1. Information We Collect

The information we collect depends on how you interact with Denali.

Information You Provide

We may collect:

• name;
• email address;
• telephone number;
• mailing address;
• age or date of birth;
• city, state, ZIP code, and country;
• communication preferences;
• information submitted through contact forms;
• information submitted through the Denali Patient Registry;
• information provided during research screening;
• communications you send to us; and
• other information you choose to provide.

If you join the Patient Registry, you may also provide health information such as medical conditions, symptoms, medications, treatment history, and answers to research-matching questions.

More information about our handling of registry health information is provided in our Consumer Health Data Privacy Notice.

Information Collected Automatically

When you use our website, we may automatically receive information such as:

• IP address;
• browser and device information;
• operating system;
• referring website or campaign;
• pages viewed;
• dates and times of visits;
• general geographic information;
• cookie identifiers;
• advertising identifiers; and
• interactions with our website.

2. How We Use Information

We may use personal information to:

• operate and maintain our website;
• respond to inquiries;
• operate the Denali Patient Registry;
• identify potential clinical research opportunities;
• communicate with individuals about research opportunities;
• conduct preliminary research screening;
• schedule calls, appointments, or research visits;
• administer clinical research activities;
• communicate by telephone, text message, or email where permitted;
• maintain the security and integrity of our systems;
• detect fraud or misuse;
• understand how our website is used;
• measure the effectiveness of advertising and outreach;
• improve our website, services, and recruitment processes;
• comply with legal, regulatory, contractual, and research requirements; and
• carry out another purpose disclosed to you when information is collected.

3. Denali Patient Registry

The Denali Patient Registry is a voluntary program for individuals who would like Denali to consider them for current or future clinical research opportunities.

Joining the registry does not:

• enroll you in a clinical trial;
• guarantee that a study will be available;
• mean that you qualify for a study; or
• require you to participate in research.

Denali may use the information you provide to determine whether a research opportunity may be relevant to you and to contact you about that opportunity.

Participation in a particular clinical trial is subject to separate study eligibility requirements, screening procedures, informed consent documents, and other study-specific requirements.

4. Consumer Health Information

Information about your health is sensitive.

Denali uses consumer health information submitted through its Patient Registry primarily to:

• maintain your registry profile;
• identify research opportunities that may be relevant to you;
• conduct preliminary research matching;
• communicate with you about potential studies; and
• administer the registry.

Additional details, including applicable privacy rights, are contained in our Consumer Health Data Privacy Notice.

5. How We Disclose Information

Service Providers

We use service providers that help us operate functions such as:

• website hosting;
• secure data storage;
• Patient Registry administration;
• customer relationship management;
• email and text communications;
• scheduling;
• cybersecurity;
• information technology; and
• research operations.

These providers may process information for Denali only for authorized purposes and subject to applicable contractual, confidentiality, security, and privacy requirements.

Research Activities

Information collected for a particular clinical trial may be disclosed as described in the study's informed consent documents and other applicable study materials.

Denali does not provide pharmaceutical sponsors, contract research organizations, or other research companies unrestricted access to the Denali Patient Registry.

As a general practice, Denali does not disclose identifiable Patient Registry health information to sponsors or other independent research partners merely because an individual joins the registry.

If information needs to be disclosed to an outside research organization in connection with a particular research opportunity, Denali will obtain any consent required by applicable law before making that disclosure.

Legal and Safety Purposes

We may disclose information when reasonably necessary or required to:

• comply with applicable law;
• respond to lawful governmental or judicial processes;
• satisfy research or regulatory requirements;
• investigate fraud or security incidents;
• protect the safety or rights of individuals; or
• establish, exercise, or defend legal claims.

Business Transactions

Information may be transferred in connection with a merger, acquisition, financing, reorganization, sale, or transfer of some or all of Denali's operations, subject to applicable privacy and confidentiality requirements.

6. Digital Advertising and Analytics

Denali advertises its services, Patient Registry, and clinical research opportunities through digital channels.

On appropriate general website pages, we may use analytics, cookies, and advertising technologies to:

• understand website traffic;
• measure advertising performance;
• determine whether an advertisement resulted in a website visit;
• improve outreach; and
• manage advertising campaigns.

Depending on the technology, limited information such as device information, cookie identifiers, IP address, page interactions, or advertising information may be processed by advertising or analytics providers.

Health Information Is Different

Denali does not use Patient Registry health information to create advertising audiences.

We do not provide advertising platforms with:

• diagnoses;
• medications;
• medical history;
• screening answers;
• Patient Registry form submissions; or
• other health information provided through the Patient Registry

for targeted advertising, custom audiences, lookalike audiences, or similar advertising purposes.

Denali does not sell Patient Registry health information.

We also apply additional restrictions to advertising technologies on pages where individuals provide health or research-screening information.

7. Cookies and Privacy Choices

Our website may use essential, analytics, and advertising technologies.

Essential technologies support functions such as website operation, security, forms, and privacy preferences.

Analytics technologies help us understand website performance and usage.

Advertising technologies may help measure or manage advertising on appropriate general website pages.

Where applicable, you may manage non-essential technologies through our cookie preference tool or Your Privacy Choices page.

Where required by law, Denali recognizes applicable browser-based privacy preference signals.

8. Communications

If you ask Denali to contact you or provide the appropriate permission, we may communicate with you regarding:

• the Patient Registry;
• potential research opportunities;
• screening;
• scheduling;
• appointments; and
• related research activities.

You can change communication preferences at any time.

For text messages, follow the opt-out instructions provided in the message, such as replying STOP where supported.

For applicable email communications, use the unsubscribe link provided in the message.

9. Your Privacy Rights

Privacy rights vary depending on your state and the information involved.

Where applicable, you may have the right to:

• know whether we process information about you;
• access information about you;
• obtain a copy of certain information;
• correct inaccurate information;
• request deletion;
• withdraw consent;
• obtain information about certain disclosures;
• opt out of certain targeted advertising, sales, or sharing; and
• appeal certain decisions concerning a privacy request.

Additional rights relating specifically to health information maintained in our Patient Registry are described in our Consumer Health Data Privacy Notice.

To simplify privacy management, Denali may honor certain Patient Registry privacy requests for U.S. users even where a particular state law does not independently require the right.

Certain information may need to be retained to satisfy legal, regulatory, research, security, contractual, or recordkeeping requirements.

Records associated with participation in an actual clinical trial are separate from the general Patient Registry and may be subject to different retention and deletion requirements.

10. Data Security

Denali maintains administrative, technical, and physical safeguards designed to protect personal information based on its nature and sensitivity.

No information system or electronic transmission method can be guaranteed to be completely secure.

If a security incident occurs, Denali will investigate the incident and provide notifications required by applicable law.

11. Data Retention

We retain information for as long as reasonably necessary to:

• operate the Patient Registry;
• provide requested services;
• maintain appropriate records;
• satisfy research requirements;
• meet legal and regulatory obligations;
• protect our systems; and
• resolve disputes.

Retention requirements associated with an actual clinical trial may differ from those applicable to the general Patient Registry.

12. Children

Unless Denali expressly provides a pediatric registration process, the general Denali Patient Registry is intended for individuals 18 years of age or older.

Pediatric clinical research will use the parental permission, minor assent, informed consent, and other processes required for the particular study.

13. United States

The Denali Patient Registry is intended for individuals located in the United States and for research opportunities conducted or supported in the United States.

Our website may be technically accessible outside the United States. This does not mean Denali offers the Patient Registry in every jurisdiction.

Individuals located outside the United States should not submit health information through the Patient Registry unless Denali expressly makes the registry available in their jurisdiction.

14. Third-Party Websites

Our website may link to websites or services operated by independent organizations.

Denali does not control their privacy or security practices. Please review their privacy notices before providing information to them.

15. Changes to This Policy

We may update this Privacy Policy as our services, technologies, or legal obligations change.

We will update the date above and provide additional notice where required.

16. Contact Us

Questions or privacy requests may be directed to:

Denali Health Attn: Privacy 1601 W Reynolds St., Suite 203 Plant City, FL 33564

Email: privacy@denali-health.com

You may also submit a privacy request through our Your Privacy Choices page.

Consumer Health Data We Collect

Depending on the information you choose to provide, Denali may collect consumer health data including:

• medical conditions and diagnoses;
• symptoms;
• medications;
• treatment history;
• medical procedures;
• health-related measurements or characteristics;
• healthcare provider information;
• clinical trial history;
• answers to research-screening questions;
• demographic information relevant to research eligibility;
• research interests;
• information about potential study eligibility; and
• other health information you voluntarily provide.

We may also derive limited information from your responses, such as whether a particular type of research opportunity may potentially be relevant to you.

Sources of Consumer Health Data

We primarily collect consumer health data:

• directly from you;
• from a parent, guardian, or authorized representative when appropriate;
• from information you provide during communications with Denali; and
• from Denali personnel conducting permitted registry or research-screening activities.

Information received for a particular clinical trial may also be governed by the documents and permissions applicable to that study.

Why We Collect Consumer Health Data

We collect and use consumer health data to:

• operate the Denali Patient Registry;
• create and maintain registry profiles;
• identify current or future research opportunities that may be relevant to an individual;
• conduct preliminary research matching;
• contact individuals about potential research opportunities;
• respond to registry inquiries;
• conduct permitted preliminary screening;
• manage registry communications;
• maintain appropriate records;
• maintain security and prevent fraud; and
• comply with applicable legal, regulatory, and research requirements.

We will not materially expand these purposes without providing any additional notice or consent required by applicable law.

How We Use Consumer Health Data

Authorized Denali personnel may review consumer health data to determine whether a clinical research opportunity may be relevant to you.

A potential match does not mean that you qualify for or are enrolled in a clinical trial.

Further screening and study-specific informed consent may be required.

Service Providers

Denali uses contracted service providers that may process consumer health data on Denali's behalf, such as providers supporting:

• secure hosting and data storage;
• Patient Registry software;
• customer relationship management;
• communications;
• information technology;
• cybersecurity; and
• other registry operations.

These providers are permitted to process the information only for authorized purposes and under appropriate contractual and security requirements.

Sharing With Research Partners

Denali does not give pharmaceutical sponsors, contract research organizations, or other independent research organizations unrestricted access to the Patient Registry.

As a general registry practice, Denali does not disclose identifiable registry health information to outside research partners simply because an individual joins the registry.

If Denali proposes to share your identifiable consumer health data with an outside research organization for purposes requiring additional consent, we will obtain that consent before the sharing occurs.

Affiliates

Denali does not currently share Patient Registry consumer health data with an affiliated company for that affiliate's independent purposes.

If this practice changes, Denali will update this notice and obtain any additional consent required by applicable law before beginning the new sharing.

Consumer Health Data We Sell

None.

Denali does not sell consumer health data.

Advertising

Denali does not use Patient Registry health information to:

• create advertising audiences;
• create lookalike audiences;
• create custom audiences;
• target advertisements based on an individual's medical condition;
• enrich third-party advertising profiles; or
• allow an advertising platform to independently market products based on registry health information.

Your Consumer Health Data Rights

Depending on applicable law, you may have rights concerning your consumer health data.

For the general Denali Patient Registry, Denali provides U.S. registry users a process to request:

• confirmation of whether Denali maintains consumer health data about them;
• access to their registry information;
• correction of inaccurate registry information;
• deletion of registry information;
• withdrawal of consent to future collection and use;
• withdrawal of applicable consent to sharing;
• information about parties with whom applicable consumer health data has been shared; and
• review of a Denali decision concerning a privacy request.

Some information may be retained when permitted or required for legal, security, research-integrity, regulatory, or recordkeeping purposes.

Information associated with participation in an actual clinical trial may be governed by different requirements and is not necessarily deleted when an individual withdraws from the general Patient Registry.

Withdrawing From the Patient Registry

You can withdraw from the Denali Patient Registry at any time.

When your withdrawal becomes effective, we will stop using your Patient Registry information to identify you for new research opportunities, except as permitted or required by law.

You may also separately change your email or text-message preferences without withdrawing from the registry.

Making a Request

To exercise a consumer health data right or withdraw from the Patient Registry, contact:

Denali Health Attn: Privacy 1601 W Reynolds St., Suite 203 Plant City, FL 33564

Email: privacy@denali-health.com

We may take reasonable steps to verify your identity before providing access to, correcting, or deleting information.

We will respond within the period required by applicable law.

Changes to This Notice

We may update this notice as our Patient Registry, data practices, or legal obligations change.

If we propose to collect, use, or share consumer health data in a manner requiring additional consent, we will obtain that consent before beginning the new activity where required.