Rarity PBC Privacy Notice

Last updated: February 18, 2026

This Privacy Notice explains how Rarity PBC (“Rarity,” “we,” “us,” or “our”) collects, uses, and shares information when you interact with us, including when you visit our website (raritypbc.com) or contact us by email or through our online forms.

1. Who we are

Rarity is a mission‑driven public benefit biotech company focused on developing life‑saving gene therapies for rare diseases and working to ensure accessibility and affordability for patients.

We are not a large-scale consumer platform, and our primary contacts are patients, caregivers, clinicians, researchers, partners, and other stakeholders who reach out to us directly.

2. Information we collect

We collect information that you choose to provide directly to us, for example when you:

Email us at an address such as info@raritypbc.com.
Fill out a “contact us” or similar form on our website.
Request information about our programs, research, or partnerships.

This may include:

Contact details (name, email address, phone number, organization, role).
Communications and inquiries (the content of your message, questions, feedback, or other details you choose to include).
Relationship and context information (for example, whether you are a patient, caregiver, clinician, researcher, investor, or other stakeholder) when you choose to share it.

We also collect limited technical information when you visit our website, such as:

Basic log and device data (browser type, operating system, general region derived from IP address, and pages viewed).
Date and time of your visit and how you navigate and interact with our site.

We may also receive information about you from organizations or individuals you interact with in connection with our work (for example, clinical sites, research collaborators, or service providers who help us manage communications or events), where they are permitted to share that information with us.

We do not intentionally collect sensitive health information about identifiable individuals through our public website. If you choose to include health‑related information in a message to us, we will use it only for the purposes described in this Notice (for example, to respond to your inquiry or evaluate potential research or program opportunities) and will limit access to personnel who need to see it for those purposes.

3. How we use information

We use the information we collect for the following purposes:

To respond to your inquiries and provide information you request (for example, about our research, programs, or potential collaborations).
To manage our relationships with patients, caregivers, clinicians, researchers, partners, investors, and advisors.
To operate, maintain, and improve our website and online services, including monitoring performance, troubleshooting, and enhancing usability.
To plan and manage scientific, clinical, commercial, and partnership activities related to our mission to advance gene therapies for rare diseases.
To comply with applicable laws, regulations, and legal processes, and to protect our rights, safety, and the rights and safety of others.
To send you updates, invitations, or other information about our programs, research, events, or opportunities that we believe may be relevant to you, where permitted by applicable law and your communication preferences.

We may also use de‑identified or aggregated information (that does not identify you as an individual) for analytics, reporting, and to help guide our scientific and business planning.

4. How we disclose information

We do not sell personal information or share it for targeted advertising or similar purposes.

We may disclose information with:

Service providers and vendors who help us operate our website, manage communications, store data, provide IT and security services, or support our research and business operations (for example, hosting providers or professional advisors). These service providers are contractually required to use personal information only to provide services to us and to protect it in a manner consistent with this Notice and applicable law.
Research, clinical, or manufacturing partners, as needed to support our mission and only where appropriate safeguards are in place (for example, with academic institutions or contract research and manufacturing organizations involved in advancing our programs).
Our use of cloud‑based productivity, collaboration, and storage tools may involve storing or processing personal information with those providers to support our internal operations.
Affiliates or future entities under common control, to the extent needed for corporate governance, operations, and mission alignment.
Public authorities, regulators, or other parties when required to comply with law, regulation, legal process, or to protect our rights or the rights, safety, and property of others.

In the event of a corporate transaction (such as an investment, merger, acquisition, financing, or similar event), information may be disclosed to relevant counterparties and their advisors, subject to appropriate confidentiality protections.

We may share de‑identified or aggregated information that does not reasonably identify you with third parties for analytics, research, or reporting purposes.

5. Cookies and similar technologies

When you visit our website or open our emails, we may collect certain information by automated means, such as cookies, web server logs, pixels, or similar technologies. Cookies are small files that websites store on your device to recognize your browser and to remember information about your visit over time.

We use these technologies to help our website function, understand how visitors use our pages, and improve the content and performance of our site (for example, by learning which pages are visited most often and how visitors move between them). We do not use cookies on our public website to infer sensitive characteristics about you.

Your browser may tell you how to be notified when you receive certain types of cookies, how to limit or turn off certain cookies, or how to delete cookies. If you choose to block or delete cookies, some parts of our website may not function as intended.

6. Legal bases / fairness principles

Although we are not currently subject to comprehensive state privacy regimes, we strive to treat personal information fairly and responsibly. In practice, this means we generally:

Use your information only for the purposes described in this Notice or otherwise explained to you at the time of collection.
Limit our collection to information that is relevant and reasonably necessary for those purposes.
Take steps to avoid using information in ways that are incompatible with the context in which it was provided, unless required by law.

Where applicable law provides specific legal bases (such as consent, legitimate interests, or contractual necessity), we will rely on those bases in a manner consistent with this Notice.

7. Data retention

We retain personal information for as long as reasonably necessary to fulfill the purposes described in this Notice, including:

Responding to your inquiries and maintaining contact records.
Supporting our research, clinical, regulatory, and business activities.
Complying with legal, regulatory, tax, and accounting requirements, and maintaining appropriate business records.

When information is no longer needed for these purposes, we will delete it, de‑identify it, or aggregate it, subject to any legal or operational retention requirements.

In determining appropriate retention periods, we consider the amount, nature, and sensitivity of the personal information, the potential risk of harm from unauthorized use or disclosure, the purposes for which we process it, and applicable legal, regulatory, and operational requirements.

8. Your choices and rights

You can:

Choose not to provide certain information; however, this may limit our ability to respond to your requests.
Ask us to stop sending you non‑essential communications by following any unsubscribe instructions in our messages or by contacting us directly.
Contact us to request access to, correction of, or deletion of personal information we hold about you, where these rights are available under applicable law.
In some circumstances, you may also object to or request that we restrict certain types of processing, particularly where we rely on our interests in operating and developing our business and mission.

We will review and respond to requests in line with applicable legal requirements and our mission‑driven operational needs and may request additional information to verify your identity before processing certain requests.

9. Children

Our website and general communications are not directed to children under 18. We do not knowingly collect personal information from children via our public website. If you believe a child has provided personal information to us through our site, please contact us so that we can take appropriate steps.

Any participation in clinical trials or research programs is governed by separate study‑specific documentation (including informed consent and authorization forms), which will describe how information collected in those contexts is used and protected. In the event of any inconsistency between that documentation and this Notice, the study‑specific documentation will generally control for information collected in connection with the study.

10. Security

We use reasonable technical and organizational measures designed to protect personal information from accidental or unlawful destruction, loss, alteration, unauthorized disclosure, or access, taking into account the nature of the information and the context in which we process it.

No method of transmission or storage is completely secure, so we cannot guarantee absolute security; however, we work to limit access to personal information to individuals with a legitimate business need and to use appropriate safeguards.

11. Third-party websites

Our website may provide links to third‑party websites or services for your convenience or information. Those sites are not controlled by Rarity, and their privacy practices are governed by their own policies, which we encourage you to review.

12. International Considerations

Rarity is based in the United States, and information we collect will typically be processed in the United States.

If you are located outside the United States and choose to interact with us, you understand that your information may be transferred to and processed in countries that may have data protection laws different from those in your home country.

Where required by local law for specific collaborations or programs, we may implement additional measures or enter into specific data transfer arrangements, which will be described in the relevant program‑specific or collaboration‑specific documentation.

13. Changes to this Notice

We may update this Privacy Notice from time to time to reflect changes in our practices, technologies, or legal requirements.

When we make material changes, we will revise the “last updated” date below and may provide additional notice where required by law or where we believe it is appropriate.

14. How to contact us

If you have questions about this Privacy Notice or our privacy practices, or if you would like to exercise a choice or right described above, you can contact us at:

Email: info@raritypbc.com

For privacy‑specific questions or requests, please include “Privacy Request” in the subject line of your email and provide enough detail to allow us to understand and respond to your request.