Chime Biologics Privacy Policy

Introduction

Chime Biologics (Wuhan) Co., Ltd. (hereinafter referred to as “we” or “Chime Biologics”) includes Chime Biologics (Wuhan) Co., Ltd. (the owner of the website that has completed the Internet content provider (ICP) procedures (ICP No.【】), with its registered address at No. 388, Gaoxin 2nd Road, East Lake Hi-tech Development Zone, Wuhan, Hubei Province) and its affiliates.

This Chime Biologics Privacy Policy (the “Privacy Policy” or the “Policy”) is closely related to the services and features provided by the Chime Biologics website (https://www.chimebiologics.com/the “Website”). You should choose whether to agree to this Privacy Policy and to use our services after carefully reading and fully understanding this Privacy Policy. If you have any questions about this Policy, please contact us in a timely manner.

This Privacy Policy describes the purposes, method, and scope of the collection, use, storage, sharing, transfer, delegated processing, and public disclosure of your personal information and the information security measures taken in the process of providing services to you, as well as your rights to manage your personal information and how to exercise your rights. You should carefully read this Privacy Policy in conjunction with our Terms of Use (https://chimebiologics.com/website-terms-of-use/). We would like to draw your attention to the following content:

1. All key content is highlighted in bold; andsensitive personal information is highlighted in bold and italic font, and you should pay special attention to it. Before you provide any sensitive personal information to us, you should have carefully considered and confirmed that such provision is appropriate, and you agree that your sensitive personal information may be processed for the purposes and in the manner specified in this Privacy Policy.
2. You may exercise your rights to your personal information by ways including but not limited to accessing, correcting, or deleting your personal information, withdrawing consent, rejecting targeted push notifications, and receiving timely response, to ensure your exercise of control over personal information.
3. We will process your personal information in strict accordance with this Privacy Policy and your consent.

This Privacy Policy will help you understand the following:

1. How We Collect and Use Your Personal Information
2. Use of Cookies and Similar Technologies
3. How We Protect and Store Your Personal Information
4. How We Share, Transfer, and Disclose Your Personal Information
5. How toManage Your Personal Information
6. Privacy Policies of Other Websites
7. Protection of Personal Information of Minors
8. Updates to the Privacy Policy
9. Contact Methods
10. Supplementary Provisions
11. Definitions of Key Terms

1.How We Collect and Use Your Personal Information

We will collect and use your personal information that you voluntarily provide to us during the use of our services, or that is generated due to your use of our services, or that we obtain from third parties for the purposes set forth herein according to the principles of legality, legitimacy, necessity, and transparency. Normally, we will obtain your consent before collecting and using your personal information in any manner whatsoever, unless under the circumstances specified by law, for example, we may collect your personal information without your consent for the purpose of fulfilling our legal obligations or responsibilities, or concluding and performing a contract to which you are a party, or protecting the significant interests of you or others.

Please understand that, with the changes in business strategies, the features of our services may change and develop. If we intend to use your personal information for purposes not described in this Privacy Policy or use the personal information we collected for a particular purpose for other purposes, we will notify you in a reasonable manner and obtain your consent in advance.

1.1 Personal information you voluntarily provide to us when we provide services to you

To provide our services to you, we need to collect your personal information. The following provides the features of our services and the personal information we need to collect in order to implement the features: Please note that if the personal information you provide is not your personal information, you should ensure that you have obtained the consent of the information subject.

If you want to learn about our services and capabilities, make investments in or business cooperation with us, communicate with us about environmental, social, and governance (ESG) issues, or file a compliance report or complaint with us, you need to provide us with your First Name，Last Name，E-mail，Company，Job title (optional)，Country/Region，Message, and fill in the relevant information (the aforesaid items are set in a form), so that we can use such information to learn about your identity and the content of your inquiry, and contact you when necessary.

• 1.2 Information subscription

To receive the information that you may be interested in and the subscription service, you need to provide us with your email address so that we may send the information to you according to your contact information. If you do not provide the above information, you will not be able to timely receive the information to which you have subscribed, including details of the services and other content.

In addition, we will not use your sensitive personal information for a purpose other than the purpose for which it was originally collected, or subsequently authorized by you, without first receiving your affirmative and explicit consent (opt-in).

1.2 Personal information that we collect when providing services to you

Subject to compliance with laws and regulations, to ensure the security of your account and provide better services to you, we may collect and use the following information generated during your use of services of the Website.

• 2.1 Improvement of services

To improve and optimize relevant features of our services, we may aggregate the data about visitors to our Website for the purposes of product and service development and improvement activities, and we may also collect relevant web log information, including the length of your visit to the Website, system activity information, browsing history, and IP address. We collect this information to develop new services, strengthen and improve our services, conduct management, communications, analysis, statistics, and review, and protect, enhance and safeguard our rights and interests and other internal functions. If you do not provide such information, it will not affect your normal browsing and use of the Website.

• 2.2 Marketing

We may use the information we obtain about you to conduct targeted marketing, and to make our Website more personalized based on your preferences.

1.3 Other legal basis other than consent

In accordance with applicable laws and regulations, we may process your personal information without your consent under the following circumstances:

• 3.1 It is necessary for concluding and performing a contract to which you are a party.
• 3.2 It is necessary for the performance of legal responsibilities or obligations.
• 3.3 It is necessary for responding to a public health emergency, or for protecting the life, health, or property safety of a natural person in the case of emergency.
• 3.4 The personal information is processed within a reasonable scope to carry out any news reporting, supervision by public opinions, or any other activity for the purpose of public interests.
• 3.5 The personal information that is voluntarily disclosed by you or otherwise legally disclosed is processed within a reasonable scope in accordance with applicable law.
• 3.6 Other circumstances provided by laws and administrative regulations.

2.Use of Cookies and Similar Technologies

2.1 Cookies

Cookies are text files placed on your computer to collect standard Internet log information and visitor behavior information. When you visit our Website, we may collect information from you automatically through cookies or similar technologies, including third party cookies and other tracking techniques. If you choose to use certain services, you will be prompted to accept or deny the use of relevant cookies.

(I) How do we use cookies?

We use cookies to improve your experience on our Website, including:

• understanding how you use our Website;
• enabling you to voluntarily complete customer questionnaires or provide feedback under customer support services on any of our message boards or by email;
• implementing certain features of the services; and
• tracking web pages visited and time spent on web pages.
• We may use different types of cookies to run the services and thus we may use both session and persistent cookies on the services.
• We may use persistent or session (essential) cookies.
• We may use the information obtained from cookies to customize and improve your experience using the services and to make your next visit easier and more useful.

(II) How to manage cookies?

We do not use cookies for purposes other than those described in this Privacy Policy. You can set your browser not to accept cookies or delete cached data that has been stored locally through tracking techniques by clearing the cache in your browser.

The Help feature of the toolbar on most browsers will tell you how to prevent your browser from accepting new cookies, how to notify you when you receive a new cookie, or how to disable most types of cookies. Please note and understand that if you refuse to use tracking techniques, you may need to personally change the relevant user settings each time you visit the Website, and we may not be able to provide you with a better user experience, and some services may not function properly.

2.2 No-tracking technique

Our Website does not respond to “Do Not Track” signals, but does not track your online activities after you are redirected to a third-party website. We do not allow third parties to track your online activities after you are redirected to our Website.

For more information about the use of cookies, please refer to the Cookie Policy posted on the Website. Please note that we have no access or control over cookies or other techniques that third parties may use to collect information about your interests and preferences, and the information policies of these third parties are not subject to this Policy. You should pay special attention to their personal information protection policies (including but not limited to their privacy policy).

3.How We Protect Your Personal Information

We attach great importance to the security of your personal information. For this reason, we have implemented appropriate technical security measures that meet the industry standards and the supporting organizational structure and management system to protect, to the maximum extent possible, your personal information against leakage, destruction, misuse, or unauthorized access, disclosure, or alteration.

3.1 Protection of your personal information

We are committed to protecting all data that we collect from you. We have designed and implemented appropriate security measures to protect your data against unauthorized access, alteration, disclosure, or destruction. We maintain physical, electronic, and management procedures designed to protect the information and data stored in our system.

We use security measures that comply with the industry standards, including establishing reasonable rules and regulations and using security technologies, to protect your personal information against unauthorized access, use, alteration, destruction, or loss. We use automated code scanning and data access log analysis technology to perform data security audits. Other security measures for protecting personal data include but are not limited to the following:

• We have established a data classification and grading system, data security management specifications, and data security development specifications to manage and standardize the storage and use of personal data.
• We have established an information security committee which has a personal information protection department and a data security emergency response organization, to promote and ensure the security of personal data.
• We implement comprehensive control over data security through data contracts, non-disclosure agreements, and monitoring and review mechanisms.

Despite of the aforesaid security measures, please understand that the Internet environment is not absolutely secure, and there are no “perfect security measures” for the network. We will provide relevant security measures and reasonable security safeguards based on the existing technical conditions, and strive to fulfill the duty of due care to protect your personal information.

We recommend that you use secure channels to communicate with us, and use complex usernames and passwords when communicating with us through a web-based instant messenger, social software, or email, to protect your personal information.

3.2 Storage of personal information

The personal information collected and generated during the operation of the Website will mainly be stored within the territory of the People’s Republic of China. However, due to the cross-border business operation, your personal information may be provided to our overseas offices or our other office locations and authorized agents as well as the third parties that comply with local laws. If the recipient of your personal information is located in another country or region, we will separately seek your consent to the cross-border transfer of your personal information. These overseas jurisdictions may have different data protection laws and even have no applicable data protection laws. In such cases, we will ensure that all your personal information will be adequately and equally protected as it is protected within the territory of the People’s Republic of China.

Your personal information we collect when you use the Website and/or services or when you provide products and/or services to us will be transferred to our company in China. In such cases, we will ensure that your personal information will be adequately protected within the territory of the People’s Republic of China.

We undertake to store your personal information for the shortest period of time necessary to achieve the purposes authorized by you, unless a longer retention period is required by you, or required by law or the competent authority, or required to assist the competent authority with the inquiry, or under other special circumstances. We will delete or anonymize your personal information upon expiration of the aforesaid retention period. However, the previously collected information may still need to be retained according to regulatory requirements or mandatory administrative or judicial proceedings and used in accordance with the law during such retention period.

If we cease the operation of the Website due to business needs or other reasons, we will inform you of our decision, cease to process your personal information, and delete or anonymize your personal information collected, unless otherwise provided by applicable laws and regulations or normative documents.

4.How We Share, Transfer, and Disclose Your Personal Information

4.1 Delegated processing

We use third party agents to help us achieve the purposes described in this Policy, including providing analysis services, performing technical operations, and storing and transferring data. Normally, we will not provide your personal identity information. If it is necessary to provide your personal information, we will encrypt or de-identify the information, to ensure the security of your personal information. We will also ensure that the third parties that are delegated to process your personal information have the same obligation to protect your personal information, to maintain your trust in us.

4.2 Sharing

To provide more complete and better services to you, some of our services (“recruitment”) will be provided by our authorized partners. We may share some of your personal information with our partners to provide better customer service and user experience. We will share your personal information only for lawful, legitimate, necessary, specific, and explicit purposes and only to the extent necessary to provide the services.

We will conduct strict security monitoring on how our partners obtain your information, to ensure the security of your personal information. In addition, we will enter into a non-disclosure agreement with our partners, and require them to establish and implement confidentiality and security measures for personal information that are not less stringent than the requirements in this Policy in accordance with applicable national laws, regulations, and standards. We will require our partners not to use the shared personal information for any other purposes. If they change the purpose of handling of personal information, they will solicit your authorization or consent again.

You should be fully aware that under the following circumstances, we may decide, in our sole discretion, to share your personal information with others without your (further) authorization or consent. However, we will fulfill our obligation to reasonably protect your personal information to the extent under our control.

• (1) The sharing is at your request, or we have obtained your explicit authorization or consent in advance.
• (2) It is related to our fulfillment of obligations specified by laws and regulations.
• (3) It is directly related to national security or national defense security.
• (4) It is directly related to public security, public health, or major public interests.
• (5) It is directly related to criminal investigation, prosecution, judgment, or enforcement.
• (6) It is necessary for protecting the life, property, and other major legitimate rights and interests of you or any other individuals, while it is difficult to obtain your prior consent.
• (7) The personal information shared is voluntarily disclosed by you to the public.
• (8) The shared personal information is collected from the legally publicly disclosed information, such as news reports, government information disclosure, and other channels.
• (9) Other circumstances provided by laws and regulations.

If we share your personal information with our partners under circumstances other than those set forth above, we will notify you in advance and you have the right to reject such sharing.

We recommend that you carefully read and comply with the respective user agreements and privacy policies of our partners, to learn about the purpose for which they obtain such information. If you refuse our partners’ collection of personal information necessary for them to provide services to you, you may not be able to use the services provided by the partners in our services.

We may share your personal information with our affiliates. However, we will share your personal information only to the extent necessary to achieve the purposes specified in this Policy. If our affiliates intend to change the purpose of processing of personal information, they will seek your consent again.

Please note that, with the updates and upgrades of our services, you may voluntarily disclose or share your relevant information to or with third-party platforms (such as WeChat, Linkedin, QQ, Twitter, and YouTube). In such case, the shared information will be immediately and widely transmitted. Once you share such information, it is difficult to ensure that the shared information can be fully deleted, at your request, from all Internet platforms where your information has been forwarded. In some cases, even if you have deleted the information you shared from our services, such information may still remain in the public domain, and may still be cached, copied, or stored independently by other users or unrelated third parties not under our control, or stored in the public domain by other users or such third parties.

For more information about third-party plug-ins used by our products and/or services, please see Annex 2 List of Personal Information Processing by Third-Party Plug-ins.

4.3 Transfer

In principle, we will not transfer your personal information to any company, organization, or individual. In the event of a merger, acquisition, transfer of assets, or similar transaction where personal information transfer is involved, we will inform you of the name and contact information of the recipient and require that the new company or organization holding your personal information be bound by this Privacy Policy to continue to perform the obligations of the personal information processor. In case of any change in the method of processing of personal information described in this Privacy Policy, we will require them to seek your authorization or consent again in accordance with laws.

4.4 Public disclosure

In principle, we will not disclose your personal information we process, unless with your separate consent. We have known the legal liability for sharing, transferring, or disclosing your personal information.

5.How to Manage Your Personal Information

We attach great importance to your attention to your personal information and try our best to protect your rights to access, copy, transfer, correct, supplement, and delete your personal information and to change the scope of your authorization or withdraw your authorization. In addition, we strive to establish a mechanism that allows you to exercise your rights conveniently. Your rights include:

5.1 Right to access, copy, and transfer your personal information

You have the right to obtain a copy of your personal information. If you want to obtain a copy of your personal information collected by us, you may contact us through the contact details described in Section 9 of this Privacy Policy. Subject to applicable laws and where technically feasible, we will provide you with a copy of your personal information at your request.

5.2 Right to correct and supplement your personal information

You have the right to access or correct your personal information at any time. If you request access to or correction of your personal information, you may contact us through the contact details described in Section 9 of this Privacy Policy. We will promptly respond to your request after verifying your identity, unless otherwise provided by laws and regulations or agreed in this Privacy Policy.

5.3 Right to delete your personal information

We will delete your personal information under any of the following circumstances. You may delete, or request us to delete, your personal information at any time. If we do not delete your personal information, you have the right to request deletion of the information:

• (1) The purpose of processing has been achieved or cannot be achieved or your personal information is no longer necessary to achieve the purpose of processing.
• (2) We cease to provide products or services or the retention period has expired.
• (3) You withdraw your consent.
• (4) Our processing of personal information violates any law, administrative regulation, or the agreement between the parties.
• (5) Other circumstances provided by laws and administrative regulations.

If you request deletion of your personal information, you may contact us through the contact details described in Section 9 of this Privacy Policy. We will promptly respond to your request after verifying your identity, unless otherwise provided by laws and regulations or agreed in this Privacy Policy.

If we decide to respond to your request for deletion, we will also notify the entities who obtained your personal information from us to promptly delete your personal information, unless otherwise provide by laws and regulations, or unless these entities have obtained your separate authorization. You acknowledge and agree that, if we respond to your request for deletion, we may not immediately delete the relevant information from our backup system, but we will delete such information when updating our backup system.

In addition, you may choose whether to receive information emails from us. You may unsubscribe from emails by clicking the Unsubscribe link at the bottom of any email from us. Please note that even if you choose to Unsubscribe, we may still send you other notices related to the updates or security warnings of our terms of service or this Policy or related to your access to or use of our products and/or services, and other non-marketing information.

5.4 Response to your requests

To achieve the above rights of you, or if you believe that we have violated any law or regulation or any agreement with you about the collection or use of personal information, you may contact us at [info@chimebiologics.com]. To ensure security, we may require you to provide a written request or provide your identity document, and we will reply your request within 15 days after receiving your request and verify your identity. We do not charge for your reasonable requests in principle, but we will charge a certain cost as appropriate for repeated requests that exceed a reasonable limit. We may reject those requests that are repeated for no reason, require excessive technical means (for example, requiring the development of a new system or a fundamental change of the current practice), pose risks to the legitimate rights and interests of others, or are very unrealistic (e.g., involving the backup of information stored on tapes).

Please understand that, subject to applicable laws and regulations, we may not be able to respond to your requests under the following circumstances.

• (1) It is related to the performance by us as a personal information controller of the obligations specified by laws and regulations.
• (2) It is related to national security and national defense security.
• (3) It is related to public safety, public health, or major public interests.
• (4) It is related to criminal investigation, prosecution, judgment, or enforcement.
• (5) There is sufficient evidence to prove your subjective malice or abuse of rights.
• (6) It is necessary to protect life, property, and other major legitimate rights and interests of you or any other individuals, while it is difficult to obtain your prior consent.
• (7) Response to your request will cause serious damage to the legitimate rights and interests of you or other individuals and organizations.
• (8) It involves trade secrets.

6.Privacy Policies of Other Websites

Please note that our Website contains links to other websites. This Privacy Policy only applies to our Website. If you click a link to another website, we remind you that you should read the privacy policy, terms of use, and other relevant policies of the third-party website, to ensure the security of your privacy.

7.Protection of Personal Information of Minors

Please understand that our Website does not provide services to minors, but we always attach great importance to the protection of personal information of minors. We will not collect the personal information of minors under the age of 14 without authorization. Although definitions of children vary with local laws and customs, we consider minors under the age of 14 as children. If we become aware that a child under the age of 14 sends his/her personal information to us without the explicit consent of his/her parent or other guardian, we will delete such information as soon as possible within a reasonable period of time, unless otherwise provided by applicable laws, regulations, or regulatory requirements.

8.Updates to the Privacy Policy

To provide better services to you and meet our business development requirements, we reserve the right to update or modify this Privacy Policy from time to time. We will post any amendments to this Privacy Policy on the Website. However, we will not reduce the rights available to you under this Privacy Policy or increase your obligations without your explicit consent. We will post the updated version of this Privacy Policy on our Website and inform you of such update by posting an announcement on the Website or in any other appropriate manner before the updated version becomes effective. Please read the updated version to keep abreast of the latest Privacy Policy.

To ensure that you can receive notices in a timely manner, we recommend that you promptly notify us of any change in your contact information. You should carefully read the amended Privacy Policy. If your do not agree to this Privacy Policy or have any doubts about the amendments or updates to this Privacy Policy, you may cease to use our services. Please note that the behaviors and activities that you conduct before you cease to use our services are still governed by this Privacy Policy. Your continued use of our services following the posting of any updates to this Privacy Policy will mean that you have fully read, understood, accepted, and agreed to be bound by the updated Privacy Policy. We encourage you to review this Privacy Policy each time you use our services.

We will review this Privacy Policy periodically and post any updates on the Website. In case of any significant or material changes, we will, based on the actual situation, notify you in a conspicuous manner or by sending you a private message, email, SMS, or otherwise.

Significant or material changes include but are not limited to the following:

• (1) Significant changes in our service models, such as changes to the purpose of processing of personal information, the type of personal information processed, and the way we use personal information;
• (2) Significant changes in our ownership structure or organizational structure, such as change of owners caused by business adjustment, bankruptcy, mergers, and acquisitions;
• (3) Changes of the main parties with whom personal information is shared or to whom personal information is transferred or disclosed;
• (4) Major changes in your rights to participate in the processing of personal information and the way you exercise such rights;
• (5) Changes of the department responsible for ensuring personal information security, its contact information, or complaint channels; and
• (6) Existence of high risk indicated in a personal data security impact assessment report.

All rights not explicitly granted in this Privacy Policy are reserved by Chime Biologics.

9.Contact Methods

If you have any questions about this Privacy Policy or have any request for your rights as a personal information subject, please contact us at [info@chimebiologics.com]. If you want to file a complaint or report or have any questions, comments, or suggestions on the Website, please contact us at [info@chimebiologics.com].

We will verify your identity and respond as soon as possible within 15 days after receiving your comments and suggestions. If we cannot respond to your request, we will send you a notice, explaining the reasons, within the maximum time limit required by law. If you are dissatisfied with our reply, especially when you believe that our processing of personal information has damaged your legitimate rights and interests, you may also file a complaint or report with the regulatory authorities such as the cyberspace administration, telecommunications, public security, and industrial and commercial administrative authorities.

10.Supplementary Provisions

The interpretation of this Privacy Policy and the dispute resolution hereunder shall be governed by the laws of the People’s Republic of China.

The headings used herein are inserted for convenience only and are not intended to affect the meaning or interpretation of any term of this Privacy Policy.

11.Definitions of Key Terms

11.1 “Products and/or services” means the functions and/or services provided by Chime Biologics through the Website (https://www.chimebiologics.com/), such as web browsing, subscription consultation, and recruitment.

11.2 “User” or “you” means the user who accesses and uses the services of Chime Biologics.

11.3 “Personal information” means any information related to an identified or identifiable natural person as electronically or otherwise recorded, excluding information that has been anonymized. Personal information includes basic personal information, personal identity information, personal biometric information, online identification information, personal health and physiological information, personal education and work information, personal property information, personal communication information, contact information, personal Internet records, personal commonly used device information, and personal location information.

11.4 “Sensitive personal information” means the personal information that, once leaked or illegally used, will easily lead to infringement of the human dignity or harm to the personal or property safety of a natural person, including biometric recognition, religious belief, specific identity, medical treatment and health, financial account, personal whereabouts, and other information of a natural person, as well as any personal information of a minor under the age of 14.

11.5 “De-identification” means the process of processing the personal information to make it impossible to identify specific natural persons without the help of additional information.

11.6 “Anonymization” means the process of processing personal information to make it impossible to identify specific natural persons and impossible to restore.

11.7 “Chinese mainland” or “Territory of the Chinese mainland” means the mainland of the People’s Republic of China (excluding Hong Kong Special Administrative Region, Macao Special Administrative Region, and Taiwan).