Notice of Privacy Practices

THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.

MaxGen Labs ("we", "us") is a clinical laboratory. The Health Insurance Portability and Accountability Act (HIPAA) requires us to keep your health information private, to give you this notice of our legal duties and privacy practices, and to follow the notice that is currently in effect. "Health information" here means information that identifies you and relates to your health, the testing we performed, or payment for it, including your genetic test results.

How we may use and disclose your health information

For treatment. We disclose your results and reports to the healthcare practitioner or practice that ordered your test, and to other providers involved in your care at your or your practitioner's direction. For example, your practitioner opens your results in the portal to discuss them with you.

For payment. We may use and disclose information to bill and collect payment for the testing, for example to the practice that ordered it or to a health plan where one is involved.

For healthcare operations. We use information to run the laboratory and the portal: quality control, audit, security, training, support and compliance. For example, our audit trail records who viewed your results and when.

To you and the people you choose. We give you access to your own results through the portal. If you tell us to share your reports with a practice, we do so as you direct until you revoke it. If you are a parent or legal guardian of a minor, or the authorized representative of an adult, we may disclose to you what the law allows.

Business associates. We use service providers, such as our cloud hosting, sign-in and email providers, who may see health information to do their work for us. Each is bound by a written agreement to protect it.

As required or permitted by law. We may use or disclose health information without your authorization when the law requires or permits it: to public-health authorities; to health-oversight agencies for audits and inspections; in response to a court order, subpoena or other lawful process; to law enforcement in limited circumstances; to coroners, medical examiners and funeral directors; to avert a serious threat to health or safety; for certain research approved by a privacy board; for workers' compensation where the law provides; and to the Secretary of Health and Human Services to review our compliance.

Uses that need your written authorization. We will not use or disclose your health information for marketing, sell it, or use it for any purpose not described in this notice without your written authorization. Genetic information is never used for underwriting. If you give an authorization, you may revoke it in writing at any time; the revocation does not undo disclosures already made under it.

Your rights

To see and get a copy. You may see and obtain a copy of your laboratory results and the health information we hold about you, in the portal at any time, or by written request. We may charge a reasonable, cost-based fee for paper copies. In limited circumstances we may deny access, and you may ask for the denial to be reviewed.

To ask for a correction. If you believe information we hold is wrong or incomplete, you may ask us in writing to amend it. We may deny the request if the information was not created by us, is accurate and complete, or is not part of the records we keep; if we deny it, we will tell you why in writing and you may file a statement of disagreement.

To an accounting of disclosures. You may ask for a list of certain disclosures we made of your health information in the six years before your request, other than for treatment, payment, healthcare operations, to you, or under your authorization. The first list in any twelve months is free.

To request restrictions. You may ask us to limit how we use or disclose your information for treatment, payment or operations. We are not required to agree, except that we must agree not to disclose to a health plan information about a service you paid for in full out of pocket, where the law provides.

To confidential communications. You may ask us to contact you in a particular way or at a particular place, for example only by email to a particular address. We will accommodate reasonable requests.

To a paper copy of this notice. You may ask for a paper copy at any time, even if you agreed to receive it electronically.

To be notified of a breach. We will notify you if a breach of your unsecured health information occurs, as the law requires.

Our duties

We are required by law to keep your health information private, to give you this notice, to follow it while it is in effect, and to tell you if a breach affects your information. We reserve the right to change this notice and to make the new notice apply to all health information we hold; when we do, we will post the new version in the portal with a new date at the top.

Complaints

If you believe your privacy rights have been violated, you may complain to us by writing to the Privacy Officer at help@maxgenlabs.com. You may also complain to the Secretary of the U.S. Department of Health and Human Services, Office for Civil Rights, at www.hhs.gov/ocr or by calling 1-800-368-1019. We will not retaliate against you for filing a complaint.

Contact

Questions about this notice: the Privacy Officer, MaxGen Labs, help@maxgenlabs.com. This notice is effective as of 2026-09-06.