1. Business Operator Information

Company	rVirogen, Inc.
Address	Dai-ichi Hoki Head Office Building 3F, 2-11-17 Minami-Aoyama, Minato-ku, Tokyo 107-0062, Japan
Representative	Yumesaku Ishigaki, Representative Director and President

rVirogen, Inc. (the “Company”) complies with the Act on the Protection of Personal Information of Japan and other applicable laws, regulations, and guidelines, and handles personal information appropriately in accordance with this Privacy Policy.

2. Personal Information Collected and Purposes of Use

The Company may collect personal information, including names, affiliations, job titles, email addresses, telephone numbers, inquiry details, and other information, through email communications, exchanges of business cards, meetings, and other means.
The Company uses the personal information it collects for the following purposes:

1. Responding to inquiries and communicating with the relevant individual;
2. Communicating, consulting, and providing information regarding business alliances, investments, financing, joint research, licensing, and other Company business activities;
3. Executing, performing, and administering agreements;
4. Conducting the Company’s business activities and operations incidental thereto; and
5. Complying with legal and regulatory obligations.

If the Company changes any purpose of use, it will do so only to the extent reasonably related to the original purpose and will publicly announce or notify the relevant individual of the revised purpose.

3. Outsourcing of Personal Information Processing

The Company may outsource the processing of personal information to external service providers to the extent necessary to achieve the purposes of use described above.
In such cases, the Company will appropriately select the service provider, enter into an agreement setting forth necessary requirements, and exercise necessary and appropriate supervision over the service provider.

4. Provision to Third Parties

The Company will not provide personal data to any third party without the prior consent of the relevant individual, except in any of the following circumstances:

1. When required or permitted by applicable laws or regulations;
2. When necessary to protect the life, body, or property of a person and it is difficult to obtain the individual’s consent;
3. When particularly necessary to improve public health or promote the sound development of children and it is difficult to obtain the individual’s consent;
4. When cooperation is necessary for a national government agency, local government, or a party entrusted by either of them to perform duties prescribed by law, and obtaining the individual’s consent may interfere with the performance of those duties; or
5. In any other case permitted by applicable laws or regulations.

Please see Section 8 (“Use of Cookies and Google Analytics”) for the Company's handling of information provided to service providers located outside Japan using cookies and similar technologies (in connection with Article 28 of the Act on the Protection of Personal Information).

5. Security Control Measures

The Company implements the following security control measures to prevent leakage, loss, damage, or other improper handling of personal data:

• Organizational measures: The Company designates a person responsible for the handling of personal information and establishes a system for understanding and managing the status of personal data handling.
• Personnel measures: The Company provides necessary guidance to and supervision of directors, officers, and employees who handle personal data.
• Physical measures: The Company manages devices, electronic media, and documents containing personal data to prevent theft, loss, unauthorized removal, and similar risks.
• Technical measures: The Company limits access to personal data to persons who require access for business purposes and implements access controls, SSL/TLS encryption, and other measures designed to prevent unauthorized access.

6. Retention Period

The Company retains personal information for the period necessary to achieve the relevant purpose of use or for any period required by applicable laws or regulations. When retention is no longer necessary, the Company will appropriately delete or dispose of the information.

7. Requests for Disclosure and Other Actions

With respect to retained personal data concerning an individual, that individual may request the following actions in accordance with applicable laws and regulations:

1. Notification of the purpose of use;
2. Disclosure;
3. Correction, addition, or deletion;
4. Suspension of use or erasure;
5. Suspension of provision to third parties; and
6. Disclosure of records concerning provision to third parties.

To make any such request, please contact the inquiry desk specified below. The Company will provide instructions regarding the submission method, identity verification, and any other required procedures.
The Company may charge a fee for responding to such requests, to the extent permitted by applicable laws and regulations.
The Company will respond in accordance with applicable laws and regulations after confirming that the request is made by the relevant individual or a duly authorized representative.

8. Use of Cookies and Google Analytics

The Company’s website uses Google Analytics, an access analysis service provided by Google LLC, to understand website usage and to maintain and improve the usability and quality of the website.
Google Analytics uses cookies and similar technologies to collect information regarding the use of the Company’s website. The information collected may include pages viewed, access dates and times, device and browser information, referring sources, approximate geographic information, and other website usage information.
Information collected through Google Analytics is managed in accordance with the Google LLC terms of service and privacy policy. The Company uses information obtained through Google Analytics to analyze and improve the use of its website.
For further information regarding Google’s handling of information, please refer to How Google uses information from sites or apps that use our services and the Google Privacy Policy.
Users who do not wish Google Analytics to collect data may disable cookies in their browser settings or use the Google Analytics Opt-out Browser Add-on. Disabling cookies may affect certain functions or displays on the Company’s website.
Information obtained through Google Analytics may be transmitted to, and stored and processed on, servers of Google LLC (headquartered in the United States) located outside Japan. To the extent this constitutes a provision of personal data to a third party located in a foreign country under Article 28 of the Act on the Protection of Personal Information, the Company will take the measures required under that article (such as obtaining the individual's consent or confirming that the recipient maintains a system meeting the standards under Article 28, paragraph 1). Information regarding the handling of personal information in the relevant foreign country will be provided upon request, to the extent required by applicable laws and regulations.

9. Contact and Complaints

For inquiries, requests for disclosure or other actions, or complaints concerning the Company’s handling of personal information, please contact the following inquiry desk. The Company will endeavor to respond to complaints appropriately and promptly.

Contact	Personal Information Inquiry Desk, rVirogen, Inc.
Address	Dai-ichi Hoki Head Office Building 3F, 2-11-17 Minami-Aoyama, Minato-ku, Tokyo 107-0062, Japan
Email	info@rvirogen.com

10. Amendments to this Privacy Policy

The Company may amend this Privacy Policy as necessary in response to changes in applicable laws or regulations, changes in its business activities, or other circumstances.
The amended Privacy Policy will take effect when posted on the Company’s website.

Effective date: August 4, 2026