Effective date: 04-06-2026

This Policy supplements the Star Therapeutics, Inc.’s Privacy Policy. In the event of any conflict regarding Consumer Health Data, this Policy controls.

Summary

This Policy, supplements Star’s Privacy Policy. In the event of a conflict, regarding Consumer Health Data, this policy controls. Together these policies explains how we handle Consumer Health Data collected through our website — including our Connect With Us page. Here is what you should know:

• You have the right to know whether we collect your Consumer Health Data and how we use it.
• You have the right to obtain a copy of your Consumer Health Data, free of charge.
• You have the right to withdraw consent to our collection and sharing of your Consumer Health Data.
• You have the right to delete your Consumer Health Data.
• We do not sell Consumer Health Data.
• We do not use geofencing near healthcare facilities.

To exercise your rights, contact us at privacy@star-therapeutics.com

1. Scope and Applicability

Star Therapeutics, on behalf of itself and its affiliates, (“Star,” “we,” “us,” or “our”) provides this U.S. Consumer Health Data Privacy Policy (“Policy”) to explain our practices regarding Consumer Health Data as defined under the Washington My Health My Data Act (“MHMDA”) and Nevada’s NRS 603A (together, “Consumer Health Data Laws”).

This Policy applies to residents of Washington State and Nevada — and to any individual whose Consumer Health Data is collected within those states — who interact with our website at www.star-therapeutics.com (the “Site”), including through our Connect With Us page as amended or replaced from time to time, along with any implementing regulations, and supplements our Privacy Policy.

This Policy does not apply to personal health information collected from clinical trial participants through study sites, investigators, or research partners, which are governed by separate participant-facing policies and informed consents.

2. What Is Consumer Health Data

“Consumer Health Data” means personal information that is linked or reasonably linkable to you and that identifies your past, present, or future physical or mental health status. For Star, that includes:

• Information you submit through our Connect With Us form — this could include rare disease identification, condition type, age, and clinical trial eligibility interest, together with name, email address, phone number, mailing address, and zip code collected alongside that health information.
• Information collected automatically through your use of our Site — including IP-address-based geolocation and pages visited that may indicate interest in a specific health condition or clinical program.

3. Consumer Health Data We Collect, Use, and Share

The following table sets out the categories of Consumer Health Data we collect, our sources, our purposes, and the third parties with whom we share it.

We do not sell Consumer Health Data. We do not share Consumer Health Data for cross-context behavioral advertising. We do not use geofencing near healthcare facilities.

4. Consent

Where required by Consumer Health Data Laws, we obtain your express separate consent before collecting your Consumer Health Data.

Connect With Us Form

Before you can submit the Connect With Us form, you must affirmatively check the unchecked checkbox confirming that you have read this Policy and consent to the collection and use of your Consumer Health Data as described herein. Pre-checked boxes are not used. Submission of the form is not permitted without this step.

Website Analytics

Where required by applicable law, we present a cookie consent notice to Site visitors before deploying non-essential analytics cookies on health-related pages. You may manage your preferences at any time through our Cookie Preference Center at the bottom of your screen.

Withdrawal of Consent

You may withdraw consent at any time by contacting us at privacy@star-therapeutics.com. Withdrawal does not affect the lawfulness of collection prior to withdrawal. Upon a valid withdrawal request, we will cease collection and use of your Consumer Health Data for the consented purposes, subject to any legal retention obligations.

5. Your Rights

If you are a Washington State or Nevada resident, or your Consumer Health Data was collected in either state, you have the following rights. These rights are subject to exceptions permitted by applicable law.

• Right to confirm and access. You may confirm whether we collect, share, or sell your Consumer Health Data and obtain a copy of it, free of charge.
• Right to withdraw consent. You may withdraw consent to our collection and sharing of your Consumer Health Data at any time. See Section 4 above.
• Right to deletion. You may request that we delete your Consumer Health Data, subject to exceptions for data we are legally required to retain, including under FDA and GCP record-retention requirements applicable to clinical research.
• Right against geofencing. We do not use geofencing to collect Consumer Health Data from individuals near health care facilities.
• Right to non-discrimination. We will not discriminate against you for exercising any right under this Policy.

How to Exercise Your Rights

Submit a request to privacy@star-therapeutics.com with the subject line “Consumer Health Data Rights Request,” or by mail to: Star Therapeutics, Attn: Privacy Team, 201 Haskins Way, Fifth Floor, South San Francisco, CA 94080. We will respond within 45 days. In complex cases, we may extend this period by an additional 45 days and will notify you within the initial period.

Appeals and Complaints

If we deny your request, you may appeal by contacting us at privacy@star-therapeutics.com within 30 days of our response. If your appeal is denied:

• Washington residents may file a complaint with the Washington State Attorney General at www.atg.wa.gov or call 1-800-551-4636.
• Nevada residents may file a complaint with the Nevada Attorney General at ag.nv.gov.

6. Data Security and Retention

We implement technical and organizational security measures appropriate to the sensitivity of Consumer Health Data — including encryption in transit and at rest, role-based access controls, and multi-factor authentication — consistent with our Information Security Program. No method of transmission or storage is completely secure.

Star retains your data for the minimum required retention period according to applicable law. Data is securely deleted or de-identified upon expiration of the applicable retention period.

7. Changes to This Policy and Contact Information

This policy may be revised from time to time. When changes to the Policy are significant, we will inform you through this Policy page.

Questions, concerns, or complaints about this Policy or our Consumer Health Data practices may be directed to: privacy@star-therapeutics.com