Privacy Notice

Introduction

This Privacy Notice (“Notice”) describes the privacy practices of Alto Neuroscience, Inc. and its subsidiaries (“Alto”, “we”, “us” or “our”) with respect to personal information that we collect in connection with the website maintained by Alto at www.altoneuroscience.com, including all pages thereof, such as investors.altoneuroscience.com) (“Website”) and any other websites, platforms or apps maintained by Alto that link to this Notice (each a “Service” and collectively, the “Services”). Where another Service provides a separate privacy notice, that notice governs that Service. If there is any conflict between this Notice and the privacy notice presented on a specific Service, the privacy notice presented on the specific Service prevails.

Alto is a corporation registered in the United States (“U.S.”) having its principal place of business at 650 Castro Street, Suite 450 Mountain View, CA 94041. As the operator of the Website, Alto identifies as the controller of the personal data that may be collected or otherwise processed by it in relation to its Website. Alto respects your privacy and is committed to protecting your personal data in accordance with all applicable data protection laws, in particular:

• United States federal and state privacy laws; and
• The General Data Protection Regulation (Regulation (EU) 2016/679 and its implementing regulations, as amended from time to time) to the extent that it forms part of the law of England and Wales, Scotland and Northern Ireland by virtue of section 3 of the European Union (Withdrawal) Act 2018 and the Data Protection Act 2018, and their implementing regulations, as amended from time to time (“UK GDPR”).

UK GDPR definitions of “personal data” and “processing”:

• “Personal data” means any information relating to an identified or identifiable natural person (“data subject”); an identifiable natural person is one who can be identified, directly or indirectly, in particularly by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.
• “Processing” means any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.

Clinical trial activities: This Notice does not apply to personal data processed as part of Alto’s clinical trials, including, for example, data stored on our mental health research registry and trial participants’ data collected through informed consent forms, and the term “Services” should not be interpreted to refer to any such clinical trial(s). These clinical trial activities are governed by separate privacy notices.

Potential clinical trial participants: If you are interested in one of our clinical trials, you will be provided with a separate privacy notice as part of the informed consent form, prior to you agreeing to participate in the study. We do not use your personal data to assess your eligibility for, or other purposes related to, a clinical trial unless and until we first obtain your consent through an informed consent form.

Personnel: This Notice does not apply to personal data that we collect from Alto employees, contractors or job candidates. Such information may be subject to separate privacy notices. For example, you may find the privacy notice for Alto job candidates here.

Protecting the privacy and security of your personal data is important to Alto. This Notice is designed to help you understand what personal data Alto may collect when you use the Service and how Alto uses and discloses that personal data. Please check the Notice regularly for updates, as we may change this Notice at any time by updating it on our website. The revised version will be effective when it is posted. If we materially change the ways in which we use or disclose personal data previously collected from you through the Services, we will notify you through the Website, by email, or other communication as appropriate.

By accessing the Website or otherwise submitting any personal data to us in relation to the Services, you agree to the use by Alto of such data according to this Notice, and to be bound by the general terms of use. Each time you use the Website or another Service, the then-current version of this Notice applies. If you do not agree to the terms of this Notice, you should discontinue the use of the Services (including the Website).

1. Personal Data We Collect

When you use the Services, you may provide certain personal data to us. For example, you may provide us with certain personal data via the Website, such as your name and email address, to submit inquiries or receive updates from us.

In addition to the above, as you use the Services, we may collect certain passive information, including internet protocol addresses, cookies (see below), navigational data, the name of the domain and host from which you access the Internet, the browser software you use and your operating system, the date and time you access the Services, and the Internet address of the website from which you linked directly to the Services.

We may also collect personal data if we conduct or sponsor surveys, business or marketing events, and when you contact us via e-mail for information or assistance. In these instances, we may ask you for your name, email address, phone number, state of residence and/or mailing address, etc.

• Use of cookies: Please note we and our third-party partners may collect certain type of data using cookies, pixel tags, or similar technologies. Our third-party partners, such as analytics and advertising partners, may use these technologies to collect information about your online activities over time and across different services. Cookies are small text files containing a string of alphanumeric characters that are stored on your device which enable features and functionality related to a website. We may use both session cookies and persistent cookies. A session cookie disappears after you close your browser. A persistent cookie remains after you close your browser and may be used by your browser on subsequent visits to our Services. Please review your web browser’s “Help” file to learn how you may modify your cookie settings. Please note that if you delete or choose not to accept cookies from the Service, you may not be able to utilize the features of the Service to their fullest potential. To find out more about cookies, including learning about what cookies have been set and how to manage and delete them, please review our Cookie Policy.
• Third Party Websites: The Services may include hyperlinks to websites or other content maintained or controlled by others. This Notice does not cover pages hosted by third parties to which Alto may refer. Alto is not responsible for such websites or other content or for any data processing performed by such third parties, and this Notice does not apply to such websites or their content. The use of web functionality that enables third-party social media widgets/tools/buttons is subject to the third party’s privacy notices and terms. We recommend that you review carefully the privacy notices and terms associated with relevant third-party social network services (i.e., LinkedIn and X).

2. Use of Personal Data

We may use the personal data we collect for the following purposes:

• To communicate with you, provide you with updates and other information relating to our Services, provide you information that you may request, respond to comments and questions and otherwise provide support.
• To provide, maintain, improve and enhance our Services.
• To personalize your experience on our Services such as by providing tailored content and recommendations.
• To find and prevent fraud and abuse, and respond to trust and safety issues that may arise.
• To measure interest in our Services and business, perform internal quality control, and send communications regarding the Services and our business.
• To generate anonymized, aggregate data containing only de-identified, non-personal data that we may use for public health, research, and analytics.
• For compliance purposes, including enforcing our terms of service and legal rights or as may be required by applicable laws and regulations or requested by any judicial process or governmental agency.
• For marketing and advertising purposes, such as developing and providing promotional and advertising materials that may be relevant, valuable or otherwise of interest to you.
• For other purposes disclosed to you at the time you provide personal data or with your consent.

3. Legal Bases for Use

The legal basis for the processing initiated through the contact pages (e.g., via the general contact form, the investor request form and the subscription form for investor email alerts) is our legitimate interest to develop relationships with new clients, to identify and select potential staff or subcontractors and to main satisfactory communication with people interested in us and our work.

The legal basis for processing via cookies, except for the strictly necessary cookies (technical), is your consent. You have the right to withdraw consent at any time. To learn more about our use of cookies, please review our Cookie Policy.

4. Disclosure of Personal Information

We do not lend, sell, or trade your personal data. We disclose the personal data we collect to the following categories of recipients:

Vendors and Service Providers

We may disclose personal data we receive to our vendors and service providers retained in connection with the provision of our Services.

Analytics Partners

Alto may also use Google Analytics or other analytics services to collect and process information regarding visitor behaviour and visitor demographics on our Services and to develop the Services. You can learn more about Google’s practices by visiting https://www.google.com/policies/privacy/partners/. You can learn more about Google Analytics and how to prevent the use of Google Analytics relating to your use of our Services here: https://tools.google.com/dlpage/gaoptout?hl=en.

Advertising Partners

We work with third-party advertising partners to show you ads that we think may interest you. Some of our advertising partners are members of the Network Advertising Initiative (https://optout.networkadvertising.org) or the Digital Advertising Alliance (https://optout.aboutads.info). If you do not wish to receive personalized ads, please visit their opt-out pages to learn about how you may opt out of receiving web-based personalized ads from member companies. You can access any settings offered by your mobile operating system to limit ad tracking, or you can install the AppChoices mobile app to learn more about how you may opt out of personalized ads in mobile apps.

Merger, Sale, or Other Asset Transfers

We may transfer your personal data to service providers, advisors, potential transactional partners, or their third parties in connection with the consideration, negotiation, or completion of a corporate transaction in which we are acquired by or merged with another company or we sell, liquidate, or transfer all or a portion of our assets. The use of your information following any of these events will be governed by the provisions of this Notice in effect at the time the applicable information was collected.

As Required By Law and Similar Disclosures: Please note we may access, preserve, and disclose your personal data if doing so is required or appropriate to (a) comply with any laws or law enforcement requests and legal process, such as a court order or subpoena; (b) respond to your requests; or (c) protect your, our, or others’ rights, property, or safety. For the avoidance of doubt, the disclosure of your information may occur if you post any objectionable content on or through the Services.

5. Cross-Border Data Transfers

In the event we are required to transfer personal data to recipients outside the United Kingdom (“UK”), such transfers will be carried out in accordance with the UK GDPR. If the personal data are transferred to countries that have not been recognized by the European Commission (or, where applicable, the UK government) as providing an adequate level of data protection, we will put in place appropriate safeguards to protect the data , including through the execution of the EU Standard Contractual Clauses as approved by the European Commission (“SCCs”), the UK international data transfer addendum to the SCCs or the UK international data transfer agreement issued by the UK Information Commissioner’s Office (“ICO”), or where one of the other safeguards under the EU/UK GDPR applies.

Please contact our data protection officer (“DPO”) if you would like to receive further information on the specific safeguard used by us when transferring your personal data out of the EEA or UK or want to obtain a copy of that safeguard (e.g., SCCs). The contact details of our DPO can be found in the “Contact Us” section of the Notice.

Users Outside of the U.S.:

• Alto is based in the U.S. The Services are directed towards users who reside in the U.S. If you are outside of the U.S., by submitting personal data to us, you are consenting to the processing of that information in accordance with this Notice. In certain situations, your personal data may be transferred to third parties through the use of products or services integrated on our Website. For information on our use of cookies, please consult our Cookie Policy.
• Sharing your personal data as explained above may involve a transfer of personal data to the U.S. Alto is therefore committed to complying with the transfer rules under applicable data protection laws of your country, including through appropriate safeguards (for transfers outside the UK) as explained above. Please contact our Data Protection Officer (see DPO contact details in the “Contact Us” section) if you want to have more details about the mechanism supporting the data transfer.

6. Storage of Data

The data retention period varies according to the different purposes of processing. To determine the appropriate retention period for personal data, we consider the amount, nature, and sensitivity of the personal data, the potential risk of harm from unauthorized use or disclosure of your personal data, the purposes for which we process your personal data and whether we can achieve those purposes through other means, and the applicable legal requirements.

We will keep your personal data for the duration of the storage and limitation periods required by law. If such an obligation does not apply, we will keep your data no longer than necessary (e.g., to meet your request via the contact form, or until you unsubscribe or cancel your subscription to a newsletter).

At all times you have the right to request removal of your personal data from our systems. Should however any legal ground prevent Alto to remove your personal data from its systems, you will be informed what personal data we are obliged to keep and the reasons for keeping it.

7. Security

Alto is committed to protecting the security of your personal data and we have implemented appropriate technical and organizational security measures designed to protect your personal data that we collect, including but not limited to role-based access controls, data encryption in-transit and at-rest, enterprise-graded network security, security patches automation, single-sign on and multi-factor authentication. While we have implemented security measures, please keep in mind that perfect security does not exist and no storage or transmission of information is guaranteed to be completely secure.

8. User Choices and Changing Your Information; Your Rights

While we do not yet meet the thresholds to be subject to US state comprehensive consumer privacy laws (e.g., the California Consumer Privacy Act), we may provide you with certain choices with respect to your personal data as a courtesy to you. If you decide that you do not want your personal data used for the purposes described in this Notice, you may contact us (see the “Contact Us” section below) to request removal of your personal data from our database. You may also contact us to correct or update any personal data you have provided us. You may also “opt-out” of receiving e-mails and other communications from us by using the unsubscribe feature that may be included in the e-mails we send or by contacting us. Even if you opt out of receiving promotional messages from us, you may continue to receive administrative messages from us.

Rights under UK GDRP

If you are in the UK, with regard to the processing of your personal data, you have the following right under UK GDPR:

• Access: you have the right to obtain confirmation as to whether or not personal data concerning you are being processed, and, where that is the case, all necessary information to make the process transparent;
• Rectification: you have the right to require rectification of inaccurate data about you;
• Deletion of personal data: you have the right to request deletion of your personal data, but this right may be limited depending on the specific circumstances;
• Object to processing: you have the right to object, on grounds relating to your particular situation, at any time to the processing of your data where we are relying on legitimate interest as legal basis;
• Restriction to processing: you have the right to restrict processing of data under certain specified circumstances;
• Data Portability: when you have given your consent for the processing of your data, you have the right to request to receive or transfer your personal data to another organization of your choice, in a machine-readable form; and
• Withdraw consent to data processing: when you have given your consent for the processing of your data, you can withdraw your consent at any time, without justification.

You can exercise your rights described above by contacting privacy@altoneuroscience.com in the United States, or if in the UK, our Data Protection Officer at the following address: altoneuroscience.dpo@mydata-trust.info

If you would like to submit a complaint about our use of your personal data or our response to your requests regarding your personal data, you may contact us or submit a complaint to the data protection authority in the member state of your habitual residence, of your place of work, or where an alleged infringement took place. If you are in the UK, you can find the UK data protection authority’s contact details at https://ico.org.uk/.

9. Minors

Alto does not intend, and the Services are not designed to, attract or collect any personal data from or about children under the age of 18. If you are a parent or guardian of a child whom you believe may have provided personal data to us, please contact us (see the “Contact Us” section below).

10. Contact Us

If you have any questions regarding this Notice or how we process your personal data, please contact us using the details below:
Mailing Address: Alto Neuroscience, Inc., 650 Castro Street, Suite 450, Mountain View, CA 94041
Email:   privacy@altoneuroscience.com
Data protection officer (“DPO”): altoneuroscience.dpo@mydata-trust.info
UK Representative:  altoneuroscience.uk.dpr@mydata-trust.info
UK users: If you are located in the UK, you have the right to lodge a complaint with your data protection authority. However, we encourage you to contact us first so we can try to resolve your concerns.
UK Information Commissioner’s Office (“ICO”) website: https://ico.org.uk/