Privacy Notice | Tarsus

Our Therapies

The first and only FDA-approved
treatment for Demodex blepharitis

Careers

Privacy Notice

Effective date: December 8, 2025

Last Updated: October 30, 2025

At Tarsus Pharmaceuticals, Inc. (“Tarsus,” “we,” “us,” or “our”), we take your privacy seriously. Please read this Privacy Notice to learn what personal data we may process (e.g., collect, record, organize, structure, store, adapt or alter, retrieve, consult, use, disclose by transmission, disseminate or otherwise make available, align or combine, restrict, erase, or destroy), how we protect it, and your rights and choices with respect to your personal data. This Privacy Notice applies to all Tarsus operations as well as websites, mobile applications and digital services (“Services”). By using or accessing our Services in any manner, you acknowledge that you accept the practices and policies outlined below, and you hereby consent that we will collect, use, and share your information as described in this Privacy Notice.

Please note that the Services are currently only available to U.S. citizens or permanent residents age 18 and older. You may not use the Services if you are under the age of 18 or not a U.S. citizen or permanent resident.

Remember that your use of Tarsus’s Services is at all times subject to our Terms of Use, which incorporates this Privacy Notice. Any terms we use in this Privacy Notice without defining them have the definitions given to them in the Terms of Use. This Privacy Notice does not address how we process “Consumer Health Data” or “Regulated Health Information” as that term is defined under applicable state law about consumers who reside in the states of Nevada, Washington, New York, and any other applicable U.S. jurisdiction. Please refer to our Health Data Privacy Policy for more details.

If you have a disability, you may access this Privacy Notice in an alternative format by contacting .

Privacy Notice Table of Contents

This Privacy Notice covers how we treat Personal Data that we gather when you access or use our Services. “Personal Data” means any information that identifies or relates to a particular individual and also includes information referred to as “personally identifiable information” or “personal information” under applicable data privacy laws, rules or regulations.

This chart details the categories of Personal Data that we collect and have collected over the past 12 months. The Personal Data that we collect depends on our relationship with you, such as if you are a healthcare provider or vendor who works with us in a professional capacity, a consumer who uses our products and services, a job applicant, or a website visitor. Some data types may be associated with more than one category.
Category of Personal Data
Examples of Personal Data We Collect
Categories of Third Parties With Whom We Share Personal Data
A. Identifiers.
First and last name; email; address; and phone number.
Service providers; advertising partners; analytics partners and other parties you may authorize.
B. Personal information categories listed in the California Customer Records statute.
First and last name; signature; phone number; employment information. Other examples include medical information, health information, and health insurance information that you disclose offline or online such as through our patient-facing websites, communications channels, or otherwise through the Services.
Service providers; advertising partners (limited information about your interactions with certain health-related pages in our online Services); analytics partners and other parties you may authorize.
C. Protected classification characteristics under California or federal law.
Age (of individuals 40 years or older) and marital status.
Service providers; analytics partners and other parties you may authorize.
D. Commercial information.
Products or services purchased, obtained, or considered, or other purchasing or consuming histories or tendencies.
Service providers; advertising partners; analytics partners and other parties you may authorize.
E. Biometric information.
None.
N/A.
F. Internet or other similar network activity.
Browsing history, search history, social media information, IP address, device ID, information on a consumer's interaction with a website, application, or advertisement.
Service providers; advertising partners; Analytics partners and other parties you may authorize.
G. Geolocation data.
IP address-based location information.
Service providers; advertising partners; analytics partners and other parties you may authorize.
H. Sensory data.
None.
N/A.
I. Professional or employment-related information.
Credentials and occupation and professional memberships.
Service providers; advertising partners; analytics partners and other parties you may authorize.
J. Transactional Data.
Financial information to complete transactions with company, e.g., expense reimbursement.
Service providers; analytics partners and other parties you may authorize.
K. Inferences drawn from other Personal Data.
Profile reflecting a person's preferences, characteristics, psychological trends, predispositions, behavior, attitudes, intelligence, abilities, and aptitudes.
Service providers; analytics partners and other parties you may authorize.
L. Sensitive Personal Data.
Health information collected within the context of: (i) our regulatory responsibilities under the Federal Food, Drug, & Cosmetic Act (such as adverse event and product complaint reporting); (ii) health-related data that you disclose to us offline and online, such as through our patient-facing websites, communications channels, or otherwise through the Services.

Contents of messages that you send to service providers acting on our behalf (for example, customer services).
Service providers; advertising partners (limited information about your interactions with certain health-related pages in our online Services) and other parties you may authorize.

We collect Personal Data about you from the following categories of sources, which may include the use of AI to facilitate collection:

You

  • When you provide such information directly to us.
    • When you use our interactive tools and Services.
    • When you voluntarily provide information in free-form text boxes through the Services or through responses to surveys or questionnaires, including through online and offline methods, such as text or mail.
    • When you send us an email or otherwise contact us.
  • When you use the Services and such information is collected automatically.
    • Through Cookies (defined in the “Tracking Tools, Advertising and Opt-Out” section below).
    • If you use a location-enabled browser, we may receive information about your location.
    • When you engage with Services we make available, we receive and collect information transmitted from your mobile or computing device for the purpose of providing you the relevant Services (such as when we optimize our Services to fit the size of your screen).

Third Parties

  • Vendors, Suppliers, and Contractors
    • We use analytics providers to analyze how you interact and engage with the Services, or third parties help us respond to your inquiries and provide the Services, including through AI-enabled customer support.
  • Professional Associations, Business Partners, and Information Aggregators
    • We receive information about you from these third parties, such as if we engage in joint research activities or conduct industry or market research.
  • Advertising Partners
    • We receive information about you from some of our vendors who assist us with marketing or promotional services related to how you interact with our Services, advertisements, or communications.

Others

  • Consumers and customers
  • Employees, former employees, potential employees and family members
  • Government officials
  • Investors and shareholders
  • Publicly available sources

We process Personal Data about you for the categories of Commercial and Business Purposes listed below. We may use AI to help perform these activities.

Providing, Customizing and Improving the Services

  • Providing you with the Services or other products, services, or information you request.
  • Meeting or fulfilling the reason you provided the information to us.
  • Operating, providing, and maintaining the Services.
  • Improving the Services, including testing, research, internal analytics, and developing new products or services.
  • Personalizing the Services, and communications based on your preferences.
  • Business and market research.
  • Protecting the Services, including fraud protection, security, and debugging.
  • Carrying out other business purposes stated when collecting your Personal Data or as otherwise set forth in applicable data privacy laws, such as the California Consumer Privacy Act, as amended by the California Privacy Rights Act (the “CCPA”).

Marketing the Services

  • Marketing and selling the Services.
  • Showing you advertisements, including interest-based or online behavioral advertising.

Corresponding with You

  • Responding to correspondence that we receive from you, contacting you when necessary or requested, and sending you information about Tarsus or the Services.
  • Sending emails and other communications according to your preferences or that display content that we think will interest you.

Meeting Legal Requirements and Enforcing Legal Terms

  • Fulfilling our legal obligations under applicable law, regulation, court order or other legal process, such as preventing, detecting and investigating security incidents and potentially illegal or prohibited activities, adverse event and product complaint reporting, exercising or defending legal claims, financial disclosure reporting, maintaining patient registries.
  • Protecting the rights, property or safety of you, Tarsus or another party.
  • Enforcing any agreements with you.
  • Responding to claims that any posting or other content violates third-party rights.
  • Resolving disputes.

Other purposes

  • Activities for public health and interest.
  • Contracting and business planning activities.
  • Data and statistical analytics.
  • Engaging scientific experts and leaders.
  • Event management.
  • Finance and tax activities.
  • Patient testimonials.
  • Study recruitment.

We may disclose your Personal Data to the categories of service providers and other parties listed in this section. These entities may use AI technologies in order to perform the services listed below.

Service Providers. These parties help us provide the Services or perform business functions on our behalf. They include:

  • Hosting, technology and communication providers.
  • Security and fraud prevention consultants.
  • Support and customer service vendors.
  • Product fulfillment and delivery providers.

Advertising Partners. These parties help us market our services and provide you with other offers that may be of interest to you. They include:

  • Ad networks.
  • Marketing providers.
  • Social media platforms.

Analytics Partners. These parties provide analytics on web traffic or usage of the Services. They include:

  • Companies that track how users found or were referred to the Services.
  • Companies that track how users interact with the Services.

Parties You Authorize, Access or Authenticate

  • Third parties you access through the Services.

Government officials (e.g., law enforcement authorities, the courts, regulatory authorities)

Tarsus employees and affiliates

Vendors, suppliers, and contractors

Legal Obligations

We may share any Personal Data that we collect with third parties in conjunction with any of the activities set forth under “Meeting Legal Requirements and Enforcing Legal Terms” in the “Our Commercial or Business Purposes for Collecting Personal Data” section above.

Business Transfers

All of your Personal Data that we collect may be transferred to a third party if we undergo a merger, acquisition, bankruptcy or other transaction in which that third party assumes control of our business (in whole or in part).

Data that is Not Personal Data

We may create aggregated, deidentified, or anonymized data from the Personal Data we collect, including by removing information that makes the data personally identifiable to a particular user. We may use such aggregated, deidentified, or anonymized data and share it with third parties for any lawful business purposes, including to analyze, build, and improve the Services, develop new products and services, and promote our business, provided that we will not share such data in a manner that could reasonably identify you. To the extent that we process deidentified data, we will maintain and use the data in deidentified form and will not attempt to reidentify the data unless permitted by applicable law. Deidentified data that is reidentified and otherwise qualifies as Personal Data is subject to this Privacy Notice.

The Services use cookies and similar technologies such as pixel tags, web beacons, clear GIFs and JavaScript (collectively, “Cookies”) to enable our servers to recognize your web browser, tell us how and when you visit and use our Services, analyze trends, learn about our user base and operate and improve our Services. Cookies are small pieces of data – usually text files – placed on your computer, tablet, phone or similar device when you use that device to access our Services. We may also supplement the information we collect from you with information received from third parties, including third parties that have placed their own Cookies on your device(s). Please note that because of our use of Cookies, the Services do not support “Do Not Track” requests sent from a browser at this time.

We use the following types of Cookies:

  • Essential Cookies. Essential Cookies are required for providing you with features or services that you have requested. For example, certain Cookies enable you to log into secure areas of our Services. Disabling these Cookies may make certain features and services unavailable.
  • Functional Cookies. Functional Cookies are used to record your choices and settings regarding our Services, maintain your preferences over time and recognize you when you return to our Services. These Cookies help us to personalize our content for you, greet you by name and remember your preferences (for example, your choice of language or region).
  • Performance/Analytical Cookies. Performance/Analytical Cookies allow us to understand how visitors use our Services. They do this by collecting information about the number of visitors to the Services, what pages visitors view on our Services and how long visitors are viewing pages on the Services. Performance/Analytical Cookies also help us measure the performance of our advertising campaigns in order to help us improve our campaigns and the Services’ content for those who engage with our advertising. For example, Google Inc. (“Google”) uses cookies in connection with its Google Analytics services. Google’s ability to use and share information collected by Google Analytics about your visits to the Services is subject to the Google Analytics Terms of Use and the Google Privacy Policy. You have the option to opt-out of Google’s use of Cookies by visiting the Google advertising opt-out page at www.google.com/privacy_ads.html or the Google Analytics Opt-out Browser Add-on at https://tools.google.com/dlpage/gaoptout/.
  • Retargeting/Advertising Cookies. Retargeting/Advertising Cookies collect data about your online activity and identify your interests so that we can provide advertising that we believe is relevant to you. For more information about this, please see the section below titled “Information about Interest-Based Advertisements.”

You can decide whether or not to accept Cookies through your internet browser’s settings. Most browsers have an option for turning off the Cookie feature, which will prevent your browser from accepting new Cookies, as well as (depending on the sophistication of your browser software) allow you to decide on acceptance of each new Cookie in a variety of ways. You can also delete all Cookies that are already on your device. If you do this, however, you may have to manually adjust some preferences every time you visit our Services and some of our functionalities may not work as intended. Please note that our Services do not currently recognize “Do Not Track” signals. However, our Services may recognize certain opt-out preference signals, such as the Global Privacy Control, and will process such signals in accordance with applicable law, potentially including “do not sell”, “do not share”, and opt out of targeted advertising requests. You may set such a signal through your browser or browser extension.

To explore what Cookie settings are available to you, look in the “preferences” or “options” section of your browser’s menu. To find out more information about Cookies, including information about how to manage and delete Cookies, please visit http://www.allaboutcookies.org/.

In addition, our Services may use social media plug-ins to enable you to share information with others easily. When you visit our Services, the operator of the social media plug-in that is on our Services can place a cookie on your computer that lets that operator recognize individuals on their website who have previously visited our Services. The social media plug-ins may allow social media Services to receive directly identifiable information about you that shows you have visited our Services. The social media plug-in may collect this information for visitors, whether or not they specifically interact with the plug-in on our Services. Social media plug-ins also allow the social media website to share information about your activities on our Services with other users of their social media website. Tarsus does not control any of the content from social media plug-ins. For more information about social plug-ins from social media websites, you should refer to those sites’ privacy and data-sharing statements.

Information about Interest-Based Advertisements:

We may serve advertisements, and also allow third-party ad networks, including third-party ad servers, ad agencies, ad technology vendors and research firms, to serve advertisements through the Services. These advertisements may be targeted to users who fit certain general profile categories or display certain preferences or behaviors (“Interest-Based Ads”). Information for Interest-Based Ads (including Personal Data) may be provided to us by you, or derived from the usage patterns of particular users on the Services and/or services of third parties. Such information may be gathered through tracking users’ activities across time and unaffiliated properties, including when you leave the Services. To accomplish this, we or our service providers may deliver Cookies, including a file (known as a “web beacon”) from an ad network to you through the Services. Web beacons allow ad networks to provide aggregated auditing, research and reporting for us and for advertisers. Web beacons also enable ad networks to serve targeted advertisements to you when you visit other websites. Web beacons allow ad networks to view, edit or set their own Cookies on your browser, just as if you had requested a web page from their site.

We seek to protect your Personal Data from unauthorized access, use and disclosure using reasonable and appropriate physical, technical, organizational and administrative security measures based on the type of Personal Data and how we are processing that data. Although we work to protect the security of your data that we hold in our records, please be aware that no method of transmitting data over the internet or storing data is completely secure.

We retain Personal Data about you for as long as necessary to provide you with our Services. In some cases we retain Personal Data for longer, if doing so is necessary to comply with our legal obligations, resolve disputes or collect fees owed, or is otherwise permitted or required by applicable law, rule or regulation. We may further retain information in an anonymous, deidentified, or aggregated form where that information does not reasonably identify you.

As noted in the Terms of Use, we do not knowingly collect or solicit Personal Data about children under eighteen (18) years of age; if you are a child under the age of eighteen (18), please do not attempt to register for or otherwise use the Services or send us any Personal Data. Accordingly, we do not have actual knowledge that we sell or share the Personal Data of consumers under the age of 16 years old. If we learn we have collected Personal Data from a child under eighteen (18) years of age, we will delete that information as quickly as possible. If you believe that a child under eighteen (18) years of age may have provided Personal Data to us, please contact us at .

Because we engage in the practice of cross-context behavioral advertising, also known as online targeted advertising, we may “sell” and “share” your Personal Data as those terms are defined by the CCPA. In the preceding 12 months, we may have “sold” or “shared” identifiers, categories listed in the California Customer Records statute, commercial information, geolocation data, professional or employment-related information, health information (limited information about your interactions with certain health-related pages in our online Services), and internet or electronic network activity information with data analytics, advertising networks, and/or social media networks. You may request that we not “sell” or “share” your Personal Data by following the instructions at the end of this Notice.

The data that we capture about your interactions with some of our health-related online Services may be considered “sensitive” Personal Data. We use this interaction data to support cross-context behavioral advertising. You may request that we limit this use of our “sensitive” Personal Data by following the instructions at the end of this Notice.

You may have the rights listed below (“Data Subject Rights”) with respect to the Personal Data that we collect or process about you, however, these rights differ depending on your place of residency, including California, Colorado, Connecticut, Delaware, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, Nevada, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah, and Virginia. Please note that we reserve the right to honor your Data Subject Rights to the extent required by applicable law.

  • Right to Confirm Processing, Access, and/or Obtain a Copy: If you ask us, we will confirm whether we are processing your Personal Data. Additionally, upon request, we will provide you with a copy of all Personal Data you are lawfully entitled to receive, potentially including specific pieces of information, along with certain other details.
  • Right to Amend: If you believe your Personal Data is inaccurate or incomplete, you may request that we correct it.
  • Right to Delete: You may request that we delete Personal Data that we maintain about you.
  • Right of Portability: You may request that we move, copy, or transfer the Personal Data that we hold about you to another organization.
  • Right to Revoke Consent and/or Opt Out of Certain Processing Activities: You may ask us to restrict or stop the processing of your Personal Data. This includes general requests and requests in specific contexts, such as if we engage in certain automated decision-making activities.
  • Right to Limit Use and Disclosure of Sensitive Personal Data: You may ask us to limit the use and disclosure of Sensitive Personal Data.
  • Right to Opt Out of Targeted Advertising or “Sharing”: Targeted advertising is the practice of serving you tailored advertisements based on your Personal Data gathered over time and across other businesses, websites, applications, or services. Some jurisdictions may refer to this activity as “sharing.” You have the right to opt out of this practice.
  • Right to Opt Out of Sales: Some jurisdictions may consider targeted advertising a “sale” of Personal Data, and some jurisdictions may consider data about your interactions with our health-related online Services to be considered “sensitive” Personal Data, thus we may “sell” Personal Data and “sensitive” Personal Data about you. You may request that we not “sell” your Personal Data and “sensitive” Personal Data.
  • Right to Non-Discrimination: We will not discriminate against you for exercising Data Subject Rights, but we may charge a reasonable fee as permitted by law in fulfilling these rights, such as if you request multiple copies of your Personal Data.
  • Right to Appeal: If we deny your request to exercise a Data Subject Right, you may have the right to appeal the decision with us. If you would like to appeal a prior decision, please be sure to include information about your prior request so that we may locate our earlier determination.
  • Right to Lodge a Complaint: You may submit a complaint to the competent supervisory authority in the jurisdiction in which you live if you have any concerns about our processing of your Personal Data or if we deny your appeal to review a prior decision about your Data Subject Rights.
    • California Residents: You may contact the California Privacy Protection Agency here and the California Attorney General here.
    • Colorado Residents: You may contact the Colorado Attorney General here.
    • Connecticut Residents: You may contact the Connecticut Attorney General here.
    • Delaware Residents: You may contact the Department of Justice here.
    • Iowa Residents: You may contact the Iowa Attorney General here.
    • Indiana Residents: You may contact the Indiana Attorney General here.
    • Maryland Residents: You may contact the Consumer Protection Division here.
    • Minnesota Residents: You may contact the Minnesota Attorney General here.
    • Montana Residents: You may contact the Montana Attorney General here.
    • Nebraska Residents: You may contact the Nebraska Attorney General here.
    • Nevada: You may contact the Nevada Attorney General here.
    • New Hampshire Residents: You may contact the New Hampshire Attorney General here.
    • New Jersey Residents: You may contact the Division of Consumer Affairs here.
    • Oregon Residents: You may contact the Oregon Attorney General here.
    • Rhode Island Residents: You may contact the Rhode Island Attorney General here.
    • Tennessee Residents: You may contact the Tennessee Attorney General here.
    • Texas Residents: You may contact the Texas Attorney General here.
    • Utah Residents: You may contact the Utah Attorney General here.
    • Virginia Residents: You may contact the Virginia Attorney General here.

To exercise the rights described above, you or your Authorized Agent (defined below) must send us a request that (1) provides sufficient information to allow us to verify that you are the person about whom we have collected Personal Data, and (2) describes your request in sufficient detail to allow us to understand, evaluate and respond to it. Each request that meets both of these criteria will be considered a “Valid Request.” We may not respond to requests that do not meet these criteria. We will only use Personal Data provided in a Valid Request to verify your identity and complete your request. You do not need an account to submit a Valid Request.

We will work to respond to your Valid Request within 45 days of receipt, or as otherwise permitted by applicable law. We will not charge you a fee for making a Valid Request unless your Valid Request(s) is excessive, repetitive or manifestly unfounded. If we determine that your Valid Request warrants a fee, we will notify you of the fee and explain that decision before completing your request.

You may submit a Valid Request using the following methods:

You may also authorize an agent (an “Authorized Agent”) to exercise your rights on your behalf. To do this, you must provide your Authorized Agent with written permission to exercise your rights on your behalf, and we may request a copy of this written permission from your Authorized Agent when they make a request on your behalf.

California Resident Rights

California’s “Shine the Light” law (Cal. Civ. Code §1798.83) permits users of our Services that are California residents to contact us to prevent disclosure of Personal Data to third parties for such third parties’ direct marketing purposes; in order to submit such a request, please contact us at href=”mailto:”>.

We’re constantly trying to improve our Services, so we may need to change this Privacy Notice from time to time, and will make the updated Notice available on this page. Please note that if you’ve opted not to receive legal notice emails from us (or you haven’t provided us with your email address), those legal notices will still govern your use of the Services, and you are still responsible for reading and understanding them. If you use the Services after any changes to the Privacy Notice have been posted, that means you agree to all of the changes.

If you have any questions or comments about this Privacy Notice, the ways in which we collect and use your Personal Data or your choices and rights regarding such collection and use, please do not hesitate to contact us at:

This section supplements the information provided above and describes the additional Personal Data we collect when you apply for a position with Tarsus. We may collect the Personal Data in the below list in the following ways: directly from you; from publicly available sources, such as government entities, public records systems, and social media networks; data analytics providers and information aggregators; or as you may otherwise authorize, such as a former employers or references.

Please note if you use our Services in the application process, additional information is collected, as described above. We may collect the Personal Data categories listed in Cal. Civ. Code § 1798.80(e) (the California Customer Records Statute) in addition to the categories of Personal Data listed below. Items with an asterisk (*) may be considered “sensitive” Personal Data according to the CCPA.

  • Identifiers*: Government-issued identification numbers, including your Social Security, driver’s license, passport, state identification card, or military identification card numbers.
  • Public records and background check information (pursuant to your consent in accordance with applicable law): Current and past addresses, court records, credit and criminal history, and drug test results
  • Demographics and Protected Classifications*: citizenship, gender, date of birth, age, immigration status, and other protected classifications that you chose to disclose, such as race and ethnicity, marital status, sexual orientation, veteran or military status, disability, and medical status.
  • Professional or Employment Related Information: professional associations and employment history, including name of employer, position, employer contact information, and associated employment records.
  • Educational Information: educational institutions attended, degrees and certifications attained, and other educational or student records, which may include transcripts, attendance, and academic and disciplinary history.

We generally collect this Personal Data in order to evaluate your application. For more ways that we use and disclose the Personal Data listed here, please refer to “Our Commercial or Business Purposes for Collecting Personal Data” and “How We Disclose Your Personal Data” above.

Our Terms of Use and Privacy Policy have changed.

By clicking accept, you agree that you have read and will abide by these new terms.