EnGeneIC’s Commitment to Maintaining Your Privacy

EnGeneIC is committed to protecting the privacy of all individuals with whom it deals in accordance with applicable laws. This Global Privacy Policy (“Policy”) describes how EnGeneIC Limited, and its affiliate or subsidiary companies worldwide (together referred to as “EnGeneIC” “us,” “our,” or “we”), collects, uses, discloses, protects, and stores certain personal information collected, and what choices and rights you have with respect to that information.

We take the privacy and security of your personal information very seriously and we are committed to ensuring that we collect, use, disclose and store your personal information in accordance with applicable data protection and privacy laws worldwide.

1. Background and Purpose

EnGeneIC is a clinical stage biopharmaceutical company focused on developing novel cancer therapies based on its proprietary platform of EnGeneIC Dream Vector (EDV) nanocells. EnGeneIC is a Bermuda company with our headquarters in Sydney, Australia with a subsidiary in the United States. EnGeneIC collects and holds personal information necessary for us to carry out our business. We collect, use, and disclose your personal information in accordance with this Policy.

As an Australian-headquartered business, we are committed to protecting the privacy of information and to handling personal information in a responsible manner in accordance with Australian privacy laws legislation, including the Privacy Act 1988 (Cth) (as amended), the Australian Privacy Principles, and relevant Australian State and Territory privacy laws (collectively the Australian Privacy Law). EnGeneIC and its subsidiaries also act in accordance with applicable privacy laws in other countries and regions in which EnGeneIC operates, including but not limited to:

• General Data Protection Regulation 2016/679 (GDPR)
• UK Data Protection Act 2018 (amended 2020) (UK DPA)
• US Health Insurance Portability and Accountability Act of 1996 (HIPAA)
• Relevant U.S. State comprehensive privacy laws (such as the CCPA)
• Singaporean Personal Data Protection Act 2021 (amended 2020) (PDPA)
• Bermudan Personal Information Protection Act 2016 (PIPA)

2. Scope

This Policy applies to our processing of personal information at a corporate level worldwide and via this website and any affiliate websites, including our careers portal. This includes handling of personal information or personal data regarding patients, healthcare professionals, customers, other third-party business associates, candidates seeking work with us, employees, and others (collectively referred to as Personal Information).

Where required by applicable Privacy Laws, we may also supplement this Policy with specific collection, processing, transfer and purpose privacy statements in the specific context. If you reside in California, please find additional disclosures required by California law in our California section below.

3. Policy

3.1 What information do we collect?

The term “Personal Information” under this Policy refers to information about an identifiable individual, and may include:

• Contact details: name, address, telephone numbers, email addresses and social media handles/usernames.
• Demographic information: gender, citizenship, date of birth, race, ethnicity, veteran status, disability status.
• Reports: Information included in suspected adverse event reporting forms.
• Health information: Collected for safety reporting, clinical trials, or COVID vaccination status for site safety (where permitted).
• Clinical trials: Pre-treatment evaluation forms and patient consent forms.
• Candidate information: Employment history, references, and psychometric testing for job applicants.
• Employment information: Tax ID, government identification, salary, and benefit administration data.
• Communications: Records of discussions via email, phone, or social media.
• Online usage: IP addresses, location data, and website interaction via Cookies.

Sensitive Personal Information: EnGeneIC does not generally collect sensitive information (e.g., political opinions, religious beliefs, sexual orientation) other than health information or racial/ethnic origin where reasonably necessary for clinical trials or site safety.

3.2 How does EnGeneIC collect Personal Information?

We collect information from the following sources:

• From You: Information provided directly when collaborating, creating accounts, or contacting us.
• From Third Parties: Public sources, data vendors, or marketplace partners.
• From Cookies and Online Trackers: Automatically collected data regarding website activity, device identifiers, and IP addresses.

3.3 How does EnGeneIC use Personal Information?

We use Personal Information to:

• Administer and manage our relationship with you.
• Fulfil contracts and purchases.
• Conduct medical research and clinical trials.
• Enable adverse event reporting.
• Investigate prohibited or illegal activities (fraud prevention).
• Process job applications.

3.4 Disclosure of Information

EnGeneIC does not sell or trade Personal Information to third-party marketing businesses. Disclosures are limited to:

• Service Providers: Clinics, IT support, auditors, and insurers.
• Company Reorganisation: Mergers or sales of assets.
• Legal Necessity: To comply with legal processes or protect our rights and safety.

3.5 Direct Marketing

EnGeneIC does not generally engage in direct marketing. You may opt out of any electronic communications at any time using the contact details in Section 3.11 or the “unsubscribe” link in emails.

3.7 How does EnGeneIC protect your information?

We store information on high-security servers and limit access to authorized employees and providers under confidentiality obligations. While we take all reasonable steps to protect data, transmission via the internet is not completely secure and is at your own risk.

3.8 Overseas Transfers

As a global company, your data may be transferred to affiliates or third parties internationally. We ensure appropriate contractual protections (such as Standard Contractual Clauses for EU/UK data) are in place for transfers to countries without equivalent privacy laws.

3.9 Your Rights

Subject to local laws, you may have the right to access, rectify, erase, or restrict the processing of your Personal Information. To exercise these rights, contact privacy@engeneic.com.

4. California Privacy Rights Notice

This section applies specifically to California residents under the CCPA/CPRA. In the last 12 months, we have collected identifiers, commercial information, internet activity, geolocation data, and professional information.

Your Rights in California:

• Right to know and access specific pieces of Personal Information.
• Right to request deletion.
• Right to correct inaccurate information.
• Right to opt-out of the “sale” or “sharing” of Personal Information.

EnGeneIC does not knowingly sell or share information of individuals under 16. To exercise California rights, email privacy@engeneic.com.

5. Contact and Complaints

If you have questions or complaints regarding this policy, please contact our Privacy Officer:

Email: privacy@engeneic.com

If dissatisfied with our response, you may contact your local regulator:

• Australia: OAIC (oaic.gov.au)
• UK: ICO (ico.org.uk)
• Bermuda: Privacy Officer (PrivacyOfficer@gov.bm)
• USA: HHS (hhs.gov/hipaa)