Privacy Policy

1. Introduction

CREATE Medicines, Inc. ("CREATE," "we," "us," or "our") respects your privacy. This Privacy Policy explains how we collect, use, disclose, and protect personal information when you use our website, interact with us, or apply for a position through our online careers portal.

Clinical data not covered. This Privacy Policy covers personal information collected through our website and our online recruiting portal only. It does not apply to personal information collected in connection with clinical studies or other research activities, which are governed by study-specific informed consents and/or separate privacy notices provided to participants and investigators.

2. Information We Collect

Personal Information You Provide: We collect personal information that you choose to provide to us. For example, if you contact us with an inquiry, we may collect your name, email address, phone number, and any other information you include in your message. If you apply for a job through our third-party career's platform (e.g., via BambooHR), we will collect the information you submit in your application, such as your contact details, resume/CV, cover letter, and any other information you provide about your employment history or qualifications.

Information Collected Automatically: When you visit our site, we automatically collect certain technical information through cookies and other tracking technologies. This may include your IP address, browser type, device type, operating system, referring URLs, and pages viewed. We also collect data about how you interact with our website (for example, time spent on pages or links clicked) to help us understand and improve your experience.

Cookies and Tracking Technologies: We use cookies and similar technologies to enhance your experience and analyze usage of our site. Cookies are small text files stored on your device that allow us to recognize you and maintain your preferences. For more details on the cookies we use and your choices, please see our Cookie Policy.

3. How We Use Your Information

We use the personal information we collect for the following purposes:

To Respond to Inquiries: If you contact us (for example, by email or through a contact form), we will use your contact information and message to communicate with you and respond to your questions or requests.

To Process Job Applications: If you apply for a position with us via our career's portal, we use your information to review and evaluate your application, contact you about the recruitment process, and, if applicable, move forward with hiring procedures.

To Improve Our Website and Services: We use analytics tools to understand how visitors use our website. This helps us troubleshoot issues, analyze trends, and improve the content and functionality of our site. For instance, we may use aggregate usage data to see which pages are most visited or to assess the effectiveness of our communications.

To Comply with Legal Obligations: We may process and disclose personal information as required by applicable laws and regulations or to comply with a subpoena, court order, or other legal process. We also may use your information to enforce our Terms of Use, to detect or prevent fraud and security issues, or to protect our rights and the rights of others.

We will only use your personal information for the purposes described above or as otherwise disclosed to you at the time of collection. If we need to use your information for an unrelated purpose, we will notify you and, if required, seek your consent.

4. Sharing of Information

We do not sell your personal information. However, we may share your personal information in the following circumstances:

Service Providers: We share information with trusted third-party service providers who perform services on our behalf. For example, we use service providers for website hosting, data analytics, and managing our careers portal. Specifically, if you submit a job application, your information will be processed through our third-party HR platform (such as BambooHR) which collects and stores your application data for us. These service providers are contractually obligated to protect your information and use it only for the purposes of providing services to CREATE.

Affiliates and business partners. We may share limited personal information with our affiliates and, where appropriate, with collaboration or business partners solely to respond to your inquiries or as reasonably necessary for the purposes described in this Policy. These recipients are required to use the information only as permitted and to protect it appropriately.

Legal Compliance and Protection: We may disclose personal information if required to do so by law or if we believe in good faith that such action is necessary to (i) comply with a legal obligation or request (for example, responding to a subpoena or lawful government request), (ii) protect and defend the rights or property of CREATE, (iii) prevent fraud, security, or technical issues, or (iv) protect the personal safety of our users or the public.

Business Transfers: In the event CREATE is involved in a corporate transaction such as a merger, acquisition, reorganization, or sale of assets, or in the event of bankruptcy or receivership, your personal information may be transferred to a successor or affiliate as part of that transaction. In such cases, we will ensure that the recipient of the data is bound by privacy obligations that are at least as protective as those described in this Privacy Policy.

Aside from the purposes and sharing described above, CREATE will not share your personal information with third parties unless we have your consent or as otherwise outlined in this Privacy Policy.

5. Your Rights and Choices

You have certain rights and choices regarding your personal information:

Access, Correction, and Deletion: You may contact us at any time to request access to the personal information we hold about you. You also have the right to request that we correct or update any inaccurate or incomplete personal information. Additionally, you can ask us to delete personal information we hold about you. We will honor such requests to the extent required by applicable law; please note that we may need to retain certain information for legal or administrative purposes (for example, to comply with retention obligations or maintain audit logs).

Opt-Out of Communications: If we send you any marketing or promotional communications (such as emails about company news or events), you can opt out at any time by contacting us directly. Please note that even if you opt out of marketing messages, we may still send you informational communications (for example, responses to your inquiries or updates on a job application).

Cookie Preferences: You have choices about how cookies and similar technologies are used on our site. You can adjust your browser settings to refuse certain cookies or to alert you when cookies are being set. You can also use browser-based signals such as the Global Privacy Control (GPC) to indicate your preference. If our site detects a GPC signal from your browser, we will treat it as a request to opt out of non-essential cookies (such as analytics and targeting cookies), to the extent required by law. Please refer to our Cookie Policy for more information on how to control cookies.

GDPR (EEA/UK) Privacy Rights: If you are located in the European Economic Area (EEA) or the United Kingdom, you have additional rights under the General Data Protection Regulation (GDPR) and UK data protection laws. These rights may include the right to object to or restrict certain processing of your data, the right to data portability (to receive a copy of your personal data in a structured, commonly used format), and the right not to be subject to a decision based solely on automated processing. You also have the right to lodge a complaint with a supervisory data protection authority in your country if you believe we have infringed your privacy rights.

CCPA (California) Privacy Rights: If you are a California resident, you have specific rights under the California Consumer Privacy Act (CCPA), as amended by the CPRA. These include the right to know what personal information we collect, use, and disclose about you, the right to request deletion of your personal information (subject to certain exceptions), and the right to opt out of the sale or sharing of your personal information. However, CREATE does not sell personal information as defined under the CCPA. You also have the right not to receive discriminatory treatment for exercising your CCPA rights. If you would like to exercise any of these California rights, please contact us using the information provided below.

To exercise your rights or choices, please contact us at info@createmedicines.com. We may need to verify your identity before fulfilling certain requests, as required or permitted by law, to protect your privacy and security.

6. Data Security and Retention

Data Security: We take data security seriously and have implemented reasonable technical and organizational measures to protect your personal information from unauthorized access, loss, misuse, or alteration. These measures include (as appropriate) encryption, access controls, and secure data storage practices. However, please be aware that no method of transmitting or storing data is completely secure, and we cannot guarantee absolute security of information transmitted to our site. You are responsible for maintaining the confidentiality of any login credentials or accounts you use to access our site (if applicable).

Data Retention: We retain personal information only for as long as necessary to fulfill the purposes for which we collected it, unless a longer retention period is required or permitted by law. For example, if you contact us with a question, we will retain your information for as long as needed to respond and follow up, and for a reasonable period thereafter. If you apply for a job, we may retain your application information for the duration of the recruitment process and for a period after its conclusion, in accordance with applicable law and our record-keeping practices (for instance, to consider you for future opportunities or as required by employment laws). We also retain certain information as necessary to comply with legal obligations, resolve disputes, or enforce our agreements.

7. International Data Transfers

CREATE is headquartered in the United States, and our website is primarily operated from the United States. If you are accessing our site from outside the United States, be aware that your personal information may be transferred to, stored, and processed in the United States or other jurisdictions where our service providers are located. These countries may have data protection laws that are different from those in your country of residence and may not provide the same level of protection.

Regardless of where your information is processed, we will protect it as described in this Privacy Policy. CREATE will take appropriate safeguards to ensure that any cross-border data transfers comply with applicable data protection laws. This may include implementing Standard Contractual Clauses or relying on other lawful mechanisms for international data transfers. By using our site or submitting your information to us, you understand that your personal information may be transferred to our facilities and those third parties with whom we share it as described above.

8. Children's Privacy

Our website and services are not directed to children under the age of 13 (and in certain jurisdictions, under the age of 16). We do not knowingly collect personal information from children in these age groups. If you are under 13, please do not use this site or send us any personal information. If we learn that we have inadvertently collected personal information from a child under the relevant age without proper consent, we will take steps to delete that information as soon as possible. If you believe that a child under 13 (or 16, as applicable) may have provided us with personal information, please contact us at info@createmedicines.com so that we can investigate and address the issue promptly.

9. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, legal requirements, or for other operational reasons. When we make changes, we will revise the "Last Revised" date at the top of this Policy. If the changes are significant, we may provide a more prominent notice (such as by posting a notice on our website or emailing you, if we have your contact information and it's appropriate to do so). We encourage you to review this Privacy Policy periodically to stay informed about how we are protecting your information.

10. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or how CREATE handles your personal information, please contact us at:

Email: info@createmedicines.com
We will do our best to address your inquiry promptly and transparently.