Privacy Policy

Effective as of July 9, 2025.

This Privacy Policy describes how Science Corporation (“Science”, “we”, “us” or “our”) handles personal information that we collect through our websites that link to this Privacy Policy (collectively, the “Service”), our communications with users and others, and our marketing and other activities described in this Privacy Policy.

Individuals in the EEA/UK: See our Notice to European users for information about your personal information and data protection rights.

Residents of Washington and Nevada: See our Consumer Health Data Privacy Policy for information about how we handle your consumer health data and your rights.

State Law Privacy Rights: See our State Law Privacy Rights section for information about rights you may have under applicable U.S. state privacy laws.

If you have any questions or concerns about our use of your personal information, please contact us.

Index

You can click the links below to jump to specific sections, but we recommend that you read this Privacy Policy in its entirety.

Scope of this Privacy Policy
Personal information we collect
How we use your personal information
How we share your personal information
Your choices
Other sites and services
Security
International data transfers
Children
Changes to this Privacy Policy
How to contact us
Notice to European users
State law privacy rights

Scope of this Privacy Policy

This Privacy Policy does not apply to our handling of personal information of clinical research participants, our employees, or our job candidates, which are governed by different privacy notices that we give to those individuals. We may also provide additional privacy notices to individuals at the time we collect their personal information.

Personal information we collect

The personal information we collect from you, either directly or indirectly, will depend on how you interact with us and with our Service. In general, we may collect personal information about you from the following sources:

Information you provide to us. We collect personal information that you voluntarily provide, for example, when you use the Service, register for our Patient Registry, or otherwise communicate with us. Personal information you may provide to us through the Service includes:

• Contact data. Your business and/or personal contact details, which may include your full name, professional title, organization name, mailing address, email address, phone number, and other contact details.
• Patient Registry data. If you sign up for our Patient Registry, your contact details, date of birth, health data (e.g. health and conditions, medical history, disability information), demographic information (e.g., country of residence, primary language, educational history and employment status), logistical details (e.g., willingness to travel, technology experience), and healthcare provider information. We will also collect the same information about a loved one or other related party when you sign up on their behalf. The health data we collect is considered “sensitive” or “special category” data under some privacy laws.
• Communications data. The contents of your communications with us through the Service, email, phone, social media, events, or other channels (including text and audiovisual content), as well as your contact preferences.

If we collect personal information not specifically listed above, we will use it consistent with this Privacy Policy or as otherwise explained at the time of collection.

Automatic collection. As you navigate the Service, our communications, and other online services, we and our service providers may automatically collect identifiable information about you, your computer or device, and your browsing actions and use patterns, such as:

• Device data. Technical information about your computer or mobile device’s operating system type and version, manufacturer and model, browser type, screen resolution, RAM and disk size, CPU usage, device type (e.g., phone, tablet), unique device identification numbers or other identifiers, language settings, mobile device carrier, radio/network information (e.g., Wi-Fi, LTE, 3G), IP address, and general location information associated with IP address, such as city, state, or geographic area.
• Usage data. Page views, search terms, what videos and other content you view, how long you spent on a page, the website you visited before browsing to the Service, navigation paths between pages, information about your activity on a page, access times and duration of access, metadata about your communications with us (e.g., time sent and whether you have opened our emails or clicked links within them), and other functional information on Service performance (like diagnostics and crash logs).

Cookies and other technologies. Some of the information we collect automatically is captured using cookies and other technologies as described in our Cookie Notice.

Third party sources. We combine personal information we receive from you or collect automatically when you use the Service with personal information we obtain from other sources, such as:

• Authentication services. When you log into the Service by using your credentials on a third party service, such as Google, the service may provide us with your name, email address, photo, and other data according to your settings in that service. The third party service’s privacy policy applies to their handling of your personal information. You can read Google’s privacy policy here: https://policies.google.com/privacy.
• Our business contacts. Our professional contacts share with us contact details about individuals in their networks, including prospective customers, vendors, and partners.
• Public sources. Such as social media platforms and commercial or institutional websites.

How we use your personal information

We use your personal information for the following purposes or as otherwise described in this Privacy Policy or at the time of collection:

• Service delivery. We use your personal information to facilitate your authentication to the Service and to provide, operate, and provide support for the Service, including our Patient Registry if you sign up for it. We use the contact data you provide to communicate with you about the Service via email or phone, such as when we respond to your Service-related questions, requests, and feedback.
• Patient Registry. We use personal information you provide when you register for and use the Patient Registry to administer your Patient Registry account, determine which of our available therapies may be relevant to you (if any), and contact you about those therapies and Science Corporation news. We use the health data and other sensitive or special category data we collect in connection with the Patient Registry only with your consent where required under applicable privacy laws.
• Business operations. We use your personal information to administer and maintain our Service and our IT systems (including monitoring, troubleshooting, data analysis, testing, system maintenance, repair, and support, reporting and hosting of data) and to operate and expand our business activities.
• Research and development. We use your personal information for research and development purposes, including to analyze and improve the Patient Registry and other features of the Service and our business in an informed way. As part of these activities, we may create aggregated, de-identified and/or anonymized data from personal information we collect. We make personal information into aggregated, de-identified or anonymized data by removing information that makes the data personally identifiable to you. We will maintain and use deidentified information in deidentified form and not attempt to reidentify it, except for purposes of testing to ensure that the information has been adequately deidentified. We may use this aggregated, de-identified or otherwise anonymized data and share it with third parties for our lawful business purposes, including to analyze, improve, and promote the Service and our business.
• Marketing. We may send you marketing communications about our business and products via mail, email, or phone as permitted by law. You may opt-out of our marketing communications as described in the opt-out of marketing section below.
• Compliance and protection. We use your personal information to comply with applicable laws, lawful requests, and legal process, such as to respond to subpoenas or requests from government authorities. We also use your personal information to protect our, your or others’ rights, privacy, safety, or property, including by making and defending legal claims; conducting internal audits against our policies; enforcing the terms and conditions that govern the Service; and taking steps to prevent, detect, investigate and deter fraud, cyberattacks or other unauthorized, unethical, or illegal activity.

How we share your personal information

We may share your personal information with the following categories of recipients and as otherwise described in this Privacy Policy or at the time of collection.

• Service providers. Third parties that provide services on our behalf or help us operate the Service or our business (such as business applications, cloud hosting and infrastructure, content delivery network, information technology, customer support, customer relationship management, telecommunications, email delivery, marketing, customer research, and analytics). Some of our service providers that use cookies and other technologies to facilitate their services are identified in our Cookie Notice.
• Affiliates. Our corporate affiliates, including La Science SAS, for purposes consistent with this Privacy Policy as needed to facilitate the services they provide for us or assist with your requests.
• Authentication services. When you log into the Service by using your credentials on a third party service, such as Google, that service will collect your credentials as well as usage data and device data described above to facilitate the authentication. See the service’s relevant settings or privacy policy for details. You can read Google’s privacy policy at https://policies.google.com/privacy.
• Professional advisors. Professional advisors, such as lawyers, auditors, bankers, and insurers, where necessary in the course of the professional services that they render to us.
• Authorities and others. Law enforcement, government authorities, and private parties, as we believe in good faith to be necessary or appropriate for the compliance and protection purposes described above.
• Business transferees. Parties (and their advisors) to transactions (or negotiations of or due diligence for such transactions) involving a corporate divestiture, merger, consolidation, acquisition, reorganization, sale or other disposition of all or any portion of the business or assets of, or equity interests in, Science or our affiliates (including, in connection with a bankruptcy or similar proceedings).
• Other parties with your consent or at your direction. We may share your personal information for other purposes disclosed to you at the time we collect the information or pursuant to your consent or direction.

Your choices

Your choices regarding the personal information we hold about you include the following:

• Close Patient Registry account. If you join our Patient Registry you can ask to have your account closed and the personal information associated with your account deleted at any time by contacting privacy@science.xyz. We may need to verify your identity to process your request to close your account.

• Withdraw consent to process sensitive data. When we ask for your consent to process your health data or other sensitive or special category data in connection with the Patient Registry and you have given your consent, you can withdraw your consent at any time by contacting privacy@science.xyz or using other mechanisms made available to you through the Patient Registry. When you withdraw this consent we will treat this as a request to close your Patient Registry account and delete associated personal information because we cannot maintain your account without this consent. Withdrawing your consent will not affect any use or disclosure of your personal information that occurred before we have processed your request.

• Opt-out of marketing communications. You may opt-out of marketing emails at any time by following the opt-out instructions in the email. You may opt-out of our marketing communications via mail or phone by contacting us with your request or by telling the caller you wish to opt-out. Please note that if you opt-out of marketing emails, you may continue to receive service-related and other non-marketing emails.

• Cookies. Most browsers let you remove or reject cookies. To do this, follow the instructions in your browser settings. See our Cookie Notice for more information about how to control cookies.

• Do Not Track. Some Internet browsers may be configured to send “Do Not Track” signals to the online services that you visit. We currently do not respond to “Do Not Track” signals. To find out more about “Do Not Track,” please visit http://www.allaboutdnt.com.

• Authentication services. You may be able to limit the information shared with us by third party services that you use to sign in to the Service, such as Google. See your settings and the privacy policy for that service for details.

Other sites and services

The Service may contain links to or integrations of websites and other online services operated by third parties. In addition, our content may be integrated into web pages or other online services that are not associated with us. These links and integrations are not an endorsement of, or representation that we are affiliated with, any third party. We do not control websites or other online services operated by third parties, and we are not responsible for their actions. We encourage you to read the privacy policies of the other websites and online services you use.

Security

We use various technical and organizational measures designed to protect the personal information we process. However, security risk is inherent in all internet and information technologies, and we cannot guarantee the security of your personal information.

International data transfers

We are headquartered in the United States and we and our service providers may process personal information from the United States and other countries. These countries may have data protection laws that are not as protective as those where you live.

Children

The Service is not intended for use by anyone under 16 years of age. If you are a parent or guardian of a child from whom you believe we have collected personal information in a manner prohibited by law, please contact us. If we learn that we have collected personal information through the Service from a child without the consent of the child’s parent or guardian as required by law, we will comply with applicable legal requirements to delete the information.

Changes to this Privacy Policy

We reserve the right to modify this Privacy Policy at any time. If we make material changes to this Privacy Policy, we will notify you by updating the date of this Privacy Policy and posting it on the Service or other appropriate means. Any modifications to this Privacy Policy will be effective upon our posting the modified version (or as otherwise indicated at the time of posting). In all cases, your use of the Service after the effective date of any modified Privacy Policy indicates your acknowledgment that the modified Privacy Policy applies to your use of the Service and interaction with our business.

How to contact us

If you have questions or concerns about this Privacy Policy or our practices, please contact us at:

Science Corporation
1010 Atlantic Ave
Alameda, CA 94501
privacy@science.xyz

You can also contact our data protection officer with questions or concerns at dpo@science.xyz.

Notice to European users

The information provided in this notice applies only to individuals in the United Kingdom (“UK”), the European Economic Area (“EEA”) and Switzerland (we collectively refer to these countries as “Europe”).

The personal information that we collect from you is identified and described in greater detail in the section of the Privacy Policy entitled Personal information we collect.

Controller. Science is the controller of your personal information described in this Privacy Policy. See the Contact us section above for contact details.

EU representative. We have appointed La Science SAS as our EU representative under Article 27 of the GDPR. You can contact our European representative at privacy@science.xyz.

Legal bases for processing. European data protection law requires that we have a “legal basis” for each purpose for which we process your personal information. Depending on the purpose for collecting your information, we may rely on one of the following legal bases:

• The processing is necessary to perform a contract that we are about to enter into, or have entered into, with you (“Contractual Necessity”).
• The processing is necessary to pursue our legitimate interests or those of a third party and we are confident that your privacy rights will be appropriately protected (“Legitimate Interests”).
• We need to comply with laws or to fulfill certain legal obligations (“Compliance with Law”).
• We have your specific consent to carry out the processing for the purpose in question (“Consent”) or your explicit consent (“Explicit Consent”) when the processing involves special categories of data, such as health data. Generally, we do not rely on Consent as a legal basis for using your personal information other than in the context of direct marketing communications where required by applicable law.
• The processing is necessary to protect your vital interests or the interests of another individual, such as in a medical emergency (“Vital Interests”).

The table below identifies the legal bases we rely on in respect of the relevant purposes for which we use your personal information. For more information on these purposes and the categories of personal information involved, see the section in the Privacy Policy entitled How we use your personal information.

Retention. We retain personal information for as long as necessary to fulfill the purposes for which we collected it. This includes satisfying any legal, accounting, or reporting requirements, establishing or defending legal claims, or for the compliance and protection purposes described above. Factors determining the appropriate retention period include the amount, nature, and sensitivity of the personal information, the potential risk of harm from unauthorized use or disclosure, the purposes for which we process the information, whether we can achieve those purposes through other means, and the applicable legal requirements.

When we no longer require the personal information we have collected about you, we will either delete or anonymize it, or if this is not possible (e.g., because it has been stored in backup archives), then we will isolate it from any further processing with security safeguards, until deletion is possible.

Use for new purposes. We may use your personal information for reasons not described in this Privacy Policy where permitted by law and the reason is compatible with the purpose for which we collected it. If we need to use your personal information for an unrelated purpose, we will notify you and explain the applicable legal basis.

Sensitive personal information. Except when you register or use the Patient Registry, we do not require personal information considered “sensitive” or “special category” data under privacy laws in connection with the Service (e.g., information related to racial or ethnic origin, political opinions, religion or other beliefs, health, biometrics or genetic characteristics, criminal background, or trade union membership) and ask that you do not provide us with any such information.

Your rights. European data protection laws give individuals in Europe the following rights regarding their personal information:

• Right of access. You can ask us to provide you with information about our processing of your personal information and give you access to your personal information.
• Right to rectification. If the personal information we hold about you is inaccurate or incomplete, you are entitled to request to have it rectified.
• Right to erasure. You can ask us to delete or remove your personal information where there is no lawful reason for us continuing to store or process it, where you have successfully exercised your right to object to processing (see below), where we may have processed your information unlawfully or where we are required to erase your personal information to comply with local law.
• Right to restrict processing. You can ask us to suspend the processing of your personal information: if you want us to establish the information’s accuracy; where our use of the information is unlawful but you do not want us to erase it; where you need us to hold the information even if we no longer require it as you need it to establish, exercise or defend legal claims; if you have objected to our use of your information but we need to verify whether we have overriding legitimate grounds to use it.
• Right to object. You can object to our processing of your personal information where we are relying on a legitimate interest (or those of a third party) and you believe it impacts your fundamental rights and freedoms. You also have the right to object where we are processing your personal information for direct marketing purposes.
• Right to data portability. You have the right, in certain circumstances, to ask us to provide to you, or a third party you have chosen, your personal information in a structured, commonly used, machine-readable format.
• Right related to automated decision-making. You have the right not to be subject to a decision based solely on automated processing (including profiling) that produces legal effects or similarly significant effects for you, unless certain exceptions apply. We do not currently make any such automated decisions about individuals without human involvement. You will not be subject to decisions on therapy eligibility purely based on a computer algorithm without human review.
• Right to withdraw consent at any time. Where we are relying on consent to process your personal information you have the right to withdraw your consent at any time. However, this will not affect the lawfulness of any processing carried out before you withdraw your consent.

Exercising those rights. Some of these rights may be limited where we have an overriding interest or legal obligation to continue to process the personal information or where certain exemptions apply. If we decline your request, we will tell you why, subject to legal restrictions.

To exercise any of these rights, please contact us. We may request specific information from you to help us confirm your identity and process your request.

Your right to lodge a complaint with your supervisory authority. If you are not satisfied with our response to a request you make, or how we process your personal information, you can make a complaint to the data protection regulator in your habitual place of residence.

For users in the EEA: The contact information for the data protection regulator in your place of residence can be found here: https://edpb.europa.eu/about-edpb/board/members_en

For users in the UK: The contact information for the UK data protection regulator is below:

The Information Commissioner’s Office
Water Lane, Wycliffe House
Wilmslow - Cheshire SK9 5AF
Tel. +44 303 123 1113
Website: https://ico.org.uk/make-a-complaint/

International data transfers. We may transfer your personal information to recipients in a country outside of Europe that is not recognized as providing an adequate level of protection for personal information by the relevant government body. In these cases, we take appropriate safeguards to ensure your personal information remains protected in accordance with this Privacy Policy and applicable laws by entering into appropriate data transfer mechanism permitted under Article 46 of the GDPR / UK GDPR (as applicable), such as the European Commission’s Standard Contractual Clauses or the UK International Data Transfer Addendum (as applicable). A copy of our data transfer mechanism can be provided on request.

State law privacy rights

Scope. Except as otherwise provided, this section applies to residents of U.S. states with privacy laws applicable to us that grant their residents the rights described below or require the disclosures made below (“Applicable State Laws”). Privacy laws change frequently. You may contact us to ask whether these laws apply in your state. Science Corporation is the controller of your personal information for purposes of these laws.

If you live in Washington or Nevada see our Consumer Health Data Privacy Policy for information about how we handle your consumer health data and your rights.

For purposes of this section, “personal information” has the meaning given to “personal data”, or similar terms under the Applicable State Laws.

Please note that the rights described and disclosures made below do not apply to you if you are not a resident of the state in which these rights are granted or the disclosures are required to be made.

Privacy Rights. Applicable State Laws grant the right:

• Confirmation. To confirm whether we are processing your personal information.

• Access. To request a copy of your personal information that we have collected about you.

• Correction. To correct inaccurate personal information that we have collected about you.

• Deletion. To ask us to delete personal information provided by or obtained about you.

• Portability. To obtain a copy of the personal information you previously provided to us in a portable, and to the extent technically feasible, readily usable format that allows you to transmit the information to another party without hindrance.

• Opt-out of

  • Processing personal information for targeted advertising purposes. To opt-out of processing of personal information for targeted advertising purposes. Sales of personal information. To opt-out of “sales” of your personal information as defined by Applicable State Laws. Profiling. To opt-out of solely automated processing of personal information for the purposes of certain “profiling” that will have a legal or similarly significant effect on you.

  We do not engage in any of the processing for targeted advertising, sales or profiling described above.

• Nondiscrimination. You are entitled to exercise the rights described above free from discrimination as prohibited by the privacy laws of the state where you reside.

These rights are not absolute, and, in certain cases, we may decline your request as permitted by law or where Applicable State Laws do not afford you these rights.

How to exercise your rights.

• Submitting requests. You may submit requests to exercise the rights described above by submitting a request by email to privacy@science.xyz. We cannot process your request if you do not provide us with sufficient detail to allow us to understand and respond to it.

• Identity verification. We may need to verify your identity to process your requests to exercise your rights and we reserve the right to confirm your state residency.

• Authorized agents. Your authorized agent may make a request on your behalf upon our verification of the agent’s identity and authority as permitted by Applicable State Law.

• Appeals. If we deny a request to exercise your privacy rights described in this State Law Privacy Rights section, you may request an appeal by contacting us at privacy@science.xyz or the mailing address listed under How to Contact Us. You must submit your appeal within 45 days of the denial of our request or within any longer timeframe provided by Applicable State Law. When sending your appeal, please include your name, contact information, details of the original request, the date of our response, and any reason you believe the denial should be reconsidered. We will review your appeal and respond in writing within the timeframe required by Applicable State Law. If we deny your appeal, we will explain why.