Privacy Policy

Effective Date: March 3, 2026

Last Updated: March 3, 2026

1. Introduction

This Privacy Policy describes how Neurvati Neurosciences, Inc. (“Neurvati,” “we,” “us,” or “our”) collects, uses, stores, shares, and protects your personal information when you visit our website at neurvati.com or interact with our services. This policy also applies to information collected through our subsidiary, GRIN Therapeutics, Inc., at grintherapeutics.com.

This policy applies to:

  • Visitors to neurvati.com and grintherapeutics.com
  • Individuals who contact us through our website contact forms
  • Individuals who subscribe to receive updates or information about our research and clinical programs
  • Healthcare professionals, investigators, patients, caregivers, and other stakeholders who interact with us through our websites

“Personal Information” means any information relating to an identified or identifiable individual, as defined under applicable privacy laws including the EU General Data Protection Regulation (GDPR) and the California Consumer Privacy Act as amended by the California Privacy Rights Act (CCPA/CPRA).

We may amend this policy from time to time. We encourage you to review this policy periodically, as changes will be posted on this page. If we make material changes, we will provide prominent notice on our website. If you do not agree with this policy, you should not use our websites or services.

Neurvati Neurosciences, Inc.

230 Park Avenue, Room 2830

New York, NY 10169, United States

2. What Personal Information We Collect

We collect various types of information depending on how you interact with us.

2.1 Information You Provide to Us

When you fill out a contact form, request information about our clinical programs, subscribe to updates, or otherwise communicate with us, we may collect:

  • Your name
  • Email address
  • Phone number
  • Company or organization name
  • Job title or professional role
  • Your relationship to Neurvati or GRIN Therapeutics (e.g., healthcare professional, patient, caregiver, investor, media) as indicated through forms on our websites
  • The content of any message or inquiry you submit

2.2 Information Collected Automatically

When you visit our websites, we may automatically collect:

  • IP address
  • Browser type and version
  • Device type and operating system
  • Pages visited and time spent on pages
  • Referring website or source
  • General geographic location (estimated from IP address)
  • Information collected by cookies and similar tracking technologies (see Section 8)

2.3 Information from Third-Party Sources

We may receive information about you from third-party sources, including analytics providers and marketing platforms.

Unless otherwise noted in this policy, we act as the “controller” of Personal Information that we collect and process.

3. How We Collect Information

We collect Personal Information in the following ways:

  • Directly from you, when you submit a contact form on neurvati.com or grintherapeutics.com
  • Automatically, through cookies, web beacons, and similar technologies when you browse our websites
  • Through analytics services, including Google Analytics 4 and Google Tag Manager
  • Through email marketing platforms used by our subsidiary

4. How We Use Your Information

We process your Personal Information for the following purposes:

  • To respond to your inquiries submitted through our contact forms
  • To provide you with information about our clinical programs, research, and therapeutic areas
  • To send updates about Neurvati and GRIN Therapeutics, including clinical trial milestones and press releases, where you have opted in to receive such communications
  • To analyze website usage and improve the performance, content, and user experience of our websites
  • To comply with legal obligations, including those arising from our clinical trial operations and regulatory engagements
  • To protect the security and integrity of our websites and business operations

5. Legal Basis for Processing (EU/EEA Visitors)

If you are located in the European Union or European Economic Area, we rely on the following legal bases for processing your Personal Information:

  • Consent: When you subscribe to updates, submit a contact form, or accept cookies through our consent management platform.
  • Legitimate Interest: To analyze website usage and improve our services, provided our interests are not outweighed by your rights. We have a legitimate interest in understanding how visitors interact with information about our clinical programs and therapeutic areas.
  • Legal Obligation: To comply with applicable laws and regulations, including pharmacovigilance reporting obligations and clinical trial transparency requirements.
  • Vital Interests: In rare circumstances, where necessary to protect the vital interests of an individual, such as adverse event reporting.

You may withdraw your consent at any time. Withdrawal of consent does not affect the lawfulness of processing conducted prior to withdrawal.

6. How We Share Information

We may share your Personal Information with the following categories of recipients:

  • Affiliates: GRIN Therapeutics, Inc. (our subsidiary) and Neurvati’s parent organization, Blackstone Life Sciences, as needed for business operations and in accordance with applicable law.
  • Service Providers: Third-party vendors who assist us in operating our websites and providing services, including website hosting providers, analytics providers, form processing services, and email marketing platforms.
  • Clinical Trial Partners: Clinical research organizations and regulatory authorities as required for our clinical development programs, subject to appropriate data protection agreements.
  • Legal and Regulatory: In response to a legal summons, subpoena, court order, or as required by law enforcement agencies or regulatory authorities (including the FDA, EMA, and other health authorities in connection with our clinical programs).
  • Business Transfers: In connection with any merger, acquisition, or sale of assets, your Personal Information may be transferred as part of the transaction.

Our vendors and service providers are contractually prohibited from using your Personal Information for any purpose other than providing the contracted services. They are not permitted to use your information for their own marketing or to share it for marketing purposes.

7. How Long We Retain Your Information

How long we keep Personal Information depends on the type of information and the purpose for which it was collected. After a reasonable period or the completion of the purpose for which it was collected, we will either delete or anonymize Personal Information.

  • Contact form submissions: Retained for as long as necessary to respond to your inquiry, plus a reasonable period thereafter.
  • Website analytics data: Retained in accordance with our analytics provider’s default retention settings.
  • Marketing communications: Retained until you unsubscribe or request deletion.
  • Legal and regulatory records: Retained as required by applicable law, including pharmacovigilance and clinical trial recordkeeping requirements.

8. Cookies and Tracking Technologies

Our websites use cookies and similar tracking technologies. This section describes the types of cookies we use and how you can manage your preferences.

8.1 What Are Cookies?

Cookies are small text files stored on your device when you visit a website. Some cookies last only for the duration of your visit (“session cookies”); others remain on your device for a set period (“persistent cookies”). Cookies help us understand how visitors use our websites, remember your preferences, and improve your experience.

8.2 Types of Cookies We Use

  • Strictly Necessary Cookies: These cookies are essential for the website to function properly. They enable core functionality such as page navigation and access to secure areas. These cookies do not collect Personal Information and cannot be disabled.
  • Analytics / Performance Cookies: These cookies help us understand how visitors interact with our websites by collecting information such as pages visited, time spent on pages, and error messages. These cookies are only set with your consent (for EU/EEA visitors).
  • Functional Cookies: These cookies enable enhanced functionality and personalization, such as remembering your preferences. They may be set by us or by third-party providers whose services we use on our pages.

8.3 Specific Cookies

Cookie Name Provider Purpose Duration
_ga Google Analytics Distinguishes unique users; analytics tracking 2 years
_ga_<ID> Google Analytics Maintains session state 2 years
_gid Google Analytics Distinguishes unique users (24-hour) 24 hours
_gat Google Analytics Throttles request rate 1 minute
osano_consentmanager Osano Stores visitor consent preferences 1 year
osano_consentmanager_uuid Osano Unique identifier for consent record 1 year

8.4 Managing Your Cookie Preferences

When you first visit our website, you will be presented with a cookie consent banner that allows you to accept, deny, or manage your cookie preferences. You can change your preferences at any time by clicking the cookie preferences icon on our website or by adjusting your browser settings.

You may also opt out of interest-based advertising by visiting the Digital Advertising Alliance at www.aboutads.info/choices or the Network Advertising Initiative at www.networkadvertising.org/choices.

8.5 Google Consent Mode v2

Our websites implement Google Consent Mode v2, which adjusts the behavior of Google Analytics and other Google services based on your consent choices. When you have not granted consent, Google tags will operate in a limited mode that does not store cookies or collect identifiable data.

9. Your Rights (EU/EEA Residents)

If you reside in the European Union or European Economic Area, you have the following rights with respect to your Personal Information under the General Data Protection Regulation (GDPR):

  • Right of Access: You have the right to access the Personal Information we hold about you and to receive a copy.
  • Right to Rectification: You have the right to correct inaccurate or incomplete Personal Information.
  • Right to Erasure: You have the right to request deletion of your Personal Information, subject to legal retention requirements.
  • Right to Restrict Processing: You have the right to restrict the processing of your Personal Information in certain circumstances.
  • Right to Object: You have the right to object to processing of your Personal Information based on legitimate interests or for direct marketing purposes. We will cease processing unless we demonstrate compelling legitimate grounds.
  • Right to Data Portability: You may request a copy of your Personal Information in a structured, commonly used, machine-readable format.
  • Right Not to Be Subject to Automated Decision-Making: You have the right not to be subject to decisions based solely on automated processing, including profiling.
  • Right to Withdraw Consent: Where processing is based on consent, you may withdraw that consent at any time without affecting the lawfulness of processing before withdrawal.
  • Right to Lodge a Complaint: You have the right to lodge a complaint with a supervisory authority in the EU/EEA Member State of your habitual residence, place of work, or place of the alleged infringement.

To exercise any of these rights, please contact us at privacy@neurvati.com.

We may request additional information to verify your identity before processing your request. We will respond within 30 days, or within the timeframe required by applicable law.

10. Information for California Residents

The California Consumer Privacy Act (CCPA), as amended by the California Privacy Rights Act (CPRA), provides California residents with specific rights regarding their Personal Information.

10.1 Your California Privacy Rights

  • Right to Know and Access: You may request information about the categories and specific pieces of Personal Information we have collected about you, the sources from which it was collected, the purposes for collection, and the categories of third parties with whom it has been shared.
  • Right to Delete: You may request that we delete Personal Information we have collected from you, subject to certain exceptions.
  • Right to Correct: You may request that we correct inaccurate Personal Information.
  • Right to Data Portability: You may request a copy of your Personal Information in a portable format.
  • Right to Non-Discrimination: We will not discriminate against you for exercising your privacy rights.

10.2 Sale and Sharing of Personal Information

We do not sell Personal Information to third parties as defined under the California Consumer Privacy Act. We do not use or disclose sensitive Personal Information for purposes other than those permitted under CCPA/CPRA.

To opt out of any future sharing of Personal Information for cross-context behavioral advertising, click the “Do Not Sell or Share My Personal Information” link in the footer of our website, or contact us at privacy@neurvati.com.

10.3 How to Exercise Your Rights

You may exercise your California privacy rights by:

We may ask for additional information to verify your identity. If you use an authorized agent, we may require written authorization.

10.4 Categories of Personal Information Collected

In the preceding 12 months, we have collected the following categories of Personal Information as defined by the CCPA:

  • Identifiers (name, email address, IP address)
  • Internet or other electronic network activity information (browsing history, interactions with our website)
  • Professional or employment-related information (job title, company name)
  • Geolocation data (general location inferred from IP address)

11. International Data Transfers

Neurvati Neurosciences is headquartered in New York, United States. Personal Information collected from visitors located in the European Union, European Economic Area, United Kingdom, or Switzerland may be transferred to and processed in the United States and other countries where our service providers operate.

We have taken appropriate safeguards to ensure that Personal Information remains protected wherever it is transferred. When we transfer Personal Information from the EEA, Switzerland, or the UK to the United States, we rely on:

  • Standard Contractual Clauses (SCCs): We use the European Commission’s Standard Contractual Clauses as a transfer mechanism where applicable, supplemented by additional safeguards where required by the circumstances of the transfer.
  • UK International Data Transfer Addendum: For transfers from the United Kingdom, we use the UK Addendum to the EU SCCs.

To obtain a copy of the safeguards we use for international data transfers, please contact us at privacy@neurvati.com.

12. Security

We take reasonable steps to protect the Personal Information we collect from unauthorized access, use, alteration, or disclosure. Our security measures include:

  • Encryption of data in transit using HTTPS/TLS
  • Access controls limiting employee access to Personal Information on a need-to-know basis
  • Regular review of our data collection, storage, and processing practices
  • Contractual requirements for service providers to maintain appropriate security standards

No security measures are perfect. While we strive to protect your Personal Information, we cannot guarantee its absolute security. In the event of a data breach, we will notify affected individuals and relevant authorities as required by applicable law.

13. Automated Decision-Making and Profiling

We do not currently use automated decision-making, including profiling, that produces legal or similarly significant effects for individuals visiting our websites.

14. Children’s Privacy

Our websites are not directed to children under the age of 13 (or under 16 for EU/EEA residents). We do not knowingly collect Personal Information from children without parental consent, unless permitted by law.

We recognize that Neurvati and GRIN Therapeutics serve patient communities that include children and families of children with neurological and neurodevelopmental disorders. Information about our clinical programs is directed to caregivers and healthcare professionals, not to children. If you believe that a child has provided us with Personal Information without appropriate parental consent, please contact us and we will promptly delete such information.

15. Sensitive Information

Unless specifically requested, we ask that you not send us sensitive Personal Information (such as health information, government-issued identification numbers, or information about race, religion, or political opinions) through our websites. If we need to collect sensitive Personal Information, we will do so only with your explicit consent and for a stated purpose.

Our contact forms do not request health or medical information. However, visitors may voluntarily include health-related details in free-text form submissions. We treat any such voluntarily disclosed health information with heightened care and process it only to respond to your inquiry.

16. Do Not Track Signals

Some browsers include a “Do Not Track” feature that signals to websites you visit that you do not want your online activity tracked. Our consent management platform (Osano) honors Global Privacy Control (GPC) signals as a valid opt-out of the sale or sharing of Personal Information under the CCPA.

17. EU Representative and Data Protection Officer

Under GDPR Article 27, Neurvati has designated the following representative in the European Union:

Richard Valanzola

Our Data Protection Officer can be contacted at:

dpo@grintherapeutics.com

18. Contact Us

If you have any questions about this Privacy Policy, or if you wish to exercise your privacy rights as described above, please contact us:

Neurvati Neurosciences, Inc.

230 Park Avenue, Room 2830

New York, NY 10169, United States

Email: privacy@neurvati.com

Website: neurvati.com

If you are not satisfied with our response to a privacy-related inquiry, you may contact:

  • For EU/EEA residents: Your local supervisory authority. Details of EU supervisory authorities can be found at edpb.europa.eu.
  • For California residents: The California Attorney General’s office at oag.ca.gov.

19. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technologies, legal requirements, or other factors. When we make material changes, we will update the “Last Updated” date at the top of this page and provide prominent notice where appropriate. We encourage you to review this policy periodically.