Privacy Notice for California Residents

a. Notice and access.

As a consumer, you have the right to know:

• i. The categories of personal information we collect about you;
• ii. The categories of sources from which the information was collected;
• iii. The business or commercial purpose for collecting, disclosing, or selling personal information; and
• iv. The categories of third parties we have disclosed personal information to for a business purpose and the categories of personal information disclosed.

You may request that ORG SERVICES LIMITED provide you access to the specific pieces of personal information collected about you in a readily usable format.

Your access rights under the CCPA are not absolute. Specifically, the CCPA limits the information you can request to personal information collected in the 12-month period preceding our receipt of the request. Additionally, under the CCPA, ORG SERVICES LIMITED is not obligated to respond to requests for access to personal information more than twice in a twelve-month period.

ORG SERVICES LIMITED may, in its sole discretion, choose to provide personal information in response to a consumer’s access request that relate to a time period greater than the preceding 12 months or respond to a consumer request more frequently than required by law; choosing to do so, however, does not constitute an obligation to do so.

b. Deletion.

You may request that ORG SERVICES LIMITED delete the personal information we process about you, subject to certain limitations. Your personal information may not be deleted if the information is necessary to:

• i. Complete the transaction for which the personal information was collected, provide a good or service requested by the consumer, or reasonably anticipated within the context of a business’s ongoing business relationship with the consumer, or otherwise perform a contract between the business and the consumer.
• ii. Detect security incidents, protect against malicious, deceptive, fraudulent, or illegal activity; or prosecute those responsible for that activity.
• iii. Debug products to identify and repair errors that impair existing intended functionality.
• iv. Ensure the right of another consumer to exercise his or her right of free speech, or exercise another right provided for by law.
• v. Comply with the California Electronic Communications Privacy Act pursuant to Chapter 3.6 (commencing with Section 1546) of Title 12 of Part 2 of the Penal Code.
• vi. Engage in public or peer-reviewed scientific, historical, or statistical research in the public interest that adheres to all other applicable ethics and privacy laws, when the businesses’ deletion of the information is likely to render impossible or seriously impair the achievement of such research, if the consumer has provided informed consent.
• vii. To enable solely internal uses that are reasonably aligned with the expectations of the consumer based on the consumer’s relationship with the business.
• viii. Comply with a legal obligation.
• ix. Otherwise use your personal information, internally, in a lawful manner that is compatible with the context in which you provided the information.

c. Opt-out of sales.

The CCPA provides you the right to opt-out of having your personal information sold by a business. ORG SERVICES LIMITED does not sell personal information to third parties.

d. Non-discrimination.

The CCPA prohibits businesses from discriminating against a consumer for exercising their rights under the CCPA. ORG SERVICES LIMITED will not discriminate against you for exercising any of your CCPA rights.

e. Designated methods for submitting rights requests.

Access and deletion rights may be exercised within your Account Settings. For additional details regarding account deletion, see Section 10 of our Privacy Policy.

If you have not created a ORG SERVICES LIMITED account, you may contact us directly to submit your request by emailing privacy@originalgene.com with the subject line “CCPA Rights Request”.

f. Verifying consumer requests.

Only you or someone legally authorized to act on your behalf may make a verifiable consumer request related to your personal information. Your request must:

• i. Provide sufficient information that allows us to verify you are the person about whom we collected personal information or an authorized representative.
• ii. Describe your request with sufficient detail that allows us to properly understand, evaluate, and respond to it.

Generally, requests submitted through your account will be considered sufficiently verified when the request relates to personal information associated with that specific account. However, if you have not created, or no longer have access to your account, we may request additional materials or information for the purposes of validating the authenticity of your request.

ORG SERVICES LIMITED will use the information provided in connection with a verification request solely for the purposes of verification. We cannot effectuate your request if we are unable to verify your identity or authority to make the request and confirm that the personal information relates to you.

There may be other situations where ORG SERVICES LIMITED is unable or not required to effectuate your rights request. In such circumstances, ORG SERVICES LIMITED will respond to your request within the period required by the CCPA. The response will provide relevant details regarding ORG SERVICES LIMITED’s determination and any additional, pertinent information about your request.

a. Information you provide directly to us.

Information	Description	Business or commercial purpose(s) of collection
Identifiers	Registration Information, such as your name and email address. User Content, such as your government-issued ID which may be requested in exceptional circumstances to assist you in regaining access to your account. Web-Behavior Information, such as your device ID or IP address, automatically collected when you visit our website. Generally identifiers are provided directly to us, collected automatically when you visit our website, or created on your behalf when you sign up for our Services to allow us to provide our Services.	Provide you with Services and analyze and improve our Services (Read more in our Privacy Policy) Process, analyze and deliver your genetic testing results Allow you to share your Personal Information with others Provide customer support Conduct surveys or polls, and obtain testimonials Provide you with marketing communications
Personal information categories listed in the California Customer Records statute (Cal. Civ. Code §1798.80(e))	Registration Information, such as your name and address. Self-Reported Information, such as details about your employment or education. User Content, such as your government-issued identification which may be requested in exceptional circumstances to assist you in regaining access your account. Some personal information included in this category may overlap with other categories.	Provide you with Services and analyze and improve our Services Process, analyze and deliver your genetic testing results Allow you to share your Personal Information with others Provide customer support Provide you with marketing communications
Protected classification characteristics	Protected classification characteristics we process include age (40 years or older), race, color, ancestry, national origin, citizenship, religion or creed, marital status, medical condition, physical or mental disability, sex (including gender, gender identity, gender expression, pregnancy or childbirth and related medical conditions), sexual orientation, veteran or military status, genetic information (including familial genetic information) Generally this information is collected because you provide it directly to us. Certain elements, including Genetic Information, ancestry, and sex, may be developed or analyzed by ORG SERVICES LIMITED in relation to our genetic testing services.	Provide you with Services and analyze and improve our Services Process, analyze and deliver your genetic testing results Allow you to share your Personal Information with others Provide customer support Conduct surveys or polls, and obtain testimonials Provide you with marketing communications
Commercial information	Self-Reported Information, such as survey responses regarding past purchasing history. User Content, such as information you share on forums about products you purchased or considered. Generally, this information is collected directly from you.	Provide you with Services and analyze and improve our Services Provide customer support Conduct surveys or polls, and obtain testimonials Provide you with marketing communications
Sensory data	Self-Reported Information including audio, electronic, visual, thermal, olfactory, or similar information. Generally, this information is collected directly from you, or passively collected about you with your permission.	Provide you with Services and analyze and improve our Services Allow you to share your Personal Information with others Provide customer support Conduct surveys or polls, and obtain testimonials Provide you with marketing communications
Professional, Education, or employment-related information.	Self-Reported Information including education, household income, occupation, and other professional information. Generally, this information is collected directly from you.	Allow you to share your Personal Information for research purposes Provide customer support Conduct surveys or polls, and obtain testimonials Provide you with marketing communications

b. Information collected in relation to our genetic testing services.

Information	Description	Business or commercial purpose(s) of collection Business purpose(s) for disclosure
Biometric information	Genetic Information (your As, Cs, Ts, and Gs) Self-Reported Information about physiological, behavioral, and biological characteristics, or other identifier or identifying information, and sleep, health, or exercise data Generally, this information is collected directly from you or developed or analyzed by ORG SERVICES LIMITED in relation to our genetic testing services.	Provide you with Services and analyze and improve our Services Process, analyze and deliver your genetic testing results Allow you to share your Personal Information with others Provide customer support Conduct surveys or polls, and obtain testimonials

c. Information collected through tracking technology (e.g. from cookies and similar technologies).

Information	Description	Purpose of Collection Business purpose(s) for disclosure
Internet or other electronic network activity information	Web-Behavior Information, including data generated from your use of our Services and collected through log files, cookies, web beacons, and similar technologies, (e.g., browser type, domains, page views). Our Cookie Policy contains more information about how ORG SERVICES LIMITED processes Web-Behavior Information.	Provide you with Services and analyze and improve our Services Allow you to share your Personal Information with others Provide customer support Conduct surveys or polls, and obtain testimonials Provide you with marketing communications
Geolocation data	Web-Behavior Information that includes the identification or estimation of physical location or movement. Our Cookie Policy contains more information about how ORG SERVICES LIMITED processes Web-Behavior Information.	Provide you with Services and analyze and improve our Services Allow you to share your Personal Information with others Provide customer support Conduct surveys or polls, and obtain testimonials Provide you with marketing communications

d. Derived information created from other personal information.

Information	Description	Purpose of Collection Business purpose(s) for disclosure
Inferences and derived data	Inferences and derived information are any information, data, assumptions, or conclusions ORG SERVICES LIMITED infers based on analyses of facts, evidence, or another source of information or data. ORG SERVICES LIMITED may derive Genetic Information, such as imputed genotype data, genetic risk scores, and phenotypes (which are observable characteristics or traits). Generally this information is created by ORG SERVICES LIMITED and not collected directly from you. We may derive information from data that was collected in relation to our genetic testing services, directly from you, or through tracking technology.	Provide you with Services and analyze and improve our Services Process, analyze and deliver your genetic testing results Allow you to share your Personal Information with others Conduct surveys or polls, and obtain testimonials Provide you with marketing communications

e. Disclosures of personal information for a business purpose

ORG SERVICES LIMITED may share information listed above under “Categories of personal information collected” with our service providers for operational business purposes including:

Audit: Auditing related to a current interaction and concurrent transactions.

• i. Security: Detecting security incidents, protecting against malicious, deceptive, fraudulent, or illegal activity, and prosecuting those responsible for that activity.
• ii. Debugging: Debugging to identify and repair errors that impair existing intended functionality.
• iii. Transient use: Short-term, transient use, where personal information is not disclosed to another third party and is not used to build a profile about a consumer or otherwise alter an individual consumer’s experience outside the current interaction.
• iv. Quality assurance and product improvement: Activities to verify or maintain the quality or safety of a service or device that is owned, manufactured, manufactured for, or controlled by ORG SERVICES LIMITED, and otherwise to improve, upgrade, or enhance the service or device that is owned, manufactured, manufactured for, or controlled by ORG SERVICES LIMITED.

f. Disclosures of personal information for a commercial purpose

If you have given your explicit consent, for example via a data transfer authorization or other consent document, we may disclose the categories of personal information detailed above for commercial purposes. The purpose, such as recruitment for external research, may vary and will be specified in the consent.