Notice of Privacy Practices

1. About This Notice

Houya, Co., operator of the Atlagene service ("Atlagene," "we," "us," or "our"), is required by the Health Insurance Portability and Accountability Act of 1996 (HIPAA) and the Health Information Technology for Economic and Clinical Health Act (HITECH Act) to maintain the privacy of your Protected Health Information (PHI) and to provide you with this Notice of Privacy Practices.

This Notice describes how we may use and disclose your PHI, your rights regarding your PHI, and our legal duties with respect to your PHI. This Notice applies to all PHI that Atlagene creates, receives, maintains, or transmits in connection with our genomic health analysis platform, including genetic analysis results, blood test data, physician review records, health risk assessments, supplement recommendations, and health-related communications (including Helix AI Assistant conversations).

We are required by law to abide by the terms of this Notice currently in effect. We reserve the right to change this Notice and to make the revised Notice effective for all PHI we already maintain, as well as any PHI we receive in the future.

2. How We May Use and Disclose Your PHI

The following describes the circumstances under which we may use or disclose your PHI without your written authorization:

2.1 For Treatment

We may use and disclose your PHI to provide, coordinate, and manage your care. This includes sharing your genetic analysis results with licensed physicians in our partner network when you choose to request an optional physician review. All results are shown to you immediately with disclaimers; physician review is optional. It also includes sharing relevant health information with healthcare providers you designate to receive your results.

2.2 For Payment

We may use and disclose limited information as necessary for billing and payment activities. Atlagene bills you directly through our payment processor; we do not submit claims to health insurance plans.

2.3 For Healthcare Operations

We may use and disclose your PHI for our healthcare operations, including quality assessment and improvement activities, reviewing the competence and qualifications of our physician partners, training of staff and students, compliance activities, auditing functions, business planning, and customer service.

2.4 Required by Law

We may use and disclose your PHI when required to do so by federal, state, or local law. The disclosure will be made in compliance with the law and limited to the requirements of the law.

2.5 Public Health Activities

We may disclose your PHI for public health activities, including: reporting to a public health authority authorized to collect or receive information for the purpose of preventing or controlling disease, injury, or disability; reporting to the FDA regarding the quality, safety, or effectiveness of FDA-regulated products or activities; and notifying a person who may have been exposed to a communicable disease or may otherwise be at risk.

2.6 Health Oversight Activities

We may disclose your PHI to a health oversight agency for activities authorized by law, including audits, civil or administrative investigations, inspections, licensure or disciplinary actions, and other activities necessary for oversight of the healthcare system, government benefit programs, and compliance with civil rights laws.

2.7 Judicial and Administrative Proceedings

We may disclose your PHI in the course of a judicial or administrative proceeding in response to a court order, subpoena, discovery request, or other lawful process. Where possible, we will notify you of such requests before disclosure and will make reasonable efforts to obtain a protective order or assurance that the receiving party will maintain the confidentiality of your PHI.

2.8 Research

We may use or disclose your PHI for research purposes only when: (a) the research has been approved by an Institutional Review Board (IRB) or privacy board that has reviewed the research and established protocols to ensure the privacy of your information; or (b) the information has been de-identified in accordance with HIPAA requirements (Safe Harbor method, removing all 18 categories of identifiers). We will never use identifiable genetic data for research without your separate, written authorization.

3. Uses Requiring Your Written Authorization

The following uses and disclosures of your PHI require your written authorization:

• Use of genetic data for research: If we wish to use your identifiable genetic data for research purposes, we will obtain your separate, written authorization that describes the research, the specific data to be used, and your right to revoke authorization at any time.
• Marketing: We will not use or disclose your PHI for marketing purposes without your written authorization. We do not engage in marketing using PHI.
• Sale of PHI: We will never sell your PHI. HIPAA prohibits the sale of PHI without authorization, and Atlagene has no intention of ever selling your health information or genetic data.
• Psychotherapy notes: Not applicable — Atlagene does not create or maintain psychotherapy notes.
• Any other use not described in this Notice: Any use or disclosure of your PHI not covered by this Notice or permitted by applicable law will be made only with your written authorization.

You may revoke any authorization you provide at any time by submitting a written revocation to hipaa@atlagene.com. Revocation will not affect any disclosures made in reliance on your authorization before the revocation was received.

4. Your Rights Regarding Your PHI

You have the following rights with respect to your Protected Health Information:

4.1 Right to Access

You have the right to inspect and obtain a copy of your PHI maintained by Atlagene. This includes your genetic analysis results, blood test data, physician review records, and other health information. To request access, submit a written request to hipaa@atlagene.com. We will respond within 30 days of receiving your request. If we need additional time, we will notify you in writing of the reason for the delay and the date by which we will respond (no more than an additional 30 days). We will provide the information in the electronic format you request, if readily producible, or in a mutually agreed-upon alternative format. We may charge a reasonable, cost-based fee for copies.

4.2 Right to Amend

You have the right to request that we amend your PHI if you believe it is incorrect or incomplete. Submit a written request to hipaa@atlagene.com, including the reason for the amendment. We will respond within 60 days. We may deny your request if the information was not created by us, is not part of the PHI maintained by us, is not available for inspection (e.g., de-identified data), or is accurate and complete. If denied, we will provide a written explanation, and you may submit a statement of disagreement.

4.3 Right to an Accounting of Disclosures

You have the right to request a list of certain disclosures of your PHI that we have made. This accounting does not include disclosures made for treatment, payment, healthcare operations, or disclosures you authorized in writing. It covers the six years prior to your request (or from the effective date of this Notice, whichever is shorter). Submit your request to hipaa@atlagene.com. We will respond within 60 days. The first accounting in any 12-month period is free; subsequent requests may be subject to a reasonable, cost-based fee.

4.4 Right to Request Restrictions

You have the right to request that we restrict certain uses and disclosures of your PHI for treatment, payment, or healthcare operations. You may also request restrictions on disclosures to individuals involved in your care. We are not required to agree to your request, except that we must agree to restrict disclosures to a health plan for payment or healthcare operations purposes if you have paid for the service in full out of pocket. Submit restriction requests to hipaa@atlagene.com.

4.5 Right to Confidential Communications

You have the right to request that we communicate with you about your PHI by alternative means or at alternative locations. For example, you may request that we contact you only at a specific email address or phone number. We will accommodate reasonable requests. Submit your request to hipaa@atlagene.com.

4.6 Right to a Paper Copy of This Notice

You have the right to obtain a paper copy of this Notice at any time, even if you have previously agreed to receive it electronically. To request a paper copy, email hipaa@atlagene.com or write to us at the address provided at the end of this Notice.

5. Our Duties

We are required by law to:

• Maintain the privacy and security of your PHI.
• Provide you with this Notice of our legal duties and privacy practices with respect to your PHI.
• Abide by the terms of this Notice currently in effect.
• Notify you following a breach of your unsecured PHI.
• Not use or disclose your genetic information for underwriting purposes (as required by GINA and HIPAA).

6. Minimum Necessary Standard

When using or disclosing your PHI, or when requesting PHI from another entity, we will make reasonable efforts to limit the information to the minimum amount necessary to accomplish the intended purpose. This standard applies to all uses and disclosures except: treatment purposes (where full information may be needed), disclosures to you about your own PHI, disclosures pursuant to your authorization, disclosures required by law, and disclosures to the Department of Health and Human Services for compliance purposes.

In the context of our physician review process, this means the reviewing physician receives only the specific genetic variants and analysis results requiring their review, not your complete genome data or full health profile.

7. Breach Notification

In the event of a breach of your unsecured PHI, we will notify you as required by HIPAA and the HITECH Act:

• Timeline: We will notify you without unreasonable delay and no later than 60 days after discovery of the breach.
• Content of Notice: The notification will include: a description of the breach and the types of information involved; the steps you should take to protect yourself; what we are doing to investigate, mitigate harm, and prevent future breaches; and contact information for you to ask questions or obtain additional information.
• Method of Notice: We will notify you by first-class mail to your last known address, or by email if you have agreed to electronic notifications. If we have insufficient or outdated contact information for 10 or more individuals, we will post a conspicuous notice on our website for at least 90 days.
• HHS Reporting: If the breach affects 500 or more individuals, we will notify the U.S. Department of Health and Human Services (HHS) contemporaneously with individual notice and, where required, notify prominent media outlets in the affected state or jurisdiction. If the breach affects fewer than 500 individuals, we will report it to HHS within 60 days of the end of the calendar year in which the breach was discovered.

8. Complaints

If you believe your privacy rights have been violated, you may file a complaint:

You will not be penalized or retaliated against for filing a complaint. All complaints will be investigated, and you will receive a written response.

9. Effective Date and Changes

This Notice is effective as of February 10, 2026. We reserve the right to change this Notice at any time and to make the revised Notice effective for all PHI we already maintain, as well as any PHI we receive in the future. If we make material changes, we will:

• Post the revised Notice on our website with a new effective date.
• Make the revised Notice available upon request.
• Notify you of the change by email or through a prominent notice on our platform.

You may obtain a copy of the current Notice at any time by visiting this page or contacting us at hipaa@atlagene.com.

Contact Information