Interim Ana lyses Not applicable. SELLAS Life Sciences Group Galinpepimut -S Protocol : SLS17 -201/ MK3475 -770 Protocol v1.1 (Amendment 1.0) 12 April 2019 Page 217 7.6.6. Go/No -Go and Futility Monitoring Guidelines This study uses a Bayesian monitoring approach to guide decision -making using data on the primary efficacy endpoint (ORR) within each cohort. The specific criteria for making a Stop, Consider, or Go decision within each tumor-specific cohort at the planned sample size are derived using the following acceptable risks: • 10% false stop risk: maximum acceptable probability that ORR > TV given that a Stop decision is made. • 20% false go risk: maximum acceptable probability that ORR ≤ LRV given that a Go decision is made The Stop or Go decision criteria in each cohort are presented in Table 14. Table 14 Decision Criteria for a Stop or Go Decision in Each Cohort at the Planned Sample Size Planned Sample Size Target Value (TV) Lower Reference Value (LRV) Minimum Number of Responses for a Go Decision Maximum Number of Responses for a Stop Decision CRC 20 20% 10% 4 1 OvC 20 20% 10% 4 1 SCLC 20 40% 30% 8 5 TNBC 15 25% 15% 4 1 AML 15 25% 15% 4 1 AML = acute myeloid leukemia; CRC = colorectal cancer; ORR = overall response rate; OvC = ovarian cancer; LRV = lower reference value; SCLC = small cell lung cancer; TV = target value SELLAS Life Sciences Group Galinpepimut -S Protocol : SLS17 -201/ MK3475 -770 Protocol v1.1 (Amendment 1.0) 12 April 2019 Page 218 Before reaching the planned sample size in a cohort, the posterior probabilities will be updated continuously after each patient or group of patients and will be used to determine, within each cohort, the predictive probability of a Stop decision at the planned sample size. If this predictive probability is ≥ 80%, then enrollment in that cohort may be stopped early for futility. The criteria for early futility stopping within each coho rt are as follows: CRC or OvC (N = number of patients currently enrolled in the cohort): • If N < 8, there is insufficient data on ORR for a futility recommendation; • If N ≥ 8, futility stopping considered if no responses observed; • If N ≥ 18, futility stopping considered if ≤1 response observed. SCLC (N = number of patients currently enrolled in the cohort): • If N < 3, there is insufficient data on ORR for a futility recommendation; • If N ≥ 3, futility stopping considered if no responses observed; • If N ≥ 7, futility stopping considered if ≤1 response observed; • If N ≥ 11, futility stopping considered if ≤2 responses observed; • If N ≥ 14, futility stopping considered if ≤3 responses observed • If N ≥ 17, futility stopping considered if ≤4 responses observed TNBC or AML: • If N < 6, there is insufficient data on ORR for a futility recommendation; • If N ≥ 6, futility stopping considered if no responses observed; • If N ≥ 13: futility stopping considered if ≤1 response observed. After reaching the planned sample size in a cohort, enrollment may be increased by approximately 10 additional patients in that cohort if the sponsor determines that further data on the primary or secondary endpoints is needed to clarify the efficacy signals for a Go/No - Go decision. In case additional patients are enrolled in a cohort, the decision boundaries for the expanded cohorts will be calculated using the same levels of acceptable risks used to SELLAS Life Sciences Group Galinpepimut -S Protocol : SLS17 -201/ MK3475 -770 Protocol v1.1 (Amendment 1.0) 12 April 2019 Page 219 derive the initial boundaries, and futility monitoring will continue as before using ≥ 80% predictive probability of a Stop decision as a threshold to recommend early futility stopping. In general, Stop/Go and futility decision criteria are non -binding and may be regarded as guidance and information to be integrated with a full medical review of safe ty and efficacy data observed at the time of analysis in determining the next course of action. 7.7. Data Quality Assurance Data entered on the eCRFs must be verifiable against the existing medical records at the investigational site. Data captured on the eCRFs will be reviewed by a SELLAS clinical monitor or designee against the existing medical records at the investigational site for validity and completeness according to procedures outlined in the monitoring plan. After completion of monitoring of the eCRFs, the eCRFs will be reviewed by SELLAS or its designee for data management and analysis purposes. If necessary, the investigational site will be periodically contacted for corrections and/or clarifications of the data. 7.7.1. Data Management As part of the responsibilities assumed by participating in the study, the investigator agrees to maintain adequate case histories for the patients participating in this study. Data will be collected for all patients signing consent. The investigator agrees to maintain accurate source documentation as part of the case histories. Source documents may include a patient’s medical records, hospital charts, clinic charts, the investigator’s patient study files, and patient-reported assessments, as well as the results of diagnostic tests such as laboratory tests and ECGs. Investigative site personnel will enter patient data into eCRFs. The eCRFs are used to record study data and are an integral part of the study and subsequent reports. All data entered into the eCRF must be substantiated by a source document. Accurate completion of the eCRFs for all patients is the responsibility of the investigator. The analysis data sets will be a combination of these data and data from other sources ( e.g., laboratory data). SELLAS Life Sciences Group Galinpepimut -S Protocol : SLS17 -201/ MK3475 -770 Protocol v1.1 (Amendment 1.0) 12 April 2019 Page 220 SELLAS Life Sciences Group (SELLAS) or its designee will designate the EDC system to be used. The eCRFs must be kept current to reflect patient status at each phase during the course of the study. Patients are not to be identified on eCRFs by name; appropriate coded identification and patient initials must be used. The investigator must keep a separate log o f patient names and addresses. This log is subject to regulatory authority inspection. Because of the potential for errors and inaccuracies in recording data onto eCRFs, originals of laboratory and other test results must be kept on file with the patient's clinical chart. These test results must be available at all times for inspection by the regulatory authority, the sponsor, and the sponsor representatives such as CRO monitors. An eCRF must be completed for each patient enrolled in the study, including t hose removed from the study for any reason. The reason for removal must be noted by the investigator for each patient. SELLAS Life Sciences Group or its designee will review all eCRFs for completeness. The investigator will be contacted for corrections an d/or clarifications. Intensive efforts will be made to minimize missing data. Those patients with missing data regarding OS will be censored at that time. Missing data on secondary endpoints will be addressed using imputation methods that reduce the risk f or bias. Clinical data management will be performed in accordance with applicable SELLAS policies and data cleaning procedures to ensure the integrity of the data, ( e.g., removing errors and inconsistencies in the data). Adverse events and concomitant medi cation terms will be coded using the latest version of MedDRA, an internal validated medication dictionary. After database lock, each study site will receive a CD -ROM containing all of their site-specific eCRF data as entered into the electronic data capture system for the study, including full discrepancy and audit history. Additionally, a CD -ROM copy of all of the study site’s data from the study will be created and sent to the sponsor for storage. The CRO will maintain a duplicate CD -ROM copy for their records. In all cases, patient initials will not be collected or transmitted to the sponsor. SELLAS Life Sciences Group Galinpepimut -S Protocol : SLS17 -201/ MK3475 -770 Protocol v1.1 (Amendment 1.0) 12 April 2019 Page 221 8. Ethics 8.1. Independent Ethics Committee or Institutional Review Board Federal regulations (United States 21 CFR Part 56.103) and the ICH guidelines require that approval be obtained from an IRB before participation of human patients in research studies. Before study onset, the protocol, informed consent, advertisements to be used for the recruitment of study patients, and any other written information regarding this study to be provided to the patient or the patient’s legal guardian must be approved by the IRB/IEC. Documentation of all IRB approvals and of the IRB compliance with ICH harmonised tripartite guideline E6(R2): Good Clinical Practice (GCP) will be maintained by the site and will be available for review by the sponsor or its designee. Copies of all IRB correspondence with the investigator should be provided to SELLAS . All IRB/IEC approvals should be signed by the IRB chairperson or designee and must identify the IRB name and address, the clinical protocol by title or protocol number or both, and the date approval or a favorable opinion was granted. SELLAS Life Sciences Group is to be notified immediately if the responsible IRB has been disqualified or if proceedings leading to disqualification have begun. The investigator is responsible for providing written summaries of the progress and status of the study at intervals not exceeding 1 year or otherwise specified by the IRB. Adverse events must be reported to the IRB as required. The investigator must promptly supply the sponsor or its designee, the IRB, and, where applicable, the institution, with written reports on any changes significantly affecting the conduct of the study or increasing the risk to patients. The IRB will receive notification of the completion of the study and final report within 3 months of study completion or termination. 8.2. Ethical Conduct of the Study The study will be performed in accordance with the ethical principle s that have their origin in the Declaration of Helsinki, ICH GCP, relevant SELLAS policies and procedures, and all applicable regulations. SELLAS Life Sciences Group Galinpepimut -S Protocol : SLS17 -201/ MK3475 -770 Protocol v1.1 (Amendment 1.0) 12 April 2019 Page 222 8.3. Patient Information and Consent In accordance with guidelines in the Federal Register, Vol ume 48, Number 17, 1982, pages 8951-8952, a written informed consent shall be obtained from each patient before entering the study or performing any study procedure. This Phase 2 study involves research that presents risk, but holds the possibility of direct benefit to the individual patient (46.405-45 CFR part 46). An informed consent form (ICF) template will be provided by SELLAS or its designee to investigative sites. If any institution-specific modifications to the informed consent are proposed or made by the site, the consent should be reviewed by the sponsor or its designee or both before IRB submission. Once reviewed, the consent will be submitted by the investigator to his or her IRB for review and approval before the start of the study. If the ICF is revised during the course of the study, all active participating patients must sign the revised form. Before recruitment and enrollment, each prospective patient or his or her legal guardian will be given a full explanation of the study and be allowed to read the approved ICF. Once the site investigator is assured that the patient/legal guardian understands the implications of participating in the study, the patient/legal guard ian will be asked to give consent to participate in the study by signing the ICF. The site investigator shall retain the original signed consent form(s) with the study center’s records. Each patient/legal guardian will also be given a copy of his or her signed consent form(s). SELLAS Life Sciences Group Galinpepimut -S Protocol : SLS17 -201/ MK3475 -770 Protocol v1.1 (Amendment 1.0) 12 April 2019 Page 223 9. Investigator’s Obligations The following administrative items are meant to guide the investigator in the conduct of the study but may be subject to change based on industry and government standard operating procedures, working practice documents, or guidelines. Changes will be reported to the IRB but will not necessarily result in protocol amendments. 9.1. Confidentiality A report of the results of this study may be published or sent to the appropriate health authorities in any country in which the study treatment may ultimately be marketed, but the patient’s name will not be disclosed in these documents. Appropriate precautions will be taken to maintain confidentiality of medical records and personal information. All laboratory specimens, evaluation forms, reports, and other records will be identified in a manner designed to maintain patient confidentiality. All records will be kept in a secure storage area with limited access. Clinical information will not be released without the written permission of the patient (or the patient’s legal guardian), except as necessary for monitoring and auditing by the sponsor, its designee, the governing regulatory authority(ies), or the IRB. The patient’s name may be disclosed to the sponsor of the study, SELLAS , or the governing health authorities if they inspect the study records. Written authorization is to be obtained from each patient and/or the patient’s legally authorized representative in accordance with the applicable privacy requirements ( i.e., the HIPAA Standards for Privacy of Individually Identifiable Health Information). In accordance with HIPAA requirements, additional purposes of this study include the following: • To publish anonymous patient data from the study; and • To create and maintain a data repository. SELLAS Life Sciences Group Galinpepimut -S Protocol : SLS17 -201/ MK3475 -770 Protocol v1.1 (Amendment 1.0) 12 April 2019 Page 224 The investigator and all employees and coworkers involved with this study may not disclose or use for any purpose other than performance of the study any data, record, or other unpublished, confidential information disclosed to those individuals for the purpose of the study. Prior written agreement from the sponsor or its designee must be obtained for the disclosure of any said confidential information to other parties.