Privacy Policy

This privacy notice discloses the privacy practices for the Maxymune Therapeutics, Inc.’s (“Maxymune,” “we,” “us,” or “our”), website, including all pages within this website, including without limitation all related domains, subdomains, mobile versions, and APIs (collectively referred to as “Website”). This privacy notice applies solely to information collected by this Website. It will notify you of the following:

• What personally identifiable information is collected from you through the Website, how it is used, and with whom it may be shared.
• What choices are available to you regarding the use of your data.
• The security procedures in place to protect against misuse of your information.
• How you can correct any inaccuracies in the information.

We collect information that you: (1) provide directly to us through the Website, (2) we collect automatically when you use our Website, and (3) we receive from third parties. This includes information you provide through forms, email, or other direct contact methods. We do not sell or rent your personal information as defined under applicable privacy laws, though we may share your information as described in this Privacy Policy.

We will disclose personal data to public and judicial authorities, regulators, or government bodies and in proceedings when required by law or regulation. We will disclose personal data where required to exercise or protect legal rights.

We will use your information to respond to you, regarding the reason you contacted us. We may use the personal information we collect from you for a variety of purposes permitted by law, including:

• To provide improved administration of our Sites;
• To provide you with content that may be of interest to you;
• To respond to your e-mail inquiries and other requests;
• To measure and analyze audience traffic and improve the quality of your experience with our Website;
• To understand how you use our Sites;
• To detect and prevent fraud and other potentially prohibited or illegal activities and comply with applicable law, our Privacy Policy, and the terms of any applicable agreements; and
• For any other purposes disclosed to you at the time of collection or pursuant to your consent.

Cookies: We may also log information using small data files stored on your hard drive when you visit our Sites (“Cookies”). We may use both session Cookies (which expire once you close your web browser) and persistent Cookies (which stay on your computer until you delete them) to provide you with a more personal and interactive experience on our Sites. This type of information is collected to make the Sites more useful to you and to tailor your experience with us to your special interests and needs. In addition, when we post videos, we may use local shared objects, known as “Flash Cookies,” to store your preferences for volume control or to personalize certain video features. Flash Cookies are different from browser Cookies because of the amount and type of data and how the data is stored. Cookie management tools provided by your browser will not remove Flash Cookies. To learn more about Cookies, please visit https://www.allaboutcookies.org.

Third-Party Sharing: We may share your personal information with service providers, contractors, and other third parties who assist in operating our Website and conducting our business. Any such third parties are contractually bound to keep your information confidential, use it only for the purposes for which we disclose it to them, and handle it in accordance with applicable privacy laws. We may share names, or other contact information that is necessary for the third party to provide these services. These parties are not allowed to use personally identifiable information except for the purpose of providing these services.

Our Website is not intended for children under the age of 13. If we discover that a child under 13 has submitted Personal Information to us, we will promptly delete such information in accordance with applicable law, including the Children’s Online Privacy Protection Act (COPPA).

You may opt out of any future contacts from us at any time. You can do the following at any time by contacting us via the email address or phone number given on our Website:

• See what data we have about you, if any. Some data may be redacted or inaccessible consistent with security precautions.
• Change/correct any data we have about you. We retain the right to keep a copy of any data for compliance or regulatory purposes.
• Express any concern you have about our use of your data.

We will retain Personal Information about you for the period necessary to fulfill the purposes outlined in this Policy. We use industry-standard methods to secure the communication of Personal Information, including HTTPS, from your computer to our servers. In addition, we use industry-standard methods of securing our databases of personal information, including the use of industry-standard encryption and security measures to protect sensitive information transmitted online and stored offline. Except as provided elsewhere in this Privacy Policy, we limit access to personal information those persons in our organization who have a business need for such access. However, you should know that no company, including Maxymune, can fully eliminate security risks associated with Personal Information. We cannot guarantee absolute security of your information.

If you are a resident of California, you have certain privacy rights under the California Consumer Privacy Act (“CCPA”). We honor those rights, as described below, and we are prohibited by law from discriminating against you for exercising any of those rights.

• Right to Know

If you are a California resident, you have the right to know what Personal Information we have collected about you, why we collected it, and the categories of third parties (excluding service providers) with whom we have shared the Personal Information during the past 12 months. (See below on “How to Submit a Request.”) You may request that we provide a description of the categories of Personal Information we have collected (a “Categories Request”) or a request for access to the specific pieces of Personal Information we have collected (a “Specific Pieces Request.”)

If you make a Categories Request, and you do not have any type of account with us, we will need you to provide us with at least two data elements specific to you, such as your cell phone number or name (depending on the data elements we already maintain about you), so that we can verify your identity. After we confirm that your request is a verifiable consumer request, we will disclose to you:

• The categories of Personal Information we collected about you.
• The categories of sources for the Personal Information we collected about you (g., social media websites, government records available to the public, etc.).
• Our business or commercial purpose for collecting that Personal Information.
• The categories of third parties other than service providers (if any) with whom we shared the Personal Information.

If you make a Specific Pieces Request, we need to be sure we have verified your identity with great certainty to safeguard your privacy. In order for to verify your identity, if you do not have any type of account with us, you will need to provide to us at least three data elements specific to you, together with a signed declaration under penalty of perjury that you are the consumer whose personal information is the subject of the request. After we confirm that your request is a verifiable consumer request, we will disclose to you the specific pieces of Personal Information we collected about you that you requested.

• Right to Request Deletion

You have the right to request that we delete any of your Personal Information that we collected from you and retained. We are not obligated to comply with your request if we have a legal basis to retain the Personal Information. If you make a request for us to delete Personal Information, and you do not have any type of account with us, we may need you to provide us with at least two data elements specific to you so that we can verify your identity. Once we receive and confirm that your request is a verifiable consumer request (see below on “How to Submit a Request”), we will inform you whether we have deleted (and have directed our service providers to delete) your Personal Information from our records, or whether we are declining to grant your request to delete due to an exception to the CCPA deletion requirements.

• Exceptions

• How to Submit a Request

To request access to or deletion of your Personal Information as described above, please submit a verifiable consumer request to us by:

• Mailing your request to: Maxymune Pharmaceuticals, Inc., 95 Main St., Suite 9, Los Altos, CA 94022, Attention: Privacy Officer

You may make a request on your own behalf, and if you are the parent or guardian of a minor child, you also may make a request related to your child’s Personal Information. If you wish to designate an authorized agent to make a request on your behalf, please provide us with a signed declaration stating that your intent is to permit that individual to act on your behalf and include such individual’s full name, address, email address, and phone number. That way we will be sure you have fully authorized us to act in accordance with the requests of that individual.

As indicated above, in order to protect your Personal Information from unauthorized disclosure or deletion at the request of someone other than you or your legal representative, Maxymune requires identification verification before granting any request to provide copies of, know more about, or delete your Personal Information. We take special precautions to help ensure this. We cannot respond to your request or provide you with Personal Information if we cannot verify your identity or authority to make the request and confirm that the Personal Information relates to you. We will only use Personal Information collected in connection with a verifiable consumer request to verify the requestor’s identity or authority to make the request.

We endeavor to respond to a verifiable consumer request within forty-five (45) days of its receipt. If we require more time (up to 45 additional days), we will inform you of the reason and extension period in writing.

Your Personal Information collected by us through our Sites or otherwise will be processed in the United States, where laws regarding the processing of Personal Information may be less protective than the laws in your country. By providing us with your Personal Information, you are consenting to our processing the information in the United States in accordance with applicable law. To the extent Maxymune collects Personal Information about you from third parties located outside the United States, Maxymune intends that the transfer of such information to Maxymune complies with all applicable laws and regulations, including the European Union (“EU”) 2016/679 General Data Protection Regulation (“GDPR”). For Personal Information transferred to Maxymune from third parties located within the European Economic Area, the transfers will be made pursuant to Standard Contractual Clauses (the form clauses issued by the European Commission), in conformity with the GDPR.

If you have questions or concerns regarding this Privacy Notice, or wish to exercise your privacy rights, please contact our Privacy Officer at Maxymune, 95 Main St., Suite 9, Los Altos, CA 94022.

Updated: April 1, 2025