Sagimet Biosciences Inc.

Cyber Risk Management and Strategy

We have developed and implemented a cybersecurity risk management program designed to protect the confidentiality, integrity, and availability of our critical systems and information. Our cybersecurity risk management program isintegrated into our broader information security policy, which is informed by industry standards such as the National Institute of Standards and Technology (NIST) Cybersecurity Framework and Center for Internet Security (CIS) benchmarks.

Our approach to cybersecurity risk management includes, but is not limited to, the following elements:

We have leveraged the support of athird-party data privacy organization to perform a risk assessment designed to identify, assess, and manage data privacy risks. Further, we follow a formal, documented process to assess the data protection practicesof certain third-party vendors that handle sensitive information on our behalf. This process includes a risk assessment process which is designed to oversee, identify and manage material cybersecurity and data privacy risks associated with systems, services and third parties.

To date, we have not experienced any cybersecurity incidents or threats that have materially affected us or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition; however, like other companies in our industry, we have, from time to time, experienced threats and security incidents relating to our and our third-party vendors’ information technology systems and infrastructure. For more information, please see the section entitled “Risk Factors” in this Annual Report on Form 10-K.

Governance Related toCybersecurity Risks

Our Senior Director of IT is responsible for the strategic leadership and direction of our cybersecurity program. The Senior Director of IT has over 16 years of experience as an information technology professional.

Our Board of Directors has delegated oversight of our cybersecurity risk management program to ouraudit committee, per the audit committee charter. Our audit committee has oversight over cybersecurity risks. Our management provides periodic presentations to the audit committee on our cybersecurity program, including updates on cybersecurity risks and related cybersecurity strategy, as applicable. In addition, management alerts the audit committee of any material cybersecurity incidents. The audit committee provides updates regarding our cybersecurity program to the board of directors when material.