Privacy Notice

SAREPTALLY PRIVACY NOTICE

Last Reviewed: June 2026

INTRODUCTION

SareptAlly is a global program designed to help patients, families, and physicians gain access to resources and information about Sarepta clinical trials and potential treatment options. For more information about SareptAlly, please consult our website www.sareptally.com.

SareptAlly is held by Sarepta Therapeutics, Inc. ("Sarepta", "Company", “Sponsor”, “we” or “us”) acting as a data controller. Sarepta has engaged P3 Technology, LLC (“P3”) as a data processor, as well as Microsoft Bookings.

This notice applies to personal data. “Personal data” is any information—as electronically or otherwise recorded—that can be used to identify a person or that we can link directly to an individual, such as name, address, email address, or telephone number, as applicable. This notice applies only to personal data we collect:

on www.sareptally.com (“Website”);
through e-mail, text and other electronic messages between you and SareptAlly Website; and
when you interact with our Case Managers, through phone-calls or emails.

Please read this notice carefully to understand our policies and practices regarding your personal data and how we will treat it. If you do not agree with our policies and practices, you should not use our Website or register for the services and information we offer. By accessing or using our Website, you agree to this privacy notice.

CHANGES TO OUR PRIVACY NOTICE

We will post any changes we make to our privacy notice on this page. If we make material changes to how we treat your personal data, we will notify you by email to the primary email address specified in your account and/or through notices on our Website. The date the privacy notice was last revised is identified at the top of the page.

CHILDREN UNDER THE AGE OF 16

No one under age 16 may provide information on our Website. Our Website is not directed at minors under 16 and we do not knowingly collect, maintain, disclose, or otherwise process personal data of minors below the age of 16 without the permission of such minor’s parents or legal guardians. If you believe we have any personal data from or about a minor under 16 without parental or guardian consent, please contact us at privacy@sarepta.com so that we may identify and delete that personal data.

INFORMATION WE COLLECT ABOUT YOU AND HOW WE COLLECT PROCESS, AND SHARE IT

Why do we process the personal data?	Examples of the types of personal data we process:	How do we collect the personal data?	What are the legal bases for processing?	Who could receive the personal data?
To respond to your inquiries for information, and to provide you the requested identification/matching to Sarepta clinical trials or potential treatment options, and information about Sarepta and its products and services, by email or phone according to your preferences	Personal data, such as: • first and last name • email address • country/region • phone number • gender • date of birth Sensitive personal data, such as: • disability • genetic diagnosis Visual Information, such as: • pictures and videos Anonymized / De‑identified Data Anonymized data is data for which your individual personal characteristics have been removed such that you are not identified and the information is no longer considered Personal Data under data protection laws.	• From you directly; • From third parties we work with	The consent you provide us to process your data	• Our affiliates, subsidiaries, and related companies • Partners or service providers that assist us in administering our business, such as our Case Management System • Regulatory authorities, such as the Food and Drugs Administration (FDA)
To provide you with notices and updates according to your preferences	Personal data, such as: • first and last name • email address • country/region • phone number • gender • date of birth Sensitive personal data, such as: • disability • genetic diagnosis	From you directly	The consent you provide us to process your data	• Our affiliates, subsidiaries, and related companies • Partners or service providers that assist us in administering our business, such as our Case Management System
To notify you about changes to our Website or any products or services we offer or provide through it	Personal data, such as: • first and last name • email address	From you directly	To comply with a legal obligation	• Our affiliates, subsidiaries, and related companies
To allow you to participate in interactive features on our Websites	Personal data, such as: • first and last name • email address	From you directly	To perform a contract	Our affiliates, subsidiaries, and related companies
To meet our legal and regulatory obligations	Personal data, such as: • first and last name • email address • country/region • phone number • gender • date of birth Sensitive personal data, such as: • disability • genetic diagnosis Visual Information, such as: • pictures and videos Anonymized / De‑identified Data Anonymized data is data for which your individual personal characteristics have been removed such that you are not identified and the information is no longer considered Personal Data under data protection laws.	• From you directly; • From third parties we work with	To comply with a legal obligation	• Our affiliates, subsidiaries, and related companies • Partners or service providers that assist us in administering our business, such as our Case Management System • Regulatory authorities, such as the Food and Drugs Administration (FDA)

NOTICE ON COOKIES

Please see our Notice on Cookies for more information on how we use cookies and similar technologies.

YOUR RIGHTS REGARDING YOUR PERSONAL DATA

Depending on your location and applicable data protection laws, you have the right to exercise the following rights with respect to some or all of your Personal Data:

to request access to the Personal Data we hold about you;
to request that we rectify or erase your Personal Data;
to request that we restrict or block the processing of your Personal Data;
- This includes the right to opt out of solicitations;
to request a copy of your data to provide your Personal Data directly to another party, i.e., a right to data portability;
when we previously obtained your consent, to withdraw consent to processing; and
to lodge a complaint with the data protection authority in your area.

You can make a request with respect to your Personal Data by emailing us at privacy@sarepta.com

DATA SECURITY

We have implemented measures designed to secure your personal data from unauthorized access, use, alteration and disclosure. All information you provide to us is stored on our secure servers behind firewalls.

Unfortunately, the transmission of information via the internet is not completely secure. Although we do our best to protect your personal data, we cannot guarantee the security of your personal data transmitted to our Website. Any transmission of personal data is at your own risk. We are not responsible for circumvention of any privacy settings or security measures contained on our Website.

INTERNATIONAL TRANSFERS OF DATA

Please be aware that personal data we collect and process from the SareptAlly Website will be transferred and maintained outside of your state, province, country, including in and to the United States. Please note that the laws of the United States pertaining to the use and protection of personal data differ from that of other countries, but Sarepta has put in place appropriate safeguards to protect your personal data (including, notably, Sarepta complies with the EU-U.S. Data Privacy Framework (EU-U.S. DPF) and the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. Data Privacy Framework (Swiss-U.S. DPF) as set forth by the U.S. Department of Commerce.).

HOW LONG YOUR PERSONAL DATA WILL BE RETAINED

We generally retain personal data for as long as needed for the specific purpose or purposes for which it was collected or as follows:

(i) For those who submit their personal data and are consequently enrolled in a program: personal data is retained for 2 years from the moment of confirmation of end of participation in a program.

(ii) For those who submit their personal data but no program is available for them, personal data is deleted as soon as it is confirmed there’s no option available for them or, if they elect to remain being contacted for purposes of receiving information and updates on programs that may be relevant to them and provide specific informed consent for such purposes, data is retained for 5 years from the date of consent.

Upon reaching the retention period, we will dispose of your information by deleting it.

ADDITIONAL INFORMATION FOR CALIFORNIA RESIDENTS

In this section, we provide additional information to California residents about how we handle their personal information, as required under the California Consumer Privacy Act, as amended by the California Privacy Rights Act, and its implementing regulations (collectively, the “CCPA”). This section does not address or apply to our handling of personal information that is exempt under the CCPA.

Categories and Sources of personal information. The table above identifies the categories of personal information we have collected about California residents in the past 12 months, as well as the categories of third parties to whom we disclose this information for a business or commercial purpose

“Sales” and “Sharing” of Personal Information. The CCPA defines a “sale” as disclosing or making available to a third-party personal information in exchange for monetary or other valuable consideration, and “sharing” broadly includes disclosing or making available personal information to a third party for purposes of cross-context behavioral advertising. While we do not disclose personal information to third parties in exchange for monetary compensation, we “sell” or “share” (as defined by the CCPA) internet and electronic network activity information, and profiles and inferences, and identifiers to third party ad companies and analytics providers. We do so in order to improve and evaluate our advertising campaigns, monitor and measure site performance, and better reach customers and prospective customers with more relevant ads and content. We do not sell or share sensitive personal information, nor do we sell or share any personal information about individuals who we know are under sixteen (16) years old.

Sensitive Personal Information. Notwithstanding the above, we only use and disclose sensitive personal information as reasonably necessary (i) to perform our Services requested by you, (ii) for compliance with our legal obligations and (iii) to our service providers who perform Services on our behalf.

Retention. We retain the personal information we collect only as reasonably necessary for the purposes described in this Privacy Statement, in accordance with our records retention policies, as required under applicable law, or as otherwise disclosed to you at the time of collection.

CCPA Rights of California Residents. Individuals who are residents of California generally have the following rights under California law with respect to their personal information processed by us, subject to certain limitations and exceptions:

To opt out of sales and sharing. The right to opt-out of our sale and sharing of your personal information.
To limit certain uses and disclosures of sensitive personal information. The right to limit our use or disclosure of sensitive personal information to those uses authorized by the CCPA. As noted above in the Section titled, “Sensitive Personal Information,” we only use and disclose Sensitive Personal Information as authorized by the CCPA.
Deletion. You have the right to request that we delete your personal information, subject to certain exceptions.
To know/access. You have the right to request access to the personal information we have collected about you, including the categories of personal information, the categories of sources from which the personal information was collected, the business or commercial purpose for collecting, selling, or sharing personal information, the categories of third parties to whom we disclose personal information, and the specific pieces of personal information we have collected about them.
Correction. You have the right to request correction of inaccurate personal information that we have about you.
Non-discrimination. You have the right not to be subject to discriminatory treatment for exercising your rights under the CCPA.

Requests to Opt Out of Sale and Sharing. California residents may exercise their right to opt-out online by clicking on the “Cookies Settings” link on the website cookie banner. In addition, our website responds to global privacy control—or “GPC”—signals, which means that if we detect that your browser is communicating a GPC signal, we will process that as a request to opt that particular browser and device out of sales and sharing (i.e., via cookies and tracking tools) on our website. Note that if you come back to our website from a different device or use a different browser on the same device, you will need to opt out of (or set GPC for) that browser and device as well. More information about GPC is available at: https://globalprivacycontrol.org/.

CONTACT INFORMATION

To ask questions or comment about this privacy notice and our privacy practices, contact us at:

Sarepta Therapeutics
Attn: Corporate Communications
215 First Street
Cambridge, MA 02142
1-888-SAREPTA (1-888-727-3782)
privacy@sarepta.com