Denali Health Privacy Policy

1. Information We Collect

The information we collect depends on how you interact with Denali.

Information You Provide

We may collect:

• name;
• email address;
• telephone number;
• mailing address;
• age or date of birth;
• city, state, ZIP code, and country;
• communication preferences;
• information submitted through contact forms;
• information submitted through the Denali Patient Registry;
• information provided during research screening;
• communications you send to us; and
• other information you choose to provide.

If you join the Patient Registry, you may also provide health information such as medical conditions, symptoms, medications, treatment history, and answers to research-matching questions.

More information about our handling of registry health information is provided in our Consumer Health Data Privacy Notice.

Information Collected Automatically

When you use our website, we may automatically receive information such as:

• IP address;
• browser and device information;
• operating system;
• referring website or campaign;
• pages viewed;
• dates and times of visits;
• general geographic information;
• cookie identifiers;
• advertising identifiers; and
• interactions with our website.

2. How We Use Information

We may use personal information to:

• operate and maintain our website;
• respond to inquiries;
• operate the Denali Patient Registry;
• identify potential clinical research opportunities;
• communicate with individuals about research opportunities;
• conduct preliminary research screening;
• schedule calls, appointments, or research visits;
• administer clinical research activities;
• communicate by telephone, text message, or email where permitted;
• maintain the security and integrity of our systems;
• detect fraud or misuse;
• understand how our website is used;
• measure the effectiveness of advertising and outreach;
• improve our website, services, and recruitment processes;
• comply with legal, regulatory, contractual, and research requirements; and
• carry out another purpose disclosed to you when information is collected.

3. Denali Patient Registry

The Denali Patient Registry is a voluntary program for individuals who would like Denali to consider them for current or future clinical research opportunities.

Joining the registry does not:

• enroll you in a clinical trial;
• guarantee that a study will be available;
• mean that you qualify for a study; or
• require you to participate in research.

Denali may use the information you provide to determine whether a research opportunity may be relevant to you and to contact you about that opportunity.

Participation in a particular clinical trial is subject to separate study eligibility requirements, screening procedures, informed consent documents, and other study-specific requirements.

4. Consumer Health Information

Information about your health is sensitive.

Denali uses consumer health information submitted through its Patient Registry primarily to:

• maintain your registry profile;
• identify research opportunities that may be relevant to you;
• conduct preliminary research matching;
• communicate with you about potential studies; and
• administer the registry.

Additional details, including applicable privacy rights, are contained in our Consumer Health Data Privacy Notice.

5. How We Disclose Information

Service Providers

We use service providers that help us operate functions such as:

• website hosting;
• secure data storage;
• Patient Registry administration;
• customer relationship management;
• email and text communications;
• scheduling;
• cybersecurity;
• information technology; and
• research operations.

These providers may process information for Denali only for authorized purposes and subject to applicable contractual, confidentiality, security, and privacy requirements.

Research Activities

Information collected for a particular clinical trial may be disclosed as described in the study's informed consent documents and other applicable study materials.

Denali does not provide pharmaceutical sponsors, contract research organizations, or other research companies unrestricted access to the Denali Patient Registry.

As a general practice, Denali does not disclose identifiable Patient Registry health information to sponsors or other independent research partners merely because an individual joins the registry.

If information needs to be disclosed to an outside research organization in connection with a particular research opportunity, Denali will obtain any consent required by applicable law before making that disclosure.

Legal and Safety Purposes

We may disclose information when reasonably necessary or required to:

• comply with applicable law;
• respond to lawful governmental or judicial processes;
• satisfy research or regulatory requirements;
• investigate fraud or security incidents;
• protect the safety or rights of individuals; or
• establish, exercise, or defend legal claims.

Business Transactions

Information may be transferred in connection with a merger, acquisition, financing, reorganization, sale, or transfer of some or all of Denali's operations, subject to applicable privacy and confidentiality requirements.

6. Digital Advertising and Analytics

Denali advertises its services, Patient Registry, and clinical research opportunities through digital channels.

On appropriate general website pages, we may use analytics, cookies, and advertising technologies to:

• understand website traffic;
• measure advertising performance;
• determine whether an advertisement resulted in a website visit;
• improve outreach; and
• manage advertising campaigns.

Depending on the technology, limited information such as device information, cookie identifiers, IP address, page interactions, or advertising information may be processed by advertising or analytics providers.

Health Information Is Different

Denali does not use Patient Registry health information to create advertising audiences.

We do not provide advertising platforms with:

• diagnoses;
• medications;
• medical history;
• screening answers;
• Patient Registry form submissions; or
• other health information provided through the Patient Registry

for targeted advertising, custom audiences, lookalike audiences, or similar advertising purposes.

Denali does not sell Patient Registry health information.

We also apply additional restrictions to advertising technologies on pages where individuals provide health or research-screening information.

7. Cookies and Privacy Choices

Our website may use essential, analytics, and advertising technologies.

Essential technologies support functions such as website operation, security, forms, and privacy preferences.

Analytics technologies help us understand website performance and usage.

Advertising technologies may help measure or manage advertising on appropriate general website pages.

Where applicable, you may manage non-essential technologies through our cookie preference tool or Your Privacy Choices page.

Where required by law, Denali recognizes applicable browser-based privacy preference signals.

8. Communications

If you ask Denali to contact you or provide the appropriate permission, we may communicate with you regarding:

• the Patient Registry;
• potential research opportunities;
• screening;
• scheduling;
• appointments; and
• related research activities.

You can change communication preferences at any time.

For text messages, follow the opt-out instructions provided in the message, such as replying STOP where supported.

For applicable email communications, use the unsubscribe link provided in the message.

9. Your Privacy Rights

Privacy rights vary depending on your state and the information involved.

Where applicable, you may have the right to:

• know whether we process information about you;
• access information about you;
• obtain a copy of certain information;
• correct inaccurate information;
• request deletion;
• withdraw consent;
• obtain information about certain disclosures;
• opt out of certain targeted advertising, sales, or sharing; and
• appeal certain decisions concerning a privacy request.

Additional rights relating specifically to health information maintained in our Patient Registry are described in our Consumer Health Data Privacy Notice.

To simplify privacy management, Denali may honor certain Patient Registry privacy requests for U.S. users even where a particular state law does not independently require the right.

Certain information may need to be retained to satisfy legal, regulatory, research, security, contractual, or recordkeeping requirements.

Records associated with participation in an actual clinical trial are separate from the general Patient Registry and may be subject to different retention and deletion requirements.

10. Data Security

Denali maintains administrative, technical, and physical safeguards designed to protect personal information based on its nature and sensitivity.

No information system or electronic transmission method can be guaranteed to be completely secure.

If a security incident occurs, Denali will investigate the incident and provide notifications required by applicable law.

11. Data Retention

We retain information for as long as reasonably necessary to:

• operate the Patient Registry;
• provide requested services;
• maintain appropriate records;
• satisfy research requirements;
• meet legal and regulatory obligations;
• protect our systems; and
• resolve disputes.

Retention requirements associated with an actual clinical trial may differ from those applicable to the general Patient Registry.

12. Children

Unless Denali expressly provides a pediatric registration process, the general Denali Patient Registry is intended for individuals 18 years of age or older.

Pediatric clinical research will use the parental permission, minor assent, informed consent, and other processes required for the particular study.

13. United States

The Denali Patient Registry is intended for individuals located in the United States and for research opportunities conducted or supported in the United States.

Our website may be technically accessible outside the United States. This does not mean Denali offers the Patient Registry in every jurisdiction.

Individuals located outside the United States should not submit health information through the Patient Registry unless Denali expressly makes the registry available in their jurisdiction.

14. Third-Party Websites

Our website may link to websites or services operated by independent organizations.

Denali does not control their privacy or security practices. Please review their privacy notices before providing information to them.

15. Changes to This Policy

We may update this Privacy Policy as our services, technologies, or legal obligations change.

We will update the date above and provide additional notice where required.

16. Contact Us

Questions or privacy requests may be directed to:

Denali Health Attn: Privacy 1601 W Reynolds St., Suite 203 Plant City, FL 33564

Email: privacy@denali-health.com

You may also submit a privacy request through our Your Privacy Choices page.