Privacy Notice

Effective Date: October 15, 2025

Cullinan Therapeutics, Inc. (“Cullinan,” “our,” “we” or “us”) respects your privacy and we want you to be familiar with how we collect, use, share, or otherwise process, your Personal Information. This Privacy Notice is meant to help you understand our privacy practices related to the Personal Information we collect from you or that you share with us when you visit and interact with us, such as through our website(s), when you participate in our clinical programs, apply for employment, or have other interactions with us (collectively “Services”) where we display or reference this Privacy Notice.

We encourage you to read this entire Privacy Notice.

Personal Information we may collect and use

When you interact with our Services, we collect information that alone or in combination with other information in our possession could be used to identify you (“Personal Information”). Personal Information we collect includes:

Information you provide to us directly
Information related to our Websites and Services
Information collected through tracking technologies on our websites
Sensitive information
Other types of information

The type of Personal Information we collect depends on the nature of your interactions with us, our Services. For example, we may collect:

Contact information: Name, email address, telephone number, mailing address, etc.
Professional Information: Curriculum vitae/resume, employment history, education, specialty, etc.
Information collected through tracking technologies: IP address or other online identifiers
Inferences derived from other Personal Information that we collect: Social media profiles, or other public records or websites, as permitted
Other types of information as necessary to your use of our Services, participation in our Services or to fulfill your requests

We may use your Personal Information to:

Communicate with you, or respond to your communications or requests including questions related to products in development, or in market
Recruit candidates for participation in research opportunities, such as clinical studies, or in conducting clinical activities
Recruit for employment purposes, new-hire onboarding and other activities in the course of employment with Cullinan, which may include pre-employment screening, scheduling interviews, or communications regarding the application process, benefit administration, payroll, etc.
Process and manage safety and quality concerns
Provide you with our Services, or support-related activities
Develop and manufacture innovative therapies
Fulfill our obligations to you under an applicable contract or to conduct business with you
Analyze and improve our Services and business processes
Conduct surveys, or polls and obtain testimonials

Tailor marketing programs, administer retargeting messaging and profiling activities, and send you promotional materials, (e.g., newsletters)
Conduct other legitimate business activities, as allowed by applicable law
Comply with legal or regulatory requirements

Some of these activities may also involve the processing of Sensitive Personal Information, as described below.

Where permitted by law, we may also combine Personal Information collected through our website or online services with our offline records and information obtained from public or third-party sources. We use this consolidated information to improve our sites, enhance our marketing activities, and to facilitate other business functions. If necessary, or as required by applicable law, we will collect your consent or provide an opportunity for you to opt out of this type of processing.

Sensitive Personal Information

While offering our Services, we may also collect and process Personal Information that is of a sensitive nature, including information that may under certain laws be defined as Consumer Health Data. Examples of Sensitive Personal Information include:

Username and password that you may select in connection with establishing an account on our website
Precise geolocation
Disciplinary actions and/or criminal proceedings and/or sanctions
Identification information, such as identity cards, passport, visa, social security number or other taxpayer/government identification number like driving license details
Financial information, such as your bank account number for employment credit checks
Information related to your health and medical condition(s), which may include genetic data or biometric information, medical treatments, medications, test results, and/or information about your insurance
Other protected characteristics, such as your race or ethnicity, should you choose to share this information with us

We may use this Information to:

Facilitate recruitment, evaluate candidates for employment purposes and conduct employee-related activities, such as payroll and benefits
Provide and manage clinical research opportunities, patient support programs and other Services we offer
Process and manage safety and quality concerns
Conduct other legitimate business activities, as allowed by applicable law.

We will only process Sensitive Personal Information where we have your express consent, or as required or permitted under applicable law, for example, when necessary to comply with applicable law, respond to legitimate requests from government authorities, including authorities that may be outside of your country of residence, to protect or defend our legal interests, and if necessary, to protect the safety of our employees and other stakeholders. You may request to opt-out or limit the processing of your Sensitive Personal Information or Consumer Health Data by clicking the link “Limit The Use of My Sensitive Personal Information” on our websites or contacting us using the details found in the “Contact Us” section of this Notice.

Read our Consumer Health Data Privacy Notice Supplement for additional information on the processing of Consumer Health Data as defined under US state laws.

From time to time, we may collect additional categories of Personal Information where necessary to support specific activities. In such cases, we will ensure the information collected is consistent with the purposes described in this Privacy Notice, and where required, we will provide supplemental notice at the point of collection.

Cookies and other similar technologies

We use cookies and similar technologies (such as web beacons, tags, scripts and device identifiers) to collect and store analytics and other information when you use our Services, such as our website. The cookies we use include both first-party and third-party cookies. Cookies, or similar technologies, may provide us the following information:

The type of web browser software you use
The name of the domain from which you access the Internet (including client and server IP addresses, usernames, ports, queries, or other status-related information)
The Internet address of the website from which you linked directly to our Services
The date and time you access our Services
Which pages you have visited on our Services

Please refer to our Cookie Notice for further detail as to the cookies we use and for what purposes. You can manage your cookie consent through the Manage Cookie Consent link found at the bottom of our website. You can also click the link “Do Not Sell/Share My Personal Information” on our website to opt out of sharing your information with third parties or cookie providers who may use your Personal Information for their own purposes.

Information we share with third parties

We may disclose your Personal Information to third parties for various business purposes as described in this Privacy Notice or under specific circumstances, including:

To Service Providers working on our behalf, or providing services such as information technology, website hosting, communication and marketing activities, customer and patient services, and similar services in support of clinical trials, employee recruitment and employment activities
Third parties to whom you authorize us to disclose your Personal Information in connection with our Services
Business partners with whom we collaborate regarding our investigational products and programs, such as scientific advisors, joint venture partners and strategic collaboration partners
Legal, regulatory, or other enforcement authorities and other third parties if required to comply with law, regulation, or judicial process or to protect the security, rights, and property of Cullinan or of users of our websites
Third parties in the event Cullinan is involved in an actual or contemplated merger, acquisition, or sale of portion of its assets, or in the unlikely event of bankruptcy. If this occurs, the Personal Information will be subject to the policies of the receiving organization. We will further inform you of such business transfers as required in accordance with applicable laws
Third parties to protect rights and interests, such as when needed for corporate audits, to investigate or respond to a complaint or threat, or to exercise our legal rights

When we share your Personal Information for a business purpose we enter into a contract with these third parties that describes the purposes for sharing your Personal Information, requires the third-party recipient to protect the confidentiality and secure the Personal Information shared, and prohibits the use or disclosure of the Personal Information except in accordance with this Privacy Notice and for the purpose(s) of performing the services under the contract, or as necessary to comply with applicable law.

Cullinan may share Personal Information that would be defined as the “sale” or “sharing” of Personal Information under certain U.S. privacy laws, such as for targeted advertising, analytics or other marketing or sales activities. Because the information we sell, share, and process may allow for inferences to be made concerning health interests and conditions, we provide the following notice for compliance with U.S. privacy laws: NOTICE: We may sell your Sensitive Personal Information, including, where applicable, your contact information, professional information, tracking technologies information, inferences and other types of information necessary to your use of our Services.

How we safeguard your Personal Information

Cullinan implements reasonable technical, physical, and administrative security measures to protect Personal Information. However, despite these protections, no organization, including Cullinan, can completely guarantee that your Personal Information are not accessed by unauthorized people/bad actors. If Cullinan becomes aware that Personal Information has been compromised, we will promptly take steps to resolve the incident in accordance with applicable laws and regulations.

International transfers of Personal Information

Your Personal Information may be stored and processed in any country where we have facilities or in which we engage service providers. We will only permit the transfer your Personal Information when we are legally permitted to do so, for example, when we have established a legal basis such as:

When we must transfer the information to fulfill our obligations under a contract or agreement we have entered with you
When we must comply with a legal requirement such as required regulatory filings or reporting
For the protection of vital interests of individuals
For our legitimate business interests, and for other purposes allowed under applicable laws.

You should not use our Services if you do not want your Personal Information potentially transferred to, or otherwise processed in countries outside of your country of residence, which may have data protection rules that are different from those of your country. In certain circumstances, courts, law enforcement agencies, regulatory agencies or security authorities in those other countries may be entitled to access your Personal Information.

If you are located in the EEA, your Personal Information may be transferred to our affiliates or service providers in non-EEA countries that are recognized by the European Commission as providing an adequate level of data protection according to EEA standards. For transfers from the EEA to countries not considered adequate by the European Commission, we have put in place adequate measures to protect your Personal Information, such as standard contractual clauses approved by the European Commission.

Children’s Privacy

Our Services are not directed at, nor intended for children under the age of 18. We do not knowingly collect information from visitors to this website or users of our Services in this age group. We encourage parents to speak with their children about their use of the Internet and the information they disclose to or make available through our Services. Anyone under 16 years old should seek a parent or guardian’s permission, prior to using our website or disclosing any Personal Information to Cullinan.

Other Websites

Our website may contain links to other websites. Cullinan does not endorse, nor are we responsible for the operations or management of those other websites. Please be advised that this Privacy Notice does not apply to your use of those other websites. We encourage you to review their applicable privacy notices, policies, terms of use, etc., to understand how they collect, use and protect Personal Information.

Retaining your Personal Information

We will retain your Personal Information for the time period required or allowed by applicable law. Otherwise, we keep your Personal Information for as long as reasonably necessary to serve the purpose(s) for which it was collected.

Exercising your rights

You may contact us at privacy@cullinantx.com to request access to the Personal Information we have collected about you, or to update or correct Personal Information that you have provided to us.

You may have the right to request access to, modification, export or deletion of, your Personal Information under law. These rights are not absolute and may only apply in certain circumstances. This means that we may be unable (e.g., due to legal requirements) or not obligated to satisfy your request.

In some cases, we may need to collect additional Personal Information from you in order to verify your identity before providing you access to or deleting your Personal Information. Cullinan will not discriminate against you for exercising your rights, but we may not be able to provide you with Services that you have requested if we are not able to use your Data.

If you have provided permission (consent) to Cullinan to process your Personal Information, you have the right to withdraw your consent for such processing at any time by contacting us at privacy@cullinatx.com. You can click the link “Do Not Sell/Share My Personal Information” on our Website(s) to opt out of sharing your Data with any other cookie provider who may use your Personal Information for their own purposes. Please note that you can always unsubscribe from receiving emails by using the “Unsubscribe”-link provided in the emails you receive from us.

Residents of the EEA and certain US states have the right to lodge a complaint with the competent data protection authority if one is available in your country or US state. For convenience, EEA data protection authority contact information can be found here: EU National Data Protection Authorities.

How to contact us

If you have questions about this Privacy Notice or our privacy practices, or if you wish to submit requests or exercise your rights regarding your Personal Information as provided for by applicable law, please contact us at:

Cullinan Therapeutics, Inc.

One Main Street, Suite 1350

Cambridge, MA 02142

Email: privacy@cullinantx.com.

Phone: 1-833-257-0899

If you have any questions about a Cullinan clinical trial that you are participating (or have participated) in, please contact the Study Site directly.

Changes to this Privacy Notice

Cullinan may modify this Privacy Notice at any time, at our discretion. We encourage you to visit this page periodically and to review our most current Privacy Notice and applicable effective date.

Last Updated; October 15, 2025