Privacy Policy

Updated October 28 2025

Zag Bio (“Zag Bio”, “we” or “us”) provides and makes available its website located at: zagbio.com (“Website”). Zag Bio is a development stage biotechnology company focused on developing therapeutics to treat autoimmune diseases by training tissue-specific T regulatory cells to enable tolerance induction. The Website provides you with information about our company, our research initiatives and our products in development.

Zag Bio respects the privacy of visitors to our Website and in our communications with you (online via the Website or email and by telephone). The purpose of this Privacy Policy is to inform you how we may use personal information collected from you when you visit the Website or otherwise interact with us. Your privacy is very important to us.

By accessing or using the Website or otherwise communicating with us as described below, you consent to the information collection, disclosure and use practices described in this Privacy Policy. If you do not agree with any of our policies and practices described in this Privacy Policy, your only remedy is not to visit the Website or otherwise interact with us.

This Privacy Policy applies to personal information we collect:

• on our Website;
• in telephone communications with us;
• in email communications with us; and
• in other electronic messages between you and our Website and us.

However, the Privacy Policy does not apply to information collected:

• on any other website operated by us or any third-party unless this Privacy Policy is posted on that website;
• any third party, including through any platform, application or content (including social media) that may link to or be accessible from the Website;
• as part of a clinical trial.

The term “personal information” (or “personal data”) refers to information that identifies, relates to, or could reasonably be linked to you or your household, directly or indirectly.

MEDICAL ADVICE DISCLAIMER 

We are making information on the Website available to you solely for your informational purposes. We do not warrant the accuracy, completeness, or usefulness of this information. Any reliance you place on such information is strictly at your own risk. The information made available through the Website or in our communications with you is not intended to be a substitute for professional medical advice, diagnosis or treatment.

Your access and use of the Website or your communications with us does not create a patient or client relationship between you and Zag Bio. You are encouraged to confirm any information obtained from or through the Website or in our communications with you with other sources and review all information regarding any medical condition or treatment with your physician or other medical professional.

NEVER DISREGARD PROFESSIONAL MEDICAL ADVICE OR DELAY SEEKING MEDICAL TREATMENT BECAUSE OF SOMETHING YOU HAVE READ ON OR ACCESSED THROUGH THE WEBSITE OR IN OUR COMMUNICATIONS WITH YOU.  IF YOU THINK YOU MAY HAVE A MEDICAL EMERGENCY, CALL YOUR DOCTOR OR YOUR LOCAL EMERGENCY TELEPHONE NUMBER FOR IMMEDIATE MEDICAL ASSISTANCE.

Your access and use of the Website, or in your communications with us, does not create a patient or client relationship between you and Zag Bio.

INFORMATION YOU PROVIDE DIRECTLY

Investors or Other Interested Visitors – We may provide investors and other interested visitors to sign up to receive updated information (such as press releases, SEC filings, upcoming presentations, our newsletter) via email. When you interact directly with us for these purposes, or if you email us, or otherwise contact us through the Website, we may collect the following information about you;

• First and last name,
• Telephone number
• Email address
• Role (patient, patient advocate, medical professional, investor, media, other)

Please do not provide any sensitive personal information, such as medical or health-related information via the Website or in other communications with us. We do not request you to provide, and we do not process, any sensitive personal information.

INFORMATION WE COLLECT AUTOMATICALLY

When you visit our Website, we automatically capture the following information:

• Domain Name – through which you access the Internet and the Website (for instance, MSN, Google, Yahoo, etc.)
• IP address – from the computer, smartphone or other device used to access the Website
• Web browser – and operating system used to access the Website
• Date and time – you accessed the Website
• Pages – you visited on the Website
• Referral Internet address – of the website from which you clicked to get to our Website
• Search terms – used in a search engine (like google.com) that brought you to our Website

Cookies — Cookies are small data files that are commonly stored on your device when you browse and use websites and online services. We use cookies to improve the Website, for example by remembering you when you return; to provide, analyze, understand and enhance the use of our services; to enforce our terms; to prevent fraud; to improve the Website’s performance, monitor visitor traffic and actions on the Website and to understand interactions with our emails. Some of these cookies may be active during the time you are viewing a website (“session cookies”). Other cookies may remain on your computer after you have closed your browser or turned off your computer (“persistent cookies”).

We deploy “Necessary” cookies to provide the Website, such as to authenticate and identify returning users. We do not use cookies to serve online advertising, whether on our Website or on other websites. You can set your browser to accept all cookies, reject all cookies, or notify you when a cookie is set. See www.allaboutcookies.org to learn how to disable cookies on your browser or otherwise opt out of cookies. If you set your browser to disable all cookies or opt out, some features of the Website may not function properly. Please note that Necessary cookies cannot be disabled.

The cookies sent by the Website are used only by the Website and are not used to collect personal information without your permission. If you choose to provide us with personal information (such as your e-mail address), that information could be linked to the data stored in the cookie. We reserve the right to change our use of cookies and our practices regarding linkage to personal information without prior notification.

Be advised that this Privacy Policy does not cover the use of cookies used by third parties, and we are not responsible for their privacy policies and practices. Please be aware that cookies placed by third parties may continue to track your activities online even after you have left our Website.

CLINICAL TRIAL RECRUITMENT

From time to time, we may invite individuals to express interest in participating in clinical trials that we or our partners may sponsor. Individuals should provide only their contact information as directed (e.g., name, phone number and email address) and not submit any sensitive personal information (such as health, genetic, or medical data) through this Website or via email; any such information will only be collected through secure and approved channels after appropriate notice and consent.

Please note that this Privacy Policy does not apply to personal information, including any sensitive personal information, collected as part of clinical trials.

JOB APPLICANTS

If you apply for a position with us, you will be asked to provide certain personal information to enable us to process your application: name, telephone, email address, CV/resume and address. Note that if you submit your application information via social media (e.g., LinkedIn) email or regular mail, your included personal information will also be treated in accordance with this Privacy Policy.

HOW WE USE AND DISCLOSE INFORMATION

In general, personal information you submit to us is used either to respond to requests that you make, or to aid us in serving you better. Zag Bio will not sell, share, or otherwise distribute your personal information to third-party individuals and entities for their independent purposes, such as to market products or services to you. However, personal information may be transferred to third parties for further processing on behalf of Zag Bio, or in connection with our business   and in accordance with the purposes for which the information was originally collected. Where disclosure of personal information to a third party occurs for this purpose, we will endeavor to ensure that the processing of this information is performed in accordance with the purposes and within the limits under which the information was originally collected.

Be advised that Zag Bio will not treat as confidential any information that you provide that is not personal or is not associated with any personal information, such as questions, suggestions, or comments you may provide to us. Zag Bio is free to disclose and use this non-confidential information for any purpose, without any obligation whatsoever to you.

We may disclose personal information for the following purposes:

• To comply with our legal obligations;
• To designated contractors, service providers, and other third parties we use to support our business (and who are required to ensure the security of the personal information);
• To a buyer or other successor in the event of a merger, divestiture, restructuring, reorganization, dissolution, or other sale or transfer of some or all of Zag Bio’s assets, whether as a going concern or as part of bankruptcy, liquidation, or similar proceeding, in which personal information held by Zag Bio about our Website’s visitors and email lists are among the assets transferred;
• To protect our rights or interests or the rights and interests of others;
• For any other purpose disclosed by us when you provide the information; and
• With your consent.

We may also disclose your personal information:

• To comply with any court order, law, or legal process, including to respond to any government or regulatory request;
• To enforce or apply our agreements, including for billing and collection purposes; and
• If we believe disclosure is necessary or appropriate to protect the rights, property, or safety of Company, our customers, or others.

We do not use your personal information with any automated decision-making process, including profiling, which may produce a legal effect concerning you or similarly significantly affect you.

Lawful Basis

We have a lawful basis for our processing of your personal information, including processing for our legitimate interests (when balanced against your rights and freedoms), to fulfill our obligations to you under a contract with you, and required by law, and with your consent, as described below:

• Consent. By using our Website, you consent to our collection, use, and sharing of your personal information as described in this Privacy Policy. If you do not consent to this Privacy Policy, please do not use the Website.
• Legitimate Interests. We will process your personal information as necessary for our legitimate interests. Our legitimate interests are balanced against your rights and freedoms, and we do not process your personal information if your rights and freedoms outweigh our legitimate interests. Our legitimate interests may include safeguarding our IT infrastructure and intellectual property.
• As Required by Law. We may also process your personal information when we are required or permitted to by law; to comply with government inspections, audits, and other valid requests from government or other public authorities; to respond to legal process such as subpoenas.
• To Protect Ourselves or Others. We may process your personal information as necessary for us to protect our interests or otherwise pursue our legal rights and remedies (for instance, when necessary to prevent or detect fraud, attacks against our network, or other criminal and tortious activities), defend litigation, and manage complaints or claims.

YOUR CHOICES AND RIGHTS

As set forth in this Privacy Policy, we collect minimal personal information about you. However, applicable data protection laws may nonetheless provide you with certain rights with regards to our processing of your personal information, including:

• Access your personal information held by us;
• Know more about how we process your personal information;
• Correct inaccurate personal information and, taking into account the purpose of processing the personal information, ensure it is complete;
• Erase or delete your personal information (also referred to as the right to be forgotten), to the extent permitted by law;
• Restrict our processing of your personal information, to the extent permitted by law;
• Transfer your personal information to another party (right to “data portability”), to the extent possible;
• Object to any processing of your personal information;
• Opt out of certain disclosures of your personal information to third parties;
• Not be discriminated against for exercising these rights; and
• Withdraw your consent at any time (to the extent we base processing on consent), without affecting the lawfulness of the processing based on such consent before its withdrawal.

You may exercise any of the above rights by contacting us via email at: info@zagbio.com. If you contact us to exercise any of the foregoing rights, we may ask you for additional information to verify your identity. We reserve the right to limit or deny your request if you have failed to provide sufficient information to verify your identity or to satisfy our legal and business requirements. Please note that if you make unfounded, repetitive, or excessive requests (as determined in our reasonable discretion) to access your personal information, you may be charged a fee subject to a maximum set by applicable law.

We will not collect, use, or disclose your personal information in any way or for any purposes that are materially different from those set forth herein. However, if we wish to do so in the future, we will obtain your consent first and offer you the choice to opt out of such proposed collection, use, or disclosure.

If you have signed up to receive notifications from us via email, such as a in an email newsletter, you can opt out at any time by using the “Unsubscribe” feature at the bottom of each email from us or by requesting to opt out by emailing us at: info@zagbio.com.

If we send you promotional or marketing messages, you also can opt out of receiving our marketing or promotional email communications by using the “Unsubscribe” feature at the bottom of each email from us or by requesting to opt out by emailing us at: info@zagbio.com. Please note, however, that you cannot opt out of receiving communications from us regarding services you may request, any account with us or other transactional or administrative issues.

LOCATED IN THE UNITED STATES

Zag Bio is located in the United States. Information that we collect will be stored and processed in the United States in accordance with this Privacy Policy. We may transfer and access personal information from around the world, including but not limited to the United States. This Privacy Policy shall apply even if we transfer personal information to other countries. By accessing the Website, you consent to this transfer, processing, and storage of your personal information in the United States or other jurisdictions, including to jurisdictions in which the privacy laws may not be as comprehensive as those in the country where you reside. Note that your personal information may be available to the United States government or its agencies under legal process in the United States.

CALIFORNIA PRIVACY RIGHTS

“Shine The Light” Law — California residents with whom we have an established relationship have the right to request certain information with respect to any personal information that a business may have shared with third parties for their direct marketing purposes. Alternatively, we may provide a cost-free means to opt out of such sharing. Note, however, that Zag Bio does not disclose your personal information to other companies for their marketing purposes.  If you have any questions, please email us at: info@zagbio.com.

For California residents under the age of 18 and registered users of our Website, California law (Business and Professionals Code § 22581) provides that you can request the removal of content or information you posted on websites.  Any such request should be sent to us at: info@zagbio.com along with a description of the posted content or other information to be removed.  Be advised, however, that applicable law may not permit us to completely or comprehensively remove your deleted content or for other reasons as set forth in this California law.

California Consumer Privacy Act (CCPA) – Zag Bio is not subject to the CCPA; however, to the extent applicable, we will honor requests from California residents seeking to exercise their privacy rights under the CCPA. Please submit any such requests via email at: info@zagbio.com.

OTHER U.S. STATES PRIVACY LAWS

In addition to California, to date multiple US states have enacted similar consumer privacy laws: Colorado, Connecticut, Delaware, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah, and Virgina. A few other states, Florida, Maine, Michigan, Nevada, New York, Vermont and Washington States have enacted laws focused on specific data privacy issues.

Residents of these states may have similar privacy rights to those in the CCPA. To the extent applicable, we will honor privacy rights requests under these other US state consumer privacy laws.  Please email us at: info@zagbio.com along with proof of your state residency.

VISITORS FROM THE EEA, UK AND SWITZERLAND

Zag Bio currently does not operate or conduct business in the European Economic Area (EEA), United Kingdom or Switzerland. We control and operate the online and mobile resources from within the United States, although we do not actively block or monitor visitors from other countries or regions. If you are an individual in EEA, United Kingdom or Switzerland, we may collect and process personal information about you as described in this Privacy Policy when you visit our online and mobile resources. Although we are not subject to the GDPR, we will honor verified requests from individuals from the EEA, United Kingdom or Switzerland seeking to exercise their privacy rights under the GDPR, the UK GDPR or the Swiss Federal Act on Data Protection. Please send your request to our email at: info@zagbio.com.

SECURITY AND DATA RETENTION

We will only collect and use personal information in accordance with this Privacy Policy and to the extent deemed reasonably necessary to serve our legitimate business purposes. We have implemented appropriate administrative, technical, and physical security safeguards to ensure the security, integrity, accuracy and privacy of the information you have provided. Please be aware, however, that no information system is totally secure, and therefore we cannot guarantee against all potential security breaches. While we will use reasonable security and monitoring controls in accordance with general industry standards to secure information you provide to us consistent with our legal requirements, we cannot guarantee that such information will not be unlawfully or illegitimately obtained by unauthorized parties.

We will generally retain your personal information for as long as it is needed to provide the Website to you or to provide any services you request (such as if you sign up to receive our emailed newsletter), unless there is a legal or legitimate business reason to retain it for a longer period.

In addition, we may retain your personal information for the following purposes:

• to provide a requested service;
• for as long as necessary to comply with any legal requirement;
• on our backup and disaster recovery systems in accordance with our backup and disaster recovery policies and procedures;
• for as long as necessary to protect our legal interests or otherwise pursue our legal rights and remedies; and
• for data that has been aggregated or otherwise rendered anonymous in such a manner that you are no longer identifiable, indefinitely.

LINKS TO OTHER WEBSITES

Any third-party websites linked to or from the Website may have different privacy policies. When you access these external websites, the providers of these websites may have access to certain information about you. You are encouraged to carefully review their privacy policies. Zag Bio is not responsible for the privacy practices or the content of any websites that we do not directly control.

CHILDREN

The Website is not directed to or intended for children under 18. We do not knowingly collect information from persons under 18. If you believe that we might have collected any personal information from a child under 18, please contact us at: info@zagbio.com as soon as possible so we may delete the information.

CHANGES TO THIS PRIVACY POLICY

We may revise this Privacy Policy at any time as we may deem appropriate and consistent with the principles described herein, our evolving business needs, or changes in applicable laws or regulations. If we make any changes to this Privacy Policy, we will update the Effective Date above and/or notify that the policy has been revised. Your continued access and use of the Website after such changes have been made constitutes informed consent of those changes.

HOW TO CONTACT US

If you have any concern about this Privacy Policy or our privacy practices, please contact us at:

Zag Bio, Inc.
21 Erie Street
Cambridge, Massachusetts 02139 USA
Email: info@zagbio.com