Privacy Policy

This policy was last updated on October 9, 2025.

I. INTRODUCTION

This Privacy Policy describes how we at Insmed Incorporated (also referred to as “Insmed,” “we,” or “us”) collect, maintain, use, and disclose information from you and others (collectively referred to as “You”) when You visit our websites that link to this Policy, or otherwise interact with us online or offline (collectively referred to as the “Site”). This Privacy Policy also describes the measures we take to protect personally identifiable information (“PII”). For purposes of this Policy, PII means information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with You or Your household.

Please note that Insmed reserves the right to revise this Privacy Policy at any time at our sole discretion. Therefore, You are urged to review the Privacy Policy each time You access the Site to ensure that You are familiar with the most current version. If we modify the Privacy Policy in a material way, we will notify You in accordance with applicable law.

II. HOW DOES INSMED COLLECT YOUR PII AND WHAT TYPES OF PII DOES IT COLLECT?

Insmed collects PII about You:

When You actively provide it to us. For example, we may collect your PII when You submit an online form, engage with us to obtain products or services, or respond to a request for information, sign up to receive communications from us, or send us an email or letter. We may also request and collect Your PII to provide You with certain features of the Insmed products, services, or Site, or to enable You to participate in a particular activity. You may always refuse to provide information to us, but this may lead to our inability to provide You with certain information, products, or services or for You to participate in certain activities.

Automatically from You when You interact with the Site. We may collect PII using various technologies and means, such as Internet Protocol (IP) addresses, cookies, Internet tags, web beacons, and navigational data collection. For example, Your Internet browser automatically transmits to the Site information such as the URL of the website You just came from, Your IP address, and the browser version Your computer is currently using. The Site may also collect information from Your computer through cookies, HTTP Logging, or other technological means. Cookies are small bits of information that are stored by Your computer’s web browser and are classified as identifying files sent to a computer by a web server. Websites read these uniquely identifying files for future access and enable servers to associate computers with user profiles. HTTP Logging consists of transaction files between a web client and server. You may be able to decide if and how Your computer will accept a cookie by configuring Your preferences or options in Your browser. You may be able to change Your browser settings to reject all cookies, accept only certain cookies, or notify You when a cookie is set. Please note that You may need to renew these settings if You delete Your cookies after these preferences are made. These settings also may not apply if You are using a different computer or internet browser. However, if You choose to reject cookies, You may not be able to use certain online products, services, or features on the Site. To learn more about cookies, please visit http://www.allaboutcookies.org.

From other sources, whether directly or indirectly, such as the individuals and entities with whom we collaborate on a business basis, including vendors, suppliers, and service providers (each, a “Business Partner”), third-party services and organizations, such as press and other print media, Meta, Google, LinkedIn, YouTube, and other Internet platforms, and other individuals and entities as permitted under applicable law.

Listed below are the types of PII that we may collect about You:

• Identifiers, such as Your real name, alias, unique personal identifier, online identifier, Internet Protocol (IP) address, email address, or other similar identifiers.
• Internet or other electronic network activity information, including, but not limited to, Your browsing history, search history, and information regarding your interaction with an internet website, application, or advertisement. This may include hardware and browser information, or information about your computer or other online devices.
• Geolocation data, such as the physical location of the device You use to connect with us online and inferred from Your IP address.

For more information about the types of health-related information we collect, please see our Consumer Health Data Privacy Policy.

III. OUR BUSINESS PURPOSES FOR COLLECTING PII; HOW WE USE THE INFORMATION

We use the PII we collect from You, including Sensitive Personal Information, for the following business purposes:

• To communicate with You, including in response to Your inquiries and to fulfill Your requests.
• To provide You with information about our products and services, and to provide You with our products and services.
• To provide You with information about our clinical trials, and to facilitate Your participation in our clinical trials.
• To improve the content of the Site, including to customize the Site to Your preferences.
• For our data analysis, product development, advertising, marketing, and research purposes. This may include the use or development of automated tools and processes. For more information, please see the section on Profiling below.
• To prevent fraud, including by confirming Your identity.
• To maintain and upgrade the security of any data or information collected.
• For risk management and compliance purposes, including to comply with law enforcement and other legal processes.
• For any other purpose You may agree to at or before the time the PII is collected from You.

U.S. state data protection laws broadly define the term “sale” to include disclosures of browsing data collected via cookies and other tracking technologies to third parties, which may include health-related inferences depending on which parts of our website You visit. In the past 12 months, we have not sold, shared, or processed for purposes of targeted advertising Your Identifiers and Internet or other similar network activity via cookies and other tracking technologies on our websites for marketing purposes to our third-party marketing and advertising partners, which may include health-related inferences and Your Sensitive Personal Information (as defined under applicable law in certain states).

IV. DATA RETENTION

We limit our retention of Your PII to what is adequate, relevant, and reasonably necessary to fulfill the purposes for which Your PII was collected.

V. HOW WE MAY DISCLOSE PERSONALLY IDENTIFIABLE INFORMATION

We disclose and have disclosed in the past 12 months the categories of PII listed in Section II to the categories of entities listed below for the purposes listed in Section III:

• Business Partners with whom we engage to assist us with technology support, operational support, and other forms of assistance, and whom we bind by contract to protect the confidentiality and security of the PII we share with them.
• Third party marketing and advertising partners, such as providers of cookies and other technologies, for purposes of marketing our products and services to You. Specifically, the Site uses third-party analytical tools like Google Analytics (http://www.google.com/analytics/) to help us monitor performance and usage patterns. Google Analytics uses cookies to collect information about Site visitors to provide analytics services based on a user’s visits to sites across the Internet and across other mobile applications. For further information about the collection and use of data through Google Analytics, see http://www.google.com/policies/privacy/partners/. Google offers the ability to opt out from tracking through Google Analytics cookies; to learn about this, visit: http://tools.google.com/dlpage/gaoptout.
• Other third parties with Your consent, authorization, or at Your direction.
• Affiliates within the Insmed corporate family for legally permissible purposes.
• In the event of a proposed or actual reorganization, merger, sale, joint venture, assignment, transfer or other disposition of all or any portion of our company or its assets, to the proposed or actual acquiring party or assignee.
• (i) When required by applicable law, including laws outside Your country of residence; (ii) to comply with legal process; (iii) to respond to requests from public and government authorities; (iv) to enforce the Terms of Use of the Sites subject to applicable law, including this Policy; (v) to protect and defend our rights and property subject to applicable law; (vi) to protect the interests of Insmed or others subject to applicable law; and (vii) to permit us to pursue available remedies or limit the damages that we may sustain subject to applicable law.

VI. DE-IDENTIFICATION

We may de-identify any PII we collect about You. When we do so, we take reasonable measures to ensure that the information cannot be associated with a consumer or household, and we maintain and use the information in de-identified form. We may re-identify the information for the purpose of determining whether our de-identification processes satisfy applicable legal standards. After it has been de-identified, the information is no longer PII and is not subject to this Policy.

VII. SITE USE LIMITATIONS AND INTERNATIONAL DATA TRANSFERS

Our Sites are not directed at users under the age of 13 and we do not knowingly collect PII online from any person we know to be under the age of 13. Although use of our Sites by children is unlikely, if You become aware that a child has provided us with PII without parental consent, please contact us at privacy@insmed.com. If we become aware that a child under 13 has provided us with PII without parental consent, we will take steps to remove such information and terminate the child’s account, if any. Further, we do not have actual knowledge of selling or sharing the PII of anyone under the age of 16.

Our Sites are designed for users from and controlled and operated by us from the United States. If You reside outside of the United States and interact with us, we may collect and transfer Your PII to the United States. For more information, see our Global Privacy Policy.

VIII. LINKS TO OTHER WEBSITES

Our Sites may provide links to third-party websites. When You click on one of these links, You will be accessing content that is not subject to this Policy. We are not responsible for the information-collection practices of the other websites that You visit and advise You to review privacy policies applicable to those websites before You provide any PII to a third party.

IX. DATA SUBJECT RIGHTS FOR CERTAIN U.S. RESIDENTS

Residents who reside in states that have adopted comprehensive privacy legislation (collectively, “U.S. Privacy Laws”) have certain rights regarding our collection and use of PII, subject to certain exceptions. We provide details about these rights below. Please note that some rights vary by state. We process data subject rights requests in accordance with U.S. Privacy Laws applicable to us. In some instances, we may not be required to comply with Your request, such as if an applicable exception applies under U.S. Privacy Laws.

Section IX.A. provides details about data subject rights, and Section IX.B. provides information about how we verify Your identity and otherwise respond to Your requests to exercise any of Your data subject rights.

A. DATA SUBJECT RIGHTS

Rights That Require Verification. U.S. Privacy Laws require us to verify Your identity prior to honoring any request You submit to exercise certain data subject rights. These rights may include:

• Right to Know. You may have the right to know certain information about our privacy practices at or before the point at which we collect Your PII. We have provided such information in this Policy. You may also request that we provide you with information about the following aspects of how we have handled Your PII specifically in the 12 months preceding your request:
  • The categories of PII we have collected about You, including Sensitive Personal Information;
  • The categories of sources from which the PII is collected;
  • Our business or commercial purpose for collecting, selling, or sharing PII, if applicable; and
  • The categories of third parties to whom we disclose PII, if any.
• Right to Delete. You may have a right to request that we delete PII provided to us by You or that we obtained about You from a third party.
• Right to Correction. You may have a right to request that we correct inaccuracies in the PII we maintain about You, taking into account the nature of the PII and the purposes of the processing of Your PII.
• Right to Access Specific Pieces of Personal Information and Data Portability. When exercising Your right to access PII we have collected about You, You may also have the right to obtain that PII in a portable and, to the extent technically feasible, readily usable format that allows You to transmit the PII to another entity without hindrance. You may not exercise this right more than two times in a calendar year.

Rights That Do Not Require Verification. Other types of data subject rights requests submitted under U.S. Privacy Laws do not require us to verify Your identity. These rights are described below.

Your Privacy Choices

Right to Revoke Consent for or Limit the Use of Your Sensitive Personal Information. You may also have the right to revoke consent for or limit the use of Your Sensitive Personal Information to the purposes authorized by the applicable U.S. Privacy Laws, depending on the U.S. Privacy Law applicable to You.

For California consumers – We use Sensitive Personal Information for the purposes listed in Section III above, which includes purposes other than those expressly permitted by the California Consumer Protection Act (“CCPA”) regulations. Accordingly, California consumers have the right to limit the use of Your Sensitive Personal Information to the purposes listed in the CCPA regulations, including to: perform services or provide goods to You, prevent and detect security incidents, fraud, and other illegal actions, ensure physical safety of natural persons, for short-term, transient use, such as non-personalized advertising as part of Your current interaction with us, perform services on our behalf, verify and maintain product and service quality, and collect or process Sensitive Personal Information where doing so is not for the purpose of inferring characteristics about You. To exercise Your right to revoke consent or your right to limit, You may click Here or contact us via any of the methods listed in Section X.B. below.

Nondiscrimination. You have the right to not be discriminated against by us because You exercised any of Your data subject rights. We will not deny goods or services to You, charge You different prices or rates for goods or services, provide You a different level or quality of goods or services, or otherwise retaliate against You for exercising data subject rights afforded to You by applicable U.S. Privacy Laws.

B. EXERCISING DATA SUBJECT RIGHTS

Exercising Your Rights. To exercise data subject rights afforded to You by applicable U.S. Privacy Laws, You may submit a request to us by either:

• Completing our webform
• Calling us at our Privacy Rights toll-free number: 1-844-4-INSMED (1-844-446-7633)

You may make a request on Your own behalf, and if You are the parent or guardian of a minor child, You also may make a request related to Your child’s PII.

Authorized Agents. Residents of some states, including California, may designate an authorized agent to make requests on Your behalf. Authorized agents may use the same methods as You, described above, to submit requests to us. When we receive a request from an authorized agent, we may request further information from the agent and/or from You to confirm that You gave the agent permission to make the request. For example, we may ask the agent to provide proof that You gave them signed permission to make the request, or we may ask You to verify Your identity directly to us and/or directly confirm to us that You gave the agent permission to submit the request.

Verification. Depending on the type of request You submit, and to protect Your PII from unauthorized disclosure or deletion at the request of someone other than You or Your authorized agent, we may verify Your identity prior to fulfilling Your request. We may request additional information from You, depending on the context and details of Your request, to do so, and we may not be able to fulfill Your request if we are unable to verify Your identity. Making a verifiable consumer request does not require You to create an account with us. We will only use information provided in Your request to verify Your identity and process Your request. We reserve the right to take additional steps as necessary to verify Your identity where we have reason to believe a request is fraudulent.

Responding to Verifiable Requests. We endeavor to respond to a verifiable consumer request within forty-five (45) days of our receipt of such a request. If we require more time (up to 45 additional days), we will inform You of the reason and extension period in writing.

Appeals. If You would like to appeal our decision with respect to Your request to exercise Your data subject rights, You can do so by contacting us at the methods listed above. Please attach a copy of or otherwise specifically reference Your request, so that we may appropriately process and respond to Your appeal.

Opt-Out Preference Signals. We recognize opt-out preference signals that we are required to recognize for compliance with applicable U.S. Privacy Laws. Where required by law, we treat such opt-out preference signals as a valid request to opt-out of sale and sharing of PII for the browser or device through which the signal is sent and any consumer profile we have associated with that browser or device, including pseudonymous profiles. Further, to the extent required by applicable U.S. Privacy Laws, if we know the identity of the consumer from the opt-out preference signal, we will also treat the opt-out preference signal as a valid request to opt out of sale and sharing for such consumer. You may use opt-out preference signals by downloading or otherwise activating them for use on supported browsers and setting them to send opt-out preference signals to websites You visit. Please note that while we recognize opt-out preference signals we are required to recognize by applicable U.S. Privacy Laws, we do not currently recognize “Do Not Track” signals.

Profiling. We do not process PII for profiling in furtherance of legal or similarly significant effects.

Contact Information. If You have any questions or concerns about our Privacy Policy or our practices regarding the collection, use, disclosure, sale, sharing, and retention of Your PII, You may contact us by:

• Sending us an email at privacy@insmed.com; or
• Mailing us at:
  Insmed Incorporated
  700 US Highway 202/206
  Bridgewater, NJ 08807
  Attention: Chief Legal Officer
  Tel: (908) 977-9900