Purpose of this Privacy Notice

Tangram Therapeutics  (“Tangram”, “we”, “us”, “our”) is committed to protecting the privacy and security of personal data.

This notice explains how we collect, use, and share personal data relating to individuals who interact with us, including:

• Clinical trial participants
• Healthcare professionals, investigators and research collaborators
• Website visitors and business or professional contacts

Where applicable, we process personal data in accordance with relevant data protection legislation:

European Union (EU) and European Economic Area (EEA)

In the context of the European Union (“EU”) and European Economic Area (“EEA”), data protection legislation means the General Data Protection Regulation (Regulation (EU) 2016/679) (“EU GDPR”), the ePrivacy Directive (2002/58/EC), as well as any local data protection implementation laws. This includes any replacement legislation coming into effect from time to time.

United Kingdom

In the context of the United Kingdom (“UK”), data protection legislation means the United Kingdom General Data Protection Regulation (“UK GDPR”), the Data Protection Act 2018 (“DPA 2018”), the Privacy and Electronic Communications (EC Directive) Regulations 2003 (“PECR”), the Data (Use and Access) Act 2025 (“DUAA”), and any legislation implemented in connection with the aforementioned legislation.

Identity of the Data Controller

Tangram Therapeutics

How we collect personal data

We collect personal data through a variety of sources, including:

• Directly from individuals (e.g. investigators, collaborators, website users)
• Clinical study sites and Contract Research Organisations (CROs)
• Laboratories and research partners
• Professional advisors
• Recruitment agencies and professional advisors
• Publicly and professional sources (e.g. publications, conferences, LinkedIn)
• Our website, cookies and digital platforms

Information we process and why

Clinical Trials, Research and Scientific Operations

Clinical trial participant personal data is primarily collected and held by clinical trial sites and  investigators. These parties act as data processors, joint controllers, or independent controllers, depending on the context and jurisdiction.

Tangram typically receives coded (pseudonymised) clinical and safety data that does not directly identify participants, except where identifiable data is required by law (for example, safety reporting or inspections).

Informed consent obtained for participation in a clinical trial is separate from the lawful basis relied upon under data protection law.

For clinical trial processing of special category data please refer to the below table for the details on lawful basis and condition for processing special category data.

Scientific Research, Reuse of Data and Safeguards

Some of our processing activities involve the use and reuse of personal data for scientific research purposes, including clinical trials, safety monitoring and related research activities.

Under data protection legislation, personal data originally collected for one research‑related purpose could be used for a compatible scientific research purpose without further consent, provided appropriate safeguards are in place and subject to any required balancing and compatibility tests.

When relying on scientific research as our lawful basis, Tangram ensures that:

• processing is necessary and proportionate for the research purpose;
• the research is unlikely to cause substantial damage or distress to individuals;
• data minimisation, pseudonymisation and access controls are applied wherever possible; and
• personal data is not used to take measures or decisions that produce legal or similarly significant effects on individuals, unless required by law.

We will assess compatibility and fairness before any reuse of personal data for research‑related purposes.

Website, Marketing and Market Intelligence

Note: We use cookies and similar technologies in accordance with data protection legislation.  Non-essential cookie and direct electronic marketing communications are only used where consent is required, unless a limited soft opt-in applies.

All marketing communications include an option to unsubscribe.

Data sharing and recipients

We share personal data only where necessary and subject to appropriate contractual, technical and organisational safeguards and, where applicable, data minimisation and pseudonymisation.

Recipients include:

• Contract research organisations (CROs)
• Laboratories and research partners
• Cloud hosting and cybersecurity vendors
• Professional advisors (Auditors, legal advisors etc)
• Regulators and Public authorities where required

International transfers

Where personal data is transferred outside the UK or EEA, we ensure appropriate safeguards are in place, such as:

• Adequacy Decision
• the EU-U.S. Data Privacy Framework and UK extension, where applicable;
• EU Standard Contractual Clauses (SCCs)
• UK Addendum to EU Standard Contractual Clauses (or UK IDTAs); and
• Supplementary technical and organisational measures.

Data security

We implement appropriate technical and organisational measures to protect personal data against loss, misuse, unauthorised access, disclosure or alteration. Access to personal data is restricted to individuals with a legitimate business need, and all staff and relevant third parties are subject to confidentiality obligations.

We maintain incident response procedures and will notify the relevant supervisory authority and affected individuals where required.

Data retention

Personal data is retained only for as long as necessary for the purposes described, including:

• Clinical trial and research data: in line with regulatory and GCP requirements (25 years)
• Healthcare professional and collaborator data: for the duration of engagement and applicable limitation periods
• Website and marketing data: until withdrawal of consent or inactivity thresholds

Data is securely deleted or anonymised at the end of the retention period.

Your rights

Under data protection legislation, individuals have rights to:

• Access their personal data
• Rectification of inaccurate data
• Erasure (in certain circumstances)
• Restriction of processing
• Object to processing, including direct marketing at any time
• Data portability (where applicable)
• Withdraw consent (where consent is used)

Please note that some rights may be limited where personal data must be processed or retained in order to comply with clinical trial legislation, regulatory obligations, or scientific research requirements.

In particular: rights to erasure, objection and restriction may not apply to clinical trial or safety data where continued processing is necessary to ensure the integrity, reliability and regulatory acceptability of research. These limitations exist to protect public health, patient safety and the validity of scientific outcomes.

Where rights are restricted, we apply appropriate safeguards and respect individuals’ rights to transparency and accountability.

Requests can be made using the contact details below.

Children’s Privacy

Our website is not directed at children, and we do not knowingly collect personal data from children.

Data Protection Officer

Tangram Therapeutics has appointed an external Data Protection Officer.

Contact:

For Individuals in the EU: Please contact our EU Representative at eurep@tangramtx.com

You also have the right to lodge a complaint with the relevant supervisory authority.

Document history