Consumer Health Data Privacy Policy

Last updated: November 14, 2025

This Policy supplements Zenas Privacy Policy and applies to personal information defined as “Consumer Health Data” under applicable state laws governing consumer health data, including, but not limited to, the Washington State My Health My Data Act and the Nevada State Consumer Health Privacy Law (collectively, “Consumer Health Data Laws”).

This Consumer Health Data Privacy Policy (hereinafter, the “Policy”) describes how Zenas collects, uses and otherwise processes Consumer Health Data in connection with this website and any of our other websites, mobile applications, or online services that link to this Policy (collectively referred to as the “Sites”).

Consumer Health Data We Collect

Consumer Health Data means personal information that is linked or reasonably linkable to you and that identifies your past, present, or future physical or mental health status.

We may collect your Consumer Health Data depending on the context of your interactions with us and the choices you make (including your privacy settings), the products and features you use and applicable law. Because applicable laws define Consumer Health Data broadly, many of the categories of data we collect may, in some instances, be considered Consumer Health Data.

Consumer Health Data may include:

Information about your health-related conditions, symptoms, status, diagnoses, testing, or treatments (including procedures, medications, or other interventions). For example, we may collect such information through surveys or other communications with you for research studies.
Information that could identify your attempt to seek health-related services or information.
Other information that may be used to infer or derive data related to the above or other health information.

Sources of Consumer Health Data

We may collect Consumer Health Data directly from you, from your interactions with our products and services, from third parties, and from publicly available sources.

Why We Collect and Use Consumer Health Data

We may use your consumer health data for the following purposes:

To operate our Sites. We may use your Consumer Health Data to:
- process and manage registrations you make through our Sites;
- provide information about our research and development;
- communicate with you regarding our programs, events, or activities for which you may have registered, including by sending you technical notices, updates, security alerts, and support and administrative messages;
- understand your needs and interests, and personalize your experience with our Sites;
- provide support and maintenance for our Sites; and
- respond to your service-related requests, questions and feedback.
To send you marketing and promotional communications. We may send you communications regarding our therapeutic products, as permitted by applicable law. You will have the ability to opt out of marketing and promotional communications. We encourage you to consult our main Privacy Policy for more information about the methods to opt out of such processing.
To comply with law. We may use your Consumer Health Data as necessary or appropriate to comply with applicable laws, lawful requests and legal processes, such as responding to requests from government authorities.
With your consent. We may use or share your Consumer Health Data with your express consent, such as when you consent to let us post your testimonials or endorsements on our Sites, you instruct us to take specific action with respect to your Consumer Health data, or you opt into third-party marketing communications.
For compliance, fraud prevention and safety. We may use your Consumer Health Data as necessary or appropriate to (a) enforce the terms and conditions that govern use of our Sites; (b) protect our rights, privacy, safety or property; and (c) protect, investigate and deter against fraudulent, harmful, unauthorized, unethical or illegal activity.

See the How to Exercise Your Rights section below for more details on the controls and choices you may have.

Third Parties with Which We Share Consumer Health Data

We do not share your Consumer Health Data with third parties without your consent, except in the following circumstances:

Affiliates. We may disclose your Consumer Health Data to our subsidiaries and corporate affiliates for purposes consistent with this Policy.
- Categories of data shared: health-related information you provide in connection with Zenas programs, treatment or disease-area interests, and related communications or support interactions.
Service Providers. We may share your Consumer Health Data with third-party companies and individuals that provide services on our behalf (such as hosting, analytics, email delivery, marketing, and database management services). These third parties use personal information only as directed by us and in a manner consistent with this Policy.
- Categories of data shared: limited health-related information necessary to operate Zenas programs (e.g., condition category, product use status, participation in patient-support or education programs).
Professional advisors. We may disclose your Consumer Health Data to professional advisors, such as lawyers, auditors and insurers, where necessary in the course of the professional services that they render to us.
- Categories of data shared: relevant health-related information tied to specific reviews, investigations, or audits.
Advertising and Analytics Partners. We may disclose information about you to third parties that place cookies, pixels, or similar tools to deliver ads or measure website usage. Depending on your browser or device settings, you may control or opt out of this type of sharing.
- Categories of data shared: online identifiers (e.g., IP address, device ID, cookie IDs), browsing activity, engagement with Zenas websites or apps.
Business Transfers. We may sell, transfer, or otherwise share some or all of our business or assets, including your Consumer Health Data, in connection with a business transaction (or potential business transaction) such as a merger, consolidation, acquisition, reorganization or sale of assets or in the event of bankruptcy, in which case we will make reasonable efforts to require the recipient to honor this
- Categories of data shared: health-related program records and other Consumer Health Data relevant to the transferred business activity.

How to Exercise Your Rights

Consumer Health Data Laws provide certain rights with respect to Consumer Health Data. These rights include the ability to:

Confirm whether Zenas is collecting, selling, or sharing your Consumer Health Data;
Access your Consumer Health Data;
Obtain a list of all third parties with which Zenas has shared or sold your Consumer Health Data;
Obtain the contact information of those third parties;
Request deletion of your Consumer Health Data; and
Withdraw consent to the processing or sale of your Consumer Health Data.

To exercise any of the rights described above, you may contact us at any time through any of the following methods.

Mail: Zenas BioPharma, Inc., Legal Department, 852 Winter Street Suite 250, Waltham, MA 02451
Email: privacy@zenasbio.com
Telephone: +1 857- 271-2954

If your request to exercise a right is denied, you may appeal that decision by contacting our privacy support at privacy@zenasbio.com

If your appeal is unsuccessful, you can raise a concern or lodge a complaint with the Washington State Attorney General at www.atg.wa.gov/file-complaint or the Nevada State Attorney General here, depending on your state of residence.

Consumer Health Data Retention

We will only retain information for as long as necessary to serve the purposes for which it was collected or to the extent necessary to comply with applicable legal requirements.

Changes to this Privacy Policy

We reserve the right to amend this Privacy Policy at our discretion and at any time. If we make material changes that significantly impact your privacy rights, we will notify you by updating the date of this Privacy Policy and posting it on the Sites.

We may, if required by law, also provide notification of changes in a manner reasonably likely to reach you, such as via e-mail (if you have provided your contact information) or through the Sites.

Contact Us

If you have any questions or concerns about our Privacy Policy or would like to request this Privacy Policy in an alternative format due to a disability, please feel free to email us at privacy@zenasbio.com, or write to us at:

Zenas BioPharma, Inc.
Legal Department
852 Winter Street
Suite 250
Waltham, MA 02451

Privacy Policy