Effective Date: September 25th , 2026

Your privacy matters to you, and it matters to us. This Privacy Policy explains how VION Biosciences LLC (“VION,” “we,” “us,” or “our”) collects, uses, shares, and protects personal data when you visit or interact with www.vionbiosciences.com (the “Site”), including through contact forms, resource downloads, newsletter sign-ups, and other interactions available on the Site.

This Policy covers the public website only. It does not cover VION’s handling of employee, contractor, or job applicant data. All VION Biosciences LLC group company websites — including immunospot.com, immunospot.eu, echelon-inc.com, anshlabs.com, bioassaysys.com, aldon-chem.com, and any other website operated by a VION affiliate — rely on and are governed by this Privacy Policy, unless a particular affiliate site publishes its own separate privacy notice.

VION Biosciences LLC and its affiliated companies (“Affiliates”) support the global life sciences and advanced technology industries with discovery-to-delivery solutions. Personal data submitted through the Site may be shared with Affiliates as described below.

1. Personal Data We Collect

A. Information you provide directly

• Contact and identification data: name, business email address, phone number, job title, employer/organization name — submitted through contact forms, demo or quote requests, event registrations, or resource (e.g., white paper) downloads.
• Newsletter and marketing preferences: email address and topics of interest, if you subscribe to communications.
• The content of any message, inquiry, or support request you send us.

B. Information collected automatically

• Technical and usage data: IP address, browser and device type, operating system, referring/exit pages, pages viewed, and time stamps, collected through cookies, tags, and similar tracking technologies.

We use Google Analytics and HubSpot across our websites to collect and analyze this technical and usage data, to understand Site traffic and engagement, and to support our marketing and sales operations.

VION and certain Affiliates also use the following categories of technology. The specific tools in use vary by website:

• Advertising and remarketing tags. Google Ads conversion and remarketing tags are in use across all VION group websites (five of which share a single Google Ads account) to measure advertising performance and to show VION ads to prior visitors on other websites. The LinkedIn Insight Tag, which supports advertising measurement and retargeting on LinkedIn, is in use on one of our sites only. VION does not use the Meta (Facebook) Pixel on any of its websites.
• Session recording and heatmap tools. Certain sites use tools that record how visitors interact with a page (such as clicks, scrolling, and mouse movement) or generate aggregate activity heatmaps: Hotjar (immunospot.eu and one other site), Microsoft Clarity (echelon-inc.com), Inspectlet (anshlabs.com), and Crazy Egg (on one of our sites).
• Visitor identification tools. On one of our sites, VION also uses ZoomInfo and Apollo.io, which identify the companies, and in some cases individuals, associated with a website visit, and participates in the AppNexus/Xandr advertising exchange.

C. Information from other sources

VION may purchase or receive business contact information — such as name, business email address, job title, and employer/organization name — from trade shows, industry databases, or third-party list and data providers, and may combine that information with the data described above for the marketing purposes described in Section 2.

2. How We Use Personal Data

We use the personal data described above for the following purposes:

• To respond to your inquiries and provide the information, quotes, or materials you request — necessary to take steps at your request before entering into a contract, or to perform a contract with you (Article 6(1)(b) GDPR).
• To send marketing communications about VION products and services, including business contact information purchased or received as described in Section 1C, where you have opted in or based on our legitimate interest in promoting our products and services to business contacts (Article 6(1)(a) or 6(1)(f) GDPR, as applicable), and to honor opt-out requests.
• To operate, maintain, secure, and improve the Site, and to understand how visitors use it, including through Google Analytics and HubSpot, which is in our legitimate interest in operating our business (Article 6(1)(f) GDPR).
• To comply with legal obligations and to detect, investigate, and prevent fraud or misuse of the Site (Article 6(1)(c) GDPR, or Article 6(1)(f) GDPR where not strictly required by law).

For visitors in the European Economic Area, the United Kingdom, or Switzerland, the paragraphs above identify the specific Article 6 GDPR legal basis on which we rely for each purpose.

3. How We Share Personal Data

• With VION Affiliates. VION is part of a corporate group that includes affiliated companies, including entities located outside the United States. We may share personal data collected through the Site with our Affiliates for the purposes described in Section 2, and for internal administration.
• With service providers. We use third-party vendors to host, operate, and support the Site and our business systems, including our email, file storage, and CRM platforms, and our managed IT services provider. These vendors process personal data on our behalf and are contractually restricted from using it for their own purposes.
• For legal reasons. We may disclose personal data to comply with applicable law, regulation, legal process, or governmental request, or to protect the rights, property, or safety of VION, our users, or others.
• In connection with a business transaction. If VION is involved in a merger, acquisition, financing, or sale of assets, personal data may be transferred as part of that transaction.

We do not sell personal data collected through the Site for monetary consideration. As described in Section 1B, VION and certain Affiliates use advertising, remarketing, and visitor-identification technologies, including Google Ads conversion and remarketing tags across our websites and, on one of our sites only, the LinkedIn Insight Tag, ZoomInfo, Apollo.io, and the AppNexus/Xandr advertising exchange. VION does not use the Meta (Facebook) Pixel on any of its websites. Use of these advertising technologies may be considered a “sale” or “sharing” of personal data for cross-context behavioral advertising under the California Consumer Privacy Act and similar U.S. state laws, even though no money changes hands; see Section 6 for how to opt out.

4. International Data Transfers

VION is based in the United States, and personal data submitted through the Site is processed in the United States. If you are located in the European Economic Area or the United Kingdom, this means your personal data will be transferred outside of those regions.

Where we transfer personal data from the EEA or UK to VION in the United States, we do so under the Standard Contractual Clauses approved by the European Commission, together with any additional safeguards described in our internal transfer assessments.

VION Biosciences LLC complies with the EU-U.S. Data Privacy Framework (“EU-U.S. DPF”) and the UK Extension to the EU-U.S. DPF, as set forth by the U.S. Department of Commerce. VION Biosciences LLC has certified to the U.S. Department of Commerce that it adheres to the EU-U.S. Data Privacy Framework Principles (“EU-U.S. DPF Principles”) with regard to the processing of personal data received from the European Union and the United Kingdom in reliance on the EU-U.S. DPF and the UK Extension to the EU-U.S. DPF. If there is any conflict between the terms in this Privacy Policy and the EU-U.S. DPF Principles, the Principles shall govern. To learn more about the Data Privacy Framework program, and to view our certification, please visit https://www.dataprivacyframework.gov/.

The following U.S. entities and subsidiaries of VION Biosciences LLC also adhere to the EU-U.S. DPF Principles, including under the UK Extension to the EU-U.S. DPF, and are covered by this certification: Gateway Chemicals, LLC, Ansh Labs, LLC, BioAssay Systems, LLC, Haematologic Technologies, LLC, Cellular Technology Limited, CTL Analyzers, LLC, CTL Reagents, LLC, CTL Laboratories, LLC, CTL Technology Limited, CTL software Ltd. and Echelon Biosciences, Inc (Echelon, LLC).

In compliance with the EU-U.S. DPF and the UK Extension to the EU-U.S. DPF, VION Biosciences LLC commits to cooperate and comply respectively with the advice of the panel established by the EU data protection authorities (“EU DPAs”) and the UK Information Commissioner’s Office (“ICO”) with regard to unresolved complaints concerning our handling of human resources data received in reliance on the EU-U.S. DPF and the UK Extension to the EU-U.S. DPF in the context of the employment relationship.

In compliance with the EU-U.S. DPF and the UK Extension to the EU-U.S. DPF, VION Biosciences LLC commits to cooperate and comply respectively with the advice of the panel established by the EU data protection authorities (“EU DPAs”) and the UK Information Commissioner’s Office (“ICO”) with regard to unresolved complaints concerning our handling of personal data other than human resources data, received in reliance on the EU-U.S. DPF and the UK Extension to the EU-U.S. DPF. These services are provided at no cost to you. Under certain conditions, you may also invoke binding arbitration under Annex I of the EU-U.S. DPF Principles. VION Biosciences LLC is subject to the investigatory and enforcement authority of the U.S. Federal Trade Commission with respect to its compliance with the EU-U.S. DPF and the UK Extension to the EU-U.S. DPF.

VION Biosciences LLC may be required to disclose personal data in response to lawful requests by public authorities, including to meet national security or law enforcement requirements.

VION Biosciences LLC remains liable under the EU-U.S. DPF Principles for the onward transfer of personal data to third parties, including agents, that process it on our behalf in a manner inconsistent with the Principles, unless we prove we are not responsible for the event giving rise to the damage.

5. Data Retention

We retain personal data collected through the Site for as long as necessary to fulfill the purposes described in this Policy, including maintaining our business relationship with you, responding to your inquiries, and complying with our legal, tax, and contractual obligations. Retention periods vary depending on the type of data and the purpose for which it was collected. When personal data is no longer needed for these purposes, we take steps to delete, destroy, or anonymize it in accordance with our internal data retention practices.

6. Your Privacy Rights

If you are located in the EEA or UK

You have the right to request access to, correction of, or deletion of your personal data; to object to or restrict certain processing; to request a portable copy of your data; and, where processing is based on consent, to withdraw that consent at any time. You also have the right to lodge a complaint with your local data protection supervisory authority.

If you are located in California or another U.S. state with a comprehensive privacy law

You may have the right to know what personal data we have collected about you, to request deletion or correction of that data, and to opt out of the sale or sharing of personal data or its use for targeted advertising. VION does not sell personal data for monetary consideration; however, as described in Sections 1B and 3, our use of advertising technologies such as Google Ads and, on one of our sites, the LinkedIn Insight Tag and other advertising tools, may constitute “sharing” for cross-context behavioral advertising under California and similar state law. You can opt out using the mechanism described below.

How to exercise your rights

You can exercise these rights by contacting us at privacy@vionbiosciences.com. We will verify your request and respond within the time required by applicable law.

7. Children’s Privacy

The Site is directed to business professionals and is not intended for, and we do not knowingly collect personal data from, children under 16.

8. Security

We maintain reasonable technical and organizational measures designed to protect personal data submitted through the Site against unauthorized access, disclosure, alteration, or destruction. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

9. Changes to This Policy

We may update this Policy from time to time. We will post the revised Policy on this page with an updated Effective Date, and where changes are material, we will provide additional notice as appropriate.

10. Contact Us

VION Biosciences LLC

20521 Chagrin Blvd, Shaker Heights, OH 44122, USA

Attn: Privacy Team

privacy@vionbiosciences.com