SMS Privacy Policy Cytokind, Inc. Privacy Policy Effective September 5, 2026 · Last updated September 5, 2026 This Privacy Policy describes how Cytokind, Inc. (“Cytokind,” “we,” “us,” or “our”) collects, uses, stores, shares, and protects personal information in connection with our websites, including cytokind.net, and our related products, services, and communications programs (collectively, the “Service”). This Policy applies to all visitors, users, patients, caregivers, and providers who access the Service or provide information to us (“you”). By using the Service or providing us information, you agree to the practices described here. If you do not agree, please do not use the Service or provide us your information. Mobile and text messaging data. No mobile information will be shared with third parties or affiliates for marketing or promotional purposes. Text messaging originator opt-in data and consent will not be shared with any third parties. 1. Information We Collect Information you provide directly Contact and identity information — your first and last name, email address, mobile or other telephone number, mailing or shipping address, and country. Information you submit through forms — including our contact form, discovery-call booking, newsletter subscription, and any information you volunteer about the inflammatory or autoimmune condition you are interested in treating. Communications — the content of emails, text messages, form submissions, and phone conversations between you and Cytokind, including support and onboarding correspondence. Order and prescription-related information — device selection, order details, and information needed to coordinate with your prescribing care provider. We do not collect payment card numbers directly; payments, where applicable, are processed by third-party payment processors. Health-related information you choose to share Because our products are prescription phototherapy devices, you may choose to share information about your health condition, symptoms, or care provider. We collect this information only when you provide it to us, and we use it only to respond to you, coordinate with your prescribing provider, and support your use of the device. We do not sell health-related information, and we do not use it for advertising. Information collected automatically Log file information — your IP address, browser type and version, referring and exit pages and URLs, pages viewed, links clicked, domain names, landing pages, device identifiers, and the date and time of your requests. Cookies and similar technologies — used to remember your preferences, keep the Service functioning, measure traffic, and understand how the Service is used. Most browsers let you refuse or delete cookies; some features of the Service may not function properly if you do. Email engagement — whether emails we send are opened and which links are clicked, so we can improve our communications. 2. How We Use Your Information We use the information we collect to: respond to your inquiries and schedule and conduct discovery calls; manage your customer relationship and provide customer and technical support; coordinate device selection, prescriptions, delivery, setup, and ongoing use with you and your care provider; send you Service-related and transactional messages by email, SMS text message, or phone, such as appointment reminders, order and shipping updates, onboarding steps, and technical or security notices; send you educational, news, or promotional communications where you have given us the appropriate consent, and only until you opt out; provide, improve, test, secure, and monitor the effectiveness of the Service; develop and test new products and features; analyze aggregate metrics such as total visitors and traffic patterns; diagnose and fix technical problems; enforce our Terms of Service and protect the rights, safety, and property of Cytokind, our users, and others; and comply with applicable law and legal obligations. 3. SMS and Text Messaging Program How we obtain your consent We send text messages only to individuals who have affirmatively opted in to receive them. You may provide consent by submitting a form on cytokind.net that includes a clearly labeled, unchecked consent checkbox next to your mobile number, by texting us first, by providing your number and consent verbally or in writing during a call or onboarding conversation with a Cytokind representative, or by replying to a confirmation message. Consent to receive marketing or promotional text messages is never a condition of purchasing any product or service from Cytokind, and is obtained separately from consent to receive transactional or care-related messages. What we send and how often Care, onboarding, and appointment messages — discovery-call confirmations and reminders, onboarding steps, device setup guidance, treatment check-ins, and support follow-ups. Order and shipping messages — order confirmations, prescription coordination status, and delivery notifications. Account and security messages — verification codes, account changes, and updates to our policies. Educational and promotional messages — sent only to individuals who have separately consented to receive them. Message frequency varies. Message and data rates may apply. How to stop, and how to get help You may cancel at any time by replying STOP or UNSUBSCRIBE to any message you receive from us. After you send one of those keywords, we will send a single confirmation message and will send no further messages to that number unless you opt in again. For assistance, reply HELP to any message or email us at adellicolli@cytokind.net. Carriers Carriers are not liable for delayed or undelivered messages. Message delivery is subject to effective transmission by your wireless carrier and is not guaranteed. How we protect your mobile information No mobile information will be shared with third parties or affiliates for marketing or promotional purposes. Text messaging originator opt-in data and consent will not be shared with any third parties. We do not sell, rent, lease, or otherwise disclose your mobile phone number or your SMS consent record to any third party, affiliate, data broker, advertiser, or lead-generation service for any purpose other than delivering the messages you asked to receive. The only parties that receive your mobile number are the messaging and communications platforms that transmit messages on our behalf, acting strictly as our service providers under contract, solely to deliver those messages, and with no right to use the number for their own purposes. 4. How We Share Your Information We do not sell your personal information. We share personal information only in the limited circumstances described below. Service providers. We share information with vendors who perform services for us — such as website hosting, email and SMS delivery, customer relationship management, analytics, shipping and logistics, and payment processing. Service providers receive only the information reasonably necessary to perform their function, are bound by confidentiality obligations, and may not use the information for their own purposes. Your care provider. Where you ask us to, or where it is necessary to fulfill a prescription or coordinate your treatment, we share relevant information with the prescribing provider or clinic you identify. Affiliates. We may share information with entities under common ownership with Cytokind to help operate, understand, and improve the Service. Affiliates are bound by this Policy. Legal requirements and safety. We may access, preserve, and disclose information where we have a good-faith belief that doing so is required by law or legal process, or is necessary to detect, prevent, or address fraud, security, or technical issues; to enforce our Terms of Service; or to protect the rights, property, or safety of Cytokind, our users, or the public. Change of control. If Cytokind is involved in a merger, acquisition, financing, reorganization, sale of assets, bankruptcy, or dissolution, information we hold may be transferred as part of that transaction. Any acquiring party will remain bound by the commitments in this Policy with respect to information transferred, or you will be notified and given a choice before your information becomes subject to a materially different policy. Aggregated or de-identified data. We may create and share aggregated or de-identified information that cannot reasonably be used to identify you. With your direction. We share information with any other party when you ask us to. All of the above categories exclude text messaging originator opt-in data and consent; this information will not be shared with any third parties. Mobile phone numbers collected for SMS purposes and the associated consent records are not disclosed to affiliates, are not included in any sale or transfer of marketing data, and are not shared with third parties or affiliates for marketing or promotional purposes. 5. Data Security We use commercially reasonable administrative, technical, and physical safeguards designed to protect personal information against loss, misuse, and unauthorized access, disclosure, alteration, or destruction. These include encryption of data in transit, access controls limiting internal access to personnel with a business need, and contractual security obligations on our service providers. No method of transmission or storage is completely secure, and we cannot guarantee absolute security. You are responsible for protecting access to your own email account and devices. 6. Data Retention We retain personal information for as long as necessary to fulfill the purposes described in this Policy, including to provide the Service, maintain records of prescriptions and orders, comply with legal and regulatory obligations, resolve disputes, and enforce our agreements. SMS consent records are retained for as long as you remain opted in and for a reasonable period afterward to demonstrate compliance with applicable messaging regulations. 7. Your Choices and Rights Text messages. Reply STOP or UNSUBSCRIBE to any message, or email adellicolli@cytokind.net. Email. Use the unsubscribe link in any marketing email, or contact us. You may not opt out of Service-related communications such as order confirmations, security notices, and policy updates while you remain a customer. Access, correction, and deletion. You may request access to, correction of, or deletion of the personal information we hold about you by emailing info@cytokind.net. We will respond within the time required by applicable law and may need to verify your identity before acting. Cookies. You may refuse or delete cookies through your browser settings. 8. California Privacy Rights If you are a California resident, you have the right to know what personal information we collect, use, and disclose; to request deletion or correction of your personal information; and to be free from discrimination for exercising these rights. Cytokind does not sell or share personal information as those terms are defined under the California Consumer Privacy Act, and we have not done so in the preceding twelve months. We do not sell or share the personal information of consumers under 16 years of age. California Civil Code Section 1798.83 additionally permits California residents to request information about our disclosure of personal information to third parties for those third parties’ direct marketing purposes. To make any of these requests, email info@cytokind.net. Our Service is not directed to minors. If you are a California resident under 18 and a registered user, you may request removal of content you have publicly posted by emailing info@cytokind.net with a detailed description. Cytokind does not currently respond to Do Not Track browser signals. 9. Individuals in the European Economic Area, United Kingdom, and Switzerland Cytokind complies with the General Data Protection Regulation (“GDPR”) and equivalent UK requirements regarding the collection, use, and retention of personal information transferred from the EEA, the UK, and Switzerland to the United States. If there is any conflict between this Policy and data subject rights under the GDPR, the GDPR governs. Definitions “Personal Data” means information that is transferred from the EU/EEA, the UK, or Switzerland to the United States; is recorded in any form; is about or pertains to a specific individual; and can be linked to that individual. “Sensitive Personal Information” means personal information revealing racial or ethnic origin, sexual orientation, political opinions, religious or philosophical beliefs, trade union membership, or concerning an individual’s health. Principles Inform. We inform individuals of the purposes for which we collect and use their Personal Data and the types of third parties to which we may disclose it, in clear and conspicuous language, when they are first asked to provide Personal Data or as soon as practicable thereafter, and in any event before we use or disclose it for a new purpose. We may be required to disclose Personal Data in response to lawful requests by public authorities. Choice. Individuals may opt out of disclosure of their Personal Data to a third party or its use for a purpose other than that for which it was collected, by emailing info@cytokind.net. For Sensitive Personal Information, including health information, we obtain affirmative, explicit opt-in consent before disclosing it to a third party or using it for a new purpose. Accountability for onward transfer. Before disclosing Personal Data to a third party, we notify the individual and offer the choice to opt out, and we require the recipient to provide an equivalent level of protection by written agreement. Data security. We take reasonable physical, electronic, and managerial steps to protect Personal Data from loss, misuse, and unauthorized access, disclosure, alteration, and destruction. Data integrity and purpose limitation. We process Personal Data only in ways compatible with and relevant to the purpose for which it was collected, and take reasonable steps to keep it accurate, complete, current, and reliable for its intended use. Access and recourse. Individuals may access, correct, amend, or delete their Personal Data by emailing info@cytokind.net, except where the burden or expense would be disproportionate to the risk or where the rights of others would be violated. Where Cytokind acts as a processor, individuals should contact the controller. Enforcement and liability. We are committed to resolving complaints about our collection or use of Personal Data. Individuals with inquiries or complaints should contact us at the address below. You also have the right to lodge a complaint with your local supervisory authority. International transfers When you use the Service, your information may be transferred to, stored in, and processed in the United States or other countries where Cytokind, our affiliates, or our service providers maintain facilities. These countries may not have the same data protection laws as your jurisdiction. Where required, we rely on appropriate safeguards such as Standard Contractual Clauses for such transfers. 10. Children’s Privacy The Service is not directed to children, and Cytokind does not knowingly collect personal information from anyone under 13. If we learn that we have collected personal information from a child under 13 without parental consent, we will delete it as quickly as possible. If you believe we may hold information from or about a child under 13, contact info@cytokind.net. 11. Other Websites and Services The Service may link to websites and services we do not operate. We are not responsible for the privacy practices or content of those sites, and this Policy does not apply to them. Review the privacy policy of any third-party site you visit. 12. Changes to This Policy We may update this Privacy Policy from time to time. When we do, we will revise the “Last updated” date above and, where the changes are material, provide additional notice as appropriate. Your continued use of the Service after an update constitutes acceptance of the revised Policy. 13. How to Contact Us If you have questions about this Privacy Policy, the Service, or our SMS program, contact us: Cytokind, Inc. Attn: Privacy Officer / Data Protection Officer 18 Forest Ring Drive Intervale, NH 03845-0448, United States General and privacy inquiries: info@cytokind.net SMS program support: adellicolli@cytokind.net See also our Terms of Service.