Mutual Nondisclosure Agreement

Who this protects, and against what

Parties

This Mutual Nondisclosure Agreement (this “Agreement”) is entered into as of the date you accept it electronically (the “Effective Date”) by and between:

XYM Health LLC, an Oregon limited liability company doing business as The Cosmetic Manufacturer, with a place of business at [STREET ADDRESS], Portland, Oregon (“TCM”); and

the individual or entity accepting this Agreement, as identified in the acceptance record described in Section 21 (“Counterparty”, “you”).

TCM and Counterparty are each a “Party” and together the “Parties”. Each Party may act as a discloser of information (“Discloser”) and as a recipient of information (“Recipient”). “Platform” means thecosmeticmanufacturer.com and everything TCM makes available under the Terms and Conditions. “User” means any Brand, Manufacturer, Consultant or other person with a Platform account.

1. Purpose

The Parties wish to explore and potentially pursue a business relationship in connection with the Platform, including the evaluation of contract manufacturing capabilities, the submission and review of project requirements, the matching of beauty and personal care brands with contract manufacturers, introductions between them, and any resulting commercial discussions (the “Purpose”).

In pursuing the Purpose, each Party may disclose information it treats as confidential. This Agreement governs that information.

2. The three relationships this Agreement covers

This is the part that makes the Platform usable. Confidential information on a matchmaking platform moves in three directions, and all three are covered here.

2.1 You and TCM. Everything you tell us, and everything we tell you, is covered in both directions.

2.2 You and your counterparty. Where your information reaches another User, or another User’s information reaches you, these same terms apply directly between the two of you, as set out in Section 9. You do not need to negotiate a separate NDA before a conversation can start, and neither of you is relying on TCM to police it.

2.3 TCM and its own work product. The directory, the structured profiles, the evidence records and the matching logic are our confidential information and you agree to treat them as such, as set out in Section 5.

3. Confidential Information

3.1 General definition. “Confidential Information” means any nonpublic information disclosed by or on behalf of a Discloser to a Recipient, directly or through the Platform, in any form, whether or not marked or identified as confidential, that a reasonable person in the Recipient’s position would understand to be confidential given its nature or the circumstances of disclosure.

Information disclosed through the Platform is confidential by default. Nothing needs to be stamped, labelled or flagged to be protected.

3.2 Brand Confidential Information. Without limiting Section 3.1, information disclosed by or about a brand, a prospective brand, or anyone acting for one includes:

• project briefs, requirements, specifications and target profiles;
• formulations, formulas, ingredient lists, INCI listings, percentages, actives, usage levels and technical specifications;
• product concepts, positioning, claims, clinical or consumer testing plans and results, and launch timing;
• packaging, componentry, decoration, artwork and tooling designs;
• ingredient, component and supplier sourcing relationships, and the commercial terms of them;
• forecasts, volumes, order quantities and reorder cadence;
• pricing, target landed cost, margins, budgets and funding status;
• retailer, distributor, customer and channel information; and
• the identity of the brand itself, before a completed introduction.

3.3 Manufacturer Confidential Information. Without limiting Section 3.1, information disclosed by or about a contract manufacturer, private label house, filler, packer or similar supplier includes:

• quotations, pricing, cost build-ups, component and pass-through costs, payment terms and rebate structures;
• minimum order quantities, batch sizes, lead times, capacity, utilization and scheduling;
• equipment, line configurations, processes, parameters, scale-up know-how and proprietary methods;
• formulation know-how, stock formulas, base formulas, platform chemistries and formulation libraries;
• quality systems, standard operating procedures, audit results, deviation and CAPA records, certificates of analysis and internal documentation;
• regulatory files and submissions not on the public record;
• customer identities, brand relationships and the existence of them; and
• business plans, financial information and ownership matters.

3.4 TCM Confidential Information. Without limiting Section 3.1, information disclosed by TCM includes: the manufacturer directory and any portion of it; profiles, structured datasets, evidence records, source citations and compilations; matching logic, scoring models, question sets, weightings, gates, thresholds and rankings; shortlists and the reasoning behind them; Platform software, interfaces, roadmaps and unreleased features; commercial terms, fee schedules and business plans; and analytics, performance data and outcome data.

3.5 Information disclosed by either Party. The existence, content and status of any brief, request, introduction, acceptance or decline; the identity of any counterparty before a completed introduction; and the terms of this Agreement and of any discussions between the Parties.

3.6 Anonymity is itself confidential. Where the Platform presents a party under an anonymous descriptive label rather than its name, the underlying identity is Confidential Information. No Recipient will attempt to determine, deduce, confirm, triangulate or disclose that identity by any means, including by cross-referencing brief details against public filings, trademark or domain registrations, social media, retailer listings, trade show lists, ingredient or component supplier inquiries, or by asking any third party to do so.

3.7 Trade secret tier. The Parties agree that the following are trade secrets and are treated as such under Section 12.3, without time limit: formulations, formulas, percentages and usage levels; base, stock and platform formulas; manufacturing processes, parameters and scale-up know-how; cost build-ups and pricing models; supplier identities and sourcing terms; and TCM’s matching logic, scoring models and structured datasets.

4. Exclusions

Confidential Information does not include information that the Recipient can demonstrate by contemporaneous written records:

• is or becomes generally available to the public other than through a breach of this Agreement or any other duty of confidence;
• was rightfully in the Recipient’s possession, without a duty of confidence, before the Discloser disclosed it;
• is rightfully received by the Recipient from a third party without a duty of confidence and without restriction on disclosure; or
• is independently developed by the Recipient without use of, reference to, or reliance on the Discloser’s Confidential Information.

4.1 Combinations. Information does not fall within an exclusion merely because it is embraced by more general information that is public or known, or because individual components of a combination are separately public or known. A formulation is not public because its ingredients are individually known. A cost is not public because the commodity price is published.

4.2 There is no residuals right. Some agreements permit a recipient to use information retained in the unaided memory of its personnel. This Agreement does not. Nothing in this Agreement permits the use or disclosure of Confidential Information on the basis that a person remembered it rather than wrote it down.

5. Obligations of every Recipient

Each Recipient will:

• Use it only for the Purpose. Use the Confidential Information solely for the Purpose and for no other purpose. No Recipient will use Confidential Information to compete with, solicit the customers of, replicate the business of, or gain commercial advantage over the Discloser.
• Protect it. Protect the Confidential Information using at least the degree of care it uses for its own confidential information of similar importance, and in no event less than a reasonable degree of care, including appropriate administrative, technical and physical safeguards.
• Limit who sees it. Disclose the Confidential Information only to its employees, officers, directors, affiliates, professional advisors and contractors who have a genuine need to know it for the Purpose and who are bound by written or professional obligations of confidentiality at least as protective as this Agreement. The Recipient remains fully responsible for any act or omission of those persons as if it were the Recipient’s own.
• Not copy it. Not copy or reproduce the Confidential Information except as reasonably necessary for the Purpose.
• Not take it apart. Not reverse engineer, deconstruct, deformulate, analyze or chemically test any sample, formulation, specification, product or software received under this Agreement, and not attempt to derive any source code, matching logic, scoring model or dataset structure from the Platform, except to the extent such a restriction is unenforceable under applicable law. Section 6.1 sets out how this applies to physical samples.
• Not harvest the Platform. Not scrape, crawl, harvest, index or systematically extract any portion of the Platform or the manufacturer directory, not run briefs, searches or queries for the purpose of enumerating the roster rather than sourcing an actual project, and not use any of it to build, train or improve a competing directory, dataset, matching service or model.
• Tell the Discloser if something goes wrong. Notify the Discloser promptly in writing, and in any event within seventy-two (72) hours, on becoming aware of any unauthorized use, disclosure, loss or compromise of Confidential Information, and cooperate reasonably in mitigating it.

6. Protections specific to this industry

Why this section exists. Generic NDAs do not address deformulation, quote shopping, or the fact that the person who reads a brief is usually a formulator. These are the three things that actually happen in personal care, so they are addressed directly.

6.1 Samples, standards and benchmarks. A physical sample, standard, prototype, pilot batch or retail unit provided by one Party to another under this Agreement is provided solely for evaluation of fit for the Purpose. The Recipient will not deformulate it, submit it for analytical deconstruction (including GC-MS, HPLC, LC-MS, NMR or equivalent), send it to a third party laboratory, or use it for competitive benchmarking, teardown or claim substantiation, without the Discloser’s prior written consent. Unused sample material will be returned or destroyed on request under Section 13. This Section does not restrict routine incoming quality checks agreed in writing between a brand and its manufacturer under a separate supply or quality agreement.

6.2 Quotations and no quote shopping. A quotation, cost build-up, price list, minimum order quantity or lead time provided by a manufacturer is Confidential Information of that manufacturer. A Recipient will not disclose it to, or use it to negotiate with, any other manufacturer, supplier, broker or consultant, and will not publish, benchmark or circulate it. A brand may of course solicit and compare quotes from as many manufacturers as it likes. It may not show one manufacturer another manufacturer’s numbers.

6.3 Formulators, chemists and technical staff. Where a Recipient routes Confidential Information to formulation, R&D, application, regulatory or technical personnel, whether employed or contracted, the Recipient is responsible for ensuring each of them is bound by confidentiality obligations at least as protective as this Agreement before they receive it, and for the consequences if they are not. Contract formulators, freelance chemists, toll processors and outsourced labs are expressly included.

6.4 Artificial intelligence and model training. A Recipient will not input, upload or submit another Party’s Confidential Information into any artificial intelligence, machine learning or large language model service that uses submitted content to train, tune or improve models accessible to anyone other than the Recipient, or that does not provide a contractual commitment against such use. A Recipient will not use Confidential Information to train, fine-tune, evaluate or build any model, dataset or tool that is made available outside the Recipient’s own organization. TCM’s own commitment on this point is in Section 10.2.

7. What you are still free to do

Why this section exists. A manufacturer that makes forty lip balms cannot sign something that stops it making lip balms. A brand should not be locked out of a category. This section draws the line so nobody has to guess.

Nothing in this Agreement:

• restricts a Party from designing, developing, manufacturing, marketing or selling products or services of its own, including in the same category, format, price tier or ingredient space as anything it learns about here;
• restricts a Party from working with, quoting to, or contracting with any other party, including a competitor of the Discloser;
• creates any exclusivity, non-compete, non-solicit of employees, or right of first refusal;
• obliges a Party to purchase, quote, accept, respond, or continue any discussion; or
• restricts a Party’s use of its own pre-existing formulations, processes, know-how or customer relationships.

The line. What a Recipient may not do is use the Discloser’s specific Confidential Information to do any of it: not the Discloser’s formulation, ratios or actives levels; not the Discloser’s specific product concept, claim set, packaging design or launch plan; not the Discloser’s disclosed supplier, component or pricing relationships; and not the Discloser’s customer or brand identities. Independent development must be genuinely independent, and the Recipient bears the burden of showing it under Section 4.

8. When protection starts

8.1 With TCM. On acceptance of this Agreement.

8.2 With a counterparty, at the brief. Protection between you and another User attaches at the moment information first moves between you, which on this Platform is when a brand’s brief is transmitted to a manufacturer for consideration. It does not wait for the introduction to complete. A manufacturer that receives a brief, reviews it, and declines is bound by this Agreement as to everything in that brief, permanently subject to Section 12, and whether or not it ever learns the brand’s name.

8.3 Anonymized does not mean unprotected. A brief presented under an anonymous label carries the full protection of this Agreement. The anonymization protects identity. It does not reduce the confidentiality of the content.

8.4 Declining costs nothing and changes nothing. A manufacturer may decline any brief or introduction for any reason or no reason. The brand is not told who declined. Declining does not release the manufacturer from this Agreement as to what it already saw.

9. Your agreement with your counterparty

9.1 Direct effect. Where Counterparty and another User exchange Confidential Information through the Platform, whether at the brief stage under Section 8.2 or after a completed introduction, these terms apply directly between Counterparty and that other User, each as Discloser and Recipient, with the same obligations, exclusions, term and remedies set out here, as if they had signed this Agreement directly with each other on the date that information first moved.

9.2 Enforceable by each of you. Each such User is an intended third party beneficiary of this Section and may enforce this Agreement directly against Counterparty, and Counterparty may enforce it directly against that User. Neither of you needs TCM’s permission, participation or consent to do so.

9.3 TCM is not in the middle. TCM is not a party to the confidentiality relationship between two Users under this Section, has no liability for it, and has no obligation to enforce it, monitor it, or take sides in a dispute about it. What TCM will do is set out in Section 10.6.

9.4 If you sign your own NDA. If Counterparty and another User sign their own nondisclosure agreement covering the same subject matter, that agreement controls between the two of them to the extent of any conflict, and this Agreement continues to govern each of them and TCM. You are free to do this at any point, and many parties will at the sampling or development stage. This Agreement is there so that nothing has to wait for it.

10. What TCM commits to

Why this section exists. Most platform NDAs are a list of things the user must not do. These are the things we are bound to, and you can hold us to them.

10.1 We do not release your identity until you do. A brand’s identity reaches a manufacturer only when that brand confirms the introduction. A manufacturer’s name and address reach a brand only at the same moment. Anonymity before that point is achieved by not transmitting the data, not by hiding it in the interface. Consent is per introduction: confirming one introduction does not reveal you to any other manufacturer on the same brief.

10.2 We do not use your material to compete with you or to train public models. TCM will not use a brand’s brief, formulation, specification, pricing or supplier information, or a manufacturer’s quotes, costs, formulas or customer information, to develop a competing product, to advantage any other User, or to train, fine-tune or evaluate any model made available outside TCM. TCM may create and use aggregated, deidentified and statistical data derived from Platform use, which will not identify you, your counterparty, your brief, your formulas or your commercial terms, and which TCM will not reverse engineer back to an identifiable party or permit anyone else to.

10.3 We do not want your formula. Nothing on the Platform requires you to upload a full formulation. Where you choose to share one with a counterparty, you do so under this Agreement or under your own.

10.4 Our people and our providers are bound. TCM personnel, contractors and advisors are bound by written confidentiality obligations at least as protective as this Agreement and receive Confidential Information on a need-to-know basis. TCM’s service providers, including hosting, database, authentication, email, scheduling, payment and analytics providers, receive only what they need to perform their function and are bound to confidentiality. We do not sell personal data and we do not share it for advertising.

10.5 Security and breach notice. TCM maintains administrative, technical and physical safeguards appropriate to the sensitivity of the information it holds, including encryption of data in transit and at rest, role-based access controls, least-privilege access, and logging of access to brief and introduction records. If TCM confirms a security incident affecting your Confidential Information, TCM will notify you without undue delay and in any event within seventy-two (72) hours of confirming it, with what is known at the time, and will update you as the picture develops.

10.6 The record, and what we will do about a breach. TCM keeps a timestamped record of what was disclosed, to whom, and when: brief transmissions, introduction states, consents, document shares and workspace access. On the written request of a Party to a dispute under this Agreement, TCM will preserve and produce that record to the Parties to it, and will respond to a lawful subpoena or arbitral order for it. Where TCM determines in good faith that a User has breached this Agreement, TCM may suspend or terminate that User’s account and remove its profile. This is not a promise to investigate, adjudicate or fund anyone’s dispute, and Section 9.3 still applies. It is a commitment that the evidence will exist and will be available to you.

10.7 Affiliate brands. TCM’s parent, affiliates and principals may own or operate beauty and personal care brands of their own. Where such a brand uses the Platform, it is treated as any other Brand: it receives no preferential matching, ranking or placement, no access to another Brand’s brief or to any manufacturer’s confidential information beyond what that manufacturer releases to it through a completed introduction, and no access to the scoring internals beyond what any Brand sees. It is bound by this Agreement on the same terms as any other User. TCM does not sell placement and does not accept payment to rank.

10.8 What we will not publish. Which brands work with which manufacturers is not published. Aggregate and verified product counts may be public. The brands behind them are not. Outcome and performance data is published only in aggregated form and never attributed to a named manufacturer or a named brand.

11. Compelled disclosure

A Recipient may disclose Confidential Information to the extent required by law, regulation, subpoena, court order or governmental authority, provided that, where legally permitted, it gives the Discloser prompt written notice before disclosing, discloses only the portion legally required, and cooperates reasonably, at the Discloser’s expense, with the Discloser’s efforts to obtain a protective order or other confidential treatment.

12. Term and survival

12.1 Duration. This Agreement takes effect on the Effective Date and remains in effect for as long as you hold a Platform account or continue to use the Platform, and thereafter as set out below. It is not terminable at will while you hold an account. Closing your account, or ceasing to use the Platform, ends future disclosures. It does not release you from anything already disclosed.

12.2 Survival. The obligations in this Agreement survive and continue with respect to each item of Confidential Information for three (3) years from the date that item was disclosed, or for five (5) years in the case of pricing, cost, quotation, customer identity and capacity information.

12.3 Trade secrets. With respect to any Confidential Information that constitutes a trade secret under applicable law, including everything listed in Section 3.7, the obligations in this Agreement continue for as long as that information remains a trade secret, without time limit.

12.4 Counterparty obligations survive independently. The obligations owed between two Users under Section 9 survive the termination of either User’s relationship with TCM and are not affected by it.

13. Return or destruction

On the Discloser’s written request, the Recipient will, within thirty (30) days, return or destroy all Confidential Information of the Discloser in its possession or control, including copies, samples and sample material, and confirm in writing that it has done so.

The Recipient may retain: (a) one archival copy solely for legal and compliance purposes; and (b) copies held in routine, automated backup or archival systems that are not readily accessible in the ordinary course. Any retained copy remains subject to this Agreement for as long as it is retained.

14. No license, no warranty, no obligation, no fee

14.1 No license. No license, assignment, option or other right, express or implied, in or to any patent, copyright, trademark, trade secret, formulation, dataset or other intellectual property is granted by this Agreement or by any disclosure made under it. All Confidential Information remains the property of the Discloser.

14.2 No warranty. ALL CONFIDENTIAL INFORMATION IS PROVIDED “AS IS”. No Discloser makes any representation or warranty, express or implied, as to the accuracy, completeness, currency, performance or fitness for any purpose of the Confidential Information it discloses, and no Recipient may rely on it as such. This Section does not limit any representation or warranty a Party gives in a separate signed agreement.

14.3 No obligation to proceed. Nothing in this Agreement obligates either Party to disclose any particular information, to enter into any further agreement, to make or accept any introduction, to place or accept any order, or to continue discussions. Either Party may end discussions at any time for any reason.

14.4 No fee obligation lives in here. This Agreement does not create, limit, waive or alter any fee or commission obligation. There is nothing to pay under this Agreement. Fees are governed solely by the Terms and Conditions and, for manufacturers, by the Manufacturer Commercial Terms accepted for that account. If you are looking for what something costs, it is not in this document.

15. Remedies

Each Party acknowledges that a breach of this Agreement may cause the other irreparable harm for which monetary damages would be an inadequate remedy. Accordingly, the non-breaching Party is entitled to seek injunctive and other equitable relief, without the necessity of posting a bond or proving actual damages, in addition to all other remedies available at law or in equity.

In any proceeding brought to enforce this Agreement, the prevailing Party is entitled to recover its reasonable attorney fees and costs.

Nothing in this Section limits any Party’s rights under applicable trade secret law, including the Defend Trade Secrets Act of 2016 and the Oregon Uniform Trade Secrets Act.

Notice under 18 U.S.C. § 1833(b). An individual will not be held criminally or civilly liable under any federal or state trade secret law for disclosing a trade secret in confidence to a government official or attorney solely for the purpose of reporting or investigating a suspected violation of law, or in a sealed filing in a lawsuit or other proceeding. An individual suing an employer for retaliation for reporting a suspected violation of law may disclose the trade secret to that individual’s attorney and use it in the proceeding, if the filing is made under seal and the individual does not disclose the trade secret except pursuant to court order.

16. Governing law and disputes

This Agreement is governed by the laws of the State of Oregon, without regard to its conflict of laws rules. The United Nations Convention on Contracts for the International Sale of Goods does not apply.

Any dispute arising out of or relating to this Agreement will be resolved in accordance with the dispute resolution provisions of the TCM Terms and Conditions then in effect, including binding arbitration before a single arbitrator seated in Portland, Oregon under the Commercial Arbitration Rules of the American Arbitration Association, and the waiver of class and representative proceedings. A dispute between two Users under Section 9 is resolved on those same terms, between those Users.

Notwithstanding the foregoing, either Party may seek temporary or preliminary injunctive relief to protect Confidential Information in the state or federal courts located in Multnomah County, Oregon, and each Party consents to that venue and to personal jurisdiction there.

Each Party knowingly and voluntarily waives any right to a jury trial in any proceeding relating to this Agreement.

17. Relationship to the other TCM agreements

This Agreement is the sole confidentiality agreement between you and TCM in connection with the Platform. It supersedes and replaces Version 1.0 of this Agreement as to information disclosed after its acceptance, and replaces any confidentiality terms previously set out in an appendix to the Terms and Conditions.

Where there is a conflict, the order of precedence is:

• a separate written nondisclosure agreement signed by you and TCM that expressly supersedes this Agreement;
• a nondisclosure agreement signed between you and another User, as between the two of you only, under Section 9.4;
• this Agreement, as to confidentiality;
• the Manufacturer Commercial Terms accepted for an account, as to fees;
• the Terms and Conditions; and
• any other Platform documentation.

18. Notices

Notices to TCM: legal@thecosmeticmanufacturer.com, with a copy to [STREET ADDRESS], Portland, Oregon.

Notices to Counterparty: the email address on Counterparty’s Platform account, and in the Platform. You are responsible for keeping that address current.

Notice is effective on the next business day after sending, provided no delivery failure is received. A notice terminating discussions, asserting a breach, or commencing a dispute must also be sent by a method producing written confirmation of delivery.

19. Assignment

Neither Party may assign this Agreement without the other’s written consent, except to a successor to all or substantially all of its business or assets, whether by merger, acquisition or sale, on written notice. Confidential Information may not be transferred to a successor except subject to this Agreement. Any attempted assignment in violation of this Section is void.

20. General

• Entire agreement. This Agreement, together with the Terms and Conditions, is the entire agreement of the Parties on its subject matter and supersedes all prior understandings, whether written or oral.
• Amendment. This Agreement may be amended only in a writing accepted by both Parties, including by electronic acceptance of a revised version presented in the Platform. A revised version applies only to Confidential Information disclosed after its acceptance.
• Severability. If any provision is held unenforceable, it will be modified to the minimum extent necessary to make it enforceable, or severed, and the remainder stays in full force.
• No waiver. No failure or delay in exercising a right is a waiver of it, and no waiver is effective unless in writing.
• Independent parties. This Agreement creates no agency, partnership, joint venture, franchise or employment relationship, and neither Party may bind the other. TCM is not a broker, agent or fiduciary of any Party.
• Third party beneficiaries. There are none, other than the Users expressly provided for in Section 9.2.
• Counterparts and electronic acceptance. This Agreement may be executed in counterparts, including electronically, each of which is an original and all of which together are one instrument.
• Headings and the summaries. Headings are for convenience and do not affect interpretation. The plain language box at the top of this Agreement, the table beneath it, and the shaded notes within it are accurate summaries provided for convenience. Where a summary and a numbered Section differ, the numbered Section controls.
• Construction. This Agreement will not be construed against either Party as drafter. “Including” means “including without limitation”.

21. Acceptance and signatures

This Agreement is executed in advance by TCM and is accepted electronically by Counterparty.

Counterparty accepts by checking the acceptance box and completing signup, claiming a profile, submitting a brief, or otherwise clicking to accept where this Agreement is presented. That action is an electronic signature under the Electronic Signatures in Global and National Commerce Act (15 U.S.C. § 7001 et seq.) and the Oregon Uniform Electronic Transactions Act, and has the same legal effect as a handwritten signature.

TCM records and retains, as the “acceptance record” referred to in the Parties clause: the accepting person’s name, business email address, company name, account identifier, the date and time of acceptance, the originating IP address, the version of this Agreement accepted, and a cryptographic hash of the version served. A copy of the accepted version is emailed to Counterparty and remains available for download from Counterparty’s account settings at any time, together with every prior version Counterparty accepted.