Last Updated: 15.06.25

Thank you for your interest in Epia Neuro. Your privacy is important to us, and this Privacy Policy describes how Epia Neuro, Inc. ("Epia Neuro," "we," "our," or "us") collects,uses, shares, discloses, and otherwise processes personal information when you access and use [www.epianeuro.com] and any content and functionality offered on or through the site (collectively, the"Services").

We may update this Privacy Policy from time to time. The "Last Updated" date at the top of this Privacy Policy indicates when it was lastrevised. Changes become effective when we post the revised Privacy Policy. Your continued use of the Services after posting constitutes your acceptance of the updated policy.

The Services are not designed for or directed to children under the age of 18. We do not knowingly collect personal information from anyone under theage of 18. If we become aware that we have collected personally identifiableinformation from a child, we will take steps to delete that information.

CAUTION: The Services provide information concerning investigational devices limited by federal (United States) law to investigational use. The Services do not provide, and no content shall be construed as, medical, clinical, regulatory, or legal advice.

1. How We Collect Personal Information

We may collect information about you through the following methods:

Information collected automatically through your use of the Services,including through cookies, pixel tags, and similar technologies, as describedin Section 3 below.

Information you provide directly to us, such as:

• Through forms, portals, or interactive features on the Services
• When you communicate or interact with us, whether at your initiation or in response to a communication from us
• When you contact us by phone, email, or other communication channel

Information from other sources, such as:

• Online platforms (e.g. LinkedIn, Instagram, X/Twitter) if you engage with our content or communicate with us on those platforms
• Business partners, service providers, or vendors acting on our behalf
• Publicly available sources, including professional directories and news sources

Where required by applicable law, we obtain express consent beforecollecting or using sensitive information. You may withdraw consent at anytime, subject to legal or contractual restrictions, by contacting us using thedetails provided below.

Note: We donot collect medical, health, genetic, or biometric information through theServices. Any information collection conducted in connection with researchactivities or clinical programs is governed by separate protocols, informedconsent documents, and applicable regulatory requirements, and is not coveredby this Privacy Policy.

2. Types of Personal Information We Collect

We may collect the following categories of personal information throughthe Services:

• Contact information: name, email address, mailing address, and phone number
• Internet and network identifiers: IP address, browser type, operating system, device identifiers, and information regarding your approximate geolocation
• Communication records: information contained in correspondence you send to us or that we exchange with you, including via email, web forms, or social media
• Professional information: professional role, title, institutional or organizational affiliation, credentials
• Usage data: Pages visited, time spent on pages, referring URLs, clickstream data, and interactions with the Services

Note regarding employment applications: If you apply for a position at Epia Neuro, the collection and processing of yourapplication information (resume, cover letter, work history, education, and related materials) is governed by the privacy policy of our applicant tracking system provider, which will be presented to you at the point of applicationsubmission. This Privacy Policy does not govern that information.

3. Cookies And Similar Technologies

We may use cookies, pixel tags, and similar technologies to collectinformation about your use of the Services.

• Cookies are small data files stored on your device by your browser that allow our servers to recognize your browser and collect usage information.
• Pixel tags (also called web beacons) are small code blocks placed on web pages that allow us or a third party to see that you have viewed a page.

Typesof cookies we may use:

We may use these technologies to analyze and track usage data, improvethe operation of the Services, better understand how visitors interact with oursite, and remember your preferences.

Google Analytics. We may use Google Analytics to evaluate website traffic and usage. Google Analytics uses cookies and similar technologies to collect and analyze information about the use of the Services and report on activities and trends. This service may also collect information regarding the use of other websites, apps, and online services. For more information about how Google collects and processes data, visit https://policies.google.com/technologies/partner-sites. To opt out, visit https://tools.google.com/dlpage/gaoptout/.

Your choices. Your browser may allow you to reject cookies or send "Do Not Track" signals. Please note that if you reject cookies, some features ofthe Services may not function properly.

Global Privacy Control (GPC). We honor Global Privacy Control (GPC) signals. If your browser or an extension transmits a GPC signal, we will treat that signal as a valid opt-out request for any processing that constitutes “selling”or “sharing” of personal information under applicable state privacy laws.

4. How We Use Personal Information

We may use your personal information for the following purposes:

• To communicate with you, including responding to inquiries and providing information you request about Epia Neuro or our research programs
• To maintain, provide, improve, and protect the Services
• To send newsletters, press updates, event invitations, or other informational communications you have requested or consented to receive
• To verify your identity and respond to your requests, questions, and feedback
• To comply with regulatory or legal obligations
• To protect the safety and rights of Epia Neuro, our personnel, and our partners
• To detect, prevent, and address fraud, security, or technical issues
• For other uses consistent with disclosures made at the time of collection and your consent

Marketing andinformational communications. Where you have subscribed to newsletters or pressupdates, we will use your contact information solely for the purposes describedat the time of subscription. You may opt out of these communications at anytime by following the unsubscribe instructions in any such communication or bycontacting us at privacy@epianeuro.com.

5. How We Share Your Personal Information

We may share your personal information with the following categories ofrecipients:

• Service providers and vendors who perform services on our behalf, including communications platforms, hosting, security, and analytics providers, subject to contractual confidentiality and data protection obligations
• Epia Neuro's corporate affiliates, if any
• Professional advisors, such as accountants, lawyers, and auditors, as necessary for the provision of their services
• As required by law, including in response to lawful requests by public authorities or to comply with regulatory obligations
• To enforce our Terms of Service and protect our rights, privacy, safety, or property
• In connection with a corporate transaction, such as a merger, acquisition, divestiture, reorganization, or sale of assets, where your information may be among the assets transferred

We do not sell your personal information. We do not share your personalinformation with third parties for targeted advertising or cross-context behavioral advertising purposes or lead generation purposes. We do not share or sell consumer personal information, includingphone numbers, to third parties or affiliates for marketing or promotionalpurposes.

We take reasonable steps to ensure that recipients of your personal information are bound by adequate confidentiality and data protection obligations.

6. How We Protect Personal Information

We implement administrative, technical, and physical safeguards designedto protect personal information against accidental or unlawful destruction,loss, alteration, unauthorized disclosure, or access. These measures include encryption, access controls, firewalls, and security testing.

Despite these safeguards, no method of transmission over the internet orelectronic storage is completely secure, and we cannot guarantee absolutesecurity. You are responsible for safeguarding any credentials used to accessthe Services and for notifying us immediately of any suspected unauthorizedaccess.

7. How We Store And Protect Personal Information

Epia Neuro is based in the United States. Any information you provide to us will be stored and processed in the United States. If you are located outside the United States, your personal information will be transferred to andprocessed in the United States.

International visitors. We recognize thatvisitors to the Services may be located in jurisdictions with data protectionlaws that differ from those in the United States, including the European Economic Area (EEA), the United Kingdom, Canada, and Australia. While we do notcurrently target or direct the Services to individuals in these jurisdictions,if you access the Services from outside the United States, you acknowledge thatyour personal information will be transferred to, stored, and processed in theUnited States. We take appropriate measures to protect your information duringthese transfers in accordance with this Privacy Policy and applicable law.

Should our operations expand to jurisdictionsgoverned by the EU General Data Protection Regulation (GDPR), UK GDPR, orequivalent frameworks, we will update this Privacy Policy to provide theadditional disclosures and rights required by those laws.

Retention. We retain personal information for as long as necessary to fulfill thepurposes for which it was collected, to comply with legal, regulatory, andrecordkeeping obligations, to resolve disputes, and to enforce our agreements.The precise retention periods vary depending on the nature of the information,the purpose for which it was collected, and applicable legal requirements. Whenpersonal information is no longer needed, we will securely delete orde-identify it in accordance with applicable law. We may also anonymize orde-identify your personal information so that it can no longer be associatedwith you, and such information may be retained indefinitely.

8. Your Rights And Choices

Depending on your jurisdiction, you may have the following rights with respectto your personal information:

• Right to know/access: Request information about the categories and specific pieces of personal information we have collected about you
• Right to correct: Request correction of inaccurate personal information
• Right to delete: Request deletion of your personal information, subject to certain legal exceptions
• Right to opt out: Opt out of the sale or sharing of your personal information (we do not sell or share personal information for advertising)
• Right to limit use of sensitive personal information[SC20] : Where applicable, request that we limit the use of sensitive personal information to purposes permitted by law
• Right to non-discrimination: We will not discriminate against you for exercising your privacy rights

Opting out of communications. You may opt out of marketing orinformational emails by following the unsubscribe instructions in the relevantcommunication or by contacting us at privacy@epianeuro.com. Even if you optout, we may still administrative or transactional communications that are notmarketing in nature.

Updating your information. If your personal information changes or is otherwiseinaccurate, please contact us at privacy@epianeuro.com with the updated information.

To exercise any of your rights, please contact us at privacy@epianeuro.com. We will verify your identity before processing your request.

9. California Consumer Privacy Act (CCPA) Disclosure

This section applies to residents of California, as required by theCalifornia Consumer Privacy Act, as amended by the California Privacy RightsAct ("CCPA/CPRA").

Categories of personal information collected (in the preceding 12 months):

Sources of collection: Directly from you; automatically through the Services; from publiclyavailable sources and business partners.

Business purposes for collection: As described in Section 4 above.

Disclosure for business purposes: We may disclose personal informationto service providers, clinical sites, and professional advisors as described inSection 5.

Sale/sharing: We do not sell personal information. We do not share personalinformation for cross-context behavioral advertising.

Right to limit use of sensitive personal information: Where we collectsensitive personal information, we use it only for purposes permitted under theCCPA/CPRA (other than account login credentials, if applicable).

Authorized agents: You may designate an authorized agent to submit a request on yourbehalf. We may require verification of both your identity and the agent'sauthority.

To exercise your CCPA rights, contact us at [privacy email]. We willverify your identity before processing your request.

10. Additional State Privacy Law Notice

Residents ofstates with comprehensive privacy laws (including, without limitation,Virginia, Colorado, Connecticut, Oregon, Texas, Montana, and other states astheir respective laws become effective) may have similar rights to thosedescribed in Section 8 and Section 9 above, including the right to access,correct, delete, and opt out of certain processing of personal information. Wewill respond to requests from residents of these states in accordance withapplicable law.

If you are aresident of a state with an applicable privacy law and wish to exercise yourrights, please contact us at privacy@epianeuro.com.If we decline your request, you may have the right to appeal our decision.Instructions for submitting an appeal will be provided in our response.

11. Third Party Sites & Consent

The Services may contain links to websites, platforms, or servicesoperated by third parties. These links are provided for convenience only and donot constitute endorsement or affiliation. We do not control third-party sitesand are not responsible for their privacy practices. We encourage you to reviewthe privacy policies of any third-party sites you visit.

12. Contact Us

If you have questions or concerns about this Privacy Policy or our datapractices, please contact us at:

Epia Neuro, Inc.
400 Wind River Way, Suite 102

Alameda, CA 94501
privacy@epianeuro.com