Section 1. Introduction

Orizon LLC ("Orizon," "we," "us," or "our") is a biologics company engaged in the research, development, and clinical collaboration surrounding umbilical cord-derived biologic products. This Privacy Policy describes how we collect, use, disclose, and protect personal information obtained through our website, located at www.orizonbiologics.com (the "Website"), and through our offline business operations, including professional inquiries, clinical collaboration requests, and order-related communications.

This Policy applies to all visitors to our Website and to professional contacts, prospective customers, and existing customers who interact with us in the course of our business-to-business operations. Because our products are made available exclusively to licensed medical professionals and not sold directly to consumers through an online checkout, this Policy is drafted to reflect that narrower data footprint.

Please read this Policy carefully. By using the Website or contacting us, you acknowledge that you have read and understood the practices described herein.

Section 2. Information We Collect

We collect only the categories of personal information reasonably necessary to operate our Website, respond to professional inquiries, and manage our business relationships. We do not maintain an online checkout function and accordingly do not collect payment card information or financial account details through the Website. The categories of information we may collect are as follows.

2.1 Information You Provide Directly

• Contact and professional identifiers, including your name, professional title, practice or clinic name, business address, business email address, and business telephone number, provided when you submit a contact or inquiry form, request information about sourcing or clinical collaboration, or otherwise communicate with us.
• Inquiry and correspondence content, including the substance of your message and details about your clinical practice, sourcing needs, or product questions, as provided in forms, emails, or other communications.
• Professional credentials, including your state medical license number, National Provider Identifier (NPI), DEA registration number where applicable, and institutional affiliation, collected as part of our customer onboarding and Know Your Customer ("KYC") verification process.
• SMS opt-in information, including your mobile telephone number, if you consent to receive business-to-business SMS communications from us, as described in Section 7 below.

2.2 Information Collected Automatically

• Device and network identifiers, including your IP address, browser type, operating system, and device type.
• Usage and navigation data, including pages visited, time spent on pages, referring URLs, links clicked, and similar interaction data collected through cookies and analogous technologies.
• Cookie and analytics data collected through first-party and third-party cookies and analytics tools, as described in Section 5 below.

2.3 Information We Do Not Collect

We do not collect government-issued identification numbers, sensitive health or medical records, financial account or payment card information, or personal information from individuals under the age of 18. Our Website and services are directed exclusively to licensed medical professionals. We do not solicit or knowingly process protected health information ("PHI") as defined under the Health Insurance Portability and Accountability Act of 1996 ("HIPAA") through our Website or other business communications channels. Any PHI received inadvertently will not be used, retained, or disclosed for any purpose other than returning or securely destroying such information in accordance with applicable law.

Section 3. How We Use Personal Information

We use the personal information we collect for the following purposes.

• Responding to professional inquiries, including questions about our products, sourcing arrangements, clinical collaboration opportunities, or laboratory standards.
• Managing business relationships, including communications with existing and prospective professional customers regarding orders, product information, and account matters.
• Customer credentialing and KYC verification, including verifying professional licensure and eligibility prior to establishing a business relationship.
• Operating and improving the Website, including maintaining Website functionality, analyzing usage patterns, identifying and resolving technical issues, and improving the user experience.
• Marketing and outreach, including sending information about our products, scientific developments, and professional events to individuals who have expressed interest or consented to receive such communications. You may opt out at any time as described in Section 8.
• Legal compliance, including complying with applicable federal and state laws, regulations, and legal process, and responding to lawful subpoenas, court orders, or regulatory inquiries.
• Security and fraud prevention, including detecting, investigating, and addressing potentially unauthorized, fraudulent, or harmful activity directed at the Website or our operations.

We do not use personal information to make automated decisions with legal or similarly significant effects, and we do not use personal information for purposes incompatible with those described above without providing prior notice.

Section 4. How We Share Personal Information

We do not sell personal information. We may disclose personal information to the following categories of recipients, solely as necessary to support our operations.

• Service providers, including vendors and contractors who perform services on our behalf such as website hosting, email delivery, analytics, customer relationship management, and IT support, each bound by confidentiality obligations and permitted to use information only for the specified service.
• Professional and legal advisors, including attorneys, accountants, and other professional advisors engaged to support our legal and compliance obligations, subject to applicable privilege and confidentiality duties.
• Regulatory and law enforcement authorities, when disclosure is required by applicable law, regulation, or lawful legal process, or is necessary to protect our legal rights or the safety of persons.
• Business transaction counterparties, in connection with a merger, acquisition, financing, or sale of all or a portion of our business assets, subject to confidentiality protections and only to the extent necessary for evaluation or consummation of the transaction.

All disclosures to service providers are governed by written agreements requiring appropriate data protection measures. We do not disclose personal information to unaffiliated third parties for their own independent marketing or commercial purposes.

Section 5. Cookies and Tracking Technologies

Our Website uses cookies and similar technologies to enable core Website functionality, understand how visitors interact with the Website, and support analytics. The types of cookies we use include the following.

• Strictly necessary cookies, which are required for the Website to function and cannot be disabled.
• Analytics cookies, which are used to collect aggregated, non-identifiable information about how visitors navigate and use the Website, enabling us to improve content and structure. We may use third-party analytics tools, such as Google Analytics, for this purpose.
• Functionality cookies, which are used to remember preferences you set when interacting with the Website.

We do not currently use cookies for targeted behavioral advertising to individual Website visitors. You may control cookies through your browser settings, although disabling certain cookies may affect Website functionality. We do not respond to browser-level "Do Not Track" signals, but we honor Global Privacy Control (GPC) signals to the extent required by applicable law.

Section 6. Third-Party Websites and Links

Our Website may contain links to third-party websites, resources, or publications. We do not control and are not responsible for the privacy practices, content, or security of any third-party sites, and the inclusion of a link does not constitute an endorsement of that site or its content. We encourage you to review the privacy policies of any external sites you visit.

Section 7. SMS Communications

We may send SMS (text) messages to licensed medical professionals and business contacts who have opted in to receive business-to-business communications from Orizon LLC. All SMS communications are transmitted in compliance with the Telephone Consumer Protection Act (47 U.S.C. § 227) and applicable Federal Communications Commission regulations. SMS messages may include information about our products, sourcing opportunities, scientific developments, and related professional topics.

• Message frequency varies and will typically not exceed one to three messages per month.
• Standard carrier message and data rates may apply.
• You may opt out at any time by replying STOP to any message, after which you will receive no further SMS communications from us.
• For assistance, reply HELP or contact us at \1.

SMS opt-in data and consent will not be shared with any third party, except aggregators and providers of text messaging services used solely to deliver messages on our behalf. Phone numbers collected for SMS purposes are used only for delivering the communications described in this Section.

Section 8. Your Choices and Communication Preferences

You may exercise the following choices with respect to your personal information.

• Marketing communications. You may opt out of receiving email marketing from us at any time by clicking the unsubscribe link in any marketing email or by contacting us directly. Opting out of marketing does not affect transactional or relationship-based communications.
• SMS. You may opt out at any time by replying STOP, as described in Section 7.
• Cookies. You may manage cookie preferences through your browser settings or, where available, through a cookie preference tool on the Website.

Section 9. Your Privacy Rights

Depending on your state of residence, you may have certain rights regarding your personal information under applicable state privacy law. The general rights described below may be available to you, subject to the thresholds and limitations of the laws in your jurisdiction.

• Right to know or access. You may request information about the categories and specific pieces of personal information we have collected about you.
• Right to correction. You may request that we correct inaccurate personal information we hold about you.
• Right to deletion. You may request that we delete personal information we hold about you, subject to applicable legal exceptions.
• Right to opt out of sale or sharing. We do not sell personal information. To the extent we engage in any sharing for cross-context behavioral advertising as that term is defined under applicable law, you may opt out.
• Right to non-discrimination. We will not discriminate against you for exercising any privacy rights available to you under applicable law.

To submit a privacy rights request, please contact us using the information in Section 14. We may need to verify your identity before processing your request and will respond within the timeframe required by applicable law. You may designate an authorized agent to make requests on your behalf, subject to written authorization and identity verification.

Utah Residents

Orizon LLC is headquartered in Utah and conducts operational and laboratory activities in the state. To the extent the Utah Consumer Privacy Act (Utah Code § 13-61-101 et seq.) applies to our processing of your personal information, Utah residents may have rights to access, correct, delete, and obtain a portable copy of their personal information, as well as the right to opt out of the sale of personal information or its use for targeted advertising. The UCPA applies to controllers meeting certain revenue and data-volume thresholds. We are committed to evaluating our compliance obligations as our operations develop and to honoring applicable rights as they arise. Utah residents with questions about their privacy rights are encouraged to contact us using the information in Section 14.

California Residents

To the extent the California Consumer Privacy Act, as amended by the California Privacy Rights Act (collectively, the "CCPA/CPRA"), applies to our processing of personal information about California residents, those individuals may have additional rights, including the right to limit the use of sensitive personal information and the right to opt out of the sharing of personal information for cross-context behavioral advertising. The CCPA/CPRA applies to businesses meeting specific revenue and data-volume thresholds. As an early-stage company, Orizon may not currently meet those thresholds. We are committed to monitoring our compliance obligations as our operations scale and will extend CCPA/CPRA rights to California residents to the extent required by applicable law. We note that, even where not legally required, we will actively monitor whether our activities in California bring us within the scope of these obligations as our customer relationships develop. California residents with questions are encouraged to contact us using the information in Section 14.

Section 10. Data Retention

We retain personal information for as long as reasonably necessary to fulfill the purposes described in this Policy, maintain business relationships, comply with applicable legal and regulatory obligations, resolve disputes, and enforce agreements. Retention periods vary depending on the type of information and the applicable legal framework. When personal information is no longer needed for those purposes, we delete or de-identify it in accordance with our internal data retention procedures.

Section 11. Data Security

We maintain reasonable administrative, technical, and physical safeguards designed to protect personal information against unauthorized access, disclosure, alteration, or destruction. These measures include access controls, encryption in transit, and vendor security assessments. No security system is impenetrable, however, and we cannot guarantee the absolute security of any information transmitted to or stored by us. You are responsible for maintaining the confidentiality of any login credentials and for ensuring that communications you send to us are transmitted over secure channels.

Section 12. International Visitors

Our Website is operated from the United States, and our data processing activities occur primarily in the United States. If you access our Website from outside the United States, please be aware that your personal information will be transferred to and processed in the United States, where data protection laws may differ from those in your country or jurisdiction. By using the Website, you acknowledge and consent to this transfer.

Section 13. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, applicable law, or Website functionality. We will post the revised Policy on this page and update the "Last Updated" date at the top of this document. For material changes, we will provide additional notice as required by applicable law, which may include email notification to professional contacts on file. Your continued use of the Website following the posting of any update constitutes acceptance of the revised Policy.

Section 14. Contact Us

If you have questions or concerns about this Privacy Policy, or wish to submit a privacy rights request, please contact us at: