Privacy & Cookie Policy

Effective September 1, 2026

1. Scope of this policy

This policy explains how Azora Therapeutics, Inc. (“Azora,” “we,” “us”) handles personal information collected through this website and through the email addresses published on it. It does not apply to information collected offline or to clinical trial data. Investor relations modules supplied through this site are also subject to the practices of our investor relations platform provider.

Azora is a clinical-stage biopharmaceutical company. This website is informational. We do not sell products through it, we do not collect health information from visitors, and we do not knowingly collect information from patients about their medical conditions.

2. Information we collect

Information you give us. If you email us, subscribe to investor alerts, or apply for a role, we receive what you choose to send: your name, email address, any message or attachment, and, for job applicants, the contents of a résumé or CV such as employment and education history.

Information collected automatically. When you visit, our servers and third-party service providers may record your IP address, approximate location derived from that address, browser and device type, operating system, referring page, the pages you view, and the dates and times of your visit.

Information from other sources. We may receive information from service providers who help us operate the site, and, in the ordinary course of investor relations, from brokers, transfer agents and market data providers about holders of our securities.

3. Cookies and similar technologies

The current site does not load optional audience analytics or advertising trackers. It may use local browser storage to support functions you request, such as email-alert form handling, and embedded investor relations modules may use cookies or similar storage under the practices of their provider.

You can block or delete cookies and browser storage through your browser settings. Doing so may prevent some site or investor-relations features from working correctly.

We do not use advertising cookies, we do not run behavioral advertising, and we do not permit third parties to track you across other websites for advertising through this site.

4. How we use information

• To respond to inquiries you send us and to have a conversation you started
• To send investor alerts, press releases and event notices that you asked to receive
• To evaluate applications for employment
• To operate, secure, maintain and improve the site, and to understand which content is useful
• To meet legal, regulatory and securities-law obligations, including obligations that apply to us as a public company
• To detect, investigate and prevent fraud, abuse and security incidents

5. How we share information

We do not sell personal information, and we do not share it for cross-context behavioral advertising. We disclose it only as follows:

• Service providers who host the site, deliver email, provide market data, or run our investor relations platform, and who are permitted to use it only to provide those services to us
• Professional advisers such as counsel, auditors and bankers, where they need it to advise us
• Legal and regulatory disclosure where required by law, subpoena or court order, or to protect the rights, property or safety of Azora, our people, or others
• Corporate transactions such as a merger, acquisition, financing or sale of assets, where information may be transferred as part of the transaction subject to this policy
• Aggregated or de-identified information that cannot reasonably be used to identify you

6. Third-party links and embedded content

This site links to third-party sites, including scientific journals, publication databases and structural biology repositories. It also loads web typography from Adobe Fonts and investor relations modules from KSCOPE. These providers may receive your IP address and standard request information as a technical consequence of loading their services. Their own privacy policies govern what they do with that information, and we do not control those practices. The site’s three-dimensional protein library and structure data are hosted locally; external RCSB links open only when you choose them.

7. Data security

We use administrative, technical and physical safeguards intended to protect personal information against loss, misuse and unauthorized access. No website or transmission over the internet is completely secure, and we cannot guarantee absolute security. If we become aware of a breach affecting your personal information, we will notify you and any regulator as required by applicable law.

8. How long we keep information

We keep personal information only as long as we need it for the purpose it was collected, and then for any additional period required by law, by our record-retention obligations as a public company, or to establish or defend legal claims. Inquiry correspondence is generally retained for the period needed to handle the matter and a reasonable time afterward. Applicant materials are retained for the period permitted by applicable employment law. Information handled by third-party investor relations services is retained according to the applicable provider settings and policies.

9. Your choices

You can unsubscribe from investor alerts using the link in any alert email. You can control cookies and browser storage through your browser settings. You can ask us to access, correct or delete personal information we hold about you by writing to the address in section 15, and we will respond as applicable law requires. We will not discriminate against you for exercising any privacy right.

10. California residents

If you are a California resident, the California Consumer Privacy Act as amended by the California Privacy Rights Act gives you specific rights. In the twelve months before the date of this policy, we may have collected the following categories of personal information: identifiers such as name, email address and IP address; internet or network activity such as browsing and interaction with the site; geolocation inferred from IP address; and, from job applicants, professional or employment-related information. We collect these for the business purposes described in section 4 and disclose them to the categories of recipients described in section 5.

We do not sell personal information and we do not share it for cross-context behavioral advertising. We do not knowingly collect or process sensitive personal information for the purpose of inferring characteristics, so no “limit the use of my sensitive personal information” right arises.

You have the right to know what we collect and how we use and disclose it, to request correction of inaccurate information, to request deletion, and to be free from retaliation for exercising these rights. To make a request, write to the address in section 15. We will verify your request by matching the information you provide against what we hold. You may use an authorized agent, in which case we may ask for proof of authorization.

11. EEA, UK and Switzerland residents

Where the EU or UK General Data Protection Regulation applies, Azora Therapeutics, Inc. is the controller of your personal information. We rely on the following legal bases: your consent for marketing or investor alert emails; the performance of a contract or steps taken at your request for handling applications and inquiries; our legitimate interests in operating, securing and improving the site and in communicating about our business, balanced against your rights; and compliance with a legal obligation.

You have the right to access your personal information, to have it corrected or erased, to restrict or object to processing, to receive it in a portable form, and to withdraw consent at any time without affecting processing already carried out. You also have the right to lodge a complaint with your local supervisory authority.

12. International transfers

Azora is based in the United States and our service providers may process information in the United States and other countries whose data protection laws differ from those where you live. Where we transfer personal information out of the EEA, the UK or Switzerland, we use a transfer mechanism recognized under applicable law, such as the European Commission’s Standard Contractual Clauses, together with any additional safeguards required.

13. Children’s privacy

This site is intended for a professional and investor audience. It is not directed to children, and we do not knowingly collect personal information from anyone under 18. If you believe a child has provided us with personal information, contact us and we will delete it.

14. Changes to this policy

We may update this policy as our practices or the law change. The effective date at the top of this page shows when it was last revised, and the updated version applies from the date it is posted. If we make a material change, we will take reasonable steps to bring it to your attention.

15. How to contact us

For any question or request about this policy or your personal information:

Azora Therapeutics, Inc.
Attn: Privacy
4870 Sadler Road, Suite 300
Glen Allen, VA 23060
1-804-487-8196
Email: info@azoratherapeutics.com