Last updated: October 17, 2025

GondolaBio, LLC (“GondolaBio,” “we,” and/or “us”) values the privacy of individuals who use our websites, participate in our clinical trials, and engage with our related services (collectively, our “Services”). This Privacy Policy (the “Privacy Policy” or “Policy”) describes how we use and disclose such Personal Information from users of our Services, your rights and choices with respect to your Personal Information, and how you can contact us if you have any questions or concerns. By using our Services, you agree to the collection, use, disclosure, and procedures this Privacy Policy describes.

1. Personal Information We Collect

In this Policy, “Personal Information” means any Personal Information relating to an identified or identifiable individual. We may collect Personal Information about you from various sources described below. Where applicable, we indicate whether and why you must provide us with your Personal Information, as well as the consequences of failing to do so. If you do not provide your Personal Information when requested, you may not be able to use the full extent of the Services if that Personal Information is necessary to provide you with the Services or if we are legally required to collect it.

Personal Information Provided by You

• Research Registration Personal Information. If you register to participate in our clinical trials, our research partners will ask you for your name, email, address, and other contact Personal Information. They may also ask for additional Personal Information, such as demographic Personal Information or Personal Information related to your medical or health conditions.
• Communications. When you contact us via a contact form, email, or other means, you provide us with Personal Information, such as your name, email address, the contents of a message or attachments that you may send to us, and other Personal Information you choose to provide.
• Careers. If you decide that you wish to apply for a job with us, you may submit your contact Personal Information and your resume online. We will collect the Personal Information you choose to provide on your resume, such as your education and employment experience. A third-party provider collects and stores this Personal Information on our behalf.
• Support Information. When you request technical support services, we will process your Personal Information such as your name and the contact details you use to contact us, as well as Personal Information on the reasons for your support request, and any additional Personal Information you may provide in that context.

Personal Information we Collect by Automated Means

• Location Information. When you use our Services, we receive your location Personal Information. For example we infer your location Personal Information by using your IP address.
• Device Information. We receive Personal Information about the device and software you use to access our Services, including IP address, device type, device identifiers, web browser type and version, and operating system version.
• Usage Information. We automatically receive Personal Information about your interactions with our Services, like the pages or other content you view, referrer Personal Information (the website you visited before coming to our Services), and the dates and times of your visits.
• Information from Cookies and Other Tracking Technologies. We and our third-party partners collect Personal Information about your activities on our Services using cookies, pixel tags, or other tracking technologies. Our third-party partners, such as analytics and security partners, may also use these technologies to collect Personal Information about your online activities over time and across different services. We and third-party service providers may use the following cookies:
  • Strictly necessary Cookies. Some cookies are strictly necessary to make our Services available to you, for example, to provide login functionality. We cannot provide you with the Services without this type of cookie.

    Cookie Name	Provider	Purpose	Expiry
    cookieyes-consent	cookieyes	CookieYes sets this cookie to remember users’ consent preferences so that their preferences are respected on subsequent visits to this site. It does not collect or store any personal information about the site visitors.	1 year
    _cfuvid	Vimeo	Cloudflare sets this cookie to track users across sessions to optimize user experience by maintaining session consistency and providing personalized services	session

  • Analytics Cookies. We also use Cookies for website and app analytics purposes in order to operate, maintain, and improve our Services. We may use our own analytics Cookies or use third-party analytics providers to collect and process certain analytics data on our behalf.

    Cookie Name	Provider	Purpose	Expiry
    _ga_*	Google	Google Analytics sets this cookie to store and count page views.	1 year 1 month 4 days
    _ga	Google	Google Analytics sets this cookie to calculate visitor, session and campaign data and track site usage for the site’s analytics report. The cookie stores information anonymously and assigns a randomly generated number to recognise unique visitors.	1 year 1 month 4 days

  • Functional Cookies. Functional cookies help perform certain functionalities like sharing the content of the website on social media platforms, collecting feedback, and other third-party features.

    Cookie Name	Provider	Purpose	Expiry
    __cf_bm	Vimeo	This cookie, set by Cloudflare, is used to support Cloudflare Bot Management.	1 hour

Personal Information Collected from Other Sources

• Personal Information from Third-party Services. If you choose to link our Services to a third-party account, we may receive Personal Information about you, including your profile Personal Information and your use of the third-party account. If you wish to limit the Personal Information available to us, you should visit the privacy settings of your third-party accounts to learn about your options.
• Research Partners. If you participate in a clinical trial, we may obtain pseudonymized Personal Information about you from our research partners, including providers of clinical trial operations services such as trial site personnel, investigators who provide you with investigational drugs, clinical research organizations, various laboratories, and imaging centers.
• Sponsored Events. If you attend meetings, conferences, symposiums, or workshops hosted by other organizations that we sponsor, we may receive Personal Information regarding your attendance from the organizations that conduct those events.
• Public Sources. We obtain Personal Information about you from public sources, such as public databases and websites. This Personal Information may include your name and professional Personal Information.

2. How We Use Personal Information

We use the Personal Information we collect for the following purposes:

• Providing the Services, including to operate, maintain, improve, and enhance our Services;
• Personalization, including to provide you with tailored content and recommendations;
• Analytics and Product Development, including to analyze how you use our Services and develop new products, services, features, and functionality;
• Communicating with You, including to contact you with updates and other Personal Information relating to our Services, provide Personal Information that you request, respond to comments and questions, and otherwise provide customer support;
• Integrations, including to facilitate the connection of third-party services or applications, such as social networks;
• Marketing, including advertising purposes such as developing and providing promotional and advertising materials that may be relevant, valuable, or otherwise of interest to you;
• Reports, including to generate anonymized or aggregate data containing only de-identified, non-Personal Information that we may use for any lawful purposes such as to publish reports;
• Employment, including processing any job application you submit to us;
• Fraud Prevention, including to find and prevent fraud and abuse, and respond to trust and safety issues that may arise;
• Legal, including for compliance purposes, enforcing our legal rights, or as may be required by applicable laws and regulations or requested by any judicial process or governmental agency; and
• Other Purposes for which we provide specific notice at the time the Personal Information is collected.

3. Legal Basis for the Processing of Personal Information

We rely on a legal basis to process your Personal Information, including:

• Consent. You have consented to the use of your Personal Information, for example to send you electronic marketing communications or for the use of certain cookies.
• Contract. We need your Personal Information to provide you with our Services and to respond to your inquiries.
• Legal Obligation. We have a legal obligation to use your Personal Information, for example to comply with tax and accounting obligations.
• Legitimate Interest. We or a third party have a legitimate interest in using your Personal Information. Specifically,  we have a legitimate interest in using your Personal Information for product development and analytics purposes, and otherwise to improve the safety, security and performance of the Services. We only rely on this legal basis when our or a third party’s legitimate interests are not overridden by your rights and interests.

4. How We Disclose Personal Information

We may disclose Personal Information about you in the following circumstances:

• Affiliates. We may disclose any Personal Information we receive to our current or future affiliates for any of the purposes described in this Privacy Policy. 
• Research Partners. We may disclose Personal Information to our research partners in order to facilitate studies.
• Vendors and Service Providers. We may disclose any Personal Information we receive to vendors and service providers retained in connection with the provision of our Services.
• Analytics Partners. We use analytics services such as Google Analytics to collect and process certain analytics data. You can learn more about Google’s practices by visiting https://www.google.com/policies/privacy/partners/.  
• As Required By Law and Similar Disclosures. We may access, preserve, and disclose your Personal Information if we believe doing so is required or appropriate to: (a) comply with law enforcement requests and legal process, such as a court order or subpoena; (b) respond to your requests; or (c) protect your, our, or others’ rights, property, or safety. For the avoidance of doubt, the disclosure of your Personal Information may occur if you post any objectionable content on or through the Services.
• Merger, Sale, or Other Asset Transfers. We may transfer your Personal Information to service providers, advisors, potential transactional partners, or other third parties in connection with the consideration, negotiation, or completion of a corporate transaction in which we are acquired by or merged with another company or we sell, liquidate, or transfer all or a portion of our assets. The use of your Personal Information following any of these events will be governed by the provisions of this Privacy Policy in effect at the time the applicable Personal Information was collected.
• Aggregated Information. We may use and disclose aggregated or otherwise de-identified information for any purpose, unless we are prohibited from doing so under applicable law.
• Consent. We may also disclose your Personal Information with your permission.

5. Your Choices

• Marketing Communications. You can unsubscribe from our promotional emails via the link provided in the emails. Even if you opt out of receiving promotional email messages from us, you will continue to receive administrative messages from us.

6. Your Rights

Depending on where you are located, including in the European Economic Area, the United Kingdom, and Switzerland (“Europe”), you may have the additional rights described below:

• Access and Correction. Access the Personal Information that we have about you, obtain a copy and have us correct or update it.
• Restriction, Anonymisation, Blocking or Deletion. Ask us to restrict, anonymise, block, or delete your Personal Information (unless we are legally obliged to keep it).
• Portability. Request us to transfer your Personal Information to another person, organisation or business of your choosing.
• Withdrawal of Consent. You may withdraw any consent you previously provided to us regarding the processing of your Personal Information at any time and free of charge. We will apply your preferences going forward and this will not affect the lawfulness of the processing before you withdrew your consent.
• Right to Object. Object at any time to the processing of your Personal Information where we rely on our legitimate interests.
• Complaints. Make a complaint by contacting us at hello@gondolabio.com, or by contacting the supervisory authority in your country of residence, place of work or where you believe we have not handled your Personal Information correctly.

You may exercise these rights by contacting us using the contact details indicated in the “Contact Information” section below. Before fulfilling your request, we may ask you to provide reasonable Personal Information to verify your identity. Please note that there are exceptions and limitations to each of these rights, and that while any changes you make will be reflected in active user databases instantly or within a reasonable period of time, we may retain Personal Information for backups, archiving, prevention of fraud and abuse, analytics, satisfaction of legal obligations, or where we otherwise reasonably believe that we have a legitimate reason to do so.

7. International Data Transfers

We may transfer your Personal Information outside of Europe and, in particular, to the United States, where the level of protection of Personal Information may be different than in your country. If we do so, we will comply with applicable data protection laws, in particular by relying on a European Commission or UK Government adequacy decision, rely on contractual protections for the transfer of your Personal Information such as the European Economic Area Standard Contractual Clauses or the UK International Data Transfer Agreement, or on Binding Corporate Rules. For more Personal Information about how we transfer Personal Information outside of Europe, or to obtain a copy of the contractual safeguards we use for such transfers (if applicable), please contact us as specified below.

8. Data Security

We make reasonable efforts to protect your Personal Information by using physical and electronic safeguards designed to improve the security of the Personal Information we maintain. However, because no electronic transmission or storage of Personal Information can be entirely secure, we can make no guarantees as to the security or privacy of your Personal Information, to the extent permitted by applicable law.

9. Data Retention

We take measures to delete your Personal Information or keep it in a form that does not permit identifying you when this Personal Information is no longer necessary for the purposes for which we process it, unless we are required by law to keep it for a longer period. When determining the retention period, we take into account various criteria, such as the type of products or services provided to you, the nature and length of our relationship with you, mandatory retention periods and the statute of limitations.

10. Third-Party Services

Our Services may contain features or links to websites and services provided by third parties. Any Personal Information you provide via these websites or services is provided directly to these third-party operators and is subject to their privacy policies, even if accessed through our Services. We encourage you to learn about these third parties’ policies before providing them with your Personal Information.

11. Children’s Privacy

We do not knowingly collect, maintain, or use Personal Information from children under 18 years of age, and no part of our Service is directed to children. If you learn that a child has provided us with Personal Information in violation of this Privacy Policy, then you may alert us at hello@gondolabio.com.

12. Changes and Updates to this Policy

We will post any adjustments to the Privacy Policy on this page, and the revised version will be effective when it is posted. If we materially change the ways in which we use or disclose Personal Information previously collected from you through the Services, we will notify you through the Services, by email, or other communication.

13. Our Contact Information

GondolaBio, LLC is the data controller and the entity responsible for the processing of your Personal Information. If you have any questions or comments about this Policy, our privacy practices, or if you would like to exercise your rights with respect to your Personal Information, please contact us by email at hello@gondolabio.com.

GondolaBio, LLC
3160 Porter Drive
Palo Alto, CA 94314
United States

You may also contact our EU representative at DPO.GondolaBio@twobirds.com or by writing to our representative at the below address.

Bird & Bird DPO Services SRL
Avenue Louise 235, Box 1
Brussels 1050
Belgium