Skyhawk Therapeutics, Inc. ("Skyhawk Therapeutics,” “we,” “us,” “our”) is committed to maintaining your privacy, and recognizes the importance of providing protection for any personally identifiable information that you choose to share with us (“Personal Information”). We have established this privacy policy (“Privacy Policy”) to inform you about how we treat any Personal Information that we collect when you visit our website or interact with us or our representatives.

This Privacy Policy does not apply to information we collect from participants in our clinical trials or that we otherwise process in connection with authorized research. If you participate in a clinical trial or other research that we sponsor, please review any informed consent forms or other information you received upon enrolment for more information.

Collection of Personal Information

Personal Information You Provide:

• Contact information, including your name, profession, e-mail address, and any other contact data that you may provide when you fill in a form to express your interest in our Services or clinical trials or when you contact us through the Website or otherwise.
• Communications that we exchange with you, including when you contact us with questions, feedback, or otherwise.
• Health information. If you choose to provide it, we may collect health-related information such as your medical history, health questionnaire responses, and other information relating to your physical or mental health or condition. For more information on how we collect, use, and disclose health information, please see our Consumer Health Data Policy.
• Events. If you attend a Skyhawk Therapeutics event, we may collect your Personal Information you share with us during the event (for example, by providing your business card) and we may take photographs with your personal image.
• Marketing information, such as your preferences for receiving our marketing communications about our Services or our business, and the types of products we think will interest you.
• Other information, not specifically listed here, which you may choose to provide and which we will use as described in this Privacy Policy or as otherwise disclosed at the time of collection.

Personal Information That We Collect Automatically:

We and our service providers may automatically collect information about you, your computer or mobile device, and your interactions over time with our Services and our communications, such as:

• Device information, such as information about your device type, operating system and version, manufacturer and model, browser type, screen resolution, RAM and disk size, CPU usage, IP address, unique identifiers, language settings, mobile carrier, network information (e.g., WiFi, LTE, 4G), and general location information such as city, state, or geographic area.
• Online activity information, such as your browser type, time spent on each page or screen, browsing history, navigation paths, information about your activity on a page or screen, access times and duration, and whether you have opened our marketing emails or clicked links within them.
• Information collected by cookies and similar tracking technologies, such as your browsing actions and patterns; for example, your internet protocol address and other similar identifiers, browsing history, search history, information on your interaction with the website. We collect this Personal Information by using different technologies, including cookies and web beacons. Please visit our Cookie Policy for more information.
• General location information, such as your city, state, zip or postal code, to personalize content provided to you, or to show you prices and promotions. 

Personal Information We Obtain From Third Parties:

We may obtain information about you from outside sources. Such information may include information from third parties that you choose to share with us or from publicly available sources. These may include:

• Social media information. We maintain pages on social media platforms, such as LinkedIn, Twitter, and other third-party platforms. When you visit or interact with our pages on those platforms, the platform provider’s privacy policy will apply to your interactions and their collection, use, and processing of your Personal Information. You or the platforms may provide us with your information through the platform, and we will treat such information in accordance with this Privacy Policy.
• Other sources. We obtain Personal Information from other third parties, such as analytics and marketing partners, data providers and publicly available sources, including from partners that help us advertise and market our Services.

Use of Personal Information

We may collect and use Personal Information for the following purposes:

• To operate the Website and provide our Services. To perform a contract with you, or when it is in our legitimate business interests to do so, we will use Personal Information to operate and improve our Services, including to personalize our Services and to give users a more consistent experience when interacting with us.
• To improve and monitor our Services. It is in our legitimate interests to improve and keep our Services safe, which includes protecting the security of our Services, and preventing and detecting security threats, fraud, or other criminal or malicious activities.
• To communicate with you about our Services and clinical trials. To perform our contractual obligations to you, or when it is in our legitimate interests to do so, we will use your Personal Information to send you announcements, updates, security alerts, support and administrative messages, responses to your requests, questions, and feedback, and communicate with you about our Services and clinical trials that you may be interested in.
• For marketing and advertising. We and our advertising partners may collect your Personal Information for the following purposes:
  • Direct marketing. We may send you direct marketing communications. This includes communicating with you to follow up if you have expressed interest in connecting to Skyhawk Therapeutics, as well as to notify you of events via postal mail, email, and other means. You may opt out of marketing communications as described in the “Opt-out of Marketing Communications” section below.
  • Interest-based advertising. We may engage third-party advertising partners, including third party advertising companies and social media companies, to display our ads around the web. These companies may use cookies and similar technologies to collect information (including the automatically-collected data described above) about your interactions over time across our Website, our communications, and other online services, and use that information to serve online ads that may interest you. For more information, or to understand your choices for limiting interest-based advertising, please visit our Cookie Policy.

Except where consent is required, we undertake such marketing and advertising on the basis of our legitimate business interests to use your personal information for the purposes described above. Where we rely on your consent, you may withdraw your consent at any time, including by following the opt-out instructions in the “Your Privacy Rights and Choices” section below.

• For research and development. We use Personal Information to help us better understand how people use our Services and how we can develop, analyze, and improve them where it is in our legitimate interests to do so. As part of these activities, we may create and use de-identified or aggregated information from the Personal Information we collect for our business purposes. We may use this anonymous, aggregated, or de-identified data and share it with third parties for our lawful business purposes.
• For compliance and protection. We use your Personal Information to comply with our legal obligations and to defend us against legal claims or disputes where it is in our legitimate business interests to do so, including:
  • To comply with applicable laws, lawful requests, and legal process, such as to respond to subpoenas or requests from government authorities;
  • To protect our, your or others’ rights, privacy, safety, or property (including by making and defending legal claims);
  • To audit our internal processes for compliance with legal and contractual requirements as well as our internal policies;
  • To enforce the terms and conditions that govern our Services; and
  • To prevent, identify, investigate and deter fraudulent, harmful, unauthorized, unethical or illegal activity, including cyberattacks and identity theft.

Use of Personal Information

We may disclose Personal Information to the following entities:

• Affiliates. We may disclose Personal Information between and among Skyhawk Therapeutics and our current and future parents, affiliates, subsidiaries, and other companies under common control and ownership for purposes consistent with this Privacy Policy.
• Service providers. We may disclose Personal Information to our service providers to perform the functions for which we engage them (such as hosting, information technology, customer support, ecommerce platform, email delivery, and Website analytics services).
• Professional advisors. We may disclose Personal Information to professional advisors, such as lawyers, auditors, bankers, and insurers, where necessary in the course of the professional services that they render to us.
• Law enforcement and other authorities. We may disclose Personal Information to law enforcement, government authorities, and private parties, as we believe in good faith to be necessary or appropriate for the compliance and protection purposes described above.
• Business transferees. We may disclose Personal Information to acquirers and other relevant participants in business transactions (or negotiations for such transactions) involving a corporate divestiture, merger, acquisition, reorganization, liquidation, consolidation, acquisition, reorganization, sale or other disposition of all or any portion of the business or assets of, or equity interests in, our business (including, in connection with a bankruptcy or similar proceedings), change in control or other sale by or of us or any affiliated entity (in each case whether in whole or in part), where such disclosure is necessary to complete the transaction or evaluate the business being transferred.
• Legal compliance. We may disclose Personal Information to relevant third parties if we believe your actions are inconsistent with our user agreements or policies, if we believe you have violated the law, or to protect the rights, property, and safety of Skyhawk Therapeutics or others.
• With your instruction or permission. We may disclose Personal Information to relevant third parties, where you give us permission to do so in the course of your relationship with us from time to time.
• De-identified information. We may also share aggregated or de-identified information that cannot reasonably be used to identify you.

International Data Transfers

We will store Personal Information in the United States, and may transfer Personal Information to our affiliates and service providers in the United States and other jurisdictions. Please note that such jurisdictions may not provide the same protections as the data protection laws in your home country.

When we engage in cross-border data transfers, we will ensure that relevant safeguards are in place to afford adequate protection for your Personal Information and we will comply with applicable data protection laws, in particular by relying on contractual protections for the transfer of Personal Information, where required. For more information, please contact us as set out in the “How to Contact Us” section below.

Your Privacy Rights and Choices

Personal Information requests. Depending on your location and the nature of your interactions with us, you may request the following in relation to your Personal Information:

• Information about how we have collected and used your Personal Information. We have made this information available to you without having to request it by including it in this Privacy Policy.
• Access to a copy of the Personal Information that we have collected about you. Where applicable, we will provide the information in a portable, machine-readable, readily-usable format.
• Correction of your Personal Information that is inaccurate or out of date.
• Deletion of your Personal Information when it is no longer needed for providing the Services, or any requested product or service, or for other lawful purposes.
• Additional rights, such as the ability to object to the processing of your Personal Information and to request that we restrict how your Personal Information is processed.

To exercise the above rights, contact us using the details as set out in the “How to Contact Us” section below. Prior to responding to your requests, we may verify your identity by matching the identifying information you provide with the information we already hold. Where we rely on your consent to process your Personal Information, you may withdraw that consent at any time using the available opt-out mechanisms.

In some instances, your rights and choices may be limited, such as where fulfilling your request would affect the rights of others, interfere with our ability to provide a requested service, or prevent us from meeting our legal obligations or enforcing our legal rights. If you are not satisfied with how we address your request, you may submit a complaint by contacting us as set out in the “How to Contact Us” section below.

Right to complain. Depending on where you reside, you may have the right to complain to a data protection regulator where you live or work, or where you feel a violation has occurred.

Opt Out of Marketing Communications

We may send you information or materials such as newsletters by email or postal mail when you submit your email or postal mail address via the Website. You may “opt out” of receiving the email from us by using the unsubscribe feature included in the email we send. Also, if you do not want to receive this information or materials, you can send an email with your name, mailing address and email address to [Insert Email]. When we receive your request, we may take reasonable steps to remove your name from our address lists. You may, however, still continue to receive non-marketing emails.

Children’s Privacy

The Services are not directed at children and we do not knowingly collect any Personal Information from children under 18 years of age. If we learn that we have collected Personal Information through the Services from a child under 18 without the consent of the child’s parent or guardian as required by law, we will delete it as soon as possible. If you have reason to believe that a child under the age of 18 has provided Personal Information to Skyhawk Therapeutics through the Website, please contact us using the details as set out in the “How to Contact Us” section below, and we will use reasonable efforts to delete that information from our databases.

Links to Other Sites

Our Services may contain links to third-party websites or services that are not under our control. Such links are not an endorsement of, or representation that we are affiliated with, those third parties or the content displayed on their sites. We do not control third party websites or online services, and we are not responsible for their actions. Other websites and services follow different rules regarding the collection, use and disclosure of your personal information. We encourage you to read the privacy policies of the other websites and online services you use. We expressly disclaim all liability for the actions of third parties, including but without limitation to actions relating to the use and/or disclosure of Personal Information by third parties.

Security

We use commercially reasonable security measures designed to prevent unauthorized access, loss, disclosure, alteration, destruction, or misuse of Personal Information we collect. However, while we strive to improve our security measures to protect your Personal Information, these are not failsafe and we cannot guarantee the security of your Personal Information. You acknowledge and agree that we are not responsible for any loss, corruption or unauthorized acquisition or misuse of Personal Information that you provide through the Website that is stored by us, or for any damages resulting from such loss, corruption, or unauthorized acquisition or misuse.

Retention of Personal Information

Where required under applicable laws, we retain Personal Information only for as long as is necessary to fulfill the purposes for which it was collected and processed in accordance with applicable laws and regulatory obligations or until you withdraw your consent (where applicable).

To determine the appropriate retention period for Personal Information, we consider the amount, nature, and sensitivity of the Personal Information, the potential risk of harm from unauthorized use or disclosure of Personal Information, the purposes for which we use Personal Information, and whether we can achieve those purposes through other means, and the applicable legal and regulatory requirements.

Job Applicants

When you apply for one of our open positions, we collect the Personal Information that you provide to us in connection with your job application. This includes, but is not limited to, business and personal contact information, professional credentials and skills, educational and work history, and other information of the type that may be included in a resume or that you may provide during the interview process. This may also include diversity information that you voluntarily provide. We may also conduct background checks and receive related information. We also collect Personal Information from other sources where relevant for your application, such as employment research firms, recruiters, identity verification services, and information that you make publicly available on websites or social media platforms.

Throughout the recruitment process, we may supplement your Personal Information in connection with the assessment of your application. For example, we may record the views of those considering your application about your suitability for the role for which you have applied and retain interview notes. If you accept an offer from us, your Personal Information will be incorporated into and used as part of your employee record.

We use this information to facilitate our recruitment activities and process employment applications, such as evaluating candidates, monitoring recruitment statistics, and responding to surveys. We may also use this information to support the administration of the Services, and as necessary to: (i) comply with relevant laws or respond to subpoenas, warrants, or other legal requests; (ii) protect and defend our or others’ rights or property; (iii) assist with or conduct legal investigations; and (iv) investigate, prevent, or address any violations or potential violations of the law or this Privacy Policy.

Updates to Privacy Policy

We reserve the right to update this Privacy Policy from time to time. If we decide to change this Privacy Policy, we will post those changes at this webpage and notify you by revising the date at the top of this Privacy Policy. You are encouraged to review this Privacy Policy whenever you access the Services or otherwise interact with us to stay informed about our information practices and the choices available to you. Your continued use of this Website will be subject to the then-current Privacy Policy.

How to Contact Us

Responsible entity: Skyhawk Therapeutics is the entity responsible for the processing of your Personal Information under this Privacy Policy (as a controller, where provided under applicable law).

If you have questions regarding this Privacy Policy, our privacy practices, or if you would like to exercise your rights with respect to your Personal Information, please contact us at privacy@skyhawktx.com. or write to us at:

Skyhawk Therapeutics, Inc.
180 3rd Ave., Sixth Floor
Waltham, MA 02451
United States

Consumer Health Data Policy

This Consumer Health Data Privacy Policy explains how Skyhawk Therapeutics collects, uses, shares, and protects “consumer health data” as defined under applicable U.S. state laws, and the privacy rights and choices you have, in connection with our Services.

This Consumer Health Data Privacy Policy supplements our Privacy Policy and applies only to consumer health data relating to Connecticut, Nevada and Washington state residents.

Categories of Consumer Health Data We Collect

Consumer health data includes Personal Information that is linked or reasonably linkable to a consumer and that identifies the consumer's past, present, or future physical or mental health status. It includes information about or regarding:

• Individual health conditions, treatment, diseases, or diagnosis;
• Social, psychological, behavioral, and medical interventions;
• Health-related surgeries or procedures;
• The use or purchase of prescribed medication;
• Bodily functions, vital signs, symptoms, or measurements;
• Diagnoses or diagnostic testing, treatment, or medication;
• Gender-affirming care information;
• Reproductive or sexual health information;
• Biometric data;
• Genetic data;
• Precise location information that could reasonably indicate a consumer's attempt to acquire or receive health services or supplies;
• Data that identifies a consumer seeking health care services; or
• Any information that can be associated with or identify a consumer with the data described above or that is derived or extrapolated from non-health related information.

We may collect this information directly from you or from other third-party sources authorized by you.

Purpose For Which We Use and Disclose Consumer Health Data

We collect, use, and share consumer health data with your consent or as reasonably necessary to facilitate clinical trial recruitment efforts and adverse event reporting. We may also use and share consumer health data to help us meet regulatory obligations, and to detect, investigate, and help prevent security incidents and other malicious, deceptive, fraudulent, or illegal activity and help protect the rights and property of Skyhawk Therapeutics and others, and to comply with applicable laws.

The categories of third parties to which we may disclose consumer health data include: affiliates, service providers, professional advisors, and government authorities. We may also disclose consumer health data in connection with or during negotiations concerning, any merger, sale of company assets, financing, or acquisition of all or a portion of our business by another company.

Your Rights

If you are a Connecticut, Nevada or Washington state resident, you may request the following in relation to your consumer health data:

• Confirm whether we are collecting, sharing, or selling consumer health data, and to access a copy of the consumer health data;
• Delete consumer health data; and
• Withdraw consent for our collection or sharing of consumer health data.

Please note that these rights may be limited in accordance with applicable laws. For example, we may not be able to delete consumer health data where we are required to maintain it for our legal and regulatory purposes.

Submitting a Request

To submit a request, please contact us at privacy@skyhawktx.com. We will not discriminate against you for exercising your rights described above.

How to Appeal

If your request to exercise any of the rights described above is denied, you may appeal this decision by emailing us within a reasonable time at privacy@skyhawktx.com. If your appeal is denied, you may issue a complaint with appropriate regulatory enforcement authorities.