Privacy Policy

Last updated June 2, 2026

Thank you for choosing to be part of our community at Nuvig Therapeutics, Inc., (“company”, “we”, “us”, or “our”). We are committed to protecting your personal information and your right to privacy. If you have any questions or concerns about our policy, or our practices with regards to your personal information, please contact us at dataprivacy@nuvigtx.com.

This Privacy Policy describes the types of information we may collect from you or that you may provide when you visit https://nuvigtx.com/ (our “Website”) and our practices for collecting, using, maintaining, protecting, and disclosing that information. It also describes your rights under applicable privacy and data protection laws, including the European Union General Data Protection Regulation (“GDPR”), the United Kingdom Data Protection Act 2018 (“UK DPA”), and certain U.S. state privacy laws.

This Privacy Policy applies to information we collect on this Website or in email, text, and other electronic messages between you and the Website. It does not apply to information collected offline or through other channels, including any other website operated by us or a third party. When you visit our Website and use our services, you trust us with your personal information. We take your privacy very seriously. This Privacy Policy explains in the clearest way possible what information we collect, how we use it and what rights you have in relation to it. We hope you take some time to read through it carefully, as it is important. If there are any terms in this privacy policy that you do not agree with, please discontinue use of our Sites and our services.

Please read this privacy policy carefully as it will help you make informed decisions about sharing your personal information with us. By accessing or using this Website, you agree to this Privacy Policy. If you do not agree, please do not use our Website. This Privacy Policy may change from time to time (see “Do We Makes Changes to this Privacy Policy” below).

1. WHAT INFORMATION DO WE COLLECT?

We collect several types of information, including:

Information by which you may be personally identified (“personal information”), such as your name, postal address, email address, or phone number
Information that is about you but does not identify you individually
Information about your internet connection, device, and usage details

We collect this information:

Personal information you directly disclose to us when expressing an interest in obtaining information about us or our products and services, when participating in activities on the Website or otherwise contacting us (for example, through forms, subscriptions, or correspondence)
Automatically as you navigate the Website (via cookies, IP addresses, and analytics tools)
From third parties such as service providers or business partners

The personal information that we collect depends on the context of your interactions with us and the Sites, the choices you make and the products and features you use. The personal information we collect can include the following:

Name and Contact Data. We may collect your first and last name, email address, phone number, and other similar contact data when you subscribe to our newsletter or use our online contact form.

Automatic Data Collection Technologies

Some information – such as IP address and/or browser and device characteristics – is collected automatically when you visit our Website. We automatically collect certain information when you visit, use or navigate the Website. This information does not reveal your specific identity (like your name or contact information) but may include device and usage information, such as your IP address, browser and device characteristics, operating system, language preferences, referring URLs, device name, country, location, information about how and when you use our Sites and other technical information. This information is primarily needed to maintain the security and operation of our Sites, and for our internal analytics and reporting purposes.

Like many businesses, we also collect information through cookies and similar technologies. We use cookies and similar technologies to understand usage patterns, improve functionality, and analyze traffic. This may include tools such as analytics providers that help us understand how visitors interact with our Website. Where required by law, non-essential cookies are only activated after you provide consent through our cookie banner. We use a consent management platform to manage and enforce these preferences. You can adjust your browser settings to refuse cookies, though some parts of the Website may not function properly. Learn more about cookies at our cookies policy at https://nuvigtx.com/cookie-policy/.

Processing Using Website Tracking

On our Website we use Google Analytics, to help us understand how users engage with this and other of our websites. Google Analytics may track your activity on our sites (i.e., the pages you have seen and the links you have clicked on) and helps us measure how you interact with the content that we provide. This information is used to compile reports and to help us improve the sites. The reports we receive disclose website trends without identifying individual visitors. You can learn about Google’s practices by going to www.google.com/policies/privacy/partners/, and exercise the opt-out provided by Google by downloading the Google Analytics opt-out browser add-on, available at https://tools.google.com/dlpage/gaoptout or clicking on the “Your Privacy Choices” link at bottom of our website.

Do-Not-Track Signals

Certain web browsers and other programs may transmit “opt-out” signals, also called a Global Privacy Control (or GPC) signal (we refer to these as “GPC Signals”), to websites with which the browser communicates. In most cases you will need to change your web browser’s settings or add an application to your web browser to enable your browser to send a GPC Signal. Our Website will recognize GPC Signals for website users differently, based on the location of the user when they access our websites. For users that access our websites from U.S. states that have laws requiring recognition of GPC Signals, we will recognize and apply the GPC Signal to inactivate all of the cookies for that website, except for cookies that are necessary for the website to operate (“Strictly Necessary Cookies”).

Additionally, if you are accessing our websites from one of these states, you can determine if your browser GPC Signal has been recognized by clicking on the “Your Privacy Choices” link in the footer of the Website that will include a short message at the top of the preference center indicating that your GPC Signal has been received. For users from states not currently requiring recognition of the GPC Signal, our website servers may recognize and apply the GPC Signal for only targeted advertising cookies, but will not apply the GPC Signal to functional, performance or social media cookies. Further, a specific GPC Signal acknowledgement notice will not be included in the preference center, but you can always check and adjust your cookie settings by going to the Your Privacy Choices link in the footer of this website.

Information collected from other sources

We may collect limited data from public databases, marketing partners, and other outside sources.

We may obtain information about you from other sources, such as public databases, joint marketing partners, as well as from other third parties. Examples of the information we may receive from other sources include: social media profile information; marketing leads and search results and links, including paid listings (such as sponsored links).

2. HOW DO WE USE YOUR INFORMATION?

We process your information for purposes based on legitimate business interests, the fulfillment of our contract with you, compliance with our legal obligations, and/or your consent.

We use personal information collected via our Website for a variety of business purposes described below. We process your personal information for these purposes in reliance on our legitimate business interests (“Business Purposes”), in order to enter into or perform a contract with you (“Contractual”), with your consent (“Consent”), and/or for compliance with our legal obligations (“Legal Reasons”). We indicate the specific processing grounds we rely on next to each purpose listed below.

We use the information we collect or receive:

To send you informational business communications for Business Purposes and/or with your Consent. You can opt-out of our emails at any time using the unsubscribe feature at the bottom of any email.
To respond to your inquiries or requests
To send administrative information to you for Business Purposes, Legal Reasons and/or possibly for Contractual. We may use your personal information to send you product, service and new feature information and/or information about changes to our terms, conditions, and policies.
To enforce our terms, conditions and policies for Business Purposes, Legal Reasons and/or possibly Contractual.
For other Business Purposes. We may use your information for other Business Purposes, such as data analysis, identifying usage trends, determining the effectiveness of our promotional campaigns and to evaluate and improve our Sites, products, services, marketing and your experience.
To present, maintain, and improve our Website and its contents
To comply with legal obligations
For any other purpose disclosed to you at the time of collection or with your consent

We may anonymize data for analysis or business purposes. Once anonymized, it is no longer considered personal data.

3. WILL YOUR INFORMATION BE SHARED WITH ANYONE?

We only share information with your consent, to comply with laws, to protect your rights, or to fulfill business obligations.

We only share and disclose your information in the following situations:

Compliance with Laws. We may disclose your information where we are legally required to do so in order to comply with applicable law, governmental requests, a judicial proceeding, court order, or legal process, such as in response to a court order or a subpoena (including in response to public authorities to meet national security or law enforcement requirements).
Vital Interests and Legal Rights. We may disclose your information where we believe it is necessary to investigate, prevent, or take action regarding potential violations of our policies, suspected fraud, situations involving potential threats to the safety of any person and illegal activities, or as evidence in litigation in which we are involved.
Vendors, Consultants and Other Third-Party Service Providers. We may share your data with third party vendors, service providers, contractors or agents who perform services for us or on our behalf and require access to such information to do that work. Examples include: data analysis, email delivery, and hosting services. We may allow selected third parties to use tracking technology on the Sites, which will enable them to collect data about how you interact with the Sites over time. This information may be used to, among other things, analyze and track data, determine the popularity of certain content and better understand online activity. Unless described in this Policy, we do not share, sell, rent or trade any of your information with third parties for their promotional purposes.
Business Transfers. We may share or transfer your information in connection with, or during negotiations of, any merger, sale of company assets, financing, or acquisition of all or a portion of our business to another company.
Business Partners. We may share your information with our business partners to offer you certain products, services or promotions.
With your Consent. We may disclose your personal information for any other purpose with your consent.

We do not sell personal information as traditionally understood.

4. Cross-Border Data Transfers

Your data may be transferred to and processed in countries outside your own, including the United States. We take reasonable steps to ensure that such transfers comply with applicable data protection laws and that your information remains protected.

6. HOW LONG DO WE KEEP YOUR INFORMATION?

We keep your information for as long as necessary to fulfill the purposes outlined in this privacy policy unless otherwise required by law. We will only keep your personal information for as long as it is necessary for the purposes set out in this Privacy Policy, unless a longer retention period is required or permitted by law (such as tax, accounting or other legal requirements).

When we have no ongoing legitimate business need to process your personal information, we will either delete or anonymize it, or, if this is not possible (for example, because your personal information has been stored in backup archives), then we will securely store your personal information and isolate it from any further processing until deletion is possible.

7. HOW DO WE KEEP YOUR INFORMATION SAFE?

We aim to protect your personal information through a system of organizational and technical security measures. We have implemented appropriate technical and organizational security measures designed to protect the security of any personal information we process. However, please also remember that we cannot guarantee that the internet itself is 100% secure. Although we will do our best to protect your personal information, transmission of personal information to and from our Sites is at your own risk. You should only access the services within a secure environment.

8. DO WE COLLECT INFORMATION FROM MINORS?

We do not knowingly collect data from or market to children under 18 years of age. We do not knowingly solicit data from or market to children under 18 years of age. By using the Sites, you represent that you are at least 18 or that you are the parent or guardian of such a minor and consent to such minor dependent’s use of the Sites. If we learn that personal information from users less than 18 years of age has been collected, we will deactivate the account and take reasonable measures to promptly delete such data from our records. If

you become aware of any data we have collected from children under age 18, please contact us at dataprivacy@nuvigtx.com.

9. WHAT ARE YOUR PRIVACY RIGHTS?

In Short: You may review, change, or terminate your account at any time. If you are resident in the European Economic Area and you believe we are unlawfully processing your personal information, you also have the right to complain to your local data protection supervisory authority. You can find their contact details here: http://ec.europa.eu/justice/data-protection/bodies/authorities/index_en.htm

Your U.S. State Privacy Rights

Depending on your state of residence (such as California, Virginia, Colorado, or Connecticut), you may have additional rights, including:

The right to know what personal information we collect, use, or disclose
The right to delete your personal information, subject to certain exceptions
The right to correct inaccuracies in your personal information
The right to opt out of the sale or sharing of personal information
The right to limit the use of sensitive personal information

To exercise these rights, please contact us at dataprivacy@nuvigtx.com. We may need to verify your identity before fulfilling your request. We do not discriminate against individuals who exercise their privacy rights.

Your GDPR and UK Data Protection Rights

If you are located in the EU, UK, or Switzerland, you have the right to:

Access, correct, or delete your personal data
Restrict or object to processing
Request data portability
Withdraw consent at any time
File a complaint with your local data protection authority

CAN SPAM Act. The CAN-SPAM Act is a law that sets the rules for commercial email, establishes requirements for commercial messages, gives recipients the right to have emails stopped from being sent to them, and spells out tough penalties for violations.

We collect your email address, when provided in the newsletter subscriptions or ‘contact us’ form, in order to send information, respond to inquiries, and/or other requests or questions.

To be in accordance with CANSPAM, we agree to the following: Not use false or misleading subjects or email addresses. Identify the message as an advertisement in some reasonable way. Include the physical address of our business or site headquarters. Monitor third-party email marketing services for compliance, if one is used. Honor opt-out/unsubscribe requests quickly.

Allow users to unsubscribe by using the link at the bottom of each email.

If at any time you would like to unsubscribe from receiving future emails, you can follow the instructions at the bottom of each email and we will promptly remove you from ALL correspondence.

If at any time you would like to view your personal data we have collected, if any, please email dataprivacy@nuvigtx.com.

Fair Information Practices. The Fair Information Practices Principles form the backbone of privacy law in the United States and the concepts they include have played a significant role in the development of data protection laws around the globe. Understanding the Fair Information Practice Principles and how they should be implemented is critical to comply with the various privacy laws that protect personal information.

In order to be in line with Fair Information Practices we will take the following responsive action, should a data breach occur we will notify you via email within 72 hours of discovering the breach.

We also agree to the Individual Redress Principle which requires that individuals have the right to legally pursue enforceable rights against data collectors and processors who fail to adhere to the law. This principle requires not only that individuals have enforceable rights against data users, but also that individuals have recourse to courts or government agencies to investigate and/or prosecute non-compliance by data processors.

Do Not Track. Do Not Track is a privacy preference that can be configured in certain web browsers (the “DNT Feature”); the DNT Feature, when enabled on a web browser, signals the websites you visit that you do not want certain information about your visit collected.

As the Internet industry is in the process of defining how to interpret signals sent by the DNT Feature, Nuvig Therapeutics, Inc. does not currently respond or recognize DNT Feature signals. Cookies and similar technologies. Most Web browsers are set to accept cookies by default. If you prefer, you can usually choose to set your browser to remove cookies and to reject cookies. If you choose to remove cookies or reject cookies, this could affect certain features or services of our Sites. To opt-out of interest-based advertising by advertisers on our Sites visit http://www.aboutads.info/choices/.

10. DO CALIFORNIA RESIDENTS HAVE SPECIFIC PRIVACY RIGHTS?

In Short: Yes, if you are a resident of California, you are granted specific rights regarding access to your personal information.

California Civil Code Section 1798.83, also known as the “Shine The Light” law, permits our users who are California residents to request and obtain from us, once a year and free of charge, information about categories of personal information (if any) we disclosed to third parties for direct marketing purposes and the names and addresses of all third parties with which we shared personal information in the immediately preceding calendar year. If you are a California resident and would like to make such a request, please submit your request in writing to us using the contact information provided below.

If you are under 18 years of age, reside in California, and have a registered account with the Sites, you have the right to request removal of unwanted data that you publicly post on the Sites. To request removal of such data, please contact us using the contact information provided below, and include the email address associated with your account and a statement that you reside in California. We will make sure the data is not publicly displayed on the Sites, but please be aware that the data may not be completely or comprehensively removed from our systems.

California Online Privacy Protection Act. CalOPPA is the first state law in the nation to require commercial websites and online services to post a privacy policy. The law’s reach stretches well beyond California to require any person or company in the United States (and conceivably the world) that operates websites collecting Personally Identifiable Information from California consumers to post a conspicuous privacy policy on its website stating exactly the information being collected and those individuals or companies with whom it is being shared. See more at: http://consumercal.org/california-online-privacy-protection-act-caloppa/#sthash.0FdRbT51.dpuf

According to CalOPPA, we agree to the following: Users can visit our site anonymously. This privacy policy will be housed in a link on our

home page or as a minimum, on the first significant page after entering our website. Our Privacy Policy link includes the word ‘Privacy’ and can easily be found on the page specified above. Should the privacy policy change, and you have subscribed to our mailing list, you will be notified of any changes via email. All other changes can be seen by visiting our Privacy Policy Page.

Can change your personal information by emailing us or following the instructions at the bottom of any email.

11. DO WE MAKE CHANGES TO THIS PRIVACY POLICY?

In Short: Yes, we will update this policy as necessary to stay compliant with relevant laws.

We may update this privacy policy from time to time. The updated version will be indicated by an updated “Revised” date and the updated version will be effective as soon as it is accessible. If we make material changes to this privacy policy, we may notify you either by prominently posting a notice of such changes or by directly sending you a notification. We encourage you to periodically review this privacy policy to be informed of how we are protecting your information.

12. HOW CAN YOU CONTACT US ABOUT THIS POLICY?

If you have any further questions or comments about us or our policies, email us at dataprivacy@nuvigtx.com or by post to:

Nuvig Therapeutics, Inc.

3450 Hillview Ave, Suite 200

Palo Alto, CA 94304

We will make reasonable efforts to respond promptly to your requests in accordance with applicable laws. Note that your request to exercise your data privacy rights must be done through the email address or above or by post sent to the address above. We may, after receiving your request, require additional information from you to honor your request and verify your identity. Please be aware that we may be unable to afford these rights to you under certain circumstances, such as if we are legally prevented from doing so.