Consumer Health Data Privacy Policy

This Consumer Health Data Privacy Policy (“Policy”) is provided pursuant to the Washington My Health My Data Act, RCW 19.373 et seq. (“MHMD Act”), and the Nevada Consumer Health Data Privacy Act, Nevada Senate Bill 370 (“NV SB 370”), and supplements the Oral Genome Privacy Policy (available at https://www.oralgenome.com/privacy-policy), to the extent applicable to Oral Genome Corp. (“Oral Genome,” “we,” “us,” or “our”).

“Consumer Health Data” means personal information that is linked or reasonably linkable to a consumer and that identifies the consumer’s past, present, or future physical or mental health status, as defined under the MHMD Act and, where applicable, NV SB 370. Consumer Health Data does not include information that is publicly available, de-identified, or aggregated. “Affiliates” and “Third Parties” have the meanings given to “affiliate” and “third party” under the MHMD Act and, where applicable, NV SB 370. This Policy describes the Consumer Health Data we collect, the purposes for which we collect and use it, the categories of Third Parties and Affiliates with whom we share it, and how you can exercise your rights.

To the extent that specific data constitutes protected health information (“PHI”) governed by the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”) or regulations thereunder, that data is excluded from the scope of this Policy on a data-specific basis, as permitted by the MHMD Act. The collection, use, and disclosure of PHI that Oral Genome processes on behalf of a dental or medical provider (“Provider”) is governed by that Provider’s HIPAA Notice of Privacy Practices. This exclusion applies to the specific data elements that constitute PHI, not to Oral Genome as an entity; Consumer Health Data that is not PHI, including information you provide when you buy a Kit from us (such as through our official Amazon account) or from our authorized resellers or distributors and use our App yourself, remains subject to this Policy.

The Consumer Health Data we collect may include:

• Saliva test results (“Results”), including biomarker and oral wellness indicators, risk assessments based on standardized health questionnaires, and trends in your Results.

• Photos of your saliva test card that you capture in our App or that your Provider uploads, which our image-analysis software analyzes to generate Results.

• Health-related information you provide directly to us, including responses to health screening questionnaires (such as medical conditions, symptoms, medications, weight, blood pressure, oral hygiene habits, tobacco use, and medical and dental history).

• Information that identifies a consumer seeking health-related products or services, such as your name, contact information, and demographic information, together with the fact that you purchased, registered, or used a Kit.

• Information about a child that a parent or legal guardian (or the child’s Provider) provides when registering a Kit on the child’s behalf.

• Information derived from non-health data that is used to associate or identify a consumer with health data, to the extent applicable.

We collect, use, disclose, or otherwise process your Consumer Health Data as reasonably necessary for the following purposes:

• To provide, administer, and support our products and Services, including analyzing test card images, generating and displaying Results, and managing your account, including where a parent or legal guardian has registered a Kit on behalf of a child.

• To share your Results with your Provider or others at your direction.

• To communicate with you regarding your use of our Services, including reminders to complete your test, notices that Results are ready, and support.

• To respond to your inquiries and requests.

• To improve, develop, and enhance our products and Services, including validating and improving the accuracy of our Kits and image-analysis algorithms.

• To comply with applicable legal obligations.

• To protect the health, safety, security, or property of Oral Genome, our users, or the public, including preventing and investigating fraud and security incidents.

We may collect Consumer Health Data from the following sources:

• Directly from you, including through our website, App, forms, health questionnaires, and communications.

• From our Kits and image-analysis software, when you or your Provider capture an image of your test card and we generate Results.

• From Providers who administer Kits, upload test card images, or enter information about you through our Provider Portal.

• From a parent or legal guardian who registers a Kit and submits information on your behalf.

• From our service providers who assist us in providing the Services.

We disclose your Consumer Health Data as reasonably necessary to the following categories of Third Parties and Affiliates:

• Providers. We may disclose your Consumer Health Data to your Provider, who can view your profile, Results, and risk assessments through our Provider Portal.

• Vendors. We may disclose your Consumer Health Data to service providers and processors, including cloud hosting providers, analytics providers, customer support providers, communication providers, and information technology service providers, solely to perform services on our behalf.

• Research and Analytics Partners. We may disclose your Consumer Health Data to research and analytics partners that help us and our Providers conduct studies and analyze practice outcomes, only with your consent (or the consent of your parent or legal guardian) or in de-identified form.

• Persons You Direct. We may disclose your Consumer Health Data to Providers, family members, or others with whom you choose to share your Results, and to the parent or legal guardian who registered a Kit on your behalf.

• Government Agencies. We may be required to disclose your Consumer Health Data to government or regulatory authorities to comply with applicable laws or legal process.

• Other Parties. We may disclose your Consumer Health Data to professional advisors, including legal counsel and auditors, as necessary, and to a successor in connection with a merger, acquisition, or other transaction, as permitted by applicable law.

We disclose your Consumer Health Data to other parties only with your consent or as necessary to provide a product or service you have requested.

We do not sell Consumer Health Data as defined under the MHMD Act or NV SB 370.

Access

You have the right to confirm whether we are collecting, sharing, or selling your Consumer Health Data. You also have the right to access your Consumer Health Data, including a list of all Third Parties and Affiliates with whom we have shared or sold your Consumer Health Data, and the categories of Consumer Health Data shared with each, and, where required by applicable law, an active email address or other online mechanism you may use to contact those Third Parties.

Deletion

You have the right to request that we delete your Consumer Health Data. Upon receipt of a Valid Request for deletion, we will delete your Consumer Health Data from our records, including from archived or backup systems within the time required by applicable law, and notify our Affiliates, processors, contractors, and Third Parties with whom we have shared your Consumer Health Data of your request, unless an exception under applicable law applies. Deleting your Consumer Health Data may mean we can no longer provide Results to you.

Withdraw Consent

Where we process your Consumer Health Data based on your consent, you have the right to withdraw that consent at any time. Withdrawal of consent does not affect the lawfulness of processing carried out before withdrawal.

To exercise any of the rights described in this Policy, you must send us a request that (1) provides sufficient information to allow us to verify that you are the person about whom we have collected the Consumer Health Data, and (2) describes your request in sufficient detail to allow us to understand, evaluate, and respond to it. Each request that meets both of these criteria will be considered a “Valid Request.” We may not respond to requests that do not meet these criteria. A parent or legal guardian may submit a Valid Request on behalf of their minor child. You may submit a Valid Request by contacting us at:

• Email: support@oralgenome.com

• Address: Oral Genome Corp., 3088 Corte Trabuco, Carlsbad, California 92009

We will respond to your Valid Request within forty-five (45) days of receipt. If we require additional time, we may extend the response period by an additional forty-five (45) days, and we will notify you of the extension and the reason for it within the initial response period. We will not charge you a fee for up to two Valid Requests in any 12-month period, except as permitted by applicable law for requests that are manifestly unfounded, excessive, or repetitive. We will not discriminate against you for exercising your rights under applicable law.

If we decline to take action on your request, you may appeal our decision within a reasonable period of time after receiving it by contacting us at support@oralgenome.com with the subject line “Consumer Health Data Appeal.” Within forty-five (45) days of receiving your appeal, or such other timeframe required by applicable law, we will inform you in writing of any action taken or not taken in response to the appeal, including a written explanation of the reasons for our decision. If you are not satisfied with our response to your appeal, you may file a complaint with:

• The Washington State Attorney General’s Office at https://www.atg.wa.gov/file-complaint.

• The Nevada Attorney General’s Office at https://ag.nv.gov/Complaints/File_Complaint/.

We do not engage in geofencing around health care facilities to either: (1) identify or track you when seeking health care services; (2) collect your Consumer Health Data; or (3) send notifications, messages, or advertisements to you related to your Consumer Health Data or health care services.

If you are a Nevada consumer, you have rights under NV SB 370 with respect to your Consumer Health Data, including the rights to confirm whether we are collecting, sharing, or selling your Consumer Health Data, to obtain a list of the Third Parties with whom we have shared or sold it, to request that we stop collecting, sharing, or selling it, and to request that we delete it, consistent with the rights described in this Policy. We do not sell Consumer Health Data.

We may update this Policy from time to time. We will notify you of any material changes by posting the updated Policy at this URL and updating the effective date, and, where appropriate, by email or through our Services. Where required by applicable law, we will obtain your consent before collecting, sharing, or using your Consumer Health Data for any purpose not disclosed in this Policy. We encourage you to review this Policy periodically.

If you have questions about this Policy or our Consumer Health Data practices, please contact us at:

• Email: support@oralgenome.com

• Address: Oral Genome Corp., 3088 Corte Trabuco, Carlsbad, California 92009

• Website: www.oralgenome.com