Legal

Privacy Policy

Last updated: July 13, 2026

Calixis, Inc. ("Calixis," "we," "us," or "our") respects your privacy and is committed to protecting the personal data of the people we interact with. This Privacy Policy explains what personal data we collect, how and why we collect, use, share, and protect it, and the rights and choices you may have. It applies to personal data we collect through this website (the "Site") and through related interactions, such as when you contact us, sign up for updates, apply for a job, or engage with us as an investigator, partner, investor, healthcare professional, or member of the public.

This Policy does not apply to personal data governed by a separate notice, including personal data processed in connection with clinical trials, which is handled under the specific informed consent documents and privacy notices provided for those studies.

1. Personal data we collect

"Personal data" (or "personal information") means information that identifies, relates to, or could reasonably be linked with you. The categories of personal data we may collect, and examples, are described below. Not all of these will apply to every individual.

A note about health information. The Site is not intended for the submission of personal health information, and we ask that you not send us detailed health information through the Site or by email. If you are a patient, please speak with your healthcare provider. Any health-related information you choose to send us voluntarily will be handled in accordance with this Policy and applicable law.

2. How we collect personal data

Directly from you

When you complete a form, contact us by email, subscribe to updates, apply for a role, or otherwise communicate with us or attend our events.

Automatically

When you use the Site, we and our service providers may collect technical information through cookies and similar technologies, such as your IP address, device and browser type, and how you interact with our pages. See Cookies & tracking.

From third parties and public sources

We may receive personal data from service providers, our affiliates and investors, recruiting platforms, event organizers, and publicly available sources, consistent with applicable law.

3. How we use personal data

We use personal data to:

• Respond to your inquiries and communicate with you;
• Operate, maintain, secure, and improve the Site and our communications;
• Send updates, announcements, or other information where you have asked to receive them or where otherwise permitted by law;
• Evaluate and process job applications and manage recruiting;
• Manage relationships with investigators, partners, investors, vendors, and healthcare professionals;
• Conduct analytics and understand how the Site is used;
• Detect, prevent, and address fraud, security, or technical issues;
• Comply with legal, regulatory, and pharmacovigilance obligations, and enforce our terms; and
• Support corporate transactions such as financings, partnerships, or a merger or acquisition.

4. Legal bases for processing (EEA & UK)

If you are in the European Economic Area (EEA) or the United Kingdom (UK), we process your personal data only where we have a legal basis to do so under the EU General Data Protection Regulation (GDPR) or the UK GDPR. Depending on the context, our legal bases include:

• Consent — for example, to send you marketing communications or to place non-essential cookies. You may withdraw consent at any time.
• Performance of a contract — to respond to your request or to take steps at your request before entering into a contract.
• Legitimate interests — to operate, secure, and improve our Site and business, provided those interests are not overridden by your rights.
• Legal obligation — to comply with laws applicable to us, including safety and pharmacovigilance requirements.

Where we rely on legitimate interests, you may ask us for more information about that assessment.

5. Cookies and similar technologies

We and our service providers use cookies, pixels, and similar technologies to operate the Site, remember your preferences, understand usage, and (where applicable) support marketing. Cookies may be "essential" (necessary for the Site to function) or "non-essential" (such as analytics or marketing).

The Site uses the following:

• Essential cookies — required for the Site to function and to remember your cookie choice. These do not require consent.
• Google Analytics (non-essential) — we use Google Analytics, a web-analytics service provided by Google LLC, to understand how visitors use the Site (for example, pages viewed, approximate location derived from IP address, and referring links). Google Analytics sets cookies and processes usage data on our behalf. We enable IP anonymization. For more information, see Google's privacy policy and "How Google uses information from sites or apps that use our services." [Confirm your Google Analytics configuration, data-retention setting, and whether any Google Analytics advertising features or data sharing are enabled, as these affect the disclosures below.]

Your choices. When you first visit the Site, a cookie banner asks for your consent to non-essential cookies. Google Analytics does not load unless you click "Accept," so no analytics cookies are set until you consent. You can change your choice at any time by selecting Cookie Settings (available in the footer of every page) or through your browser settings. If your browser sends a Global Privacy Control (GPC) signal, we treat it as a decline. Blocking some cookies may affect how the Site functions.

6. Marketing communications

Where permitted, we may send you news and updates you have requested. You can opt out at any time by using the unsubscribe link in our emails or by contacting us at info@calixisbio.com. We will still send you non-promotional messages, such as responses to your inquiries.

7. How we share personal data

We do not sell your personal data for money. We may disclose personal data to the following categories of recipients:

• Service providers that perform functions on our behalf (e.g., website hosting, analytics, email, IT security, recruiting), under contracts that limit their use of the data;
• Our affiliates and, where relevant, collaborators and partners involved in our programs;
• Professional advisors such as lawyers, auditors, and consultants;
• Investors and potential acquirers or partners, and parties to a corporate transaction such as a financing, merger, or sale of assets;
• Government, regulatory, and law-enforcement authorities, where required by law or to protect rights, safety, and property.

8. Sale/sharing of personal information and targeted advertising

We do not sell your personal information for money. However, some U.S. state privacy laws define "sale" and "sharing" (for cross-context behavioral advertising) broadly, so that the use of certain analytics technologies may be treated as a "sale" or "share" even when no money changes hands. Our use of Google Analytics could be considered "sharing" (or, in some interpretations, a "sale") under these laws. [Have counsel confirm this characterization based on your Google Analytics configuration.]

We give you control over this: Google Analytics loads only if you consent through our cookie banner, you can withdraw consent at any time via Cookie Settings, and we honor the Global Privacy Control (GPC) opt-out preference signal. Because these controls let you opt out of the relevant processing, they serve as our "Do Not Sell or Share My Personal Information" mechanism. We do not knowingly sell or share the personal information of individuals under 16 years of age.

9. International data transfers

We are based in the United States, and personal data we collect may be processed in the United States and other countries that may have data-protection laws different from those in your country. Where we transfer personal data from the EEA, UK, or Switzerland to a country not recognized as providing an adequate level of protection, we rely on appropriate safeguards, such as the European Commission's Standard Contractual Clauses and the UK International Data Transfer Agreement or Addendum. You may request a copy of the relevant safeguards by contacting us.

10. Data retention

We retain personal data for as long as necessary to fulfill the purposes described in this Policy, including to meet legal, accounting, regulatory, or reporting requirements, and to resolve disputes and enforce our agreements. Retention periods depend on the type of data and the purpose for which it is processed. [Insert specific retention periods or the criteria used to determine them.] When personal data is no longer needed, we take reasonable steps to delete or anonymize it.

11. How we protect personal data

We maintain administrative, technical, and physical safeguards designed to protect personal data against unauthorized access, loss, misuse, or alteration. However, no method of transmission over the Internet or electronic storage is completely secure, and we cannot guarantee absolute security.

12. Children's privacy

The Site is intended for adults and is not directed to children. We do not knowingly collect personal data from children under 16. If you believe a child has provided us personal data, please contact us and we will take appropriate steps to delete it.

13. Your privacy rights

Depending on where you live and applicable law, you may have some or all of the following rights regarding your personal data:

• Access / know — to request confirmation of, and access to, the personal data we hold about you and details about how we process it;
• Correction — to request that we correct inaccurate personal data;
• Deletion — to request that we delete your personal data;
• Portability — to receive a copy of certain personal data in a portable format;
• Opt out — of sale or sharing of personal information, targeted advertising, and certain profiling;
• Limit use of sensitive personal information — where applicable;
• Restriction / objection — to restrict or object to certain processing;
• Withdraw consent — where we rely on consent; and
• Non-discrimination — we will not discriminate against you for exercising your rights.

To exercise your rights, contact us at info@calixisbio.com or as described in the sections below. We will verify your request as required by law and respond within the timeframes the law provides. You may use an authorized agent to submit a request on your behalf, subject to verification.

14. Notice to California residents (CCPA/CPRA)

This section provides additional information for California residents under the California Consumer Privacy Act, as amended by the California Privacy Rights Act ("CCPA"). The categories of personal information we collect, the sources, the business and commercial purposes for collecting it, and the categories of third parties to whom we disclose it are described in Section 1 and throughout this Policy.

Your California rights

• Right to know the categories and specific pieces of personal information we have collected, the sources, purposes, and categories of third parties to whom we disclose it;
• Right to delete personal information we collected from you, subject to exceptions;
• Right to correct inaccurate personal information;
• Right to opt out of the "sale" or "sharing" of personal information, if applicable (see Section 8);
• Right to limit the use and disclosure of sensitive personal information, if applicable; and
• Right to non-discrimination for exercising your rights.

How to exercise your California rights

Submit a request by emailing info@calixisbio.com [or your designated web form/toll-free number]. We will verify your identity before responding and will respond within the time period required by the CCPA. You may designate an authorized agent to make a request on your behalf; we may require the agent to provide proof of authorization and may require you to verify your identity directly.

Opt-out preference signals

We recognize the Global Privacy Control (GPC) opt-out preference signal. If your browser or extension sends a GPC signal, we treat it as a request to opt out of the "sale" or "sharing" of personal information for that browser, and our cookie banner will not load Google Analytics. You can also opt out at any time via Cookie Settings.

Appeal

[If you deny a request, describe how a California resident may appeal, if you choose to offer an appeal process, or direct them to contact the California Privacy Protection Agency or Attorney General.]

California "Shine the Light"

California Civil Code § 1798.83 permits California residents to request certain information about our disclosure of personal information to third parties for their own direct marketing purposes. We do not share personal information with third parties for their own direct marketing purposes. [Confirm.] You may direct questions to info@calixisbio.com.

15. Notice to Nevada residents

Nevada law (NRS Chapter 603A) gives Nevada consumers the right to opt out of the "sale" of certain "covered information" for monetary consideration to a person who will license or sell it to others. We do not sell covered information as defined under Nevada law. [Confirm.] If you are a Nevada resident and wish to submit a request regarding the sale of your covered information, contact us at info@calixisbio.com.

16. Notice to EEA & UK residents (GDPR)

If you are located in the EEA or UK, this section applies to you in addition to the rest of this Policy.

Controller

Calixis, Inc. is the controller of your personal data. [Insert registered address and, if applicable, the identity and contact details of your EU representative (Article 27 GDPR), your UK representative, and your Data Protection Officer.]

Legal bases

We process personal data on the legal bases described in Section 4.

Your GDPR rights

Subject to conditions and exemptions, you have the right to access, rectify, erase, restrict, or object to processing of your personal data; the right to data portability; and the right to withdraw consent at any time without affecting the lawfulness of processing before withdrawal.

International transfers

We transfer personal data internationally using appropriate safeguards, as described in Section 9.

Complaints

You have the right to lodge a complaint with your local data-protection supervisory authority. In the UK, this is the Information Commissioner's Office (ICO). We would, however, appreciate the chance to address your concerns first — please contact info@calixisbio.com.

17. Other U.S. state privacy rights

Residents of certain other U.S. states (such as Colorado, Connecticut, Virginia, Utah, and others as laws take effect) may have rights similar to those described above, including rights to access, correct, delete, and obtain a portable copy of personal data, and to opt out of targeted advertising, sale, or certain profiling. [Confirm which state laws apply to Calixis and tailor this section accordingly.] To exercise any such rights, contact us at info@calixisbio.com.

18. Third-party links

The Site may link to third-party websites or services that we do not control. This Policy does not apply to those third parties, and we are not responsible for their privacy practices. We encourage you to review their privacy notices.

19. Changes to this Policy

We may update this Privacy Policy from time to time. When we make material changes, we will take appropriate steps to inform you consistent with the significance of the changes. The "Last updated" date at the top reflects the most recent revision.

20. How to contact us

If you have questions or requests regarding this Policy or your personal data, contact us at:

Calixis, Inc.
Attn: Privacy
300 Technology Square, 8th Floor
Cambridge, MA 02139, United States
info@calixisbio.com

[If applicable, insert the name and contact details of your Data Protection Officer and your EU and UK representatives.]