Effective Date: 07/07/2026

Last Updated: 07/07/2026

This Privacy Policy (“Policy”) describes how Dux Bio, Inc. and its affiliates (“Dux Bio,” “we,” “us,” or “our”) collect, use, disclose, and safeguard information obtained through www.dux.bio (the “Site”) and related services, including product information requests, distributor and provider inquiries, account registrations, and communications with our sales, regulatory, and customer support teams (collectively, the “Services”). By accessing or using the Site, you agree to the practices described in this Policy.

This Policy applies to visitors, prospective and current customers (including licensed physicians, clinics, hospitals, and other healthcare providers and distributors), and other individuals who interact with the Site. It does not apply to information processed by Dux Bio or its affiliates in contexts governed by a separate agreement (such as a distribution, supply, or manufacturing agreement) or by a business associate agreement executed under the Health Insurance Portability and Accountability Act (“HIPAA”), which shall control in the event of a conflict.

1. Scope and Nature of the Site

Dux Bio is a cGMP-compliant biologics distribution company specializing in umbilical cord-derived regenerative products, including but not limited to DuxCord™ and NativeMUSE™ product lines. The Site is intended for licensed healthcare providers, clinics, distributors, researchers, and other business partners, and is not intended to provide medical advice, establish a provider-patient relationship, or serve as a platform for patients to submit personal health information. The Site is not directed to individual patients seeking treatment, and we ask that visitors refrain from submitting protected health information (“PHI”) or other sensitive medical information through the Site’s forms, email addresses, or chat features.

2. Information We Collect

2.1 Information You Provide Directly

We may collect information that you voluntarily provide when you:

• Submit a contact, product inquiry, or “Request Information” form
• Register for an account, distributor portal, or provider ordering platform
• Request samples, pricing, clinical literature, or regulatory documentation
• Subscribe to newsletters, webinars, or marketing communications
• Apply to become a distributor, ambassador, or business partner
• Contact our customer support, regulatory affairs, or sales teams by phone, email, or chat
• Respond to surveys or participate in promotions

This information may include your name, business name and title, professional license or credential information, business mailing address, email address, phone number, order and billing history, and any other information you choose to include in free-text fields or attachments.

2.2 Information Collected Automatically

When you visit the Site, we and our service providers may automatically collect certain information about your device and usage through cookies, web beacons, log files, and similar technologies, including:

• IP address, browser type and version, device identifiers, and operating system
• Referring and exit pages, pages viewed, and time spent on the Site
• Approximate geographic location derived from IP address
• Interactions with emails, advertisements, and search terms used to reach the Site

2.3 Information from Third Parties

We may supplement the information described above with information from third parties, such as data analytics providers, marketing platforms, professional licensing databases, and business partners, for purposes of verifying credentials, preventing fraud, and improving our marketing and Services.

3. Cookies and Tracking Technologies

We use cookies and similar technologies (such as pixels and web beacons) to operate the Site, remember preferences, analyze traffic, and deliver relevant marketing. Categories of cookies used on the Site may include strictly necessary, performance/analytics, functional, and advertising cookies. You can control cookies through your browser settings, and where required by law, we will present a cookie consent banner allowing you to accept or reject non-essential cookies. Disabling certain cookies may limit functionality of the Site.

4. How We Use Information

We use the information we collect to:

• Respond to inquiries, process orders, and provide customer and technical support
• Verify professional licensure and eligibility to purchase regulated biologic products
• Communicate regulatory updates, clinical literature, product availability, and safety information
• Operate, maintain, and improve the Site and our Services
• Send marketing communications, subject to your preferences and applicable opt-out rights
• Detect, investigate, and prevent fraud, misuse, or violations of our terms
• Comply with applicable laws, regulations, and regulatory reporting obligations, including those administered by the U.S. Food and Drug Administration (“FDA”) and comparable authorities
• Evaluate distributor, ambassador, and partnership applications

5. Legal Bases for Processing (Where Applicable)

Where required by applicable law (such as the EU/UK General Data Protection Regulation), we process personal data on the basis of: (a) performance of a contract or steps requested prior to entering a contract; (b) our legitimate interests in operating and marketing our business, provided those interests are not overridden by your rights; (c) compliance with a legal obligation; and (d) your consent, where obtained.

6. How We Share Information

We do not sell personal information to third parties for monetary consideration. We may share information with:

• Service providers who perform functions on our behalf, such as website hosting, email delivery, analytics, customer relationship management, payment processing, and logistics
• Manufacturing, tissue-processing, and supply chain partners involved in fulfilling orders
• Professional advisors, including legal, regulatory, and accounting consultants
• Regulatory authorities, licensing boards, or law enforcement where required by law, subpoena, or to protect the rights, safety, or property of Dux Bio or others
• A successor entity in connection with a merger, acquisition, financing, or sale of assets
• Other parties with your consent or at your direction

7. Health-Related Information and Regulatory Context

Because Dux Bio distributes human cell and tissue products regulated under Section 361 of the Public Health Service Act and 21 C.F.R. Part 1271, certain information we collect from healthcare providers (such as facility licensure, accreditation, and clinical use attestations) supports regulatory compliance, traceability, and adverse event reporting obligations. We retain such records as required under applicable FDA recordkeeping regulations, including donor eligibility and traceability requirements. The Site is not designed to collect PHI from patients, and any adverse event or product complaint involving a specific patient should be reported through our designated regulatory affairs or quality contacts rather than through general website forms.

8. Data Security

We maintain administrative, technical, and physical safeguards designed to protect information from unauthorized access, disclosure, alteration, and destruction, consistent with the sensitivity of the information and applicable regulatory requirements (including cGMP and cGTP recordkeeping standards where relevant). However, no method of transmission or storage is completely secure, and we cannot guarantee absolute security.

9. Data Retention

We retain personal information for as long as necessary to fulfill the purposes described in this Policy, including to satisfy legal, regulatory, accounting, or reporting requirements applicable to human cell and tissue products (which may require extended retention periods), resolve disputes, and enforce our agreements. Retention periods vary depending on the type of information and the purpose for which it was collected.

10. Your Privacy Rights

10.1 California Residents

If you are a California resident, you may have rights under the California Consumer Privacy Act, as amended by the California Privacy Rights Act (“CCPA/CPRA”), including the right to know, delete, correct, and limit the use of certain personal information, and the right to be free from discrimination for exercising these rights. Dux Bio does not sell or share personal information for cross-context behavioral advertising, as those terms are defined under the CCPA/CPRA.

10.2 Other U.S. State Residents

Residents of certain other states with comprehensive privacy laws may have similar rights to access, correct, delete, or port their personal information, and to opt out of targeted advertising or certain profiling. We will honor verifiable requests in accordance with applicable law.

10.3 European Economic Area, UK, and Other Jurisdictions

If applicable data protection law grants you rights of access, rectification, erasure, restriction, portability, or objection, you may exercise these rights by contacting us using the information in Section 14. You may also have the right to lodge a complaint with your local data protection authority.

10.4 Exercising Your Rights

To submit a privacy request, please contact us at the details in Section 14. We may need to verify your identity before processing certain requests. You may designate an authorized agent to submit a request on your behalf where permitted by law.

11. Marketing Communications

You may opt out of receiving marketing emails from us by following the unsubscribe instructions included in each email or by contacting us directly. Please note that even after opting out of marketing communications, we may continue to send transactional or account-related communications, such as order confirmations and regulatory or safety notices.

12. Children’s Privacy

The Site is intended for business use by adults, including licensed healthcare professionals and business partners, and is not directed to individuals under the age of 18. We do not knowingly collect personal information from children. If we learn that we have inadvertently collected information from a child, we will take steps to delete it.

13. Third-Party Links

The Site may contain links to third-party websites, including those of manufacturing partners, clinical trial registries, and industry resources. This Policy does not apply to those third-party sites, and we encourage you to review their privacy policies before providing any information.

14. International Operations and Data Transfers

Dux Bio and its affiliated entities operate and support activities in multiple countries. As a result, information collected through the Site may be transferred to, stored, and processed in the United States or other countries that may have data protection laws different from those in your jurisdiction. Where required, we implement appropriate safeguards for such transfers, such as standard contractual clauses or equivalent mechanisms.

15. Changes to This Policy

We may update this Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. We will post the revised Policy on the Site with an updated “Last Updated” date, and, where required by law, provide additional notice of material changes. Your continued use of the Site after changes become effective constitutes acceptance of the revised Policy.

16. Contact Us

If you have questions, concerns, or requests regarding this Policy or our privacy practices, please contact us at:

Dux Bio, Inc.
5020 Thoroughbred Lane
Brentwood, TN 37027

Email: orders@dux.bio

Phone: (‭865) 323-4740‬

Note: This document is a general-purpose template and has not been reviewed by a licensed attorney. Because Dux Bio distributes FDA-regulated human cell and tissue products and may process information from healthcare providers, professional licensing bodies, and international jurisdictions, we recommend that this Policy be reviewed by qualified privacy and healthcare regulatory counsel prior to publication, with particular attention to CCPA/CPRA and state privacy law applicability, HIPAA/business associate considerations for any downstream patient data, cross-border data transfer requirements for your Czech Republic and other international operations, and FDA recordkeeping/traceability obligations under 21 C.F.R. Part 1271.