PRIVACY POLICY

Effective Date: September 17, 2024
LAST UPDATED: September 17, 2024

Table of Contents

1. Sources of Personal Data
2. Types of Personal Data We Collect
3. How We Use Personal Data
4. How We Disclose Personal Data
5. Cookies and Other Tracking Technologies
6. Data Security and Data Retention
7. Children’s Privacy
8. External Links
9. Contact Information
10. Supplemental Information for Residents of California, Colorado, and other U.S. States

10X Health Ventures, LLC, together with its subsidiaries and affiliates (collectively, “Company” “us,” “we,” or “our”) is committed to protecting the privacy of Personal Data (i.e., information reasonably related to a specific individual). This Privacy Notice describes how we process Personal Data collected through our websites, social media accounts, mobile applications, and other online interactions and communications such as email (collectively, our “Digital Properties”); in-person events and purchases; and other online and offline interactions.

This Privacy Notice applies to information we collect about individual consumers, such as general website visitors (“Individuals”) as well as information we collect about the personnel of our business partners, including vendors and business customers, in business-to-business interactions (“Business Contacts”). However, this Privacy Notice does not apply to:

• Information about our current/former employees, applicants, and other individuals who interact with us for employment-related purposes.
• Information that is subject to the Health Insurance Portability and Accountability Act (“HIPAA”)
• Information that we process on behalf of and under the instructions of our business customers (as a processor), including information we process on behalf of medical practices subject to HIPAA or equivalent state laws.

Whenever you interact with us on behalf of another individual or entity, such as if you refer a friend to us, you must obtain their consent (or have the legal authority without consent) to share their Personal Data with us.

Changes: We may update this Privacy Notice from time to time. Any updated Privacy Notice will be effective when posted to our Digital Properties. Please check this Privacy Notice periodically for updates.

Sources of Personal Data

We collect Personal Data about you from the following sources:

1. Directly from you. We may collect Personal Data you provide to us directly, such as when you contact us through our Digital Properties; interact with us in person; sign up for offers or newsletters; communicate with us; place or customize orders; or sign up for an account or other services.
2. Data collected automatically and through tracking technologies. We may automatically collect information or inferences about you when you interact with our Digital Properties, such as through cookies and other tracking technologies. This may include information about how you use and interact with our Digital Properties, information about your device, and internet usage information. For more information about cookies and other tracking technologies, please see Section 5 (Cookies and Other Tracking Technologies).
3. From third parties. We may collect Personal Data from third parties, such as service and content providers, our affiliated companies and subsidiaries, business partners, data brokers, affiliate marketing partners, social media companies, and other parties who interact with us.
4. From publicly available sources. We may collect Persona Data about you from publicly available sources, such as public profiles and websites.

We may combine information that we receive from the various sources described in this Privacy Notice, including third party sources, and use or disclose the combined information for the purposes identified below.

Types of Personal Data We Collect

We may collect the following types of Personal Data about you. Except as otherwise specified, we may collect this Personal Data from both Individuals and Business Contacts.

1. Identifiers, such as your name, email address, physical address, telephone number, business contact information, and device identifiers (e.g., cookie IDs and IP address).
2. Records about you, such as signatures; physical characteristics or a description of you; the content, timing and method of communications you have with us, such as online chats, calls, and emails; and information you share with or upload to our Digital Properties, such as reviews and comments.
3. Demographic information, such as age (including birthdates) and gender (including gender identity).
4. Commercial information, such as information related to your transactions; products or services purchased, obtained, or considered; subscription information; or other purchasing or consuming histories or tendencies.
5. Internet or other electronic network activity information, such as your browsing history, search history, preference information (including marketing and purchasing preferences), account settings (including any default preferences), and other information regarding your interactions with and use of the Digital Properties. For more information about cookies and other device data, please see Section 5 (Cookies and Other Tracking Technologies).
6. Non-precise geolocation data, such as approximate location derived from IP addresses.
7. Audio, electronic, visual, or other sensory information, such as photographs you choose to provide and audio/video recordings during our interactions.
8. Professional or employment-related information (for Business Contacts), such as job title; organization; professional licenses, credentials, or affiliations; and other professional information.
9. Education information (for Business Contacts).
10. Inferences drawn from any of the information we collect about your preferences or behavior, including to assess the level of interest in our products and services based on frequency of visits and contact and determine your preferred frequency for receiving offers.
11. Sensitive Personal Data, including health and genetic information.

How We Use Personal Data

We may use Personal Data for the following purposes:

1. To provide you or your company products and services, such as making our Digital Properties, products and services available to you; registering, verifying, and maintaining your account with us; providing and delivering you the goods and services you request; providing customer service; processing or fulfilling orders and transactions (including processing payments); verifying customer information and eligibility for certain programs or benefits; communicating with you (including soliciting feedback or responding to requests, complaints, and inquiries); hosting informational webinars; and providing similar services or otherwise facilitating your relationship with us.
2. For our internal business purposes, such as operating our Digital Properties and customizing the content; maintaining internal business records, such as accounting, document management, and similar activities; enforcing our policies and rules; management reporting; auditing; and IT security and administration.
3. For our internal research and product improvement purposes, such as verifying or maintaining the quality or safety of our products or services; developing and improving our products or services, including developing or training algorithms or AI tools; evaluating the effectiveness of our advertising or marketing efforts; and debugging and repairing errors with our systems, networks, and equipment.
4. For legal, safety, or security reasons, such as complying with legal, reporting, and similar requirements; investigating and responding to claims against us, our personnel, and our customers; for the establishment, exercise or defense of legal claims; protecting our, your, our customers’, and other third parties’ safety, property, or rights; detecting, preventing, and responding to security incidents and health and safety issues (including managing the spread of communicable diseases); and protecting against malicious, deceptive, fraudulent, or illegal activity.
5. In connection with a corporate transaction, such as if we acquire, or sell or transfer all or a portion of our business or assets including through a sale in connection with bankruptcy and other forms of corporate change.
6. For marketing and targeted advertising, such as marketing our products or services or those of our affiliates, business partners, or other third parties. For example, we may use Personal Data we collect to personalize advertising to you (including by developing product, brand, or services audiences and identifying you across devices/sites); to analyze interactions with us or our Digital Properties; or to send you newsletters, surveys, questionnaires, promotions, or information about events or webinars. You can unsubscribe to our email marketing via the link in the email, or by contacting us using the information in the Contact Information section below.

We may use anonymized, de-identified, or aggregated information for any purpose permitted by law.

How We Disclose Personal Data

We may disclose Personal Data to third parties, including the categories of recipients described below:

1. Affiliates and subsidiaries, including parent entities, corporate affiliates, subsidiaries, business units, and other companies that share common ownership.
2. Health Care Providers, including independent health care providers that practice through our affiliated professional entities to facilitate scheduling and other purposes related to our services. We do not control the privacy practices of these providers, so encourage you to consult their privacy notices.
3. Service providers that work on our behalf to provide the products and services you request or support our relationship with you, such as our genetic and blood testing laboratory partners, IT providers, internet service providers, web hosting providers, data analytics providers, and companies that provide business support services, financial administration, or event organization.
4. Professional consultants, such as accountants, lawyers, financial advisors, and audit firms.
5. Vendors necessary to complete transactions you request, such as shipping companies and logistics providers.
6. Law enforcement, government agencies, and other recipients for legal, security, or safety purposes, such as when we share information to comply with law or legal requirements, to enforce or apply our Terms of Use and other agreements or policies; and to protect ours, our customers’, or third parties’ safety, property, or rights.
7. Other entities in connection with a corporate transaction, such as if we acquire, or sell or transfer all or a portion of our business or assets including through a sale in connection with bankruptcy and other forms of corporate change.
8. Business partners that may use Personal Data for their own purposes, such as:
   • Advertisers, ad platforms and networks, and social media platforms.
   • Third parties whose cookies and tracking tools we use as described in Section 5 (Cookies and Other Tracking Technologies) below.
   • Commercial data partners to whom we make information available for their own marketing purposes.
   • Partners who collaborate with us on promotional opportunities, including co-branded products and services.

   Where recipients use your Personal Data for their own purposes independently from us, we are not responsible for their privacy practices or personal data processing policies. You should consult the privacy notices of those third-party services for details on their practices.

9. The public, such as when you have an opportunity to make comments regarding us or our products that we may share with the public, including comments on our blog posts and reviews on our product pages. Any Personal Data in comments, reviews, or other content that you share in public areas of our Digital Properties may be read, collected, or used by other users or the public.
10. Entities to which you have consented to the disclosure.

Except as otherwise stated in this privacy policy or in any express consent given by you, 10X Health System does not share any personal information, including SMS opt-in consent, with any third-party organizations.

Cookies and Other Tracking Technologies

Our Digital Properties and authorized third parties use cookies and other tracking technologies (collectively “Cookies”) to collect information about you, your device, and how you interact with our Digital Properties. This section contains additional information about:

• The types of tracking technologies we use and the purposes for which we use them.
• The types of information we collect using these technologies.
• How we disclose or make information available to others.
• Choices you may have regarding these technologies.

1. Types of cookies and tracking technologies we use
   We and the third parties that we authorize may use the following tracking technologies:
   • Cookies, which are a type of technology that install a small amount of information on a user’s computer or other device when they visit a website. Some cookies exist only during a single session, and some are persistent over multiple sessions over time.
   • Pixels, web beacons, and tags, which are types of code or transparent graphics. In addition to the uses described below, these technologies provide analytical information about the user experience and help us customize our marketing activities. In contrast to cookies, which are stored on a user’s computer hard drive, pixels, web beacons, and tags are embedded invisibly on web pages.
   • Session replay tools, which record your interactions with our Digital Properties, such as how you move throughout our Digital Properties and engage with our webforms. In addition to the uses described below, this information helps us improve our Digital Properties and identify and fix technical issues visitors may be having with our Digital Properties.
   • Embedded scripts and SDKs, which allow us to build and integrate custom apps and experiences on our Digital Properties.
2. Purposes for using these technologies
   We and authorized third parties use these technologies for purposes such as:
   • Personalization, such as remembering language preferences, pages, and products you have viewed in order to enhance and personalize your experience when you visit our Digital Properties.
   • Improving performance, such as maintaining and improving the functionality and features of our Digital Properties.
   • Analytics, such as analyzing how our websites are used. For example, we use Google Analytics to help us improve the user experience. Google Analytics may use cookies and other tracking technologies to perform their services. To learn how Google Analytics collects and processes data, please visit www.google.com/policies/privacy/partners.
   • Advertising, such as conducting advertising and content personalization on our Digital Properties and those of third parties; tracking activity over time and across different website and other digital properties to develop a profile of your interests and advertise to you based on those interests (“interest-based advertising”); providing you with offers and online content that may be of interest to you; and measuring the effectiveness of advertising campaigns and our communications with you, including identifying how and when you engage with one of our emails.
   • Security, such as preventing fraud and malicious behavior.
3. Information collected
   These tracking technologies collect data about you and your device, such as your IP address, location (both approximate and precise) cookie ID, device ID, Ad ID, operating system, browser used, browser history, search history, and information about how you interact with our Digital Properties (such as pages on our Digital Properties that you have viewed and information you have submitted).
4. Disclosures of your information
   We may disclose information to third parties or allow third parties to directly collect information using these technologies on our Digital Properties, such as social media companies, advertising networks, companies that provide analytics including ad tracking and reporting, security providers, and others that help us operate our business and Digital Properties.
5. Your choices
   Some of the third parties we work with participate with the Digital Advertising Alliance (“DAA”) and Network Advertising Initiative (“NAI”). The DAA and NAI provide mechanisms for you to opt out of interest-based advertising performed by participating members at http://www.aboutads.info/choices/ and https://optout.networkadvertising.org/. You may also click on the AboutAds icon on an advertisement and follow the instructions on how to opt out.

   You can also refuse or delete cookies using your browser settings. If you refuse or delete cookies, some of our Digital Properties’ functionality may be impaired. Please refer to your browser’s Help instructions to learn more about how to manage cookies and the use of other tracking technologies. If you change computers, devices, or browsers; use multiple computers, devices, or browsers; or delete your cookies, you may need to repeat this process for each computer, device, or browser. Opting out of interest-based advertising will not opt you out of all advertising, but rather only interest-based advertising from us or our agents or representatives.

   Some browsers have incorporated Do Not Track (“DNT”) preferences. At this time, we do not honor Do Not Track signals.

Data Security and Data Retention

Although we maintain reasonable security safeguards, no security measures or communications over the Internet can be 100% secure, and we cannot guarantee the security of your information.

Your Personal Data will be retained as long as necessary to fulfill the purposes we have outlined above unless we are required to do otherwise by applicable law. This includes retaining your Personal Data to provide you with the products or services you have requested and interact with you; maintain our business relationship with you; improve our business over time; ensure the ongoing legality, safety and security of our services and relationships; or otherwise in accordance with our internal retention procedures. Once you have terminated your relationship with us, we may retain your Personal Data in our systems and records in order to ensure adequate fulfillment of surviving provisions in terminated contracts or for other legitimate business purposes, such as to enable easier future user onboarding, demonstrate our business practices and contractual obligations, or provide you with information about our products and services in case of interest.

Children’s Privacy

The Digital Properties are not directed at, marketed to, nor intended for, children under 13 years of age. As a general rule, we do not knowingly collect any information, including Personal Data, from children under 13 years of age. If you believe that we have inadvertently collected Personal Data from a child under the age of 13, please contact us at the address in the Contact Information section below, and we will take prompt steps to delete the information.

External Links

Our Digital Properties may contain links to external sites or other online services that we do not control, including those embedded in third party advertisements or sponsor information. We are not responsible for the privacy practices or data collection policies of such third-party services. You should consult the privacy notices of those third-party services for details on their practices.

Contact Information

If you have questions regarding this Privacy Notice, please contact us at privacy@10xhealthsystem.com.

Supplemental Information for Residents of California, Colorado, and Other U.S. States

1. Data Subject Rights
   Depending on our relationship with you (i.e., whether you are an Individual or a Business Contact), and in which state you reside within the United States, you may have certain rights regarding Personal Data:
   • Right to Know. You may have the right to request information about the categories of Personal Data we have collected about you, the categories of sources from which we collected the Personal Data, the purposes for collecting, selling, or sharing the Personal Data, and to whom we have disclosed your Personal Data and why. You may also request the specific pieces of Personal Data we have collected about you.
   • Right to Delete. You may have the right to request that we delete Personal Data that we have collected from you.
   • Right to Correct. You may have the right to request that we correct inaccurate Personal Data that we maintain about you.
   • Right to Opt Out of Sales and Sharing for Targeted Advertising. You may have the right to opt out of the sale or sharing of your Personal Data for targeted advertising.
   • Right to Limit Use and Disclosure of Sensitive Personal Data. You may have the right to limit the use and disclosure of Sensitive Personal Data.

   You may exercise the any of the rights available to you by emailing us at privacy@10xhealthsystem.com or by calling us at (844) 977-2810.

   To the extent required by law, we will honor opt-out preference signals sent in a format commonly used and recognized by businesses, such as an HTTP header field or JavaScript object. We will process opt-out preference signals at the browser level.

   We will not discriminate against you for exercising your privacy rights.

   Verification: In order to process rights requests, we may need to obtain information to locate you in our records or verify your identity depending on the nature of the request. In most cases we will collect some or all of the following data elements: first and last name, email address, and telephone number. In some cases, we may request different or additional information, including a signed declaration that you are who you say you are, and will inform you if we need such information.

   Authorized Agents: Authorized agents may exercise rights on behalf of you by submitting a request to privacy@10xhealthsystem.com and indicating that they are submitting the request as an agent. We may require the agent to demonstrate authority to act on behalf of you by providing signed permission from you. We may also require you to verify your own identity directly with us or to directly confirm with us that you provided the authorized agent permission to submit the request.

   Appeal: If we deny your rights request, you may have the right to appeal. To submit an appeal, contact us at privacy@10xhealthsystem.com. We will inform you in writing our response to your appeal.

2. Additional Data Processing Disclosures
   Below please find a chart detailing the categories of Personal Data we collected and with whom it was sold, shared, or disclosed for a business purpose in the past 12 months.

Categories of Personal Data We Collect

Identifiers (Section 2.A)

Categories of Third Parties with Whom We Disclose Personal Data for a Business Purpose

• Affiliates and subsidiaries
• Healthcare Providers
• Service providers
• Professional consultants
• Vendors necessary to complete transactions you request
• Law enforcement, government, agencies, and other recipients for legal, security, or safety purposes
• In connection with a corporate transaction
• Entities to which you have consented to the disclosure

Categories of Third Parties to Whom Personal Data is Sold or Shared for Targeted Advertising

• Advertisers, ad platforms and networks, and social media platforms
• Third parties whose cookies and tracking tools we use as described in Section 5 (Cookies and Tracking Technologies)
• Commercial data partners to whom we make information available for their own marketing purposes
• Partners who collaborate with us on promotional opportunities, including co-branded products and services

Categories of Personal Data We Collect

Records about you (Section 2.B)

Categories of Third Parties with Whom We Disclose Personal Data for a Business Purpose

• Affiliates and subsidiaries
• Healthcare Providers
• Service providers
• Professional consultants
• Vendors necessary to complete transactions you request
• Law enforcement, government, agencies, and other recipients for legal, security, or safety purposes
• In connection with a corporate transaction
• Entities to which you have consented to the disclosure

Categories of Third Parties to Whom Personal Data is Sold or Shared for Targeted Advertising

• Advertisers, ad platforms and networks, and social media platforms
• Third parties whose cookies and tracking tools we use as described in Section 5 (Cookies and Tracking Technologies)
• Commercial data partners to whom we make information available for their own marketing purposes
• Partners who collaborate with us on promotional opportunities, including co-branded products and services

Categories of Personal Data We Collect

Demographic information (Section 2.C)

Categories of Third Parties with Whom We Disclose Personal Data for a Business Purpose

• Affiliates and subsidiaries
• Healthcare Providers
• Service providers
• Professional consultants
• Vendors necessary to complete transactions you request
• Law enforcement, government, agencies, and other recipients for legal, security, or safety purposes
• In connection with a corporate transaction
• Entities to which you have consented to the disclosure

Categories of Third Parties to Whom Personal Data is Sold or Shared for Targeted Advertising

• Advertisers, ad platforms and networks, and social media platforms
• Third parties whose cookies and tracking tools we use as described in Section 5 (Cookies and Tracking Technologies)
• Commercial data partners to whom we make information available for their own marketing purposes
• Partners who collaborate with us on promotional opportunities, including co-branded products and services

Categories of Personal Data We Collect

Commercial information (Section 2.D)

Categories of Third Parties with Whom We Disclose Personal Data for a Business Purpose

• Affiliates and subsidiaries
• Healthcare Providers
• Service providers
• Professional consultants
• Vendors necessary to complete transactions you request
• Law enforcement, government, agencies, and other recipients for legal, security, or safety purposes
• In connection with a corporate transaction
• Entities to which you have consented to the disclosure

Categories of Third Parties to Whom Personal Data is Sold or Shared for Targeted Advertising

• Advertisers, ad platforms and networks, and social media platforms
• Third parties whose cookies and tracking tools we use as described in Section 5 (Cookies and Tracking Technologies)
• Commercial data partners to whom we make information available for their own marketing purposes
• Partners who collaborate with us on promotional opportunities, including co-branded products and services

Categories of Personal Data We Collect

Internet or other electronic network activity (Section 2.F)

Categories of Third Parties with Whom We Disclose Personal Data for a Business Purpose

• Affiliates and subsidiaries
• Service providers
• Professional consultants
• Vendors necessary to complete transactions you request
• Law enforcement, government, agencies, and other recipients for legal, security, or safety purposes
• In connection with a corporate transaction
• Entities to which you have consented to the disclosure

Categories of Third Parties to Whom Personal Data is Sold or Shared for Targeted Advertising

• Advertisers, ad platforms and networks, and social media platforms
• Third parties whose cookies and tracking tools we use as described in Section 5 (Cookies and Tracking Technologies)
• Commercial data partners to whom we make information available for their own marketing purposes
• Partners who collaborate with us on promotional opportunities, including co-branded products and services

Categories of Personal Data We Collect

Non-precise geolocation data (Section 2.G)

Categories of Third Parties with Whom We Disclose Personal Data for a Business Purpose

• Affiliates and subsidiaries
• Service providers
• Professional consultants
• Vendors necessary to complete transactions you request
• Law enforcement, government, agencies, and other recipients for legal, security, or safety purposes
• In connection with a corporate transaction
• Entities to which you have consented to the disclosure

Categories of Third Parties to Whom Personal Data is Sold or Shared for Targeted Advertising

• Advertisers, ad platforms and networks, and social media platforms
• Third parties whose cookies and tracking tools we use as described in Section 5 (Cookies and Tracking Technologies)
• Commercial data partners to whom we make information available for their own marketing purposes
• Partners who collaborate with us on promotional opportunities, including co-branded products and services

Categories of Personal Data We Collect

Audio, electronic, visual, or other sensory information (Section 2.H)

Categories of Third Parties with Whom We Disclose Personal Data for a Business Purpose

• Affiliates and subsidiaries
• Service providers
• Professional consultants
• Law enforcement, government, agencies, and other recipients for legal, security, or safety purposes
• In connection with a corporate transaction
• Entities to which you have consented to the disclosure

Categories of Third Parties to Whom Personal Data is Sold or Shared for Targeted Advertising

• Not sold or shared

Categories of Personal Data We Collect

Professional or employment-related information (Section 2.I)

Categories of Third Parties with Whom We Disclose Personal Data for a Business Purpose

• Affiliates and subsidiaries
• Service providers
• Professional consultants
• Vendors necessary to complete transactions you request
• Law enforcement, government, agencies, and other recipients for legal, security, or safety purposes
• In connection with a corporate transaction
• Entities to which you have consented to the disclosure

Categories of Third Parties to Whom Personal Data is Sold or Shared for Targeted Advertising

• Advertisers, ad platforms and networks, and social media platforms
• Third parties whose cookies and tracking tools we use as described in Section 5 (Cookies and Tracking Technologies)
• Commercial data partners to whom we make information available for their own marketing purposes
• Partners who collaborate with us on promotional opportunities, including co-branded products and services

Categories of Personal Data We Collect

Education information (Section 2.J)

Categories of Third Parties with Whom We Disclose Personal Data for a Business Purpose

• Affiliates and subsidiaries
• Service providers
• Professional consultants
• Law enforcement, government, agencies, and other recipients for legal, security, or safety purposes
• In connection with a corporate transaction
• Entities to which you have consented to the disclosure

Categories of Third Parties to Whom Personal Data is Sold or Shared for Targeted Advertising

• Not sold or shared

Categories of Personal Data We Collect

Inferences (Section 2.K)

Categories of Third Parties with Whom We Disclose Personal Data for a Business Purpose

• Affiliates and subsidiaries
• Service providers
• Professional consultants
• Vendors necessary to complete transactions you request
• Law enforcement, government, agencies, and other recipients for legal, security, or safety purposes
• In connection with a corporate transaction
• Entities to which you have consented to the disclosure

Categories of Third Parties to Whom Personal Data is Sold or Shared for Targeted Advertising

• Advertisers, ad platforms and networks, and social media platforms
• Third parties whose cookies and tracking tools we use as described in Section 5 (Cookies and Tracking Technologies)
• Commercial data partners to whom we make information available for their own marketing purposes
• Partners who collaborate with us on promotional opportunities, including co-branded products and services

Categories of Personal Data We Collect

Sensitive personal information (Section 2.L)

Categories of Third Parties with Whom We Disclose Personal Data for a Business Purpose

• Affiliates and subsidiaries
• Healthcare providers
• Service providers
• Professional consultants
• Vendors necessary to complete transactions you request
• Law enforcement, government, agencies, and other recipients for legal, security, or safety purposes
• In connection with a corporate transaction
• Entities to which you have consented to the disclosure

Categories of Third Parties to Whom Personal Data is Sold or Shared for Targeted Advertising

• Advertisers, ad platforms and networks, and social media platforms
• Third parties whose cookies and tracking tools we use as described in Section 5 (Cookies and Tracking Technologies)
• Commercial data partners to whom we make information available for their own marketing purposes
• Partners who collaborate with us on promotional opportunities, including co-branded products and services

California Shine the Light: If you are a California resident, you may opt out of sharing your Personal Data subject to California Civil Code §1798.83 (the “Shine the Light law”) with third parties for those third parties’ direct marketing purposes by emailing privacy@10xhealthsystem.com.