Privacy & Cookie Policy

I. Introduction

Korro Bio, Inc. and its group companies (“Company”) process personal data relating to patients, healthcare professionals, vendors, job applicants, employees, and others.

“Personal Data” means information that can identify you directly or indirectly. “Processing” means any action involving Personal Data, such as collecting, storing, using, or sharing it.

As part of our mission to develop new therapies, we collect and process Personal Data when you:

  • visit our website (www.korrobio.com),
  • contact us by email, letter, or through an online form,
  • work with us under a contract,
  • participate in research programs, or
  • otherwise interact with our business.

This Privacy Policy explains how we use your Personal Data. It is not part of a contract. We may update it from time to time; the version on our website is the current version.

II. Who is responsible for processing your data?

The data controller, the party legally responsible, for processing under this Privacy Policy is:

Korro Bio, Inc.
60 First Street, 2nd Floor, Suite 250
Cambridge, MA 02141
United States of America
Email: Privacy@korrobio.com

If you interact directly with another Korro Bio group company (for example, you purchase services from them or correspond with them), that company is the controller for your Personal Data.

III. What Personal Data do we process?

Depending on your relationship with us, we may process the following types of data:

  • Contact and identification details: name, address, phone number, email, nationality, language skills, employer, government-issued IDs (passport, driver’s license), professional license numbers, login details, answers to security questions, bank or credit card information, photos or images.
  • Contract data: information needed to conclude or perform a contract, such as type, duration, terms, payments, invoices, complaints, feedback, or customer satisfaction.
  • Health data: information about health status, medical history, treatments, or medication, collected directly from individuals or through third parties with consent.
  • Communication data: information from correspondence (emails, letters, phone calls), including date, time, and sometimes location.
  • Technical data: limited information created when using our website, such as IP address, device type, operating system, and browser settings, to the extent required for the site to function securely and to maintain your session.
  • Career and education data: CVs, qualifications, diplomas, job references, memberships, professional skills, and work history.
  • Other data: any additional Personal Data that arises in specific situations. We will inform you separately if required.

We may also collect information that is not considered Personal Data, such as company or institutional details.

IV. Why do we process your data?

We use Personal Data for purposes connected to our business and legal obligations, including:

  • identifying and working with healthcare professionals,
  • carrying out clinical and medical research,
  • developing and improving our services,
  • managing communications and business relationships,
  • ensuring IT and building security (e.g., access control, spam and virus filters, data loss prevention),
  • documenting incidents such as security breaches or complaints,
  • meeting regulatory and compliance requirements,
  • supporting investigations and responding to authorities,
  • preventing and investigating legal or regulatory violations, and
  • establishing, exercising, or defending legal claims.

If we process your data for other purposes, we will inform you as required by law.

V. Collection and processing of data

1. Principles – How do we handle Personal Data?

We only process Personal Data when we have a legal basis to do so. In some cases, this requires your explicit consent (for example, in clinical research). We commit to:

  • explaining how we will use your data before collecting it,
  • collecting only what is necessary,
  • using it only for the stated or reasonably expected purposes,
  • avoiding harmful use unless required by law,
  • anonymizing or pseudonymizing data where appropriate, and
  • sharing it only where necessary, with affiliates, service providers, authorities, or other third parties who have a legal right or legitimate reason.

Our websites may link to third-party sites that we do not control. This Privacy Policy does not apply to those sites, and we recommend reviewing their privacy notices.

2. How do we collect Personal Data?

We may collect Personal Data:

  • directly from you (via websites, surveys, events, applications, or contracts),
  • indirectly from healthcare professionals (where they are legally allowed to share it),
  • from public or third-party sources, and
  • automatically when you use our websites (through cookies or similar tools).

We may also collect information through third-party platforms or social media linked to our sites, in line with your privacy settings and the platform’s rules.

3. Internet users and cookies

We use only strictly necessary cookies, which are required for our website to function properly and securely (for example, to maintain your session, support security, and remember your cookie preferences). We do not use cookies for analytics, advertising, or other tracking. Because these cookies are strictly necessary, your prior consent is not required; you can still block or delete them through your browser settings, though parts of the site may then not work as intended. Cookies are small files stored on your device that allow us to recognize your browser. The specific cookies in use are listed in the Cookie Statement in Section XII below.

Our websites are not directed at children.

4. International transfers

We may transfer Personal Data to countries outside of your country of origin. Where the destination country does not provide adequate protection, we use appropriate legal safeguards such as the European Commission’s Standard Contractual Clauses, unless another valid legal exception applies (e.g., legal proceedings, public interest, contractual necessity, or your consent).

VI. Who do we share your data with?

We may share Personal Data with:

  • Service providers: e.g., IT services, research partners, contractors, who process data on our behalf.
  • Authorities: where required to comply with laws, respond to investigations, or participate in regulatory or judicial proceedings.
  • Parties in legal proceedings: e.g., courts, opposing parties, experts, witnesses.
  • Business partners or buyers: if we transfer parts of our business or assets.

VII. How long do we keep your data?

We keep Personal Data only as long as needed for our purposes or to comply with legal requirements.

  • Contract-related data is generally kept for the duration of the contract.
  • Some operational or security-related data is kept for shorter periods (e.g., 6 months to 3 years).
  • Business records are retained as long as needed for our interests or legal obligations.

Once retention periods expire, we delete or anonymize your data.

VIII. Legal bases for processing

Depending on the situation and the country where the activity takes place, we may process your Personal Data because:

  • you have given consent,
  • it is necessary to perform a contract or pre-contractual steps,
  • it is required by law,
  • it is necessary for legitimate business interests, or
  • it is needed to establish, exercise, or defend legal claims.

IX. How do we protect your data?

We use technical and organizational measures—such as access controls, encryption, anonymization, and staff instructions—to protect your Personal Data from loss, misuse, unauthorized access, or alteration.

For research, direct identifiers (like your name) are replaced with codes to reduce the risk of identification.

X. Your rights

Under data protection laws and depending where you are located, you may have the right to:

  • Access your Personal Data,
  • Correct or update it,
  • Request deletion of data we no longer need or are not required to keep,
  • Object to or restrict certain processing,
  • Withdraw consent (where consent is the basis for processing; this will only affect future use), and
  • Complain to a supervisory authority if you believe we are not handling your data correctly (for example for Ireland the Data Protection Commission https://www.dataprotection.ie/en).

Some rights may be limited in specific cases, for example where legal obligations require us to continue processing.

XI. Contact

If you have questions, requests, or complaints about how we handle your Personal Data, please contact our Data Protection Office:

Data Protection Office

Email: Privacy@korrobio.com

We may need to confirm your identity before acting on your request.

XII. Cookie Statement

This website (www.korrobio.com) uses only strictly necessary cookies. These cookies are required for the site to function properly and securely — for example, to maintain your session, support security, and remember your cookie preferences.

We do not use cookies for analytics, advertising, or any other form of tracking, and we do not share cookie data with third-party advertising networks.

Because these cookies are strictly necessary for the operation of the site, your prior consent is not required to use them. You can still block or delete cookies at any time through your browser settings; however, if you do, parts of the website may not function as intended.

The table below lists the specific cookies currently in use. It is generated and updated automatically following each scan of our website.