Privacy Policy

Last Modified: February 3, 2026

Introduction

This Privacy Policy (this "Policy") applies to onyx.bio and its subdomains (the "Website"). Onyx ("Onyx," "we," or "us") operates this Website to provide online access to information about Onyx and the products and services we offer.

Your use of this Website is governed by our Terms of Use. This Policy is incorporated into the Terms of Use.

This Policy describes the types of information we may collect from you or that you may provide to us and our practices for collecting, using, maintaining, protecting, and disclosing that information when you visit the Website or access or use any content, functionality, and services offered on or through the Website (collectively, the "Services").

Please read this Policy carefully to understand our policies and practices regarding your information and how we treat it. If you do not agree with our policies and practices, your choice is not to use our Services. We may update or revise this Policy from time to time (see Changes to this Privacy Policy). Updates will be posted on the Website with an updated "Last Modified" date. For non-material updates, the revised Policy applies to information collected after the update. For material changes—meaning changes that introduce new uses of your Personal Information or processing a reasonable user would not expect—we will provide advance notice and request your affirmative consent before applying those changes to your previously collected information.

This Policy applies to the information we collect:

• Through the Website;
• In email, text, and any other electronic messages between you and Onyx;
• When you interact with our advertising and applications on third-party websites and services, if those applications or advertising include links to this Policy; or
• When you provide information, data, materials, texts, prompts, images, or other content on or through the Services.

This Policy does not apply to information collected by:

• Us offline or through any other means; or
• Any third party (our affiliates and subsidiaries), including through any application or content (including advertising) that may link to or be accessible from or on the Services.

Information We Collect About You and How We Collect It

Onyx recognizes any data relating to an identifiable individual or which identifies an individual as "Personal Information" subject to this Policy. Depending on how you interact with Onyx, we collect and use different types of Personal Information. Types of information we may collect include information:

• By which you may be personally identified, such as your name, username, e-mail address, mailing address, telephone number, personal health information, payment information and other Personal Information you choose to provide to us;
• About your internet connection, the equipment you use to access our Services, and usage details.

We collect this information:

• Directly from you when you provide it to us.
• Automatically as you navigate through the Website. Information collected automatically may include usage details, IP addresses, and information collected through cookies and other tracking technologies.
• From third parties, for example, our business partners. We may combine information from third-party sources with information we collect directly.

The information we collect on or through our Services may include:

• Information that you provide (e.g., by using or filling in forms on the Website or while interacting with the Services). This includes information provided at the time of registering to use the Services, enrolling in research studies, posting or providing material, or requesting further services.
• Records and copies of your correspondence (including email addresses) if you contact us.
• Details of transactions you carry out through the Services and of the fulfillment of your requests.
• Your search queries and activities on the Website or while interacting with the Services.

As you navigate through the Website and interact with the Services, we may use automatic data collection technologies to collect certain information about your equipment, browsing actions, and patterns, including:

• Details of your visits to the Website or interactions with our Services, including traffic data, location data, logs, and other communication data and the resources that you access and use on the Website or through your interactions with our Services.
• Information about your computer and internet connection, including your IP address, operating system, display resolution, date and time, and browser type.

The information we collect automatically may include Personal Information, or we may maintain it or associate it with Personal Information we collect in other ways or receive from third parties. This helps us to improve the Services and to deliver a better and more personalized service, including by enabling us to:

• Estimate our audience size and usage patterns.
• Store information about your preferences, allowing us to customize our Services according to your individual interests.
• Recognize you when you return to the Website and interact with our Services.

The technologies we use for this automatic data collection may include:

• Cookies (or browser cookies). A cookie is a small file placed on the hard drive of your computer. You may refuse to accept browser cookies by activating the appropriate setting on your browser. However, if you select this setting, you may be unable to access certain parts of our Services. Unless you have adjusted your browser setting so that it will refuse cookies, our system will issue cookies when you direct your browser to the Website.
• Log Files. Like many websites and technology services delivered over the Internet, we collect and store information that your browser sends to us when you visit the Website or interact with the Services. This information may include your IP address, browser type, browser version, domain names, the pages that you visit, the time and date of your visit, the time spent on those pages, and other statistics.
• Analytic Tools. We use cookies and tracking tools like Google Analytics to improve your experience and deliver personalized advertising. This includes collecting data about your browsing behavior—such as page views and clicks—as well as device details like IP address, device information, referrer URL, browser type, operating system, and geographic location.

Google has created an "Opt-out Browser Add-on" for users who wish to use the Services while preventing their data from being accessed or used by Google Analytics. If you want to opt out of the features the Website that relies on Google Analytics, please follow the directions provided by Google here: https://tools.google.com/dlpage/gaoptout.

Purpose of Collection

We use information that we collect about you or that you provide to us, including any Personal Information to:

• Provide the Services. We may use your Personal Information to provide the Services, and any other services you may request from us.
• Monitor the Services. We collect your Personal Information for monitoring purposes to help us diagnose problems with our servers, administer and troubleshoot the Services, calculate usage levels, analyze industry standards, and analyze transactions, trends, and statistics regarding the use of the Services.
• Respond to Inquiries and Fulfill Requests. We may use your Personal Information to respond to your inquiries and to fulfill your requests for information.
• Communicate with You. We may use your Personal Information to communicate with you about items that may be of interest to you. We may also contact you on behalf of our third-party business partners about a particular offering of theirs that may be of interest to you.
• Improve the Services. We may use your Personal Information to make the Services more stable and user-friendly, to analyze issues with the Services, improve the design and content of the Services, personalize your experience, analyze how the Services are used, offer new Services, and to develop new marketing programs relating to the Services.
• Customer Service. We may use your Personal Information when contacting you regarding customer service, to resolve disputes, or in response when you provide feedback. We may also use your information to send administrative emails regarding the Services or to inform you of any changes to this Policy, our Terms of Use, or other agreements with you.
• Support Business Operations. We may use your Personal Information to support our internal business operations, including account management, marketing, security, and advertising.
• Enforce Agreements. We may use your Personal Information to enforce separate agreements between you and us, enforce this Policy, our Terms of Use, and other agreements with you.
• Fulfill Other Purposes. We may use your Personal Information to fulfill: (a) any other purpose for which you provide it; (b) any legal or regulatory requirements and any of our internal policies; (c) other purposes disclosed at the time of collection; (d) any other purpose with your consent; and (e) any other purposes set forth in this Policy.
• Research and Development. We may use your Personal Information to conduct research (including through partnerships with academic institutions, research organizations, and other collaborators), develop current and future products and services, analyze trends, and improve our existing offerings. This includes the use of artificial intelligence, machine learning, and other current or future computational technologies to advance scientific understanding and product development.
• Partnership and Collaboration. We may use your Personal Information to facilitate collaborations with research partners, academic institutions, healthcare organizations, pharmaceutical companies, and other organizations in furtherance of our mission to advance precision medicine and improve health outcomes.
• Product and Service Enhancement. We may use your Personal Information to develop, test, and improve new and existing products, services, features, technologies, and business lines, including those related to health research, diagnostics, therapeutics, and data analytics.
• Analytics and Insights. We may create inferences, predictions, profiles, and derived data based on your Personal Information, which we own and may use for any purpose described in this Policy.
• Automated Processing. We may use automated decision-making, including profiling, to personalize Services, assess eligibility for programs, and improve user experience.
• Data Enrichment. We may combine your information with data obtained from third-party sources to enhance Services, conduct research, or improve accuracy.
• Cross-Device Operations. We may combine information collected across multiple devices, platforms, and sessions to provide a unified experience.
• Aggregate and De-Identified Data. We may create, use, and share aggregate or de-identified information derived from your Personal Information for any lawful purpose, including research, analytics, product development, and commercial purposes. De-identified data is not subject to the restrictions of this Policy.

Sale or Sharing of Personal Information

We do not sell your Personal Information in exchange for monetary compensation. We may share your Personal Information with our service providers by allowing such service providers to collect Personal Information.

Third Party Links

As stated above, our Services may link to third-party websites, online services, or mobile applications and/or contain advertisements from third parties that are not affiliated with us—and which may link to other websites, services, or applications. Please be aware that we are not responsible for the privacy or practices of other websites or third parties. We do not make any guarantee regarding those third-party websites, services, or applications, and we are not liable for any loss or damage caused by the use of such sites. Any data collected by third parties is not covered by this Policy. You should review the policies of the third parties and contact them directly if you have any questions about their services or practices.

Artificial Intelligence ("AI")

Onyx may use AI to provide its Services. We may use Personal Information as well as de-identified information to build AI models where such use directly benefits you or your use of the Services. In all other cases, including those that support the accelerated and safer development of precision medicines, Onyx will only use de-identified information.

Consent and Withdrawal

Where required by law, we will obtain your consent before collecting, using, or disclosing your Personal Information. You may withdraw your consent at any time by contacting us using the details in the Contact Us section below. Withdrawal of consent will not affect the lawfulness of processing based on consent before its withdrawal.

Additional Usage

To the extent Onyx and you wish to use your Personal Information outside the scope of what is described in this Policy, or for purposes that would materially expand the ways your information is used, you will be provided with an informed consent form describing the additional processing and requesting your explicit authorization. You may withdraw your consent at any time by contacting privacy@onyx.bio.

Disclosure of Your Information

We may disclose Personal Information that we collect or that you provide as described in this Policy:

• To our subsidiaries or affiliates;
• To contractors, service providers, and other third parties we use to support our business and who are bound by contractual obligations to keep Personal Information confidential and use it only for the purposes for which we disclose it to them;
• To a buyer or other successor in the event of a merger, divestiture, restructuring, reorganization, dissolution, or other sale or transfer of some or all of Onyx's assets, whether as a going concern or as part of bankruptcy, liquidation, or similar proceeding, in which Personal Information held by Onyx about users of the Services is among the assets transferred;
• To third parties to market their products or services to you only if you have provided prior consent to such disclosures (we contractually require these third parties to keep Personal Information confidential and use it only for the purposes for which we disclose it to them);
• To fulfill the purpose for which you provide it; for example, when using the Services, you may provide us with information to sign up for events, request specific information about programs, or register or apply for various programs or services, and we will use the information you provide us to evaluate and process your request or application or provide you with the services you request;
• For any other purpose disclosed by us when you provide the information; and
• With your consent.

We may use for other purposes and disclose to third parties information that does not constitute Personal Information.

We may also disclose your Personal Information:

• To comply with any court order, law, or legal process, including to respond to any government or regulatory request;
• To enforce or apply the Terms of Use and other agreements between you and Onyx; and
• If we believe disclosure is necessary or appropriate to protect the rights, property, or safety of Onyx, our customers, or others, including by exchanging information with other companies and organizations for the purposes of fraud protection and credit risk reduction.

How Long We Retain Your Information

We will keep your Personal Information while you have an account with us or while we are providing the Services to you. Thereafter, we will keep your Personal Information for as long as is necessary to respond to any questions, complaints or claims made by you or on your behalf or to the extent necessary to keep records required by law.

Choices About How We Use and Disclose Your Information

We strive to provide you with choices regarding the Personal Information you provide to us. We have created mechanisms to provide you with the following control over your information:

• Tracking Technologies and Advertising. You can set your browser to refuse all or some browser cookies, or to alert you when cookies are being sent. Please consult your browser's documentation to learn how. Note that certain portions of the Services may not operate as intended if you refuse certain cookies.
• Opt-out of marketing communications. You can opt-out anytime by following the opt-out instructions in our commercial e-mails or contacting us at privacy@onyx.bio. You will continue to receive emails relevant to your continued use of the Services. If you believe that SPAM has been sent from us, please contact us at privacy@onyx.bio so that we can investigate and rectify the situation.

We do not control third parties' collection or use of your information to serve interest-based advertising. However, these third parties may provide you with ways to choose not to have your information collected or used in this way.

Do Not Track

Our Services do not respond to Do Not Track signals. However, some third-party websites do keep track of your browsing activities. If you are visiting such websites, you can set your preferences in your web browser to inform websites that you do not want to be tracked. You can enable or disable Do Not Track signals by visiting the preferences or settings page of your web browser.

Confidentiality and Security

Onyx has implemented appropriate administrative, technical, and physical safeguards designed to help maintain the integrity and security of your Personal Information. We undertake commercially reasonable efforts to guard against unauthorized access, use, alteration, or destruction of Personal Information.

ONYX MAKES NO CLAIMS, PROMISES OR GUARANTEES ABOUT THE ACCURACY, COMPLETENESS OR ADEQUACY OF THE CONTENTS OF THE SERVICES, AND EXPRESSLY DISCLAIMS LIABILITY FOR ERRORS AND OMISSIONS IN THE CONTENTS OF THE SERVICES. NO WARRANTY OF ANY KIND, IMPLIED, EXPRESSED OR STATUTORY, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF NON-INFRINGEMENT, TITLE, MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND FREEDOM FROM COMPUTER VIRUS, IS GIVEN WITH RESPECT TO THE SERVICES OR HYPERLINKS TO OTHER INTERNET RESOURCES. REFERENCE IN THE SERVICES TO ANY SPECIFIC COMMERCIAL PRODUCTS, PROCESSES OR SERVICES, OR THE USE OF ANY TRADE, FIRM OR CORPORATION NAME IS FOR INFORMATION AND CONVENIENCE ONLY AND DOES NOT CONSTITUTE ENDORSEMENT OR RECOMMENDATION BY ONYX.

Updating Your Information

If you are a user who has a registered account on the Website, you can review and change some of your Personal Information by logging into the Website and visiting your account details page or contacting us at the information listed in the Contact Us section below.

Children Under the Age of 18

Our Services are not intended for children under 18 years of age. We do not knowingly collect information from children under 18. If you are under 18, do not use or provide any information through the Services. If we learn we have collected or received information from a child under 18 without verification of parental consent, we will delete that information. If you believe we might have any information from or about a child under 18, please contact us using the information listed in the Contact Us section below.

Changes to this Policy

We may revise or update this Policy from time to time. If we make material changes to how we treat users' Personal Information, we will provide advance notice before the changes take effect through a prominent notice on the Website or, where practicable, by email to the address associated with your account. A "material change" includes any change that introduces new uses of Personal Information or any processing that a reasonable user would not expect.

Before we continue to use or disclose your Personal Information under the revised Policy, you will be asked to affirm consent to the new terms. If you do not wish to provide consent, you may withdraw consent and/or terminate access. In that case, we will not continue processing your Personal Information under the new terms, except as required or permitted by law.

You are responsible for maintaining an up-to-date, active, and deliverable email address and for periodically reviewing this Policy and the Website for updates. The last date of revision of this Policy is set forth above.

Your State Privacy Rights

State consumer privacy laws may provide their residents with additional rights regarding our use of their Personal Information.

These states may provide (now or in the future) their state residents with rights to:

• Confirm whether we process their Personal Information.
• Access and delete certain Personal Information.
• Correct inaccuracies in their Personal Information, taking into account the information's nature and processing purpose.
• Data portability.
• Opt-out of Personal Information processing for:
  • targeted advertising;
  • sales; or
  • profiling in furtherance of decisions that produce legal or similarly significant effects.
• Either limit (opt-out of) or require consent to process sensitive Personal Information.

The exact scope of these rights may vary by state. To understand if you have any of these rights, and to exercise any of these rights please contact us at the information listed in the Contact Us section below.

Your California Privacy Rights (CCPA/CPRA)

This privacy notice section for California residents supplements the information contained in this Policy and it applies solely to all visitors, users, and others who reside in the State of California.

Categories of Personal Information Collected

Disclosure of Personal Information for Business Purposes or Commercial Purposes

We may use or disclose and may have used or disclosed in the last twelve (12) months the following categories of Personal Information for business or commercial purposes:

• Identifiers
• Personal information categories listed in the California Customer Records statute (Cal. Civ. Code § 1798.80(e))
• Characteristics of protected classifications under California or federal law
• Biometric information
• Internet or other similar network activity
• Geolocation data
• Sensory data
• Inferences drawn from other Personal Information

Please note that the categories listed above are those defined in the CCPA. This does not mean that all examples of that category of Personal Information were in fact disclosed.

Sharing of Personal Information

We may share your Personal Information identified in the above categories with the following categories of third parties:

• Service Providers
• Our affiliates
• Our business partners
• Third party vendors whom you or your agents authorize us to disclose your Personal Information in connection with products or services we provide to you.

Shine the Light

Under California Civil Code Section 1798.83 ("Shine the Light"), California residents have the right to request in writing from businesses with whom they have an established business relationship, (a) a list of the categories of Personal Information (e.g., name, e-mail and mailing address and the type of services provided to the consumer) that a business has disclosed to third parties (including affiliates that are separate legal entities) during the immediately preceding calendar year for the third parties' direct marketing purposes; and (b) the names and addresses of all such third parties. To request the above information, please contact us as directed in the Contact Us section below with a reference to Shine the Light inquiry.

Purpose & Sources of Personal Information Collected

We may collect (and have collected during the 12-month period prior to the "Last Modified" date of this Policy) the categories of Personal Information from the sources and for the purposes as described in the above sections.

Selling and Sharing Personal Information

We do not sell or share your Personal Information in exchange for monetary consideration; however, we may use tools described above (such as Google Analytics), which may be interpreted as sharing your Personal Information. As such, please see the above sections for more information regarding opting out of use of these tools.

Privacy Rights

Under California State Law, consumers have certain rights regarding their Personal Information, as described below.

Right of Access. You have the right to request, twice in a 12-month period, that we disclose to you the following information about you, limited to the preceding twelve (12) months:

• The categories of Personal Information that we collected about you;
• The categories of sources from which the Personal Information is collected;
• The business or commercial purpose for collecting Personal Information;
• The categories of third parties with whom we share Personal Information;
• The specific pieces of Personal Information that we have collected about you;
• The categories of Personal Information that we disclosed about you for a business purpose (if any); and
• For each category of Personal Information identified, the categories of third parties to whom the information was disclosed (if any).

Right of Deletion. You have the right to request that we delete any Personal Information about you which we have collected from you, subject to exceptions within the law.

Right to Limit Use and Disclosure of Sensitive Personal Information. You may request specific limitations on further sharing, use, or disclosure of your sensitive Personal Information that is collected or processed. Onyx does not sell or disclose your personal information for monetary consideration.

Right to Correction. You have the right to request that we maintain accurate Personal Information about you and correct any Personal Information about you which we have collected from you, subject to exceptions within the law.

Data Portability. You may request that your data be provided to you or transferred to another organization.

Discrimination

We will not discriminate against you for exercising any of your rights under the CCPA.

Request Processing and Verification

In order to protect your Personal Information from unauthorized access, deletion, rectification, or restriction we may require you to verify your identity before we will process any request to know or delete Personal Information. If we cannot verify your identity to our satisfaction, we will not provide or delete your Personal Information.

You may submit a request to know or delete your Personal Information through an authorized agent. Such an agent must present signed written authority to act on your behalf and must be able to verify your identity to our satisfaction.

To exercise one of your rights, you should send a communication in writing to privacy@onyx.bio. We will attend to your request in a timely manner within 45 days of receiving your request. If, for any reason, we need to extend this period of time, we will contact you.

International Transfers of Personal Information

Onyx is based in the United States, and we process and store information on servers located in the United States. By accessing or using the Services or otherwise by providing information to us, you consent to the processing, transfer and storage of your information in and to the United States, where you may not have the same rights as you do under local law. Continually, by using our Services, or by providing any Personal Information to us, where applicable law permits, you consent to the transfer, processing, and storage of such information outside of your country of residence where data protection standards may be different. Where required by law, we implement appropriate safeguards, such as Standard Contractual Clauses approved by the European Commission or UK authorities, to protect your Personal Information.

Contact Us

If you have any further questions, concerns, comments or you would like to exercise any applicable rights listed above, please use the contact information listed below.

Onyx
626 Bancroft Way, Suite A
Berkeley, CA 94710
privacy@onyx.bio
(415) 617-5959