This Privacy Notice (“Privacy Notice”) was last updated and effective on May 17, 2022.

Neurogene Inc. (“Neurogene”) respects the privacy of all individuals who entrust us with their personal data. This Privacy Notice explains what types of personal data Neurogene may collect from you, how we collect it, how we use it, who we may disclose it to, and how you can manage it. It also describes the policies and practices that we have developed to safeguard personal data and to comply with applicable data protection laws. Please read this Notice and our Terms of Use carefully.

Our Privacy Notice is not a contract, and it does not create any legal rights or obligations. We may amend this Notice at any time. When this Notice is changed, the date of the latest revision will appear at the top of this page.
If you have any questions regarding Neurogene’s privacy practices or wish to access or correct personal data Neurogene has collected from you, please contact us using the information below:

Company name: Neurogene Inc.
Mailing address: 535 West 24th Street, 5th Floor New York, NY 10011

Person responsible for privacy inquiries: Carleen D. Lyken
Director, Regulatory Compliance and Legal Affairs
Email address: Privacy@neurogene.com

Information We May Collect About You

We may collect, use, store and transfer different categories of personal data about you in electronic (e.g., email, photographs, documents) or paper media. We have grouped them together as follows:

• Identity Data includes first name, maiden name, last name, username or similar identifier, marital status, title, date of birth and gender.
• Contact Data includes billing address, delivery address, email address and telephone numbers.
• Transaction Data includes details about payments to and from you and other details of products and services you have purchased from us.
• Technical Data includes internet protocol (IP) address, your login data, browser type and version, time zone setting and location, browser plug-in types and versions, operating system and platform and other technology on the devices you use to access our website or intranet.
• Profile Data includes your username and password on our website, our intranet, purchases or orders made by you, your preferences, and feedback and survey responses.
• Usage Data includes information about how you use our website, intranet, products and services.
• Marketing and Communications Data includes your preferences in receiving marketing from us and our third parties and your communication preferences.
• Special Categories of Personal Data include details about your race or ethnicity, religious or philosophical beliefs, sex life, sexual orientation, political opinions, trade union membership, information about your health (including health-related personal data that Neurogene or its agent may use to determine your eligibility for clinical research or to conduct a clinical trial) and genetic and biometric data.

How We Collect Information About You

Direct interactions. You may give us your Identity, Contact and Financial Data by filling in forms or by corresponding with us by mail, phone, and e-mail or otherwise. This includes personal data you provide when you create an account on our Website, request marketing be sent to you, apply for employment with us or express interest in our clinical research program.

Automated interactions. As you interact with our website or intranet, we may automatically collect Technical Data about your equipment, browsing actions and patterns. We collect this personal data by using cookies, and other similar technologies. For additional information about how Neurogene uses cookies and similar technologies, see “Cookies and Similar Technologies” section.

Third parties (or publicly available sources). We may receive categories of personal data about you from various third parties and public sources as set out below:

• Technical Data from analytics providers such as Google; advertising networks and search information providers.
• Identity and Contact Data from data brokers, aggregators or recruitment agencies.
• Identity and Contact Data from publicly availably sources.
• Special Categories of Data including Health Data from entities such as those assisting us with our clinical research.

How We Use Your Information

Neurogene does not disclose, give, or sell any personal data you provide to any outside organizations for any reason (other than as described below). We may use any information we collect about you or about your use of the Website in connection with the operation of our business, as well as to improve the Website or to communicate with you about products, features, or services we provide, and offers that we believe may be of interest to you or otherwise in connection with our management of the Website. We may also use information we collect about you for the following purposes:

• Security and protection of personnel, assets, and resources;
• Regulatory compliance and monitoring; and
• Compliance with legal requirements or to defend or pursue legal claims.

We may personalize your experience by using your use of the Website to shape any recommendations we may make about content (including advertising) that might be of interest to you. We may also monitor traffic patterns and Website usage to help us develop the design and layout of the Website. We use application logs on your device and our server as well as “cookies” and other tracking technologies for the purposes described below as well as to enhance the functionality of the Website. This information may be stored in files on your device that we access.

We may also use the information we collect to occasionally notify you about functionality changes to the Website. We may create from information we collect from you anonymous demographic information that is not unique to you, such as your ZIP code, domicile, age, gender, preferences, and interests. We may use or permit use of this information with affiliates, advertisers, business partners, or unaffiliated third parties for our or their business purposes.

How We Share Your Information

We may employ independent contractors, consultants, vendors, and suppliers, such as third-party service providers, call centers, mail houses, or any other third party who may need to receive or handle your personal information on our behalf (collectively, “Outside Contractors”) in connection with the performance of obligations under this Privacy Notice and to provide specific services and products related to the Website and our business. In the course of providing products or services to us, these Outside Contractors may sometimes have access to your personal data.

We may disclose information we have about you to regulatory authorities, law enforcement agencies, or as required by applicable law.

We may share personal data with a buyer or other successor in the event of a merger, divestiture, restructuring, reorganization, dissolution or other sale or transfer of some or all of the Company’s assets, whether as a going concern or as part of bankruptcy, liquidation or similar proceeding, in which personal data held by the Company about our Service users is among the assets transferred.

Marketing

We strive to provide you with choices regarding certain personal data uses, particularly around marketing and advertising. We have established the following personal data control mechanisms:

• Promotional material from us. We may use your Identity, Contact, Technical, Usage and Profile Data to form a view on what we think you may want or need, or what may be of interest to you. This is how we decide which product candidates, services and offers may be relevant for you.
• Opting in. You will receive marketing communications from us if you have requested information from us and you have opted-in to receiving that marketing.
• Third-party marketing. We will get your express opt-in consent before we share your personal data with any company outside Neurogene for marketing purposes.
• Opting out. You can ask us or third parties to stop sending you marketing messages at any time by following the opt-out links on any marketing message sent to you. Where you opt-out of receiving these marketing messages, this will not apply to personal data provided to us as a result of a product/service purchase, warranty, product/service experience or other transactions.
• Cookies. Most web browsers allow some control of most cookies through the browser settings. For additional information about how Neurogene uses cookies and similar technologies, see the “Cookies and Similar Technologies” section. To find out more about cookies, including how to see what cookies have been set and how to manage and delete them, visit www.aboutcookies.org or www.allaboutcookies.org.
• Google Analytics. To opt out of being tracked by Google Analytics across all websites, visit http://tools.google.com/dlpage/gaoptout.

How We Protect Your Information

We have put in place appropriate security measures to prevent your personal data from being accidentally lost, used or accessed in an unauthorized way, altered or disclosed. In addition, we limit access to your personal data to those employees, agents, contractors and other third parties who have a business need to know. They will only process your personal data on our instructions and they are subject to a duty of confidentiality.

We have put in place procedures to deal with any suspected personal data breach and will notify you and any applicable regulator of a breach where we are legally required to do so.

Cookies and Similar Technologies

Cookies are small files that many websites place on your hard drive that allow those websites to identify you. For example, if you allow a website to remember your login name or password, that website places a cookie on your computer.

We may place cookies on your computer to allow us to identify you during future visits to our Website. We may use cookies to measure web traffic and to customize your visit. Most web browsers are set to automatically accept cookies. However, if you do not wish to receive cookies, or want to be notified of when they are placed, your browser may permit you to do so. In many web browsers, you can change the browser settings to warn you before accepting cookies or to block cookies. If you block cookies, you may not be able to use certain features or functions of this Website, or this Website may not operate in optimal mode.

A beacon is an electronic tracking mechanism that usually consists of a single-pixel image. It can be embedded in a web page or in an email to transmit information, which could include personal information. For example, it allows an email sender to determine whether a user has opened a particular email.

We may also use Google Analytics or other similar software or services to gather certain information in connection with the use of the Website. When we use Google Analytics, your web browser automatically sends certain information to Google about your use of the Website, such as the web address of the page you’re visiting and your IP address. If you don’t want Analytics to be used in your browser, you can install the Google Analytics opt-out browser add-on by visiting this link. For more information on how Google Analytics collects, protects, uses, and shares your data, click here.

How We Respond to Do Not Track Signals

Some web browsers may transmit “do-not-track” signals to websites with which the browser communicates. Websites linked to this Privacy Notice do not currently respond to these “do-not-track” signals.

California Privacy Rights

California Civil Code Section 1798.83 permits California residents who are individual customers of Neurogene products to request certain information regarding its disclosure of personal data to third parties for their direct marketing purposes. To make such a request, please contact us using our contact information listed at the beginning of this Notice.

Be sure to include your name and address. You can include your email address if you want to receive a response by email. Otherwise, we will respond by postal mail within the time required by law.

Choices You Have About Our Use of Your Information

You can write to us at any time to obtain a copy of your information and to have any inaccuracies corrected or if you no longer wish to be registered on the Website. Where appropriate, you may have your personal information erased, rectified, amended, or completed. In order to contact us regarding your information, you may send us an email at privacy@neurogene.com.

Links to Third Party Websites

The Website may contain links to other websites. These third-party sites may send their own cookies to users to collect data or solicit personal information. Please be aware that other sites are not subject to this Privacy Notice and Neurogene is not responsible for the privacy practices of these other sites. We encourage our users to be aware when they leave our site and to read the privacy statements of each and every website that collects personal data. This Privacy Notice applies solely to information collected by the Website.

Children’s Privacy

The Website is not directed to children under the age of 13. We do not knowingly collect personal information from children under the age of 13. If an individual identifies themselves as a child under the age of 13, we will not collect, store, or use any personal information. If we receive personal information that we discover was provided by a child under the age of 13, we will promptly destroy such information.

SUPPLEMENTAL EUROPEAN PRIVACY NOTICE

For purposes of European data protection laws, Neurogene Inc. is the data controller, i.e., the company responsible for controlling the processing of personal information covered by this Privacy Notice.

European Union Regulation 2016/679 of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (the “General Data Protection Regulation” or “GDPR”) requires Neurogene as the data controller to provide additional and different information about its data processing practices to data subjects in the European Economic Area (“EEA”). If you are a data subject within the EEA, this Supplemental European Privacy Notice applies to you in addition to the provisions above.

HOW WE USE YOUR PERSONAL DATA

We will only use your personal data when the law allows us to so. Most commonly, we will use your personal data in the following circumstances:

• We need to perform the contract we are about to enter into or have entered into with you.
• It is necessary for our legitimate interests (or those of a third party) and your interests and fundamental rights do not override those interests.
• We need to comply with a legal or regulatory obligation.
• It is necessary for scientific research purposes.

We may also use your personal data in the following situations, which are likely to be rare:

• We need to protect your interests (or someone else’s interests).
• It is needed in the public interest or for official purposes.

We may also rely on consent as a legal basis for processing your personal data in certain circumstances, like sending direct marketing communications to you via email or text message. You have the right to withdraw consent to marketing at any time by contacting us.

We have set out below, in a table format, a description of many of the ways we plan to use your personal data, and which of the legal bases we rely on to do so. We have also identified what our legitimate interests are where appropriate.

Note that we may process your personal data for more than one lawful ground depending on the specific purpose for which we are using your data. Please contact us if you need additional details about the specific legal ground we are relying on to process your personal data.

CHANGE OF PURPOSE

We will only use your personal data for the purposes for which we collected it, unless we reasonably consider that we need to use it for another reason and that reason is compatible with the original purpose.

If we need to use your personal data for an unrelated purpose, we will notify you and we will explain the new legal basis.

Please note that we may process your personal data without your knowledge or consent, in compliance with the above rules, where this is required or permitted by law.

INTERNATIONAL TRANSFERS OF PERSONAL DATA

We are based outside the European Economic Area, so the processing of your personal data may involve a transfer of data outside the EEA. Information on how to contact our privacy officer can be found at the introduction of this Notice.

Whenever we transfer your personal data out of the EEA, we ensure a similar degree of protection is afforded to it by ensuring at least one of the following safeguards is implemented:

• We will only transfer your personal data to countries that have been deemed to provide an adequate level of protection for personal data by the European Commission.
• Where we use certain service providers, we may use specific contracts approved by the European Commission which give personal data the same protection it has in Europe.
• Regarding transfers to the US, we are required to incorporate the model clauses in agreements for transfer provided by the European Commission in order to provide similar protection to personal data shared within Europe.

HOW LONG WE RETAIN YOUR PERSONAL DATA

We will only retain your personal data for as long as necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, accounting, or reporting requirements.

To determine the appropriate retention period for personal data, we consider the amount, nature, and sensitivity of the personal data, the potential risk of harm from unauthorized use or disclosure of your personal data, the purposes for which we process your personal data and whether we can achieve those purposes through other means, and the applicable legal requirements.

In some circumstances we may anonymize your personal data (so that it can no longer be associated with you) for research or statistical purposes in which case we may use this information indefinitely without further notice to you.

YOUR DATA PROTECTION RIGHTS

Under certain circumstances, visitors from within the EEA have the following data protection rights:

• access to your personal data.
• correction of your personal data.
• erasure of your personal data.
• object to processing of your personal data.
• restrict of processing your personal data.
• transfer of your personal data.
• withdraw consent to any consent that you have previously given.

If you wish to exercise any of the rights set out above, please contact our privacy officer. You can also contact the Supervisory Authority in the country of your residence within the EU at this link for advice or to make a complaint.

VeraSafe has been appointed as Neurogene’s representative in the United Kingdom for data protection matters, pursuant to Article 27 of the United Kingdom General Data Protection Regulation. If you are located within the United Kingdom, VeraSafe can be contacted in addition to or instead of Neurogene’s privacy officer, only on matters related to the processing of personal data.

To make such an inquiry, please contact VeraSafe using this contact form: https://verasafe.com/public-resources/contact-data-protection-representative or via telephone at: +44 (20) 4532 2003.

Alternatively, VeraSafe can be contacted at:
VeraSafe United Kingdom Ltd. 37 Albert Embankment London SE1 7TL United Kingdom.

Please be aware that your rights in relation to clinical research data may be limited.

You will not have to pay a fee to access your personal data (or to exercise any of the other rights). However, we may charge a reasonable fee or refuse to comply with your request if it is clearly unfounded, repetitive or excessive.

We may need to request specific information from you to help us confirm your identity and ensure your right to access your personal data (or to exercise any of your other rights). This is a security measure to ensure that personal data is not disclosed to any person who has no right to receive it. We may also contact you to ask you for further information in relation to your request to speed up our response.

We try to respond to all legitimate requests within one month. Occasionally it may take us longer than a month if your request is particularly complex or you have made a number of requests. In this case, we will notify you and keep you updated.

Effective Date: May 17, 2022