General Privacy Notice for Healthcare Professionals

Effective as of December 5, 2025.

Immunome, Inc. (“Immunome” “we”, “us”, or “our”) sponsors ethically approved clinical trials (each, a “Study”, and collectively, the “Studies”). We take the protection of personally identifiable information (“Personal Data”) seriously.

Scope
This Privacy Notice (“Notice”) is addressed to the study staff involved in conducting the Studies sponsored by Immunome, including principal investigators, sub-investigators, and other health care professionals (“HCPs”) and study site personnel (“Site Personnel”) (collectively, “Data Subjects”, “you”, “your”) whose Personal Data we may receive and process in connection with your work related to the execution of the Studies.
This Notice does not apply to Personal Data collected by any other means or in other contexts, such as Personal Data collected through our website(s), or the Personal Data of our employees, job applicants, contractors, business owners, officers, directors, or staff. This Notice does not apply to Personal Data of individual patients involved in our Studies.
If we maintain information in a manner that cannot reasonably identify, relate to, describe, be capable of being associated with, or be linked, directly or indirectly, with a particular individual or household, such information is not considered Personal Data, and this Notice will not apply to our processing of that information.

Controllership
Within the scope of this Notice, Immunome generally acts as a data controller for the Personal Data processed in the context of the Studies we sponsor. This means that Immunome determines the purpose and means of the processing of your Personal Data needed for the conduct of the Studies.

Personal Data Collected About You
The following types of Personal Data may be processed about you in the context of the Studies:

• Professional contact and identification information (e.g., name, gender, email address, postal address, phone number)
• Professional role and experience (ev .g., title, position, company name; specialty, year of graduation, publications, congress participation, awards, biography, education, university affiliations, areas of expertise, and involvement in clinical trials, guidelines, editorial boards, organizations, conferences, events, and speaking engagements)
• Payment and financial information (e.g., credit card details, bank account information, VAT or other tax identification numbers)
• Electronic identification data if on systems used for the Study or Immunome systems (e.g., login credentials, access rights, passwords, badge numbers, IP addresses, online identifiers/cookies, logs, access and connection times.
• Publicly available social media and group interaction data (e.g., posts, blogs, forums, or social media activity related to your professional or therapeutic area)
• Scientific and medical engagement data, including services you provide to us and potential future collaborations;
• Location information, such as the location of the study site where you are based; and
• Other information you provide, such as through forms, inquiries, surveys, or participation in market research.

If you intend to provide us with Personal Data about other individuals (e.g. your colleagues), you must provide a copy of this Notice to the relevant individuals, directly or through their employer.

How We Receive Your Personal Data

• We may collect Personal Data about you from a variety of sources, including:
• When you or the study site provides it directly to us and when you provide CVs and resumes through email or pre-clinical questionnaires;
• When we receive it from the CRO that conducts the Studies on our behalf;
• When we receive it from publicly available sources such as the register of licensed medical practitioners in your country, online, and other databases and websites such as PubMed, ClinicalTrials.gov, congress websites, or university websites;
• When we receive it from other documents or forms that you provide in order to participate in clinical research and development activities, such as webinars, services, educational events, and clinical information and updates or in other contexts;
• When certain Personal Data about you may be inferred from other Personal Data held by us or our service providers.

The Personal Data you provide will become part of the clinical trial databases and paper files as needed for the implementation, monitoring, performance, record-keeping (archiving), and government oversight or review of the Studies.

Providing your Personal Data is necessary to take part in any Study activities. If you do not wish to provide your Personal Data, you will be ineligible to take part in any Study activities related to our Studies.

When the CRO shares your Personal Data with Immunome that it has collected previously as a data controller in its own right, the CRO’s processing of your Personal Data is governed by its own privacy notice made available to you by them.

The Purposes of Processing Your Personal Data and Legal Bases of Processing
We will process your Personal Data for a specific, legitimate purpose. We will not process your Personal Data unless we have a valid legal basis for doing so. Accordingly, we will only process your Personal Data if one of the following applies:

• Consent: You have given us your prior consent.
• Contractual necessity: The processing is necessary to perform our contractual obligations or to take steps at your request before entering into a contract with you.
• Legal obligation: The processing is necessary for us to comply with legal or regulatory obligations.
• Legitimate interest: The processing is necessary for our legitimate interests and does not override your interests or fundamental rights and freedoms.

The table below includes examples of the purposes for which we process your Personal Data and the corresponding legal basis.

Recipients and Transfer of Your Personal Data
We may share your Personal Data with our service providers, contractors, government and regulatory agencies, researchers and research institutions, laboratories, professional advisors such as lawyers, insurers, consultants, and auditors, actual or prospective purchasers of our businesses in the event of a sale, merger or acquisition (“Recipients”) who will use your Personal Data only for the purposes described above. All Recipients are contractually obligated to maintain the confidentiality and security of your Personal Data in accordance with applicable laws. In some cases, your Personal Data may be made publicly available to meet legal, regulatory, or transparency obligations through websites such as www.clinicaltrials.gov, https://www.cms.gov/priorities/key-initiatives/open-payments, and other websites and databases that serve a comparable purpose.

For EEA and UK Individuals:
Immunome and our Recipients will process your Personal Data in countries outside the EEA or the UK for the purposes described in this Notice. Please note that the GDPR only allows us to transfer Personal Data outside of the EEA or the UK if the country that the data is being transferred to offers an adequate level of protection for the Personal Data which is equivalent to the EU or UK law. In some cases, the European Commission may have determined that the laws of certain countries provide an adequate level of protection to Personal Data. You can see here the list of countries that the European Commission has recognized as providing an adequate level of protection to Personal Data.

To the extent that your Personal Data is shared with Recipients which are located in countries not recognized as providing an adequate level of protection to Personal Data, Immunome will only transfer your Personal Data when there are appropriate safeguards to govern such transfers outside your jurisdiction, for example, the Standard Contractual Clauses as approved by the European Commission under Article 46.2 of the GDPR (or a similarly appropriate contractual transfer mechanism) and the UK International Data Transfer Addendum or the UK International Data Transfer Agreement. If you require further details, please contact us using the details provided in this Notice.

Please note that we will only transfer your Personal Data outside of your country in accordance with the applicable laws.

How Do We Protect Your Personal Data?
We have implemented appropriate technical and organizational measures to ensure a high level of security and confidentiality for your Personal Data and to protect it from unauthorized processing consistent with applicable privacy and data security laws. When we retain a third-party service provider, that provider will be carefully selected and required to use appropriate measures in accordance with applicable law to protect the confidentiality and security of Personal Data. That provider will only be permitted to process your data in accordance with our instructions and as described in this Notice.

How Long Do We Store Your Personal Data?
We retain your Personal Data only for as long as reasonably necessary to fulfill the purposes outlined in this Notice and to comply with applicable legal or regulatory requirements. Your Personal Data associated with the conduct of the Studies and as contained in the clinical trial master file will be stored for a period of 25 years after completion of the Studies in accordance with Article 58 of the Clinical Trial Regulation 536/2014 and/or applicable UK clinical trials legislation (such as the Medicines for Human Use (Clinical Trials) Regulations 2004, as amended from time to time).

What Are Your Privacy Rights and How Can You Exercise Them?
Subject to certain limitations and exclusions under applicable law, you may be entitled to contact Immunome to exercise your rights to access, correct, restrict, delete, or object to the processing of your Personal Data or request that your Personal Data be received in a structured, commonly used and machine-readable format and have it transmitted to another controller. Each of these rights are discussed in more detail below.

Right to Know What Happens to Your Personal Data
This is otherwise known as the “right to be informed”. It means that you have the right to obtain from us all information regarding our data processing activities that concern you, such as how we collect and use your Personal Data, how long we will keep it, and who it will be shared with, among other things.
We are informing you of how we process your Personal Data with this Notice.
We will always try to inform you about how we process your Personal Data. However, if we do not collect the Personal Data directly from you, certain privacy laws, such as the GDPR exempt us from the obligation to inform you: (i) when providing the information is either impossible or unreasonably expensive; (ii) the gathering and/or transmission is required by law, or if (iii) the Personal Data must remain confidential due to professional secrecy or other statutory secrecy obligations.

Right to Know What Personal Data We Have About You
This is otherwise known as the “right of access”. This right allows you to ask for full details of the Personal Data we hold about you. You have the right to obtain from us a copy or access to the Personal Data and certain related information concerning you, including confirmation of whether or not we process Personal Data concerning you, and, where that is the case. Once we receive and confirm that the request came from you or your authorized agent, we will disclose the relevant information to you, which may include:

• the categories of your Personal Data that we process;
• the categories of sources for your Personal Data;
• our purposes for processing your Personal Data;
  where possible, the retention period for your Personal Data, or, if not possible, the criteria used to determine the retention period;
• the categories of third parties with whom we share your Personal Data;
• the specific pieces of Personal Data we process about you in an easily-sharable format;
• if we rely on legitimate interests as a lawful basis to process your Personal Data, the specific legitimate interests (for example, to process a request made by you); and
• the appropriate safeguards used to transfer Personal Data from the EEA or the UK to a third country, if applicable.

Under some circumstances, we may deny your access request. In that event, we will respond to you with the reason for the denial.

Right to Change Your Personal Data
This is otherwise known as the “right to rectification”. It gives you the right to ask us to correct without undue delay anything that you think is wrong with the Personal Data we have on file about you, and to complete any incomplete Personal Data.

Right to Delete Your Personal Data
This is otherwise known as the “right to erasure”, “right to deletion”, or the “right to be forgotten”. This right means you can ask for your Personal Data to be deleted. Sometimes we can delete your information, but other times it is not possible for either technical or legal reasons (such as if the law requires us to maintain a record of your involvement in a Study). If that is the case, we will inform you of our reason for denying your deletion request.

Right to Ask Us to Limit How We Process Your Personal Data
This is otherwise known as the “right to restrict processing”. It is the right to ask us to only use or store your Personal Data for certain purposes. You have this right in certain instances, such as where you believe the data is inaccurate or the processing activity is unlawful.

Right to Ask Us to Stop Using Your Personal Data
This is otherwise known as the “right to object”. This is your right to tell us to stop using your Personal Data. You have this right where we rely on a legitimate interest of ours (or of a third party). 
We will stop processing the relevant Personal Data unless: (i) we have compelling legitimate grounds for the processing that override your interests, rights, or freedoms; or (ii) we need to continue processing your Personal Data to establish, exercise, or defend a legal claim.

Right to Port or Move Your Personal Data
This is otherwise known as the “right to data portability”. It is the right to ask for and receive a portable copy of your Personal Data that you have given us, so that you can:

• move it;
• copy it;
• keep it for yourself; or
• transfer it to another organization.

We will provide your Personal Data in a structured, commonly used, and machine-readable format. When you request this information electronically, we will provide you a copy in electronic format.

Right Related to Automated Decision Making
We do not, as of the date of this Notice, use automated decision-making. However, if we do in the future, for decisions that may seriously impact you, you have the right not to be subject to automated decision-making, including profiling. But in those cases, we will always explain to you when we might do this, why it is happening and the effect it may have on you or your Personal Data.

Right to Withdraw Your Consent
Where we rely on your consent as the legal basis for processing your Personal Data, you may withdraw your consent at any time. However, this will not affect the lawfulness of our processing before you withdrew your consent. It will also not affect processing performed on other lawful grounds.

Right to Lodge a Complaint with a Supervisory Authority
If the GDPR applies to our processing of your Personal Data, you have the right to lodge a complaint with a supervisory authority if you are not satisfied with how we process your Personal Data.

Specifically, you can lodge a complaint in the Member State of the EU of your habitual residence, place of work, or the alleged violation of the GDPR. In the UK, you can lodge a complaint with the UK Information Commissioner’s Office (ICO). A listing of each EU country’s supervisory authority may be found here: http://ec.europa.eu/justice/data-protection/bodies/authorities/index_en.htm.

How to Exercise Your Rights
If you want to exercise the above rights, please contact Immunome at: privacy@immunome.com.

Contact Us
If you have any questions about this Notice or our processing of your Personal Data, please contact us at:

Immunome, Inc.
18702 North Creek Parkway, Suite 100
Bothell WA 98011
privacy@immunome.com

You can also contact our Data Protection Officer directly using the contact details provided below. Please allow up to four weeks for us to reply.

Data Protection Officer
We have appointed VeraSafe as our Data Protection Officer. While you may contact us directly, VeraSafe can also be contacted on matters related to the processing of Personal Data. VeraSafe’s contact details are:

VeraSafe, LLC
100 M Street S.E., Suite 600
Washington, D.C. 20003 USA
Phone: +1 (617) 398-7067
Email: experts@verasafe.com
Web: https://www.verasafe.com/about-verasafe/contact-us/

Data Protection Representative
While you may contact us at any time, our data protection representative can be contacted about matters related to the processing of your Personal Data.

European Union Representative
We have appointed VeraSafe as our representative in the EU for data protection matters. To contact VeraSafe, please use this contact form: https://www.verasafe.com/privacy-services/contact-article-27-representative/.
Alternatively, VeraSafe can be contacted at:

VeraSafe Netherlands BV
Keizersgracht 555
1017 DR Amsterdam
The Netherlands 

United Kingdom Representative 
VeraSafe has also been appointed as our representative in the UK for data protection matters. To make an inquiry, please contact VeraSafe using this contact form: https://verasafe.com/public-resources/contact-data-protection-representative or via telephone at +44 (20) 4532 2003.
Alternatively, VeraSafe can be contacted at:

VeraSafe United Kingdom Ltd.
37 Albert Embankment
London SE1 7TL
United Kingdom

Changes to this Notice
We reserve the right to change this Notice at any time (for example, to comply with changes in laws or regulations, our practices, procedures, and organizational structures, requirements imposed or recommended by supervisory authorities or otherwise). Changes to this Notice shall be applicable on the effective date of implementation. We will communicate any changes to you, where we are required to do so.