R-009-001 US Johnson & Johnson 20251031

• Deal Id: 45489188014

• Contract sign date: 2026-01-21
• Contract effective date: 2025-11-07 (Effective Date)
• Contract end date: 2027-12-31
• Deal name: US J&J Retrospective study - AD and Psoriasis
• Master Agreement Reference: eMC R2025033170 / ICD 2272258 (effective October 10, 2025)
• J&J Address: 1125 Trenton-Harbourton Road, Titusville, NJ 08560, USA

Goals

Main Objective:
Evaluate the feasibility and value of using Legit.Health AI models with J&J’s clinical images

• 1. Applying AI models to J&J’s retrospective dataset (up to 85,000 images, focused on atopic dermatitis and psoriasis)

  • 1.1. Providing automatic global and local severity scores
    • Support for EASI and SCORAD (atopic dermatitis)
    • Support for PASI (psoriasis)
  • 1.2. Efficiently identifying and quantifying clinical signs in images
    • Detect erythema, swelling, oozing/crusting, excoriations, lichenification, dryness, and other relevant signs

• 2. Comparing Legit.Health model outputs to J&J’s internal models

  • To inform the decision to build vs. buy

Project definition details summary

• Overview: J&J has an internal dataset of approximately 85,000 clinical images (~43 images per patient, ~1,977 patients) focused on Atopic Dermatitis and Psoriasis lesions. This project leverages Legit.Health AI models to provide automatic global and local severity scores and identify clinical visual signs through quantification of lesional images and lesion segmentation. Due to data sensitivity, J&J employees run the algorithm on their datasets via API; servers do not store data—only process and delete residual data. All recordkeeping is done by J&J.

• Primary Objective: Integrate AI-driven image analysis into clinical workflows to enhance accuracy, efficiency, and scalability of disease evaluation, reduce patient burden, support decentralized clinical trials, and provide automated severity scores (PASI, EASI, SCORAD) with lesion segmentation.

• Conditions: Atopic Dermatitis (AD), Psoriasis

• Scoring Systems: EASI and SCORAD for Atopic Dermatitis; PASI for Psoriasis

• Output Clinical Signs: Erythema, swelling, oozing/crusting, excoriations, lichenification, dryness

• Integration: API (JSON Only) | Translations: No | Dashboard: No | Data Transfer: No (API calls only, no storage) | Geographical scope: US only | Timeline: 2025-11-07 to 2027-12-31

• Data Volume:

  • Total dataset: ~85,000 images (~1,977 patients)
  • Phase 2: Up to 1,000 images (evaluation)
  • Phase 3 (optional): ~1,000 images
  • Phase 4 (optional): 1-1,000 / 1,000-5,000 / 5,001-10,000 / 10k+ images
  • Maximum potential: Up to 85,000 images (subject to Phase 4 expansion)

• Challenges: Image quality issues (poor resolution, lighting, framing); API failures (connectivity, response times, availability); incorrect patient information (wrong body area, condition codes, questionnaire answers)

• Ethics committee approval required?: TBD

• Technical Notes: API processes one image per call (JSON Request). J&J can implement automated batch processing. API documentation for /severity-assessment endpoint will be prepared.

Summary of dates

Concept	Start Date	End Date	Approx. Months
Contract Period	2025-11-07	2027-12-31	~26
Study period	TBC	TBC	TBC
Technical Support	TBC	TBC	TBC

Project Phases

Phase	Description	Images to Process
1	Technical Setup: Onboarding, API Access, expert support, request/response management	-
2	First batch analysis: Algorithm suitability evaluation	Up to 1,000 images
Licensing	Skin-Segmentation Algorithm Monthly License (minimum 3 months, commencing upon completion of Phase 1)	-
3	Dataset Expansion (optional, subject to Phase 2 outcomes)	~1,000 images
4	Additional Expansions (optional, case-by-case)	1-1,000 / 1,000-5,000 / 5,001-10,000 / 10k+ images

Project timeline and milestones

To achieve the goals, the parties agree on the following timeline.

info

Timeline dates are illustrative. Actual dates TBC upon contract execution.

JSON-only API Flow for J&J Backend

Data Flow for Local Severity Assessment via Legit.Health API (JSON Only)

Request details:

• EASI
  • Condition: Atopic Dermatitis (ICD-11 code: EA89)
  • scoringSystem: aeasi
  • questionnaire:
    • Question: Affected area from selected body area (%)
    • Age: Patient age (years), only needed if age below 7 years or above 7 years
• PASI
  • Condition: Psoriasis (ICD-11 code: EA80)
  • scoringSystem: apasi
  • questionnaire:
    • Question: Affected area from selected body area (% or (0 to 6))

Response visual signs example

• AEASI

  • local score
  • Surface area score (*)
  • patient age (*)
  • Redness
  • Thickness
  • Scratching
  • Lichenification

• APASI

  • local score
  • Body area (*)
  • Surface area score (0 to 6)(*)
  • Desquamation
  • Erythema
  • Induration

Quantification of intensity, count and extent of visible clinical signs

The device provides quantifiable data on the intensity, count and extent of clinical signs such as erythema, desquamation, and induration, among others; including, but not limited to:

• erythema,
• desquamation,
• induration,
• crusting,
• xerosis (dryness),
• swelling (oedema),
• oozing,
• excoriation,
• lichenification,
• exudation,
• wound depth,
• wound border,
• undermining,
• hair loss,
• necrotic tissue,
• granulation tissue,
• epithelialization,
• nodule,
• papule
• pustule,
• cyst,
• comedone,
• abscess,
• draining tunnel,
• inflammatory lesion,
• exposed wound, bone and/or adjacent tissues,
• slough or biofilm,
• maceration,
• external material over the lesion,
• hypopigmentation or depigmentation,
• hyperpigmentation,
• scar

Backend Cloud Infrastructure Flow

Default data flow diagram

Note: DPIA it is available upon request.

Note: All data flows are secured using encrypted HTTPS connections to ensure data integrity and confidentiality. Note: we employ the robust OAuth 2.0 authentication mechanisms to ensure that only authorized users can access the API. Role-based access control further restricts user privileges, enhancing data security. All data transmitted between the user and the API is encrypted using industry-standard encryption protocols.

Possible data flow diagram (upon request and contract agreement)

Note: The client may require that the data not be stored or request its immediate deletion after processing, provided this request is made explicitly and specified in the contract.

Project tasks

🧭 Definition & planning

Task	Description	Start Date	End Date	Status	Notes
Project conception and initiation	Initial ideation and opportunity scoping with all key stakeholders.	2025-10-30	2025-11-07	✅ Done	SOW finalized
Definition and planning	Define project details: scope, key deliverables, timelines, success metrics, and required resources.	2025-10-30	2025-11-07	✅ Done	Defined in SOW
Implementation plan defined	Project scope, key deliverables, timelines, success metrics, and required resources are defined and clear	2025-11-07	2025-11-07	✅ Done	SOW Exhibit 1

📝 Contracting

Task	Description	Start Date	End Date	Status	Notes
Offer Sent	Formal offer/proposal shared with the customer for review.	2025-11-20	2025-11-20	✅ Done
Offer Approved	Customer reviews and approves the proposed scope, terms, and pricing.	2025-12-11	2025-12-11	✅ Done
Contract Review	Align on deliverables, timelines, legal and data terms.	2025-12-11	2026-01-20	✅ Done
Contract Signing	Finalize and sign all contractual agreements.	2026-01-21	2026-01-21	✅ Done

Signatories:

• J&J Innovative Medicine: Oana Cula, Sr. Director DSDH Immunology
• Legit.Health: Sheyla Andina Aguilar, CEO & Co-founder

🏁 Kickoff

Task	Description	Date	Status
Kick-off Meeting	Initial meeting to align on project goals, timelines, and responsibilities.	February 2026	⏳ Pending

🔌 Integration workflow (Phase 1 - Technical Setup)

Task	Description	Timeline	Status	Dependencies
Technical onboarding	Provide comprehensive API documentation and detailed walkthroughs.	February 2026	⏳ Pending	Contract signed
API Access	Generate and deliver API keys for production environment.	February 2026	⏳ Pending	Contract signed
Professional Services	Expert support from technicians, consultants, and project managers. Review and align API input/output structures with client requirements.	February 2026	⏳ Pending	Technical onboarding
Request/Response Setup	Complete setup of request and response management, system ready for operational use of the algorithms.	February 2026	⏳ Pending	Professional Services
Algorithm Setup Support	Provide support for setting up and running the API, including troubleshooting to achieve desired solution.	February 2026	⏳ Pending	API Access

📊 Phase 2 - Evaluation of Results

Task	Description	Timeline	Status	Dependencies
Initial dataset analysis	J&J runs initial set of up to 1,000 images to evaluate algorithm suitability.	TBC when Phase 1 completed	⏳ Pending	Phase 1 complete
Results evaluation	Assess scoring accuracy, latency, and output quality for AD and Psoriasis images.	TBC	⏳ Pending	Initial dataset analysis

📈 Phase 3 - Dataset Expansion (Optional)

Task	Description	Timeline	Status	Dependencies
Phase 3 expansion approval	Subject to satisfactory outcomes from Phase 2, J&J may elect to proceed.	TBC when Phase 2 completed	⏳ Pending	Phase 2 satisfactory
Additional dataset processing	Processing of additional ~1,000 images (psoriasis, atopic dermatitis, or combination).	TBC	⏳ Pending	Written confirmation

🚀 Phase 4 - Additional Expansions (Optional)

Task	Description	Timeline	Status	Dependencies
Phase 4 scope agreement	Mutual written agreement on dataset size, scope of analysis, timeline, and applicable pricing.	TBC	⏳ Pending	Phase 3 complete
Extended dataset processing	Potential dataset sizes: 1-1000, 1000-5000, 5001-10000, or 10k+ images.	TBC	⏳ Pending	Scope agreement

🚀 Project Execution

Task	Description	Responsible	Status
User Onboarding	Train IT managers on the API and scoring system.	JD-021, JD-016	⏳ Pending
Customer Support	Setup and activate helpdesk or in-app support systems. Comprehensive assistance for complex issues	JD-021, JD-016	⏳ Pending
Ongoing Support	Legit.Health available for any ongoing support as needed	JD-016, JD-007	⏳ Pending

🔁 Follow-up Meetings (Optional)

Task	Description	Responsible	Status
Follow-up Meeting	Formal review of key findings, feedback, and performance.	JD-021, JD-016	⏳ Pending
Interim Report	Summary report of current status, insights, and recommendations mid-project.	JD-021, JD-016	⏳ Pending

✅ Project Close

Task	Description	Responsible	Status
Final Report	Analyze final outcomes, compare against objectives, and document results.	JD-021, JD-016	⏳ Pending
Define Next Steps	Outline future roadmap, improvements, or additional collaborations.	JD-021, JD-016	⏳ Pending

Project leads

Team	Code	Leader of
Legit.Health	JD-002, JD-008, JD-019	Sales Manager, Business Development Manager, Sales Development Representative, Digital Health Manager
Legit.Health	JD-027	Project Manager Lead
Legit.Health	JD-013	Project Manager
Legit.Health	JD-003	Design and Development Manager
Legit.Health	JD-016	Customer Success Manager
Legit.Health	JD-018	Clinical Research Manager
Legit.Health	JD-004	Quality Manager & PRRC
Legit.Health	JD-007, JD-010	Technology Manager, Software developer
Legit.Health	JD-005, JD-009	Machine Learning Manager, Medical Data Scientist
Legit.Health	JD-014	Data Analyst
J&J Innovative Medicine	Oana Cula	Sr. Director DSDH Immunology

Signature meaning

The signatures for the approval process of this document can be found in the verified commits at the repository for the QMS. As a reference, the team members who are expected to participate in this document and their roles in the approval process, as defined in Annex I Responsibility Matrix of the GP-001, are:

• Author: Team members involved
• Reviewer: JD-003 Design & Development Manager, JD-004 Quality Manager & PRRC
• Approver: JD-001 General Manager