Your privacy is important to us. This Privacy Notice (“Notice”) will let you know what personal information (“PI”) DICE Therapeutics, Inc., a wholly owned subsidiary of Eli Lilly and Company (“DICE” “we,” “us,” or “our”), and Eli Lilly and Company (“Lilly”) and/or entities or persons that work on behalf of, or in partnership with, DICE but are not Lilly employees (“Third Parties”), may process (e.g., collect, record, organize, structure, store, adapt or alter, retrieve, consult, use, disclose by transmission, disseminate or otherwise make available, align or combine, restrict, erase, or destroy), how we protect it, and your rights and choices with respect to your PI. This Notice applies to websites, mobile applications, and digital services (“websites”) that link to or post it. This Notice applies to PI processed by us, including on our websites or other online/offline offerings. To make this Notice easier to read, our websites or other online/offline offerings will be referred as the “Services.” It is incorporated into and made a part of our Terms of Use for this website, which include provisions that limit our liability.

We may collect the following PI necessary for our business purposes:

• Basic Personal Details
  • e.g., name; alias; date of birth; gender; family member names; family, lifestyle & social circumstances; image/photograph/video; marital status; physical characteristics/descriptions; signature; voice/audio
• Behavioral Information
  • e.g., behavior; computer ergonomics; inferences reflecting preferences
• Criminal/Conviction Records
• Education & Skills
  • e.g., academic transcripts; Curriculum Vitae (CVs); educational background; languages; qualifications/certifications; training records/test scores
• Government Identifiers
  • e.g., driving license number; national identification number; national identity card details; passport number; social insurance number; tax ID number; U.S. Social Security Number; visa number
• Personal Contact Information
  • e.g., online identifiers (e.g., personal IP [Internet Protocol] address), email address, postal address, telephone number, unique personal identifier. This may also include information for your emergency contact(s).
• Professional Details
  • e.g., payment information; professional license number/status; professional memberships; reference/background checks
• Professional Contact Information
  • e.g., online identifiers (e.g., personal IP [Internet Protocol] address, email address, postal address, telephone number
• Protected Characteristics
  • e.g., nationality/citizenship; privately held political/philosophical/religious beliefs and opinions; racial or ethnic origin; sex life information; sexual orientation; trade union membership
• Social Media Information
  • e.g., social media account/contact/history
• Transactional Data
  • e.g., clinical trial participation; interactions with DICE and/or Lilly for products and services; speaking engagements; structured call notes; interactions with DICE and/or Lilly systems; audit logs; meeting minutes

Some of this PI may be considered sensitive under applicable laws, such as information about your health or medical diagnosis and demographic information collected in some circumstances, such as race, ethnic origin, and sexual orientation. We may process your sensitive PI with your consent, or as otherwise permitted by law.

In the ordinary course of business, we sometimes collect Social Security numbers to fulfill legal or regulatory obligations or for other administrative purposes. We respect the confidentiality of Social Security numbers and we avoid the unnecessary collection of them, limit access to them, and disclose them only (i) according to our internal privacy policy and procedures, (ii) with those third parties who are legally or contractually obligated to protect them, and (iii) as required or permitted by law.

We may de-identify certain information described above. To the extent we maintain and use-de-identified information in its de-identified form, and do not re-identify such information except as permitted by law, this de-identified information is not PI and is not subject to this Notice.

We may de-identify certain of the information described above. To the extent we maintain and use-de-identified information in its de-identified form, and do not re-identify such information except as permitted by law, this de-identified information is not PI and is not subject to this Privacy Statement.

We collect PI from:

• Adverse event reporters and subjects;
• Business partners;
• Clinical/medical investigators and staff conducting clinical/medical research;
• Consumers;
• Customers;
• Directly from you;
• Employees, former employees, potential employees, and their family members;
• Government officials;
• Healthcare professionals;
• Investors and shareholders;
• DICE systems and devices;
• Patients and clinical/medical trial participants;
• Publicly accessible sources; and
• Vendors, suppliers, contractors, and associations.

DICE, Lilly, and/or Third Parties may process PI for the following purposes:

• Activities for public health and interest;
• Activities as an employer to support and fulfill our obligations to our employees;
• Administration of our business processes;
• Business and market research;
• Contracting and business planning activities;
• Communicating information about our products and services;
• Compliance with legal or regulatory obligations (e.g., adverse event and product complaint reporting, exercising or defending legal claims, financial disclosure reporting, maintaining patient registries);
• Data analytics;
• Engaging scientific experts and leaders;
• Event management;
• Finance or tax activities;
• Marketing and sales of our products;
• Merger and acquisition due diligence;
• Product improvement and development;
• Recruitment and job placement;
• Registration for services;
• Responding to requests for information;
• Statistical analytics;
• Study recruitment and management, including monitoring of study activities;
• Validating your ability to access/use certain product, services, and information; and
• Administration of other legal and business processes that are in DICE’s legitimate interest, inclusive of company record retention, safeguarding our physical and electronic workplace, maintaining our systems and records (e.g., testing, validation, fixing software errors), and website management.

We may share your PI in compliance with applicable law with:

• Business partners;
• Government officials (e.g., law enforcement authorities, the courts, regulatory authorities);
• Health care professionals;
• DICE and Lilly employees and affiliates; and
• Vendors, suppliers, and contractors.

Where permitted by law, DICE may also enhance or merge information, including PI, with information obtained from third parties for the same purposes shared above. PI may also be used for profiling for the same purposes shared above. You may object to profiling via automated-decision making by contacting us using the information in the “How to Contact Us” section below.

You may choose not to share your PI, withdraw your consent to the processing of your PI, or restrict the processing of your PI, but we may not be able to provide you with certain information, products, or services.

This website is not intended for or designed for individuals under the age of 18. We do not knowingly collect PI from any person under the age of 18 unless a parent or guardian provides consent.

We may share your PI with the recipients listed above for purposes consistent with those identified in this Notice. These Third Parties have agreed to protect the information and to process it as directed by us (if acting on our behalf) or as required by law.

We may also be required to disclose your information in response to lawful requests by public authorities, including to comply with national security or law enforcement requests.

This website is owned and operated by DICE in the United States. Your PI may be transferred and processed by and between DICE, Lilly and its affiliates and wholly-owned subsidiaries, and Third Parties worldwide. When transferring PI across country borders, we utilize appropriate transfer mechanisms as applicable (which may include consent, Standard Contractual Clauses, existing adequacy decisions, intra-corporate data transfer agreements, etc.). To obtain additional information regarding the mechanism for transfers we have in place for cross-border transfers of PI, please contact us at DPO@dicetx.com.

PI will be saved for a period of time needed to fulfill legitimate and lawful business purposes in accordance with our record retention policies and applicable laws and regulations.

We provide reasonable physical, electronic, and procedural safeguards to protect PI we process and maintain. We limit access to PI to authorized employees and third parties who need access to perform the business activities in this notice. Although we strive to protect the PI we process and maintain, no security system can prevent all potential security breaches.

Upon verification of your identity, and as applicable by law, you have the right to request:

• information from us on how your PI is being used and with whom it is being shared;
• to see and receive a copy of the PI that we have about you;
• that we correct, restrict the processing of, and/or erase/delete your PI; and
• to have your information transmitted to another entity or person in a machine-readable format, in limited circumstances.

You also have the right to unsubscribe/opt out from communications or profiling for marketing, including direct marketing and object to profiling via automated decision-making.

If you would like to exercise any of these rights, you or your authorized representative may contact us as set forth in “Contact Us” below. In order to designate an authorized representative to make a request on your behalf, you must provide a valid power of attorney, the requester’s valid government-issued identification, and the authorized agent’s valid government issued identification.

We will process such requests in accordance with applicable laws. There may be exceptions that apply to your request. You may be entitled, in accordance with applicable law, to appeal a refusal to take action on your request. To do so, please contact us by using one of the methods listed in the “Contact Us” section below. You will not be discriminated against for exercising any of your rights.

If you are a resident of Nevada, you have the right to opt-out of the sale of certain personal information to third parties who intend to license or sell that personal information. Please note that we do not currently sell your personal information as sales are defined in Nevada Revised Statutes Chapter 603A. If you have any questions, please contact us as set forth in “Contact Us” below.

California residents who have an established business relationship with DICE may have the right to request information regarding DICE’s disclosure of certain PI to Third Parties for their direct marketing purposes. To make a request for such information, you may contact us using the information in the “How to Contact Us” section below.

California law entitles California residents to certain rights with regard to their PI. Those rights have been incorporated into this Notice under “Your Rights and Choices” section above.

Sale and Sharing of Personal Information

DICE does not sell PI about California consumers protected under the California Consumer Privacy Act of 2018 (“CCPA”) or California Privacy Rights Act (“CPRA”) to third parties or share such PI with third parties for targeted or cross-context behavioral advertising, as those terms are defined by applicable law. When DICE permits third parties to collect PI through our websites or discloses PI to third parties, DICE is doing so pursuant to various exceptions to the opt-out rights provided for under California law. For example, DICE permits third parties acting on its behalf to process PI for the business purposes described in this Notice, including advertising and marketing services (excluding cross-context behavioral advertising). In addition, DICE may permit third-party advertising solutions to process PI when you direct us to do so by agreeing to the use of such technologies to personalize DICE’s content and ads. Consistent with the above, Lilly does not sell or share for cross-context behavioral advertising PI relating to consumers who it knows are under 16 years of age.

Sensitive Personal Information

DICE does not use or disclose your sensitive PI except for limited purposes that are authorized by law. For example, DICE may collect information about your health or medical diagnosis to provide you specific functionality or products or services that you have requested. California law does not afford you rights to limit the use or disclosure of sensitive PI for these purposes, although we may nonetheless ask for your consent or provide you choices about how we use this information depending on the relevant context.

If you have questions about this Privacy Notice you may contact us at:

DICE Therapeutics, Inc.

400 East Jamie Court, Suite 300

South San Francisco, CA 94080

DPO@dicetx.com

info@dicetx.com

(650) 566-1402

If you wish to raise a complaint on how we have handled your PI, you can contact the Data Protection Officer at DPO@dicetx.com, who will investigate the matter. If you are not satisfied with our response or believe we are not processing your PI in accordance with the law, you can register a complaint with a relevant regulatory authority (e.g., a Data Protection Authority or Attorney General).

As a convenience to our visitors, this website may contain links to other sites owned and operated by Third Parties that may offer useful information. The policies and procedures we describe here do not apply to those sites. We are not responsible for the collection or use of PI at any third-party sites. Therefore, we disclaim any liability for any Third Party’s use of PI obtained through using the third-party website. We suggest contacting those sites directly for information on their privacy, security, data collection and distribution policies. Other company and product names are trademarks of their respective owners.

We may update this Privacy Statement from time to time. When we do update it, for your convenience, we will make the updated statement available on this page. We will always handle your PI in accordance with the Privacy Statement in effect at the time it was collected unless we provide you with the new notice and/or obtain your consent, as appropriate.

Last Updated: October 23, 2023