Rarity PBC Privacy Notice

Last updated: February 18, 2026

This Privacy Notice explains how Rarity PBC (“Rarity,” “we,” “us,” or “our”) collects, uses, and shares information when you interact with us, including when you visit our website (raritypbc.com) or contact us by email or through our online forms.

1. Who we are

Rarity is a mission driven public benefit biotech company focused on developing life saving gene therapies for rare diseases and working to ensure accessibility and affordability for patients.

For information about how we handle consumer health data as that term is defined under applicable state law, please see our Consumer Health Data Privacy Notice.

2. Information we collect

We collect information that you choose to provide directly to us, for example when you:

Email us at an address such as info@raritypbc.com.
Fill out a “contact us” or similar form on our website.
Request information about our programs, research, or partnerships.

This may include:

Contact details (name, email address, phone number, organization, role).
Communications and inquiries (the content of your message, questions, feedback, or other details you choose to include).
• Relationship and context information (for example, whether you are a clinician, researcher, investor, or other stakeholder) when you choose to share it. We do not request information about any individual's medical condition, diagnosis, or treatment status.

We also collect limited technical information when you visit our website, such as:

Basic log and device data (browser type, operating system, general region derived from IP address, and pages viewed). We do not collect precise geolocation data.
Date and time of your visit and how you navigate and interact with our site.

We may also receive information about you from organizations or individuals you interact with in connection with our work (for example, research collaborators or service providers who help us manage communications or events), where they are permitted to share that information with us. Any health-related data received from clinical sites or research partners in connection with our gene therapy programs is de-identified prior to our receipt and is not subject to this Notice.

We do not request consumer health data (as defined under applicable state law) or other individually identifiable health information through our public website or general communications. Please see our Consumer Health Data Privacy Notice for information about how we handle consumer health data, including consumer health data that we inadvertently receive.

3. How we use information

We use the information we collect for the following purposes:

To respond to your inquiries and provide information you request (for example, about our research, programs, or potential collaborations).
To manage our relationships with patients, caregivers, clinicians, researchers, partners, investors, and advisors.
To operate, maintain, and improve our website and online services, including monitoring performance, troubleshooting, and enhancing usability.
To plan and manage scientific, clinical, commercial, and partnership activities related to our mission to advance gene therapies for rare diseases.
To comply with applicable laws, regulations, and legal processes, and to protect our rights, safety, and the rights and safety of others.
To send you updates, invitations, or other information about our programs, research, events, or opportunities that we believe may be relevant to you, where permitted by applicable law and your communication preferences.

We may also use de‑identified or aggregated information (that does not identify you as an individual) for analytics, reporting, and to help guide our scientific and business planning.

To the extent we receive consumer health data, our use of that information is governed by our Consumer Health Data Privacy Notice.

4. How we disclose information

We do not sell personal information or share it for targeted advertising or similar purposes.

We may disclose information with:

Service providers and vendors who help us operate our website, manage communications, store data, provide IT and security services, or support our research and business operations (for example, hosting providers or professional advisors). These service providers are contractually required to use personal information only to provide services to us and to protect it in a manner consistent with this Notice and applicable law.
Research, clinical, or manufacturing partners, as needed to support our mission and only where appropriate safeguards are in place (for example, with academic institutions or contract research and manufacturing organizations involved in advancing our programs).
Our use of cloud‑based productivity, collaboration, and storage tools, including Microsoft 365 and DocuSign, may involve storing or processing personal information with those providers to support our internal operations. To the extent any consumer health data is inadvertently received and stored in these tools, our handling of that information is governed by our Consumer Health Data Privacy Notice.
Affiliates or future entities under common control, to the extent needed for corporate governance, operations, and mission alignment.
Public authorities, regulators, or other parties when required to comply with law, regulation, legal process, or to protect our rights or the rights, safety, and property of others.

In the event of a corporate transaction (such as an investment, merger, acquisition, financing, or similar event), information may be disclosed to relevant counterparties and their advisors, subject to appropriate confidentiality protections.

We may share de‑identified or aggregated information that does not reasonably identify you with third parties for analytics, research, or reporting purposes.

5. Cookies and similar technologies

When you visit our website or open our emails, we may collect certain information by automated means, such as cookies, web server logs, pixels, or similar technologies. Cookies are small files that websites store on your device to recognize your browser and to remember information about your visit over time.

We use these technologies to help our website function, understand how visitors use our pages, and improve the content and performance of our site (for example, by learning which pages are visited most often and how visitors move between them). We do not use cookies on our public website to infer sensitive characteristics about you.

Your browser may tell you how to be notified when you receive certain types of cookies, how to limit or turn off certain cookies, or how to delete cookies. If you choose to block or delete cookies, some parts of our website may not function as intended.

6. Data retention

We retain personal information for as long as reasonably necessary to fulfill the purposes described in this Notice, including:

Responding to your inquiries and maintaining contact records.
Supporting our research, clinical, regulatory, and business activities.
Complying with legal, regulatory, tax, and accounting requirements, and maintaining appropriate business records.

When information is no longer needed for these purposes, we will delete it, de‑identify it, or aggregate it, subject to any legal or operational retention requirements.

In determining appropriate retention periods, we consider the amount, nature, and sensitivity of the personal information, the potential risk of harm from unauthorized use or disclosure, the purposes for which we process it, and applicable legal, regulatory, and operational requirements.

7. Your choices and rights

You can:

Choose not to provide certain information; however, this may limit our ability to respond to your requests.
Ask us to stop sending you non‑essential communications by following any unsubscribe instructions in our messages or by contacting us directly.
Contact us to request access to, correction of, or deletion of personal information we hold about you, where these rights are available under applicable law.

We will review and respond to requests in line with applicable legal requirements and our mission‑driven operational needs and may request additional information to verify your identity before processing certain requests.

If you have questions or requests specifically related to consumer health data, please refer to our Consumer Health Data Privacy Notice, which describes the rights available to you under applicable state law and how to exercise them.

8. Children

Our website and general communications are not directed to children under 18. We do not knowingly collect personal information from children via our public website. If you believe a child has provided personal information to us through our site, please contact us so that we can take appropriate steps.

9. Clinical Trials

Any participation in clinical trials or research programs is governed by separate study‑specific documentation (including informed consent and authorization forms), which will describe how information collected in those contexts is used and protected. In the event of any inconsistency between that documentation and this Notice, the study‑specific documentation will generally control for information collected in connection with the study.

10. Security

We use reasonable technical and organizational measures designed to protect personal information from accidental or unlawful destruction, loss, alteration, unauthorized disclosure, or access, taking into account the nature of the information and the context in which we process it.

No method of transmission or storage is completely secure, so we cannot guarantee absolute security; however, we work to limit access to personal information to individuals with a legitimate business need and to use appropriate safeguards.

11. Third-party websites

Our website may provide links to third‑party websites or services for your convenience or information. Those sites are not controlled by Rarity, and their privacy practices are governed by their own policies, which we encourage you to review.

12. International Considerations

Rarity is based in the United States, and information we collect will typically be processed in the United States.

If you are located outside the United States and choose to interact with us, you understand that your information may be transferred to and processed in countries that may have data protection laws different from those in your home country.

Where required by local law for specific collaborations or programs, we may implement additional measures or enter into specific data transfer arrangements, which will be described in the relevant program‑specific or collaboration‑specific documentation.

13. Changes to this Notice

We may update this Privacy Notice from time to time to reflect changes in our practices, technologies, or legal requirements.

When we make material changes, we will revise the “last updated” date below and may provide additional notice where required by law or where we believe it is appropriate.

14. How to contact us

If you have questions about this Privacy Notice or our privacy practices, or if you would like to exercise a choice or right described above, you can contact us at:

Email: info@raritypbc.com

For privacy‑specific questions or requests, please include “Privacy Request” in the subject line of your email and provide enough detail to allow us to understand and respond to your request.