Effective Date: July 18, 2025

TenNor Therapeutics (Suzhou) Limited respects your privacy and is committed to protecting your personal information. This Policy applies to all service activities provided by TenNor to the outside world, including online or digital service activities, including but not limited to the following items that publish or link to this Policy: our official website (www.tennortherapeutics.com), WeChat Official Account (the "Official Account"), and various other services related to drug research and development, production, procurement, etc. (the "Services").

We fully recognize the importance of personal information to you and will make every effort to protect the security of your personal information and privacy. This Policy is intended to help you understand our privacy practices, including what personal information we collect, how we use such information, and how we protect personal information. Please read this Policy carefully to learn more about how we collect, use, store, process, transmit, provide, disclose and delete (collectively referred to as "process") your personal information, as well as the measures we take to protect your personal information from unauthorized use or disclosure. You must fully understand and agree to this Policy. Once you start using the Services we provide, it means that you have fully understood and agreed to this Policy, and we will process your information in accordance with this Policy. Please note that for specific Services we provide (including conducting clinical trials, etc.) and personal information processing scenarios (including processing of sensitive personal information, providing personal information to third parties, cross-border provision of personal information, etc.), we will separately inform you of the personal information processing status through informed consent forms and other means and obtain your consent. Please note that this Policy does not apply to information collected from you when you access third-party websites or services through the Services provided by TenNor. The inclusion of links to third-party websites or digital services does not imply TenNor's endorsement of such websites or services or the quality or accuracy of the information presented therein. If you decide to access third-party websites or services, you will be subject to the personal information protection policies of such third-party websites or services, not this Policy. We encourage you to carefully read the personal information protection policies and other legal notices of each website or service you access. Please remember that the statements in this Policy apply only to TenNor's information processing activities. If you have any questions about this Policy during your reading, you may contact us through the contact information at the end of this Policy, and we will provide you with answers as soon as possible.

I. How We Collect and Use Your Personal Information

(I) Purposes of Processing Your Personal Information

TenNor processes your personal information primarily for the following legitimate purposes:

1. Specific purposes with your consent: We will process your personal information in accordance with your consent after obtaining it.

2. Legitimate business purposes: To carry out TenNor's professional and scientific activities, and to promote and evaluate TenNor's products and Services, we will collect your personal information to enhance our understanding of how TenNor's products are used to treat corresponding diseases, or to create aggregated data (including research) for TenNor's commercial purposes to improve our products and analyses that may help us enhance our Services. In some cases, such aggregated data may be a combination of personal information provided by you and personal information provided by other users.

3. Necessary to comply with TenNor's legal and regulatory obligations: For the purposes of safety reporting and pharmacovigilance reporting, if you contact TenNor regarding your experience with our products, we may incorporate the information you provide into the safety reports we are required to submit to regulatory authorities (such as the National Medical Products Administration of China). We may also use such information to contact medical professionals to follow up on adverse events related to the use of our products.

4. Necessary to perform contracts you have entered into: To provide you with the Services, TenNor may sign specific contracts with you and collect your personal information (the specific processing purposes, methods and types of personal information shall be subject to the content of the contract signed with you at that time) to fulfill contractual obligations.

(II) Information of Clinical Trial Participants

To conduct clinical trials, we will collect and use the personal information of clinical trial participants, including your gender, date of birth and other personal information (subject to the informed consent form signed at that time). We will inform you of the collection, use and other processing of personal information and obtain your explicit consent before conducting the corresponding clinical trials. You may contact the principal investigator of the relevant research, or review the informed consent form and other clinical trial documents provided to you for further information about the clinical trials.

Through the above collection channels, the information we collect cannot identify a specific individual, nor can we communicate directly with such individual. If you find that we have collected your personal information and do not agree with the personal information processing status informed in this Privacy Statement, you may contact TenNor via info@tennorx.com to exercise the rights informed in this Privacy Statement.

(III) Personal Information of Investigators

TenNor collects, uses and stores the personal information of investigators for the purposes of sponsoring, implementing, quality managing, regulatory filing and compliance review of clinical trials. Specifically, the personal information of investigators includes basic personal information (name, current position, current employer and department, address and postal code, contact information (telephone, E-mail), medical license number) and personal education and work information (educational background, work experience, major clinical research experience, GCP training experience, participation in professional associations or organizations).

(IV) Information of Job Applicants

You may apply for vacant positions with us and submit resume information (including name, contact information, educational background, work experience, etc., subject to the content of the resume you submit) for our recruitment purposes. For further information about the personal information that may be collected as part of a job application, please contact TenNor via info@tennorx.com.

(V) Business Cooperation Information

If you are a contact person of our cooperating institution, we may collect your basic personal information, such as name, telephone number, email address, address, professional title and company name, subject to the personal information you provide. TenNor collects and uses your relevant personal information to complete transactions and cooperation related to products, Services, etc.

(VI) Exceptions to Authorization and Consent

Pursuant to the relevant laws and administrative regulations, we are not required to obtain your consent to process your personal information in the following circumstances:

1.It is necessary for TenNor to perform its statutory duties or obligations;

2.It is necessary for the conclusion or performance of a contract in which you are a party, or for the implementation of human resources management in accordance with legally formulated labor rules and regulations and legally signed collective contracts;

3.It is necessary to respond to sudden public health incidents, or to protect the life, health and property safety of natural persons in emergency situations;

4.It is necessary to conduct news reporting, public opinion supervision and other activities for the public interest, and process your personal information within a reasonable scope;

5.Process your personal information that you have disclosed by yourself or that has been legally disclosed by others within a reasonable scope;

6.Other circumstances stipulated by laws and administrative regulations.

II. How We Entrust the Processing, Share, Transfer and Publicly Disclose Your Personal Information

(I) Entrusted Processing

We may entrust certain third parties to provide services such as data statistical analysis and translation, which may involve entrusting third parties to process your personal information. For companies, organizations and individuals entrusted by us to process personal information, we will sign agreements with them, stipulating the purpose, term, method of processing, types of personal information, protective measures and the rights and obligations of both parties, requiring them to process personal information in accordance with our requirements, this Policy and any other relevant confidentiality and security measures, and supervise the personal information processing activities of the trustees.

(II) Sharing

We will not share, transfer your personal information to any company, organization or individual, or use it for public disclosure unless we obtain your explicit consent or are required to do so in accordance with applicable laws and regulations.

(III) Transfer

In the event of merger, division, dissolution, declaration of bankruptcy and other circumstances that require the transfer of your personal information, we will inform you of the name and contact information of the recipient, and require the new company, organization or individual holding your personal information to continue to be bound by this Policy; otherwise, we will require such company, organization or individual to re-obtain your authorization and consent.

(IV) Public Disclosure

In principle, we will not publicly disclose your personal information. If it is indeed necessary to make a public disclosure, we will obtain your explicit consent. In addition, we may publicly disclose your personal information when required by laws and regulations, legal procedures, litigation or mandatory requirements of government competent departments.

III. How We Store Your Personal Information

(I) Storage Location

In principle, personal information collected and generated by us within the territory of the People's Republic of China will be stored within the territory of the People's Republic of China. For the cross-border provision of information involved in specific Services we provide (including conducting clinical trials, etc.), we will inform you of the personal information processing status through informed consent forms and other means and obtain your separate consent. We will take confidentiality and security measures in accordance with the provisions of laws and regulations to ensure that your personal information is adequately protected.

(II) Storage Period

We will retain your personal information only for the period necessary to provide the relevant products or Services, unless an extension of the storage period is required or permitted by law. After the expiration of the necessary period, we will delete or anonymize your personal information unless otherwise stipulated by laws and regulations.

IV. How We Protect Your Personal Information

We will use security protection measures to protect the personal information you provide to prevent data from being subject to unauthorized access, public disclosure, use, modification, damage or loss. We will take all reasonably feasible measures to protect your personal information. For example, we use encryption to protect the security of your information when transmitting sensitive information; we use trusted protection mechanisms to prevent malicious attacks on data; we deploy permission control mechanisms to ensure that only authorized personnel can access personal information.

The Internet is not an absolutely secure environment, and no product, service or data transmission can be guaranteed to be 100% secure. Even so, we will make every effort to protect your personal information. We will, as required, immediately activate the emergency response plan in the event of an information security incident and strive to prevent the expansion of the impact and consequences of such security incident. In the unfortunate event of a personal information security incident, we will, in accordance with the requirements of laws and regulations, promptly inform you of: the basic situation and possible impact of the security incident, the disposal measures we have taken or will take, suggestions for you to independently prevent and reduce risks, remedial measures for you, etc. We will promptly inform you of the relevant circumstances of the incident by email, letter, telephone, push notification and other means; if it is difficult to inform each individual information subject one by one, we will adopt reasonable and effective means to issue an announcement. We will also take the initiative to report the disposal of the personal information security incident to the regulatory authorities in accordance with their requirements.

V. Your Rights Relating to Personal Information

We attach great importance to your management of personal information and will make every effort to protect your right to know, right to decide with respect to personal information, as well as your rights to access, copy, correct, supplement, transfer, delete, withdraw consent or authorization, and the rights of close relatives, etc. To exercise these rights relating to personal information, please contact us through the methods published in this Policy.

VI. How We Process the Personal Information of Minors

Our website and other contents and Services are not intended to provide products and Services to minors. If we find that we have collected the personal information of a minor without first obtaining the express consent of a verifiable guardian, we will take measures to delete the relevant data as soon as possible. If you are the guardian of a minor and have any questions about the personal information of the minor under your guardianship, please contact us through the contact information published in this Policy.

VII. Revision and Update of the Privacy Policy

This Policy has provided a detailed and truthful explanation of personal information processing and undertakes to update the Policy in a timely manner if there are any changes. After the update of this Policy, we will issue an updated version and remind you of the updated content through pop-ups or other appropriate means so that you can keep abreast of the latest version in a timely manner.

For material changes, we will also provide a more prominent notice (such as through SMS, private message or special prompt on your browsing page, stating the specific changes to the Privacy Policy) and re-obtain your consent. Material changes to this Policy include but are not limited to:

1.Material changes in our service model, such as the purposes, methods of processing personal information and types of personal information processed;

2.Material changes in our ownership structure, organizational structure, etc., such as changes in ownership caused by business adjustment, bankruptcy and merger, etc.;

3.Changes in the main objects of sharing, transfer or public disclosure of personal information;

4.Material changes in your rights to participate in personal information processing and the ways to exercise such rights;

5.Changes in the responsible department, contact information and complaint channel for personal information security processing by us.

If you do not agree with the revised Privacy Policy, you shall immediately stop receiving the relevant products and/or Services provided by us. If you continue to use the products and/or Services provided by us, it means that you have fully read, understood and accepted the revisions we have made to the relevant terms of this Policy.

VIII. How to Contact Us

If you have any requests, questions, comments or suggestions about this Policy or matters related to your personal information, you may contact us via info@tennorx.com. In general, we will respond within 15 days. For any dispute arising from this Policy and our processing of your personal information, you may contact us at any time and request a response. If you are not satisfied with our response and believe that our personal information processing activities have seriously damaged your legitimate rights and interests, you may also seek a solution by filing a lawsuit with the people's court having jurisdiction in Suzhou Industrial Park, China (Jiangsu) Pilot Free Trade Zone, where TenNor Therapeutics (Suzhou) Limited is located.

IX. Explanation of Key Terms in This Policy

1. The term "Affiliated Companies" in this Policy refers to any company directly or indirectly controlled by, controlling, or under common control with TenNor (excluding TenNor itself) and the legal successors of the aforesaid companies.

2. The term "Sensitive Personal Information" in this Policy refers to personal information that, if disclosed or used illegally, is likely to lead to infringement of the personal dignity of natural persons or endanger their personal and property safety, including biometric identification, religious beliefs, specific status, medical and health, financial accounts, travel tracks and other information, as well as the personal information of minors under the age of 14. In this Policy, sensitive personal information is indicated in bold and underlined format.