Effective Date: February 3, 2025

LAST UPDATED February 3, 2025

1. Sources of Consumer Health Data
2. Types of Consumer Health Data We Collect
3. How We Use Consumer Health Data
4. How We Disclose Consumer Health Data
5. Data Subject Rights
6. Contact Information

U.S. CARIS MPI, Inc., d/b/a Caris Life Sciences, together with its subsidiaries and affiliates (collectively, “Company,” “Caris,” “us,” “we,” or “our”) is committed to protecting the privacy of Consumer Health Data (i.e., health information relating to a reasonably identifiable consumer). This Consumer Health Privacy Notice describes how we process Consumer Health Data collected through our websites, social media accounts, mobile applications, and other online interactions and communications such as email (collectively, our “Digital Properties”); molecular samples you submit for profile testing; in-person interactions, events, and purchases; and other online and offline interactions.

Scope: This Consumer Health Privacy Notice does not apply to:

1. Data about our own current/former employees, contractors, agents, and job applicants;
2. Protected health information subject to the Health Insurance Portability and Accountability Act. Please review our Notice of Privacy Practices for additional information on our processing of protected health information;
3. Personal Data that we handle on behalf of and under the instructions of our business customers; or
4. Personal Data collected as part of a clinical trial or other biomedical research study subject to the Common Rule (45 C.F.R. 46).

Whenever you interact with us on behalf of another individual or entity, such as if you refer a friend to us, you must obtain their consent (or have the legal authority without consent) to share their Consumer Health Data with us.

Changes: We may update this Consumer Health Privacy Notice from time to time. Any updated Consumer Health Privacy Notice will be effective when posted. Please check this Consumer Health Privacy Notice periodically for updates. If required by law, we will contact you directly to provide you with an updated Consumer Health Privacy Notice.

1. Sources of Consumer Health Data

We collect Consumer Health Data about you from the following sources:

1. Directly from you. We may collect Consumer Health Data you provide to us directly, such as when you provide us a sample for testing, contact us through our Digital Properties, interact with us in person, sign up for offers or newsletters, communicate with us, place or customize orders, or sign up for an account or other services.
2. From third parties. We may collect Consumer Health Data from third parties, such as healthcare providers (“HCPs”) who complete requisition forms to order tests or send samples to us for testing, distributors who coordinate the ordering process and/or may provide services to you, service and content providers, our affiliated companies and subsidiaries, business partners, data brokers, social media companies or other parties who interact with us.
3. From publicly available sources. We may collect Consumer Health Data about you from publicly available sources, such as public profiles and websites.

We may combine information that we receive from the various sources described in this Consumer Health Privacy Notice, including third party sources, and use or disclose the combined information for the purposes identified below.

2. Types of Consumer Health Data We Collect

We may collect the following types of Consumer Health Data:

1. Health status or treatment information, such as health conditions or diagnoses; health treatments and services (such as surgeries, procedures, or other mental or physical interventions); medications; and bodily functions, including vital signs, symptoms, or health measurements.
2. Genetic data, including DNA, RNA, protein, and other molecular data.

3. How We Use Consumer Health Data

We may use Consumer Health Data for the following purposes:

1. To provide you products and services, such as conducting molecular profile testing and providing a report upon completion of testing; making our Digital Properties, products and services available to you; registering, verifying, and maintaining your account with us; providing and delivering you the goods and services you request; providing customer service; processing or fulfilling orders and transactions (including processing payments); verifying customer information and eligibility for certain programs or benefits; communicating with you (including soliciting feedback or responding to requests, complaints, and inquiries); hosting informational webinars; and providing similar services or otherwise facilitating your relationship with us.
2. For our internal business purposes, such as day-to-day operation of our business; managing your tests; maintaining internal business records, such as accounting, document management and similar activities; administration and billing; enforcing our policies and rules; management reporting; auditing; and IT security and administration.
3. For our internal analysis and product improvement purposes, such as verifying or maintaining the quality or safety of our products or services; internal analyses; safety reporting; improving the quality or safety our products or services; designing new products and services; developing and improving algorithms, artificial intelligence or machine learning tools and models; evaluating the effectiveness of our advertising or marketing efforts; and debugging and repairing errors with our systems, networks, and equipment.
4. For research and study-related purposes, such as conducting studies, trials, and medical testing; reusing your Personal Data and samples collected from testing; conducting research-related analysis on prior projects; using stored samples for future research projects; researching the causes of disease; and developing new drugs and therapies.
5. For legal, safety or security reasons, such as complying with legal, reporting, and similar requirements, including regarding the reliability and safety of our tests; investigating and responding to claims against us, our personnel, and our customers; for the establishment, exercise or defense of legal claims; protecting our, your, our customers’, and other third parties’ safety, property or rights; processing your requests to exercise your rights; detecting, preventing, and responding to security incidents and health and safety issues (including managing spread of communicable diseases); and protecting against malicious, deceptive, fraudulent, or illegal activity.
6. In connection with a corporate transaction, such as if we acquire assets of another business, or sell or transfer all or a portion of our business or assets including through a sale in connection with bankruptcy and other forms of corporate change.
7. For marketing, such as marketing our products or services. For example, we may use Consumer Health Data we collect to personalize advertising to you or to send you newsletters, surveys, questionnaires, promotions, or information about events or webinars.

We may use anonymized, de-identified, or aggregated information for any purpose permitted by law.

4. How We Disclose Consumer Health Data

We may disclose the Consumer Health Data described above to third parties, including the categories of recipients described below:

1. Affiliates and subsidiaries, including parent entities, corporate affiliates, subsidiaries, business units, and other companies that share common ownership.
2. Service providers that work on our behalf to provide the products and services you request or support our relationship with you, such as IT providers, local distributors, internet service providers, web hosting providers, data analytics providers, and companies that provide business support services, financial administration, or event organization.
3. Professional consultants, such as accountants, lawyers, financial advisors, and audit firms.
4. Vendors necessary to complete transactions you request, such as shipping companies and logistics providers.
5. Law enforcement, government agencies, and other recipients for legal, security, or safety purposes, such as when we share information to comply with law or legal requirements, to enforce or apply our Terms of Service and other agreements or policies, and to protect our, our customers’, or third parties’ safety, property, or rights.
6. Other entities in connection with a corporate transaction, such as if we acquire assets of another entity, or sell or transfer all or a portion of our business or assets including through a sale in connection with bankruptcy and other forms of corporate change.
7. The public, such as when you have an opportunity to make comments regarding us or our products that we may share with the public, including comments on our blog posts and reviews on our product pages. Any Consumer Health Data in comments, reviews, or other content that you share in public areas of our Digital Properties may be read, collected, or used by other users or the public.
8. Research collaborators, such as academic researchers, universities, hospitals, laboratories, and life science, pharmaceutical, and other companies for the purposes of research, where you have provided us with consent to do so.
9. Your healthcare provider or insurance, healthcare plan, or other payor, where applicable. For example, we may disclose medical information about you to (a) the appropriate doctors, nurses and health care personnel who you have authorized for treatment, and/or (b) third-party payors so that the treatment and services you receive may be billed to and payment may be collected from you.
10. Entities to which you have consented to the disclosure.

6. Data Subject Rights

Washington consumers may have certain rights regarding your Consumer Health Data:

• Right to Access. You may have the right to confirm whether we process your Consumer Health Data and to obtain information about how we process such data.
• Right to Delete. You may have the right to request that we delete Consumer Health Data concerning you.
• Right to Withdraw Consent. If you provided consent to process Consumer Health Data, you may have the right to withdraw such consent.
• Appeal. If we deny your rights request, you may have the right to appeal. To submit an appeal, email us at Privacy@CarisLS.com.

You may exercise the rights available to you by emailing us at Privacy@CarisLS.com or by calling us at (866) 771-8946.

7. Contact Information

If you have questions regarding this Consumer Health Privacy Notice, please contact us at: Privacy@CarisLS.com