Effective Date: 15th of April, 2025

Cycle is committed to being transparent about the ways in which we collect and process your information. This privacy policy (“Privacy Policy”) describes our practices for handling the information we collect about you through our operations, applications, and services that include an authorized link to or reference to this Privacy Policy (“Services”). The Services include our websites and mobile apps that link to this Privacy Policy. This Privacy Policy applies to United States audiences only; if you are outside of the United States, please visit the applicable Privacy Policy here.

When this policy refers to us as “we,” “our”, or “Cycle,” it means Cycle Pharmaceuticals Limited and all of its affiliate companies located in the United States.

Assurances by Cycle:

• No mobile information will be shared with third parties or affiliates for marketing or promotional purposes.
• Cycle is committed to endeavoring that any third party with whom Cycle shares user data, such as analytics tools, advertising networks, third party software developers, as well as any parent, subsidiary or other related entity that will have access to the data, will provide the same or equal protection of user data as stated in this privacy policy and as required by the guidelines of the relevant software application vendor.
• Cycle will only retain data for as long as necessary to fulfill the purposes outlined in this privacy policy unless otherwise required by law. When Cycle has no ongoing legitimate business need to process your personal information, Cycle will either delete or anonymize the information.
• You may review, change or terminate your account at any time. You can withdraw your consent to use your information at any time by contacting Cycle by using the contact details provided in the contact section.

Depending on your relationship to Cycle, we may collect the following categories of information:

• Identifiers, such as your name, contact information, and online identifiers.
• Professional information and educational information, such as information about your medical specialty.
• Demographic information, such as gender and marital status.
• Medical, health, and biometric information, such as medical condition and biological characteristics.
• Internet and electronic network activity information, such as your IP address and information about your interaction with our online Services.
• Geolocation information.
• Audio, electronic, and visual information, such as identifiable photographs and video.
• Correspondence you send to us.

• We collect information directly from you, such as when you provide information to our Services, whether electronically, by calling us, through other means, or when you authorize others to provide it to us.
• We collect information about you through tracking tools and when we observe other information about you. See “Cookies and Similar Technologies” for more information.
• Third parties may also share information about you with us. For example, our research partners and other partners may give us information. We may receive information from commercial sources such as companies that maintain information about health care providers and their specialties.
• We may aggregate or de-identify the information described above. Aggregated or de-identified data is not subject to this Privacy Policy.

We use and otherwise process each of the categories of information identified above for the following business purposes and are committed to the following responsibilities:

• Cycle may sell or share your personal health information with third parties.
• To provide you with the information, products and services that you request from us. This includes contacting you regarding such products and Services, such as to communicate information on the proper use of our products, and to provide, collect, review, and communicate information on the quality, safety, or effectiveness of our products.
• To operate our business. We also may use your information to administer our services, including vendor management, troubleshooting, data analytics, testing, research, and statistical and survey activities.
• For research and development of our products, including scientific, business, and market research.
• To make suggestions and recommendations to you about products or Services that are similar to those you have enquired about or may otherwise be of interest to you, or to send you promotional materials from us or by our affiliates and trusted business partners.
• To improve our Services, and to ensure that content is presented in the most relevant and effective matter for you and for your devices.
• To keep our Services, business and users safe and secure, and to protect the rights and Services of others.
• To comply with applicable legal and regulatory obligations, and to protect or exercise our legal rights or defend against legal claims. This includes using your information to comply with regulatory requirements relating to the safety and efficacy of our products.

We may share the personal information we collect with certain third parties.

• Regulatory requirements. We may use your information in submitting reports or other materials to the U.S. Food and Drug Administration. We may also use information you provide regarding your experience with any of our products to contact your healthcare professional regarding an unexpected event involving the use of any of our products.
• Research purposes. We may share your information in connection with research and development, and in ensuring and promoting the safety and efficacy of our products.
• Other third parties. We may share your information with various service providers, contractors, agents, or partners in connection with business services they are providing with or on behalf of Cycle. Examples of such third parties include individuals and companies that develop, host or maintain our websites, or online resources, or those that provide customer service support activities. We also may share your information with third parties with whom Cycle is jointly marketing a product or service or jointly conducting a program or activity.
• Corporate affiliates. We may share your information with our corporate affiliates.
• Business transfers. We may share personal information in connection with a transaction involving all or part of our assets. For example, if all or part of Cycle is sold or merged into another entity, the information we have about you may be transferred to a third party as part of that transaction. We may also share your information in the unlikely event of bankruptcy.
• Legal purposes. We may disclose information to respond to legal process (such as a search warrant, subpoena, or court order), law enforcement requests, legal claims, or government inquiries. We may disclose information to protect and defend our rights or property, and to address security situations or emergencies when safety is at risk.
• With your consent. We may share information for any other purposes disclosed to you at the time we collect the information or pursuant to your consent.

When you use our Services, we and our third-party partners use cookies, pixel tags, local storage, local shared objects, and other similar technologies (collectively, “cookies”) to collect information about your browser or device. By using the Services, you consent to our use of cookies and similar technologies.

The following types of cookies are used on our Services:

• Cookies. Cookies enable us to recognize when a computer being used to browse our website has previously visited a Cycle website. Cookies can also be used to enable a website to ‘remember’ the information a visitor has previously inputted, should that visitor so choose. Cookies may be placed on your computer both by us and by third parties with whom we have a relationship, such as web analytic services and advertising network services. For example, we use Google Analytics, and other analytical/performance cookies to help improve the way our website works.
• Web beacons. On certain web pages or in e-mails we send to you, we may utilize a technology called a “web beacon” (also known as an “action tag” or “clear GIF technology”). We may use web beacons, for example, to help determine which email messages sent by us were opened and whether a message was acted upon. Web beacons also help analyze the effectiveness of websites by measuring, for example, the number of visitors to a website or how many visitors clicked on key elements of a website.
• Social media plugins. The Services may use social plugins (e.g., the Facebook “Like” button) to enable you to post or easily share information with others. When you visit our website, the operator of the social plugin may be able to place a cookie on your computer, enabling that operator to recognize individuals who have previously visited our website. If you are logged into the associated social media website (e.g., Facebook, discussion boards, blogs, wikis,) while browsing on our website, the social plugin allows that social media website to receive information that you have visited our website. The social plugin may also allow the social media website to share information about your activities on our website with other users of their social media website. For more information about the information shared via a particular social media plugin, you should refer to that social media site’s privacy policy.
• Other technologies. There are other local storage and Internet technologies, such as local shared objects (also referred to as “Flash cookies”) and HTML5 local storage, that operate similarly to the cookies discussed above. We also may collect mobile advertising IDs and similar device identifiers to collect your information.

You may be able to refuse or disable cookies by adjusting your web browser settings. Some browsers have options that allow the visitor to control whether the browser will accept cookies, reject cookies, or notify the visitor each time a cookie is sent. Because each web browser is different, please consult the instructions provided by your web browser (typically in the “help” section). Please note that you may need to take additional steps to refuse or disable certain types of tracking technologies, such as local shared objects. For example, local shared objects can be controlled through the instructions on Adobe’s Setting Manager page. If you choose to refuse, disable, or delete these technologies, some of the functionality of the Services may no longer be available to you and any differences in service are related to the data. Deleting cookies may in some cases cancel the opt out selection in your browser.

Some of our third-party partners are members of the Network Advertising Initiative, which offers a single location to opt out of ad targeting from member companies. Due to differences between websites and mobile apps, you may need to take additional steps to opt out of interest-based advertising for mobile applications. Please check your device settings and mobile app permissions for additional information on how to opt out. You also may stop further data collection from a mobile application by removing it from your mobile device.

Do-Not-Track Signals and Similar Mechanisms. Certain web browsers and other programs may be used to signal your preferences to Cycle about how or whether Cycle or third parties may collect information about your online activities. Currently, Cycle does not respond to such signals.

Depending on where you live, you may have certain rights under applicable laws, including

• The right to access your personal information; and
• The right to request the deletion of certain personal information.

If you would like to access or delete your information, or otherwise exercise your rights, please contact us as set out in the Contact Us section below. We will respond in a manner that is appropriate in light of relevant laws. For example, we cannot provide you access to your personal information if we cannot verify your identity, and we may request further information from you to verify your request, such as, where necessary, copies of government-issued identification.

We will not discriminate against you for exercising your rights and choices under California state law. If you would like to use an authorized agent to exercise your rights, we may request evidence that the agent otherwise has valid written authority to submit requests to exercise rights on your behalf.

You also may have the right to be informed as to the categories of personal information that we have collected and shared or otherwise made accessible to third parties during the preceding 12 months. We share your information as described in this Privacy Policy, but we do not, and will not without consent, sell your information to third parties for money or other similar types of consideration.

In addition to other rights California residents may have under state law, California Civil Code Section 1798.83, also known as the “Shine The Light” law permits California residents to request certain information regarding our disclosure of personal information to third parties for their direct marketing purposes. To make such a request, please contact us as set out in the Contact Information section below.  California residents may use the California Privacy Protection Agency Complaint Form at the CPPA’s website.

8.1. Notice: This U.S. State Privacy Notice applies to “Consumers” as defined under U.S. privacy laws. This U.S. State Privacy Notice also applies to our current data practices such that it is also meant to provide you with “notice at collection”. Cycle reserves the right to amend this U.S. State Privacy Notice at Cycle’s discretion at any time. To contact Cycle about this U.S. Privacy Notice, please see the Contact Information section below.
8.2. Purpose: Cycle will collect, retain, use, and disclose your personal data for Cycle’s  business purposes and commercial purposes, which are described above in the remainder of this Privacy Policy. Some of the processing include sale, sharing and targeted advertising.
8.3. The following describes the categories of personal data Cycle collects, the recipient, processing purposes and retention period:

Cycle also may disclose each category of personal data and sensitive personal data in the table to the following categories of recipients in a manner that does not constitute Sale or Sharing:

• The consumer or to other parties at your direction or through your intentional action.
• Recipients to whom personal data is disclosed for legal and similar reasons.
• In addition, Cycle’s vendors and the other recipients listed in the above table may, subject to contractual restrictions imposed by us and/or legal obligations, also use and disclose your personal data for business purposes. For example, Cycle’s vendors and the other categories of recipients listed in the table above may engage subcontractors to enable them to perform services for us or process for our business purposes.

This Service is owned and operated by Cycle, but the information you provide may be accessible by, collected by or transferred to our affiliates and subsidiaries, vendors and suppliers in other countries. Furthermore, this Privacy Policy addresses only information that is or may be collected on our US Services, which are not intended to be used by non-US residents, or information otherwise collected in the United States. If you are using this Service from a country other than the United States, your communication with us will necessarily result in the transfer of information across international boundaries. By using this Service, you consent to the collection, storage, and processing of your information in the United States and in any country to which we may transfer your information in the course of our business operations.

If you have applied for employment or a contract position with Cycle, the information submitted in your job application and that we otherwise collect in evaluating your application will be used for recruitment and other customary human resources purposes including any required government reporting and recordkeeping obligations. This information may include criminal record information and federal exclusion list status, as applicable.

We do not knowingly collect or sell any information from children, as defined by applicable law, without parental consent or as otherwise permitted by applicable law.

We take reasonable steps to protect your information from unauthorized access. You should keep in mind, however, that no internet transmission is ever 100% secure or error free. In particular, email sent to or from a website or online resource may not be secure, and you should therefore take special care in deciding what information you send to us via email. Moreover, where you use user IDs and passwords to access the Services, it is your responsibility to safeguard your access credentials. Please note that information collected by third parties may not have the same security protections as information you submit to us, and we are not responsible for protecting the security of such information.

While our Services may provide links to other third-party websites as a service to our visitors, we do not endorse, nor are we responsible for the content of such third-party sites. Furthermore, this Privacy Policy does not apply to third-party websites, even if they are accessed through a link from a Cycle website or online resource or otherwise directed to by one of our Services. We encourage you to review the privacy policies of any third-party website before providing any personal information.

Questions about this Privacy Policy may be directed to: legal@cyclepharma.com or you can write to us at:

Cycle Pharmaceuticals Ltd
The Broers Building
21 JJ Thomson Ave
Cambridge, CB3 0FA, UK

California residents may also exercise their rights through a web form on the California Privacy Protection Agency website.

For opt-out or requests for data to be removed can be made by calling contacting any of the above addresses or calling +1 877-835-5784.

Opt-out requests will be responded to as soon as feasibly possible, up to a maximum of 15 business days from the date Cycle receives your request to opt-out.

Requests to delete data will be responded to within 45 calendar days. Cycle can extend the deadline by another 45 days (90 total days) if Cycle notifies you that more time is needed.

For opt-out of whether you wish to receive promotional emails, SMS messages, telephone calls, postal mail from Cycle please contact the above addresses or phone number, or follow the opt-out instruction on the application, SMS message, email, or telephone call as applicable.

We reserve the right to amend this Privacy Policy at our discretion. Many states are passing new laws for the rights of consumers to protect their personal data and Cycle continues to keep this policy current with the new laws. When changes are made to this Privacy Policy, we will post the updated policy and the date the last revisions were made.

Date of last revision 1st of February, 2025

Cycle Pharmaceuticals, Inc