Consumer Health Data Privacy Policy

For Washington, Nevada and Connecticut Consumers Only

Consumer Health Data Privacy Policy

Last updated: April 2026

This “Consumer Health Data Privacy Policy” supplements the TScan Website Privacy Policy. It applies to personal information defined as “Consumer Health Data” under the Washington State My Health My Data Act, the Nevada State Consumer Health Privacy Law, and select provisions of the Connecticut Data Privacy Act (collectively, the “Consumer Health Data Laws”).

The Policy describes how TScan collects, uses and otherwise processes Consumer Health Data in connection with this website and any of our other websites, mobile applications, or online services that link to this Privacy Policy (collectively referred to as the “Sites”).

Consumer Health Data We Collect

Consumer Health Data means personal information that is linked or reasonably linkable to you and that identifies your past, present, or future physical or mental health status.

We may collect your Consumer Health Data depending on the context of your interactions with us and the choices you make (including your privacy settings) and applicable law. Because applicable laws define Consumer Health Data broadly, some of the categories of data we collect may, in certain instances, be considered Consumer Health Data, including:

• Information you provide to TScan about your health-related conditions, symptoms, status, diagnoses, testing, or treatments (including procedures, medications, or other interventions).
• Information that could identify your attempt to seek health-related services or information.
• Other information that may be used to infer or derive data related to the above or other health information.

Sources of Consumer Health Data

We may collect Consumer Health Data directly from you, from your interactions with our products and services, from authorized third parties and service providers, and from publicly available sources.

Why We Collect and Use Consumer Health Data

We may use your Consumer Health Data for the following purposes:

• To operate our Sites. We may use your Consumer Health Data to:
  • process and manage any registrations you make through our Sites;
  • understand your needs and interests, and personalize your experience with our Sites;
  • provide support and maintenance for our Sites; and
  • respond to your service-related requests, questions and feedback.
• To provide you with information. We may provide information about our research and development and communicate with you regarding our programs, events, or activities for which you may have registered, including by sending you technical notices, updates, security alerts, and support and administrative messages.
• To send you marketing and promotional communications. We may send you communications regarding our therapeutic products, as permitted by applicable law. You will have the ability to opt out of marketing and promotional communications. We encourage you to consult the TScan Website Privacy Policy for more information about the methods to opt out of such processing.
• To comply with law. We may use your Consumer Health Data as necessary or appropriate to comply with applicable laws, lawful requests and legal processes, such as to respond to requests from government authorities.
• With your consent. We may use or share your Consumer Health Data with your express consent, such as when you consent to let us post your testimonials or endorsements on our Sites, you instruct us to take a specific action with respect to your Consumer Health data, or you opt into third-party marketing communications or targeting cookies.
• For compliance, fraud prevention and safety. We may use your Consumer Health Data as necessary or appropriate to (a) enforce the terms and conditions that govern use of our Sites; (b) protect our rights, privacy, safety or property; and (c) protect, investigate and deter against fraudulent, harmful, unauthorized, unethical or illegal activity.

Third Parties with Which We Share Consumer Health Data

We do not share your Consumer Health Data with third parties without your consent, except in the following circumstances:

• Service Providers. We may share your Consumer Health Data with third-party companies and individuals that provide services on our behalf (such as hosting, analytics, email delivery, marketing, and database management services). These third parties use personal information only as directed by us and in a manner consistent with this Privacy Policy.
• Professional advisors. We may disclose your Consumer Health Data to professional advisors, such as lawyers, auditors and insurers, where necessary in the course of the professional services that they render to us.
• Compliance with Laws and Law Enforcement; Protection and Safety. We may disclose information about you to government or law enforcement officials or private parties as required by law, and disclose and use such information as we believe necessary or appropriate to (a) comply with applicable laws and lawful requests, such as to respond to requests from government authorities; (b) enforce the terms and conditions that govern use of the Sites; (c) protect the rights, privacy, safety or property of users of our Sites; and (d) protect, investigate and deter against fraudulent, harmful, unauthorized, unethical or illegal activity.
• Business Transfers. We may sell, transfer, or otherwise share some or all of our business or assets, including your Consumer Health Data, in connection with a business transaction (or potential business transaction) such as a merger, consolidation, acquisition, reorganization or sale of assets or in the event of bankruptcy, in which case we will make reasonable efforts to require the recipient to honor this Privacy Policy.

How to Exercise Your Rights

The Consumer Health Data laws provide you with rights regarding your Consumer Health Data, including the right to:

• Access or delete consumer health data about you;
• Receive a list of third parties and affiliates with whom your consumer health data has been shared; and
• Confirm, delete, or withdraw consent relating to your consumer health data, subject to certain exceptions.

To exercise any of the rights described above, you may contact us at any time using any of the following methods:

• Mail:
  TScan Therapeutics, Inc.
  880 Winter St.
  Waltham, MA 02451
  Attn: Privacy Officer
• Email: privacy@tscan.com

If your request to exercise a right is denied, you may appeal that decision by contacting our privacy support at privacy@tscan.com.

If your appeal is unsuccessful, you can raise a concern or lodge a complaint with the Washington State Attorney General, the Nevada State Attorney General, or the Connecticut Department of Consumer Protection depending on your state of residence.

Changes to this Privacy Policy

We may modify this Privacy Policy from time to time. If we make material changes that significantly impact your privacy rights, we will take reasonable steps to notify you by updating the date of this Privacy Policy.

Where required by law, we may also provide notification of changes in a manner reasonably likely to reach you, such as via e-mail (if you have provided it to us) or through the Sites.

Contact Us

If you have any questions or concerns about our Privacy Policy or would like to request this Privacy Policy in an alternative format due to a disability, please feel free to email us at privacy@tscan.com, or write to us at: