Privacy Policy

PRIVACY POLICY

Last Updated: June 30, 2026

PLEASE READ THIS PRIVACY POLICY CAREFULLY TO UNDERSTAND OUR POLICIES AND PRACTICES REGARDING YOUR INFORMATION. BY ACCESSING OR USING OUR SERVICES OR PROVIDING US WITH YOUR INFORMATION, YOU AGREE TO THE COLLECTION, USE AND SHARING OF YOUR INFORMATION AS DESCRIBED IN THIS PRIVACY POLICY. IF YOU DO NOT AGREE, DO NOT USE THE SERVICES.

THIS PRIVACY POLICY MAY CHANGE FROM TIME TO TIME (SEE CHANGES TO THIS PRIVACY POLICY). YOUR CONTINUED USE OF THE SERVICES AFTER WE MAKE CHANGES AS DESCRIBED HERE IS DEEMED TO BE ACCEPTANCE OF THOSE CHANGES, SO PLEASE CHECK PERIODICALLY FOR UPDATES.

Pheast Therapeutics, Inc. (the “Company”, “we”, “us”, “our”) respects your privacy and is committed to protecting your personal data through our compliance with this Privacy Policy. This policy describes how we collect, process, retain and disclose personal data about you when providing services to you through our website (pheast.com), including email or other communications between you and our company through our website (collectively, the “Services”). This policy does not apply to any information collected by us offline or collected by a third party (including our affiliates) through websites accessible through links contained in the Services.

Any information you provide or we collect may be transmitted for processing and/or storage to a country other than your country of residence, and it may also be communicated to third parties hired by us to provide services such as website hosting, database management, or analytics. By using our website, you consent to the collection, use, storage, and processing of your Personal Information (as defined below) in the United States and in any country to which we may transfer your Personal Information as part of our business operations.

CHILDREN'S PRIVACY

Our Services are not intended for children under the age of 18 and we do not knowingly collect, use, or disclose any Personal Information from children under the age of 18. If you believe that we have done so, please email us at contact@pheast.com or write us at the address listed in the Contact Information section below, and we will take appropriate action in line with applicable law.

‍

PERSONAL INFORMATION WE COLLECT OR PROCESS

When you visit our website or use our Services, you may voluntarily provide, or we may automatically collect and store, information that can (directly or indirectly) identify, locate, or be used to contact you or communicate with you (“Personal Information”).

The types and categories of Personal Information we collect or process include:

Personal and business contact information, such as your first and last name, email address, postal address, phone number, job title, employer name and other contact information you provide us.
Professional credentials, such as educational and work history, industry and institutional affiliations, and other information of the type that would be included on a resume or curriculum vitae.
Usage information, such as information about how you use the website and interact with us.
Feedback and correspondence, such as information you provide when you contact us with questions, report a problem with the Services, or otherwise correspond with us.
Device information, such as your IP address, device identifiers, operating system and version, hardware identifiers, browser type and settings, domain name, host, length of user session and the pages to which you navigate, browser information and operating system you use and other system settings, as well as the language your system uses and the country, region, and time zone where your device is located and other device information.

We also collect:

Statistics or aggregated information. Statistical or aggregated data does not directly identify a specific person, but we may derive non-personal statistical or aggregated data from Personal Information.
Technical information. Technical information includes information about your internet connection and usage details about your interactions with the Services, such as clickstream information to, through, and from our Services (including date and time), information that you view or search for, page response times, download errors, length of your visits to certain pages, page interaction information (such as scrolling, clicks, and mouse-overs), or methods used to browse away from a page.

If we combine or connect non-personal statistical or technical data with personal data so that it directly or indirectly identifies an individual, we treat the combined information as Personal Information.

California Residents. If you are a California resident, our Privacy Policy For California Residents supplements this Privacy Policy and provides for additional rights that apply to you.

Please note that clinical trial information is collected by our research partners and governed by study-specific informed consent and privacy notices, not this Privacy Policy.

HOW WE COLLECT YOUR PERSONAL INFORMATION

You Provide Information to Us. We collect information about you when you interact with our Services, such as when you email us with feedback or other information.

Automatically Through Our Services. As you navigate through and interact with our Services, we may use automatic data collection technologies to collect information that may include Personal Information. Our website uses certain tags, log files, cookies, web beacons, and similar tracking technologies, which may collect details of your interactions with our Services, such as traffic data, location data, logs, other communication data, and which resources and Services features you access and use.

Cookies are small data files stored on your hard drive or in device memory that help us to, among other things, improve the Services and your experience. Web beacons are clear, electronic images that may be used on the Services and help deliver cookies, count visits, understand usage and campaign effectiveness. 

When you visit our website, we store cookies on your browser to collect information. The information collected might relate to you, your preferences or your device, and is mostly used to make the site work as you expect it to and to provide a more personalized web experience. However, you can choose not to allow certain types of cookies, which may impact your experience of the site and the services we are able to offer.

By virtue of their operation, cookies used on our website fall within the following categories:

Strictly Necessary Cookies: These cookies are required for the operation of our website and cannot be switched off.
Functional Cookies: These cookies allow our website to remember choices you make when you use our website. The purpose of these cookies is to provide you with a more personal experience and to avoid the need to re-select your preferences every time you visit our website.
Performance Cookies: These cookies are used to collect information about traffic to our website and how users use our website. The information gathered may include the number of visitors to our website, the websites that referred them to our website, the pages they visited on our website, what time of day they visited our website, whether they have visited our website before, and other similar information. We use this information to help operate our website more efficiently, to gather information and to monitor the level of activity on our website.

When you interact with the Services, there are third parties that may use automatic collection technologies to collect information about you or your device. These third parties may include advertisers, ad networks, ad servers, analytics companies, your device manufacturer, and your internet or mobile service provider.

These third parties may use tracking technologies to collect information about you when you use the Services. The information they collect may be associated with your personal data or they may collect information, including personal data, about your online activities over time and across different websites, apps, platforms, and other online services. We do not control these third parties' tracking technologies or how they may be used. If you have any questions about an advertisement or other targeted content, you should contact the responsible provider directly.

HOW WE USE YOUR PERSONAL INFORMATION

We may use your Personal Information for the following purposes:

To provide, operate and improve our Services. We may use your Personal Information to:
- Provide, operate, maintain, and administer our Services, and provide any content, features, information, products, or services that we make available through the Services.
- Improve our Services, including by analyzing your information and creating aggregated data derived from your information to develop, maintain, analyze, improve, optimize, measure, and report on our Services and their features and how users interact with them. The usage information we collect, whether connected to your personal data or not, helps us improve our Services and deliver a better and more personalized experience by enabling us to:
  - estimate our audience sizes and usage patterns;
  - identify our website audience.
  - store information about your preferences, allowing us to customize the Services according to your individual needs and interests;
  - speed up your searches; and
  - recognize you when you return to our Services.
- Provide information about our research and development.
- Respond to your service-related requests, questions, and feedback.
To determine candidates for jobs. We use information you provide to us (or to our third-party recruiting services provider) to determine if your expertise fulfills the requirements of the role you are applying for and to contact you to continue the recruiting process if we believe you are potentially a match for the role.
To comply with law. We use your Personal Information as we believe necessary or appropriate to comply with applicable laws, any court order, legal process, lawful requests and legal processes, such as to respond to requests from government authorities.
To create anonymous, aggregated, or de-identified data. We may create anonymous, aggregated, or de-identified data from your Personal Information. We may use this data and share it with third parties for our lawful business purposes, including to analyze and improve our website and promote our business.
For compliance, fraud prevention, and safety. We may use your Personal Information as we believe necessary or appropriate to: (a) carry out our obligations and enforce our rights arising from the terms and conditions that govern use of our website and contracts entered into between you and us; (b) protect our rights, privacy, safety, security, or property; and (c) protect, investigate, and deter against fraudulent, harmful, unauthorized, unethical, or illegal activity.
For Other Purposes. We may use your Personal Information in any other way we may describe when you provide the information and for any other purpose with your consent.

HOW WE DISCLOSE YOUR PERSONAL INFORMATION

We do not sell Personal Information.

We may disclose aggregated information about our users, and information that does not identify any individual, without restriction. We may also disclose Personal Information that we collect or you provide as described in this Privacy Policy:

Affiliates and Professional Advisors. We may disclose your Personal Information to our corporate affiliates, investors and advisors, such as lawyers, bankers, auditors, and insurers or to a third party in connection with a business deal (or potential business deal) such as a merger, consolidation, acquisition, reorganization, sale of assets, or in the event of bankruptcy liquidation, or similar proceeding, in which personal data held by Company is among the assets transferred.
Service Providers. Third parties may use your Personal Information only as directed by us and in a manner consistent with this Privacy Policy and are prohibited from using or disclosing your Personal Information for any other purpose. We may employ third-party companies and individuals to perform services on our behalf, including:

contract research organizations that conduct clinical trials;
data storage and analytics providers;
technology services and support (including email and web hosting providers, marketing and advertising technology providers, email and text communications providers, and mobile app developers);
recruiting and hiring service providers;
event planning and travel organizations that help facilitate Company programs; and
payment, shipping, and fulfillment service providers.

To comply with law. We may disclose your Personal Information as we believe necessary or appropriate to comply with applicable laws, any court order, legal process, lawful requests and legal processes, such as to respond to requests from government authorities.
For compliance, fraud prevention, and safety. We may disclose your Personal Information as we believe necessary or appropriate to (a) carry out our obligations and enforce our rights arising from the terms and conditions that govern use of our website and contracts entered into between you and us; (b) protect our rights, privacy, security, safety, or property; and (c) protect, investigate, and deter against fraudulent, harmful, unauthorized, unethical, or illegal activity.
For Other Purposes. We may disclose your Personal Information to fulfill the purpose for which you provide it and for any other purpose with your consent.

YOUR RIGHTS AND CHOICES ABOUT YOUR INFORMATION

This section describes mechanisms you can use to control certain uses and disclosures of your information and rights you may have under state law, depending on where you live.

Disabling Cookies and Other Tracking Technologies. You can set your browser to refuse all or some browser cookies or other tracking technology files, or to alert you when these files are being sent. Your choices for managing the use of cookies include:

Blocking cookies in your browser. Most browsers let you remove or reject cookies. To do this, follow the instructions in your browser settings. Many browsers accept cookies by default until you change your settings. If you disable or refuse cookies or similar tracking files, some Services features may be inaccessible or not function properly.
Blocking the use of advertising ID in your mobile settings. Your mobile device settings may provide functionality to limit use of the advertising ID associated with your mobile device for interest-based advertising.
DNT. Some browsers include a "Do Not Track" (DNT) setting that can send a signal to the online services you visit indicating you do not wish to be tracked. Because there is not a common understanding of how to interpret the DNT signal, our Services may not respond to all browser DNT signals. Instead, you can use the range of other tools to control data collection and use, including the cookie controls and advertising controls described in this policy.

Location Data Choices. You can choose whether or not to allow the Services to collect and use real-time information about your device's location through the device's privacy settings.

GPC. Some browsers and browser extensions support the Global Privacy Control (“GPC”) that can send a signal to process your request to opt out from certain types of data processing, including data "sales" as defined under certain laws. When we detect such a signal, we will make reasonable efforts to respect your choices indicated by a GPC setting as required by applicable law.

State Privacy Rights. U.S. consumers residing in other states with comprehensive privacy laws may consult their local jurisdictions for more information regarding their privacy rights and the designated methods for making data subject rights requests under their respective state laws. Depending on your state of residency, you may have certain rights related to your personal data, including:

Access and Data Portability. You may confirm whether we process your personal data and access a copy of the personal data we process. To the extent feasible and required by state law, depending on your state, data will be provided in a portable format. Depending on your state, you may have the right to receive additional information and it will be included in the response to your access request.
Correction. You may request that we correct inaccuracies in your personal data that we maintain, taking into account the information's nature and processing purpose.
Request/Withdrawal. You may request restriction of, or object to our processing of your Personal Information, or withdraw your consent to our processing of your personal information.
Deletion. You may request that we delete personal data about you that we maintain, subject to certain exceptions under applicable law.
Opt Out of Using Personal Data for Targeted Advertising, Profiling, and Sales. You may request that we do not use your personal data for these purposes.

The exact scope of these rights varies by state. There are also several exceptions where we may not have an obligation to fulfill your request.

If you are a California resident, our Privacy Policy For California Residents supplements this Privacy Policy and provides for additional rights that apply to you.

To exercise any of these rights please email us at contact@pheast.com. If we deny your request, you may appeal by emailing us at contact@pheast.com with “APPEAL” in the subject and we will respond within 15 days with our decision and rationale. We will respond with our or otherwise contact us using the information provided below in the Contact Information section.

HOW WE PROTECT PERSONAL INFORMATION

Security. We maintain commercially reasonable administrative, physical, and technical safeguards designed to protect Personal Information from accidental loss, misuse, and unauthorized access, use, disclosure, alteration, or disclosure. However, security risk is inherent in all internet and information technologies, and we cannot guarantee complete security of your Personal Information. For example, email sent to or from us may not be secure and, therefore, you should take special care in deciding what information you send to us via email. Any transmission of personal data is at your own risk. Please keep this in mind when disclosing any Personal Information to us via the internet. If you receive any emails or other communication purporting to be from our website asking you to provide sensitive information (including medical information) via email, you should treat that communication as unauthorized and suspicious and should report it to us immediately at contact@pheast.com.

The safety and security of your information also depends on you. You are responsible for taking steps to protect your personal data against unauthorized use, disclosure, and access.

Data Retention. We will only retain your Personal Information collected as described in this Privacy Policy for as long as reasonably necessary to fulfill the purposes described or as otherwise legally permitted or required, such as maintaining the Services, operating our organization, complying with our legal obligations, resolving disputes, and for safety, security, and fraud prevention. This means that we consider our legal and business obligations, potential risks of harm, and nature of the information when deciding how long to retain personal data. This does not affect your right to request that we delete your Personal Information before the end of its retention period. In some circumstances we may anonymize your Personal Information (so that it can no longer be associated with you) in which case we may use this information indefinitely without further notice to you. At the end of the retention period, Personal Information will be deleted, destroyed, or deidentified, except that any Personal Information stored in our backup and disaster recovery systems will be deleted or destroyed when the backup expires or is overwritten or the system is updated.

THIRD-PARTY WEBSITES/APPLICATIONS

Our website may contain links to other websites and applications and such websites and applications may reference or link to our Services. These third-party services are not controlled by us. We encourage our users to read the privacy policies of each website and application with which they interact. We do not endorse, screen, or approve, and are not responsible for, the privacy practices or content of such other websites or applications. Providing Personal Information to third-party websites or applications is at your own risk.

CHANGES TO THIS POLICY

This Privacy Policy is effective as of the date first stated above. We reserve the right to change this policy at any time and any changes are effective immediately.   We will take reasonable steps to advise you of any changes to this policy and make our revised Privacy Policy accessible through the Services and/or obtain your consent as required by law. Your continued use of our Services after we make Privacy Policy updates constitutes acceptance of our updated policy, so please check our Privacy Policy periodically for updates.

CONTACT INFORMATION.

If you have any inquiries or comments related to this Privacy Policy, please email us at contact@pheast.com or write us at:

Pheast Therapeutics, Inc.
200 Cardinal Way, Suite 300
Redwood City, CA 94063, USA
Attention: Legal

‍

PRIVACY POLICY FOR CALIFORNIA RESIDENTS

Last Updated: June 30, 2026

This Privacy Policy for California Residents (“California Privacy Policy”) supplements the information contained in our Privacy Policy and applies solely to residents of the State of California (“you”), in compliance with the California Consumer Privacy Act as amended by the California Privacy Rights Act (collectively, “CCPA”). This California Privacy Policy applies to information we collect through our website (pheast.com), including our collection and use of personal information if you apply as a job candidate. Consumers residing outside of California should see our general Privacy Policy .

This California Privacy Policy provides the information the CCPA requires, together with other useful information regarding our collection and use of personal information. Terms used in this policy have the meaning defined in the CCPA or our Privacy Policy , as applicable.

From time to time we may update this policy to reflect changes, including changes in the law, our data collection and use practices, or advances in technology. If such updates are made, we will make our revised policy accessible through the Services and/or obtain your consent as required by law. Your continued use of our Services after we make updates to this policy constitutes acceptance of our updated policy, so please check this policy periodically for updates.

CATEGORIES OF INFORMATION

We may collect and use information that identifies, relates to, describes, references, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with you (“personal information”). This information is described in our Privacy Policy. The following are the categories of personal information we may have collected over the past 12 months.

Identifiers, such as your real name, alias, postal address, unique personal identifier, online identifier, Internet Protocol address, email address, or other similar identifiers.
Personal information categories listed in the California Customer Records statute (Cal. Civ. Code § 1798.80(e)) (“California Customer Records”), such as your name, address, telephone number, education, employment, or employment history. Some personal information included in this category may overlap with other categories.
Protected classification characteristics under California or federal law ("Protected Classes"), such as your age.
Internet or other similar network activity, such as your activity on our websites, and electronic communications with us.
Geolocation data, such as the city or region related to your use of our website.
Professional or employment-related information, such as current or past job history and information provided in connection with your job application.
Non-public education information (per the Family Educational Rights and Privacy Act (20 U.S.C. Section 1232g, 34 C.F.R. Part 99)) ("FERPA Information"), such as your education records.

Personal information does not include:

Information excluded from the CCPA's scope, including health or medical information covered by the Health Insurance Portability and Accountability Act (HIPAA) and the California Confidentiality of Medical Information Act (CMIA), clinical trial data, or other qualifying research data.
Publicly available information, including from government records, through widely distributed media, or that the consumer made publicly available without restricting it to a specific audience.
Lawfully obtained, truthful information that is a matter of public concern.
Deidentified or aggregated consumer information.

Sensitive Personal Information. Sensitive personal information is a subtype of personal information consisting of the specific information categories listed in the CCPA. The categories of information we collect, listed above, contain information from which sensitive personal information may be inferred. We do not use or disclose such information in ways that would be subject to the right of California residents to limit use or disclosure of sensitive personal information under the CCPA.

SOURCES OF PERSONAL INFORMATION

We may obtain the categories of personal information listed above:

directly from you, such as from emails you send to us;
indirectly from you, such as from your interactions with our website; and
from our service providers, such as website data analytics providers.

‍

PURPOSE OF COLLECTION, USE AND DISCLOSURE

We may use personal information we obtain as described in in our Privacy Policy, including to:

communicate with you;
provide you with information;
provide and improve our services and support;
personalize your experience;
perform data analytics
secure, administer and maintain our Services;
detect and prevent fraud;
participate in our corporate transactions;
meet our obligations and exercise or defend our legal rights, or those of our employees, affiliates, customers, contractors, and agents;
fulfill the purposes for which you provided your personal information or that were described to you at collection, and as the CCPA otherwise permits; and
comply with applicable law and regulations.

‍

DISCLOSING PERSONAL INFORMATION

We do not sell personal information. We may disclose your personal information to the following third parties in relation to the purposes listed above:

affiliates and professional advisors, such as corporate affiliates, investors, lawyers, bankers, auditors, insurers and third parties in connection with business deals (or potential business deals);

service providers, such as companies that provide us with website and recruiting and hiring-related services;
government authorities and law enforcement; and
other parties as identified to you at or before our collection of your personal information.

The categories of personal information that we may have collected through our website and/or disclosed within the past 12 months are as follows:

Personal Information

CCPA Category

Third Party Receiving Disclosure/Purpose

Analytics information, such as IP addresses, and city/region of location.

Identifiers
Internet or other similar activity
Geolocation data

Website service providers to provide website and related data analytics and services.

Resume/job application information.

Identifiers
Educational, professional, or employment-related information

Recruiting/hiring service providers in relation to job applicants.

RETENTION

Our retention period for personal information is determined by the time necessary to fulfill the purpose for which it was collected as described above. Any personal information stored in our backup and disaster recovery systems will be deleted or destroyed when the backup expires or is overwritten or the system is updated.

CALIFORNIA PRIVACY RIGHTS

The CCPA provides you with specific rights regarding your personal information. This section generally describes your rights and explains how to exercise those rights.

Right to Know and Data Portability. You have the right to request that we disclose certain information to you about our collection and use of your personal information over the past 12 months. Once we receive your request and confirm your identity, we will disclose to you:

the categories and specific pieces of personal information we collected about you.
the categories of sources for the personal information we collected about you.
our business or commercial purpose for collecting that personal information.
the categories of third parties with whom we share that personal information.
The business purposes of disclosures, identifying the personal information categories that each category of recipient obtained.

Right to Delete and Right to Correct. You have the right to request that we delete any of your personal information that we collected from you and retained, subject to certain exceptions. Once we receive your request and confirm your identity, we will review your request. We may deny your deletion request if an exemption applies and retaining the information is necessary for us or our service provider(s) for business purposes, to comply with a legal obligation, or for other lawful uses. We will delete or de-identify personal information not subject to one of these exceptions from our records and will direct our service providers to take similar action.

You also have the right to request correction of personal information we maintain about you that you believe is inaccurate. We may require you to provide documentation, if needed, to confirm your identity and support your claim that the information is inaccurate. Unless an exception applies, we will correct personal information that our review determines is inaccurate and direct our service providers to take similar action.

Exercising Your Rights. To exercise your right to know, right to delete, or right to correct, please submit a request by contacting us using the contact information below. Only you, or someone legally authorized to act on your behalf, may make a request related to your personal information.

Sales Opt-Out Rights. You have the right to direct us to not sell your personal information at any time. If you opt in to personal information sales, you may opt-out of future sales at any time. To exercise the right to opt-out, you (or your authorized representative) may submit a request to us by contacting us using the information below.

Shine the Light. California’s “Shine the Light” law permits you to request certain information regarding our disclosure of any personal information to third parties for their direct marketing purposes. To make such a request, please contact us using the information below.

Non-Discrimination. You are entitled to exercise your rights free from discrimination as prohibited by the CCPA.

OUR CONTACT INFORMATION

If you have any inquiries or comments related to this California Privacy Policy, please email us at contact@pheast.com or write us at:

Pheast Therapeutics, Inc.
200 Cardinal Way, Suite 300
Redwood City, CA 94063, USA
Attention: Legal

‍