Biotia Privacy Policy

Biotia, Inc. ("Biotia," "we," "us," or "our") is a life sciences company committed to protecting and respecting your privacy and personal information. This Privacy Policy (the "Policy") explains our practices for handling information we may collect and use about website visitors, prospective customers, researchers, institutional partners, and others with whom we interact in making our website, biotia.io, our portal at portal.biotia.io, and our e-commerce platform, shop.biotia.io (collectively, the "Website"), available. This Policy applies to individuals who interact with Biotia in a direct-to-consumer capacity, as well as researchers, healthcare providers, laboratories, and other business or institutional partners who engage with Biotia's products and services.

Note, if you are a patient who has interacted with our patient store, purchased a test kit, submitted a biological sample, or received test results, the handling of your health data is subject to and governed by our notices specific to health data which are made available to you through the patient portal or in the footer of our Website. In the event of a conflict, any notices specific to health data control over this Policy.

By providing us with personal information or using the Website, you expressly consent to the information-handling practices described in this Policy. If you do not agree with this Policy, please do not use the Website or provide us with your information.

Important Information About This Policy

While we always aim to provide complete and transparent information about how we process your personal information, we reserve the right to amend or update this Policy from time to time, or to create additional policies, in order to accurately reflect changed circumstances or new legal requirements. As a result, it is important that you read this Policy closely so that you are fully aware of how and why we are using your personal information.

To assist us in ensuring that we can provide the most accurate information possible, we ask that you check this Policy for updates. We also ask that, where we have an ongoing relationship with you and any of the data you have provided becomes no longer accurate, you keep us informed of this so we can amend our records accordingly.

Personal Information We Receive or Collect About You

For the purposes of this Policy, "personal information" is any information that identifies, relates to, or can be used to contact a particular individual. The types of personal information we may collect include the following categories detailed below. Please note that if you are acting in a commercial or institutional context (for example, as a representative of a research institution, healthcare provider, or laboratory), the information collected may not be considered "personal information" under relevant consumer data privacy laws, and certain consumer-specific rights may not apply to you.

1. Information You Provide:

• Contact information - first name, last name, email address, billing and mailing address, telephone number, and, for our commercial partners, institutional affiliation and professional title.
• Account information - if you have an account with us, user ID, account username, account password, account number, organizational account details (for our commercial partners), and other information that we may request or that you may provide relating to your account.
• Transactional information - details about your transactions with us, including method of payment, payments received, payment details, transaction history, purchase orders, invoices, and other information relating to any payments transmitted to us by you or your organization.
• Marketing information - details regarding informational and promotional materials you may have requested or received from us, the properties or communities in which you are interested, your receipt of promotional communications, and information on your marketing or communication preferences.
• Communication information - copies of communications and inquiries you have submitted to us, including through email, calls, social media, chatbots, and features available on our Website, and otherwise.
• Device and usage information - details regarding how and when you use our website, including the device used to connect to our website or software, your IP address, associated location (though not precise geolocation), and device identifier, the frequency and duration of your usage, the pages you view, what websites or search terms referred you to our website, and information about your interaction with our Website.

We collect this information when you visit or navigate our Website, fill in forms through use of our Website, submit applications or inquiries to us, communicate with us (including by phone, email, or otherwise), visit or engage with our social media pages, participate in surveys or sponsored activities, or otherwise provide us with personal information.

Please note that we may aggregate or anonymize the foregoing types of information such that they are no longer capable of identifying you, in which case they are no longer considered "personal information." We may also collect information about you from third-party sources and information about you that is publicly available.

2. Automatically Collected Usage and Device Information

Like most website operators, we use various technologies to automatically collect information about visitors. Those technologies include:

• Cookies. Cookies are small text files that a website transfers to a visitor's browser or device for recordkeeping purposes. We use cookies to personalize visitors' experiences on our website, provide content that we believe may be of interest, track visitor trends and patterns, engage in marketing and advertising, and otherwise analyze our website traffic. For further information about cookies, including how to refuse cookies, please visit www.allaboutcookies.org. Please note that if cookies are disabled, you may not be able to enjoy certain features of our Website.
• Log Files and Device Identifiers. We use log files to track actions occurring on the Website and collect data about visitors, including IP address, browser type, Internet service provider, referring/exit pages, date/time stamps, and device identifiers. This information is used for security purposes and to detect and prevent fraud.
• Pixels, tags, and web beacons. Our website may also use "pixels," "tags," or "web beacons." When we refer to "pixels," we are generally referring to all of these types of technologies. These technologies are small pieces of code that run when a page or email is loaded. They are used to monitor the behavior of the visitor or email recipient (such as what icons were clicked or whether links in an email were opened) and gather analytics. For example, when you open our homepage, a pixel may run and generate information based on the visit, and then this information is processed by us and our vendors. Pixels work in conjunction with cookies to let us know what portions of our website are of interest to you and to help us provide you with tailored information from our website. If you turn off cookies, the pixels, tags, and web beacons we use may still detect certain information about your interaction with our website and disregard any cookie-prohibitive markers or signals. Note, the vendors that supply us these pixels, tags, web beacons, or similar tracking technologies collect your personal information instantaneously and simultaneously with our collection of your information and they may use the information for their own or others' purposes. Under some state laws, this may be a "sale" or "sharing" (i.e., cross-context behavioral advertising). You can adjust your preferences anytime via the "Cookie Preferences" link on every page. We also honor Global Privacy Control (GPC) and recognized universal opt-out signals.
• Analytics. Our website may also use third-party analytics tools, such as Google Analytics. You can find more information about how data is collected and processed in connection with the Google Analytics service here. You can also read Google's privacy policy here.

We use a consent banner and "Cookie Preferences" link to control non-essential cookies and pixels (including analytics and advertising) on biotia.io.

The information collected through these technologies may be combined with personal information or aggregated with other information on website visits. We may disclose information about your use of our website to our advertising and analytics partners, who may combine it with other information that you previously provided to them.

3. Information from Other Sources

We may obtain both personal and non-personal information about you from our vendors, affiliates, business partners, contractors, suppliers, telehealth partners, research collaborators, and other third parties and add it to other information we have collected. We, and the third parties we engage, may combine information we collect from you over time, and across our Website, with information obtained from other sources. This helps us improve the information's overall accuracy and completeness, and also helps us better tailor our interactions with you.

4. Social Media

If you interact with us on any social media platform (e.g., Meta, TikTok, X, LinkedIn), depending on your social media privacy settings, the personal information that you submit on the social media platform may be read, collected, or used by us as described in this Policy. In addition, where we respond to any interaction with you on social media, your account name/handle may be viewable by any and all members or users of our social media accounts. Social media platforms operate independently from us and we are not responsible for the personal information that you choose to submit or link on any social media platform. We encourage you to review the privacy policies and settings of any social media platform with which you interact to help you understand their privacy practices.

How We Use Personal Information

We (or service providers acting on our behalf) may use the personal information identified above for the following purposes:

• Negotiating, entering into, and managing our relationship and agreements with you, including service agreements, research collaborations, and partnership arrangements with our commercial partners.
• Process orders for products or services, including test kits, research services, data analysis, and related offerings for both consumers and our commercial partners.
• Administering our patient portal, e-commerce platform, and our commercial partner portals or interfaces.
• Providing and optimizing your experience on our Website and ensuring that our content is presented to you in the most effective manner.
• Communicating with you and communicating regarding our services, our agreements with you, and other issues.
• Sending you promotional or informational communications and solicitations, tracking your marketing preferences, and for our internal marketing purposes.
• Managing customer service issues, including issues relating to the performance of our services and user feedback.
• Developing, updating, and improving our Website, products, services, and user experience, and otherwise improving our knowledge and insights regarding customers.
• Preventing and detecting fraud, financial crime, hacking activities, security breaches, and other unlawful activities in connection with our Website.
• Enforcing our agreements with you, participants, partners, or vendors, complying with our legal or regulatory obligations, and defending or advancing legal claims.
• Notifying you about changes to our Website, goods and services offered, or material changes to this Policy.
• Providing you with surveys or otherwise soliciting feedback from you.
• Conducting advertising and analytics to measure the performance of our advertising campaigns and understand how users interact with our website and e-commerce platform, including through the use of cookies, pixels, and similar tracking tools provided by third parties including Google, Meta, and TikTok (where the law allows us to do so or with your consent).
• Performing other functions as otherwise described to you at the time of collection or to which you otherwise consent.

For more information about your options relating to your personal information and your communication preferences, see "Your Choices About Personal Information" below.

Our Marketing Efforts

We may send you direct marketing communications from time to time including news, updates, offers, and other promotions relating to our services and activities. We will only send marketing messages where the law allows us to do so and, in the event that you no longer wish to receive marketing from us, then you can always unsubscribe using the option provided in the footer of the communication you have received or by contacting us using the information below.

Our services may include emails, SMS messaging, or other mobile communication capabilities. By providing your telephone number and opting into SMS or phone communications, you expressly consent to receive autodialed, pre-recorded, or artificial voice calls and text messages from Biotia and its authorized service providers regarding your account, test orders, results, and related services, which may be in the form of informational, marketing, promotional, or commercial communications. Message and data rates may apply. Message frequency will vary.

You may opt out of SMS communications at any time by replying STOP to any message. For help, reply HELP or contact privacy@biotia.io. Consent to receive marketing communications is not a condition of purchasing any services. That said, if the law permits us to communicate with you via SMS text message or telephone without your consent, we may continue to do so, even if you opt out of receiving marketing, promotional, or commercial communications.

Telephone calls made to or from Biotia or its affiliated providers may be monitored or recorded for quality assurance, training, compliance, and legal purposes. By initiating or accepting a phone call through the services, you consent to such monitoring and recording. If you do not consent, please notify the representative at the start of the call.

You may opt out of receiving marketing or promotional email from Biotia by following the "unsubscribe" instructions or using "unsubscribe" links within communications we send.

Disclosure of Personal Information

When the information we collect about you is aggregated, anonymized, or otherwise does not identify you, we may use that information for any purpose or disclose it to third parties, to the extent permitted by applicable law.

In addition, we may disclose your information to the following types of third parties:

• Service providers we use to facilitate our business operations and administration. For example, our service providers include (i) IT and system administration providers, (ii) data storage providers, (iii) vendors to facilitate payments and payment processing, and (iv) kitting and fulfillment partners.
• Marketing and advertising vendors that may assist with lead generation, hosting information relating to users and customers, marketing automation, advertisement placement and targeting, and marketing campaigns and communications. These may include Google, Meta, and TikTok, which may receive device data, browsing behavior, and purchase event data from our Website subject to your consent and/or the opt-out rights described below.
• Our affiliates and related entities who assist us with our business operations and making our services and the Website available to you.
• Analytics vendors in order to understand our website traffic and usage patterns and optimize our Website. Note, the technologies we use on our website to automatically collect information about you and your interaction with our website may be supplied by third-party vendors that collect your information instantaneously and simultaneously with our collection of your information. They may also use your information for their own or others' purposes.
• Affiliated entities who may use your information to provide you the details of their services or otherwise market to you.
• Research partners, laboratories, and healthcare providers with whom we collaborate to provide testing, analysis, or research services, subject to applicable agreements and, where required, your consent or authorization.
• Regulatory and governmental authorities, law enforcement agencies, and courts, as necessary to comply with applicable laws and regulations, respond to a subpoena, search warrant, or other lawful request for information, or to otherwise protect our rights.
• Our professional advisors, such as lawyers, accountants, and other similar advisors.
• Buyers or other successors prior to or in the event of a merger, acquisition, divestiture, restructuring, reorganization, dissolution, or other sale or transfer of some or all of our assets, whether as a going concern or as a part of bankruptcy, liquidation, or similar proceeding, where the information is among the assets being transferred.
• Other parties for any purpose we disclose at the time you provide the information.

We further reserve the right to refer or disclose your information to law enforcement or regulatory authorities in the event that we believe you, other individuals, our partners or service providers, or anyone else is in danger, at risk of harm, in violation of applicable laws, or representing a safety concern.

De-Identified Data

We may process personal information to create data that is no longer reasonably capable of being associated with, or used to identify, you or any other individual. Once information has been de-identified, it is no longer considered "personal information" under this Policy or applicable law. We maintain technical, administrative, and procedural safeguards designed to prevent the re-identification of de-identified data. We commit to not attempt to re-identify any de-identified information, except as may be permitted or required by applicable law (for example, to verify that de-identification processes are functioning as intended). We may use de-identified data for any lawful purpose, including research, analytics, product development, collaborations with research partners, and other business purposes, without restriction. De-identified data derived from biological samples and test results may be used for research and development purposes as described in our User Agreement.

Protection of Personal Information

We use appropriate administrative, technical, and physical measures to protect your personal information from loss, theft, and unauthorized use, disclosure, or modification. We implement technical and organizational measures to maintain a level of security appropriate to the risk to the personal information we process, aimed at maintaining the ongoing integrity and confidentiality of personal information. We evaluate these measures on a regular basis. Please be aware that no data transmission over the Internet is 100% secure. While we strive to protect your personal information, we cannot ensure or warrant the security of any information you transmit to us and you do so at your own risk. Financial information and payment data that you provide to us, including credit card numbers, are encrypted with secure socket layer (SSL) encryption technology.

Data Retention

We retain personal information for as long as necessary to fulfill the purposes we collected it, including for the purposes of satisfying any legal, accounting, or other mandatory reporting requirements. To determine the appropriate retention period, we consider the amount, nature, and sensitivity of the personal information, the potential risk of harm from unauthorized use or disclosure, the purposes for which we process it, whether we can achieve those purposes through other means, and the applicable legal requirements. We also consider any specific limitation periods under applicable law. We will retain your personal information in accordance with our record retention policy, as updated from time to time, and as long as we have a relationship with you. To request that your personal information be deleted from our databases, please see "Your Choices About Personal Information" below for more information.

Your Choices About Personal Information

We respect your right to make choices about the ways we collect, use, and disclose your information. We try to offer you meaningful choices regarding your personal information. Some choices you have regarding personal information include the following.

• Marketing Emails - As required by applicable laws, you can opt-out of receiving promotional emails from us by clicking the "unsubscribe" link in any such promotional emails and following the instructions provided.
• Tracking Technologies - Depending on your browser or device, you may have the option to set the browser to accept all cookies, reject all cookies, notify you when a cookie is set, or delete cookies. Each browser and device is different, so we recommend you evaluate the tools and settings available in your browser or device, as well as any available instructions for the same. Please note that if you disable or delete cookies, you may not be able to access or use certain features of our website. The National Advertising Initiative also makes resources available to assist consumers in opting out of certain tailored online ads, which you can access here.
• Google Analytics - As discussed above, we use Google Analytics in connection with our Website. If you would like to refrain from having your data collected by Google Analytics, Google has developed an opt-out browser that you can use. You can find more information on how Google uses information it collects here.
• Declining to Provide Information - You can choose not to provide us with information we may request through our Website, but that may result in you being unable to use certain features of our Website, request information about our services, or initiate other transactions with us.
• Do Not Track and Global Privacy Control - Our Website honors Global Privacy Control (GPC) and similar recognized universal opt-out signals. Please note that our Website may not honor other "Do Not Track" signals, and such signals may not impact the operation of our website beyond the scope of GPC.

In addition to the above, you may contact us using the details provided at the end of this Policy with any questions about the choices relating to your personal information.

Links to Third-Party Websites

Our website may contain links to third-party websites, including the websites of vendors we use to process information on our behalf and social media platforms. Such websites have separate privacy policies that you should review. We do not control these third-party websites and are not responsible for the content of linked websites or those companies' data-handling practices.

Additional Information for Nevada Residents

Under Nevada law, Nevada "consumers" may request that certain "operators" of internet sites and online services refrain from the "sale" of their "covered information" to third parties (as such terms are defined under Nevada law). Biotia does not sell your personal information to third parties. If you are a Nevada resident and have questions about our data practices, you may contact us using the information below.

Additional Information for Residents of Other U.S. States

The laws of the jurisdiction where you reside (e.g., Nebraska, Texas, etc.) may afford you certain rights with respect to your personal information.

The categories of personal information we process are described in the Section above titled "Personal Information We Receive or Collect About You."

If you are a patient or prospective patient, we may collect "sensitive data" or "sensitive personal information" (if not otherwise exempted as being regulated by HIPAA). For more information about how we collect, use, disclose this information, see our health data privacy notices.

Our purposes in processing personal information are described in the Section above titled "How We Use Personal Information."

We disclose the personal information described above to the third parties described in the "Disclosure of Personal Information" section of this Privacy Policy.

Subject to any applicable limitations or exceptions, the laws of your state of residence may provide you with the right to:

• Confirm whether a company processes personal information about you, access such personal information, and to obtain a copy of the personal information in a readable format;
• Correct inaccuracies in your personal information, taking into account the nature of the data and purposes for which it is processed;
• Delete personal information regarding or provided by you;
• Obtain a list of the third parties to whom we have disclosed your personal information;
• Opt out of the processing of your personal information for the purposes of targeted advertising, the sale of your personal information, or using your personal information for automated decision-making or automated profiling in furtherance of a decision that produces legal or similarly significant effects; and/or
• Be free from discrimination for exercising any of the rights described in this section, including by denying goods or services, charging different prices or rates for goods or services, or providing a different quality of goods or services.

We do not sell personal information for monetary remuneration. Biotia does not engage in the processing of personal information for the purpose of profiling in furtherance of a decision that produces legal or similarly significant effects, and as a result, will not be able to honor requests seeking to exercise these rights with respect to such conduct.

Biotia does engage in the processing of personal information for the purpose of targeted advertising. Please email us at privacy@biotia.io or use the "Preferences" link on our Website to exercise any applicable rights on behalf of yourself or as an authorized agent of a consumer. If you submit an email, your request must include your name, email address, mailing address, phone number, the nature of your inquiry and the context in which we may have received your information. To protect the privacy and security of your information, we require your verifiable consumer request to:

• Provide sufficient information that allows us to reasonably verify you are the person about whom we collected personal information; and
• Describe your request with sufficient detail that allows us to properly understand, evaluate, and respond to it.

We will respond within the timeframe and manner required by any applicable law. For example, we will respond to a verifiable Texas resident's request without undue delay and, in any event, within forty-five (45) days of its receipt though that may be extended by an additional 45 days, taking into account the complexity and number of requests. If we require more time, we will inform you of the reason and extension period in writing via email. We will deliver our written response via e-mail.

In the event Biotia declines your request, you have the right to appeal the decision. You can do so by contacting Biotia at privacy@biotia.io and explaining the basis for your appeal. We will respond to your appeal within the timeframe and manner required by any applicable law. For example, we will respond to a Texas resident's appeal no later than 60 days after receipt and if such appeal is unsuccessful, we will also provide information to contact the Texas Attorney General's Office to submit a complaint.

You may submit a request to exercise any of the rights described above twice annually. We will not charge a fee to process or respond to a verifiable consumer request unless it is excessive, repetitive, or manifestly unfounded.

Additional Information for Researchers and Our Commercial Partners

If you are a researcher, healthcare provider, laboratory, or other institutional partner engaging with Biotia's products and services in a business capacity, your use of Biotia's services may be governed by a separate agreement between Biotia and your organization (such as a services agreement, research collaboration agreement, or data use agreement). In the event of a conflict between this Policy and such agreement, the terms of the agreement will control with respect to the services provided under that agreement.

Personal information collected in connection with commercial relationships may include business contact information, professional credentials, institutional affiliations, and information necessary to administer the business relationship. We use this information to provide services, manage our contractual relationships, communicate about products and services, and for other legitimate business purposes.

Certain consumer privacy rights described in this Policy may not apply when you are acting in a business or employment context. Please contact us at the information below if you have questions about your rights.

Additional Information for California Residents

California Civil Code § 1798.83 (California's "Shine the Light" law) permits California residents to request certain information regarding our disclosure of personal information to third parties for their direct marketing purposes. We do not share the personal information regulated by the Shine the Light law with third parties for their own direct marketing purposes. Nonetheless, you may contact us at privacy@biotia.io to learn more.

Children's Privacy

Our services are intended for a general audience and are not directed at, or intended for use by, individuals under the age of 16 years. Accordingly, we do not knowingly collect personal information from individuals under age 16. In the event Biotia is notified or becomes aware that the Website has been used by an individual under the age of 16 to store information of that individual without parental consent, Biotia shall be and is authorized to delete, in its entirety, with no notice to you, any of the information stored by that individual or by you on that individual's behalf.

Data Location

You understand and agree that information about you may be transferred to, stored, and processed by information technology systems located in the United States or other jurisdictions that may have laws that differ from the laws of your country of residence or the jurisdiction in which you reside. We have put in place appropriate safeguards (such as contractual commitments) in accordance with applicable legal requirements so that your personal information is adequately protected.

Changes to this Policy

Please note that we may change this Policy from time to time. If there are changes to our Policy, we will post them here and update the "Last Updated" date at the top of this document. Continued use of our Website after any changes is deemed to be acceptance of those changes. Accordingly, we encourage you to check the Policy periodically for updates.

How to Contact Us

For questions or more information about our privacy practices, please contact us by using the contact information provided below:

Biotia, Inc.

Email: privacy@biotia.io

Postal Address: 30-02 48th Ave, Suite 260, Long Island City, NY 11101

Toll-Free Phone number: +1 (917) 730-1829