Enliven Therapeutics, Inc.

Adopted on June 10, 2026

A. Scope

This EU-US Data Privacy Framework Policy (the "Policy") sets forth the privacy principles that Enliven Therapeutics, Inc. and its subsidiaries (collectively, “Enliven”) follow with respect to personal data received from the European Economic Area (“EEA”), Switzerland and the United Kingdom (“UK”). 

Enliven has certified that it adheres to the EU-US Data Privacy Framework, UK Extension to the EU-US DPF, and the Swiss-U.S. Data Privacy Framework (collectively, “the DPF”) and the Principles of Notice, Choice, Accountability for Onward Transfer, Security, Data Integrity and Purpose Limitation, Access, and Recourse, Enforcement and Liability, as set forth by the US Department of Commerce. To learn more about the DPF program, and to view our certification page, please visit https://www.dataprivacyframework.gov/s/.

This Policy applies to the processing of personal data that Enliven receives in the United States concerning individuals who reside in the EEA, Switzerland and the UK. This Policy does not cover data from which individual persons cannot be identified.

Enliven employees who handle personal data from the EEA, Switzerland or the UK are required to comply with the principles stated in this Policy.

B. INFORMATION COLLECTED

Enliven may collect personal data about healthcare professionals, including clinical investigators and their staff; clinical study patients; Enliven suppliers, contractors, and their personnel; and Enliven’s current, prospective and former employees and consultants. Information collected includes, but is not limited to, curriculum vitae data, business contact information and other non-sensitive information.

Sensitive information may be collected in certain instances, including from clinical trial subjects and patients or potential clinical trial subjects and patients, with the consent of the individual or where otherwise required by applicable law. In some instances, prospective clinical trial subjects, patients or their family members may choose to provide personal data to Enliven via our websites in order to request information.

C. PURPOSES OF PROCESSING

Enliven processes personal data to facilitate the development and commercialization of its products and for its business purposes. Personal data may be used for purposes of clinical research, business development, marketing and sales, regulatory affairs, procurement, human resources management, and other Enliven business activities.

Enliven transfers personal data to third-party processors providing a variety of services, including, but not limited to, clinical trial operations, payroll, systems hosting, and sales and marketing activities. 

D. ONWARD TRANSFERS TO THIRD PARTIES

Enliven will take measures to obtain assurances (including contractual provisions) from third-party service providers that process personal data on Enliven’s behalf that they will process such information in a manner consistent with Enliven policies and DPF Principles. Enliven is responsible under the DPF Principles for any damage caused by Enliven’s Service Providers who process personal data on Enliven’s behalf in a manner inconsistent with the DPF Principles. Enliven is not responsible for damages resulting from Service Providers processing personal data outside of the specific terms of the agreement between the parties. Enliven will take measures to only disclose personal data that is necessary for its Service Providers to provide  relevant services to Enliven. Where Enliven has knowledge that a third-party is using or disclosing personal data in a manner contrary to Enliven’ privacy policies or DPF Principles, Enliven will take reasonable steps to prevent or stop the use or disclosure. 

Enliven may be required to disclose personal data in response to lawful requests by public authorities, including to meet national security or law enforcement requirements. 

E. ACCESS

Upon request, and as required by DPF Principles and applicable law, Enliven will provide individuals with reasonable access to personal data that Enliven possesses about them. Enliven will also take reasonable steps to allow individuals to review personal data for the purposes of correcting, amending or deleting such information in instances where personal data is demonstrated to be incomplete or inaccurate. 

Individuals can contact Enliven at dpo@enliventherapeutics.com in order to request access or to make inquiries regarding limiting the use and disclosure of personal data about them. 

F. DISPUTE RESOLUTION

Enliven is subject to the investigatory and enforcement powers of the US Federal Trade Commission. 
Any questions or concerns regarding the use or disclosure of personal data should be directed to the Enliven addresses provided below. Enliven will investigate and attempt to resolve complaints and disputes regarding use and disclosure of personal data by reference to DPF Principles.

In addition, Enliven has agreed to participate in the following independent dispute resolution procedure in the investigation and resolution of complaints to resolve disputes pursuant to the DPF Principles: 

1. JAMS
Information about how to file a complaint with the JAMS DPF program can be found at: https://www.jamsadr.com/eu-us-data-privacy-framework.  

An individual may invoke binding arbitration, at his or her own cost, subject to procedures set forth by the DPF. 

G. COMPLIANCE 

This Policy may be amended from time to time, to remain consistent with the requirements of the DPF Principles. Enliven will provide appropriate notice about such amendments. This Policy will be reviewed annually by Enliven’s Chief Legal Officer or their delegates.

H. CONTACT INFORMATION 

e-mail: dpo@enliventherapeutics.com