ENALARE THERAPEUTICS INC.
PRIVACY POLICY
effective September 15, 2026.
This Privacy Policy (“Privacy Policy”) describes the types of personal information that Enalare Therapeutics Inc., a Delaware corporation (“Enalare”, “us,” “our” or “we”), may collect about you in the context of your use of, and access to, the Enalare website located at https://enalare.com or any other affiliated website where these terms appear (the “Website”) and the features and functionality thereof (the “Service(s)”), the purposes for which we use the information, and the circumstances in which we may share such information.
Enalare is a clinical-stage biopharmaceutical company. The Website is an informational corporate website. It does not sell products or services, does not require you to create an account, and is not used to enroll or screen clinical trial participants. Where clinical study information appears on the Website, it is presented only in aggregate, summary form and does not identify individual study participants.
When you visit the Website, we collect certain personal information about you. As used in this Privacy Policy, “personal information” means information that identifies, relates to, describes, is capable of being associated with, or could reasonably be linked, directly or indirectly, to you or your household.
By using the Website, you consent to the collection and use of your personal information as described in this Privacy Policy, and as applicable, our Terms of Use, and as permitted or required by law. If you do not agree with the terms set out in this Privacy Policy, please do not use our Website or Services.
We collect, use and are responsible for certain personal information about you. When we do so we are subject to various privacy laws in the United States and to the General Data Protection Regulation, which applies across the European Union, and to the UK GDPR, which applies in the United Kingdom, and we are responsible as “controller” of that personal information for the purposes of those laws.
Key Terms. It would be helpful to start by explaining some key terms used in this policy:
| We, us, our | Enalare Therapeutics Inc. |
| Our privacy contact | May be contacted at privacy@enalare.com |
| Personal information | Any information relating to an identified or identifiable individual |
COLLECTION OF PERSONAL INFORMATION
The categories below describe the personal information we collect about you and the sources from which we collect those categories of personal information.
| Category | Description | Source of Information |
| Personal Identifiers | Email address, and any name, telephone number, postal address or other contact details that you choose to include in a message you send to us | you |
| Device and/or Online Identifiers | IP address; session ID; session timestamps | you; devices associated with you |
| Internet, Browser, and Network Activity | Clickstream website tracking information; data related to user browser activity, including browser visits, page views, unique visitor data; and cookies or other similar technologies | you; devices associated with you |
| Log Information | Information automatically recorded by our servers or hosting providers, including your Internet Protocol address, operating system, browser type and language, referring URLs, access times, pages viewed, links clicked and other information about your activities on the Website | you; devices associated with you |
| Cookies and Other Tracking Technology Information | See the section below entitled “Cookies and Other Tracking Technologies” for a description of what cookies or other tracking technology may be employed on the Website. | devices associated with you |
| Location data | Region, country and city or municipality, derived from IP address | you; devices associated with you |
| Professional or Employment Information | Employer, professional role and related background information, where you choose to provide it in an inquiry to us regarding employment, partnering, licensing or investment | you |
| Inferences drawn from other personal information | Inferences drawn from the information identified above, such as your general geographic region and the pages and content you appear to be interested in, derived from analytics data. We do not use inferences to build profiles about individual visitors or to make decisions about them. | you; devices associated with you |
You may visit the Website without providing personal information to us. We do not require you to register, create an account, or submit personal information in order to browse the Website. If you choose not to provide personal information in a message to us, we may be unable to respond to your inquiry.
Information we do not collect. The Website does not use data collection forms; the “Contact Us” page provides an email link only. We do not collect payment card information through the Website, we do not host user accounts or user-generated content, and we do not collect protected health information or individual patient or clinical study participant data through the Website.
USE OF PERSONAL INFORMATION
We may use your information for the following purposes:
• Responding to inquiries, requests and other communications that you send to us;
• Sending you administrative or service-related communications, including notices of updates to our Terms of Use or this Privacy Policy;
• Operating, maintaining, administering, securing and improving the Website and its performance;
• Analyzing and understanding how visitors access and use the Website;
• Protecting your, our, or third parties’ networks, systems, property, or physical safety;
• Complying with requests from regulatory agencies, law enforcement, and other public and government authorities, as well as with relevant industry standards and policies;
• Enforcing our contracts, terms, and conditions or otherwise exercising our legal rights; defending ourselves from claims; and complying with laws and regulations that apply to us or third parties with whom we work;
• Aggregating the information collected via cookies and similar technologies to use in statistical analysis to help us track trends, analyze patterns and conduct research and product development;
• Responding to your inquiries related to employment, partnering, licensing or investment opportunities;
• Participating in any merger, acquisition, financing, or other corporate transaction;
• Meeting our or third party audit and compliance requirements; or
• For any other purposes that we may specifically disclose at the time you provide or we collect your information.
Anonymized or Aggregated Information
We may also use data that we collect on an aggregate or anonymous basis (such that it does not identify any individual users) for various business purposes, where permissible under applicable laws and regulations, including for research, product development, and the purposes set forth above. Separately, clinical study results that appear on the Website are presented only in aggregate, summary form; they are derived from study data that does not identify individual participants, and they are not compiled from information collected about visitors to the Website. If you would like to opt out of inclusion of your information in aggregated Website data, please email privacy@enalare.com.
How Long Your Personal Information Will Be Kept
We generally retain personal information to fulfill the purposes for which we collected it, including for the purposes of satisfying any legal, accounting, or reporting requirements, to establish or defend legal claims, or for fraud prevention purposes. To determine the appropriate retention period for personal information, we may consider factors such as the amount, nature, and sensitivity of the personal information, the potential risk of harm from unauthorized use or disclosure of your personal information, the purposes for which we process your personal information and whether we can achieve those purposes through other means, and the applicable legal requirements.
Correspondence you send to us is retained in accordance with our internal records practices. Information collected through our analytics providers is retained for no longer than is necessary for the analytics purposes described above, in accordance with the retention settings we configure in those tools and review from time to time.
When we no longer require the personal information we have collected about you, we may either delete it or de-identify, aggregate or anonymize it. If we de-identify, aggregate or anonymize your personal information (so that it can no longer be associated with you), we may use this information indefinitely without further notice to you.
SHARING OF PERSONAL INFORMATION WITH OTHER ENTITIES
We may share personal information about you with other entities, including entities that provide services to us. We do not disclose your personal information collected through the Website to other entities, except as described in this Privacy Policy.
We may share your personal information with the following types of entities or in the following situations:
Service providers: We engage service providers to host and operate the Website and to analyze information about the Website and your use of the Website. Information disclosed for these purposes may include device and online identifiers, ISP information, session ID and session log data, information about your internet, browser, and network activity, and location data. These providers are identified in the section below entitled “Detailed Information on the Processing of Your Personal Information.”
Legal authorities, emergency responders and other legal requirements: We may disclose personal information to third parties as permitted by, or to comply with, applicable laws, regulations, or legal obligations, including but not limited to responding to a subpoena or similar legal process, protecting against fraud, cooperating with law enforcement or regulatory authorities, protecting and defending the rights or property of Enalare, preventing or investigating possible wrongdoing in connection with the Website or Services, protecting the personal safety of users of the Website or the public, and protecting against legal liability. Information disclosed for these purposes may include personal identifiers, device and online identifiers, information about your internet, browser, and network activity, and location data.
Business transfers: We may share or transfer your personal information in connection with, or during negotiations of, any merger, sale of our assets, financing, or acquisition of all or a portion of our business to another company.
No sale or sharing for advertising. We do not sell your personal information, and we do not share or otherwise disclose your personal information for cross-context behavioral advertising or targeted advertising. We do not serve advertising on the Website, and we do not use the Website to deliver interest-based advertising to you.
COOKIES AND OTHER TRACKING TECHNOLOGIES
We and other persons acting on our behalf use cookies and similar technology, such as web beacons (also known as clear GIFs or pixel tags), or similar technologies as they may develop over time to collect, use, and share information when you visit the Website or interact with us online, via email or through other electronic means.
Cookies are small pieces of data sent from a website and stored on a device. Cookies may enable us to capture and compile statistical information about how you use the Website, including information relating to your device’s IP address, the frequency of your visits, readership data (such as the average length of visits, which pages are viewed or shared during a visit or other interactions with our content, such as time spent viewing videos, PDFs read and links clicked), acceptance or rejection of website terms, and periods of inactivity. To learn more about cookies, including information on what cookies have been set on your device and how cookies can be managed and deleted, visit https://www.allaboutcookies.org/.
The Website also uses web beacons. Web beacons are invisible tags and may be placed on a webpage, in advertisements, or in an email or other message. They usually work in conjunction with cookies, registering when a particular device visits a particular page.
“Clickstream” data (for example, information regarding which of our Website pages you access, the frequency of such access, and the content you view) may be collected by Enalare itself, or by our service providers, using cookies, web beacons, page tags, or similar tools that are set when you visit the Website. Clickstream data and similar information may be shared internally within Enalare and used for administrative purposes to assess the usage, value and performance of the Website; to improve your experience with the Website; and as otherwise permitted by applicable law or regulation. This information may be processed by us for the purposes described above, or on our behalf by other entities, solely in accordance with our instructions.
How We Use These Technologies
We and our service providers may use information collected from cookies, web beacons, and similar technologies for the following purposes:
• to allow the Website to operate as you have requested;
• to understand how the Website is accessed and used;
• to recognize you when you return to the Website;
• to detect, investigate and prevent errors, abuse and security incidents; and
• for other purposes described above under “USE OF PERSONAL INFORMATION.”
Other than service providers, we do not allow unaffiliated third parties to collect personal information about your activities on the Website. Nor do we serve ads promoting unaffiliated third party products or services on the Website.
Managing Your Preferences
Web Browser Preferences. Many web browsers allow you to manage your preferences. You can set your browser to refuse cookies or delete certain cookies. Unless you have adjusted your browser setting so that it will reject cookies, our system may issue cookies when you access or use the Website. In the event you refuse to accept cookies by adjusting your browser setting, some or all areas of the Website may not function properly or may not be accessible. You can also opt out of online targeted advertising by companies participating in the Digital Advertising Alliance by visiting https://www.aboutads.info/choices.
Cookie consent. Where required by applicable law, including for visitors located in the European Economic Area and the United Kingdom, we obtain your consent before setting cookies that are not strictly necessary. You may accept or reject non-essential cookies, and withdraw or change your consent at any time, using the cookie preferences tool available on the Website. You may also manage cookies through your browser settings as described above.
Do Not Track and Opt-Out Preference Signals
There is no universally accepted standard for responding to legacy “Do Not Track” browser signals, and the Website does not respond to such signals. We do, however, honor the Global Privacy Control (GPC) as an opt-out preference signal, and we treat a GPC signal as a valid request to opt out of the sale or sharing of personal information for the browser or device on which the signal is received. As described above, we do not sell or share personal information. If you are visiting third-party websites, you can set preferences in your web browser to inform those websites that you do not want to be tracked.
OUR SECURITY PROCEDURES
Our goal is to protect the personal information you submit to us through the Website. We maintain reasonable physical, electronic, and procedural safeguards that comply with applicable law to guard personal information about you against loss, misuse or unauthorized access, disclosure, alteration or destruction. We also rely on the security measures maintained by our hosting and analytics providers with respect to information processed by them on our behalf. The security of your personal information is important to us, but please note that no method of transmission over the Internet, or method of electronic storage, is perfectly secure. While we strive to use commercially acceptable means to protect your personal information, we cannot guarantee its absolute security.
Where Your Personal Information is Held
The Website and our Services are administered from our offices within the United States, and personal information collected through the Website is processed and stored in the United States and in other locations where our service providers operate. For more information on how specific service providers process personal information, see the section below entitled “Detailed Information on the Processing of Your Personal Information.”
Transferring Your Personal Information Out of the EEA and the United Kingdom
To operate the Website, it is sometimes necessary for personal information relating to individuals located in the European Economic Area (EEA) or the United Kingdom to be transferred to, or accessed from, the United States, including because our offices and certain of our service providers are located outside the EEA and the United Kingdom.
Where we transfer personal information to a country that has not been recognized as providing an adequate level of protection, we rely on an appropriate safeguard permitted under applicable law, such as the European Commission’s Standard Contractual Clauses, together with the UK International Data Transfer Addendum in respect of personal information subject to the UK GDPR. You may request further information about the safeguards we apply by contacting us at privacy@enalare.com.
LINKS TO OTHER WEBSITES
This Privacy Policy only applies to the use and disclosure of information we collect through the Website. The Website may contain links to other websites, publications and resources belonging to third parties that are not affiliated with us. The inclusion of any link on the Website does not imply our endorsement of the linked website or service. While we try to link only to websites that meet our standards and respect for privacy, we are not responsible for the content, security, or privacy practices employed by other websites, or links posted on the Website. Information you disclose to other parties or through such sites is subject to the privacy and security practices and policies of those parties or websites. We disclaim all liability, to the extent permissible, with regard to your access to such linked websites. Access to any other websites is at your own discretion and we encourage you to read the privacy statements of each and every website visited in order to learn how such third parties may treat your information.
DETAILED INFORMATION ON THE PROCESSING OF YOUR PERSONAL INFORMATION
Our third-party service providers have access to your personal information only to perform their tasks on our behalf and are obligated not to disclose or use it for any other purpose.
Website and Hosting
We use the following providers to host, deliver, secure and serve the Website and its content. You can read more about how each provider uses your personal information at the links below:
WordPress (content management system, operated by Automattic): https://automattic.com/privacy/
Amazon Web Services (cloud infrastructure and hosting, including Amazon S3 for hosting video content served on the Website): https://aws.amazon.com/privacy/
Microsoft Azure (cloud infrastructure): https://privacy.microsoft.com/en-us/privacystatement
Analytics and Performance Measurement Providers
We use the following providers to understand how visitors use the Website and to measure and improve its performance. You can read more about how each provider uses your personal information at the links below:
Google Analytics: https://policies.google.com/privacy. You can prevent Google Analytics from collecting information about your visits by installing the browser add-on available at https://tools.google.com/dlpage/gaoptout.
Google Tag Manager (tag and script management): https://policies.google.com/privacy
Adobe Analytics: https://www.adobe.com/privacy/policy.html
Cookie Consent Management
We use a consent management platform to present cookie choices, to block cookies that are not strictly necessary until you consent, and to record your preferences. The provider we use is iubenda: https://www.iubenda.com/privacy-policy/36700132.
PROTECTING CHILDREN’S PRIVACY ONLINE
Protecting the privacy of minors is important to us. We comply with the Children’s Online Privacy Protection Act in the United States, and similar laws around the world, where applicable. The Website and the Services are not directed to or intended for individuals under 18 years of age. We do not knowingly collect or solicit personal information from or about individuals under the age of 18, or the relevant minimum age under applicable local legal requirements, except as permitted under applicable law. If you become aware that we have collected personal information from a minor, please contact us at privacy@enalare.com so that we can promptly investigate and address the issue.
CALIFORNIA RESIDENTS
Enalare voluntarily provides the following rights and disclosures to California residents in accordance with the California Consumer Privacy Act of 2018, as amended by the California Privacy Rights Act of 2022 (collectively, “CCPA/CPRA”). To the extent Enalare meets the applicable thresholds for coverage under the CCPA/CPRA, California residents are entitled to the rights described in this section as a matter of law. Regardless of whether such thresholds are met, Enalare extends these rights to California residents as a matter of policy.
California residents should be aware that this section does not apply to personal information covered by certain sector-specific privacy laws, or to other information subject to a California Consumer Privacy Act (CCPA) exception.
Your Rights under the CCPA. Under this Privacy Policy, and by law if you are a resident of California and the necessary thresholds have been met, you may have the following rights:
| Disclosure of Personal Information We Collect About You | You may have the right to know:
• The categories of personal information we have collected about you; • The categories of sources from which the personal information is collected; • Our business or commercial purpose for collecting or selling personal information; and • The categories of third parties with whom we share personal information, if any. The right to access: • The specific pieces of personal information we have collected about you. Please note that we are not required to: • Retain any personal information about you that was collected for a single one-time transaction if, in the ordinary course of business, that information about you is not retained; • Reidentify or otherwise link any data that, in the ordinary course of business, is not maintained in a manner that would be considered personal information; or • Provide the personal information to you more than twice in a 12-month period. |
| Personal Information Sold or Used for a Business Purpose | In connection with any personal information we may sell or disclose to a third party for a business purpose, you may have the right to know:
• The categories of personal information about you that we sold and the categories of third parties to whom the personal information was sold; and • The categories of personal information that we disclosed about you for a business purpose. You have the right under the CCPA and certain other privacy and data protection laws, as applicable, to opt out of the sale or sharing of your personal information. As described in this Privacy Policy, we do not sell or share personal information. |
| Right to Deletion | Subject to certain exceptions set out below, on receipt of a verifiable request from you, we will:
• Delete your personal information from our records; and • Direct any service providers to delete your personal information from their records. Please note that we may not delete your personal information if it is necessary to: • Complete the transaction for which the personal information was collected, provide a good or service requested by you, or reasonably anticipated within the context of our ongoing business relationship with you, or otherwise perform a contract between you and us; • Detect security incidents, protect against malicious, deceptive, fraudulent, or illegal activity, or prosecute those responsible for that activity; • Debug to identify and repair errors that impair existing intended functionality; • Exercise free speech, ensure the right of another consumer to exercise his or her right of free speech, or exercise another right provided for by law; • Comply with the California Electronic Communications Privacy Act; • Engage in public or peer-reviewed scientific, historical, or statistical research in the public interest that adheres to all other applicable ethics and privacy laws, when our deletion of the information is likely to render impossible or seriously impair the achievement of such research, provided we have obtained your informed consent; • Enable solely internal uses that are reasonably aligned with your expectations based on your relationship with us; • Comply with an existing legal obligation; or • Otherwise use your personal information, internally, in a lawful manner that is compatible with the context in which you provided the information. |
| Right to Correct | You may have the right to request correction of any inaccurate or incomplete personal information that we maintain about you. If you believe any personal information we have is incorrect, please contact us with the details, and we will make the correction where required. |
| Right to Opt Out of Sale or Sharing | You may have the right to direct us to stop selling or sharing your personal information with third parties for cross-context behavioral advertising or other purposes. We do not sell or share personal information. We honor the Global Privacy Control as an opt-out preference signal. |
| Right to Limit Use and Disclosure of Sensitive Personal Information | You may have the right to limit our use and disclosure of sensitive personal information. As described below, we do not collect, use or disclose sensitive personal information. |
| Protection Against Discrimination | You have the right to not be discriminated against by us because you exercised any of your rights under the CCPA. This means we cannot, among other things:
• Deny goods or services to you; • Charge different prices or rates for goods or services, including through the use of discounts or other benefits or imposing penalties; • Provide a different level or quality of goods or services to you; or • Suggest that you will receive a different price or rate for goods or services or a different level or quality of goods or services. |
Exercising Your CCPA Data Protection Rights
In order to exercise any of your rights under the CCPA, and if you are a California resident, you can email us at privacy@enalare.com.
California law requires us to verify the requests we receive from you when you exercise certain of the rights listed above. To verify your request, we will check the information you provide us in your request against information we maintain or against third party identity verification tools. As part of this process, we may contact you after you submit your request to verify information. You may also designate an authorized agent to exercise certain of the rights listed above on your behalf by providing the authorized agent with power of attorney pursuant to the California Probate Code. If an authorized agent submits a request on your behalf, we will contact you to verify that they represent you.
Enalare will disclose and deliver the required information free of charge within 45 days of receiving your verifiable request. The time period to provide the required information may be extended once by an additional 45 days when reasonably necessary and with prior notice.
Categories of Personal Information Disclosed for a Business Purpose
Applicable law requires that we identify the categories of personal information we disclose for a business purpose. In the preceding twelve (12) months, we have disclosed the following categories of personal information for a business purpose: personal identifiers; device and online identifiers; internet, browser, and network activity; log information; and location data. We disclose these categories to the hosting and analytics service providers described in this Privacy Policy. We do not sell or share personal information for cross-context behavioral advertising, and we do not knowingly sell or share the personal information of consumers under 16 years of age.
Sensitive Personal Information
We do not collect, use, or disclose “sensitive personal information” or “sensitive data” as those terms are defined under the CCPA/CPRA and other applicable U.S. state privacy laws, and we do not use or disclose such information for any purpose that would give rise to a right to limit its use. Clinical study results presented on the Website are aggregated and do not identify individual study participants, and they do not constitute health information about visitors to the Website.
Right to Appeal
If you are a resident of a state that provides a right to appeal and we decline to take action on your request, you may appeal that decision within a reasonable period after your receipt of our decision by emailing us at privacy@enalare.com. Within forty-five (45) days of receiving your appeal, we will inform you in writing of any action taken or not taken in response to the appeal, including a written explanation of the reasons for our decision. If your appeal is denied, you may contact your state Attorney General to submit a complaint.
Do Not Sell or Share My Personal Information
We do not sell your personal information in exchange for money, and we do not share your personal information for cross-context behavioral advertising or targeted advertising. We do not use advertising or remarketing technologies on the Website. Because we do not sell or share personal information, we do not maintain a “Do Not Sell or Share My Personal Information” link. We nonetheless honor the Global Privacy Control as an opt-out preference signal, and we will update this Privacy Policy and provide an opt-out mechanism if our practices change.
“Do Not Track” Policy as Required by the California Online Privacy Protection Act (CalOPPA)
There is no universally accepted standard for responding to legacy “Do Not Track” browser signals, and the Website does not respond to such signals. We do, however, honor the Global Privacy Control (GPC) as an opt-out preference signal. If you are visiting third-party websites, you can set preferences in your web browser to inform websites that you do not want to be tracked.
Your California Privacy Rights (California’s Shine the Light law)
Under California Civil Code Section 1798.83 (California’s Shine the Light law), California residents with an established business relationship with us can request information once a year about sharing their personal information with third parties for the third parties’ direct marketing purposes. We do not share personal information with third parties for their direct marketing purposes. If you would like to request more information under the California Shine the Light law, and if you are a California resident, you can contact us by email at privacy@enalare.com.
COLORADO RESIDENTS
This section applies to residents of Colorado to the extent Enalare meets the applicability thresholds under the Colorado Privacy Act (the “CPA”). Where applicable, this section supplements the information contained in the rest of this Privacy Policy, and these provisions supersede any other possibly divergent or conflicting provisions with respect to Colorado residents. This section uses the term “personal data” as defined in the CPA. Colorado law gives Colorado consumers the right to (i) access, correct, delete, or obtain a copy of their personal information in a portable format, and (ii) opt out of the processing of their personal data for the purposes of targeted advertising, the sale of personal data, or profiling in furtherance of decisions that produce legal or similarly significant effects concerning them. If you are a Colorado consumer and wish to exercise these rights, please submit your request by emailing us at privacy@enalare.com.
CONNECTICUT RESIDENTS
This section applies to residents of Connecticut to the extent Enalare meets the applicability thresholds under the Connecticut Data Privacy Act (the “CTDPA”). Where applicable, this section supplements the information contained in the rest of this Privacy Policy, and these provisions supersede any other possibly divergent or conflicting provisions with respect to Connecticut residents. This section uses the term “personal data” as defined in the CTDPA. Connecticut law gives Connecticut consumers the right to (i) access, correct, delete, or obtain a copy of their personal information in a portable format, and (ii) opt out of the processing of their personal data for the purposes of targeted advertising, the sale of personal data, or profiling in furtherance of decisions that produce legal or similarly significant effects concerning them. If you are a Connecticut consumer and wish to exercise these rights, please submit your request by emailing us at privacy@enalare.com.
DELAWARE RESIDENTS
This section applies to residents of Delaware to the extent Enalare meets the applicability thresholds under the Delaware Personal Data Privacy Act (the “DPDPA”). Where applicable, this section supplements the information contained in the rest of this Privacy Policy, and these provisions supersede any other possibly divergent or conflicting provisions with respect to Delaware residents. This section uses the term “personal data” as defined in the DPDPA. Delaware law gives Delaware consumers the right to (i) confirm whether their personal data is being processed, and access, correct, delete, or obtain a copy of their personal information in a portable format, (ii) obtain a list of the categories of third parties to which their personal data has been disclosed, and (iii) opt out of the processing of their personal data for the purposes of targeted advertising, the sale of personal data, or profiling in furtherance of decisions that produce legal or similarly significant effects concerning them. If you are a Delaware consumer and wish to exercise these rights, please submit your request by emailing us at privacy@enalare.com.
FLORIDA RESIDENTS
This section applies to residents of Florida to the extent Enalare meets the applicability thresholds under the Florida Digital Bill of Rights (the “FDBOR”). Where applicable, this section supplements the information contained in the rest of this Privacy Policy, and these provisions supersede any other possibly divergent or conflicting provisions with respect to Florida residents. This section uses the term “personal data” as defined in the FDBOR. Florida law gives Florida consumers the right to (i) confirm whether their personal data is being processed, and access, correct, delete, or obtain a copy of their personal information in a portable format, (ii) obtain a list of the categories of third parties to which their personal data has been disclosed, and (iii) opt out of the processing of their personal data for the purposes of targeted advertising, the sale of personal data, or profiling in furtherance of decisions that produce legal or similarly significant effects concerning them. If you are a Florida consumer and wish to exercise these rights, please submit your request by emailing us at privacy@enalare.com.
INDIANA RESIDENTS
This section applies to residents of Indiana to the extent Enalare meets the applicability thresholds under the Indiana Consumer Data Protection Act (the “INCDPA”). Where applicable, this section supplements the information contained in the rest of this Privacy Policy, and these provisions supersede any other possibly divergent or conflicting provisions with respect to Indiana residents. This section uses the term “personal data” as defined in the INCDPA. Indiana law gives Indiana consumers the right to (i) confirm whether their personal data is being processed, and access, correct, delete, or obtain a copy of their personal information in a portable format, and (ii) opt out of the processing of their personal data for the purposes of targeted advertising, the sale of personal data, or profiling in furtherance of decisions that produce legal or similarly significant effects concerning them. If you are a Indiana consumer and wish to exercise these rights, please submit your request by emailing us at privacy@enalare.com.
IOWA RESIDENTS
This section applies to residents of Iowa to the extent Enalare meets the applicability thresholds under the Iowa Consumer Data Protection Act (the “ICDPA”). Where applicable, this section supplements the information contained in the rest of this Privacy Policy, and these provisions supersede any other possibly divergent or conflicting provisions with respect to Iowa residents. This section uses the term “personal data” as defined in the ICDPA. Iowa law gives Iowa consumers the right to (i) confirm whether their personal data is being processed, and access, delete, or obtain a copy of their personal information in a portable format, and (ii) opt out of the sale of their personal data and of targeted advertising. If you are a Iowa consumer and wish to exercise these rights, please submit your request by emailing us at privacy@enalare.com.
KENTUCKY RESIDENTS
This section applies to residents of Kentucky to the extent Enalare meets the applicability thresholds under the Kentucky Consumer Data Protection Act (the “KCDPA”). Where applicable, this section supplements the information contained in the rest of this Privacy Policy, and these provisions supersede any other possibly divergent or conflicting provisions with respect to Kentucky residents. This section uses the term “personal data” as defined in the KCDPA. Kentucky law gives Kentucky consumers the right to (i) confirm whether their personal data is being processed, and access, correct, delete, or obtain a copy of their personal information in a portable format, and (ii) opt out of the sale or sharing of their personal data for the purposes of targeted advertising or profiling in furtherance of decisions that produce legal or similarly significant effects concerning them. If you are a Kentucky consumer and wish to exercise these rights, please submit your request by emailing us at privacy@enalare.com.
MARYLAND RESIDENTS
This section applies to residents of Maryland to the extent Enalare meets the applicability thresholds under the Maryland Online Data Privacy Act (the “MODPA”). Where applicable, this section supplements the information contained in the rest of this Privacy Policy, and these provisions supersede any other possibly divergent or conflicting provisions with respect to Maryland residents. This section uses the term “personal data” as defined in the MODPA. Maryland law gives Maryland consumers the right to (i) confirm whether their personal data is being processed, and access, correct, delete, or obtain a copy of their personal information in a portable format, (ii) obtain a list of the categories of third parties to which a controller has disclosed their personal data, and (iii) opt out of the sale or sharing of their personal data for the purposes of targeted advertising or profiling in furtherance of decisions that produce legal or similarly significant effects concerning them. If you are a Maryland consumer and wish to exercise these rights, please submit your request by emailing us at privacy@enalare.com.
MINNESOTA RESIDENTS
This section applies to residents of Minnesota to the extent Enalare meets the applicability thresholds under the Minnesota Consumer Data Privacy Act (the “MCDPA”). Where applicable, this section supplements the information contained in the rest of this Privacy Policy, and these provisions supersede any other possibly divergent or conflicting provisions with respect to Minnesota residents. This section uses the term “personal data” as defined in the MCDPA. Minnesota law gives Minnesota consumers the right to (i) confirm whether their personal data is being processed, and access, correct, delete, or obtain a copy of their personal information in a portable format, (ii) obtain a list of the categories of third parties to which a controller has disclosed their personal data, (iii) opt out of the sale or sharing of their personal data for the purposes of targeted advertising or profiling in furtherance of decisions that produce legal or similarly significant effects concerning them, and (iv) question the result of profiling and, where feasible, be informed of the reason that profiling resulted in a specific decision. If you are a Minnesota consumer and wish to exercise these rights, please submit your request by emailing us at privacy@enalare.com.
MONTANA RESIDENTS
This section applies to residents of Montana to the extent Enalare meets the applicability thresholds under the Montana Consumer Data Protection Act (the “MTCDPA”). Where applicable, this section supplements the information contained in the rest of this Privacy Policy, and these provisions supersede any other possibly divergent or conflicting provisions with respect to Montana residents. This section uses the term “personal data” as defined in the MTCDPA. Montana law gives Montana consumers the right to (i) confirm whether their personal data is being processed, and access, correct, delete, or obtain a copy of their personal information in a portable format, and (ii) opt out of the sale or sharing of their personal data for the purposes of targeted advertising or profiling in furtherance of decisions that produce legal or similarly significant effects concerning them. If you are a Montana consumer and wish to exercise these rights, please submit your request by emailing us at privacy@enalare.com.
NEBRASKA RESIDENTS
This section applies to residents of Nebraska to the extent Enalare meets the applicability thresholds under the Nebraska Data Privacy Act (the “NEDPA”). Where applicable, this section supplements the information contained in the rest of this Privacy Policy, and these provisions supersede any other possibly divergent or conflicting provisions with respect to Nebraska residents. This section uses the term “personal data” as defined in the NEDPA. Nebraska law gives Nebraska consumers the right to (i) confirm whether their personal data is being processed, and access, correct, delete, or obtain a copy of their personal information in a portable format, and (ii) opt out of the sale or sharing of their personal data for the purposes of targeted advertising or profiling in furtherance of decisions that produce legal or similarly significant effects concerning them. If you are a Nebraska consumer and wish to exercise these rights, please submit your request by emailing us at privacy@enalare.com.
NEW HAMPSHIRE RESIDENTS
This section applies to residents of New Hampshire to the extent Enalare meets the applicability thresholds under the New Hampshire Data Privacy Act (the “NHDPA”). Where applicable, this section supplements the information contained in the rest of this Privacy Policy, and these provisions supersede any other possibly divergent or conflicting provisions with respect to New Hampshire residents. This section uses the term “personal data” as defined in the NHDPA. New Hampshire law gives New Hampshire consumers the right to (i) confirm whether their personal data is being processed, and access, correct, delete, or obtain a copy of their personal information in a portable format, and (ii) opt out of the sale or sharing of their personal data for the purposes of targeted advertising or profiling in furtherance of decisions that produce legal or similarly significant effects concerning them. If you are a New Hampshire consumer and wish to exercise these rights, please submit your request by emailing us at privacy@enalare.com.
NEW JERSEY RESIDENTS
This section applies to residents of New Jersey to the extent Enalare meets the applicability thresholds under the New Jersey Data Privacy Act (the “NJDPA”). Where applicable, this section supplements the information contained in the rest of this Privacy Policy, and these provisions supersede any other possibly divergent or conflicting provisions with respect to New Jersey residents. This section uses the term “personal data” as defined in the NJDPA. New Jersey law gives New Jersey consumers the right to (i) confirm whether their personal data is being processed, and access, correct, delete, or obtain a copy of their personal information in a portable format, and (ii) opt out of the sale or sharing of their personal data for the purposes of targeted advertising or profiling in furtherance of decisions that produce legal or similarly significant effects concerning them. If you are a New Jersey consumer and wish to exercise these rights, please submit your request by emailing us at privacy@enalare.com.
OREGON RESIDENTS
This section applies to residents of Oregon to the extent Enalare meets the applicability thresholds under the Oregon Consumer Data Privacy Act (the “OCDPA”). Where applicable, this section supplements the information contained in the rest of this Privacy Policy, and these provisions supersede any other possibly divergent or conflicting provisions with respect to Oregon residents. This section uses the term “personal data” as defined in the OCDPA. Oregon law gives Oregon consumers the right to (i) confirm whether their personal data is being processed, and access, correct, delete, or obtain a copy of their personal information in a portable format, (ii) obtain, at the controller’s option, a list of specific third parties to which the controller has disclosed the consumer’s personal data, and (iii) opt out of the sale or sharing of their personal data for the purposes of targeted advertising or profiling in furtherance of decisions that produce legal or similarly significant effects concerning them. If you are a Oregon consumer and wish to exercise these rights, please submit your request by emailing us at privacy@enalare.com.
RHODE ISLAND RESIDENTS
This section applies to residents of Rhode Island to the extent Enalare meets the applicability thresholds under the Rhode Island Data Transparency and Privacy Protection Act (the “RIDTPPA”). Where applicable, this section supplements the information contained in the rest of this Privacy Policy, and these provisions supersede any other possibly divergent or conflicting provisions with respect to Rhode Island residents. This section uses the term “personal data” as defined in the RIDTPPA. Rhode Island law gives Rhode Island consumers the right to (i) confirm whether their personal data is being processed, and access, correct, delete, or obtain a copy of their personal information in a portable format, and (ii) opt out of the sale or sharing of their personal data for the purposes of targeted advertising or profiling in furtherance of decisions that produce legal or similarly significant effects concerning them. If you are a Rhode Island consumer and wish to exercise these rights, please submit your request by emailing us at privacy@enalare.com.
TENNESSEE RESIDENTS
This section applies to residents of Tennessee to the extent Enalare meets the applicability thresholds under the Tennessee Information Protection Act (the “TIPA”). Where applicable, this section supplements the information contained in the rest of this Privacy Policy, and these provisions supersede any other possibly divergent or conflicting provisions with respect to Tennessee residents. This section uses the term “personal data” as defined in the TIPA. Tennessee law gives Tennessee consumers the right to (i) confirm whether their personal data is being processed, and access, correct, delete, or obtain a copy of their personal information in a portable format, and (ii) opt out of the sale or sharing of their personal data for the purposes of targeted advertising or profiling in furtherance of decisions that produce legal or similarly significant effects concerning them. If you are a Tennessee consumer and wish to exercise these rights, please submit your request by emailing us at privacy@enalare.com.
TEXAS RESIDENTS
This section applies to residents of Texas to the extent Enalare meets the applicability thresholds under the Texas Data Privacy and Security Act (the “TDPSA”). Where applicable, this section supplements the information contained in the rest of this Privacy Policy, and these provisions supersede any other possibly divergent or conflicting provisions with respect to Texas residents. This section uses the term “personal data” as defined in the TDPSA. Texas law gives Texas consumers the right to (i) confirm whether their personal data is being processed, and access, correct, delete, or obtain a copy of their personal information in a portable format, and (ii) opt out of the sale or sharing of their personal data for the purposes of targeted advertising or profiling in furtherance of decisions that produce legal or similarly significant effects concerning them. If you are a Texas consumer and wish to exercise these rights, please submit your request by emailing us at privacy@enalare.com.
UTAH RESIDENTS
This section applies to residents of Utah to the extent Enalare meets the applicability thresholds under the Utah Consumer Privacy Act (the “UCPA”). Where applicable, this section supplements the information contained in the rest of this Privacy Policy, and these provisions supersede any other possibly divergent or conflicting provisions with respect to Utah residents. This section uses the term “personal data” as defined in the UCPA. Utah law gives Utah consumers the right to (i) access, delete, or obtain a copy of their personal information in a portable format, and (ii) opt out of the processing of their personal data for the purposes of targeted advertising or the sale of personal data. If you are a Utah consumer and wish to exercise these rights, please submit your request by emailing us at privacy@enalare.com.
VIRGINIA RESIDENTS
This section applies to residents of Virginia to the extent Enalare meets the applicability thresholds under the Virginia Consumer Data Protection Act (the “VCDPA”). Where applicable, this section supplements the information contained in the rest of this Privacy Policy, and these provisions supersede any other possibly divergent or conflicting provisions with respect to Virginia residents. This section uses the term “personal data” as defined in the VCDPA. Virginia law gives Virginia consumers the right to (i) access, correct, delete, or obtain a copy of their personal information in a portable format, (ii) opt out of the processing of their personal data for the purposes of targeted advertising, the sale of personal data, or profiling in furtherance of decisions that produce legal or similarly significant effects concerning them, and (iii) not be discriminated against for exercising any of the data privacy rights granted. If you are a Virginia consumer and wish to exercise these rights, please submit your request by emailing us at privacy@enalare.com.
NEVADA RESIDENTS
This section applies to residents of Nevada to the extent Enalare meets the applicability thresholds under the Nevada Privacy of Information Collected on the Internet from Consumers Act (the “Nevada Privacy Law”). The Nevada Privacy Law gives Nevada consumers the right to request that a company not sell their personal information. We do not sell personal information. If you are a Nevada consumer and wish to exercise these rights, please submit your request by emailing us at privacy@enalare.com.
RESIDENTS OF OTHER STATES
If you are a resident of a state that has enacted a comprehensive consumer privacy law that is in effect and applicable to Enalare, and that state is not separately addressed above, you may exercise the rights available to you under that law. Depending on the law of your state, those rights may include the right to confirm whether we are processing your personal data; to access, correct or delete your personal data; to obtain a copy of your personal data in a portable format; to obtain a list of the categories of third parties to which we have disclosed personal data; to opt out of the processing of your personal data for purposes of targeted advertising, the sale of personal data, or profiling in furtherance of decisions that produce legal or similarly significant effects concerning you; and to appeal a decision we make regarding your request. We do not sell personal data or process it for targeted advertising. To exercise any of these rights, please submit your request by emailing us at privacy@enalare.com. We will respond within the period required by the applicable law of your state.
INTERNATIONAL USERS
The Website is administered by Enalare from its offices within the United States, is published in the English language, and is directed to a United States audience. Enalare does not market or offer goods or services to individuals located outside the United States through the Website. This Privacy Policy is provided in accordance with and subject to applicable United States law. If you access the Website from a location outside the United States, personal information collected through the Website will be processed and stored in the United States and in other locations where our service providers operate, as described in the sections above entitled “Where Your Personal Information is Held” and “Transferring Your Personal Information Out of the EEA and the United Kingdom.” Where the General Data Protection Regulation or the UK GDPR applies to our processing of your personal information, the section below applies to you.
GDPR PRIVACY
Legal Basis for Processing Personal Information under GDPR
We may process personal information under the following conditions:
• Consent – you have given your consent for processing personal information for one or more specific purposes, including for the setting of cookies that are not strictly necessary.
• Performance of a contract – provision of personal information is necessary for the performance of an agreement with you and/or for any pre-contractual obligations thereof.
• Legal obligations – processing personal information is necessary for compliance with a legal obligation to which we are subject.
• Vital interests – processing personal information is necessary in order to protect your vital interests or those of another natural person.
• Legitimate interests – processing personal information is necessary for the purposes of the legitimate interests pursued by Enalare, including operating, securing and improving the Website, responding to your inquiries, and understanding how the Website is used, provided those interests are not overridden by your rights and freedoms.
In any case, Enalare will gladly help to clarify the specific legal basis that applies to the processing, and in particular whether the provision of personal information is a statutory or contractual requirement, or a requirement necessary to enter into a contract.
Your Rights under the GDPR
Enalare undertakes to respect the confidentiality of your personal information and to enable you to exercise your rights under the GDPR. Under this Privacy Policy, and by law if you are within the European Economic Area (EEA) or the United Kingdom, you may have the following rights:
| Right to be Informed | The right to be informed as to what personal data we collect, the purposes for which we use it, the legal bases for processing, and with whom we share it. |
| Right to Access | The right to be provided with a copy of your personal information (the right of access). |
| Right to Rectification | The right to require us to correct any mistakes in your personal information. |
| Right to be Forgotten | The right to require us to delete your personal information, in certain situations. |
| Right to Restriction of Processing | The right to require us to restrict processing of your personal information in certain circumstances, for example if you contest the accuracy of the data. |
| Right to Data Portability | The right to receive the personal information you provided to us, in a structured, commonly used and machine-readable format, and/or to transmit that data to a third party, in certain situations. |
| Right to Object | The right to object:
• at any time to your personal information being processed for direct marketing (including profiling); and • in certain other situations to our continued processing of your personal information, for example processing carried out for the purpose of our legitimate interests. |
| Right Not to be Subject to Automated Individual Decision-Making | The right not to be subject to a decision based solely on automated processing (including profiling) that produces legal effects concerning you or similarly significantly affects you. We do not carry out automated decision-making of this kind through the Website. |
| Right to Withdraw Consent | The right to withdraw your consent at any time, meaning you can stop us from processing your personal information based on your consent by contacting us as set forth below. Withdrawing your consent will not affect the lawfulness of any processing based on your consent before its withdrawal. |
| Right to Lodge a Complaint | The right to lodge a complaint with a supervisory authority, such as the data protection authority in the European Union member state where you live or work, or where the alleged infringement occurred, or the Information Commissioner’s Office in the United Kingdom, if you believe that the processing of your personal data violates the GDPR or the UK GDPR. |
For further information on each of those rights, including the circumstances in which they apply, see the guidance published by the UK Information Commissioner’s Office (ICO), the European Data Protection Board (EDPB), or the national data protection authority of the relevant EU Member State, on individual rights under the General Data Protection Regulation.
Exercising Your GDPR Data Protection Rights
You may exercise your rights of access, rectification, erasure, restriction, portability and objection by contacting us by email at privacy@enalare.com. Please note that we may ask you to verify your identity before responding to such requests. We will respond within the period required by applicable law.
You have the right to complain to a data protection authority about our collection and use of your personal information. If you are in the EEA, please contact your local data protection authority. If you are in the United Kingdom, you may contact the Information Commissioner’s Office.
CHANGES TO THIS PRIVACY POLICY
We reserve the right to modify or supplement this Privacy Policy at any time. Therefore, we recommend that you review this Privacy Policy, updated and posted on the Website, regularly for changes. The effective date of this Privacy Policy, as stated above, indicates the last time this Privacy Policy was revised.
Your continued use of the Website after we have changed the Privacy Policy signifies your acceptance of the revised terms. This Privacy Policy may be changed from time to time to reflect changes in our practices concerning the collection and use of personal information related to your use of the Website. Under certain circumstances, including with respect to material changes to this Privacy Policy, we may also elect to notify you through additional means, such as by posting a notice on the Website or sending you an email. The revised Privacy Policy will be effective immediately upon posting to the Website.
OUR OTHER PRIVACY POLICIES AND NOTICES
This Privacy Policy provides a general statement of the ways in which Enalare protects your personal information when you access and use the Website. It does not apply to information governed by a separate notice or process. In particular, personal information relating to participants in Enalare’s clinical studies is governed by the informed consent documentation and the study-specific privacy notices applicable to those studies, and not by this Privacy Policy. Information relating to Enalare employees, contractors and job applicants is likewise governed by separate notices.
CONTACT US
If you have any questions about this Privacy Policy, you can contact us:
By email: privacy@enalare.com
By mail:
Enalare Therapeutics Inc.
107 Gilbreth Parkway
Mullica Hill, NJ 08062
Attn: Legal Department