risk), carcinoma in situ (yes vs no) Bladder cancer history: histopathologic type, TNM stage, carcinoma in situ, severity, newly diagnosed disease vs recurrent disease, time from last BCG treatment to screening (for patients with recurrent disease) Phase 1 Risk assessment: Number of tumors, tumor diameter, prior recurrence rate, category (Ta / T1), concurrent CIS, Grade (WHO 1973), total recurrence score, total progression score Baseline vital signs: Weight, height, systolic blood pressure, diastolic blood pressure, heart rate, body temperature and respiratory rate Selected baseline laboratory, including lab values dictating inclusion/exclusion:  Hematology: White blood cell (WBC) count, neutrophils, platelets, hemoglobin, lymphocytes, red blood cell (RBC) count  Chemistry: ALT, AST, Alkaline phosphatase, Albumin, total bilirubin, serum creatinine, creatinine clearance No statistical tests to check homogeneity between treatment groups at baseline will be performed. 6.4 Medical History Medical history will be coded using MedDRA dictionary version 18 or higher, and will be summarised by MedDRA preferred term and system organ class.