Dyne Therapeutics, Inc. Privacy Statement
Last Updated: August 1, 2026
Dyne Therapeutics, Inc. (“Dyne” or the “Company” or “us” or “we”) recognizes and respects the privacy rights of individuals regarding their Personal Data (as defined below) and are committed to complying with all applicable data privacy laws. When we address “Personal Data,” we mean any information relating to an identifiable, living natural person. This Privacy Statement explains what types of Personal Data we may collect from you; how and why that data are collected, used, processed and protected; as well as how to exercise any privacy rights you may have with respect to the management of your Personal Data. This Privacy Statement applies to information we collect about you through our interactions with you, including when you visit our website(s).
Updates to This Privacy Statement
We may update this Privacy Statement from time to time. Please check this Statement periodically for any changes. When we materially update our Privacy Statement, we will take appropriate measures to inform you, consistent with the significance of the changes we make. You can see when this Privacy Statement was last updated by checking the “last updated” date displayed at the top of this Privacy Statement.
How to Contact Us
For questions or to send requests to exercise rights with respect to your data, please contact: privacy@dyne-tx.com
The Personal Data We Collect About You
Dyne may collect, use, store, process, and or share Personal Data from the following broad categories:
- Identity Data: Includes, for example, name, marital status, title, social security or similar national identification number, date of birth, and gender.
- Contact Data: Includes, for example, physical address, billing address, email address, and telephone number(s).
- Financial Data: Includes, for example, bank account, payment card details, insurance information, and payroll data.
- Transaction Data: Includes, for example, details related to payments and other details regarding services you have provided to or received from the Company or professional or educational credentials (for example, resumes/CVs).
- Technical Data: Includes, for example, internet protocol (IP) address, login data, browser type and version, time zone and location settings, browser plug-in types and versions, operating system, platform, and other technology on the devices you use to access the Dyne website.
- Profile Data: Includes, for example, your username and password to access any authenticated area of our website(s), your preferences, and feedback and survey responses.
- Usage Data: Includes, for example, information about how you use our website, products, or services.
- Marketing and Communications Data: Includes, for example, your preferences in receiving materials regarding our products and services communications from Dyne and our third parties in addition to your communication preferences.
- Special Categories of Personal Data: Includes information that most people would consider sensitive, for example, details about your race or ethnicity, sexual orientation, information about your health (including medical history, diagnoses, treatment details or clinical trial data collected in accordance with study protocols), and genetic and biometric data. Given its nature, this particular type of data is subject to heightened protections and treatment so it will only be processed as expressly permitted by applicable law.
How We Collect Personal Data About You
1. Information that you provide to us voluntarily and directly
You may choose to interact with us directly by completing forms or corresponding with us by electronic or written means or even by speaking to us over the phone. For example, you might sign up to receive clinical, educational, disease awareness, promotional or other information from Dyne; you might sign-up for our patient support services or programs; you might send us unsolicited information; you might otherwise express interest in participating in our offerings, research programs or clinical trials; you may be a potential or existing employee, contractor, consultant, partner or service provider who may be engaged for business reasons, for example, an eyecare provider or vendor.
During such interactions we will ask you to provide certain information voluntarily, which may include various categories of data like Identity Data, Contact Data, Financial Data, and in some instances, Special Categories of Personal Data.
2. Information that we collect automatically
information automatically from you and about you, such as Technical Data, which may include information from your device like your IP address, device type, unique device identification numbers, browser-type, preference settings, broad geographic location (e.g., country or city-level location) and other technical information. Some of this information is collected using cookies and similar tracking technologies. Collecting this information enables us to better understand the visitors who come to our website(s), where they come from, and what content on our website(s) is of interest to them. We use this information, including information collected using such technologies, for our internal analytics and marketing purposes, to improve the quality and relevance of our website(s) to our visitors, to track and respond to concerns, and to comply with regulatory monitoring and reporting obligations. You can find more information about our use of cookies and other tracking technologies in our in our “Cookies and Other Tracking Technologies” section below.
3. Information we receive from third parties (or publicly available sources)
We may receive categories of Personal Data about you from various third parties and/or public sources, such as:
- Technical Data from analytics providers such as Google, advertising networks, and search information providers.
- Contact Data, Financial Data, and Transaction Data from providers of technical, payment, recruitment and delivery services.
- Identity Data and Contact Data from publicly available sources.
- Special Categories of Personal Data, which may include health data, from, e.g., our service providers, collaborators, business partners, research partners (for example, clinical trial sites, investigators or contract research organizations) or services providers (for example, specialty pharmacy, infusion service, or patient support providers) who assist us in our work, including the offerings and services we may provide and the research we may conduct.
How We Use Your Personal Data
Dyne and/or our affiliates or service providers may use your Personal Data for various relevant purposes including, for example, to:
- Communicate with you;
- Provide you with offerings for which you expressed interest (for example, to provide scientific, medical, promotional or corporate updates or information);
- Provide you with services for which you expressed interest (for example, to provide patient support or infusion services);
- Conduct research and development activities (for example, conducting clinical trials or other studies) that advance scientific understanding of neuromuscular diseases;
- Help us develop additional products and services that are likely to be of interest to you or others like you, or those you care for;
- Investigate or respond to issues such as adverse events, product quality and other complaints, security threats or preventative measures against bad actors;
- Help us evaluate and modify our existing websites, products and services;
- Comply with or fulfill a request or inquiry that you have made;
- Maintain and develop our business or professional relationship with you (as applicable, for example by evaluating your candidacy for a role);
- Conduct depersonalized and aggregate statistical studies and research related to our products and services and the use of websites to help us understand trends and needs;
- As necessary, recognize you and allow you to log-on to certain pages and features for which you have registered;
- Exercise our legal and regulatory rights and obligations, including taking actions in furtherance of study participant safety; and
- Conduct and evaluate audits (such as compliance or corporate audits).
Marketing Use of Your Personal Data
We strive to provide you with choices regarding certain Personal Data uses, particularly around communications related to Dyne, our products and services. We may use your categorized Identity Data, Contact Data, Technical Data, Usage Data, and Profile Data to form a view on what we think you may want or need, or what may be of interest to you. This is how we decide which services and materials may be relevant for you. We may establish the following Personal Data control mechanisms:
- Opting in. You will receive certain communications from us if you have requested information from us and opted-in to receive such communications.
- Consent to third-party marketing. We will not share your Personal Data for marketing purposes with any company outside of Dyne and its service provider network unless you provide your express opt-in consent to do so.
- Opting out. You can ask us or third parties to stop sending you marketing messages at any time by following the opt-out links on any marketing message sent to you. Remember, however, that even if you opt-out of receiving these marketing communications, Dyne will still communicate with you to provide an offering that you request.
- Online Analytics. Dyne may use third-party web analytics services (such as, for example, Google Analytics) on our website(s) to collect and analyze the information discussed in this Statement, and to engage in auditing, research or reporting. The information (including your IP address) collected by various analytics technologies will be disclosed to or collected directly by these service providers, who evaluate information, including by noting the third-party website(s) from which you arrive, analyzing usage trends, assisting with fraud prevention, and providing certain features to you. To prevent Google Analytics from using your information for analytics, you may install the Google Analytics Opt-out Browser Add-on.
How We Share Your Personal Data
We do not sell your Personal Data. We may share your Personal Data with the following categories of parties for the purposes described in this Statement:
- Internal and Affiliated Parties: Individuals or groups within our Company or within our family of companies, like subsidiaries, parents or related corporate entities.
- Partners: Entities, service providers, consultancies or academic institutions, with whom we have formal professional relationships, for example research and clinical partners (including clinical trial sites, contract research organizations, and scientific collaborators) and patient support services providers (such as infusion providers or our patient support program provider).
- External Third Parties: Entities or individuals whose services we have formally retained to perform services on our behalf and help further our business requirements, including without limitation, for professional services, research, communications, technological maintenance, data storage, system administration, and data analysis and processing.
- Parties as part of a business transaction: Third parties to whom we may choose to sell, transfer, or merge parts of our business or our assets. If a change happens to our business, then the new owners may use your Personal Data in the same way as set out in this Privacy Statement.
- Government Authorities: Government agencies, regulators, safety reporting compliance bodies and other authorities as may be advisable under or required by law.
We do not allow our vendors and service providers to process your Personal Data for their own purposes and only permit them to process your Personal Data for specified purposes and in accordance with our instructions.
The Basis for Handling Your Personal Data
Dyne will only collect, process, and use the Personal Data described above where applicable laws allow us to do so. Simply put, we will do so only when we have your consent and/or when we have a legitimate business interest. In some cases, we may also have a legal or regulatory obligation to collect personal information from you, such as if there is a requirement to report an adverse event for our products. Please note that we may process your Personal Data based upon more than one lawful basis and legitimate interest depending upon the specific purpose(s) for which we are using the Personal Data. Dyne’s primary legitimate interests include the research, development, production, and promotion of pharmaceuticals aimed at delivering functional improvement for people living with genetically driven neuromuscular diseases.
If you have questions about or need further information concerning the legal basis on which we collect and use your Personal Data, please contact us using the contact details provided under the “How To Contact Us” section above.
How We Protect Your Personal Data
We have put in place technical and organizational security measures to prevent your Personal Data from being accidentally lost, impermissibly altered, disclosed, used, or accessed in an unauthorized way while it is under our control. Such safeguard include, but are not limited to, access controls, encryption and secure storage and monitoring and incident response protocols. In addition, we limit access to your Personal Data to those employees, agents, designees, and other third parties who have a business need to do so. Those parties will only process your Personal Data on our instructions, and they are subject to a duty of confidentiality.
We have implemented reasonable procedures to guard against and address data breaches. In the unlikely event of a breach implicating your Personal Data that requires notification, we will do so and fulfill all our related legal obligations.
Cookies and Other Tracking Technologies
As we have stated earlier, we may automatically collect some Personal Data when you visit and engage with our website(s) using Internet server logs, cookies, beacons, and/or other tracking technologies.
Cookies are small files that are automatically stored on your computer when you visit a website. Cookies are used to (a) recognize your device; (b) store your preferences and settings; (c) understand the web pages of the website you have visited; (d) perform searches and analytics; and (e) assist with security functions. Cookies perform many functions, such as allowing you to navigate between pages efficiently, remembering your preferences, and generally improving the user experience.
A web server log is a file where website activity is stored. An IP address is a number assigned to your device whenever you access the Internet that allows devices and servers to recognize and communicate with each other. Dyne may collect IP addresses to conduct system administration and report aggregate information to affiliates, business partners and/or service providers to conduct website and application analysis and performance reviews.
Beacons are small strings of code that are placed in websites, email messages, and/or online ads. Sometimes called “tracking pixels” or “pixel tags,” beacons are most often used in conjunction with cookies to track activity on websites. Since beacons are typically used in combination with cookies, if you disable cookies the beacons will only detect an anonymous website visit. When used in an email, beacons enable us to know whether you have received or opened the email and may be used for other analytics, personalization, and advertising.
If you do not wish to have cookies on your system, you can set your browser preferences to refuse them or to alert you when cookies are being sent. You are able to change our setting to notify you when a cookie is being placed or to block cookies altogether. For additional information, consult your browser’s “Help” section because controls and settings vary by browser.
If you choose to decline all cookies, you may not be able to fully experience all the features of our website(s). Some web browsers may transmit “do-not-track” signals to websites with which the browser communicates. Websites linked to this Privacy Statement do not currently respond to these “do-not-track” signals.
How Long We Will Retain Your Personal Data
We will only retain your Personal Data for as long as necessary to fulfill the purposes we collected it for, including for the purposes of satisfying any legal, accounting, or reporting requirements.
To determine the appropriate retention period for Personal Data, we consider the amount, nature, and sensitivity of the Personal Data, the potential risk of harm from unauthorized use or disclosure of your Personal Data, the purposes for which we process your Personal Data and whether we can achieve those purposes through other means, and the applicable legal requirements.
In some circumstances we may anonymize your Personal Data (so that it can no longer be associated with you) for research or statistical purposes in which case we may use this information indefinitely without further notice to you.
Acquisition or Sale of Business
We may sell, transfer, or otherwise share some or all of our business or assets, including your Personal Data and/or Consumer Health Data (as defined below), in connection with a business transaction (or potential business transaction) such as a merger, consolidation, acquisition, reorganization or sale of assets or in the event of bankruptcy. In such an event, Dyne will make all reasonable commercial and legal efforts to require the recipient to honor the terms of this Privacy Statement.
Effect of Other Privacy Statements or Notices
Dyne may have additional privacy statements or notices that are directed to and tailored for the different ways your Personal Data is collected. For example, clinical trial participants are provided with separate notices related to their Personal Data as collected for the trials.
If you receive a privacy statement or notice provided to you for a specific purpose, the terms of the more specific statement or notice will control to the extent that other statements or notices may differ from this Privacy Statement.
Links to Other Websites
Dyne may offer links to other sites that we believe may offer useful information to visitors of our website(s). The inclusion of a link on the Dyne website(s) does not imply our endorsement of the linked site or service. Dyne is not responsible for content that exists on third party websites. When you click on one of these links, you will be transferred from the website and be connected to the site of the organization or company that you selected. At such point, this Privacy Statement will not apply to your activity on the non-Dyne website(s). Each of these linked sites maintains its own independent privacy policies and procedures, which you should consult before providing any of your personal information.
Please note that linked third-party websites may also use cookies or other tracking technologies. We cannot control the use of cookies or other tracking technologies by any such third-party websites. For example, when you link from this site to a third-party website, that website may have the ability to recognize that you have come from our site by using cookies. If you have any questions about how third-party websites use cookies, you should contact such third parties directly.
After choosing to move to a third-party website, our Privacy Statement will no longer apply.
Children’s Privacy
Our website(s) and online services are not directed to children under the age of 18 and we do not intend for our website(s) or online services to be used by anyone under the age of 18. In some limited instances, we may collect Personal Data about individuals under the age of 18, but we will do so only with the proper consent of a parent or guardian as may be required by law. We do not otherwise knowingly collect or solicit data about or from children without the express consent of a parent or guardian. If a parent or guardian becomes aware that his or her child has provided us with Personal Data without proper adult consent, he or she should contact us as described in the “How To Contact Us” section above. In such an event, we will take reasonable steps to delete such data.
We do not knowingly collect Personal Data from children under the age of 13 on our website. If we become aware that we have collected Personal Data from children under the age of 13 on our website, we will take reasonable steps to delete such data.
“Do Not Track”
Some privacy regulations, such as the laws of California and Delaware, require affirmative indication of whether or not Dyne recognizes a browser’s ‘Do Not Track’ settings concerning targeted advertising. Dyne adheres to the standards set out in this Statement and does not monitor or respond to Do Not Track browser requests.
Jurisdictional Supplements
Supplemental Notice to California Residents
If you are California resident, please read this section carefully as it will supplement the other provisions of this Privacy Statement.
1. How We Use Your Personal Data
We will use your Personal Data only to the extent that our policies and the law authorized us to do so. Most commonly, we will use your Personal Data only where: you have given us your consent for a specific purpose; we need to perform a contract or directive concerning or from you; or when necessary for our business purposes and/or legitimate interests (or those of a third party) and your interests and fundamental rights do not override those interests.
Generally, you will have the right to withdraw your consent at any time for any future use of your Personal Data by contacting us using the contact information listed in the “How To Contact Us” section above.
We have set out below, in a table format, a description of all the ways we may use your Personal Data, and which of the corresponding legal bases we rely upon to do so. We may process your Personal Data for more than one lawful basis depending on the specific purpose for which we are using your data. Please contact us if you would like additional details about the specific legal basis we are relying on to process your Personal Data where more than one basis has been set out in the table below.
| Purpose/Activity | Category of Personal Data | Lawful basis for processing |
|---|---|---|
To engage you as a new vendor or other service provider, contractor, consultant or employee |
|
|
|
To process and deliver products or services including:
|
|
|
|
To manage our relationship with you which may include:
|
|
|
|
To enable you to complete a request for information related to patient services registration, prescription fulfillment or other similar services |
|
|
|
To administer and protect our business and our intranet and website(s) (including troubleshooting, data analysis, testing, system maintenance, support, reporting and hosting of data) |
|
|
|
To deliver relevant content on website(s), marketing to you and to understand the effectiveness of our marketing activities |
|
|
|
To use data analytics to improve our website(s), products/services, marketing, customer relationships and experiences |
|
|
|
To make suggestions and recommendations to you about goods or services that may be of interest to you |
|
|
|
To conduct a research program (including conducting clinical trials) or provide our products |
|
|
2. Your Rights as a Data Subject
Californians have certain rights with respect to the collection and use of their Personal Data, as may be provided for by the California Consumer Privacy Act, or other law. Such rights include:
- Right to Receive Information on Privacy Practices (as you receive in this supplemental section and throughout the Dyne Privacy Statement);
- Right to Delete certain Personal Data collected from you;
- Right to Correct certain inaccurate Personal Data that we might maintain about you;
- Right to Know, for the period of the prior twelve months, the categories of Personal Data we have collected from you and the specific pieces of Personal Data we have collected about you, the categories of sources from which we have collected such data, the commercial purpose for such collection, the categories of Personal Data that have been shared with or disclosed to third parties and the length of time we intend to retain each category of Personal Data about you;
- Right to Non-Discrimination if you have chosen to exercise any of your data subject rights;
- Right to Appeal a dispositive decision we make concerning a data subject request you may submit;
- Right to Restrict or Limit the Use of Sensitive Personal Information, a right that allows you – at any time – to direct us to limit the use of your sensitive personal information only to the use(s) necessary to perform the services requested by you; and
- Right to Opt Out of Sharing or Disclosing of Personal Information, a right that allows you to direct us not to share or disclose your personal information.
You may exercise the data subject rights applicable to you under the applicable U.S. state privacy law by contacting us at privacy@dyne-tx.com. While we will make reasonable efforts to accommodate your request, we reserve the right to impose certain restrictions or requirements on your request, if allowed by or required by applicable law.
Dyne has not sold or shared Personal Data about California consumers to third parties for their own use in the previous twelve months. Relatedly, we do not have actual knowledge that we sell or share Personal Information of California consumers under 16 years of age. However, we may share your personal information with our affiliates and trusted partners in arrangements that may meet the broad definition of “sale” or “share” under California law. In these arrangements, use of the information we share is limited by policies, contracts, or similar restrictions.
Changes to this Supplemental Notice. We reserve the right to amend this Supplemental Notice at our discretion and at any time. When we make material changes to this Supplemental Notice, we will notify you by posting an updated Supplemental Notice on our website and listing the effective date of such updates.
California’s Shine the Light Law (California Civil Code Section 1798.83) permits certain California residents who are individual customers to request certain information regarding its disclosure of “personal information” to third parties for their direct marketing purposes. To make such a request, please contact us using our contact information listed in the “How To Contact Us” section above.
Supplemental Notice to Nevada Residents
Section 603A of the Nevada Revised Statutes permits certain Nevada residents who are “consumers” to submit a request at any time to an “operator” of a website in Nevada directing the operator not to make any sale of any “covered information” the operator has collected or will collect about the consumer. Dyne does not currently “sell” or plan to sell covered information as defined in the Nevada law. If you are a Nevada resident, you may submit a verified request by contacting us by sending an email or contacting us by using the information provided in the “How To Contact Us” section above.
Supplemental European Economic Area (“EEA”), United Kingdom (“UK”), and Switzerland Privacy Statement
If you are resident within the European Union (“EU”), European Economic Area, Switzerland, or the United Kingdom, please read this section carefully as it will supplement the other provisions of this Privacy Statement.
1. How We Use Your Personal Data
We will use your Personal Data only when the law allows us to do so. Most commonly, we will use your Personal Data in the following circumstances:
- Where you have given us your consent, for a specific purpose.
- Where we need to perform the contract, we are about to enter into or have entered into with you.
- Where it is necessary for our legitimate interests (or those of a third party) and your interests and fundamental rights do not override those interests.
- Where we need to comply with a legal or regulatory obligation.
- Where necessary for scientific research purposes.
- Where we need to protect your vital interests or the vital interests of another natural person.
- Where it is needed in order to perform a task in the public interest or to exercise official authority.
Generally, you will have the right to withdraw your consent at any time by contacting us using the contact information listed in the “How To Contact Us” section above.
We have set out below, in a table format, a description of all the ways we may use your Personal Data, and which of the corresponding legal bases we rely upon to do so. We have also identified what our legitimate interests are where appropriate.
Note that we may process your Personal Data for more than one lawful basis depending on the specific purpose for which we are using your data. Please contact us if you need additional details about the specific legal basis we are relying on to process your Personal Data where more than one basis has been set out above in the section entitled:
- “JURISDICTIONAL SUPPLEMENTS: SUPPLEMENTAL NOTICE TO CALIFORNIA RESIDENTS – How we Use Your Personal Data.”
2. Change of Purpose
We will only use your Personal Data for the purposes for which we collected it, unless we need to use it for another reason and that reason is compatible with the original purpose. If we need to use your Personal Data for an unrelated purpose, we will notify you and we will explain the legal basis which allows us to do so.
We may process your Personal Data without your express knowledge or consent, in compliance with the above rules, where this is required or permitted by law.
3. Clinical Trials
To the extent that Dyne may undertake clinical trial studies within the EEA, Switzerland or the UK, we may also use information from clinical trial participants’ medical records and other health data in order to conduct clinical or scientific research to improve healthcare. Dyne may contract with specialized service providers, such as Contract Research Organizations (“CROs”), clinical trial sites or other service partners, typically as data processors, to collect the Personal Data of the participants of the clinical trial and to manage the clinical trials that we sponsor. We may then process key-coded or pseudonymized Personal Data of clinical trial participants which means that we do not have direct or immediate access to their identifiable Personal Data (except, for example, to comply with legal requirements such as those related to our pharmacovigilance obligations).
We would have a legitimate interest in using information related to your health for research studies when you agree to take part in a research study by providing your informed consent to participate. Our exception to the general provision at Article 9(1) of the General Data Protection Regulation (GDPR), or other analogous provision, not to process special categories of data is that processing is necessary for scientific research purposes in accordance with Article 89 of the GDPR, or other analogous provision. This means that we will use your Personal Data collected in the course of a research study when we act as the data controller for such studies in the ways needed to conduct and analyze the research study. Your rights to access, change or move your Personal Data may be limited, as we need to manage your information in specific ways in order for the research to be reliable and accurate. If you withdraw from the study, we will keep the information about you that we have already obtained. To safeguard your rights, we will use only the minimum Personal Data needed for these purposes.
In addition, the Personal Data of potential and actual site investigators, employees or contractors may also be collected directly by Dyne or through the CRO that we may work with and is typically used, for example, to verify the individual’s qualifications, satisfy documentation requirements for the purpose of the clinical trial, to verify financial disclosures to avoid any conflict of interest and to otherwise conduct and analyze the research study.
Please see the “How We Use Your Personal Data” section of the “Jurisdictional Supplements: Supplemental Notice to California Residents” above for additional information about the collection and use of Personal Data.
4. International Transfers of Personal Data
Dyne is headquartered in the United States of America, so the processing of your Personal Data may involve a transfer of data outside the EEA, Switzerland or the UK.
Whenever we transfer your Personal Data out of the EEA, Switzerland or UK, we ensure an adequate and similar degree of protection is afforded to it by ensuring at least one of the following safeguards is implemented:
- We will only transfer your Personal Data to countries or entities that have been deemed by the applicable supervisory authority to provide an adequate level of protection for Personal Data;
- We will only transfer your Personal Data to countries or entities pursuant to the terms of binding data processing agreement and (as applicable) an agreement to comply with standard contractual clauses or binding corporate rules, each as approved by the European Commission or other regulators, as applicable;
- We will only transfer your Personal Data to countries or entities pursuant to the consent of the individual to whom the Personal Data pertains; or
- We will only transfer your Personal Data to countries or entities as otherwise authorized by the applicable laws and requirements of the EEA, UK or Switzerland.
5. Your Data Protection Rights
This section provides information on the rights that you may have under EEA, Switzerland or UK law in relation to your Personal Data. Under certain circumstances, individuals located in the EEA, Switzerland or UK have the ability to exercise the following data protection rights:
- To access their Personal Data.
- To correct their Personal Data.
- To erase their Personal Data.
- To object to the processing of their Personal Data.
- To restrict the processing of their Personal Data.
- To transfer their Personal Data.
- To not be subject to a decision based solely on automated processing, including profiling.
- To withdraw any consent that they have previously provided for the processing of their Personal Data.
To exercise any of the rights described above, please send a message to privacy@dyne-tx.com. Please be aware that your rights in relation to clinical research data may be limited.
Dyne has appointed a Data Protection Officer to serve as an initial point of contact on issues relating to Personal Data and its processing in the regions we operate. The contact information for the Data Protection Officer and the respective Data Protection Representative are as follows:
Data Protection Officer:
- Physical Address: MyData-TRUST S.A.
Avenue Lavoisier 18b, Wavre (BELGIUM) - Email Contact: DyneTherapeutics.dpo@mydata-trust.info
EU Data Protection Representative:
- Physical Address: MyData-TRUST France
Rue de Rennes, 140b, 75006 Paris (FRANCE) - Email Contact: Dynetherapeutics.dpr.eu@mydata-trust.info
To make a complaint concerning our Personal Data practices, you can also directly contact the applicable Supervisory Authority within the respective jurisdiction, for example, the EEA, Switzerland or the UK.
You will not have to pay a fee to access your Personal Data or to exercise any of the other rights. However, we may charge a reasonable fee or refuse to comply with your request if it is clearly unfounded, repetitive or excessive. We may need to request specific information from you to help us confirm your identity and ensure your right to access your Personal Data (or to exercise any of your other rights). This is a security measure to ensure that Personal Data is not disclosed to any person who has no right to receive it. We may also contact you to ask you for further information in relation to your request to speed up our response.
We try to respond to all legitimate requests in a timely fashion and as may be required by applicable law. Occasionally it may take us longer than usual if your request is particularly complex or you have made a number of requests. In this case, we will notify you and keep you updated.
Supplemental Notice for Japan
If you are resident of Japan please read this section carefully as it will supplement the other provisions of this Privacy Statement.
To the extent of any conflict between this Supplement and the general Privacy Statement, this Supplement governs the handling of personal information of individuals in Japan. This Supplement applies to personal information handled in connection with our activities in Japan and to other processing for which Japan’s Act on the Protection of Personal Information (Act No. 57 of 2003, as amended) (“APPI”) applies. APPI uses distinct terms, including “personal information,” “personal data,” and “retained personal data,” so, as used herein, those terms have the meanings assigned to them under APPI.
Separate privacy information may apply to particular services, programs, or relationships. Clinical-trial participants receive study-specific informed-consent and privacy materials before enrollment. Those materials provide more detailed information about the processing associated with the relevant study and should be read together with this Supplement.
1. Personal Information We May Handle
The personal information we handle depends on an individual’s relationship with us and may include:
- Contact and professional information, such as name, business contact details, employer, title, professional qualifications, and correspondence.
- Investigator, study-site, contract research organizations (“CROs”), laboratory, or vendor information, such as qualifications, training, financial disclosures, contracts, and trial-administration records.
- Safety, medical-information, and product-quality information, including information contained in adverse-event reports, medical inquiries, product complaints, and related follow-up communications.
- Clinical-research information, such as coded or key-coded study data, laboratory or imaging results, efficacy and safety information, and limited identifiable information where necessary for safety, regulatory, quality, reimbursement, legal, or similar purposes.
- Website, device, and communications information described in our general Privacy Statement.
- Other information provided to us by the individual, an authorized person, or a research or business partner.
Typically, we will receive only coded or key-coded study information rather than information that directly identifies a clinical-trial participant. The investigator site typically maintains the participant’s identity and source medical records, subject to the applicable protocol(s), agreements, regulation(s) and law(s).
2. Purposes of Use
We may use personal information for the following purposes, as applicable:
- Planning, conducting, monitoring, analyzing, documenting, and supporting clinical trials and other research sponsored or supported by us.
- Evaluating the safety, tolerability, efficacy, quality, and performance of investigational products and supporting product development.
- Receiving, assessing, following up, documenting, and reporting adverse events, product-quality complaints, medical inquiries, and other safety information.
- Preparing regulatory submissions and communicating with the Pharmaceuticals and Medical Devices Agency (PMDA), the Ministry of Health, Labour and Welfare (MHLW), and other competent authorities in Japan and other countries.
- Selecting and qualifying investigators, sites, CROs, laboratories, consultants, and vendors; administering agreements; reviewing financial disclosures; and managing study and business relationships.
- Conducting monitoring, audits, inspections, quality assurance, compliance reviews, investigations, and legal or regulatory recordkeeping.
- Analyzing research results and communicating or publishing results in aggregated or other appropriately protected form, as described in the applicable study materials and permitted by law.
- Responding to inquiries, operating and securing our systems, establishing or defending legal claims, and carrying out the additional purposes described in the general Privacy Statement.
- Using personal information for another compatible purpose or a purpose that is separately notified or consented to where required by law.
3. Special Care-Required Personal Information
Some information handled in connection with clinical research, safety reporting, or medical inquiries may constitute “special care-required personal information” under APPI. This may include certain medical history, diagnoses, treatment information, health-examination results, disability information, and other health-related information that falls within APPI’s statutory definition.
Genetic, biometric, image, audio, or video information may also constitute special care-required personal information depending on the information revealed and the manner in which it is processed; such information is not automatically special care-required personal information merely because of its format.
Where APPI requires consent to acquire special care-required personal information, the party acquiring the information will obtain the individual’s consent or rely on an applicable statutory exception. Consent to participate in a clinical trial and any consent required under APPI to acquire or transfer personal data are separate legal matters, although they may be documented in the same study materials.
4. Clinical Trials in Japan
We sponsor clinical trials in Japan and works with investigator sites, CROs, laboratories, and other research partners. We generally seek to receive coded or key-coded study information and may receive identifiable information where necessary for safety, regulatory, quality, reimbursement, legal, or similar purposes.
Before enrollment, clinical-trial participants receive study-specific informed-consent and privacy materials describing the collection, use, disclosure, international transfer, retention, and protection of information for the relevant study, together with the appropriate contacts for questions and requests. Those study-specific materials provide the more detailed notice for processing associated with that study and should be read together with this Supplement.
Withdrawal from a clinical trial does not necessarily require deletion of information already collected or prevent processing needed for participant safety, regulatory compliance, scientific integrity, legal obligations, or other purposes described in the study-specific materials and permitted by law.
5. Service Providers and Other Recipients
We may entrust personal information processing to CROs, laboratories, safety vendors, hosting providers, professional advisers, and other service providers within specified purposes. We take measures to select and supervise entrusted parties as required by applicable law and contract.
We may also provide personal data to investigator sites, healthcare professionals, regulatory authorities, affiliates, research collaborators, transaction counterparties, or other recipients with consent or another basis permitted under APPI Article 27. A recipient’s legal role depends on the particular processing activity and applicable law. The specific recipients and roles applicable to a clinical trial are described in the study-specific materials where required.
6. Transfers Outside of Japan
Personal data may be transferred from Japan to our headquarters in the United States, the European Economic Area (“EEA”), the United Kingdom and Switzerland and to other recipients outside Japan, including CROs, laboratories, safety vendors, service providers, affiliates, collaborators, and regulatory authorities. The destination countries and recipients depend on the relevant activity or clinical trial.
Where APPI requires consent for a transfer to a recipient in a foreign country, the party making the transfer will provide the information required by APPI before obtaining that consent. For clinical-trial participants, the applicable study-specific materials provide the operative information about relevant destinations, recipients, protective measures, and consent.
Where permitted by APPI, a transfer may instead be made to a recipient that has established a system designed to provide protections equivalent to those required under APPI, or on another basis permitted by law. In such cases, the transferring party will take the measures required by APPI to support continued implementation of the relevant protections and will provide information about those measures upon request to the extent required by law.
Where personal data is received in Japan from the EEA, the United Kingdom or Switzerland based on an applicable adequacy decision, the additional APPI Supplementary Rules applicable to that transfer will be followed.
7. Retention
We retain personal information for as long as reasonably necessary for the purposes described in this Supplement and the general Privacy Statement and for the periods required or permitted by applicable law. We, investigator sites, our clinical-trial in-country representative, and other trial parties retain the records for which each is responsible under J-GCP and other applicable legal, regulatory, scientific, safety, contractual, and litigation requirements.
8. Security and Incident Response
We maintain administrative, physical, and technical safeguards designed to protect retained personal data, taking into account the nature of the information and the risks involved.
We will report qualifying security incidents to the Personal Information Protection Commission and notify affected individuals as required by APPI or other applicable law or regulation.
9. APPI Article 32 Disclosure of Information Concerning Retained Personal Data
We disclose the following information regarding the entity responsible for retained personal data covered by this Supplement:
- Legal Entity: Dyne Therapeutics, Inc.
- Physical Address: 1560 Trapelo Road, Waltham, Massachusetts 02451, USA
- Corporate Representative: Legal Department
- Usage Purposes: See Section 3 of this Supplement, above, and any applicable provisions of our Privacy Statement.
- Security Controls: See Section 9 of this Supplement, above.
- Request and Complaint Procedures: See Section 11 of this Supplement, below.
10. Individual Rights and Requests
Subject to APPI’s requirements and exceptions, an individual may request notice of purpose, disclosure of retained personal information and certain third-party provision records, correction, addition or deletion of inaccurate information, cessation of use or erasure where statutory grounds exist, and cessation of third-party provision where statutory grounds exist, pursuant to Articles 33, 34 and 35, respectively.
A request may be limited or denied where APPI or another applicable law requires or permits. If we do not take all or part of the requested action, we will provide the notice required by law and will endeavor to explain the reason.
Requests concerning retained personal data that we hold may be submitted by email to:privacy@dyne-tx.com.
We may request information reasonably necessary to verify the requester’s identity and authority. An authorized agent may submit a request as permitted by law.
Our response to an individual’s personal information request may be limited or denied where APPI or another applicable law requires or permits.
Clinical-trial participants should ordinarily submit study-related questions and requests through the contact identified in the study-specific privacy materials.
11. Questions and Complaints
Questions, requests, or complaints concerning our handling of personal information may be submitted to:
- Email: privacy@dyne-tx.com
- Regular Mail: Dyne Therapeutics, Inc., Attn: Legal, 1560 Trapelo Road, Waltham, Massachusetts 02451, USA
12. Changes to this Supplement
We may update this Supplement from time to time. We will post the updated version and revise the “Last Updated” date. Where required by law, we will provide additional notice or obtain consent before materially changing how personal information is handled.
Dyne Therapeutics, Inc. Consumer Health Data Privacy Policy
Last Updated: August 1, 2026
1. Purpose
This “Consumer Health Data Privacy Policy” describes how Dyne collects, uses and/or processes Consumer Health Data in connection with this website and any of our other websites, mobile applications, online services that link to this Privacy Policy (collectively referred to as the “Sites”) or otherwise. Consumer Health Data generally means personal information that is linked or reasonably linkable to you and that identifies your past, present, or future physical or mental health status.
This policy supplements Dyne’s Privacy Statement and applies to personal information defined as “Consumer Health Data” which may be subject to the Washington State My Health My Data Act (“MHMD”) or similar laws addressing the governance of Consumer Health Data.
2. Consumer Health Data We Collect
We may collect your Consumer Health Data depending on the context of your interactions with us and the choices you make (including your established privacy settings), the services, products and features you use and applicable law. Consumer Health Data may include the following categories:
- Information about your health-related conditions, symptoms, status, diagnoses, testing, or treatments (including procedures, medications, or other interventions). For example, we may collect such information in the course of providing products or services to you or in response to your questions or requests for information.
- Information that could identify your attempt to seek health-related services or information.
- Other information that may be used to infer or derive data related to the above or other health information.
3. Sources of Consumer Health Data
We may collect Consumer Health Data directly from you, from your interactions with our products, services, communications, business associations and from third parties or publicly available sources.
4.0 Why We Collect and Use Consumer Health Data
We may use your Consumer Health Data for the following purposes:
4.1 To operate our Sites.
We may use your Consumer Health Data to:
- process and manage registrations you make through our Sites;
- provide information about our research, services, products, offerings, disease education or related resources;
- communicate with you regarding our programs, events, or activities for which you may have registered, including by sending you technical notices, updates, security alerts, and support and administrative messages;
- understand your needs and interests, and personalize your experience with our Sites;
- provide support and maintenance for our Sites; and
- respond to your requests and questions.
4.2 To send you marketing and promotional or educational communications.
We may send you communications regarding our products, services, offerings or relevant disease education or related resources as may be permitted by applicable law. You will have the ability to opt out of marketing and promotional communications. We encourage you to consult our main Privacy Statement at “Marketing Use of Your Personal Data”, above.
4.3 To comply with law.
We may use your Consumer Health Data as necessary or appropriate to comply with applicable laws, lawful requests and legal processes, such as to respond to requests from government authorities.
4.4 With your consent.
We may use or share your Consumer Health Data with your express consent, such as if, e.g., you consent to allow us post or publish your testimonials or experiences, you instruct us to take a specific action with respect to, or which may require the use of, your Consumer Health data, or you opt into third-party communications for the purposes of marketing and/or provision of products or services.
4.5 For compliance, fraud prevention and safety.
We may use your Consumer Health Data as necessary or appropriate to (a) enforce the terms and conditions that govern use of our Sites; (b) protect legal rights; or (c) protect, investigate and deter against fraudulent, harmful, unauthorized, unethical or illegal activity.
See the “How to Exercise Your Rights” section below for more details on the controls and choices you may have.
5.0 Third Parties with Which We May Share Consumer Health Data
We do not share your Consumer Health Data with third parties without your consent, except in the following circumstances:
5.1 Affiliates.
We may disclose your Consumer Health Data to our subsidiaries and corporate affiliates for purposes consistent with this Privacy Statement.
5.2 Service Providers.
We may share your Consumer Health Data with companies and individuals that provide services on our behalf, for example, patient support services, infusion service providers, specialty pharmacies/distributors, educational offerings, provision of products or other support, hosting, analytics, communications delivery, marketing, and database management services. These parties use personal information only as directed by us and in a manner consistent with this Privacy Statement and Dyne’s privacy practices.
5.3 Compliance with Laws and Law Enforcement; Protection and Safety.
We may disclose information about you to government or law enforcement officials or private parties as required by law, and disclose and use such information as we believe necessary or appropriate to (a) comply with applicable laws and lawful requests, such as to respond to requests from government authorities; (b) enforce the terms and conditions that govern use of the Sites; (c) protect the rights, privacy, safety or property of users of our Sites and (d) protect, investigate and deter against fraudulent, harmful, unauthorized, unethical or illegal activity.
5.4 Business Transfers.
We may sell, transfer, or otherwise share some or all of our business or assets, including your Consumer Health Data, in connection with a business transaction (or potential business transaction) such as a merger, consolidation, acquisition, reorganization or sale of assets or in the event of bankruptcy, in which case we will make all reasonable commercial and legal efforts to require the recipient to honor the terms of this Policy and our Privacy Statement.
6. Changes to This Consumer Health Data Privacy Policy
We reserve the right to amend this Privacy Policy but if we make material changes that significantly impact your privacy rights, we will notify you by updating the date of this Privacy Policy and posting it on the Sites.
We may, if required by law, also provide notification of changes in a manner reasonably likely to reach you, such as via e-mail (if you have provided your contact information) or through the Sites.
7. How to Exercise Your Rights and Contact Us
Some laws, including but not necessarily limited to the MHMD, provide certain rights to covered state residents with respect to Consumer Health Data, including, for example, the right to confirm, access, delete, or withdraw consent relating to such data, subject to certain exceptions.
To inquire as to and, if applicable, exercise any of the rights described above, or if you have any questions or concerns about this Consumer Health Data Privacy Policy, you may contact us at any time through any of the following methods.
- Mail: Dyne Therapeutics, Inc., Legal Department, at 1560 Trapelo Rd, Waltham, MA 02451
- Email: privacy@dyne-tx.com
If your request to exercise a right is denied, you may appeal that decision by contacting our privacy support at 1560 Trapelo Rd, Waltham, MA 02451. If your appeal is unsuccessful, you may be eligible to raise a concern or lodge a complaint with the Washington State Attorney General (if you are a resident of Washington State), the Nevada State Attorney General (if you are a resident of Nevada) or another state’s attorney general office depending on your state of residence.
