PRIVACY POLICY

Last Updated: July 24, 2026

Upstream Biotechnology, Inc. (“Upstream,” “Company,” “we,” “us,” or “our”) respects your privacy.

This Privacy Policy explains how we collect, use, retain, disclose, and protect personal information when you visit our website (the “Site”) or contact us using an email address, form, link, or other communication method provided through the Site.

This Privacy Policy applies to information collected through the Site and to communications initiated through the Site.

It does not govern information collected or processed under a separate agreement, including a nondisclosure agreement, employment agreement, research collaboration agreement, licensing agreement, partnership agreement, financing agreement, or other contract.

1. Information We Collect

Information You Provide

We may collect information that you voluntarily provide when you contact us regarding research, licensing, partnerships, investment, media, employment, or other matters.

This information may include:

• Your name.

• Business or professional email address.

• Telephone number.

• Employer, academic institution, or other affiliation.

• Job title or professional role.

• The content of your inquiry.

• Documents or attachments you submit.

• Other information you choose to provide.

If you apply for a position or submit recruitment materials, we may also collect information contained in your résumé, curriculum vitae, cover letter, publication history, employment history, educational history, references, and related application materials.

Please do not submit confidential research information, proprietary biological or genetic data, trade secrets, sensitive personal information, or other confidential material unless an appropriate written agreement is already in effect.

Submitting information through the Site or by email does not create a confidentiality obligation unless Upstream has entered into a separate confidentiality agreement through an authorized representative.

Information Collected Automatically

When you access the Site, Upstream and its website-hosting, security, and analytics providers may automatically collect limited technical and usage information, including:

• Internet Protocol address.

• Browser type and version.

• Device type.

• Operating system.

• Pages viewed and links selected.

• Date and time of access.

• Referring website or source.

• Approximate geographic location derived from an Internet Protocol address.

• Information about how visitors navigate and interact with the Site.

• Security, diagnostic, and technical log information.

We use this information to operate, secure, maintain, analyze, and improve the Site.

2. Cookies and Similar Technologies

The Site uses necessary cookies and similar technologies to provide essential functions, including security, network management, navigation, and website operation.

With your consent where required, the Site also uses Squarespace Analytics cookies to help us understand aggregate Site traffic, visitor interaction, page usage, and technical performance.

Upstream does not use advertising or remarketing cookies and does not currently use Meta Pixel, LinkedIn Insight Tag, Google Ads remarketing, or comparable advertising technology on the Site.

Non-essential analytics cookies will not be placed where prior consent is required unless you accept them through the Site’s cookie banner.

You may accept, reject, or manage non-essential cookies through the Site’s cookie banner. You may change or withdraw your cookie choices through the “Cookie Settings” link made available on the Site.

You may also manage cookies through your browser settings. Blocking or deleting certain cookies may affect Site functionality.

Third-party services or content embedded in the Site may use their own cookies or similar technologies. Their use of information is governed by their own privacy policies and controls.

3. How We Use Information

We may use personal information to:

• Present, operate, secure, maintain, and improve the Site.

• Respond to inquiries and communications.

• Evaluate potential research collaborations, licensing opportunities, technology-development programs, investment discussions, and strategic partnerships.

• Evaluate employment inquiries and job applications.

• Communicate with you about matters relevant to your inquiry.

• Monitor Site performance and visitor interaction.

• Detect, investigate, and prevent fraud, misuse, security incidents, and other harmful activity.

• Protect Upstream’s rights, property, systems, personnel, technology, and confidential information.

• Maintain appropriate business and administrative records.

• Comply with legal, regulatory, contractual, and administrative obligations.

• Establish, exercise, or defend legal claims.

• Complete or evaluate a financing, corporate transaction, or business reorganization.

We will not use personal information for a materially different purpose without providing appropriate notice or obtaining consent where required.

4. How We Disclose Information

We may disclose personal information in the circumstances described below.

Service Providers

We may disclose information to website-hosting providers, cloud-service providers, information-technology providers, cybersecurity vendors, analytics providers, professional advisers, recruitment providers, and other contractors that support our operations.

These providers may process information only as necessary to provide services to Upstream and must handle the information in accordance with applicable law and their contractual obligations.

Affiliates, Collaborators, and Business Partners

We may disclose information to subsidiaries, affiliates, scientific collaborators, development partners, investors, or other business partners where reasonably necessary to evaluate or respond to an inquiry, conduct appropriate diligence, or pursue a potential business relationship.

Such disclosures may be subject to applicable confidentiality and contractual obligations.

Corporate and Financing Transactions

Information may be disclosed or transferred in connection with a proposed or completed financing, merger, acquisition, restructuring, reorganization, sale of assets, dissolution, bankruptcy, or similar transaction, including during related diligence.

Legal and Protective Purposes

We may disclose information when we reasonably believe disclosure is necessary to:

• Comply with applicable law, regulation, subpoena, court order, governmental request, or legal process.

• Respond to an inquiry from a regulator or governmental authority.

• Enforce our agreements, policies, or legal rights.

• Protect the rights, property, safety, systems, or security of Upstream, our personnel, Site visitors, or others.

• Investigate or prevent fraud, misuse, security incidents, or unlawful activity.

5. No Sale or Targeted Advertising

Upstream does not sell personal information.

Upstream does not share personal information for cross-context behavioral advertising, as that term is defined under applicable privacy laws.

Upstream does not use personal information collected through the Site to deliver targeted advertising.

If these practices change, we will update this Privacy Policy and provide any notices, consent mechanisms, or privacy choices required by applicable law before the change takes effect.

6. Data Retention

We retain personal information only for as long as reasonably necessary for the purposes described in this Privacy Policy.

Those purposes may include:

• Responding to inquiries.

• Evaluating business, research, licensing, investment, or employment opportunities.

• Maintaining appropriate business records.

• Satisfying legal, regulatory, tax, accounting, or contractual obligations.

• Resolving disputes.

• Establishing, exercising, or defending legal claims.

• Protecting Upstream’s rights, systems, technology, and personnel.

Retention periods may vary depending on the type of information, the nature of the relationship, applicable legal requirements, and whether the information is relevant to an existing or anticipated legal, regulatory, contractual, employment, research, or commercial matter.

We may retain anonymized or aggregated information that does not reasonably identify an individual.

7. Data Security

We use administrative, technical, and physical safeguards designed to protect personal information against accidental or unlawful destruction, loss, alteration, disclosure, access, or misuse.

No internet transmission, electronic storage system, or security measure is completely secure. We therefore cannot guarantee the absolute security of information transmitted through or stored in connection with the Site.

Email is not necessarily a secure method of communication. Do not send confidential or highly sensitive information through ordinary email unless appropriate protections and agreements are in place.

8. Your Privacy Rights

Depending on your location and applicable law, you may have the right to request:

• Confirmation of whether we process personal information about you.

• Access to certain personal information.

• Correction of inaccurate personal information.

• Deletion of certain personal information.

• A portable copy of certain personal information.

• Restriction of or objection to certain processing.

• Withdrawal of consent where processing is based on consent.

• An appeal of certain decisions concerning a privacy request.

• Information about the categories of personal information we collect, use, or disclose.

These rights are subject to applicable legal limitations, exemptions, and verification requirements.

To submit a request, contact us at info@upstreambiotech.com. Please describe the request and provide sufficient information for us to identify the relevant records.

We may need to verify your identity before completing a request. An authorized agent may submit a request where permitted by applicable law, but we may require evidence of the agent’s authority.

We will respond within the period required by applicable law.

We will not discriminate against you for exercising a legally protected privacy right.

9. Additional Information for EEA and UK Visitors

Where European Union or United Kingdom data-protection law applies, Upstream Biotechnology, Inc. is the controller of the personal information described in this Privacy Policy.

We process personal information under one or more of the following legal bases:

• To respond to your request or take steps at your request before entering into an agreement.

• To perform an agreement with you.

• To comply with a legal obligation.

• For our legitimate interests in operating and securing the Site, responding to business inquiries, conducting research and business development, maintaining appropriate records, and protecting our legal rights.

• With your consent, including where consent is required for non-essential analytics cookies.

Where we rely on legitimate interests, we consider whether those interests are overridden by your rights and interests.

Subject to applicable law, you may have the right to:

• Access your personal information.

• Correct inaccurate personal information.

• Request erasure of your personal information.

• Restrict or object to processing.

• Receive certain information in a portable format.

• Withdraw consent at any time where processing is based on consent.

• Lodge a complaint with the data-protection supervisory authority in the country

where you live, work, or believe an infringement occurred.

Withdrawal of consent does not affect the lawfulness of processing completed before consent was withdrawn.

10. International Data Transfers

Upstream is based in the United States.

If you access the Site from outside the United States, your personal information may be transferred to, stored in, or processed in the United States or other countries where Upstream or its service providers operate.

Privacy and data-protection laws in those countries may differ from the laws in your jurisdiction.

Where applicable law requires safeguards for international transfers, we use legally recognized transfer mechanisms or other appropriate safeguards.

11. Children’s Privacy

The Site is intended for business, scientific, professional, and general informational audiences. It is not directed to children under 13, and we do not knowingly collect personal information from children under 13.

If you believe a child has provided personal information through the Site, contact us so that we can review and, where appropriate, delete the information.

12. Third-Party Links and Services

The Site may contain links to third-party websites, publications, services, and platforms.

Upstream does not control and is not responsible for the privacy, security, or information practices of third parties. You should review the privacy policies of any third-party website or service before providing personal information.

13. Changes to This Privacy Policy

We may update this Privacy Policy periodically to reflect changes in our practices, technology, legal obligations, or Site functionality.

The “Last Updated” date indicates when the policy was most recently revised.

Where required by applicable law, we will provide additional notice of material changes through the Site or another appropriate method.

14. Contact Information

Questions, comments, or privacy requests may be directed to:

Upstream Biotechnology, Inc.

701 W. Main St., Suite 200

Durham, NC 27701

Email: info@upstreambiotech.com