Please see our Privacy Snapshot below for a high-level overview of our privacy practices.

1. Overview

1.1. Purpose
AnaptysBio, Inc. and its operating divisions, subsidiaries, affiliates, and branches (collectively, “AnaptysBio,” “Anaptys,” “we,” “our,” or “us”) are sensitive to privacy issues, and it is important to us to protect the information entrusted to us. Accordingly, AnaptysBio provides this privacy and information practices policy (the “Policy”) to inform you about how we handle your personal information (“Personal Information”).

1.2. Scope
This Policy applies to Personal Information that is processed by AnaptysBio in the course of our online business, including on AnaptysBio websites, (www.anaptysbio.com and https://ir.anaptysbio.com) (together with any and all future online and mobile offerings operated by or on behalf of AnaptysBio, the “Services”). This Policy does not apply to current or prospective clinical trial participants. If you are a current or prospective clinical trial participant, we will provide you with a separate notice.

This Policy applies to all AnaptysBio’s operating divisions, subsidiaries, affiliates, and branches and any additional subsidiary, affiliate, or branch of AnaptysBio that we may subsequently form.

2. Types of Personal Information We Collect and How We Use It

The types of Personal Information we collect (directly from you or from third-party sources) and our privacy practices depend on the nature of the relationship you have with AnaptysBio and the requirements of applicable law. We only collect Personal Information which is relevant for the purposes of our processing.

2.1. Types of Personal Information We Collect
AnaptysBio collects Personal Information regarding its service providers, investors, job candidates, healthcare professionals, and other website users (collectively, “you” or “your”).

2.1.1. Information You Provide Directly to Us
When you use or interact with the Services or engage in certain activities, such as participating in surveys, attending events, making an investor inquiry or document request, requesting services or information, applying for a job with us or contacting us directly, you may provide us with some or all of the following types of information:

• • • Contact information, such as name, email address, telephone, fax or mobile number, and address;
    • Professional information, such as your job title and company. If you are a healthcare professional, this may also include your medical specialization, professional qualifications, license number and scientific society membership number;
    • Communications, such as the content of requests and other correspondence you send to us;
    • Survey information, when you participate in one of our surveys and respond to our survey questions;
    • Preferences to receive marketing and for investor email alerts;
    • Application information, such as your name, contact information, job role applied for, resume information (including education and job history), job expectations and any other job application related information you provide to us when you express interest in, or apply for a job with us.

As part of your communications to us, or when you participate in surveys we run, you may choose to send us sensitive information, such as information about your health, including medical conditions, health history, treatment and medication history, medical records, and health insurance information. When you do so, we will comply with applicable laws. Any ‘protected health information’ will be protected in accordance with the requirements of HIPAA.

You can choose not to provide Personal Information to us directly, but some of this information is required to participate in some of the Services, and some Services may not function properly if you choose not to provide the Personal Information requested.

2.1.2. Information We Collect Automatically
We and our service providers may automatically log and combine information about you, your computer or mobile device, and your interactions over time with the Services, online resources, and our communications, such as:

Device data, including your computer’s or mobile device’s operating system type and version, manufacturer and model, browser type, screen resolution, device type (e.g., phone, tablet), IP address, unique identifiers, language settings, and general location information such as city, state, or geographic area.

Usage data, including pages, screens and/or features you viewed, accessed and/or used, how long you spent on a page, screen and/or feature, the website you visited before browsing to the Services, navigation paths between pages or screens, information about your activity on a page, screen and/or feature, access times, duration of access, and whether you have opened or otherwise engaged with our communications, such as our marketing emails, or clicked links or files within them.

For more information, including on our use of Cookies, please see section on Cookies below.

2.1.3. Information We Obtain from Other Sources
We may receive Personal Information about you from other sources, including through third-party services and organizations.

We may also receive personal data from service providers that conduct surveys for us. They will collect your survey responses on our behalf.

Further, if you are a healthcare professional, we may obtain your Personal Information from a Clinical Research Organization (CRO). This may include your first name, last name, age, gender, home address, home phone number, medical specialization, professional qualifications, license number and scientific society membership number.

2.2. How AnaptysBio Uses Personal Information
We collect and process Personal Information based on the following legal grounds and for the following purposes:

• • To Provide Products, Services, or Information Requested: To perform a contract with you, or where it is in our legitimate business interests, AnaptysBio may use Personal Information about you to fulfill requests for products, Services, or information, including information about potential or future Services, such as to:
    • Generally manage information;
    • Respond to questions, comments, and other requests;
    • Provide access to certain areas, functionalities, and features of the Services;
    • Allow you to register for events.
  • For Administrative Purposes: Where it is in our legitimate business interests, AnaptysBio may use Personal Information about you for its administrative purposes, including to:
    • Ensure internal quality control;
    • Communicate with you about our Services and systems, for example to communicate changes to any AnaptysBio policy;
    • Process job applications and transactions.
  • To send you marketing communications: Except where consent is required, we use your Personal Information to send marketing to you where it is in our legitimate business interests. You may contact us at any time to opt out of marketing, as further described below.
  • For Legal and Compliance Purposes: AnaptysBio processes Personal Information to comply with regulatory and legal requirements, including to enforce our Terms of Use, to protect our, your or others’ rights, privacy, safety or property (including by making and defending legal claims) and to audit our internal processes for compliance with legal and contractual requirements and internal policies.
  • To prevent potentially prohibited or illegal activities, including cyberattacks and identity theft to comply with our legal obligations and/or where it is in our legitimate business interests to do so.
  • For Research and Development: AnaptysBio may use Personal Information to create non-identifiable information that we may use alone or in the aggregate with information obtained from other sources, in order to help us to optimally deliver our existing products and Services or develop new products and Services. Anonymized and aggregated information is used for a variety of functions, including the measurement of visitors’ interest in and use of various portions or features of the Services. Where aggregated information constitutes your Personal Information, AnaptysBio will only process it in accordance with this Policy. Where aggregated information is fully anonymized, it is not Personal Information, and AnaptysBio may use such information in a number of ways, including research, internal analysis, analytics, and any other legally permissible purposes. We may share this information within AnaptysBio and with third parties for our or their purposes in an anonymized or aggregated form that is designed to prevent anyone from identifying you.
  • To carry out Surveys: From time to time, AnaptysBio may perform research (online and offline) via surveys. We may engage third-party service providers to conduct such surveys on our behalf. All survey responses are voluntary, and the information collected will be used for research and reporting purposes to help us better serve patients by learning more about their needs and the quality of the products and Services we provide. The survey responses may be utilized to determine the effectiveness of our Services, various types of communications, advertising campaigns, and/or promotional activities. We carry out surveys when it is in our legitimate business interests.

3. Information Disclosures

3.1. Information We Share
AnaptysBio does not sell or otherwise disclose Personal Information about you, except as described in this Policy or as you explicitly consent to.

3.1.1. Service Providers
AnaptysBio may share Personal Information with our service providers that we have retained to perform services on our behalf including (i) provision of IT and related services; (ii) provision of information and services you have requested and (iii) customer service activities.

AnaptysBio has executed appropriate contracts with the service providers that prohibit them from using or sharing Personal Information except as necessary to perform the contracted services on our behalf or to comply with applicable legal requirements.

3.1.2. Business Partners
AnaptysBio may share Personal Information with our business partners and affiliates for our and our affiliates’ internal business purposes or to provide you with a product or service that you have requested. AnaptysBio requires our affiliates and business partners to agree in writing to maintain the confidentiality and security of Personal Information and not to use it for any purpose other than the purpose for which AnaptysBio provided it to them.

3.1.3. Information Disclosed for Our Protection and the Protection of Others
We may disclose information about you: (i) if we are required to do so by law, court order, or legal process; (ii) in response to lawful requests by public authorities, including to meet national security or law enforcement requirements; (iii) under the discovery process in litigation; (iv) to enforce AnaptysBio policies or contracts; (v) to collect amounts owed to AnaptysBio; (vi) when we believe disclosure is necessary or appropriate to prevent physical harm or financial loss or in connection with an investigation or prosecution of suspected or actual illegal activity; or (vii) if we, in good faith, believe that disclosure is otherwise necessary or advisable.

In addition, from time to time, server logs may be reviewed for security purposes – e.g., to detect unauthorized activity on the Services. In such cases, server log data containing IP addresses may be shared with law enforcement bodies in order that they may identify users in connection with their investigation of the unauthorized activities.

3.1.4. Information Disclosed in Connection with Business Transactions
We reserve the right to disclose or transfer any Personal Information we have about you in the event of a proposed or actual purchase, reorganization, sale, lease, merger, joint venture, assignment, amalgamation, or any other type of acquisition, disposal, or financing of all or any portion of our business or of any of the business assets or shares (including in connection with any bankruptcy or similar proceeding).

3.2. Data Transfers
All Personal Information collected via or by AnaptysBio will be stored in the United States or other jurisdictions by us or our service providers. Please note that such jurisdictions may not provide the same protections as the data protection laws in your home country.

When we engage in cross-border data transfers, we will ensure that relevant safeguards are in place to afford adequate protection for Personal Information and we will comply with applicable data protection laws, for example by relying on an EU Commission or UK government adequacy decision/regulation for transfers outside of the European Economic Area and United Kingdom, or on contractual protections for the transfer of Personal Information. For more information about how we transfer Personal Information internationally, please contact us at: privacy@anaptysbio.com.

4. Rights regarding your Personal Information

Opt out of marketing communications. You may opt out of marketing-related communications by following the opt-out or unsubscribe instructions contained in the marketing communications we send you or by contacting us as at privacy@anaptysbio.com. You may continue to receive non-marketing emails.

Personal Information requests. We offer you choices that affect how we handle the Personal Information that we control. Depending on your location and the nature of your interactions with our Services, you may request the following in relation to Personal Information:

• Information about how we have collected and used Personal Information. We have made this information available to you without having to request it by including it in this Policy.
• Access to a copy of the Personal Information that we have collected about you. Where applicable, we will provide the information in a portable, machine-readable, readily usable format.
• Correction of Personal Information that is inaccurate or out of date.
• Deletion of Personal Information that we no longer need to provide the Services or for other lawful purposes.
• Withdrawal of consent, where we have collected and processed your Personal Information with your consent. Withdrawing your consent will not affect the lawfulness of any processing we conducted prior to your withdrawal, nor will it affect processing of your Personal Information conducted in reliance on lawful processing grounds other than consent.
• Opt out of the sale of your Personal Information or sharing of your Personal Information for interest-based advertising. We currently do not engage in the sale of your Personal Information or the sharing of your Personal Information for such purposes.
• Opt out of “profiling” in connection with decisions that produce legal or similarly significant effects. We currently do not engage in profiling in connection with decisions that produce legal or similarly significant effects.
• Appeal our denial of your Personal Information request.
• Additional rights, such as the rights to object to and request that we restrict our use of Personal Information.

To make a request, you may use any of the methods set out in Section 7 of this Policy. Such requests will be processed in line with local laws. We may ask for specific information from you to help us confirm your identity. Depending on where you reside, you may be entitled to empower an “authorized agent” to submit requests on your behalf. We will require authorized agents to confirm their identity and authority, in accordance with applicable laws. You are entitled to exercise the rights described above free from discrimination.

Although AnaptysBio makes good faith efforts to provide you with access to your Personal Information, there may be circumstances in which AnaptysBio is unable to provide access, including but not limited to: where the information contains legal privilege, would compromise others’ privacy or other legitimate rights, where the burden or expense of providing access would be disproportionate to the risks to your privacy in the case in question or where it is commercially proprietary. If AnaptysBio determines that access should be restricted in any particular instance, we will provide you with an explanation of why that determination has been made and a contact point for any further inquiries. To protect your privacy, AnaptysBio will take commercially reasonable steps to verify your identity before granting access to or making any changes to your Personal Information.

5. Retention

Where required under applicable laws, AnaptysBio retains the Personal Information we receive as described in this Policy for as long as you use our Services or as necessary to fulfill the purpose(s) for which it was collected, provide our products and Services, resolve disputes, establish legal defenses, conduct audits, pursue legitimate business purposes, enforce our agreements, and comply with applicable laws.

To determine the appropriate retention period for Personal Information, we consider the amount, nature, and sensitivity of the Personal Information, the potential risk of harm from unauthorized use or disclosure of Personal Information, the purposes for which we use Personal Information and whether we can achieve those purposes through other means, and the applicable legal and regulatory requirements.

6. Security

The security of all Personal Information provided to AnaptysBio is important to us, and AnaptysBio takes reasonable steps designed to protect Personal Information. Unfortunately, no data transmission over the Internet or storage of information can be guaranteed to be 100% secure. As a result, while AnaptysBio strives to protect Personal Information, we cannot ensure or warrant the security of any information you transmit to AnaptysBio, and you do so at your own risk. You are responsible for maintaining the secrecy of your own passwords. If you have reason to believe that your passwords or Personal Information is no longer secure, please promptly notify AnaptysBio at privacy@AnaptysBio.com.

7. Contact Us

For the purposes of this Policy, AnaptysBio is the controller of (or the business for) your Personal Information. If after reviewing this Policy, you would like to submit a request or you have any questions or privacy concerns, please contact us at either: privacy@anaptysbio.com or 10770 Wateridge Circle, Suite 210, San Diego, CA 92121-5801. AnaptysBio will address your concerns and attempt to resolve any privacy issues in a timely manner. Depending on where you are located, you may be entitled to complain to your local data protection authority if you are unhappy with how we handle your Personal Information.

VeraSafe has been appointed as AnaptysBio’s representative in the European Economic Area (“EEA”) and in the United Kingdom (“UK”) for data protection matters. See below for VeraSafe’s contact details:

In the EEA:
VeraSafe Czech Republic s.r.o.
Klimentská 46
Prague 1, 11002
Czech Republic

In the UK:
VeraSafe United Kingdom Ltd.
37 Albert Embankment
London SE1 7TL
United Kingdom

If you are in the EEA or the UK, you can contact VeraSafe in addition to privacy@anaptysbio.com, only on matters related to the processing of Personal Information. To make such an inquiry, please contact VeraSafe using this contact form: https://verasafe.com/public-resources/contact-data-protection-representative.

8. Other Rights and Important Information

8.1. Information Regarding Children
Due to the nature of AnaptysBio’s business, products and Services are not marketed to minors. AnaptysBio does not knowingly solicit or collect Personal Information from children under the age of 13 (and in certain jurisdictions under the age of 16). If we learn that we have collected Personal Information from a child under the age of 13 (and in certain jurisdictions under the age of 16), we will promptly delete that information.

8.2. Links to Third-Party Websites
AnaptysBio’s Services may contain links to other websites for your convenience and information. AnaptysBio does not control third-party websites or their privacy practices, which may differ from those set out in this Policy. AnaptysBio does not endorse or make any representations about third-party websites. Any Personal Information you choose to give to unrelated third parties is not covered by this Policy. AnaptysBio encourages you to review the privacy policy of any company or website before submitting your Personal Information. Some third parties may choose to share their users’ Personal Information with AnaptysBio; that sharing is governed by that company’s privacy policy, not this Policy.

8.3. Changes to the Policy
AnaptysBio may update this Policy from time to time as it deems necessary in its sole discretion. AnaptysBio encourages you to review this Policy periodically to be informed regarding how AnaptysBio is using and protecting Personal Information and to be aware of any policy changes. Your continued relationship with AnaptysBio after the posting or notice of any amended Policy shall constitute your agreement to be bound by any such changes. Any changes to this Policy take effect immediately after being posted or otherwise provided by AnaptysBio.

9. Cookies

This section explains how AnaptysBio uses cookies and similar technologies in connection with our Services.

You are free to set your browser or operating system settings to limit or decline cookies which are not necessary for the functioning of our websites, but by doing so, you may not be able to use certain features on our websites or take full advantage of all of our offerings.

In certain circumstances, we collect Personal Information about you through these cookies which may include your IP address, information about the way you use our websites, your choice of Internet browser, the type of device you’re accessing our websites from, and where you are in the world.

What are cookies and similar technologies?

• Cookies are text files that websites store on a visitor’s device to uniquely identify the visitor’s browser or to store information or settings in the browser for the purpose of helping you navigate between pages efficiently, remembering your preferences, enabling functionality and helping us understand activity and patterns.
• Local storage technologies, like HTML5, provide cookie-equivalent functionality but can store larger amounts of data, including on your device outside of your browser in connection with specific applications.
• Web beacons, also known as pixel tags or clear GIFs, are used to demonstrate that a webpage or email was accessed or opened, or that certain content was viewed or clicked.

We may use both persistent cookies and session cookies. Persistent cookies stay on your device for a set period of time or until you delete them, while session cookies are deleted once you close your web browser. The cookies placed through your use of our website are either set by us (first-party cookies) or by a third party at our request (third-party cookies).

What types of cookies do we use?

We use the following categories of cookies:

• Essential. We use essential cookies to help make our Services usable by enabling basic functions like page navigation and access to secure areas of the website. You can set your browser to block or alert you about these cookies, but then some parts of the websites will not work.
• Functionality / performance. We use these cookies to enhance the functionality and performance of the Services.
• Analytics. These cookies help us understand how you interact with our websites by providing information such as the pages visited, the time spent on the websites, and any issues encountered, such as error messages. The information these cookies collect are for the purposes of generating aggregated statistics, and they help us improve the way our Services work. Where required by law, we will obtain your consent before placing analytics cookies on your device.

How can you control the use of cookies?

Depending on where you access the Services from, you may be presented with a cookie banner or other tool to provide permissions prior to non-essential cookies being set. In this case, we only set these non-essential cookies with your consent.

You can also limit online tracking by:

• Blocking cookies in your browser. Most browsers let you remove or reject cookies. To do this, follow the instructions in your browser settings. Many browsers accept cookies by default until you change your settings. For more information about cookies, including how to see what cookies have been set on your device and how to manage and delete them, visit www.allaboutcookies.org.Use the following links to learn more about how to control cookies and online tracking through your browser:
  Firefox; Chrome; Microsoft Edge; Safari (Mac); Safari (Mobile/iOS)
• Using privacy plug-ins or browsers. You can block our websites from setting cookies used for interest-based ads by using a browser with privacy features, like Brave, or installing browser plugins like Privacy Badger, Ghostery, or uBlock Origin, and configuring them to block third party cookies/trackers.
• Google Analytics. We use Google Analytics to help us better understand how people engage with our Services by collecting information and creating reports about how users use our Services. For more information on Google Analytics, click here. For more information about Google’s privacy practices, click here. You can opt out of Google Analytics by downloading and installing the browser plug-in available at: https://tools.google.com/dlpage/gaoptout

You may also have the ability to reject or toggle off non-essential cookies by enabling the Global Privacy Control setting within the browser that you use to access our websites. Learn more at the Global Privacy Control website.

Note that because these opt out mechanisms are specific to the device or browser on which they are exercised, you will need to opt out on every browser and device that you use.

Do Not Track. Some Internet browsers can be configured to send “Do Not Track” signals to the online services that you visit. We currently do not respond to “Do Not Track” or similar signals. To find out more about “Do Not Track,” please visit http://www.allaboutdnt.com.

Privacy Snapshot

Below is a high-level snapshot of how we collect, use, and disclose your Personal Information, but you need to read the entire Policy for complete information.

Note: As described further in our Policy, we may disclose all categories of Personal Information to our service providers, affiliates, and professional advisors for the purposes described in the Policy. We also may disclose Personal Information to authorities and others for legal and compliance purposes, and business transferees in the context of an acquisition or the sale of our business or another corporate transaction.

Last updated: 01 October 2024