You care about the protection of your Personal Data – and so do we. At Invivyd, we work to maintain the privacy and data security of all Personal Information we collect or receive from you, including when you use an Invivyd website.

In this Privacy Notice, Invivyd, Inc. and its subsidiaries (“Invivyd”) describes our general practices regarding how we collect, use, and disclose Personal Data of patients, caregivers, and healthcare professionals — as well as other individuals with whom we interact, for example, research study participants, researchers, visitors to our online services, job applicants, service providers, business partners, and investors. Personal Data does not include, and this Privacy Notice does not apply to, aggregate information or information that has been de-identified or anonymized in accordance with applicable law. This notice also does not apply to workforce personal data. Should you have any questions about this Statement or how we handle Personal Information, please contact us at privacy@invivyd.com.

Please read this Privacy Notice carefully to understand how we collect, use, and share your Personal Data. Your use of the Site is also subject to our Terms of Use. Where applicable law requires a specific legal basis for our processing of your Personal Data, those legal bases are identified in the “Why We Process Your Personal Data” section below.

For Washington and Nevada residents, please visit our Consumer Health Data Privacy Statement for information about our practices in handling consumer health data as defined under applicable laws.

California, Connecticut, Nebraska, and Texas Residents: This Privacy Policy describes how we collect, use, disclose, and retain your personal information. Please see the section Additional Terms Applicable to California, Texas, Connecticut, and Nebraska Residents Only below for additional terms that may apply to you.

In this Privacy Notice, you’ll learn about the following:

• What is Personal Information/Data?
• The Types of Personal Data We May Process
• How Invivyd Collects Personal Data
• Why We Process Your Data
• How We Share Your Personal Data
• Cookies and Other Tracking Technologies
• Data Analytics
• Interest-based Advertising
• Your Rights and Choices
• Data Security and Retention
• Consent to Processing in the United States and Elsewhere
• Third-Party Resources
• Children’s Privacy
• Changes to this Notice
• How to Contact Us
• Additional Terms Applicable to California, Texas, Connecticut, and Nebraska Residents Only

What is Personal Information/Data?

Personal Information (which we also refer to as Personal Data), is information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked to an identified or identifiable individual. This is information we obtain when you access and interact with our websites and other applications, including mobile applications (collectively “Site”), that directly link to this statement. Invivyd respects the privacy of visitors to the Site, and we recognize the need for appropriate protection and management of the Personal Data you share with us. It is Invivyd’s commitment that Personal Data collected will be used only for the limited purposes described in this Privacy Notice. Invivyd respects the personal and private nature of this information, and we are committed to appropriately protecting the Personal Data that we collect and using it in compliance with applicable privacy laws and regulations as well as Invivyd corporate policies and procedures. This Privacy Notice also answers certain specific questions that you may have regarding privacy and security of Personal Data. This Notice is intended to comply with applicable United States privacy and data protection laws, including state consumer privacy statutes.

The Types of Personal Data We May Process

This Notice defines and provides examples of Personal Data that we may collect and also explains our practices regarding that Personal Data. Personal Data is any information that can be used to identify, locate, or contact you. Examples of types of Personal Data that we may collect include the following:

• Contact Data, which includes information such as your name, email address, mailing address, zip code, phone numbers, country or social media handle.
• Relationship Data, including information about products, treatments, and health conditions that are of interest to you.
• Transaction Data, including program participation, purchases, inquiries, and information about how you use websites and mobile applications.
• Geo-location Data, such as information about your physical location collected from geolocation features on your device, may be transmitted to us by your smartphone or other location-aware devices. Note that precise geolocation is a category of sensitive personal data under several state laws and is subject to additional protections described in this Notice.
• Internet/Network Information, such as your IP address (a unique identifier that devices use to identify and communicate with each other on the Internet), browsing history, browser type, device information, search history, and information regarding a consumer’s interaction with an internet website, application, or advertisement.
• Job Applicant Data, such as your Contact Data, resume, previous work experience, education, transcript, driver’s license information, Social Security number or national identification number and information relating to references.
• Sensory Data, such as recordings of customer service calls or patient testimonial videos submitted through the Website. Please note that voice recordings may constitute biometric data under certain state laws (e.g., Illinois BIPA, Texas, Washington). We process such data only to the extent permitted by applicable law and subject to any required consent.
• Health and safety information, including adverse events and product complaint data, where required by law.
• Protected Classification/Characteristic Data, such as age, gender, and disability information, and/or
• Statistical Data, to monitor utilization of the Site and continuously improve its quality, we may compile statistical information concerning the usage of the Site using analytics services. Examples of this information include: the number of visitors to the Site or to sections or pages within the Site, patterns of traffic flowing through the Site, length of time spent on the Site or in sections or pages of the Site, the other sites that refer visitors to the Site, the pages of the Site that visitors frequently use as entry and exit points, utilization of the browser and operating systems and versions used by visitors to the Site, methods used to browse away from the page, any phone number used to call our customer service number, and location information.

We do not use or disclose sensitive personal data for purposes other than those permitted under applicable local law.

Additional Personal Data that Invivyd may Collect about Healthcare Professionals

If you are a healthcare professional, we may collect Personal Data about you directly from you, from third-party sources such as the organization where you work, publicly available sources, interactions with Invivyd (including online available sources), participation in Invivyd-sponsored or Invivyd-supported initiatives such as clinical research and development activities, third-party databases, or reporters of pharmacovigilance events.

We may collect the following additional categories of Personal Data about health care professionals:

• Professional details, such as resumes or other documents or forms provided directly to us, place of practice, job title, professional contact details, medical specialty, professional license number, professional qualifications and scientific activities (such as previous clinical trial experience, activity on social media platforms or other websites, and participation in past or pending research studies with us and other companies), organizational or institutional affiliations, publication of academic or scientific research and articles, and membership in associations and boards;
• Personal Data, such as that provided to participate in our sponsored or supported initiatives, such as our sponsored clinical research and development activities, online or in-person seminars regarding product information, educational events, and clinical information updates;
• Details of interactions with us, such as what kind of meetings we have held, topics discussed, your knowledge of and questions you have had about our business and products, what kind of material we have displayed to you, and any feedback that you have provided, as well as your opinions of and routines for prescribing, routines regarding your patients, diagnoses, and automatic tracking information in online interactions with us; and/or
• Payment and other transfers of value details received from your interactions with Invivyd, which may include your tax identification number or national identification number (where required or permitted by law), contributions to costs of educational events (such as registrations fees, travel and accommodation expenses) and fees for services, including consultancy services.

How Invivyd Collects Personal Data

Invivyd may collect Personal Data from a variety of sources, including directly from you when you voluntarily provide it to us or when such information is requested in the course of your interactions with us. We also obtain your Personal Data from our business partners and affiliates, third parties you direct to share information with us, your browser or device, information generated from your online browsing and usage activity, or from public third-party sources.

We may also obtain Personal Data about healthcare professionals from third party sources. This information is used to verify such things as professional status, state license information, identity and specialty when providing tailored information, communications or products and/or services to healthcare professionals.

When you use our website or online services, we may use cookies and similar technologies to collect information about your device and how you use our site and applications. If you use an Invivyd mobile app, the app will explain what information it collects and what may be shared with Invivyd. We treat this information as Personal Data only when it, or other data that is associated with it, can be used to identify you. For more details, please see the “Cookies and Other Data Collection Technologies” section below.

Personal Data That We Collect from Third Parties

We may obtain Personal Data relating to you from third parties, such as when we obtain contact data from marketing list suppliers to support our marketing and sales initiatives or when we obtain professional license information to confirm information provided by healthcare providers.

The third parties from whom we obtain Personal Data generally fall within the following categories:

• Government sources
• Publicly accessible data
• Social media companies
• Marketing list suppliers
• Advertising and Marketing partners
• Analytics providers
• Payment processors
• Data supplementation suppliers
• Job Application Processing and/or Employment Vendors
• Business partners, such as event co-sponsors

Why We Process Your Data

We process Personal Data for the business and commercial purposes described in the bullet points below. The laws of certain jurisdictions require that we have a “legal basis” for our processing of Personal Data; where those laws apply, we have identified our legal bases in the first-line bullet points, and those legal bases apply only for those jurisdictions.

• As necessary for our legitimate interests in:
  • Operating and overseeing our business, for example, supporting quality and safety, enabling ethical and compliant business operations, conducting audits and investigations, managing your accounts, providing our products and services, improving and developing new products and services, researching market trends, monitoring service providers, analyzing potential talent, and otherwise administering our business (e.g., providing key functions like human resources, finance, accounting, IT, security, legal, and compliance). For these purposes, we may use any of the types of Personal Data described above, for example, identifiers and contact information, certain health and medical information, education information, and video and audio information (as part of monitoring our compliance with applicable laws and internet or other electronic network activity information to monitor online safety).
  • Understanding customer and stakeholder opinions, for example, identifying business opportunities and gathering and analyzing stakeholder needs, preferences, sentiments, and opinions on Invivyd, its products, and indications. For these purposes, we may use identifiers and contact information and opinions or statements.
  • Communicating with you, for example, responding to your inquiries (including unsolicited requests for information about our indications or scientific information), providing you with information we think may interest you, contacting you for your input, and maintaining records of our interactions with you. For these purposes, we may use any of the types of Personal Data described above, for example, identifiers and contact information.
  • Promoting our business and research, for example, carrying out marketing and sales activities, measuring the effectiveness of our promotional campaigns, and targeting advertisements on third-party services. For these purposes, we may use any of the types of Personal Data described above, for example, identifiers and contact information, professional or employment-related information, inferences, demographic information, and internet or other electronic network activity information.
  • Personalizing our interactions with you, for example, understanding your professional and personal interests and adapting our services to your needs and preferences. For these purposes, we may use any of the types of Personal Data described above, for example, identifiers and contact information, professional or employment-related information, inferences, demographic information, and internet or other electronic network activity information.
  • Protecting rights and interests, for example, protecting the health, safety, and security of Invivyd, its employees, patients, caregivers, HCPs, and the general public; enforcing our legal rights; and pursuing remedies or otherwise taking steps to limit damages and liabilities. For these purposes, we may use any of the types of Personal Data described above, for example, identifiers and contact information to investigate violations of our contracts or health and medical information in the event of an emergency.
  • Identifying potential talent, for example, reviewing information to identify candidates for our talent pipeline via online or public sources. For these purposes, we may use any of the types of Personal Data described above, for example, identifiers and contact information, professional or employment-related information, education information, and demographic information.
• Pursuant to a contract or pre-entering a contract, for example, negotiating contracts in advance of entering into one and honoring our contractual commitments, such as:
  • Engaging you to provide services on our behalf or as a business partner, for example, engaging with services providers that provide market research services or working with research collaborators. For these purposes, we may use any of the types of Personal Data described above, for example, identifiers and contact information and financial information.
  • Delivering our products or services to you, billing for them, and providing patient support services, for example, supporting you, assisting you with claims and authorizations, and connecting you with other resources or organizations. For these purposes, we may use any of the types of Personal Data described above, for example, identifiers and contact information, health and medical information, and mental and physical characteristics.
  • Providing grants, sponsorships, and other opportunities, for example, offering our access to medicines programs and sponsoring and participating in research, events, and conferences. For these purposes, we may use any of the types of Personal Data described above, for example, identifiers and contact information, health and medical information, mental and physical characteristics, professional or employment-related information, education information, and demographic information.
• With your consent, or if you are a Minor (defined in the “Children’s Privacy” section below), with your or your parent’s or legal guardian’s consent, in order to:
  • Send promotional materials, for example, if you are a patient who enrolls in one of our patient support programs and you have consented to promotional communications. For these purposes, we may use any of the types of Personal Data described above, for example, identifiers and contact information.
  • Evaluate job candidates, for example, reviewing your job applications, talking to references, and reviewing information to identify candidates for our talent pipeline. For these purposes, we may use any of the types of Personal Data described above, for example, identifiers and contact information, professional or employment-related information, education information, and demographic information, medical certificate as required by local applicable employment law.
  • Share your story with others, for example, when we share patient stories to help our employees and others better understand our patients and their journeys. For these purposes, we may use any of the types of Personal Data described above, for example, identifiers and contact information and audio and visual information.
  • Collect information from or about you, for example, when we are legally required to obtain your consent before collecting certain Personal Data (e.g., sensitive information, such as health and medical information and mental and physical characteristics) about you.

As required by law, for example, by:

• Monitoring pharmacovigilance and product safety, quality, and complaints, for ensuring high standards of quality and safety of health care and of medicinal products, for example, providing infrastructure to intake adverse event reports and complaints, maintaining records of such events and complaints, appropriately responding to reports and complaints, and providing appropriate information to regulators. For these purposes, we may use any of the types of Personal Data described above, for example, identifiers and contact information, health and medical information, and mental and physical characteristics.
• Complying with transparency requirements, for example, monitoring payments and other transfers of value. For these purposes, we may use any of the types of Personal Data described above, for example, identifiers and contact information, professional or employment-related information, and financial information.
• Monitoring fraud and abuse, for example, investigating potential claims of fraud and abuse. For these purposes, we may use any of the types of Personal Data described above, for example, financial information.
• Responding to legal process, for example, complying with legal requests from administrative or judicial authorities and complying with subpoenas. For these purposes, we may use any of the types of Personal Data described above, for example, identifiers and contact information, professional or employment-related information, and financial information.

Due to the nature of our business, Invivyd is subject to a number of legal requirements. As a result, Invivyd may be required to process Personal Data, for example, sensitive Personal Data (including health and medical information and mental and physical characteristics), in order to meet these obligations. We will process your Personal Data in accordance with our legal obligations and in a way that protects your privacy to the extent possible, for example, pseudonymizing information, while still complying with our legal obligations.

Invivyd may collect, use, share, transfer and otherwise process de-identified and aggregated information that it receives or creates for any purposes in its sole discretion, in compliance with applicable laws. Deidentified or aggregated information describes users as a group but does not reveal the identity of individual users. We will not attempt to re-identify aggregated or deidentified information. We may use de-identified or aggregate information to understand users’ needs, to determine user demographics and Website usage patterns, to determine what kinds of products or services we can provide, and to improve and enrich our products and services and the Website. Invivyd will maintain and use de-identified information only in de-identified form and will not attempt to re-identify it, consistent with applicable law.

Please refer to our Consumer Health Data Privacy Statement for additional information on the processing of Consumer Health Data as required by US state laws.

Additional Uses and Disclosures of Healthcare Professional Personal Data

Invivyd may use and disclose Personal Data of healthcare professionals for the following additional purposes.

• For the performance of our contract with you if you or your institution entered into a consulting, professional services, or other type of agreement with Invivyd.
• Based on our legal obligations and for reasons of public interest, we will use and disclose Personal Data about health care professionals for:
  • Safety monitoring, reporting and auditing and responding to inquiries or issues in relation to our products.
  • Complying with applicable laws and regulations, including requirements imposed by industry codes of conduct to collect payment and other transfer of value data of health care professionals and the public disclosure of such data, subject to applicable local consent requirements to publish such data in a manner that identifies the health care professional individually.
• Based on our legitimate interests in developing and improving our services, we will use and disclose Personal Data about health care professionals for:
  • Managing and improving our relationship with you, including planning, organizing and reviewing any collaboration with you and for contacting you.
  • Striving to ensure that we provide you with information that is relevant based on your expertise, interests and preferences.
  • Recruitment and evaluation of the suitability of healthcare professionals for their participation in clinical trials and market research and other research studies.
  • Conducting market and research studies in the public and private sectors.
  • Communicating with you about our products and programs (subject to any additional marketing consent requirements), engage with you about scientific or educational programs, administer our patient-support programs and provide access to you where applicable, respond to product orders, and provide product samples.
  • Research and analytics purposes to develop and evaluate our products, services, materials and treatment, and/or:
  • Internal accounting and analysis in connection with our internal policies and rules, such as our Invivyd Code of Business Ethics and Conduct.

How We Share Your Personal Data

Invivyd does not sell, share, or otherwise distribute your Personal Data to third parties for their marketing purposes. Invivyd will share your Personal Data with third parties only in compliance with applicable laws and regulations. For example, we may share your Personal Data as follows:

• We may share your Personal Data with your consent or as you direct. For example, we may share data with your doctor as part of programs in which you agree to participate.
• We may share your Personal Data with our affiliated companies which may only use your Personal Data for the purposes listed herein.
• We may share your Personal Data with our service providers who act on our behalf and are bound by law or contract to protect your Personal Data and only use your Personal Data in accordance with our instructions. For example, we may share your Personal Data with vendors who provide data processing or fulfillment services for us such as services delivery, evaluating the usefulness of this website, advertising and marketing, data management or technical support.
• We may disclose your Personal Data where needed to affect the sale or transfer of business assets, to investigate legal issues, enforce our rights, protect our property, or protect the rights, property or safety of others, or as needed to support external auditing, compliance and corporate governance functions.
• We may also disclose your Personal Data when requested or required to do so by applicable law, court order or governmental regulation, or if such disclosure is otherwise necessary in support of any criminal or other legal investigation or proceeding in the United States and other countries where we operate.
• Please note that we may also disclose data about you that is not personally identifiable. For example, we may publish reports that contain aggregate and statistical data about our customers. These reports do not contain any data that would enable the recipient to contact, locate, or identify you.
• We may also disclose your Personal Data to try to protect you against, and to prevent, fraud, illegal activity (such as identifying and responding to incidents of hacking or misuse of our websites and mobile applications) and claims and other liabilities.

Cookies and Other Tracking Technologies

When you visit our website or use our mobile applications, we may collect certain data by automated means, using technologies such as cookies that we may place on your computer when you visit our website, pixel tags, browser analysis tools, server logs, and web beacons. We may collect data about the device you use to access our website, the pages you visit on our website, the length of time you spend on pages on our site, your operating system, and platform type, browser type and version, domain, and other system settings, as well as the language your system uses and the country and time zone where your device is located and the date and time you visit our sites, and the pages you visit. Our server logs also record the IP address of the device you use. We may collect information about the websites you visit before and after accessing our website.

Cookies are small pieces of data that websites send to your computer or other Internet-connected device to uniquely identify your browser or to store information in your browser. Cookies allow us to recognize you when you return. They also help us provide a customized experience and enable us to detect certain kinds of fraud. Note that while standard cookies have limited access to your device, other tracking technologies described in this Notice — such as pixel tags, local storage, and third-party advertising tools — may collect additional information about your device and online activity. Your web browser may allow you to be notified when you are receiving a cookie, giving you the choice to accept it or not. You can also refuse all cookies by turning them off in your browser. By not accepting cookies, some features on our website may not fully function, and you may not be able to access certain information on this website. Where required by applicable law, we will seek your affirmative consent before placing non-essential cookies on your device. You may control cookies through browser settings and site-level preference tools where available.

Invivyd may also make use of pixel tags and web beacons. These are tiny graphic images placed on website pages or in our emails that allow us to determine whether you have performed a specific action. When you access these pages, open, or click an email, the pixel tags and web beacons generate a notice of that action. These tools allow us to measure response to our communications and improve our web pages and promotions.

In many cases, the data we collect using cookies and other tools is only used in a non-identifiable way, without any reference to Personal Data. For example, we use data we collect about all website users to optimize our websites and to understand website traffic patterns.

In some cases, we do associate the data we collect using cookies and other technology with your Personal Data. This Notice governs how we use that data when we associate it with your Personal Data.

Invivyd may have relationships with third‑party advertising partners that place advertisements on our websites and other websites and provide tracking and reporting services. These third-party advertising companies may place cookies on your computer when you visit our website or other websites so they can display targeted advertisements to you, but we do not sell any Personal Data to them as part of this process. However, this Notice does not cover the collection methods or use of the data collected by these vendors. For more information about third party advertising, please visit the Network Advertising Initiative (NAI) at www.networkadvertising.org.

Do-Not-Track Signals and Similar Mechanisms

Some web browsers incorporate a Do Not Track (DNT) or similar feature that signals to websites with which the browser communicates that a visitor does not want to have his/her online activity tracked. If a digital service that responds to a particular DNT signal receives the DNT signal, the browser can block that digital service from collecting certain Personal Information about the browser’s user. Where required by applicable law (including Colorado and Connecticut), Invivyd recognizes Universal Opt-Out Mechanisms (UOOMs) such as the Global Privacy Control (GPC) as valid opt-out signals for the sale of personal data and targeted advertising. Colorado residents have the right to opt out of the processing of their personal data for targeted advertising, the sale of personal data, and profiling in furtherance of decisions that produce legal or similarly significant effects. Colorado residents may also appeal a denial of a privacy rights request by contacting us using the details in the “How to Contact Us” section below. If we deny your appeal, you may contact the Colorado Attorney General at https://coag.gov/office-sections/consumer-protection/. Outside of those legally required contexts, our websites may not respond to all browser-level Do-Not-Track signals, as no uniform technical standard for DNT has been established.

Social Media Plugins

This website may use social media plugins (e.g., the Facebook “Like” button, “Share to Twitter” button) to enable you to easily share information with others. When you visit our website, the operator of the social plugin can place a cookie on your computer, enabling that operator to recognize individuals who have previously visited our site. If you are logged into the social media website (e.g., Facebook, Twitter, LinkedIn) while browsing on our website, the social plugins allow those social media websites to share data about your activities on our website with other users of their social media website. For example, Facebook Social Plugins allows Facebook to show your Likes and comments on our pages to your Facebook friends. Facebook Social Plugins also allows you to see your friends’ Facebook activity on our website. Invivyd does not control any of the content from the social media plugins. For more information about social plugins from other social media websites, you should refer to those sites’ privacy and data sharing statements.

Data Analytics

We may use third-party analytics services (such as Google Analytics) on our online services to process information about your use of our online services, for example, knowing which webpage referred you to our services, understanding which pages you visited or usage trends, providing certain features to you, and assisting with fraud prevention. To learn more about Google’s privacy practices, please review the Google Privacy Policy. To prevent Google Analytics from using your information for analytics, you can install the Google Analytics Opt-Out Browser Add-on here.

Interest-based Advertising

Some of our online services may integrate third-party advertising technologies that allow for the delivery of relevant content and advertising on non-Invivyd services or that you use. The ads on third-party services may be based on various factors, such as the content of the page you are visiting, your searches, demographic data, and your activities on our websites and third-party services.

We neither have access to, nor does this Privacy Notice govern, the use of cookies or other tracking technologies that may be placed on your device to access the Services by non-affiliated third parties. To learn more about certain third-party trackers used for interest-based advertising, for example, through cross-device tracking, and to exercise certain choices regarding such technologies, please visit the Digital Advertising Alliance (DAA), Network Advertising Initiative (NAI), Digital Advertising Alliance-Canada, European Interactive Digital Advertising Alliance, or your device settings if you have the DAA or other mobile app that allows you to control interest-based advertising on your device. We do not control these opt-out links or whether any particular company chooses to participate in these opt-out programs.

The opt-outs described at the links above are device- and browser-specific and may not work on all devices. If you clear cookies on your device or in your browser, you will have to go through the process of opting out again. If you choose to use any of these opt-out tools, this does not mean you will cease to see advertising. Rather, the ads you see will just not be based on your interests.

Your Rights and Choices

We are committed to protecting your Personal Data and ensuring it is handled lawfully, transparently, and accurately. Depending on your jurisdiction of residence or location, you may have certain rights with respect to your Personal Data. We will honor your requests in accordance with applicable laws and regulations and may need to verify your identity before responding. Please note that some rights may be subject to legal limitations or exceptions.

Your Privacy Rights

To the extent provided under applicable law, you may contact us at any time to exercise the following rights:

• Access — Request confirmation of whether we process your Personal Data and obtain a copy or description of the Personal Data we hold about you, including the categories of data, sources, purposes of processing, and categories of third parties with whom it is shared.
• Correction — Request that we correct or update inaccurate or incomplete Personal Data.
• Deletion — Request deletion of your Personal Data, to the extent permitted by law and technically feasible.
• Data Portability — Request a copy of your Personal Data in a portable, machine-readable format.
• Restriction or Objection — Opt out of or impose restrictions on certain processing of your Personal Data, or object to its processing where permitted by law.
• Withdraw Consent — Withdraw your consent at any time, without legal penalty. Please note that withdrawing consent may affect your ability to access certain services, features, or offerings.
• Right to Appeal (where applicable) — Appeal a decision we make regarding your privacy request, as permitted by applicable law.

We will not discriminate against you for exercising any of your privacy rights.

Managing Marketing and Communications

You may opt out of receiving promotional emails, text messages, or other marketing communications at any time by following the opt-out instructions included in the communication (for example, by clicking an unsubscribe link in an email or texting “STOP” in response to a text message).

Please note that even if you opt out of promotional communications, we may still send you important transactional or administrative messages, such as account updates, service notifications, program changes or expirations, product safety information, or other communications necessary to provide our services or comply with legal obligations.

Cookies and Tracking Technologies

You can manage cookies and similar tracking technologies through your browser settings. Browser options vary, so please consult your browser’s “Help” section for details on available controls. Where applicable, you may also opt out of certain interest-based advertising through industry programs, such as those offered by member companies of the Network Advertising Initiative (www.networkadvertising.org).

Automated Decision-Making

In certain circumstances, we may use automated processing, including profiling, to evaluate Personal Data for purposes such as risk assessment, fraud prevention, reporting, or recruiting. Automated decisions may be made where such processing is:

• Necessary to enter into or perform a contract with you;
• Required or authorized by applicable law; or
• Based on your consent, where required.

Subject to applicable legal requirements and limitations, you may request additional information about automated decision-making that applies to you, object to its use, or request that an automated decision be reviewed by a human.

How to Exercise Your Rights

To submit a privacy request or exercise any of the rights described above, please contact us at privacy@invivyd.com or using the contact details provided in the “How to Contact Us” section of this Privacy Notice.

Data Security and Retention

Invivyd has implemented a data security program that contains administrative, technical and physical controls that are designed to reasonably safeguard your Personal Data from unlawful use and unauthorized disclosure. However, no system is completely secure or error-free. We do not, and cannot, guarantee the complete security of your personal information.

We retain personal data for as long as reasonably necessary to fulfill the purposes described in this Notice and to comply with legal and regulatory obligations. Retention periods vary depending on the category of data and the purpose for which it was collected. Factors we consider include: the nature and sensitivity of the data, applicable legal or regulatory retention requirements, whether a legal hold applies, and the expiration of any applicable statute of limitations. We will delete or anonymize personal data when it is no longer needed for these purposes.

Consent to Processing in the United States and Elsewhere

This site is owned and operated by Invivyd in the United States. This site is not directed to users outside of the United States. If you are visiting this site from a country other than the United States, your communication with us will result in the transfer of data across international boundaries. The level of legal protection for Personal Data is not the same in all countries. However, we will take the security measures described in this Notice in an effort to keep your data secure.

Third-Party Resources

This Notice only addresses the use and disclosure of Personal Data by Invivyd. We may provide links to outside websites or advertisements for third parties that have their own Policies regarding data collection, use and disclosure. The terms of usage and other conditions of use posted on those websites, and not the policies and procedures we described here, apply to those websites. We cannot guarantee the privacy standards of websites to which we link or be responsible for the contents of other sites. Additionally, this Privacy Notice is not intended to be applicable to any linked, non-Invivyd website. We encourage you to familiarize yourself with the Policies provided by all third parties prior to providing them with data or taking advantage of an offer or promotion.

Children’s Privacy

Invivyd is committed to protecting the privacy of children. This website content and services are not intended for, or designed to attract, children under the age of 13. We do not knowingly collect any Personal Data of anyone under the age of 13 without verifiable parental consent. Certain states impose enhanced protections for minors: California and Connecticut protect minors up to age 16 from having their data sold or shared without opt-in consent; other states may impose additional consent or data-handling requirements for individuals under 18. We apply the most protective standard required by applicable law based on the user’s state of residence. We apply additional care when processing data of individuals we know or have reason to believe are minors, consistent with applicable law. No Personal Data should be submitted to Invivyd through the website by visitors who are less than 13 years old. If we learn that personal data of a child was collected without required parental or guardian consent, we will take reasonable steps to delete it in accordance with applicable legal requirements. Please contact us as described in the “How to Contact Us” section below to make us aware of Personal Data that we process about a Minor without consent. This website and its content are intended for adults and are not directed at, designed to attract, or targeted to children. Invivyd does not knowingly collect, use, or disclose Personal Data from children without verifiable parental or guardian consent.

Changes to this Notice

Invivyd may, at any time, revise this Privacy Notice by updating this posting. If we make revisions to this Privacy Notice, we will update the date of this Privacy Notice. We will continue to use and/or disclose Personal Data in accordance with the version of this Notice that was in effect at the time the Personal Data was collected, unless you have agreed to have an updated version of the Privacy Notice apply to the Personal Data collected while a prior version of our Privacy Notice was in force.

You understand and agree that your continued use of the Site on and/or after the effective date means that the collection, use, and sharing of your Personal Data is subject to the updated Notice.

Except to the extent we receive your authorization or as permitted or required by applicable law, we will handle your data in accordance with the terms of the Notice in effect at the time of the collection.

To the extent permitted by applicable law, this Notice is governed by the internal substantive laws of the laws of the State of Connecticut, without regard to its conflict of laws principles, except where superseded by applicable state or federal privacy law. Nothing in this Notice limits or waives any rights you may have under the privacy laws of the state in which you reside. If any provision of this Notice is found to be invalid by a court having competent jurisdiction, the invalidity of such provision shall not affect the validity of the remaining provisions of this Notice, which shall remain in full force and effect.

Any portions of this Notice are void to the extent they are prohibited by applicable law.

How to Contact Us

We do not unlawfully discriminate against individuals for exercising their privacy rights. Please contact us if you have any questions or comments about our privacy practices, your privacy choices, or this Notice. You can always reach us by e-mail or telephone at privacy@invivyd.com, or +1 781-819-0080. You may contact us to update or correct your Personal Data that you provided to us through the Site.

If you choose to contact us via mail at the address below, please provide your name, address, email address, and information about the communication that you do not want to receive.

Invivyd, Inc.
Attn: Chief Privacy Officer
209 Church Street
New Haven, CT 06510

Additional Terms Applicable to California, Texas, Connecticut, and Nebraska Residents Only

Under the California Consumer privacy Act (“CCPA”), the Texas Data Privacy and Security Act (“TDPSA”), the Connecticut Data privacy Act (“CTDPA”), and the Nebraska Data Privacy Act (“NDPA”), residents in each of these respective states are provided with additional rights regarding use of their Personal Information subject to certain limitations such as (a) exceptions permitted by applicable law and (b) verification of your identity.

This Section provides additional terms that apply to residents of California, Texas, Connecticut, and Nebraska. In the event of a conflict between this Section and the remainder of this Privacy Statement (“Statement”), this Section shall take precedence for California, Texas, Connecticut, and Nebraska residents. In this section only, any capitalized terms not defined in this Statement have the meanings set forth in the CCPA, TDPSA, NDPA, and the CTDPA.

Your Privacy Rights:

California, Texas, Connecticut, and Nebraska residents may exercise the following rights regarding their Personal Information:

1. Right to Opt-Out of the Selling or Sharing of Your Personal Information.

California residents may direct us not to sell or share your Personal Information at any time. Texas, Nebraska, and Connecticut residents may direct us to cease processing their Personal Information for targeted advertising, selling their Personal Information, or profiling in furtherance of decisions that produce legal or similarly significant effects.

Honoring Opt-out Preference Signals. California, Texas, and Connecticut residents may opt out of third-party Cookies on the Invivyd Website by sending an Opt-Out Preference Signal, such as the Global Privacy Control (GPC) on the browsers or extensions that support such a signal. To download and use a browser supporting the GPC browser signal, click here: globalprivacycontrol.org/orgs.

If you choose to use the GPC signal, you will need to turn it on for each supported browser or browser you use.

You may also submit an opt-out request by:

• Phone: +1 781-819-0080
• Email: privacy@invivyd.com

You may appoint an authorized agent to submit a request to opt out on your Personal Information. If you choose to use an authorized agent, the authorized agent must provide signed permission from you to that the authorized agent to submit requests on your behalf. We may deny a request from an authorized agent if we do not have proof that they are authorized by you to act on your behalf.

2. Right to Access.

California residents have the right to access any of the following which occurred in the prior 12-month period: (a) the categories of Personal Information we collected from you, (b) the categories of sources from which the Personal Information was collected, (c) the business or commercial purpose for collecting your Personal Information, (d) the categories of third parties with whom we shared your Personal Information, and (e) the specific pieces of Personal Information we collected from you.

Texas, Nebraska, and Connecticut residents have the right to confirm whether we are processing your Personal Information and to access such Personal Information.

3. Right to Request Deletion.

You have a right to request that we delete Personal Information we collected from you. We will comply with such requests, and direct our service providers to do the same, subject to certain exceptions permitted by applicable law.

4. Right to Correct Your Information.

You have a right to request that we correct your inaccurate Personal Information. If you request that we correct inaccurate Personal Information about you, we will use commercially reasonable efforts to correct it. If necessary, we may ask that you provide documentation showing that the information we retained is inaccurate.

5. Right to Data Portability.

You may request a copy of the Personal Information you previously provided to us in a portable and, to the extent technically feasible, readily usable format.

How to Exercise Your Rights of Access, Deletion, Correction and Portability. To exercise your rights described in this Section, you may submit your request to us by contacting us at any of the following:

• Phone: +1 781-819-0080
• Email: privacy@invivyd.com

Verifiable Consumer Request. In order to verify your request to exercise your rights, except for the right to opt out, you must provide sufficient information to allow us to reasonably verify you are the person about whom we collected Personal Information. You must describe your request with sufficient detail to allow us to properly understand, evaluate, and respond to your request.

When we receive your request to exercise your rights: (a) we will acknowledge receipt of your request; (b) we will try to match the information you provide in making the request with information we already maintain; (c) if required to verify your identity, we may ask you to provide additional information, including Personal Information; (d) we will consider various factors when determining how to verify your identity, such as the sensitivity and value of the data, the risk of harm, and the likelihood of fraud.

We will only use the Personal Information we collect during the verification process for the purpose of verifying your identity. If you maintain an account with us, we may use that account to respond to your request and/or verify your identity. If we are unable to verify your identity as required by applicable laws and regulations, we will decline to comply with your request, and let you know why.

When We Will Respond. We will try to respond to your request to exercise your privacy rights within 45 days. If we require additional time, we will inform you of the reason and extension period. For California residents, any disclosures we provide will only cover the 12-month period preceding our receipt of your request. For data portability requests, we will select a format to provide you with that Personal Information. We may charge a fee to process or respond to your request if it is excessive, repetitive, or manifestly unfounded.

Who May Exercise Your Rights? You may only make a request to exercise your rights on behalf of yourself. A parent or legal guardian may make a request on behalf of his or her child.

Texas, Nebraska, and Connecticut residents may submit a request to opt out through an authorized agent. California residents have the right to submit any privacy right request through an authorized agent. You may designate an authorized agent to make a request on your behalf to exercise your rights by doing the following: (1) provide the authorized agent written permission to do so; and (2) verify your identity. We may deny a request from an authorized agent if we do not have proof that they are authorized by you to act on your behalf. We will not require authorized agents to verify your identity to effectuate an opt-out request. We may deny a request from an authorized agent if we do not have proof that they are authorized by you to act on your behalf.

Right to Non-Discrimination. You have the right to not receive discriminatory treatment for requesting to exercise any of your privacy rights.

Additional Information for California Residents

• Categories of Personal Information We Have Collected. During the past 12 months, we have collected the following categories of Personal Information: Identifiers, Protected Classifications, Commercial Information, Internet Activity, Sensory Data, Employment Information, Education Information and Inferences.
• Categories of Personal Information Disclosed for a Business Purpose. During the past 12 months, we have disclosed the following categories of Personal Information for a Business Purpose: Identifiers, Protected Classifications, Commercial Information, Internet Activity, Sensory Data, Employment Information, and Educational Information to the Sources described in this Statement.
• Sharing Personal Information. In the last 12 months we have not Sold your Personal Information to a third party for monetary compensation. We have Shared Personal Information with third parties for the purposes of serving targeted advertising, including: Identifiers, Commercial Information, and Internet Activity to the Sources described in this Statement. Under the CCPA, sharing personal data for cross-context behavioral advertising is treated equivalently to a sale for purposes of the opt-out right. California residents may opt out of both the sale and sharing of their Personal Information using the methods described in Section 1 above.
• We Do Not Use or Disclose Sensitive Information. We do not use or disclose Sensitive Information, as defined in the CCPA.

Shine the Light. California’s “Shine the Light” law (Civil Code Section § 1798.83) permits users of our Website that are California residents to request certain information regarding our disclosure of personal information to third parties for their direct marketing purposes. To make such a request, please send an email to privacy@invivyd.com or write to us at: Invivyd Inc., 209 Church St New Haven, CT 06510.

Appeal Process for Texas, Nebraska, and Connecticut Residents

Right to Seek an Appeal. If you disagree with our refusal to take action on your request to exercise your privacy rights, you have the right to ask us to reconsider. You must submit your request within 60 days of your receipt of our denial. You may submit your request to us by:

• Phone: +1 781-819-0080
• Email: privacy@invivyd.com

Appeal Timeframe. Once we receive your request, we will acknowledge and start processing your request. Within 60 days of receiving your request, we will inform you in writing of any action taken or not taken in response to your request, including a written explanation of the reasons for our decision.

References

This Notice is written to comply with the provisions of all applicable privacy laws and regulations as well as Invivyd corporate policies and procedures.