If you reside in California, please read this section for additional disclosures about how Kymera Therapeutics, Inc. (“Kymera,” “we,” “our,” or “us”) may collect, use, and disclose information about you, and for information about your rights under California law under the California Consumer Privacy Act (“CCPA,” including as amended by the California Privacy Rights Act (the “CPRA”)).

1. Information We May Collect About You

We collect personal data that identifies, relates to, describes, references, is capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular person or household (“Personal Information,” as defined by the CCPA).

Personal Information does not include:

• Publicly available information from government records;
• De-identified or aggregated consumer information; and
• Information excluded from the CCPA’s scope, such as health or medical information collected by entities directly subject to the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”) and the California Confidentiality of Medical Information Act (“CMIA”), clinical trial data or certain other research data; and

Over the last 12 months, we may have collected the information referenced in Section 2 of our Privacy Policy, “Personal Data We Collect About You,” which may include one or more of the following categories of Personal Information:

• Identifiers;
• Personal Information categories listed in the California Consumer Records statute (Cal. Civ. Code § 1798.80(e));
• Sensitive Personal Information (as defined in the CPRA);
• Internet or other electronic network activity information;
• Non-public education information;
• Professional or employment-related information;
• Characteristics of protected classifications under California or federal law;
• Biometric information;
• Audio, electronic, visual, or similar information;
• Geolocation data; and
• Inferences drawn from other Personal Information.

2. Sources of Personal Information

We may obtain the Personal Information from the following categories of sources:

• Directly from you or your agent;
• Indirectly from you or your agents (i.e., in the course of providing services);
• Directly and indirectly from activity on the Website (for example, from submissions through the Website or from the Website usage details collected automatically); and
• From third parties in connection with the provision of services.

3. Use of Personal Information

We and/or our service providers, vendors, and other third parties operating on our behalf use your personal data to conduct our business operations. Examples of how we may use the personal data we collect include to:

• Engage with you as a vendor, business partner, collaborator, or service provider;
• Recruit and discuss employment or consulting opportunities with you;
• Fulfil the purposes for which you provided the personal data or that were described when it was collected;
• Contact you to obtain more information or feedback;
• Provide you with information that you have requested;
• Perform and administer clinical trials, research, and product-improvement activities;
• Monitor pharmacovigilance, safety and quality of our products;
• Operate the Website;
• Use data analytics to help us evaluate and modify the Website and its content and our existing practices, products, offerings, and services
• Provide additional information that we believe may be of interest to you; or
• To comply with our regulatory and legal obligations, including, but not limited to, transparency reporting requirements, monitoring fraud and abuse, responding to legal process and other government or law enforcement agency requests.

Due to the nature of our business, Kymera may be subject to a number of legal requirements, thus requiring Kymera to Process Personal Information and sensitive information (including health information and mental and physical characteristics) to meet these requirements. When permissible under the law, we will attempt to limit and protection the Processing of your Personal Information to the extent possible, for example, pseudonymizing information, while still complying with our legal obligations.

4. How We Share Your Personal Information

Kymera does not “sell” (as such term is defined by the CCPA) your Personal Information. Kymera does not “share” (as such term is defined by the CPRA) your Personal Information.

We may share your personal data with the parties set out below for the purposes set out in Section 3 above (“Use of Personal Information”).

• Internal Parties: individuals or groups within Kymera to operate our business.
• Our Collaborators: our collaborators, including other companies and institutions, including those listed or referenced on the Website.
• External Third Parties: third parties who perform services or other activities on our behalf and help further our business objectives, including, without limitation, professional advisers.
• Parties as part of a business transaction: third parties to whom we may choose to sell, transfer, or merge parts of our business or our assets. If a change happens to our business, then the new owners may use your personal data in the same way as set out in this Privacy Policy.
• Government Authorities: the U.S. Federal Communications Commission, U.S. Internal Revenue Service, the U.S. Food and Drug Administration, the U.S. Federal Trade Commission and other government agencies, regulators and authorities (in the U.S. and around the world) as required to do so by law or in the good faith belief that such action is necessary to (i) comply with a legal obligation, (ii) protect and defend the rights or property of Kymera, (iii) act in urgent circumstances to protect the personal safety of users of the Website or the public, or (iv) protect against legal liability.

We require all third parties to respect the confidentiality of your personal data and to treat it in accordance with the law. We do not allow our third-party service providers to use your personal data for their own purposes and only permit them to process your personal data for specified purposes and in accordance with our instructions. We do not sell your personal data.

5. How Long We Retain Your Personal Information

We will only retain your personal data (which includes Personal Information for purposes of the California Consumer Privacy Act (“CCPA”)) for as long as necessary to fulfill the purposes for which we collected it. To determine the appropriate retention period for personal data (including Personal Information), we consider the amount, nature, and sensitivity of the personal data, the potential risk of harm from unauthorized use or disclosure of your personal data, the purposes for which we process your personal data and whether we can achieve those purposes through other means, and applicable legal requirements.

6. Your CCPA Rights

The CCPA provides California residents with specific rights (listed below and subsequently referred to as “CCPA Rights”), subject to some limitations and the verification of their identity, regarding their Personal Information:

1. The right to know about and request access to the specific pieces of Personal Information that Kymera has collected, used, shared, or sold about them, including the categories of information, sources, and business purposes of collection, as well as the categories of third parties to whom Kymera has disclosed or shared the Personal Information. You may only make a request twice within a 12-month calendar year;
2. The right to request deletion of their Personal Information (subject to certain exceptions);
3. The right to opt-out of the sale of their Personal Information, and under the CPRA, the right to opt-out of the sharing of certain Personal Information;
4. The right to receive equal service and price and not be discriminated against for exercising their CCPA Rights;
5. Under the CPRA, the right to correct inaccurate Personal Information; and
6. In certain circumstances, under the CPRA, the right to restrict the processing of Sensitive Personal Information.

For Kymera to process a request for you to exercise your CCPA Rights, we will first verify your identity by asking you to provide certain Personal Information. This may include a description of your relationship with Kymera, your first and last name, email address, telephone number, and postal address or other Personal Information that will allow us to verify your identity. Please submit your requests by contacting us at this number: by emailing us at privacy@kymeratx.com.

You may designate an authorized agent to exercise your CCPA Rights on your behalf in accordance with the CCPA. Kymera may require that you provide the authorized agent with written permission to act on your behalf and that the authorized agent verify his or her identity directly with us.

When you submit a request to exercise your CCPA Rights, Kymera will do its best to respond to your request as soon as possible after we verify your identity, and, in any event, no later than 45 days after receiving your request.

*****

Last Revised: November 17, 2023