Privacy Policy

Effective date: July 29, 2026 Last updated: October 28, 2026

1. Introduction

Gather Bio, Inc. ("Gather Bio," "we," "us," or "our") is a Delaware corporation building research infrastructure for autoimmune disease. GatherChart is a service operated by Gather Bio, Inc. This Privacy Policy describes how we collect, use, and share information through our website at gatherchart.com (the "Site") and through the GatherChart service you can sign in to (the "Service"), including the conversations you have with GatherChart and the accounts and data sources you choose to connect.

This Policy does not cover participation in research studies or at-home testing. If we invite you to take part in those, they will be governed by separate consent documents that we will present to you before anything is collected, including any documents required by an independent Institutional Review Board (IRB).

By using the Site or the Service, or by creating an account, you agree to this Privacy Policy.

2. Information we collect on the Site

We collect the following information when you choose to provide it:

• Getting started. When you press Get started on the Site, you may enter your mobile number, and you agree to this Policy, our Terms of Use and our Consumer Health Data Policy. The number stays in your browser until you confirm it during onboarding (Section 3); we do not receive it before then. If you arrived from an advertisement, we record the advertising click identifier attached to the link you followed, and associate it with your account when you create one.
• Waitlist. If you join a waitlist instead, your name, email address, and optionally the condition that brought you to GatherChart.
• Any information you include when you contact us directly, such as the content of an email.
• Basic technical and usage information collected automatically when you visit the Site, such as your browser type, device type, pages viewed, referring page, timestamps, and general location inferred from your IP address.

How signing up works. When you sign up and during onboarding, we ask about your current health conditions and diagnoses and may ask related questions about your symptoms, diagnosis history, treatments, and medications. These questions are not limited to lupus or any single condition. Your answers contain health information. We store them with your account and use them to determine your eligibility for GatherChart, support your onboarding, and personalize your experience. We never use your health information for advertising. We also record the time you agreed to this Policy, our Terms of Use and our Consumer Health Data Policy, and which version of each you agreed to.

Our earlier sign-up form. Before October 9, 2026, people signed up through a form hosted for us by Jotform on a HIPAA-enabled account. That form collected your name, email address and zip code, your answer to whether you have an official lupus diagnosis from a healthcare professional and roughly when you received it, how you heard about us, and any advertising click identifier, and transmitted them to Gather Bio's own systems to decide eligibility, create your account invitation and email your sign-up link, and to support your onboarding. We keep those submissions as described in Section 10. If you would rather we delete yours, email us at hello@gatherbio.com.

3. Information we collect in the Service

When you create a GatherChart account and use the Service, we collect:

• Account information. Your name as it appears on your medical records, your email address, and either a password, which we store only in protected (hashed) form, or the Google account you sign in with. We also keep the record of your agreement to our policies described in Section 2.
• Your mobile number. During onboarding we ask for your mobile number and confirm it by texting you a code, which you enter in the Service. We record the number and when you confirmed it. Confirming it is not agreeing to texts: if you choose texting, we record that consent separately, with the time you gave it and the wording you agreed to.
• Your conversations. What you tell GatherChart in check-ins and chats — which may include how you are feeling, symptoms, and anything else you choose to share. We store these conversations to keep your record for you and to continue the conversation with context.
• Your WhatsApp connection. If you connect WhatsApp, we record the phone number your messages come from so we can recognize you. Messages you exchange with GatherChart over WhatsApp are delivered by WhatsApp, a Meta company, and are subject to WhatsApp's own terms and privacy policy while in transit on its network. We design the messages we send over WhatsApp to avoid including your medical records, results, or other health details — the details stay in the Service, and the thread carries the conversation.
• Your text-message connection. If you choose to text with GatherChart, your conversation with Gather happens at the number you confirmed. Texts are carried by the mobile carriers and, in future, by our SMS provider, Twilio. Members of our team can see the texts you send and Gather's replies; they handle them under confidentiality obligations and only to deliver your conversation and keep you safe. Text messages are not end-to-end encrypted, and they may appear on your phone's lock screen.

Beyond that, the Service is built around connections that you turn on one at a time. Every connection is off until you switch it on, and each collects the minimum it needs:

• Medical records. If you connect your patient portals or insurance records, you authorize us — through a patient records-access provider acting on your instruction — to retrieve your visits, diagnoses, treatments, lab results, and medications, and we store them to build your timeline in the Service.
• Voice notes. If you send voice notes, we store the audio and have it transcribed by a speech-to-text provider bound by confidentiality obligations, and we store the transcript as part of your conversation.
• Wearables and Apple Health. If you connect a wearable or import Apple Health data, we collect the health and activity metrics you authorize, such as sleep, heart rate, and activity.
• Calendar. If you connect your calendar, we request your free/busy intervals — the start and end times of busy periods — and, if you also allow it, permission to add events. We do not receive event titles, descriptions, attendees, or locations, and we use the intervals only to time our check-ins considerately. Adding events is used for one thing: when you ask GatherChart to remind you about something, we create that reminder as an event on your calendar so your own device can alert you. We do not read, change, or delete anything already in your calendar, and we do not add anything you did not ask for.
• Environmental context. If you turn on environmental context, we store your area only — a city, region, or zip code. Your precise coordinates are rounded on your device before anything is sent to us, and we never store them.

You can disconnect any of these at any time in Settings, which stops new collection from that source. You can ask us to delete what was already collected, as described in Section 10.

4. Analytics, cookies, and similar technologies

We use first-party analytics to understand how visitors find and use the Site. When you visit, we assign your browser a randomly generated visitor identifier and store it on your device using a cookie or equivalent browser storage. That identifier does not contain your name or contact information, but it persists across visits and lets us recognize a returning browser.

We log a record of each page you view, associated with that identifier, along with the technical and usage information described in Section 2. We use this to measure traffic, understand which pages and referral sources are useful, and improve the Site.

Sign-up steps. We also record which steps of signing up and onboarding you reach — for example, that you pressed Get started, created an account, confirmed your number, connected records, or chose WhatsApp or texting. These records carry your visitor identifier or your account, and never your name, number, email address or anything you wrote. We use them to see where signing up is hard and to fix it.

When you create an account, your visitor identifier is associated with it, which means analytics activity we have recorded for that browser can become linked to you.

You can clear or block cookies and similar storage through your browser settings. Blocking them may affect how parts of the Site function.

We honor the Global Privacy Control (GPC) signal. If your browser or a browser extension sends GPC, we do not assign your browser a visitor identifier, we do not log your pageviews or the sign-up steps you take before you have an account, and we do not store analytics information on your device. You can still sign up with GPC enabled — your account simply will not be linked to a browser identifier. The bot protection described in Section 5 still runs, because it is what keeps our forms usable.

5. Bot protection (Cloudflare Turnstile)

We use Cloudflare Turnstile to protect our forms from automated abuse and spam. Turnstile runs automatically in the background and may collect information about your browser, device, and interaction with the page in order to distinguish human visitors from bots. This information is processed by Cloudflare, Inc. as our service provider.

Cloudflare's handling of this information is described in the Cloudflare Turnstile Privacy Addendum and the Cloudflare Privacy Policy.

6. How we use information

We use the information we collect to:

• Assess eligibility: use your answers about your health conditions, diagnoses, symptoms, diagnosis history, treatments, and medications to determine your eligibility for GatherChart and assess your potential eligibility for clinical trials.
• Provide the Service: keep your record, organize what you and your connected sources tell us into one timeline, check in with you, and respond with context.
• Support your onboarding: confirm your mobile number, help you connect records and choose WhatsApp or texting, follow whether you finish, remind you once by text if you stop partway (where you agreed to texts), and honor the onboarding offer described on the Site, which includes checking your connected records against the eligibility criteria stated for that offer to confirm it applies to you.
• Add you to our waitlist and notify you when GatherChart opens to you.
• Respond to your questions and communicate with you about GatherChart and Gather Bio.
• Operate, maintain, secure, and improve the Site and the Service, including measuring traffic and protecting against fraud and automated abuse.
• Comply with legal obligations.

We do not use your health information for advertising, and we do not show you advertising.

7. How we share information

We do not sell your personal information. We share information only in these limited circumstances:

• With service providers who help us operate the Site and the Service under contractual confidentiality obligations — including providers of hosting and infrastructure, database services, form hosting (Jotform, on a HIPAA-enabled account, for the sign-up form we used before October 9, 2026), transactional email delivery (for sign-in codes), bot protection, message delivery (such as WhatsApp for conversations you choose to have there and, for text messages, the mobile carriers and, in future, Twilio), records access, transcription, and the data sources you choose to connect.
• With appropriate clinical trial sponsors or research teams, only after obtaining your permission, to explore clinical trials for which you may qualify. Sharing your information does not enroll you in a trial; participation requires separate study consent.
• When required by law, regulation, legal process, or governmental request.
• In connection with a corporate transaction such as a merger, acquisition, or financing, where information may be transferred subject to this Policy.

Text messaging. No mobile information will be shared with third parties or affiliates for marketing or promotional purposes. All the above categories exclude text messaging originator opt-in data and consent; this information will not be shared with any third parties. The mobile carriers, and in future our SMS provider, handle your number and your texts only to deliver them.

8. Google user data (Limited Use)

Connecting your calendar is optional, and if you do it, GatherChart receives data from Google APIs. This section describes exactly what we ask for and what we do with it, and it governs that data in addition to the rest of this Policy.

We request only these permissions, and only when you press “Connect Google Calendar”:

• See the availability on your calendars (calendar.freebusy) — we read only the start and end times of busy periods, so a check-in doesn't arrive in the middle of something. We never receive event titles, descriptions, attendees, or locations through this permission, because the Google endpoint it reaches does not return them. The busy times are used to choose a send time and are then discarded; they are not stored.
• View and edit events on your calendars (calendar.events) — used for exactly one action: creating a reminder event that you asked for, so your own device can alert you. GatherChart never reads, changes, or deletes an event, and never creates one you did not request.
• Your email address and basic account identity (openid, userinfo.email) — used only to show you which Google account you connected, so a calendar linked from the wrong account is visible to you rather than silently wrong.

GatherChart's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Specifically:

• We use Google user data only to provide and improve the user-facing features described above.
• We do not transfer Google user data to third parties except as necessary to provide or improve those features, to comply with applicable law, or as part of a merger, acquisition, or sale of assets with notice to users.
• We do not use Google user data for advertising, and we do not sell it.
• We do not use Google Workspace APIs data to develop, improve, or train generalized or non-personalized artificial intelligence or machine learning models. Calendar data is never sent to a model provider for training, and it is not used to build models that serve anyone other than you.
• No human reads your Google user data, except where you have given specific consent, where it is necessary for security purposes such as investigating abuse, to comply with applicable law, or where the data has been aggregated and de-identified.

Your Google refresh token is encrypted at rest and is used only to obtain short-lived access tokens for the two actions above. You can disconnect at any time from Settings, which revokes the token with Google and deletes it on our side, or from your Google Account permissions page.

9. Data security

We use commercially reasonable administrative, technical, and physical safeguards designed to protect your information. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

10. Data retention and deletion

We retain your account information and Service data, including your conversations and connected-source data, for as long as your account is active. We retain sign-up form submissions and waitlist information for as long as needed to operate the program, contact you, and support your onboarding, unless you ask us to delete it; a copy of each sign-up submission also remains with our form provider under its retention settings until we delete it there. We retain analytics records, including visitor identifiers, pageview logs and the sign-up step records described in Section 4, for up to 24 months, after which they are deleted or aggregated so they can no longer be linked to an individual browser. We keep a record of your consent to receive texts, and of any request to stop them, for as long as we need it to honor that choice, including after you stop texting with us. You may request deletion of your information at any time by emailing hello@gatherbio.com. We will respond to verified requests within the timeframes required by applicable law.

11. Your privacy rights

Depending on where you live, you may have rights to access, correct, delete, or restrict the use of your personal information, and to opt out of the sale or sharing of your personal information. We do not sell personal information. To exercise any of these rights, email hello@gatherbio.com. We will not discriminate against you for exercising your rights.

Residents of California, Washington, Virginia, Colorado, Connecticut, Texas, Utah, and other states with applicable privacy laws have specific rights under those laws. We honor verified requests in accordance with the law that applies to you.

12. Children's privacy

The Site is not directed to children under 18, and we do not knowingly collect personal information from children. If you believe a child has provided us information, email hello@gatherbio.com and we will delete it.

13. Changes to this Policy

We may update this Policy from time to time. When we do, we will revise the "Last updated" date above. Material changes will be communicated through the Site.

14. Contact us

Questions about this Policy or your information can be sent to: