Last updated: July 31, 2026

YUGA BIO INC.

Privacy Policy

Effective Date: July 31, 2026 | Last Updated: July 31, 2026

Applies to: yugabio.com and the Krita platform

1. Who We Are and What This Policy Covers

Yuga Bio Inc. (“Yuga Bio,” “we,” “us,” or “our”) is a biotechnology software company based in San Francisco, California. We operate yugabio.com and Krita, an AI-powered platform that helps patients, caregivers, clinicians, and researchers synthesize molecular, clinical, and diagnostic data alongside scientific literature to generate personalized therapeutic hypotheses.

This Privacy Policy describes how we collect, use, store, share, and process information about you when you use our website and the Krita platform (together, the “Service”). It also describes your rights regarding your data and how to exercise them.

This policy applies to all users of the Service, including:

  • Patients accessing the Service on their own behalf
  • Caregivers or authorized representatives acting on behalf of a patient
  • Licensed clinicians, oncologists, and medical professionals
  • Researchers and bioinformaticians

By using the Service, you agree to the practices described in this policy. If you do not agree, please do not use the Service. The Service is offered only to individuals who are residents of, and physically located in, the United States. At registration you will be asked to attest that you are a United States resident, and that attestation is recorded with a date and time stamp. We do not offer the Service to individuals located outside the United States.

2. What Data We Process

Below we describe the types of data that we process from, about, or related to you.

We apply de-identification only on a limited-scope basis as described below. We run an automated process that detects and removes certain personal identifiers from medical-record extracts uploaded as documents, retaining a de-identified version while sequestering the raw identifiers from our AI models and third parties. We do not de-identify genomic or variant data, and we cannot guarantee de-identification of information you voluntarily enter into free-form chat. We also deliberately retain absolute diagnosis and treatment dates for clinical-trial matching. Because of these limitations, and because genomic data is inherently re-identifiable, we do not represent that the data we process is fully anonymized or de-identified within the meaning of applicable law. By uploading data, you acknowledge that:

  • Genomic data you upload may be inherently re-identifiable even without standard personal identifiers.
  • You have the authority to upload this data — either because it is your own, or because you are an authorized representative of the person whose data it is.
  • You understand and accept the identification risks described in this section.

2.1 Account and Identity Data

When you create an account, we process:

  • Name and email address
  • Your role (patient, caregiver, clinician, researcher)
  • Organization or institution name, if applicable
  • Team membership and access permissions within a Care Team
  • Login information

2.2 Uploaded Scientific and Clinical Data

When you use Krita to analyze data, you may upload what we refer to throughout this policy as your “molecular, clinical, and diagnostic data,” which includes::

  • Multi-omics sequencing data, including but not limited to bulk RNA-seq, single-cell RNA-seq (scRNA-seq), T-cell receptor sequencing (TCR-seq), whole exome or genome sequencing, somatic variant files (e.g., VCF), and gene expression matrices
  • Clinical and diagnostic data you choose to provide, including pathology reports, treatment history, clinical annotations, and records exported from electronic health record (EHR) systems or third-party diagnostic service providers
  • Documents and literature references

This data is uploaded by you voluntarily. We process it solely to provide the Service — to run analyses, return results, and power your team’s research.

Genomic sequencing data — including somatic tumor variant data — is unlike most other types of personal data. Standard methods of de-identification (such as removing your name and date of birth) do not eliminate the possibility that your data could be linked back to you. Your DNA sequence is unique to you and cannot be anonymized in the way that other data can.

2.3 Query and Interaction Data

When you interact with Krita, we process:

  • Your queries, prompts, and messages sent to the platform
  • AI-generated responses and analysis outputs
  • Thread history and conversational context
  • Inferred knowledge artifacts — such as case wikis and agent memory — that the platform generates based on your interactions

2.4 Usage Telemetry

We process technical usage data to operate the platform:

  • Which features you use and in what sequence
  • Session duration and frequency
  • Error logs and performance/usage metrics
  • Video screen capture of your session, including on-screen content, which is off by default and is collected only if you provide separate, explicit opt-in consent, and from which we make reasonable efforts to remove your username and email (although such removal cannot be guaranteed)

Usage telemetry does not include the content of your uploaded data, queries, or outputs. It is used only in aggregate and anonymized form to improve the Service.

2.5 Communications

If you contact us by email or through the platform, we retain those communications to respond to your requests and maintain a record of our interactions.

3. How We Use Your Data

We process data for the following purposes:

  • To provide the Krita Service — running analyses, returning results, maintaining your account, and enabling collaboration within your Care Team.
  • To maintain and improve platform reliability — diagnosing errors, optimizing performance, and ensuring the Service works as intended.
  • To respond to your support requests and communications.
  • To comply with applicable law and enforce our Terms of Service.

Aggregate, anonymized usage patterns — data that cannot be linked to you or your patients — may be used to improve the product and may be shared with other parties in that form.

4. How We Share Your Data

We may share data in the following circumstances.

4.1 Supporting Entities

We use third-party providers to support our operations of the Service. These providers process data on our behalf and under our instructions, and include the following categories of entities:

  • Cloud and operational infrastructure providers
  • Technical support
  • Security and outside advisors, such as counsel
  • Electronic-health-record connection providers that authenticate and enable data transfers you initiate
  • Analytics and product-improvement providers acting on our behalf under written agreement

We may disclose your data if required to do so by law, court order, or valid legal process, or if we believe in good faith that disclosure is necessary to protect the rights, property, or safety of Yuga Bio, our users, or the public.

4.3 Care Team Members

Within a Care Team you create or belong to, data you designate as shared — including datasets, threads, outputs, and inferred knowledge artifacts — will be accessible to other members of that team. You control who is added to your team and what they can see.

Because Yuga Bio processes consumer health data and genetic information, additional disclosures and rights apply under state health-privacy and genetic-privacy laws. Those disclosures are set out in our Consumer Health Data and Genetic Information Privacy Policy, which is a separate document linked on our homepage and incorporated into this Privacy Policy by reference.

5. Changes to Your Information

You control the information that you upload to the Service and you regulate the access to individuals who may upload information on your behalf are able to make changes to it as indicated in the Service. If you have changes to details such as your account information, or otherwise have questions on how to update your data, you may email us at support@yugabio.com.

6. Data Retention

We retain your data for as long as your account is active and as needed to provide the Service, and otherwise only as permitted or required by law. When you request deletion of your account, we delete your data, and direct our service providers and sub-processors to delete your data, within thirty (30) days, except for the limited categories except for records we must keep to comply with law, and data retained to resolve disputes or enforce our agreements). We describe the categories of consumer health data we retain, and how to exercise your deletion and withdrawal rights, in our Consumer Health Data and Genetic Information Privacy Policy.

6A. Your Privacy Rights

Subject to applicable law, you have the right to request access to the personal data we hold about you; to request correction of inaccurate data; to request deletion of your data; to request a copy of your data in a portable format; to withdraw a consent you have given; and to obtain information about how your data has been used and with whom it has been shared. You may exercise these rights by emailing support@yugabio.com, and we will respond within the timeframe required by law and in any event within thirty (30) days.

You may withdraw any optional consent at any time without affecting the lawfulness of processing carried out before withdrawal. When you delete data or withdraw consent, we will direct our service providers and sub-processors to give effect to your request. We do not discriminate against you for exercising any of these rights.

7. Security

We take the security of your data seriously and implement industry standard administrative, technical, and physical safeguards that are commercially reasonable in light of the nature of the data we process.

No security system is impenetrable and while we take reasonable efforts to keep your data secure, we cannot guarantee that unauthorized third parties will not circumvent our controls.

If you believe your account has been compromised or you suspect a security incident, please contact us immediately at support@yugabio.com.

8. Third-Party Data Sources

Krita may incorporate or reference publicly available scientific databases and datasets as part of its analyses, including databases such as The Cancer Genome Atlas (TCGA), published literature from PubMed and related sources, and publicly available clinical trial registries.

Each of these sources is subject to its own data use terms and licensing conditions. Users who require compliance with specific data use agreements — for example, as part of an institutional research protocol — are responsible for ensuring that their use of Krita is consistent with those agreements. Yuga Bio makes no warranty about the completeness, accuracy, or currency of any third-party data referenced by the platform.

9. Children

Account holders must be at least 18 years old. However, we recognize that Krita may be used to support care for patients with pediatric cancers and other childhood diseases. Parents and legal guardians may create accounts and use the Service on behalf of their minor child, including uploading the child’s molecular, clinical, and diagnostic data. In doing so, the parent or guardian represents that they have the authority to act on the minor’s behalf and accepts these Terms in that capacity. The Service is not intended for direct, unsupervised use by minors. We do not knowingly permit minors to create their own accounts. If you believe there is an account created by a minor, please contact us at support@yugabio.com.

10. Changes to This Policy

We may update this Privacy Policy at any time. The current version will always be available at yugabio.com/privacy and is effective upon posting. Where required by law, we will obtain your consent before making changes to the applicable privacy policy.

Your continued use of the Service after a change takes effect constitutes acceptance of the updated policy.

The date at the top of this document reflects when it was last updated. Prior versions are available upon request.

11. Business Transfers

Your data may be transferred to another entity if Yuga Bio is involved in a merger, acquisition, sale of assets, or similar transaction. Where legally required, we will obtain your consent before transferring such data. Any successor entity that receives your data as part of such a transaction will be required to honor the commitments in this Privacy Policy

12. Contact Us

If you have questions about this Privacy Policy or need to report a security concern, please contact us: