Last Updated: June 12, 2026
Stoke Therapeutics, Inc. (“Stoke,” “Company,” “we,” “us,” or “our”) recognizes and respects the privacy rights of individuals regarding their personal data and is committed to complying with all applicable data privacy laws. This Privacy Statement explains what types of personal data we may collect from you; how and why that data is collected, used, processed and protected; as well as how to exercise any privacy rights you may have with respect to the management of your personal data.
This Privacy Statement applies to personal data we collect about you through our interactions with you, including when you visit our website(s) or other digital properties, participate in our patient support programs or clinical trials or interact with our educational resources, or engage with us as a job applicant or business partner.
UPDATES TO THIS PRIVACY STATEMENT
We may update this Privacy Statement from time to time. Please check this Statement periodically for any changes. When we materially update our Privacy Statement, we will take appropriate measures to inform you, consistent with the significance of the changes we make. You can see when this Privacy Statement was last updated by checking the “last updated” date displayed at the top of this Privacy Statement.
THE TYPES OF PERSONAL DATA STOKE MAY COLLECT ABOUT YOU
Stoke may collect, use, store, process and/or share the following categories of personal data:
Identity Data: Including, for example, name, marital status, title, social security or similar national identification number, date of birth, and gender.
Contact Data: Including, for example, physical address, billing address, email address, telephone number(s) and social media account identifiers.
Transaction Data: Including, for example, details related to payments and other details regarding services you have received or requested from Stoke.
Technical Data: Including, for example, internet protocol (IP) address, login data, browser type and version, time zone and location settings, location, browser plug-in types and versions, operating system, platform, device identifiers, mobile advertising identifiers, and other technology on the devices you use to access Stoke’s website(s) or digital properties.
Profile Data: Including, for example, your username and password to access any authenticated area of our website(s), your preferences, and feedback and survey responses.
Usage Data: Including, for example, information about how you use our website, products, and services, including pages visited, searches performed, and links clicked.
Marketing and Communications Data: Including, for example, your preferences in receiving materials regarding our products and services, communications from Stoke and our third parties, and your communication preferences.
Professional Data: Including, for example, information about healthcare professionals such as medical specialty, National Provider Identifier (NPI), institutional affiliations, prescribing history, and professional credentials.
Employment Data: Including, for example, information contained in CVs, cover letters, resumes, references, and other employment-related documentation.
Special Categories of Personal Data: Including information that most people may consider sensitive, for example, details about your race, ethnicity or citizenship status, sexual orientation, information about your health, and genetic and biometric data. We collect genetic information in connection with our clinical trials and research programs focused on precision medicines for genetic diseases and in connection with some of our services and products in those regards.
HOW STOKE COLLECTS PERSONAL DATA ABOUT YOU
Information That You Provide to Us Directly and Voluntarily
You may choose to interact with us directly by completing forms or corresponding with us by electronic or written means, or by speaking to us over the phone or in person. For example:
- Website Interactions: When you sign up to receive clinical, educational, disease awareness, promotional, or other information from Stoke or our partners; when you provide us with feedback or complete a survey; when you send us unsolicited information; or when you otherwise express interest in participating in our offerings or research programs.
- Clinical Trial Participation: When you apply to, enroll in or participate in our clinical trials, we collect health information which may include, e.g., genetic data, and other research-related data as described in the applicable informed consent and related documents.
- Patient Support Programs: When you apply to, enroll in or participate in patient support programs, we may collect health information which may include, e.g., insurance information, and other data necessary to provide such services.
- Healthcare Professional Interactions: When healthcare professionals interact with our medical affairs team, sales representatives, or attend conferences, training events, or educational programs, we may collect professional and business contact and similar information.
- Job Applications: When you apply for employment opportunities and submit your CV, cover letter, and related materials, we may collect educational and professional history and experience information.
- Product Safety Information: When you provide us with information about our products related to undesirable side effects, interactions, lack of effectiveness, quality complaints, and/or other aspects related to the safety or quality of our products, we may collect such information.
- Conferences and Trade Shows: When you interact with or express interest in Stoke at conferences and trade shows, we may collection information concerning your area(s) of interest and your contact information and similarly limited information about you.
Information That We Collect Automatically
When you visit and interact with our website(s) or digital properties, we may collect certain information automatically from you and about you, such as Technical Data, which may include information from your device like your IP address, device type, unique device identification numbers, browser-type, preference settings, broad geographic location (e.g., country or city-level location), and other technical information.
Some of this information is collected using cookies and similar tracking technologies. Collecting this information enables us to better understand the visitors who come to our website(s) or properties, where they come from, and what content on our website(s) is of interest to them. We use this information, including information collected using such technologies, for our internal analytics and marketing purposes, to improve the quality and relevance of our website(s) to our visitors, to track and respond to concerns, and to comply with regulatory monitoring and reporting obligations.
You can find more information about our use of cookies and other tracking technologies in our “Cookies and Other Tracking Technologies” section below.
Information We Receive from Third Parties or Publicly Available Sources
We may receive categories of personal data about you from various third parties and public sources, such as:
- Technical Data from analytics providers such as Google, advertising networks, and search information providers.
- Contact Data, Financial Data, and Transaction Data from providers of technical, payment, and delivery services.
- Identity Data and Contact Data from publicly available and third-party information provider sources.
- Special Categories of Personal Data, which may include health data, from our service providers, collaborators, or business partners who lawfully assist us in our work and the offerings we may provide.
- Information from healthcare providers, patient advocacy groups, educational institutions, and other business partners in the context of clinical research, market research, disease awareness campaigns, mentoring programs, training events, adverse events, or managing complaints.
- Information from third-party information providers, including industry-dedicated services.
- Information from publicly available sources like social media and professional or industry platforms and networks.
HOW STOKE MAY USE YOUR PERSONAL DATA
Stoke and/or our affiliates or service providers may use your personal data for various relevant purposes including, for example, to:
- Communicate with you;
- Provide you with offerings for which you expressed interest;
- Help us develop additional products and services that are likely to be of interest to you or others like you, or those you care for;
- Investigate or respond to issues such as complaints, security threats, or preventative measures against bad actors;
- Help us evaluate and modify our existing products and services;
- Comply with or fulfill a request that you have made or issue you have submitted;
- Maintain and develop our business or professional relationship with you (as applicable);
- Conduct statistical studies and research related to our products and services and the use of websites to help us understand trends and needs;
- As necessary, recognize you and allow you to log-on to certain pages and features for which you have registered;
- Exercise our legal and regulatory rights and obligations, including taking actions in furtherance of safety or security;
- Conduct and evaluate audits (such as compliance or corporate audits);
- Conduct clinical trials and other research studies, including analyzing research data and reporting results;
- Manage and facilitate patient support programs and related services;
- Process job applications and manage employment relationships;
- Comply with pharmacovigilance and drug safety reporting obligations;
- Prevent fraud and ensure security of our systems and services; and
- Process information for research, analytics, and other legally permissible purposes.
MARKETING USE OF YOUR PERSONAL DATA
Stoke strives to provide you with choices regarding certain personal data uses, particularly around communications related to Stoke, our products and services.
We may use your Identity Data, Contact Data, Technical Data, Usage Data, and Profile Data to form a view on what we think you may want or need, or what may be of interest to you. This is how we decide which services and materials may be relevant for you.
We have established the following personal data control mechanisms:
Opting In. You will receive certain communications from us if you have requested information from us and opted-in to receive such communications.
Consent to Third-Party Marketing. We will not share your personal data for marketing purposes with any company outside of Stoke and its service provider network unless you provide your express opt-in consent to do so.
Opting Out. You can ask us or third parties to stop sending you marketing messages at any time by following the opt-out links on any marketing message sent to you. Remember, however, that even if you opt-out of receiving these marketing communications, Stoke will still communicate with you to provide an offering that you request.
Online Analytics. Stoke may use third-party industry-recognized web analytics services (such as, for example, Google Analytics) on our website(s) to collect and analyze the information discussed in this Statement, and to engage in auditing, research, or reporting. The information (including your IP address) collected by various analytics technologies will be disclosed to or collected directly by these service providers, who evaluate information, including by noting the third-party website(s) from which you arrive, analyzing usage trends, assisting with fraud prevention, and providing certain features to you. To prevent Google Analytics from using your information for analytics, you may install the Google Analytics Opt-out Browser Add-on by visiting http://tools.google.com/dlpage/gaoptout.
HOW STOKE MAY SHARE YOUR PERSONAL DATA
We do not sell your personal data. However, we may share your personal data for targeted advertising purposes as described in this Privacy Statement and in our jurisdiction-specific notices below.
We may share your personal data with the following categories of parties for the purposes described in this Statement:
Internal and Affiliated Parties: Individuals or groups within our Company or within our family of companies, like subsidiaries, parents, or related corporate entities.
Partners: Entities, service providers, consultancies, or academic institutions with whom we have formalized professional relationships.
External Third Parties: Entities or individuals whose services we have formally retained to perform services on our behalf and help further our business requirements, including without limitation, for professional services, research, communications, technological maintenance, data storage, system administration, and data analysis and processing.
Clinical Research Organizations and Trial Sites: Contract Research Organizations (“CROs”), clinical trial sites, or other service partners who assist in conducting and managing clinical trials that we sponsor or engage with.
Healthcare Providers and Healthcare Professionals: We may share your personal data with healthcare providers and healthcare professionals in connection with our patient support programs, clinical trials, and other healthcare-related activities.
Third-Party Advertising Partners: Where applicable, to improve the effectiveness of our communication with you and our marketing campaigns, we may share your personal data with our third-party advertising partners, including social media platforms and publishers.
Parties as Part of a Business Transaction: Third parties to whom we may choose to sell, transfer, or merge parts of our business or our assets. If a change happens to our business, then the new owners may use your personal data in the same way as set out in this Privacy Statement.
Government Authorities: Government agencies, regulators, and authorities as may be advisable under or required by law.
We do not allow our third-party service providers to use your personal data for their own purposes and only permit them to process your personal data for specified purposes and in accordance with our instructions.
STOKE’S BASIS FOR HANDLING YOUR PERSONAL DATA
Stoke will only collect, process and use the personal data described above where applicable laws allow us to do so. That means, we will do so only when we have your consent and/or when we have a legitimate business interest to do so. In some instances, we may also have a legal or regulatory obligation to collect personal information from you, such as if there is a requirement to report an adverse event related to our products.
We may process your personal data based upon more than one lawful basis and legitimate interest depending upon the specific purpose(s) for which we are using the personal data. Stoke’s primary legitimate interests include the research, development, production, and promotion of precision genetic medicines at the heart of our corporate mission.
If you have questions about or need further information concerning the legal basis on which we collect and use your personal data, please contact us using the contact details provided under the “How To Contact Us” section of this Statement.
USE OF ARTIFICIAL INTELLIGENCE AND EMERGING TECHNOLOGIES
Stoke may use new tools and technologies, including artificial intelligence (AI), in connection with our products, services and operations. Where personal data is processed by these technologies, such processing is limited to the purposes described in this Privacy Statement and/or any supplemental privacy notices provided at the time of data collection.
Stoke does not use AI or other automated technologies to make decisions that may produce legal or similarly significant effects concerning you, except in limited circumstances where:
- You have been clearly informed of such automated processing,
- The processing is permitted by applicable law, and
- You are provided with meaningful information about the logic involved, as well as the opportunity to request human intervention or review.
HOW STOKE PROTECTS YOUR PERSONAL DATA
We deploy reasonable technical, organizational, administrative and physical security measures to prevent your personal data from being accidentally lost, impermissibly altered, disclosed, used, or accessed in an unauthorized way while it is under our control. We purposefully limit access to your personal data to those employees, agents, designees, and other third parties who have a business need to do so. Those parties are instructed to only process your personal data on our instructions and they are subject to a duty of confidentiality.
We have implemented reasonable procedures to guard against and address data breaches. In the unlikely event of a breach implicating your personal data that requires notification, we will do so and fulfill all our related legal obligations.
If you have reason to believe that your interaction with us is no longer secure (for example, if you feel that the security of any account you have with us has been compromised), please immediately notify us using the contact information provided in the “How to Contact Us” section.
COOKIES AND OTHER TRACKING TECHNOLOGIES
As we have stated, Stoke may automatically collect some personal data when you visit and engage with our website(s) or digital properties using Internet server logs, cookies, beacons, and/or other tracking technologies.
Cookies are small files that are automatically stored on your computer when you visit a website. Cookies are generally used to: (a) recognize your device; (b) store your preferences and settings; (c) understand the web pages of the website you have visited; (d) perform searches and analytics; and (e) assist with security functions. Cookies may perform many functions, such as allowing you to navigate between pages efficiently, remembering your preferences, and generally improving the user experience.
Web Server Logs are files where website activity can be stored. An IP address is a number assigned to your device whenever you access the Internet that allows devices and servers to recognize and communicate with each other. Stoke may collect IP addresses to conduct system administration and report aggregate information to affiliates, business partners, and/or service providers to conduct website and application analysis and performance reviews.
Beacons (also known as “tracking pixels” or “pixel tags”) are small strings of code that are placed in websites, email messages, and/or online ads. Beacons are most often used in conjunction with cookies to track activity on websites. Since beacons are typically used in combination with cookies, if you disable cookies, the beacons will only detect an anonymous website visit. When used in an email, beacons enable us to know whether you have received or opened the email and may be used for other analytics, personalization, and advertising.
Stoke’s uses of such technologies fall into the following general categories:
- Operationally Necessary: Technologies that allow you access to our Services, are required to identify irregular behavior, prevent fraudulent activity, and improve security, or that allow you to make use of our functions.
- Performance Related: Technologies we use to assess the performance of our Services, including as part of our analytic practices to help us understand how visitors use the Services.
- Functionality Related: Technologies that allow us to offer you enhanced functionality when accessing or using our Services, including identifying you when you sign into our Services and keeping track of your specified preferences or past pages viewed.
- Advertising or Targeting Related: Technologies used to develop and deliver content, including ads relevant to your interests, on our Services or on third-party sites.
Managing Your Cookie Preferences: If you do not wish to have cookies on your system, you can set your browser preferences to refuse them or to alert you when cookies are being sent. You are able to change our setting to notify you when a cookie is being placed or to block cookies altogether. For additional information, consult your browser’s “Help” section because controls and settings vary by browser. If you choose to decline all cookies, you may not be able to fully experience all the features intended for use of our website(s).
Do Not Track: Some web browsers may transmit “do-not-track” signals to websites with which the browser communicates. Websites linked to this Privacy Statement do not currently respond to these “do-not-track” signals.
Global Privacy Control: Websites linked to this Privacy Statement will recognize and honor the Global Privacy Control and similar browser-based opt-out preference signals, as may be required by applicable law.
HOW LONG WE WILL RETAIN YOUR PERSONAL DATA
Stoke will only retain your personal data for as long as necessary to fulfill the purposes we collected it for, including for the purposes of satisfying any legal, accounting or reporting requirements.
To determine the appropriate retention period for certain personal data, we consider various factors including: the amount, nature, and sensitivity of the personal data; the potential risk of harm from unauthorized use or disclosure of your personal data; the nature and status of your relationship with us; the purposes for which we process your personal data and whether we can achieve those purposes through other means and any applicable legal requirements.
In some circumstances, we may anonymize your personal data (so that it can no longer be associated with you) for research or statistical purposes, in which case we may use this information indefinitely without further notice to you.
INTERNATIONAL DATA TRANSFERS
Your personal data may be stored and processed in any location where we have facilities or service providers. By the use of our services or by providing consent to us (where required by law), your information may be transferred to other locations.
For transfers to locations not deemed adequate by a relevant supervisory authority, we have ensured that appropriate measures are in place to protect your personal data, including by ensuring that the recipient is bound specified obligations, like for example, published Standard Contractual Clauses, if relevant and applicable to regions where you or your personal data is located.
EFFECT OF OTHER PRIVACY STATEMENTS OR NOTICES
Stoke may have additional privacy statements or notices that are directed to and tailored for the specific context in which your personal data is collected. For example, applicants for employment may be provided with a separate privacy statement, and clinical trial participants are provided with separate notices related to their personal data as collected for the trials.
If you receive a privacy statement or data privacy-related notice provided to you for a specific purpose, the terms of that more specific statement or notice will control to the extent that other statements or notices may differ from this Privacy Statement.
LINKS TO OTHER SITES
Stoke website(s) or digital properties may contain links to other sites that we believe may offer useful information to visitors. The inclusion of any such link on the Stoke website(s) does not imply our endorsement of the linked site or service. Stoke is not responsible for content that exists on third-party websites.
When you click on one of these links, you will be transferred away from a Stoke property and be connected to the site of the organization or company that you selected. At such point, this Privacy Statement will not apply to your activity on the non-Stoke website(s). Each of these linked sites maintains its own independent privacy policies and procedures, which you should consult before providing any of your personal information.
Please note that linked third-party websites may also use cookies or other tracking technologies. Stoke cannot control the use of cookies or other tracking technologies by any such third-party websites.
CHILDREN’S PRIVACY
Stoke does not intend for our website(s) or online services to be used by anyone under the age of 18 and we do not design any website features to be intentionally appealing to a minor audience. In some limited instances, we may collect personal data about children in connection with our clinical trials or patient support programs focused on pediatric genetic diseases, but we will do so only with the proper consent of a parent or guardian and in compliance with applicable laws.
We do not otherwise knowingly collect or solicit data about or from children without the express consent of a parent or guardian. If a parent or guardian becomes aware that his or her child has provided us with personal data without proper adult consent, he or she should contact us as described in the “How to Contact Us” section of this Statement. In such an event, we will take reasonable steps to delete such data.
We do not knowingly collect personal data from children under the age of 13 on our website. If we become aware that we have collected personal data from children under the age of 13 on our website, we will take reasonable steps to delete such data.
YOUR PRIVACY RIGHTS
In accordance with applicable law which may be dependent upon your state of residency and other factors, you may have the right to:
- Request confirmation of whether we are processing your personal information;
- Obtain access to or a copy of your personal information;
- Receive an electronic copy of personal information that you have provided to us, or ask us to send that information to another company (the “right of data portability”);
- Restrict our uses of your personal information;
- Seek correction or amendment of inaccurate, untrue, incomplete, or improperly processed personal information;
- Request erasure of personal information held about you by Stoke, subject to certain exceptions prescribed by law;
- Object to the processing of your personal information; and
- Withdraw any consent that you have previously provided.
If you would like to exercise any of these rights, please contact us as set forth in the “How to Contact Us” section. We will process such requests in accordance with applicable laws. To protect your privacy and as permitted by applicable law, Stoke may take steps to verify your identity before processing or fulfilling certain requests.
You have the right to be free from unlawful discrimination for exercising your rights.
***
SUPPLEMENTAL NOTICE FOR CALIFORNIA RESIDENTS
This Supplemental Notice for California Residents applies to individuals who are California residents and supplements the information in this Privacy Statement. This Notice describes how we collect, use, disclose, and otherwise process personal information of California residents under the California Consumer Privacy Act of 2018, as amended by the California Privacy Rights Act of 2020 (collectively, “CCPA”).
Categories of Personal Information We Collect
In the past 12 months, we have collected the following categories of personal information, as described in the CCPA:
| Category | Examples | Collected |
|---|---|---|
| Identifiers | Name, alias, postal address, unique personal identifier, online identifier, IP address, email address, account name, social security number, driver's license number, passport number, or other similar identifiers | Yes |
| Personal Information under Cal. Civ. Code § 1798.80(e) | Name, signature, social security number, physical characteristics or description, address, telephone number, passport number, driver's license or state ID card number, insurance policy number, education, employment, employment history, bank account number, credit card number, debit card number, or any other financial information, medical information, or health insurance information | Yes |
| Characteristics of Protected Classifications | Age, race, color, ancestry, national origin, citizenship, religion or creed, marital status, medical condition, physical or mental disability, sex, sexual orientation, veteran or military status, genetic information | Yes |
| Commercial Information | Records of products or services purchased, obtained, or considered, or other purchasing or consuming histories or tendencies | Yes |
| Internet or Other Electronic Network Activity Information | Browsing history, search history, and information regarding interactions on Stoke Therapeutics websites, applications, digital properties or advertisements | Yes |
| Sensitive Personal Information | Social security number, driver's license number, state ID card, passport number; account log-in, financial account, debit card, or credit card number in combination with any required security or access code, password, or credentials allowing access to an account; precise geolocation; racial or ethnic origin; union membership; contents of mail, email, and text messages (unless Stoke is the intended recipient); genetic data; biometric information for identification purposes; health information; information about sex life or sexual orientation | Yes |
| Sensory Data | Audio, electronic, visual, thermal, olfactory or similar information | Limited |
| Inferences | Inferences drawn from any of the information identified above to create a profile reflecting preferences, characteristics, psychological trends, predispositions, behavior, attitudes, intelligence, abilities, and aptitudes | No |
| Non-Public Education Information | Education records directly related to a student maintained by an education institution | Limited |
| Professional or Employment-Related Information | Current or past job history or performance evaluations | Yes |
Sources of Personal Information
We collect personal information from the following sources:
- Directly from you when you provide it to us
- Automatically through your use of our website and services
- From third parties, including service providers, healthcare providers, clinical research organizations, data brokers, and publicly available sources
Purposes for Collection and Use
We collect and use the categories of personal information described above for the following business and commercial purposes:
- Providing our services and responding to your requests
- Clinical trial and research activities
- Patient support programs
- Marketing and advertising
- Analytics and website improvement
- Security and fraud prevention
- Legal compliance and protecting our rights
- Employment-related purposes
Disclosure of Personal Information
In the past 12 months, we have disclosed the following categories of personal information for a business purpose to the following categories of recipients:
| Categories of Personal Information | Categories of Recipients |
|---|---|
| Identifiers | Service providers, clinical research organizations, healthcare providers, advertising partners, affiliates |
| Personal Information under Cal. Civ. Code § 1798.80(e) | Service providers, clinical research organizations, healthcare providers, affiliates |
| Characteristics of Protected Classifications | Service providers, clinical research organizations, affiliates |
| Commercial Information | Service providers, advertising partners, affiliates |
| Internet or other Electronic Network Activity | Service providers, advertising partners, affiliates |
| Sensitive Personal Information | Service providers, clinical research organizations, healthcare providers, affiliates |
| Inferences | Service providers, advertising partners, affiliates |
| Professional or Employment-Related Information | Service providers, affiliates |
Sale and Sharing of Personal Information
We do not sell your personal information for monetary consideration. However, we may share personal information with third-party advertising partners for purposes of cross-context behavioral advertising (targeted advertising). Under the CCPA, this may be considered “sharing” of personal information.
The categories of personal information we have shared for cross-context behavioral advertising in the past 12 months include:
- Identifiers
- Internet or Other Electronic Network Activity Information
- Inferences
You have the right to opt out of this sharing. To exercise this right, please click “Do Not Share My Personal Information” on our website or contact us as described in the “How to Contact Us” section.
Sensitive Personal Information
We use sensitive personal information only for the following purposes permitted under the CCPA:
- To perform services or provide goods reasonably expected by you
- To detect security incidents and protect against malicious, deceptive, or illegal activity
- To verify or maintain the quality or safety of our services
- For clinical trials and research purposes with your consent
- For pharmacovigilance and drug safety purposes as required by law
- For short-term, transient use
- For purposes that do not involve inferring characteristics about you
Your California-Specific Privacy Rights
As a California resident, you have the following rights under the CCPA:
Right to Know: You have the right to request that we disclose to you the categories of personal information we have collected about you, the categories of sources from which we collected the personal information, the business or commercial purpose for collecting, selling, or sharing the personal information, the categories of third parties to whom we have disclosed the personal information, and the specific pieces of personal information we have collected about you.
Right to Delete: You have the right to request that we delete personal information we have collected from you, subject to certain exceptions.
Right to Correct: You have the right to request that we correct inaccurate personal information we maintain about you.
Right to Opt Out of Sale/Sharing: You have the right to opt out of the sale of your personal information or the sharing of your personal information for cross-context behavioral advertising.
Right to Limit Use of Sensitive Personal Information: You have the right to limit our use and disclosure of your sensitive personal information to uses that are necessary to perform our services or provide goods, or as otherwise permitted by the CCPA.
Right to Non-Discrimination: You have the right not to receive discriminatory treatment for exercising your CCPA rights.
How to Exercise Your Rights
To exercise your rights under the CCPA, you may:
- Email us at privacy@stoketherapeutics.com
- Call us at 781-430-8200
We will verify your identity before fulfilling your request. You may also designate an authorized agent to make a request on your behalf. If you use an authorized agent, we may require proof of your written authorization and verification of your identity directly.
We will respond to your request within 45 days, unless we need additional time, in which case we will notify you.
California “Shine the Light” Law
California’s Shine the Light Law (California Civil Code Section 1798.83) permits California residents who are individual customers to request certain information regarding disclosure of “personal information” to third parties for their direct marketing purposes. We do not share personal information with third parties for their own direct marketing purposes without your consent.
Retention of Personal Information
We retain personal information as described in the “How Long We Will Retain Your Personal Data” section of this Privacy Statement.
Financial Incentives
We do not offer financial incentives or price or service differences in exchange for the retention or sale of personal information.
***
***
SUPPLEMENTAL NOTICE FOR EUROPEAN ECONOMIC AREA (“EEA”) AND UNITED KINGDOM (“UK”) RESIDENTS
If you are resident within the European Union (“EU”), European Economic Area, or United Kingdom, please read this section carefully as it supplements the other provisions of this Privacy Statement.
Legal Bases for Processing Your Personal Data
We will use your personal data only when the law allows us to do so. Most commonly, we will use your personal data in the following circumstances:
- Consent: Where you have given us your consent for a specific purpose.
- Contractual Necessity: Where we need to perform the contract we are about to enter into or have entered into with you.
- Legitimate Interests: Where it is necessary for our legitimate interests (or those of a third party) and your interests and fundamental rights do not override those interests.
- Legal Obligation: Where we need to comply with a legal or regulatory obligation.
- Scientific Research: Where necessary for scientific research purposes.
- Vital Interests: Where we need to protect your vital interests or the vital interests of another natural person.
- Public Interest: Where it is needed in order to perform a task in the public interest or to exercise official authority.
Generally, you will have the right to withdraw your consent at any time by contacting us using the contact information listed in the “How to Contact Us” section above.
Purposes of Processing and Legal Bases
| Purpose / Activity | Legal Basis |
|---|---|
| To administer and protect our business and digital properties, including website(s) | Legitimate interests; Legal obligation |
| To engage with you as a vendor, service provider, contractor, or employee | Performance of a contract with you; Legitimate interests |
| To manage our relationship with you, including notifying you about changes to our terms or Privacy Statement and asking you to provide feedback | Performance of a contract with you; Legal obligation; Legitimate interests |
| To process and deliver products or services, including managing payments and obligations | Performance of a contract with you; Legitimate interests |
| To use data analytics to improve our website(s), products/services, marketing, and customer relationships | Legitimate interests |
| To determine and make suggestions and recommendations about goods or services that may be of interest to you | Legitimate interests; Consent |
| To deliver relevant content and marketing to you | Legitimate interests; Consent |
| To enable you to complete a survey | Legitimate interests |
| To comply with pharmacovigilance and drug safety obligations | Legal obligation; Vital interests |
| To conduct clinical trials and research programs | Consent; Scientific research purposes; Legitimate interests; Legal obligation |
Change of Purpose
We will only use your personal data for the purposes for which we collected it, unless we need to use it for another reason and that reason is compatible with the original purpose. If we need to use your personal data for an unrelated purpose, we will notify you and we will explain the legal basis which allows us to do so.
Please note that we may process your personal data without your knowledge or consent, in compliance with the above rules, where this is required or permitted by law.
Clinical Trials
To the extent that Stoke may undertake clinical trial studies within the EEA or UK, we may also use information from clinical trial participants’ medical records and other health data in order to conduct clinical or scientific research to improve healthcare.
Stoke may contract with specialized service providers, such as Contract Research Organizations (“CROs”), clinical trial sites, or other service partners, typically as data processors, to collect the personal data of the participants of the clinical trial and to manage the clinical trials that we sponsor. We may then process key-coded or pseudonymized personal data of clinical trial participants, which means that we do not have direct or immediate access to their identifiable personal data (except, for example, to comply with legal requirements such as those related to our pharmacovigilance obligations).
We would have a legitimate interest in using information related to your health for research studies when you agree to take part in a research study by providing your informed consent to participate. Our exception to the general provision at Article 9(1) of the GDPR not to process special categories of data is that processing is necessary for scientific research purposes in accordance with Article 89 of the GDPR.
This means that we will use your personal data collected in the course of a research study when we act as the data controller for such studies in the ways needed to conduct and analyze the research study. Your rights to access, change, or move your personal data may be limited, as we need to manage your information in specific ways in order for the research to be reliable and accurate. If you withdraw from the study, we will keep the information about you that we have already obtained. To safeguard your rights, we will use only the minimum personal data needed for these purposes.
In addition, the personal data of potential and actual site investigators, employees, or contractors may also be collected directly by Stoke or through the CRO that we may work with and is typically used, for example, to verify the individual’s qualifications, satisfy documentation requirements for the purpose of the clinical trial, verify financial disclosures to avoid any conflict of interest, and to otherwise conduct and analyze the research study.
International Transfers of Personal Data
Stoke is based outside the EEA and the UK, so the processing of your personal data may involve a transfer of data outside the EEA or the UK.
Whenever we transfer your personal data out of the EEA or UK, we ensure an adequate and similar degree of protection is afforded to it by ensuring at least one of the following safeguards is implemented:
- We will only transfer your personal data to countries or entities that have been deemed by the applicable supervisory authority to provide an adequate level of protection for personal data;
- We will only transfer your personal data to countries or entities pursuant to the terms of binding agreement to and compliance with standard contractual clauses or binding corporate rules, each as approved by the European Commission or other regulators, as applicable;
- We will only transfer your personal data to countries or entities pursuant to the consent of the individual to whom the personal data pertains; or
- We will only transfer your personal data to countries or entities as otherwise authorized by the EEA or UK or permitted by applicable EEA or UK requirements.
You may obtain a copy of the Standard Contractual Clauses or other transfer mechanisms by contacting us in accordance with the “How to Contact Us” section of this Statement.
Your Data Protection Rights Under GDPR
Under certain circumstances, individuals located in the EEA or UK have the following data protection rights:
- Right of Access: To request access to your personal data and receive a copy of the personal data we hold about you.
- Right to Rectification: To request correction of inaccurate or incomplete personal data.
- Right to Erasure (“Right to be Forgotten”): To request deletion of your personal data in certain circumstances.
- Right to Object: To object to the processing of your personal data in certain circumstances.
- Right to Restriction: To request restriction of processing of your personal data in certain circumstances.
- Right to Data Portability: To receive your personal data in a structured, commonly used, and machine-readable format and to transmit that data to another controller.
- Right Not to Be Subject to Automated Decision-Making: Not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects or similarly significantly affects you.
- Right to Withdraw Consent: To withdraw any consent that you have previously provided for the processing of your personal data.
To exercise any of the rights described above, please send a message to. sar@thedpo.co.uk Please be aware that your rights in relation to clinical research data may be limited.
Supervisory Authority
For advice or to make a complaint, you can also contact the applicable Supervisory Authority within the EEA at https://edpb.europa.eu/about-edpb/board/members_en or the Information Commissioner’s Office within the UK at https://ico.org.uk/make-a-complaint/.
Fees and Response Time
You will not have to pay a fee to access your personal data or to exercise any of the other rights. However, we may charge a reasonable fee or refuse to comply with your request if it is clearly unfounded, repetitive, or excessive.
We may need to request specific information from you to help us confirm your identity and ensure your right to access your personal data (or to exercise any of your other rights). This is a security measure to ensure that personal data is not disclosed to any person who has no right to receive it.
We try to respond to all legitimate requests in a timely fashion and as may be required by applicable law. Occasionally, it may take us longer than usual if your request is particularly complex or you have made a number of requests. In this case, we will notify you and keep you updated.
HOW TO CONTACT US
For questions about this Supplemental Notice, Stoke’s privacy practices or to exercise your privacy rights, you may contact
Our Data Protection Officer at:
Dr. Philip Griffiths
The DPO Ltd
Capital Tower, Grefriars Road,
Cardiff, CF10 3AZ, United Kingdom
Email: sar@thedpo.co.uk
***
NOTICE TO NEVADA RESIDENTS
Section 603A of the Nevada Revised Statutes permits certain Nevada residents who are “consumers” to submit a request at any time to an “operator” of a website in Nevada directing the operator not to make any sale of any “covered information” the operator has collected or will collect about the consumer. Stoke does not currently “sell” or plan to sell covered information as defined in the Nevada law.
If you are a Nevada resident, you may submit a verified request by contacting us using the information provided in the “How to Contact Us” section of this Statement.
***
HOW TO CONTACT US
For questions about this Privacy Statement or Stoke’s privacy practices or to exercise your privacy rights, please contact us at:
Stoke Therapeutics, Inc. 45 Wiggins Avenue Bedford, MA 01730
Email: privacy@stoketherapeutics.com
Phone: 781-430-8200