Applicant Privacy Notice

Last Updated: June 11, 2026

Scope

Intellia Therapeutics, Inc. (collectively, the “Company”, “we”, “our”) has developed this Applicant Privacy Notice (the “Notice”) to outline the steps we take to respect for the privacy of our job applicants. This policy describes the personal information we collect, use, and disclose about individuals who apply for a position of employment. This is also to provide you with notice at or before the point at which we collect personal information from you informing you of what information we collect, how we use it, how long we retain it, and whether we sell it or share it for cross-context behavioral advertising purposes (we do not).

This Applicant Privacy Notice applies only to your interaction with the Company in the capacity of a job applicant. It does not apply to other contexts, such as if you are hired for employment, in which case you would be provided access to a privacy policy that covers information collected in the employment context, or if you visit our public-facing website or engage in transactions with the Company in other capacities (as a patient, customer, or independent contractor), in which case the privacy policy on our website https://www.intelliatx.com/privacy-policy/ would apply to those interactions.

Artificial Intelligence

As part of our initial screening process, we may use an Artificial Intelligence (AI) tool to compare the skills and job titles from your resume with the job description, using machine learning or AI based on their contextual meaning and relevancy. We do not rely on this output to make any employment decisions. We manually review the output and candidate.

Collection of Personal Information and Sensitive Personal Information

When you apply for a position or interact with us regarding potential job openings, we may collect Personal Information from you in a variety of different situations and using a variety of different methods, including, but not limited to, on our website, your mobile device, through email, in physical locations, through written applications, through the mail, and/or over the telephone or via video conferencing applications like Teams. We retain your personal information for as long as necessary to process your application for employment, etc. and in accordance with the Company’s data retention schedule. We may retain your personal information for longer if it is necessary to comply with our legal obligations or reporting obligations, resolve disputes, or as permitted or required by applicable law. We may also retain your personal information in a deidentified or aggregated form so that it can no longer be associated with you. To determine the appropriate retention period for your personal information, we consider various factors such as the amount, nature, and sensitivity of your information; the potential risk of unauthorized access, use or disclosure; the purposes for which we collect or process your personal information; and applicable legal requirements. Personal Information does not include certain categories of information, such as publicly available information from government records, deidentified or aggregated consumer information, and information subject to HIPAA or the California Confidential Medical Information Act.

Generally, we may collect the following categories of personal information from or about job applicants.

Categories of Personal Information Collected
Identifiers and Contact information. This category includes names, addresses, telephone numbers, mobile numbers, email addresses, signature, account name, dates of birth, bank account information, and other similar contact information and identifiers. Protected classification information. This category includes characteristics of protected classifications under California or federal law. Geolocation data. This category includes GPS location data such as from mobile devices. Internet or other electronic network activity information. This category includes without limitation: all activity on the Company’s information systems, such as internet browsing history, search history, email communications, usernames and passwords, and all activity on communications systems including phone calls, call logs, voice mails, text messages, chat logs, and app use. Audio, electronic, visual, thermal, olfactory, or similar information. This category includes, for example, information collected from camera, microphones, and similar devices. Professional and employment-related information. This category includes without limitation: data submitted with employment applications including employment history, recommendations, etc., background check and criminal history, drug testing as applicable, work authorization, and fitness for duty data and reports. Education information. This category includes education history. Limited medical information. This category includes without limitation: fitness for duty data and reports, disability accommodation requests during the applications and hiring process. Sensitive Personal Information. This category includes sensitive information such as social security, driver’s license, state identification card, or passport number, citizenship or immigration status, precise geolocation, racial or ethnic origin, religious or philosophical beliefs, or union membership, biometric information for the purpose of uniquely identifying a consumer, and information concerning health and sex life or sexual orientation. Inferences drawn from the Applicant Personal Information in the categories above. This category includes engaging in human capital analytics, including but not limited to, identifying certain correlations about individuals and success on their jobs, and analyzing data to improve retention.

Categories of Personal Information Collected

Identifiers and Contact information. This category includes names, addresses, telephone numbers, mobile numbers, email addresses, signature, account name, dates of birth, bank account information, and other similar contact information and identifiers.

Protected classification information. This category includes characteristics of protected classifications under California or federal law.

Geolocation data. This category includes GPS location data such as from mobile devices.

Internet or other electronic network activity information. This category includes without limitation:

all activity on the Company’s information systems, such as internet browsing history, search history, email communications, usernames and passwords, and
all activity on communications systems including phone calls, call logs, voice mails, text messages, chat logs, and app use.

Audio, electronic, visual, thermal, olfactory, or similar information. This category includes, for example, information collected from camera, microphones, and similar devices.

Professional and employment-related information. This category includes without limitation:

data submitted with employment applications including employment history, recommendations, etc.,
background check and criminal history, drug testing as applicable,
work authorization, and
fitness for duty data and reports.

Education information. This category includes education history.

Limited medical information. This category includes without limitation:

fitness for duty data and reports,
disability accommodation requests during the applications and hiring process.

Sensitive Personal Information. This category includes sensitive information such as

social security, driver’s license, state identification card, or passport number,
citizenship or immigration status,
precise geolocation,
racial or ethnic origin, religious or philosophical beliefs, or union membership,
biometric information for the purpose of uniquely identifying a consumer, and
information concerning health and sex life or sexual orientation.

Inferences drawn from the Applicant Personal Information in the categories above. This category includes engaging in human capital analytics, including but not limited to, identifying certain correlations about individuals and success on their jobs, and analyzing data to improve retention.

Purposes Personal Information, Including Sensitive Personal Information, is Collected and Used
To fulfill or meet the purpose for which you provided the information. For example, if you share your name and contact information to apply for a job with the Company, we will use that Personal Information in connection with your candidacy for employment. Collect and process employment applications, including confirming eligibility for employment, obtaining and verifying background checks, references, and employment history. To maintain physician records and occupational health programs. Maintaining personnel records and record retention requirements. To evaluate, make and communicate decisions regarding your job application and candidacy for employment. To communicate with you regarding your candidacy for employment, onboarding and related employment efforts. To permit you to create a job applicant profile, which you can use for filling out future applications if you do not get the job you are apply for. To keep your application on file even if you did not get the job applied for, in case there is another position for which we want to consider you as a candidate even if you do not formally apply. To evaluate and improve our recruiting methods and strategies. To engage in lawful monitoring of job applicant activities and communications when they are on Company premises, or utilizing Company internet and Wi-Fi connections, computers, networks, devices, software applications or systems. To engage in corporate transactions requiring review or disclosure of job applicant records subject to non-disclosure agreements, such as for evaluating potential mergers and acquisitions of the Company. To evaluate, assess, and manage the Company’s business relationship with vendors, service providers, and contractors that provide services to the Company related to recruiting or processing of data from or about job applicants. To improve job applicant experience on Company computers, networks, devices, software applications or systems, and to debug, identify, and repairCorrection of “misspelled” disease-driving DNA sequence using a CRISPR/Cas9-based gene editing therapy. errors that impair existing intended functionality of our systems. To prevent identity theft. To verify and respond to consumer requests from job applicants under applicable consumer privacy laws. Complying with applicable state and federal health, labor, employment, disability, equal employment opportunity, and related laws, guidance, or recommendations (such as immigration compliance records, accident or safety records, and tax records). Preventing unauthorized access to, use, or disclosure/removal of the Company’s property, including the Company’s information systems, electronic devices, network, and data. Investigating complaints and suspected violations of Company policy. Protect the legal rights, privacy, safety or property of Company or its employees, agents, contractors, customers or the public. Protect against fraud or other illegal or malicious activity or for risk management purposes. Enforce the Company’s website’s terms of use. Facilitate the efficient and secure use of the Company’s information systems. Improve safety of employees, customers and the public with regard to use of Company property and equipment. Evaluate an individual’s appropriateness for a position at the Company. To respond to and manage any legal claims against the Company and/or its personnel, including civil discovery in litigation. To facilitate other business administrative functions and strategic activities, such as risk management, information technology and communications, financial management and reporting, workforce and succession planning, mergers and acquisition activities; and maintenance of licenses, permits and authorization applicable to Company operations.

Purposes Personal Information, Including Sensitive Personal Information, is Collected and Used

To fulfill or meet the purpose for which you provided the information. For example, if you share your name and contact information to apply for a job with the Company, we will use that Personal Information in connection with your candidacy for employment.
Collect and process employment applications, including confirming eligibility for employment, obtaining and verifying background checks, references, and employment history.
To maintain physician records and occupational health programs.
Maintaining personnel records and record retention requirements.
To evaluate, make and communicate decisions regarding your job application and candidacy for employment.
To communicate with you regarding your candidacy for employment, onboarding and related employment efforts.
To permit you to create a job applicant profile, which you can use for filling out future applications if you do not get the job you are apply for.
To keep your application on file even if you did not get the job applied for, in case there is another position for which we want to consider you as a candidate even if you do not formally apply.
To evaluate and improve our recruiting methods and strategies.
To engage in lawful monitoring of job applicant activities and communications when they are on Company premises, or utilizing Company internet and Wi-Fi connections, computers, networks, devices, software applications or systems.
To engage in corporate transactions requiring review or disclosure of job applicant records subject to non-disclosure agreements, such as for evaluating potential mergers and acquisitions of the Company.
To evaluate, assess, and manage the Company’s business relationship with vendors, service providers, and contractors that provide services to the Company related to recruiting or processing of data from or about job applicants.
To improve job applicant experience on Company computers, networks, devices, software applications or systems, and to debug, identify, and repairCorrection of “misspelled” disease-driving DNA sequence using a CRISPR/Cas9-based gene editing therapy. errors that impair existing intended functionality of our systems.
To prevent identity theft.
To verify and respond to consumer requests from job applicants under applicable consumer privacy laws.
Complying with applicable state and federal health, labor, employment, disability, equal employment opportunity, and related laws, guidance, or recommendations (such as immigration compliance records, accident or safety records, and tax records).
Preventing unauthorized access to, use, or disclosure/removal of the Company’s property, including the Company’s information systems, electronic devices, network, and data.
Investigating complaints and suspected violations of Company policy.
Protect the legal rights, privacy, safety or property of Company or its employees, agents, contractors, customers or the public.
Protect against fraud or other illegal or malicious activity or for risk management purposes.
Enforce the Company’s website’s terms of use.
Facilitate the efficient and secure use of the Company’s information systems.
Improve safety of employees, customers and the public with regard to use of Company property and equipment.
Evaluate an individual’s appropriateness for a position at the Company.
To respond to and manage any legal claims against the Company and/or its personnel, including civil discovery in litigation.
To facilitate other business administrative functions and strategic activities, such as risk management, information technology and communications, financial management and reporting, workforce and succession planning, mergers and acquisition activities; and maintenance of licenses, permits and authorization applicable to Company operations.

Examples of Disclosures (not intended to be exclusive)
Government agencies talent acquisition management systems vendors providing services related to our HRIS systems and/or management of job applicant data and recruiting process recruiting and staffing firms or agencies, social media platforms (name only), IT, cybersecurity, and privacy vendors and consultants vendor providing disability accommodation related services

We do NOT sell or share, as those terms are defined under applicable law, the above categories of Personal Information.

We do NOT and will not use or disclose your sensitive personal information for any purposes that give rise to a right to limit the use or disclosure of your sensitive personal information under the California Consumer Privacy Act (CCPA), if it applies and you are a California resident.

We also do not use or disclose your sensitive personal information for purposes that, with limited exceptions, are not necessary to process your application as reasonably expected by an average job applicant.

Consent to Terms and Conditions

By applying for a position with the Company or submitting any information for purposes of being considered for or inquiring about employment with the Company, you consent to all terms and conditions expressed in this Applicant Privacy Notice.

Changes to Our Privacy Policy and this Applicant Privacy Notice

As our Company evolves and we perceive the need or desirability of using information collected in other ways, we may from time to time amend our Privacy Policy and/or this Applicant Privacy Notice. We encourage you to check our website frequently to see the current Privacy Policy in effect and any changes that may have been made to them. If we make material changes to this Applicant Privacy Notice, we will post the revised Applicant Privacy Notice and the revised effective date on this website. Please check back here periodically or contact us at the address listed at the end of this Applicant Privacy Notice. We reserve the right to amend this Notice at any time without advance notice.

Individuals With Disabilities

This Policy is in a form that is or will be made accessible to individuals with disabilities.

Questions About the Policy

If you have any questions about this Privacy Policy, please email us at [email protected] .

Third-Party Vendors

We may use other companies and individuals to perform certain functions on our behalf. Examples include administering e-mail and payroll services. Such parties only have access to the personal information needed to perform these functions and may not use or store the information for any other purpose.

Business Transfers

In the event we sell or transfer a particular portion of our business assets, applicant information may be one of the business assets transferred as part of the transaction. If substantially all of our assets are acquired, employee information may be transferred as part of the acquisition.

Compliance With Law and Safety

We may disclose specific personal and/or sensitive personal information based on a good faith belief that such disclosure is necessary to comply with or conform to the law or that such disclosure is necessary to protect our employees or the public.

Passwords

The personal data record created through your registration for your Company account can only be accessed with the unique password associated with those records. To protect the integrity of the information contained in those records, you should not disclose or otherwise reveal your passwords to third parties.

Job Applicants Under the Age of 16

We do not knowingly collect or disclose, let alone sell or share, the personal information of job applicants under 16 years of age.

How We Protect the Information That We Collect

The protection of the information that we collect about applicants and employees is of the utmost importance to us and we take every reasonable measure to ensure that protection, including:

We use internal encryption on all data stores that house voluntarily captured data.
We use commercially reasonable tools and techniques to protect against unauthorized access to our systems.
We restrict access to private information to those who need such access in the course of their duties for us.

Rights Under the CCPA

This section of the Privacy Policy applies only to California residents. If you are a California resident, you have the following rights pursuant to the CCPA:

Right to Know. The right to request, up to 2 times in a 12-month period, that we identify to you (1) the categories of personal information we have collected, shared or sold about you, (2) the categories of sources from which the personal information was collected, (3) the business purpose for which we use this information, and (4) the categories of third parties with whom we disclose or have disclosed your personal information;
Right to Access. The right to request, up to 2 times in a 12-month period, that we provide you access to or disclose to you the specific pieces of personal information we have collected about you;
Right to Delete. The right to request, up to 2 times in a 12-month period, that we delete personal information that we have collected from you, subject to certain exceptions;
Right to Correct. The right to request that we correct inaccurate personal information (to the extent such an inaccuracy exists) that we maintain about you;
The right to designate an authorized agent to submit one of the above requests on your behalf. See below for how you can designate an authorized agent; and
The right to not be discriminated or retaliated against for exercising any of the above rights.

You Can Submit Any of the Above Types of Requests by Any of the Options Below:

Email us at [email protected]
Send a written request to Intellia Therapeutics, Inc., 40 Erie Street, Cambridge, MA 02139, Attn: General Counsel (Applicant Privacy Notice)

How We Will Verify That it is Really You Submitting the Request:

If you are a California resident, when you submit a Right to Know, Right to Access, Right to Delete, or Right to Correct request through one of the methods provided above, we will ask you to provide some information in order to verify your identity and respond to your request. Specifically, we will ask you to verify information that can be used to link your identity to particular information in our possession, which depends on the nature of your relationship and interaction with us.

Responding to your Right to Know, Right to Access, Right to Delete, and Right to Correct Requests

Upon receiving a verifiable request from a California resident, we will confirm receipt of the request no later than 10 business days after receiving it. We endeavor to respond to a verifiable request within forty-five (45) calendar days of its receipt. If we require more time (up to an additional 45 calendar days, or 90 calendar days total from the date we receive your request), we will inform you of the reason and extension period in writing. We will deliver our written response by mail or electronically, at your option. The response we provide will also explain the reasons we cannot comply with a request, if applicable.

We do not charge a fee to process or respond to your verifiable request unless it is excessive, repetitive, or manifestly unfounded. If we determine that the request warrants a fee, we will tell you why we made that decision and provide you with a cost estimate before completing your request.

For a request to correct inaccurate personal information, we will accept, review, and consider any documentation that you provide, and we may require that you provide documentation to rebut our own documentation that the personal information is accurate. You should make a good-faith effort to provide us with all necessarily information at the time that you make the request to correct. We may deny a request to correct if we have a good-faith, reasonable, and documented belief that a request to correct is fraudulent or abusive. If we deny your request to correct, we shall inform you of our decision not to comply and provide an explanation as to why we cannot comply with a request, if applicable.

If You Have an Authorized Agent:

If you are a California resident, you can authorize someone else as an authorized agent who can submit a request on your behalf. To do so, you must either (a) execute a valid, verifiable, and notarized power of attorney, or (b) provide other written, signed authorization that we can then verify. When we receive a request submitted on your behalf by an authorized agent who does not have a power of attorney, that person will be asked to provide written proof that they have your permission to act on your behalf. We will also contact you and ask you for information to verify your own identity directly and not through your authorized agent. We may deny a request from an authorized agent if the agent does not provide your signed permission demonstrating that they have been authorized by you to act on your behalf.

We will not retaliate against you for exercising any of your rights under the CCPA.