Privacy Policy

Effective date: June 19, 2026 Last updated: August 3, 2026

1. Introduction

Gather Bio, Inc. ("Gather Bio," "we," "us," or "our") is a Delaware corporation building research infrastructure for autoimmune disease. This Privacy Policy describes how we collect, use, and share information through our website at gatherbio.com (the "Site").

This Policy covers our waitlist sign-up and informational website. It does not cover participation in research studies. When we open active research enrollment, we will provide separate informed consent documents that govern the collection and use of research data. Those documents will be reviewed and approved by an independent Institutional Review Board (IRB) before enrollment begins.

By using the Site or submitting information to our waitlist, you agree to this Privacy Policy.

2. Information we collect

We collect the following information when you choose to provide it:

• Contact and identifying information you submit through our waitlist form, which may include your name, email address, phone number, and zip code.
• Any information you include when you contact us directly, such as the content of an email.
• Basic technical and usage information collected automatically when you visit the Site, such as your browser type, device type, pages viewed, referring page, timestamps, and general location inferred from your IP address.

We do not ask for medical or diagnosis information through the waitlist form. If you choose to include health-related details in a message to us, we will treat that information as described in this Policy.

3. Analytics, cookies, and similar technologies

We use first-party analytics to understand how visitors find and use the Site. When you visit, we assign your browser a randomly generated visitor identifier and store it on your device using a cookie or equivalent browser storage. That identifier does not contain your name or contact information, but it persists across visits and lets us recognize a returning browser.

We log a record of each page you view, associated with that identifier, along with the technical and usage information described in Section 2. We use this to measure traffic, understand which pages and referral sources are useful, and improve the Site.

If you later join our waitlist, information you submit through the form may be associated with the visitor identifier for that browser, which means analytics activity we have recorded can become linked to you.

You can clear or block cookies and similar storage through your browser settings. Blocking them may affect how parts of the Site function.

We honor the Global Privacy Control (GPC) signal. If your browser or a browser extension sends GPC, we do not assign your browser a visitor identifier, we do not log your pageviews, and we do not store analytics information on your device. You can still join our waitlist with GPC enabled — your sign-up simply will not be linked to a browser identifier. The bot protection described in Section 5 still runs, because it is what keeps our forms usable.

4. Session analytics (Microsoft Clarity)

With your permission, we use Microsoft Clarity to understand how visitors actually use our pages — how far people scroll, where they click, and where they get stuck partway through a form. Clarity records a reconstruction of your visit that we can replay, and combines visits into aggregate heatmaps.

Clarity does not run unless you agree to it. The first time you visit, we ask. No Clarity code loads and no Clarity cookie is set unless you choose "Accept." If you decline, or if you never answer, it never runs.

We configure Clarity in its strictest privacy mode, which masks text before it leaves your browser. We cannot read your email address, or anything else you type, from a session recording. We do not attach your name, email address, or any other identifier to a Clarity session, and we do not send Clarity any information about health or medical conditions.

Clarity sets cookies named _clck and _clsk on your device to recognize a session. This information is processed by Microsoft Corporation as our service provider and is subject to the Microsoft Privacy Statement.

As with our first-party analytics, we honor the Global Privacy Control signal here. If your browser sends GPC, we do not ask you about Clarity and it never runs.

You can change your answer at any time, and turning it off is as easy as turning it on was. Your current setting for this browser:

5. Bot protection (Cloudflare Turnstile)

We use Cloudflare Turnstile to protect our forms from automated abuse and spam. Turnstile runs automatically in the background and may collect information about your browser, device, and interaction with the page in order to distinguish human visitors from bots. This information is processed by Cloudflare, Inc. as our service provider.

Cloudflare's handling of this information is described in the Cloudflare Turnstile Privacy Addendum and the Cloudflare Privacy Policy.

6. How we use information

We use the information we collect to:

• Add you to our waitlist and notify you about research enrollment opportunities as they become available.
• Respond to your questions and communicate with you about Gather Bio.
• Operate, maintain, secure, and improve the Site, including measuring traffic and protecting against fraud and automated abuse.
• Comply with legal obligations.

7. How we share information

We do not sell your personal information. We share information only in these limited circumstances:

• With service providers who help us operate the Site, run analytics, protect our forms from abuse, and manage our waitlist, under contractual confidentiality obligations. These currently include Cloudflare for bot protection and, where you have agreed to it, Microsoft for session analytics.
• When required by law, regulation, legal process, or governmental request.
• In connection with a corporate transaction such as a merger, acquisition, or financing, where information may be transferred subject to this Policy.

8. Data security

We use commercially reasonable administrative, technical, and physical safeguards designed to protect your information. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

9. Data retention and deletion

We retain waitlist information for as long as needed to operate the waitlist and contact you about enrollment, unless you ask us to delete it. We retain analytics records, including visitor identifiers and pageview logs, for up to 24 months, after which they are deleted or aggregated so they can no longer be linked to an individual browser. Session recordings described in Section 4 are held by Microsoft on their own retention schedule; turning session analytics off stops any further recording of your browser. You may request deletion of your information at any time by emailing hello@gatherbio.com. We will respond to verified requests within the timeframes required by applicable law.

10. Your privacy rights

Depending on where you live, you may have rights to access, correct, delete, or restrict the use of your personal information, and to opt out of the sale or sharing of your personal information. We do not sell personal information. To exercise any of these rights, email hello@gatherbio.com. We will not discriminate against you for exercising your rights.

Residents of California, Washington, Virginia, Colorado, Connecticut, Texas, Utah, and other states with applicable privacy laws have specific rights under those laws. We honor verified requests in accordance with the law that applies to you.

11. Children's privacy

The Site is not directed to children under 18, and we do not knowingly collect personal information from children. If you believe a child has provided us information, email hello@gatherbio.com and we will delete it.

12. Changes to this Policy

We may update this Policy from time to time. When we do, we will revise the "Last updated" date above. Material changes will be communicated through the Site.

13. Contact us

Questions about this Policy or your information can be sent to: