Privacy Policy

Effective date: July 29, 2026Last updated: September 14, 2026

1. Introduction

Gather Bio, Inc. ("Gather Bio," "we," "us," or "our") is a Delaware corporation building research infrastructure for autoimmune disease. GatherChart is a service operated by Gather Bio, Inc. This Privacy Policy describes how we collect, use, and share information through our website at gatherchart.com (the "Site") and through the GatherChart service you can sign in to (the "Service"), including the conversations you have with GatherChart and the accounts and data sources you choose to connect.

This Policy does not cover participation in research studies or at-home testing. If we invite you to take part in those, they will be governed by separate consent documents that we will present to you before anything is collected, including any documents required by an independent Institutional Review Board (IRB).

By using the Site or the Service, or by submitting our sign-up form or waitlist, you agree to this Privacy Policy.

2. Information we collect on the Site

We collect the following information when you choose to provide it:

• Sign-up form. Contact and identifying information you submit through the sign-up form on the Site — your name, email address, and zip code — together with your answer to whether you have an official lupus diagnosis from a healthcare professional and, if so, roughly when you received it; how you heard about us; and, if you arrived from an advertisement, the advertising click identifier attached to the link you followed.
• Waitlist. If you join a waitlist instead, your name, email address, and optionally the condition that brought you to GatherChart.
• Any information you include when you contact us directly, such as the content of an email.
• Basic technical and usage information collected automatically when you visit the Site, such as your browser type, device type, pages viewed, referring page, timestamps, and general location inferred from your IP address.

How the sign-up form works, and what you consent to by submitting it. The sign-up form is hosted for us by Jotform, a form provider we use on a HIPAA-enabled account. When you press Submit, Jotform transmits your answers — including your name, email address, zip code, and your diagnosis answer, which is health information — to Gather Bio's own systems, where we store them in order to (a) decide whether you are eligible for our program, which at this time is limited to people with an official lupus diagnosis, (b) create your GatherChart account invitation and email your personal sign-up link to the address you gave, and (c) keep a record of whether you went on to create an account and connect WhatsApp, so we can support you through onboarding and honor the onboarding offer described on the Site. Your diagnosis answer is self-reported; we do not verify it at this stage and we use it for eligibility only. Submitting the form, with the "I agree to the Privacy Policy" box checked, is your consent to this collection and transmission. If you would rather not provide this information through the form, you can email us at hello@gatherbio.com instead.

3. Information we collect in the Service

When you create a GatherChart account and use the Service, we collect:

• Account information. Your name, email address, and a password, which we store only in protected (hashed) form.
• Your conversations. What you tell GatherChart in check-ins and chats — which may include how you are feeling, symptoms, and anything else you choose to share. We store these conversations to keep your record for you and to continue the conversation with context.
• Your WhatsApp connection. If you connect WhatsApp, we record the phone number your messages come from so we can recognize you. Messages you exchange with GatherChart over WhatsApp are delivered by WhatsApp, a Meta company, and are subject to WhatsApp's own terms and privacy policy while in transit on its network. We design the messages we send over WhatsApp to avoid including your medical records, results, or other health details — the details stay in the Service, and the thread carries the conversation.

Beyond that, the Service is built around connections that you turn on one at a time. Every connection is off until you switch it on, and each collects the minimum it needs:

• Medical records. If you connect your patient portals or insurance records, you authorize us — through a patient records-access provider acting on your instruction — to retrieve your visits, lab results, and medications, and we store them to build your timeline in the Service.
• Voice notes. If you send voice notes, we store the audio and have it transcribed by a speech-to-text provider bound by confidentiality obligations, and we store the transcript as part of your conversation.
• Wearables and Apple Health. If you connect a wearable or import Apple Health data, we collect the health and activity metrics you authorize, such as sleep, heart rate, and activity.
• Calendar. If you connect your calendar, we request your free/busy intervals — the start and end times of busy periods — and, if you also allow it, permission to add events. We do not receive event titles, descriptions, attendees, or locations, and we use the intervals only to time our check-ins considerately. Adding events is used for one thing: when you ask GatherChart to remind you about something, we create that reminder as an event on your calendar so your own device can alert you. We do not read, change, or delete anything already in your calendar, and we do not add anything you did not ask for.
• Environmental context. If you turn on environmental context, we store your area only — a city, region, or zip code. Your precise coordinates are rounded on your device before anything is sent to us, and we never store them.

You can disconnect any of these at any time in Settings, which stops new collection from that source. You can ask us to delete what was already collected, as described in Section 10.

4. Analytics, cookies, and similar technologies

We use first-party analytics to understand how visitors find and use the Site. When you visit, we assign your browser a randomly generated visitor identifier and store it on your device using a cookie or equivalent browser storage. That identifier does not contain your name or contact information, but it persists across visits and lets us recognize a returning browser.

We log a record of each page you view, associated with that identifier, along with the technical and usage information described in Section 2. We use this to measure traffic, understand which pages and referral sources are useful, and improve the Site.

If you later join our waitlist, information you submit through the form may be associated with the visitor identifier for that browser, which means analytics activity we have recorded can become linked to you.

You can clear or block cookies and similar storage through your browser settings. Blocking them may affect how parts of the Site function.

We honor the Global Privacy Control (GPC) signal. If your browser or a browser extension sends GPC, we do not assign your browser a visitor identifier, we do not log your pageviews, and we do not store analytics information on your device. You can still join our waitlist with GPC enabled — your sign-up simply will not be linked to a browser identifier. The bot protection described in Section 5 still runs, because it is what keeps our forms usable.

5. Bot protection (Cloudflare Turnstile)

We use Cloudflare Turnstile to protect our forms from automated abuse and spam. Turnstile runs automatically in the background and may collect information about your browser, device, and interaction with the page in order to distinguish human visitors from bots. This information is processed by Cloudflare, Inc. as our service provider.

Cloudflare's handling of this information is described in the Cloudflare Turnstile Privacy Addendum and the Cloudflare Privacy Policy.

6. How we use information

We use the information we collect to:

• Provide the Service: keep your record, organize what you and your connected sources tell us into one timeline, check in with you, and respond with context.
• Act on your sign-up form: confirm your eligibility, create your account invitation, email you your sign-up link, and follow whether you complete onboarding and connect WhatsApp.
• Add you to our waitlist and notify you when GatherChart opens to you.
• Respond to your questions and communicate with you about GatherChart and Gather Bio.
• Operate, maintain, secure, and improve the Site and the Service, including measuring traffic and protecting against fraud and automated abuse.
• Comply with legal obligations.

We do not use your health information for advertising, and we do not show you advertising.

7. How we share information

We do not sell your personal information. We share information only in these limited circumstances:

• With service providers who help us operate the Site and the Service under contractual confidentiality obligations — including providers of hosting and infrastructure, database services, form hosting (Jotform, on a HIPAA-enabled account, for the sign-up form), transactional email delivery (for your sign-up link), bot protection, message delivery (such as WhatsApp for conversations you choose to have there), records access, transcription, and the data sources you choose to connect.
• When required by law, regulation, legal process, or governmental request.
• In connection with a corporate transaction such as a merger, acquisition, or financing, where information may be transferred subject to this Policy.

8. Google user data (Limited Use)

Connecting your calendar is optional, and if you do it, GatherChart receives data from Google APIs. This section describes exactly what we ask for and what we do with it, and it governs that data in addition to the rest of this Policy.

We request only these permissions, and only when you press “Connect Google Calendar”:

• See the availability on your calendars (calendar.freebusy) — we read only the start and end times of busy periods, so a check-in doesn't arrive in the middle of something. We never receive event titles, descriptions, attendees, or locations through this permission, because the Google endpoint it reaches does not return them. The busy times are used to choose a send time and are then discarded; they are not stored.
• View and edit events on your calendars (calendar.events) — used for exactly one action: creating a reminder event that you asked for, so your own device can alert you. GatherChart never reads, changes, or deletes an event, and never creates one you did not request.
• Your email address and basic account identity (openid, userinfo.email) — used only to show you which Google account you connected, so a calendar linked from the wrong account is visible to you rather than silently wrong.

GatherChart's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Specifically:

• We use Google user data only to provide and improve the user-facing features described above.
• We do not transfer Google user data to third parties except as necessary to provide or improve those features, to comply with applicable law, or as part of a merger, acquisition, or sale of assets with notice to users.
• We do not use Google user data for advertising, and we do not sell it.
• We do not use Google Workspace APIs data to develop, improve, or train generalized or non-personalized artificial intelligence or machine learning models. Calendar data is never sent to a model provider for training, and it is not used to build models that serve anyone other than you.
• No human reads your Google user data, except where you have given specific consent, where it is necessary for security purposes such as investigating abuse, to comply with applicable law, or where the data has been aggregated and de-identified.

Your Google refresh token is encrypted at rest and is used only to obtain short-lived access tokens for the two actions above. You can disconnect at any time from Settings, which revokes the token with Google and deletes it on our side, or from your Google Account permissions page.

9. Data security

We use commercially reasonable administrative, technical, and physical safeguards designed to protect your information. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

10. Data retention and deletion

We retain your account information and Service data, including your conversations and connected-source data, for as long as your account is active. We retain sign-up form submissions and waitlist information for as long as needed to operate the program, contact you, and support your onboarding, unless you ask us to delete it; a copy of each sign-up submission also remains with our form provider under its retention settings until we delete it there. We retain analytics records, including visitor identifiers and pageview logs, for up to 24 months, after which they are deleted or aggregated so they can no longer be linked to an individual browser. You may request deletion of your information at any time by emailing hello@gatherbio.com. We will respond to verified requests within the timeframes required by applicable law.

11. Your privacy rights

Depending on where you live, you may have rights to access, correct, delete, or restrict the use of your personal information, and to opt out of the sale or sharing of your personal information. We do not sell personal information. To exercise any of these rights, email hello@gatherbio.com. We will not discriminate against you for exercising your rights.

Residents of California, Washington, Virginia, Colorado, Connecticut, Texas, Utah, and other states with applicable privacy laws have specific rights under those laws. We honor verified requests in accordance with the law that applies to you.

12. Children's privacy

The Site is not directed to children under 18, and we do not knowingly collect personal information from children. If you believe a child has provided us information, email hello@gatherbio.com and we will delete it.

13. Changes to this Policy

We may update this Policy from time to time. When we do, we will revise the "Last updated" date above. Material changes will be communicated through the Site.

14. Contact us

Questions about this Policy or your information can be sent to: