California Privacy Notice

Last Updated: November 5, 2024

California Privacy Notice

In accordance with the California Privacy Rights Act (“CPRA”), this California CPRA Privacy Notice (“Notice”) discloses the personal information we collect from you and the purposes for doing so. As used in this Notice, “Caris,” “we,” “us” and “our” refer to Caris Life Sciences, Inc. and our subsidiaries, joint ventures and other companies under a common control (“Affiliates”), and “personal information” means all personal information as defined in the CPRA, which includes information relating to a particular household as well as a natural person. We do not consider personal information to include information that has been anonymized so that it does not allow a third party to identify a specific individual. This Notice applies to most of the personal information collected by Caris from California residents in the course of conducting our general business operations and is supplemental to our website privacy policies at www.carislifesciences.com, www.carismolecularintelligence.com, and www.mycancer.com (collectively, the “Websites”). There are three main exceptions:

• This Notice does not apply to personal information collected in the course of treatment, payment, or healthcare operations otherwise covered by the Health Insurance Portability and Accountability Act (HIPAA) of 1996 as amended from time to time. We have a separate HIPAA Privacy Statement covering Protected Health Information that is available here: www.carislifesciences.com/privacy-website.
• This Notice does not apply if you have received (directly or through our service providers or physicians) a separate notice concerning our use of your personal information. This may occur when we need to provide a separate notice to meet the requirements of specific laws.
• This Notice does not apply to the personal information of our employees or job applicants. An employee privacy notice is posted on our intranet. A job applicant privacy notice is provided to applicants when they submit their personal information to us in connection with their job application.

Our business purposes for processing your personal information

We may use the personal information you provide us to:

• contact you
• respond to your comments and questions
• take steps to enter into, or enter into, a contract with you or your employer or business perform our contracts with you or your employer or business
• make payments to you
• comply with our legal and regulatory obligations

Categories of personal information we may process

We may process the following categories of personal information, as appropriate for the relevant processing activity:

• Identifiers, such as name, contact details (including postal and e-mail addresses), employment-related information and financial information.
• Personal Characteristics, such as age and gender.
• Professional and Educational Information, such as information about education and professional qualifications, including professional specialties, prescribing data and verification of credentials.
• Sensitive Personal Information, such as genetic data, identifiers, racial information and health information.

Sources of personal information

You may provide personal information to us directly or via our service providers.

The recipients or categories of recipients of the personal information

We may share your personal information with:

• our subsidiaries, joint ventures or other companies under a common control (“Affiliates”), in which case we will require our Affiliates to honor this Notice;
• our service providers under appropriate contractual restrictions;
• companies or individuals who advise us in the course of running our business;
• third parties in connection with or during negotiation of any merger, financing, acquisition or dissolution, transaction or proceeding involving sale, transfer, divestiture or disclosure of all or a portion of our business or assets. In the event of an insolvency, bankruptcy or receivership, personal information may also be transferred as a business asset. If another company acquires our company, business or assets, that company will possess the personal information collected by us and will assume the rights and obligations regarding your personal information as described in this Notice;
• relevant authorities, or other recipients as required in litigation, if Caris believes in good faith that such disclosure is necessary (i) in connection with any legal investigation; (ii) to comply with relevant regulatory requirements and laws, such as laws requiring the disclosure of payments made to healthcare providers, (iii) to respond to subpoenas or warrants served on Caris; (iv) to protect or defend the rights or property of Caris; or (v) to investigate or assist in preventing any violation or potential violation of the law.

The period for which the personal information will be stored, or the criteria for determining the retention period

How long we retain personal information varies according to the type of information in question and the purpose for which it is used. Certain laws may require us to store personal information for specified periods. We delete personal information within a reasonable period after we no longer need to use it for the purpose for which it was collected or for any subsequent purpose that is compatible with the original purpose. The standards we use to determine the retention period are as follows: the time required to retain personal information to fulfill business purposes, including providing products and services; maintaining corresponding transaction and business records; controlling and improving the quality of the website; handling possible user inquiries or complaints and locating problems; and whether the user agrees to a longer retention period. This does not affect your right to request that we delete your personal information before the end of its retention period. We may archive personal information (which means storing it in inactive files) for a certain period prior to its final deletion, as part of our ordinary business continuity procedures.

Children (under 18)
We do not knowingly collect information about children (anyone under 18), except in connection with pediatric medical services, which, as explained above, are not subject to this Notice. If any parent or guardian of a child believes that we have personal information about that child that is not related to the child’s medical treatment, please contact us through one of the means below.

Rights of California residents under the CPRA

Right to Know
You have the right to request the following information:

• The categories of personal information Caris has collected about you.
• The categories of sources from which the personal information was collected.
• The business purpose for collecting the personal information.
• The categories of third parties with whom Caris has shared the personal information.
• The specific pieces of personal information Caris has collected about you.

Right to Opt Out of the Sale or Sharing of Your Information
We will not knowingly sell to or share your personal information unless we have your permission or are required by law to do so. Nevertheless, if you wish to be deleted from our list, you may unsubscribe to any communication you receive from us, or you may make a deletion request as described below.

Right to Request Deletion
We will delete personal information we have regarding you and direct our service providers to delete your personal information from their records to the extent required by the CPRA. Please note that Caris may be required or permitted by law to not remove (or allow removal) of your personal information.

Right to Be Free from Discrimination
Caris will not discriminate against you for exercising any of your rights under the CPRA.

Right to Correct
Caris will make commercially reasonable efforts to correct any inaccurate personal information about you.

Exercising Individual Rights

CPRA Contact Information
If you are a California resident and would like to exercise the rights described above on or after November 5, 2024, please contact us using one of the methods below.

Toll-Free Phone Number: (866) 771-8946
E-mail: Legal@CarisLS.com

Mail:
Caris Life Sciences
Corporate Compliance Officer
750 West John Carpenter Freeway, Suite 800
Irving, TX 75039

We may need to request specific information from you to help us confirm your identity and ensure your right to access your personal information (or to exercise any of your other rights). Government identification may be required. This is a security measure to ensure that personal information is not disclosed to any person who has no right to receive it. We cannot respond to an individual’s request if we cannot verify their identity and/or authority to make the request on behalf of another and confirm the personal data relates to them. Making a verifiable consumer request does not require any person to create an account with us. If an individual wishes to use an authorized agent to submit a request to opt-out on their behalf, they must provide the authorized agent written permission signed by them, the consumer. We may deny a request from an authorized agent if the agent cannot provide to us the individual’s signed permission demonstrating that the agent has been authorized to act on their behalf.

We may also contact you to ask you for further information in relation to your request to speed up our response.

Time Limit to Respond

We will respond to all legitimate requests within forty-five (45) days, or in more difficult cases, we may extend our response time by another forty-five (45) days.

Changes to this Notice
This Notice may be amended from time to time for any reason. Generally, we will notify you of any changes to this Notice by posting a new Notice on this page as indicated by changing the “Last updated” date below. However, if we intend to process your personal information for a purpose other than the purposes for which it was initially collected, we will take appropriate steps to contact you first and notify you of the new purpose.