Privacy Policy

Last updated: September 15, 2026

ON THIS PAGE

    This Privacy Policy describes Our policies and procedures on the collection, use and disclosure of Your information when You use the Service and tells You about Your privacy rights and how the law protects You.

    We use Your Personal Data to provide and improve the Service. We collect, use, and disclose Your information as described in this Privacy Policy and, where required by applicable law, only where We have a valid legal basis to do so, including Your consent (where consent is required).

    Interpretation and definitions

    Interpretation

    The words whose initial letters are capitalized have meanings defined under the following conditions. The following definitions shall have the same meaning regardless of whether they appear in singular or in plural.

    Definitions

    For the purposes of this Privacy Policy:

    Affiliate means an entity that controls, is controlled by, or is under common control with a party, where "control" means ownership of 50% or more of the shares, equity interest or other securities entitled to vote for election of directors or other managing authority.

    Company (referred to as either "the Company", "We", "Us" or "Our" in this Privacy Policy) refers to Vero Bioscience, Inc., 264 Summit Dr, Corte Madera, CA 94925.

    For the purposes of the GDPR, the Company is the Data Controller.

    Cookies are small files that are placed on Your computer, mobile device or any other device by a website, containing the details of Your browsing history on that website, among its many uses.

    Country/State refers to: California, United States.

    Data Controller, for the purposes of the GDPR (General Data Protection Regulation), refers to the Company as the legal person which alone or jointly with others determines the purposes and means of the processing of Personal Data.

    Device means any device that can access the Service, such as a computer, a cell phone or a digital tablet.

    Do Not Track (DNT) is a concept that has been promoted by U.S. regulatory authorities, in particular the U.S. Federal Trade Commission (FTC), for the Internet industry to develop and implement a mechanism for allowing Internet users to control the tracking of their online activities across websites.

    GDPR refers to the EU General Data Protection Regulation.

    Personal Data (or "Personal Information") is any information that relates to an identified or identifiable individual.

    For the purposes of GDPR, Personal Data means any information relating to You such as a name, an identification number, location data, an online identifier, or one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity. We use "Personal Data" and "Personal Information" interchangeably unless a law uses a specific term.

    Service refers to the Website.

    For the purposes of the GDPR, Service Providers are considered Data Processors.

    Usage Data refers to data collected automatically, either generated by the use of the Service or from the Service infrastructure itself (for example, the duration of a page visit).

    User means any individual who accesses or uses the Service.

    Website refers to Vero Bioscience, accessible from https://verobioscience.com.

    You means the individual accessing or using the Service, or the company, or other legal entity on behalf of which such individual is accessing or using the Service, as applicable.

    Collecting and using your personal information

    Types of data collected

    Personal data

    While using Our Service, We may ask You to provide Us with certain personally identifiable information that can be used to contact or identify You. Personally identifiable information may include, but is not limited to:

    • Email address
    • First name and last name
    • ZIP or postal code

    Usage data

    Usage Data is collected automatically when using the Service.

    Usage Data may include information such as Your Device's Internet Protocol address (e.g. IP address), browser type, browser version, the pages of Our Service that You visit, the time and date of Your visit, the time spent on those pages, unique device identifiers and other diagnostic data.

    When You access the Service by or through a mobile device, We may collect certain information automatically, including, but not limited to, the type of mobile device You use, Your mobile device's unique ID, the IP address of Your mobile device, Your mobile operating system, the type of mobile Internet browser You use, unique device identifiers and other diagnostic data.

    We may also collect information that Your browser sends whenever You visit Our Service or when You access the Service by or through a mobile device.

    Tracking technologies and cookies

    We use tracking technologies (such as cookies) to track the activity and to improve Our Service. The technologies We use may include:

    Cookies or Browser Cookies. A cookie is a small file placed on Your Device. You can instruct Your browser to refuse all Cookies or to indicate when a Cookie is being sent. However, if You do not accept Cookies, You may not be able to use some parts of Our Service.

    Web Beacons. Certain sections of Our Service may contain small electronic files known as web beacons that permit the Company, for example, to count users who have visited those pages and for other related website statistics.

    Email Tracking Technologies. Our emails may contain similar technologies that tell Us whether an email has been opened or a link within it has been clicked. We use this information to measure the performance of Our email communications, to maintain email deliverability, and to understand which content is of interest to You. You can prevent most email tracking by configuring Your email client to block the automatic loading of remote images, and You may opt out of marketing emails entirely by using the unsubscribe link in any marketing email We send.

    Cookies can be "Persistent" or "Session" Cookies. Persistent Cookies remain on Your personal computer or mobile device when You go offline, while Session Cookies are deleted as soon as You close Your web browser.

    Where required by law, We use non-essential cookies only with Your consent. You can withdraw or change Your consent at any time using the cookie preferences tool available on Our Website. Withdrawing consent does not affect the lawfulness of processing based on consent before its withdrawal.

    We use both Session and Persistent Cookies for the purposes set out below:

    Necessary / Essential Cookies — Type: Session Cookies. Administered by: Us. Purpose: These Cookies are necessary for the Website to function properly, maintain security, prevent abuse, and provide features requested by You.

    Cookies Policy / Notice Acceptance Cookies — Type: Persistent Cookies. Administered by: Us. Purpose: These Cookies identify whether users have accepted the use of cookies on the Website and record the consent choices You have made.

    Analytics Cookies — Type: Persistent Cookies. Administered by: Third Parties. Purpose: These Cookies collect information about how visitors use the Website. We use this information to understand Website traffic and improve the performance and content of the Website. Where required by law, We use Analytics Cookies only with Your consent.

    Use of your personal data

    The Company may use Personal Data for the following purposes:

    To provide and maintain Our Service, including to monitor the usage of Our Service.

    To contact You: To contact You by email in response to Your inquiries, regarding Your waitlist registration, or with other communications that You have requested or consented to receive.

    To provide You with marketing communications: To send You news, updates and other information about Vero Bioscience where You have requested or consented to receive such communications. You may opt out or withdraw Your consent at any time.

    To manage Your requests: To attend and manage Your requests to Us.

    For business transfers: We may use Your Personal Data to evaluate or conduct a merger, divestiture, restructuring, reorganization, dissolution, or other sale or transfer of some or all of Our assets.

    For other purposes: We may use Your information for data analysis, identifying usage trends, determining the effectiveness of Our promotional campaigns, and evaluating and improving Our Service.

    We may share Your Personal Data in the following situations:

    • With Service Providers: to monitor and analyze the use of Our Service, and to contact You.
    • For business transfers: in connection with any merger, sale of Company assets, financing, or acquisition.
    • With Affiliates: We will require those affiliates to honor this Privacy Policy.
    • With Your consent: for any other purpose with Your consent.

    Retention of your personal data

    The Company will retain Your Personal Data only for as long as is necessary for the purposes set out in this Privacy Policy, to comply with Our legal obligations, resolve disputes, and enforce Our legal agreements and policies.

    We determine retention periods based on the nature of the Personal Data, the purposes for which it was collected, the length of Our relationship with You, applicable legal requirements, and the need to establish, exercise or defend legal claims.

    Waitlist and email-marketing information is generally retained until You unsubscribe, withdraw Your consent or ask Us to delete it, subject to limited retention where necessary to maintain suppression records or comply with applicable law. Website analytics information is retained in accordance with Our analytics settings and is deleted or aggregated when it is no longer reasonably necessary.

    When Personal Data is no longer required, We delete, anonymize or securely dispose of it. Residual copies may remain temporarily in secure backup systems until overwritten or deleted in accordance with Our backup procedures.

    Transfer of your personal data

    Your information, including Personal Data, is processed at the Company's operating offices and in any other places where the parties involved in the processing are located, which may be outside of Your jurisdiction.

    Where required by applicable law, We will ensure that international transfers of Your Personal Data are subject to appropriate safeguards, and no transfer of Your Personal Data will take place to an organization or a country unless there are adequate controls in place.

    Delete your personal data

    You have the right to delete or request that We assist in deleting the Personal Data that We have collected about You.

    You may contact Us to request access to, correction of, or deletion of Personal Data that You have provided to Us. Certain information may be retained where We have a legal obligation or other lawful basis to retain it.

    Disclosure of your personal data

    Business transactions

    If the Company is involved in a merger, acquisition or asset sale, Your Personal Data may be transferred. We will provide notice before Your Personal Data is transferred and becomes subject to a different Privacy Policy.

    Law enforcement

    Under certain circumstances, the Company may disclose Your Personal Data if required to do so by law or in response to valid requests by public authorities.

    Other legal requirements

    The Company may disclose Your Personal Data in the good-faith belief that such action is necessary to:

    • Comply with a legal obligation
    • Protect and defend the rights or property of the Company
    • Prevent or investigate possible wrongdoing in connection with the Service
    • Protect the personal safety of Users of the Service or the public
    • Protect against legal liability

    Security of your personal data

    The security of Your Personal Data is important to Us, but remember that no method of transmission over the Internet, or method of electronic storage, is 100% secure. While We strive to use commercially reasonable means to protect Your Personal Data, We cannot guarantee its absolute security.

    Detailed information on the processing of your personal data

    The Service Providers We use may have access to Your Personal Data. These third-party vendors collect, store, use, process and transfer information about Your activity on Our Service in accordance with their Privacy Policies.

    Where required by applicable law (including in the EEA and the UK), We deploy the non-essential cookies and similar technologies used by Our Service Providers only with Your prior consent, and You may withdraw that consent at any time as described in the "Tracking Technologies and Cookies" section.

    Analytics

    We may use third-party Service Providers to monitor and analyze the use of Our Service. Depending on the provider and how the relevant tool is configured, these analytics providers may also use the information collected on Our Service for their own purposes, including to improve their own services.

    Google Analytics

    Google Analytics is a web analytics service provided by Google that helps Us understand how visitors use the Website. Depending on the configuration, Google Analytics may process information such as device and browser information, Website interactions, referring pages and approximate location. We use this information to measure Website traffic and improve the Website.

    Where required by law, Google Analytics is activated only after You provide consent through Our cookie preferences tool. We do not intentionally provide Google Analytics with Your name, email address, ZIP or postal code, or health information.

    You can learn more about how Google handles information at: https://policies.google.com/privacy. You can also use Google's Analytics opt-out browser add-on: https://tools.google.com/dlpage/gaoptout.

    Email marketing

    We may use Your Personal Data to contact You with newsletters, marketing or promotional materials and other information that may be of interest to You. You may opt out of receiving any, or all, of these communications from Us by following the unsubscribe link or instructions provided in any email We send or by contacting Us.

    We may use Email Marketing Service Providers to manage and send emails to You.

    Klaviyo — Their Privacy Policy can be viewed at https://privacy.klaviyo.com/.

    GDPR privacy

    Legal basis for processing personal data under GDPR

    Where the GDPR or UK GDPR applies, We rely on the following legal bases:

    Consent: We rely on Your consent to add You to Our waitlist, send marketing communications, and use non-essential cookies and analytics technologies where consent is required. You may withdraw Your consent at any time.

    Legitimate interests: We may process Personal Data to respond to inquiries, maintain Website security, prevent fraud and abuse, understand Website performance where permitted without consent, establish or defend legal claims, and evaluate or complete a business transaction.

    Legal obligations: We may process or retain Personal Data where necessary to comply with applicable law or respond to valid legal requests.

    Where information is marked as required, We need it to respond to Your request or provide the relevant Website feature. If You do not provide required information, We may be unable to process Your request or add You to the waitlist.

    International transfer of personal data

    We may transfer, store, and process Personal Data in countries other than the country in which You are located, including countries outside the European Economic Area ("EEA") and the United Kingdom ("UK"), where data protection laws may differ.

    Where We transfer Personal Data outside the EEA or the UK, We use a lawful transfer mechanism as required by applicable data protection law. Depending on the destination and recipient, these mechanisms may include:

    • A decision by the European Commission or the UK Government recognizing that the destination provides an adequate level of data protection, including transfers to United States recipients participating in the EU-U.S. Data Privacy Framework and its UK Extension
    • The European Commission's Standard Contractual Clauses ("SCCs"), the UK International Data Transfer Agreement ("IDTA"), or the UK Addendum to the SCCs, as applicable
    • Additional safeguards where appropriate, such as encryption in transit and at rest, access controls, data minimization, and security reviews of Service Providers

    We transfer Personal Data internationally only as necessary to operate and provide the Website and to work with Our Service Providers. You may contact Us using the details in the "Contact Us" section to request further information about the safeguards We use for international transfers.

    Your rights under the GDPR

    The Company undertakes to respect the confidentiality of Your Personal Data and to guarantee You can exercise Your rights.

    You have the right under this Privacy Policy, and by law where the GDPR or the UK GDPR applies, to:

    • Request access to Your Personal Data. You may ask whether We process Personal Data about You and request a copy of the Personal Data We hold about You.
    • Request restriction of processing. You have the right to ask Us to restrict processing of Your Personal Data in certain circumstances.
    • Request correction of the Personal Data that We hold about You. You have the right to have any incomplete or inaccurate information corrected.
    • Object to processing of Your Personal Data. This right exists where We are relying on a legitimate interest, or where We are processing Your Personal Data for direct marketing purposes.
    • Request erasure of Your Personal Data. You have the right to ask Us to delete or remove Personal Data when there is no good reason for Us to continue processing it.
    • Request the transfer of Your Personal Data. We will provide to You, or to a third party You have chosen, Your Personal Data in a structured, commonly used, machine-readable format.
    • Withdraw Your consent. You have the right to withdraw Your consent to Our use of Your Personal Data.

    Exercising of your GDPR data protection rights

    You may exercise any of the rights described above by contacting Us. Please note that We may ask You to verify Your identity before responding to such requests. We generally respond within one month, and may extend by two further months where necessary, in accordance with applicable law.

    You have the right to complain to a supervisory authority about Our collection and use of Your Personal Data. If You are in the EEA, please contact Your local data protection authority. If You are in the UK, You can complain to the Information Commissioner's Office (ICO).

    Automated decision-making

    We do not make decisions based solely on automated processing, including profiling, that produce legal effects concerning You or similarly significantly affect You. If this changes, We will update this Privacy Policy and provide the information and safeguards required by the GDPR.

    "Do Not Track" policy as required by CalOPPA

    Our Service does not respond to Do Not Track signals.

    However, some third-party websites do keep track of Your browsing activities. If You are visiting such websites, You can set Your preferences in Your web browser to inform websites that You do not want to be tracked. You can enable or disable DNT by visiting the preferences or settings page of Your web browser.

    Children's and minors' privacy

    The Service is not directed to, and We do not knowingly collect Personal Information from, anyone under the age of 16.

    If You are a parent or guardian and You believe Your child has provided Us with Personal Information, please contact Us. If We become aware that We have collected Personal Information from anyone under the age of 16, We will take steps to remove that information from Our servers as soon as reasonably possible.

    Some countries and states set a higher age at which an individual can consent to the processing of their own Personal Information. Where We rely on consent as a legal basis and the law applicable to a User sets an age higher than 16, We may require the consent of that User's parent or guardian before We collect and use their Personal Information.

    Links to other websites

    Our Service may contain links to other websites that are not operated by Us. If You click on a third-party link, You will be directed to that third party's site. We strongly advise You to review the Privacy Policy of every site You visit.

    We have no control over and assume no responsibility for the content, privacy policies or practices of any third-party sites or services.

    Changes to this Privacy Policy

    We may update Our Privacy Policy from time to time. We will notify You of any changes by posting the new Privacy Policy on this page.

    Where appropriate, We may also notify You of material changes by email or through a prominent notice on the Website. The "Last updated" date at the top of this Privacy Policy will identify when the policy was most recently revised. You are advised to review this Privacy Policy periodically for any changes. Changes to this Privacy Policy are effective when they are posted on this page.

    Contact us

    If You have any questions about this Privacy Policy, You can contact Us:

    Service Provider means any natural or legal person who processes the data on behalf of the Company. It refers to third-party companies or individuals employed by the Company to facilitate the Service, to provide the Service on behalf of the Company, to perform services related to the Service or to assist the Company in analyzing how the Service is used.

    Under GDPR, You can be referred to as the Data Subject since You are the individual using the Service.