Notice of Privacy Practices

THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.

As a HIPAA covered entity, we follow the HIPAA Privacy, Security and Breach Notification Rules.

This notice applies to the health information we hold about you in connection with the test you ordered.

We may use and disclose your health information in these ways (45 CFR 164.520):

• Treatment, payment and health care operations. This includes running your test; when a test is billed to your health plan, sending the plan what it needs to process that claim; and our own internal activities, such as quality assessment and staff training.
• Disclosures to you. We give you access to your own information, including your completed test reports. When your results are ready we email you (the email never names your test) with the lab’s secure link to your report, which asks for the tested person’s details before it opens.
• As required by law. We disclose health information when a federal, state or local law requires it.
• Public health activities. We may disclose health information to a public health authority for a purpose the law allows, such as preventing or controlling disease.
• Victims of abuse, neglect or domestic violence. We may disclose health information to a government authority the law authorizes to receive reports of this kind.
• Health oversight activities. We may disclose health information to a government agency that oversees the health care system, such as one auditing or investigating a health care provider.
• Judicial and administrative proceedings. We may disclose health information in response to a court order, or, in limited circumstances, a subpoena or discovery request.
• Law enforcement. We disclose health information to law enforcement only when the law requires it. Where a state requires a court order or search warrant before we may disclose, we require one too, and we do not promise advance notice to you before a disclosure the law allows without it.
• Coroners, medical examiners and funeral directors. We may disclose health information to identify a deceased person, determine a cause of death, or carry out their duties.
• Organ and tissue donation. We may disclose health information to organizations that handle organ, eye or tissue procurement, banking or transplantation.
• Research. We do not use or disclose your genetic information or test results for research without your written authorization.
• To avert a serious threat to health or safety. We may disclose health information to prevent or lessen a serious and imminent threat to the health or safety of a person or the public.
• Specialized government functions. We may disclose health information for functions such as military, national security or protective services the law specifically authorizes.
• Workers’ compensation. We may disclose health information as necessary to comply with workers’ compensation or similar programs that provide benefits for work-related injuries or illness.
• Business associates. Some of the companies that help us run this service, such as those that host our systems, may see your information under a written agreement that requires them to protect it the way we do.

Some uses need your written authorization before we may make them: marketing, any sale of your health information, and any other use not described in this notice. You may revoke an authorization you have given, in writing, at any time, for anything we have not yet done because of it.

You have the right to:

• Access and copies. See and get a copy of the health information we hold about you, including your completed test reports. We act on your request within 30 days, and may take one additional 30-day extension if we need it.
• Amendment. Ask us to amend information you believe is incorrect or incomplete.
• An accounting of disclosures. Ask for a list of certain disclosures we have made of your information.
• Requesting restrictions. Ask us not to disclose certain information. We are not required to agree, except this: if you paid for that item or service in full yourself, we will honor a request not to disclose information about it to your health plan for payment or health care operations, unless the law otherwise requires the disclosure.
• Confidential communications. Ask us to communicate with you in a particular way, or at a particular location.
• A paper copy of this notice. Ask us for a paper copy of this notice at any time, even if you agreed to receive it electronically.
• Choosing a representative. Name someone to act for you in exercising these rights.

Every test is self-pay today, and when you pay the self-pay price we don’t send a claim to your health plan. Once insurance billing opens, you may still pay for our pharmacogenomics (PGx) test yourself and ask us not to share that test with your health plan; we will honor that request unless the law requires the disclosure.

Where a state law protects your health or genetic information more strictly than this notice describes, we follow that law. In Illinois, for example, the Genetic Information Privacy Act keeps genetic test results confidential and limits who may receive them.

Which state laws apply to you, and how they change this notice, is [To be confirmed] by counsel.

We are required to:

• Keep your health information private.
• Give you this notice of our privacy practices, and follow the terms of whichever version is currently in effect.
• Notify you if a breach compromises your unsecured health information.
• We reserve the right to change this notice, and to make the change effective for the health information we already hold as well as any we receive afterwards. We will post the revised notice on this page, and you may ask us for a paper copy.

If you believe your privacy rights have been violated, you may complain to us at info@genematrix.io, or to the U.S. Department of Health and Human Services Office for Civil Rights. We will not retaliate against you for filing a complaint.

Privacy Officer, GeneMatrix, Fulton Labs, 1375 W Fulton St, Suite 545, Chicago, IL 60607. Email: info@genematrix.io. Phone: 847-302-9668.

October 2, 2026