HEALTHCARE PROFESSIONALS, INVESTIGATOR AND STUDY PERSONNEL PRIVACY NOTICE

Fate Therapeutics, Inc.

Fate Therapeutics, Inc. (“Fate Therapeutics”, “we”, “us”, or “our”) are conducting a clinical trial at your site. This Privacy Notice as it relates to the personal information of healthcare professionals, principal investigators, and investigator site personnel conducting our clinical trials (“Clinical Trial Personnel,” “you”, or “your”).

Information We Collect and How We Collect It

If you are an investigator for one of our clinical trials or one of the site staff (e.g., a nurse or technician), we may collect personal information about you such as:

Contact Details: your name, identification number and other professional contact details (address, telephone number, email address);

Professional Information: your qualifications and your experience;

Trial Related Information: information relating to your clinical trial involvement, such as quality events, adverse event reports, and clinical trial reports; and

Financial Information: under a separate process, and only if you will be paid / reimbursed for your work directly by us, your bank account details for payment processing, and amount of compensation and remuneration received.

We collect information about you in a variety of ways depending on how you interact with us, including: (i) directly from you when you provide it to us; and (ii) from other sources, including, for example, third parties, business partners, our affiliates, or publicly available sources.

How We Use Information and Legal Bases for Processing

Fate (and/or a CRO on Fate’s behalf) will collect, use and otherwise process your personal data to the extent necessary for the purposes as set out in the table below.

If you are an HCP in the European Economic Area (“EEA”) / United Kingdom (“UK”), the following chart also provides additional information about our legal grounds for processing your personal information:

Categories of Personal Information	Processing Purposes	Legal Basis (where you are located in the EEA/UK)
Contact Details and Professional Information	Confirm your qualifications and experience for the trial which may include conducting background checks to verify your credentials, training and licensing necessary for the conduct of clinical studies	To comply with a legal obligation (e.g., under the Clinical Trials Regulation and relevant national laws and with reference to the verification of your licensing) (Article 6(1)(c) GDPR). We have a legitimate interest to ensure the effective administration and conduct of the trial (e.g., with reference to conducting background checks) (Article 6(1)(f) GDPR).
Contact Details, Professional Information, Trial Related Information	For the authorization, administration and conduct of the trial including, site feasibility, study implementation, management, and monitoring, the storage of your personal information as part of the trial database (and paper files) as needed for the implementation, performance, and record-keeping (archiving) of the trial	To comply with a legal obligation (e.g., under the Clinical Trials Regulation and relevant national laws) (Article 6(1)(c) GDPR). We have a legitimate interest to ensure the effective administration and conduct of the trial and to comply with its legal obligations outside of the EEA/UK. For instance, we are subject to obligations from non-EEA countries to store your personal information for a certain amount of time (Article 6(1)(f) GDPR).
Contact Details	For communicating with you in the context of the conduct of clinical studies	We have a legitimate interest to ensure the effective administration and conduct of the trial (Article 6(1)(f) GDPR).
Contact Details, and Trial Related Information	To comply with our legal and regulatory obligations (including, anti-corruption and safety data reporting laws, and other than as identified in the row below) or to respond to legal requests or court orders	To comply with a legal obligation (e.g., under anti-corruption and safety data reporting laws) (Article 6(1)(c) GDPR). We have a legitimate interest to ensure the effective administration and conduct of the trial and to comply with its legal obligations outside of the EEA/UK (Article 6(1)(f) GDPR).
Contact Details, Financial Information, and Transparency Information	Comply with financial reporting requirements in respect of the payments made for the services provided	To comply with a legal obligation (e.g., under financial and regulatory reporting laws) (Article 6(1)(c) GDPR). We have a legitimate interest to comply with applicable transparency reporting obligations (including, those outside of the EEA/UK), and to ensure the effective administration and conduct of the trial (Article 6(1)(f) GDPR).
Contact Details	To publicly disclose your involvement in the trial, including (if applicable) your association as an investigator to comply with regulatory requirements, for posting the European Clinical Trials Database, ClinicalTrials.gov, and similar sites	We have a legitimate interest to ensure the effective administration and conduct of the trial and to comply with our legal obligations outside of the EEA/UK relating to the disclosure of our involvement in the trial (Article 6(1)(f) GDPR).
All categories of personal information identified above	Share your personal information as described further below including, with other companies with which we collaborate for purposes of the conducting of the trial regarding e.g., joint development and distribution of our products	We have a legitimate interest to ensure the effective administration and conduct of the trial through e.g., joint collaborations or similar, and to comply with our legal obligations outside of the EEA/UK (Article 6(1)(f) GDPR).
Contact Details, and Professional Information	Store your details in resource databases to identify and, if applicable, engage with you for other research collaboration and professional consulting opportunities based on your professional expertise	We have a legitimate interest to manage our business and the conduct of future studies (Article 6(1)(f) GDPR).
All categories of personal information identified above	To prepare, complete and implement any reorganization, merger, sale, joint venture, transfer or other disposition of all or any portion of our business, assets or stock (including any bankruptcy proceedings)	We have a legitimate interest to manage our business and assets (Article 6(1)(f) GDPR).
All categories of personal information identified above	To take legal action or otherwise protect safety, rights or property of our customers, the public, us and our affiliates	To comply with a legal obligation (e.g., under safety or property laws) (Article 6(1)(c) GDPR). We have a legitimate interest to protect our business and assets (Article 6(1)(f) GDPR).

Please note that if you are located in the EEA/UK, you have a right to object to the processing of your personal information where that processing is carried out for our legitimate interests. However, we may not be able to fulfil this request in all instances in accordance and under the conditions of applicable laws. Information on the balancing test carried out to allow reliance on our legitimate interests is available upon request via the contact information set out below.

Where we require your personal information to comply with (as applicable) our legal or contractual requirements (as set out in the table above where processing is required to perform a contract or fulfil our legal obligations), failure to provide this personal information could make it impossible for you to take part in the clinical trial.

Retention of Information

Your personal information will be stored for as long as required to satisfy the purpose for which it was collected by us under applicable local, state, national and/or international laws, rules and/or regulations. Your personal information processed for the purpose of conducting clinical studies will be kept in active database for 15 years until after the end of the last research project in which you participated and archived on the CT Database for at least 25 years after the close of the relevant studies. This retention period may be extended if Fate is required to preserve your personal data in connection with litigation, investigations and proceedings, or if a longer retention period is required by applicable law.

How We Share Information

We may share information with our corporate affiliates (e.g., parent company, sister companies, subsidiaries, joint ventures, or other companies under common control), service providers involved in the clinical trials (e.g., third parties that perform services to support our business and internal operations, including ethics committees, study monitors, laboratory service providers), and other third parties (e.g., in response to subpoenas, warrants, court orders, government inquiries or investigations, or in connection with any other legal process, or to comply with relevant laws and regulations).

Your Choices

Some jurisdictions give you a right to make the following choices regarding your personal information, in accordance with applicable laws:

Access to Your Personal Information. You may request access to the personal information we maintain about you, or confirmation that we have information about you, by following the instructions described below. In certain limited circumstances, you may also request to receive access to your personal information in a portable, machine-readable format.
Updating or Correcting Your Personal Information. You may request that we update or correct inaccuracies in any personal information we maintain about you by following the instructions described below.
Deletion of Your Personal Information. You may request that we delete your personal information by following the instructions described below. Please note that in certain situations, and to the extent permitted by law, we may be required to keep your personal information to comply with our legal obligations, resolve disputes, enforce our agreements, to protect against fraudulent, deceptive, or illegal activity, or for another one of our business purposes.

Objection to Certain Processing. You may object to the processing of your personal information under certain circumstances by contacting us at the address described below.
Revocation Of Consent. Where we process your personal information based upon consent, you may revoke your consent. Please note, if you revoke your consent for the processing of personal information then we may no longer be able to provide you services.
Limitation of the Processing: You can request the limitation of the processing of your personal information (i.e. ask us to temporarily freeze the use of your personal information).

Data portability: You can also ask for a copy of your personal information to be provided to you, or a third party, in digital format. You may also have the right to file a complaint with the competent data protection authority, for example if you believe we did not properly handle your personal information or did not respect your rights.

How to Submit a Request to Access, Correct, or Delete Your Personal Information or Any Other Abovementioned Right

To submit such a request dealing with your personal information, please contact us by email at privacy@fatetherapeutics.com, or by phone at 888-852-3891.

International Data Transfers

We may transfer your personal information to countries other than the country in which the information was originally collected. As a result, your personal information may be processed and stored outside of your country of residence where privacy laws may be less stringent than the laws in your country.

If you are located in the EEA or United Kingdom, we will transfer personal information outside of the EEA/UK in compliance with data protection laws in the EEA/UK (for example, to the U.S. where Fate is located) and as deemed necessary, enter into a data transfer agreement (e.g., standard contractual clauses), seek to rely on Binding Corporate Rules or otherwise make the transfer in reliance on a derogation under EEA/UK data protection laws (e.g., where the transfer is necessary for the defence of legal claims). If you would like more information in relation to, or a copy of the relevant safeguards, you can contact us using the details set out below.

Contacting Us

If you have any questions, comments, or concerns about our privacy practices, please contact our Data Protection Officer using the information below.

12278 Scripps Summit Drive
San Diego, CA 92131
Attn: Legal Department
Email: privacy@fatetherapeutics.com
Phone: 888-852-3891

The Fate affiliated entity that you contract with, or that otherwise is the entity with which you have a business relationship, is the controller of your personal data for purposes of applicable data protection and privacy laws.

EEA/UK Data Representative

We have appointed DataRep as our Data Protection Representative in the EEA and the UK. If you reside in the EEA/UK and wish to raise a question to us or otherwise exercise your rights in respect of your personal data, you may do so by either (1) sending an email to DataRep at datarequest@datarep.com, including “Fate Therapeutics, Inc.” in the subject line or contacting DataRep using their online webform at www.datarep.com/data-request.

Information for California Residents

Please refer to the “Information for California Residents” section of our Privacy Notice posted on our website, www.fatetherapeutics.com for additional information about our privacy practices for California residents.