Website Privacy Policy

This policy governs our website privacy terms and use of cookies.

Last Updated: DECEMBER 3, 2024

This privacy notice applies to all users of our website where Biora Therapeutics, Inc. with an address at 10070 Carroll Canyon Road, Suite 100, San Diego, CA 92131 (“Biora Therapeutics”), is the data controller for your personal data, and explains the purposes for which we process your personal data, how we collect and use your personal data, how long we retain your personal data, and the rights you have in relation to your personal data. Personal data means any information that relates to an identified or identifiable living individual.

Any references in this policy to “you” or “your” should be interpreted in the context in which the information is processed. Biora Therapeutics respects all data subject rights to privacy and complies with all applicable data protection laws and regulations. Under European data protection law we need to have a lawful basis for processing your personal data. Biora Therapeutics only processes your personal data under one (or more) of the following bases.

• Consent: you must have provided your clear consent to us processing your personal data for a specific purpose.
• Contract: the processing is necessary for a contract that we have with you, or because we need to take steps to enter into a contract with you.
• Legal Obligation: the processing is necessary for us to comply with the law.
• Vital Interests: the processing is necessary to protect someone’s life.
• Public Task: the processing is necessary for a task in the public interest.
• Legitimate Interests: the processing is necessary for our legitimate interests, or the legitimate interests of a third-party.

Further information on which lawful basis we use can be found below.

We collect personal data from:

• Website visitors;
• Prospective and current clinical study participants; and
• Prospective employees accessing or creating accounts on one of our portals (as described below).

Personal Data Collection

We collect personal data that you provide to us directly, as well as information provided by your browser or device when you visit our website. We also collect personal data via the portals connected to our site (as described below).

We will collect information from you so that we can provide you with the services you require. If you do not provide certain information, we may not be able to fulfill your requests.

Personal Data Collected from You

Register for Updates

If you choose to register for updates from Biora Therapeutics, we will collect your email address. We collect this information for the purpose of providing you with company updates.

Lawful basis/es: You must have provided your consent to us processing your personal data for this purpose.

Register for a Webinar

If you choose to register for a webinar hosted by Biora Therapeutics, we will collect first and last name, email, company name, and phone number. We collect this information for the purpose of registering you for and communicating with you about the webinar.

Lawful basis/es: You must have provided your consent to us processing your personal data for this purpose.

Personal Data Collected via Our Website Portals

Submit a Job Application

If you apply for a job via our Careers portal, you will be asked to provide your first and last name, contact information, work history, education, applicant information and your answers to our pre-employment questions. If you submit a resume and/or cover letter, we will also collect any information you provide in such documents, including any additional personal information you choose to share. We use this information to evaluate your candidacy for employment, as well as contact you regarding your application.

Lawful basis/es: The processing is necessary for our legitimate interests, or the legitimate interests of a third-party as described below. In some instances, the processing is necessary for a contract that we have with you, or because we need to take steps to enter into a contract with you.

Personal Data Collected via Web-Based Technologies

Browser or Device Information

When you use the website, we automatically receive certain information provided by the interaction of your mobile phone or web browser and the website. This information includes your internet website provider name, web browser type, type of mobile device (if applicable), and computer operating system. We use this information to analyze trends among our users to help improve the website. Such information is collected in anonymous, aggregate form and is typically not considered personal data.

We also collect information on computer operating system, your IP address, the web browser, and information about the websites visited before accessing the website.

We collect this data for the following general purposes:

• Customizing your user experience
• Promoting and improving services.

Lawful basis/es: You must have provided your consent to us processing your personal data for a specific purpose. For further details, please refer to Cookies and Web Beacons below.

Cookies and Web Beacons

We use first- and third-party cookies and web beacons to personalize the content that you see on our website, analyze our web traffic, and improve your experience while visiting the website. Most web browsers can be set to disable the use of cookies.

Information on the cookies and web beacons used by Biora Therapeutics (including list of essential and non-essential cookies) can be found on Biora Therapeutics’ Cookies Notice.

When you first visit our website, you will be asked to consent to our use of cookies, and you can withhold, withdraw, or change your consent at any time.

Lawful basis/es: You must have provided your consent to the use of cookies.

Personal Data Use

How we use your personal data will depend on how you interact with our website and the personal data you have shared with us.

Our legal bases for processing your personal data include your prior consent, fulfilment of a contractual obligation, and where we have a legitimate interest to process your personal data, provided that our interests do not outweigh your individual rights and freedoms.

Our legitimate interests include:

• Investigating, preventing, and protecting against fraud, security risks, threats to you and others, and violations of this policy;
• Protecting and defending our rights and properties, including intellectual property;
• Complying with laws and regulations that apply to us, as well as responding to requests from law enforcement or government authorities or as otherwise required by law;
• Understanding and improving our website, user experience, and customer relationships; and
• Enabling our business operations.

Respond to Your Requests

We use your personal data to respond to your requests, including communications, requests for updates. We may also use your personal data to register you for webinars, and, when applicable, consider your candidacy for employment.

Enhance Website and User Experience

We use the information regarding the use of our website to analyze and administer the site and track user movement for web analytics purposes. This website usage information enables us to provide you with an ever-improving site, service, and general offering. Except where you have provided consent for us to use your identifiable personal data for our analytics research, we only use anonymous, aggregate data that cannot be used to identify you individually.

Conduct Marketing and Advertising

If you request to receive company updates, we will use the contact information you provided to send you the requested information, to keep you informed about company news, events, or regulatory filings.

Meet Legal and Regulatory Obligation

In certain circumstances, we use your personal data if we are required to by law or legal proceeding. We will only share the information we are required to disclose by law and only when we are required to do so, including to meet national security or law enforcement requirements.

Security and Fraud Prevention

When necessary, we will use your personal data to preserve the security of our website, systems, and personal data in our control. If necessary, we will also use your personal data to investigate possible fraud, to identify violations of this Privacy Policy and our Legal Terms, and to prevent any attempted harm to you and our services.

Personal Data Sharing and Disclosure

We share your personal data when you have granted us permission to do so, when it is necessary to fulfill our obligations to you, or when it is in the legitimate interest of our business to do so, provided that our interests do not outweigh your individual rights and freedoms.

Support Vendors

When necessary, we share your data with third-party vendors working on our behalf to provide specific business support services, including website hosting and management and career applications. Such third-party vendors will only receive information necessary to provide the respective services and will be bound by confidentiality agreements limiting the use of such information.

Website Analytics Companies

We share anonymous, aggregate information regarding visitors to our website with third-party website analytics companies. These companies use this aggregate data, which has been stripped of any personally identifying information about you, to provide us with insight regarding our web usage patterns. As we only share anonymous, aggregate data, this information cannot be traced back to you individually by either us or the website analytics vendors.

We use Google Analytics to provide us website usage and analytic reports, which necessitates us sharing your anonymous, aggregate data. You may choose not to share your data with Google by installing the Google Analytics opt-out browser add-on, which instructs your browser not to provide your website usage data to Google Analytics. To opt-out of Google Analytics, visit https://tools.google.com/dlpage/gaoptout to install the browser add-on.

Please note that installing the Google Analytics opt-out browser add-on will only disable the use of Google Analytics and will not prevent data from being sent to the website itself or to other web analytics services.

Legal Requirements

We may be legally required to disclose your personal data, if such disclosure is:

• required by subpoena, law, or other legal process;
• necessary to assist law enforcement officials or government enforcement agencies; and/or
• necessary to protect us from legal action or claims from third parties including you and/or other Members.

Security and Fraud Prevention Efforts

When necessary, we will share your personal data to investigate, prevent, or take action regarding illegal activities, suspected fraud, situations involving potential threats to the physical safety of any person, violations or suspected violations of this Privacy Policy, our agreements or arrangements with you or other policies in effect from time to time to which you are subject, or as otherwise required by law.

Sale of Business

We reserve the right to transfer your personal information in the event we sell or transfer all or a portion of our business or its assets to which your personal data relates. Should this event occur, we will let you know.

Your Choices and Rights

Data Subject Rights

If you are a European Economic Area (“EEA”) or Swiss data subject, we provide you with choices about the collection, use, and disclosure of your personal data. You may exercise these rights by contacting us at the address provided at the end of this Privacy Policy under the heading “Contact Information.” These rights are not absolute and will apply in certain circumstances.

Your rights in relation to your personal data are:

• The right of access: you have the right to request a copy of your personal data
• The right to rectification: you have the right to have inaccurate, incomplete or obsolete data rectified
• The right to erasure: you have the right to ask for your personal data to be deleted in situations set forth by applicable laws
• The right to restrict processing: you have the right to request the restriction of processing of your personal data under certain circumstances
• The right to data portability: you have the right to request a copy of your personal data in a machine-readable format
• The right to object: you have the right to object to the processing of your personal data
• Rights in relation to automated decision making and profiling: you have the right to request human intervention on automated decisions.
• The right to withdraw your consent where the collection and processing of your personal data is based on your consent

You will always have the right to object to direct marketing at any time using any opt-out or unsubscribe buttons we provide to you.

Complaint and concerns

We value your concerns and would like to have to opportunity to address them first. Please contact us at privacy@bioratherapeutics.com. You shall have the right to lodge a complaint with a supervisory authority in particular in the Member State of your habitual residence, place of work or place of the alleged infringement if you considers that the processing of personal data relating to you infringes data protection laws.

California Privacy Rights

If you are a resident of the State of California and you have provided your personal data to us, you have the right to request a list of all third parties to which we have disclosed your personal data for direct marketing purposes. If you exercise your right to submit such a request to us, we will send you the following information:

• The categories of information we have disclosed to any third party for any third party’s direct marketing purposes during the preceding year; and
• The names and addresses of third parties that received such information, or if the nature of their business cannot be determined from the name, then examples of the products or services marketed.

You may make such a request by contacting us at the address provided at the end of this privacy notice under the heading “Contact Information.”

California law also requires that we disclose how we respond to “do-not-track requests” from our users. At this time, we do not respond to “do-not-track” requests from our users’ browsers.

Other Important Information

Cross-Border Data Transfers

We process data both inside and outside the United States. Where we transfer your personal data from the EEA or Switzerland to a location outside of these countries, we will only transfer your data if an appropriate level of protection for your personal data is guaranteed and we shall ensure that adequate safeguards, as required under applicable data protection legislation, will be implemented (including, notably, the European Commission’s Standard Contractual Clauses, as applicable).

Third-Party Websites

The website may contain links to other websites that are not under our direct control. This Privacy Policy applies only to our websites and not to any third-party websites, which may have their own policies regarding privacy. We have no control of or responsibility for linked websites and provide these links solely for the convenience and information of our visitors. You access such linked websites at your own risk.

You should check the privacy policies, if any, of those individual websites to see how the operators of those third-party websites will utilize your personal information. In addition, these websites may contain a link to websites of our affiliates. The websites of our affiliates are not subject to this Privacy Policy, and you should check their individual privacy policies to see how the operators of such websites will use your personal information.

Security

We have implemented organizational and technical safeguards for protecting the personal data you share with us. These measures include secure infrastructure, carefully configured access to resources and best practices around data safety and retention.

Children Under the Age of 16

We do not knowingly collect personal data from individuals under the age of 16. Our website is not intended for anyone under the age of 16, and no one under the age of 16 may provide information on this website. If you believe your child is providing or has submitted personal data to Biora Therapeutics and you wish to remove any personal data about your child, please contact our Data Protection Officer at the address provided in “Contact Information” section below.

Privacy Notice Changes

We reserve the right to modify this privacy notice at any time. You can find the most current version of our privacy notice at any time by clicking on the “privacy notice” link at the bottom of our website. If we make material changes to this policy, we may notify you on our Website, by a blog post, by email, or by any method we determine. The method we chose is at our sole discretion. Any changes we make to our privacy notice are effective as of this Last Updated date and replace any prior privacy notices.