Privacy Policy

Effective Date: November 1st 2025

For purposes of this Privacy Policy, “Ani.ai” refers to the digital platform and related services operated by ANI BIOME PBC. This Privacy Policy applies to the Services provided by ANI BIOME PBC, its subsidiary Cidrani d.o.o., and any other affiliates, subsidiaries, or related entities (collectively, “Ani”). The terms “Ani.ai” and “Ani” may be used interchangeably throughout this Policy.

Relationship Between Informed Consent and This Privacy Policy

Ani conducts multiple scientific and clinical research studies, each of which may collect different combinations of biological, digital, and behavioral data.

Each study you participate in is governed by a study-specific Informed Consent Form (ICF) that describes the purpose of the research, the data collected, and any specific data sharing or retention conditions.

This Research Data Privacy Policy applies across all Ani studies, Ani digital tools, and Ani partner-led research studies. It explains how Ani handles and protects personal data, regardless of which study you join. In the event of a conflict between this Policy and a study’s ICF, the ICF will govern that study’s specific data use.

Relationship Between Ani Terms of Service and This Privacy Policy

This Privacy Policy is incorporated by reference into the Ani terms of service (“Terms” or “Terms of Service”), which can be found on our websites located at www.ani.ai, www.anibiome.ai, and mobile software applications. Please carefully review this Privacy Policy and Terms of Service.

“Services” means the research, data processing, analysis, digital platform access, and related activities provided by Ani.ai, including but not limited to (i) collection, handling, testing, and analysis of biological samples (such as stool, blood, saliva, tongue, cheek, or skin swabs) and related data; (ii) collection and analysis of digital and behavioral information (including questionnaires, sensor data, and self-reported information); (iii) generation of analytical outputs, test data, and results derived from Ani.ai’s proprietary algorithms, artificial intelligence systems, or statistical models; (iv) delivery of informational reports, insights, or recommendations through Ani.ai’s website, mobile application, or partner platforms; and (v) optional participation in Ani.ai’s research programs, product development initiatives, or wellness programs (such as the AgeBiotics Service as defined herein).

These Services are provided for research, informational, and educational purposes only and do not constitute medical advice, diagnosis, or treatment.

By using our Services, you agree, accept, and consent to all of the policies and procedures described in these documents. If you do not agree with or are not comfortable with any aspect of this Privacy Policy or the Terms of Service, you should immediately discontinue use of our Services.

Scope and ParticipantsAni.ai provides its applications and related research services for scientific and clinical research purposes. Individuals who use the Ani app or dashboard, provide biological samples, or otherwise participate in Ani-led or partner-led studies are referred to in this Privacy Policy as “Participants.”

Participation is voluntary and may involve submission of health, biological, and questionnaire data under informed consent. Ani processes such information in accordance with this Privacy Policy, applicable data protection laws, and ethical research standards. References in this Policy to “you” or “your” refer to these Participants.

Where Ani provides non-research features (for example, subscription content or general wellness information), the same privacy protections apply.

Introduction

Ani.ai is a next-generation AI platform creating dynamic, evolving digital twins of human biology to advance the science of longevity and precision interventions. We integrate deep multi-omics analysis - including but not limited to genomics, epigenomics, transcriptomics, microbiomics, mitochondrial health, and microRNA expression - to decode the complexity of aging biology.

Founded in the emerging field of Affectoneuroimmunology, Ani.ai bridges the biological and emotional layers of health. By capturing how multi-omics data, digital biomarkers, emotions, cognition, immunity, and microbial ecosystems interact, we generate personalized models that go beyond diagnostics - with the focus on predictive, preventative, and adaptive health intelligence.

Our Services include access to the Ani public websites, Ani.ai and AniMedical.ai mobile application and dashboard (“Ani Digital Platform”), Ani supplements (“AgeBiotics”), Ani families of subscription services (“Subscription Service”), and “omics” testing services (e.g., microbiome, genetic, epigenetic, etc.) that include Ani Labs Tests (“Ani Labs Tests”). In the course of these Services, we may collect and analyze (i) your biological samples (such as tongue tissue, stool, blood, saliva, or other biological materials) and (ii) relevant digital data you provide through our mobile application (including but not limited to questionnaires, sensor data, and other user inputs).

The biological samples we collect include stool, blood, saliva, tongue swab, cheek swab, skin swab, and other (“Samples”), using sample collection kits (“Kits”) provided by Ani.ai. Participants will collect the Samples using the Kits and ship them to Ani.ai for testing and analysis. Data obtained from testing the Samples are subjected to a process of scientific testing to produce sample data (“Sample Data”) used for producing test data (“Test Data”) that will be stored and used with Participant-provided information (in response to our questionnaires and other self-reported information) and Ani.ai proprietary technology that use analytics and Artificial Intelligence to generate test results (“Test Results”). Based on our analysis of Test Results of Ani VQ Score line of products including Ani’s proprietary digital aging clocks (“Vitalligence Scores”) and Participant-provided data, using Ani technology, Ani makes supplement and lifestyle recommendations and offer AgeBiotics supplements (“AgeBiotics Service”) to individuals via Ani website located at www.ani.ai and Ani mobile applications. Based on our analysis of Samples associated with Ani Labs Tests line of Services and Participant-provided data, using Ani.ai technology, Ani.ai detects molecular features and deliver associated Test Results and recommendations using its Ani digital platform via web platforms, mobile platforms or its partner web or mobile platforms.

Disclaimer: Not Medical AdviceThe Services, including all Test Data, Test Results, recommendations, and related reports, are intended for research, informational, and educational purposes only and are not a substitute for professional medical advice, diagnosis, or treatment.

Ani.ai is not a healthcare provider and does not engage in the practice of medicine. The Services have not been evaluated or approved by the U.S. Food and Drug Administration (FDA) or any other regulatory authority as medical devices or diagnostic tests.

Participants should not interpret or rely on any information provided by Ani.ai as medical advice, and should always seek the guidance of qualified healthcare professionals regarding any medical conditions or health-related decisions.

Based on our analyses of your Samples, Test Data, and any other Participant-provided data, Ani.ai uses advanced analytics and Artificial Intelligence to generate Test Results, personalized recommendations, Vitalligence Scores and other predictive insights. We may also use these data to create “synthetic” datasets, which are artificially generated data records that do not identify you as an individual. We use these predictive insights and synthetic data to improve and develop our products and services, conduct research, refine our AI models, create research or analytic reports, and for other lawful business purposes.

Ani takes privacy very seriously. We are committed to protecting the privacy and security of “Personal Information” which could be used to identify Participants, either alone or in combination with other information. By accessing or using the Service (as defined above), Participants allow us to collect, store, and use their Personal Information that enables us to provide services associated with Ani Services (as defined above). Ani recognizes and understands the importance of privacy and respects our Participants’ desire to store and access Personal Information in a private and secure manner.

“Participants” or “Users” of Ani’s Services may also include individuals who enroll in our partners’ research programs (hereinafter, “Partner Research Participants”). Such research programs may be administered directly by Ani.ai or through our partners’s network, and may be conducted on our website, mobile application, or by other means. By enrolling in Ani partner research programs, you acknowledge that your Personal Information is subject to this Privacy Policy, as well as additional terms found in any separate study participation agreement you sign.

THIS PRIVACY POLICY DESCRIBES HOW INFORMATION ABOUT YOU MAY BE COLLECTED, USED, STORED, MAINTAINED, SHARED, DISCLOSED, PROTECTED, AND ABLE TO ACCESS THIS INFORMATION. THIS PRIVACY POLICY FURTHER DESCRIBES OUR POLICIES ON OUR PARTICIPANT’S PERSONAL INFORMATION, PERSONAL DATA, PERSONALLY IDENTIFIABLE INFORMATION, SELF-REPORTED INFORMATION, PROTECTED HEALTH INFORMATION, AND SENSITIVE INFORMATION. PLEASE REVIEW IT CAREFULLY.

Acceptance of Privacy Policy

By enrolling in a study conducted by Ani or any of its partners, subscribing to, becoming a Participant or otherwise using our Services (including our Subscription Service), or accessing any content or materials made available through the Service, you agree to be bound by our Terms of Service, that includes this Privacy Policy. Ani reserves the right to change or modify this Privacy Policy at any time and in its sole discretion. Any changes or modifications will be effective immediately upon posting of the revised Privacy Policy (with the revision effective date posted on the top left side) on our Service. Your continued use of the Service following the posting of revised Privacy Policy will constitute your acceptance of those.

What Information We Collect

When you subscribe to or use our Services, Ani collects and uses several types of information as identified below. These include information you provide directly to us, your clinical and test data, medical information and history, information you provide in response to Ani questionnaires, self-reported information, information we receive from our Partner Services, data we retain in order to improve our data analytics methods and artificial intelligence engine and our Service, data you provide us for the purpose of providing Participant services, data we retain for provisioning our Service and securing payments for same, information we collected through tracking technology, chatbot, web analytics, and other types of information we receive about you from third party sources.

We may collect “Personal Information” about you that amounts to any factual or subjective information whether recorded or not about an identifiable individual.

“Personally, Identifiable Information” or “PII” is information about an individual when used alone or with other relevant data that can identify an individual (e.g., first and last name, birthdate, home address, social security number, bank account number, credit card number, passport number, Health insurance ID number, etc.).

“Personal Data” is any information relating to a natural person, when that person can be identified, directly or indirectly, in particular by reference to an identification number (e.g., social security number or credit card number) or one or more factors specific to his physical, physiological, mental, economic, cultural or social identity (e.g., last name and first name, date of birth, biometrics data, fingerprints, or DNA).

“Sensitive Information” or “Sensitive Data” is a category of Personal Information or Personal Data of an individual relating to confidential medical facts, medical history, records, racial or ethnic origins, political or religious beliefs, or sexuality.

“Self-Reported Information” is all information you provide us about yourself, including input and answers to surveys, forms, questionnaires, email, features on our website and software applications, while participating in any of Ani or Ani’s partners’ research activities, engaging with our Participant service (“Participant Service”) or while using the Service (e.g., information about your personal traits (e.g., eye color, height), ethnicity, disease conditions (e.g., Type 2 Diabetes), physical health-related information (e.g., pulse rate, cholesterol levels, visual acuity, medicine you currently take, habits such as smoking), diet related information (e.g., vegetarian, vegan, allergies, etc.), mental health related information (e.g. emotional conditions such as fear or anxiety), your disease conditions, medical history, and family history (e.g., information similar to the foregoing about your family members).

“Protected Health Information” or “PHI” is any information about health status, provision of health care, or payment for health care that can be linked to a specific individual that also includes such information as any part of a medical record or payment history.

“Registration Information” is collected when you subscribe to or register for our Services, or when your participation is facilitated through a partner research institution or clinical site.

For individuals who register directly with Ani.ai, this information may include, but is not limited to, Personal Information such as your name, date of birth, password, payment information (of which Ani stores only the last four digits and expiration date unless your Services include a recurring Subscription Service), billing and shipping addresses, and contact details such as email address and telephone number used to create your Ani Account (“Account”).

For participants enrolled in Ani.ai’s partner-led or institutional research studies, Ani.ai may not receive direct identifiers such as names or contact details. Instead, such participants are represented in Ani.ai’s systems by coded identifiers or pseudonyms generated by the research site. Only the authorized administrator of that research center retains the key linking such codes to individual identities. Ani.ai processes such coded data solely for research and analytical purposes. In such cases, Ani.ai functions as a data processor or joint controller in collaboration with the research institution, depending on the study’s data governance structure.

Ani uses Registration Information to authenticate your access to Ani Account, websites and mobile applications for purposes that include but not limited to the following: use the Service, complete your orders, or access add-ons and new features related to the Service, charge recurring fees for Subscription Services, deliver personalized reports, send consent forms and questionnaires, marketing and communications, and certain other purposes.

“Biological Samples” are the self-collected stool, blood, and other fluid samples such as saliva, tongue swab, cheek swab, skin swab, or urine, that you collect using Sample collection kits (“Kits”) and used for epigenome, microbiome, genome, and other testing and analysis performed by Ani.

“Sample Data” is molecular data created from the Samples you provide to Ani for testing and analysis. Sample Data analysis includes, but is not limited to, primary sequencing and other types of analysis including but not limited to RNA and DNA, microbiome analysis, microbial gene expression analysis, human gene expression, and personal genotype.

“Medical Information” refers to information contained in your medical records or held by your healthcare provider that you expressly authorize Ani.ai to access.

Ani.ai will access such Medical Information only with your explicit written consent, obtained either directly from you (for example, through a signed consent form or verified digital authorization) or indirectly through your treating physician or research site where the consent process forms part of an approved research study.

Access to Medical Information is limited to the data necessary for the performance of the relevant research or Service and will be carried out in accordance with applicable data-protection and medical-privacy laws, including HIPAA, GDPR, and related national regulations. Where applicable, you may also choose to connect Ani.ai to third-party digital health platforms or electronic medical record systems to import Medical Information. Ani.ai will access such data only after you authorize the connection and may revoke it at any time.

“User Content” is information that you create or content that you post or upload on our website, social media, or public forums that relate to us, such as blogs, data, text, software, documents, audio, photographs, graphics, video, messages, discussions, emails, or other materials that you create or provide to us through public or private transmissions.

“Test Data” is information we extract from Sample Data for use in our testing services that produce data and test results that help us provide you with accurate and personalized recommendations and Services.

“Pseudonymized and De-identified Information” or “De-identified Data” refers to Samples and other forms of data from which direct personal identifiers are removed immediately upon receipt and replaced with a unique alphanumeric code. All downstream testing, research, and data analyses are conducted using this code rather than direct identifiers.

Where the data are processed in a manner that still allows a coded link to be maintained by Ani or its authorized partners (for example, to allow follow-up or quality-control procedures), the data are considered pseudonymized. Where identifiers have been irreversibly removed and no code or key exists that could reasonably re-identify a Participant, the data are considered fully de-identified or anonymized.

Ani follows established industry practices for data minimization and pseudonymization, ensuring that information likely to identify you is removed or separated from Sample Data, Test Data, internal records, or other digital inputs (including images or sensor data such as tongue or facial features).

Ani does not store your direct identifiers together with your Samples, Test Data, or other digital data in any database and does not release identifiable information externally. Your identifiable Personal Information is used only to the extent necessary to deliver the Service to you and to communicate directly with you when required. For all other purposes, including research, algorithmic analysis, or improvement of our Artificial Intelligence systems, Ani uses pseudonymized or de-identified data only, unless you have specifically consented to additional use.

Pseudonymized Information or Pseudonymized Data refers to Samples and other forms of data from which direct personal identifiers have been removed and replaced with artificial identifiers or pseudonyms. These identifiers are held separately and protected by strong technical and organizational safeguards to prevent re-identification of the data with any natural person.

For the purposes of this Privacy Policy, de-identified or pseudonymized data means information that cannot be attributed to you or to any specific individual without the use of additional information, and such additional information is accessible only to authorized administrators and not to other users of the data.

Ani takes all reasonable precautions, including encryption, access controls, and compartmentalized data storage, to avoid inadvertent re-identification of Samples, Test Data, and other sensitive information.

“Aggregate Information” or “Aggregate Data” means high-level information or data collected from a group of individual Samples or other data combined with similar data of the others and compiled into data collections or summaries such that when evaluated as a whole, that no specific individual may be reasonably identified. Aggregate Data is often used for data analysis and sometimes for Research.

“Individual-level Data” means information or data about a single individual's Sample or other types of data provided by the individuals themselves or collected from other sources.

“Web Information” is information on how you use Ani website (e.g., browser type, domains, page views, etc.) or other online media owned by Ani, and are collected through log files, cookies, pixels, and web beacon technologies.

Use of Cookies

Ani and its third-party service providers from whom it receives your information may use “cookies” and similar tracking technologies (such as web beacons, pixel tags, scripts, and device identifiers used for automatic collection of information), for a variety of purposes. Cookies are small data files that are stored on a user’s hard drive at the request of a website to enable the website to recognize and retain certain user information.

Cookies help us recognize when and how you use our Services, customize, and improve your experience, provide security, analyze your interactions with our Services and their features, gather demographic information about our user base, make special offers of our Service, retarget marketing content, monitor the success of marketing programs, and for targeted advertising on our website and on other websites on the Internet. To learn more on cookies and tracking technologies, please read our Cookie Policy at https://www.ani.ai/cookie-policy

Third Party Cookies and Pixels

When Ani engages third party cookie service providers for targeted advertising and obtaining reports on how certain functionalities of our website work and obtaining usage and statistical information such as the user’s browser type, operating system, device IDs, etc., these third-party providers may collect personal and non-personal information from you including your IP address, email address, and demographic information, in connection with the services they provide. They may place cookies, Pixel tags, or web beacons on your device to collect personal and non-personal information.

When you visit our website, log in, register, or open an email, cookies, pixels, ad beacons, and similar tracking technologies may be used by our online data partners or service providers to associate your activities with information they or others have about you, including your email address. We (or service providers on our behalf) may then send communications and marketing or advertising messages about our Services to these email addresses. You can read our Cookie Policy to learn more about cookies, analytics, and advertising partners we use on our Services.

You may choose to opt-in or optout of the collection or sale of your personal information in compliance with the privacy laws applicable to you (such as GDPR, CCPA, etc.). If you are a resident of certain U.S. States that provide you with a legal right to opt out of such cookies, you can choose to opt out of non-essential cookies as stated in our Cookie Policy, or you may opt-out of collection, sale, or sharing of your personal information by our third party cookie service providers by visiting their websites.

Your information may be used, among other things to deliver advertising targeted to your interests, cross-referencing information, better understand the usage of the Service, and for other services tracked by these third parties. In addition, certain third-party cookie service providers may use your information for purposes other than providing their services to us, such as licensing and sharing your information with their Participants. Except as expressly stated in a legally binding agreement executed between Ani and these third parties with terms that contractually restrict access or processing personal information, Ani is not responsible for, and does not control, any actions or policies of any third-party service providers.

For additional details, including the types of cookies and your privacy choices, please see our Cookie Policy (that is incorporated herein by reference and that supplements this Privacy Policy), located at https://www.ani.ai/cookie-policy.

The information reports we receive from third party service providers can be in de-identified, individual-level, or at aggregate-level, and we may also use these reports to initiate communications with you, make Service offerings, and improve our data analytics methods. If we combine cookies with, or link them to, any of the Personal Information, Ani will treat this information as Personal Information.

If you wish to block, erase, or be warned of cookies, please refer to your browser instructions or help screen to learn about these functions. However, if you reject certain cookies or your browser or device settings do not accept cookies, you may not be able to use certain parts of our website or sign in to your Ani Account and may not be able to access certain Service features. For more information, including the types of cookies found on our Service and how to control cookies, please read our Cookie Policy.

Google Analytics

Like many websites, we use Google Analytics for web behavior monitoring, a service that provides information about how many users visit our website and online resources, when they visit, and how they navigate our website. We also may use other Google Analytics tools, such as Demographics and Interest Reporting, which enable us to learn more about the characteristics and interests of the users who visit our website, and Remarketing with Google Analytics, which enables us to provide relevant advertising on different websites and online services.

To learn more about Google’s privacy practices, please go to Google Privacy Policy at: https://www.google.com/policies/privacy/. You can also download the Google Analytics Opt-out Browser Add-on to prevent your data from being used by Google Analytics at: https://tools.google.com/dlpage/gaoptout.

User Content

Some features of our Service may include functionality enabling you to post user content, whether publicly posted or privately transmitted, such as profiles, posts, emails, feedback, experiences, suggestions, notes, messages, photos, and videos (“User Content”) that may be made available to Ani and other users of the Service.

You should be aware that any User Content you provide or post in public media may be read, collected, and used by others who access them, and we have no control over these media. Please exercise caution before and when you choose to share personal information on our blogs, forums or in any other public media.

Ani at its sole discretion, has the right (but not the obligation) to screen, reject, retain, or remove any User Content on our Service that infringes Ani’s or any third party’s intellectual property or other rights, violates our Terms and this Privacy Policy or our other policies, or is otherwise objectionable.

By sending User Content, you grant Ani a perpetual, irrevocable, worldwide, royalty-free, freely transferable and sub-licensable, non-exclusive right to use, reproduce, modify, transmit, translate, publish, publicly perform, display, distribute, commercialize, share with third parties, transmit or distribute over public network and media, and create derivative works of such User Content for purposes specified in Ani Terms of Service and for delivering the Service to you and other users of the Service.

Services Processors

Where applicable, Ani may engage accredited laboratories, sequencing facilities, data-hosting providers, or logistics partners (collectively, “Service providers” or “Processors”) to assist with the collection, storage, processing, or analysis of biological or digital data.

These providers may include, for example, laboratories performing sample sequencing, biobanks storing biological materials, cloud service providers hosting digital datasets, or authorized logistics companies managing sample collection and transportation.

All service providers handling identifiable or pseudonymized data operate under written agreements or standardized contractual terms, such as industry-standard Data Processing Addenda (DPAs) provided by certified cloud providers, that ensure confidentiality, data security, and compliance with applicable data-protection laws.

In cases where samples or datasets are fully de-identified or anonymized such that no individual can reasonably be identified, Ani may share or process them without such agreements, consistent with applicable data-protection laws and ethical research standards.

Medical History

During participation in research studies or when using Ani Services, we may collect information related to your medical history, health status, lifestyle, or symptoms. Such information may be collected directly from you (for example, through questionnaires or digital forms within the Ani platform) or indirectly through Ani’s network of partners, including healthcare providers, research institutions, and associated physician or laboratory networks.

This information is used for the provision of Ani Services, which may include research, analysis, generation of Test Data or Test Results, and communication of related insights to you or your authorized research site.

In addition, pseudonymized or de-identified medical data may be used by Ani for scientific research and the development of commercial products, such as diagnostic tools, digital algorithms, nutritional formulations, or wellness programs. Such use occurs in compliance with applicable data-protection laws and ethical research standards, without identifying any individual participant.

For research studies conducted jointly with or on behalf of Ani’s partners, including healthcare providers, research institutions, or laboratory networks, specific contractual agreements are in place to govern data sharing, data protection, and ownership of results. These agreements ensure that all parties handle data in accordance with applicable privacy laws and ethical research standards.

All medical history information is processed for research, analytical, and informational purposes only and is not used for medical diagnosis or treatment.

Ani retains ownership of any aggregated, pseudonymized, or de-identified datasets and derivative insights generated through its research and product development activities.

Order Data and Test Results

In the course of providing Ani Services, including both research activities and test-based offerings, Ani may process information related to orders placed on your behalf by an authorized healthcare provider, researcher, or partner institution (“Authorized Partner”). Such orders may involve the shipment of sample-collection kits, supplements, or related materials, as well as the delivery of Test Results and analytical outputs generated by Ani.

Ani collects and processes order-related information, which may include your coded identifier, contact information (where applicable), the type of test or kit ordered, and logistical details necessary to complete the order. Where required for fulfillment, Ani may share limited information with logistics or distribution partners to arrange shipment and delivery of kits, biological-sample containers, or supplements. These partners process data only as necessary to perform their delivery functions under strict confidentiality and data-protection obligations.

For research studies and clinical collaborations conducted through Ani’s Ani Medical Product Suite as part of Ani Digital Platform, study activities may be coordinated using Ani’s secure digital dashboard. Within this environment, authorized research or clinical partners may access pseudonymized operational data, such as sampling timelines, receipt confirmations, and alerts or notifications related to potential adverse events, to ensure study oversight and participant safety.

When studies are conducted by Ani’s external research partners, Ani may not have access to direct participant identifiers. In such cases, Ani processes only coded or pseudonymized data, and any link between the code and a participant’s identity is held exclusively by the partner research site or clinical administrator.

Test Results and related outputs are stored and transmitted through secure systems and made available only to you, your Authorized Partner, or other parties you have explicitly authorized. Ani does not release personally identifiable Test Results to any third party without your consent or a lawful requirement to do so.

Ani may use trusted service providers and subprocessors (such as accredited laboratories, cloud-hosting providers, or logistics partners) to support the secure storage, processing, or delivery of Test Results and related Services. These entities act solely on Ani’s behalf and under written Data Processing Agreements (DPAs) where applicable, or equivalent contracts that ensure compliance with applicable privacy laws. No additional consent is required for such processing, as it forms part of the Ani Services described in this Privacy Policy.

Other Types of Information

From time to time, we may collect other types of information automatically about your use of our Service through the log files. Such information may include your device’s Internet Protocol (IP) address, operating system, browser type, and your device ID. Ani uses this information for purposes such as analyzing trends, administering the Service, providing, and improving Participant service, diagnosing problems with our servers, monitoring the security of our website and systems, tracking user movement, and gathering broad demographic information for aggregate use.

We may collect information about you or your interactions with our website, directly or indirectly through our authorized third party chatbot service provider, for the purpose of providing you with guidance on use of our website or better Participant service. The terms governing use of your personal information by such chatbot service are subject to the terms of the legally binding contractual agreements with Ani. Use of your personal information, interaction with our website, and conversation record or content by such chatbot services are generally limited for the purpose of providing their service to us and for fulfilling their contractual obligations. They may however use de-identified information about you for improving their chatbot and for other services as specified in their contractual agreements with us.

By using our websites and our Services, you agree to this Privacy Policy and provide express consent for our chatbot service, on our behalf, to retain a record or transcription of your interaction with our website or chatbot service. Any information collected by our chatbot service will be used by us in manners consistent with this Privacy Policy. All other information we receive directly or indirectly through the above methods, from you, our website, social media, referral, or a third party associated with you will be used in manners consistent with this Privacy Policy.

Information on our Services

To participate in Ani Services, you may be enrolled in a research study, request access to a specific test or program (“Test Request”), receive a kit or subscription as part of a study or partner collaboration, or obtain a kit or subscription directly from Ani or through one of Ani’s authorized partners.

Upon enrollment or order confirmation, you may be required to create an Ani Account, register your Kit or Subscription Service, and, where applicable, collect and submit your biological Sample according to the instructions provided in the Kit and within the timeframe specified in your study or Service materials.

Ani may also receive orders or authorizations for participation from your healthcare provider, research site, or authorized partner acting on your behalf. In all cases, the collection, shipment, and processing of Samples are conducted in accordance with Ani’s quality and privacy standards, and Samples are pseudonymized immediately upon receipt for testing and analysis.

Depending on our needs we may use certified and licensed third-party service facilities in the for testing and Sample collection services. Our partner laboratories will use your Samples associated with our Services for testing, analysis and generation of Sample Data that will be used to generate Test Data. Test Data is used with Self-Reported Data in conjunction with our data analysis methods and artificial intelligence engine that we use for generating the Test Results that we use in order to provide personalized diet, lifestyle, supplements, and other intervention recommendations, and providing you with Ani Supplements and Subscription Services.

During the Kit Registration, Test Requests, and at various stages of using our Services, you will be requested to review this Privacy Policy, Terms of Service, and other relevant documents (such as study specific Consent Forms and questionnaires) and accept them. By accepting these documents, you consent to use of your information according to the terms specified in these documents, that include informed consent for use of your Samples, Sample Data, Test Data, Medical History, Test Requests, and other types of information for purposes specified herein and in our Terms in accordance with this Privacy Policy.

How We Use your Information

Ani will use and share your information (including Personal Information) in the ways that are described below and elsewhere in the Privacy Policy.

a) Provide you with the Services

We use your information to perform activities necessary for the provision, improvement, and safe operation of Ani Services. These activities include testing and analysis of biological and digital data, coordination of research studies, management of partner collaborations, delivery of Test Results, generation of insights and recommendations, production and customization of nutritional formulations such as Supplements and probiotics + prebiotics, and continuous improvement of Ani’s digital, scientific, and analytical capabilities.

Specifically, Ani may use your information to:

i) Establish and manage your Ani Account and maintain secure access to Ani’s digital platforms;ii) Coordinate research and operational logistics, including shipment of sample-collection kits or supplements through Ani or its logistics partners;iii) Process and analyze biological Samples and digital data for research, analytics, and generation of Test Results;iv) Communicate with you, your authorized research site, or partner institution about your participation, including updates, notifications, delivery confirmations, or relevant study communications;v) Provide and improve Ani Services, including development of personalized insights, recommendations, and formulations based on aggregated and pseudonymized data;vi) Support and monitor research and clinical collaborations conducted through Ani’s authorized partners or the AniMedical Product Suite, including management of sampling timelines, data dashboards, and alerts related to study safety or adverse events;vii) Conduct scientific research and development, including projects performed by Ani or in collaboration with Ani Research Institute or partner organizations;viii) Perform analytics and algorithmic modeling to enhance Ani’s artificial intelligence systems and improve the precision of data interpretation and personalization;ix) Ensure compliance, security, and integrity of Ani’s systems by detecting, investigating, and preventing fraud, misuse, or prohibited activities; andx) Develop new products and Services, including commercial offerings derived from aggregated, pseudonymized or de-identified data, such as analytical tools, digital biomarkers, or nutritional interventions.

All processing of identifiable or pseudonymized data is performed in accordance with applicable data-protection laws, and de-identified or aggregated data may be used for research and product development purposes consistent with Ani’s mission to advance scientific understanding of health and longevity.

We may also use your information to fix bugs or issues, analyze the use of our website, charge recurring Subscription Fees, to improve or optimize the Participant experience and Participant Service, or assess the efficacy of our marketing campaigns.

For individuals located in Europe and in certain Designated Countries, we process your Personal Data in compliance with the applicable law, in the same way in accordance with this Privacy Policy and our Terms of Service.

Ani may deliver certain Services and research activities through its affiliated entities and subsidiaries, including those located outside your country of residence (for example, Ani’s subsidiary in Croatia). All such entities operate under Ani’s unified data-protection policies and contractual safeguards to ensure compliance with applicable privacy laws and ethical research standards.

Ani processes personal data only where permitted by applicable law.

For Participants located in the European Union, the United Kingdom, or other jurisdictions applying similar data-protection laws, Ani relies on the following legal bases: (i) Explicit consent (Articles 6(1)(a) and 9(2)(a) GDPR) — when Participants voluntarily provide biological or digital data for analysis, testing, or research; (ii) Scientific research purposes (Articles 9(2)(j) and 89 GDPR) — when Ani or its partners use pseudonymized or de-identified data for research, algorithmic development, or product improvement; (iii) Performance of a contract (Article 6(1)(b) GDPR) — when processing is necessary to provide requested Services, such as shipping kits or delivering Test Results; (iv) Legal obligations (Article 6(1)(c) GDPR) — to comply with recordkeeping, accounting, or reporting requirements; and (v) Legitimate interests (Article 6(1)(f) GDPR) — to maintain platform security, improve user experience, and support business operations, provided such interests are not overridden by Participant rights.

For Participants located in the United States or other jurisdictions outside the EU, Ani processes information with the Participant’s consent and in accordance with applicable privacy and consumer-protection laws (including the California Consumer Privacy Act and Federal Trade Commission standards).

All processing of identifiable or pseudonymized data is conducted under appropriate contractual, organizational, and technical safeguards, and de-identified or aggregated data may be used for research, product development, and analytical purposes consistent with Ani’s mission to advance scientific understanding of health and longevity.

b) Provide Research and Partner ServicesAni collaborates with research institutions, clinics, and healthcare partners (“Research Partners”) who may enroll participants, collect biological samples, or manage aspects of data collection using Ani’s systems and infrastructure (for example, the AniMedical Product Suite).

In these cases, Ani may receive order-related or coded participant information (such as sample IDs, kit registration data, or test identifiers) from the Research Partner in order to process samples, generate analytical results, and provide data back to the Research Partner through secure digital environments (“Partner Services”).

Ani and its Research Partners operate under written agreements that define their respective responsibilities, data access rights, and ownership of results. When data are processed within such collaborations, Ani uses pseudonymized or coded data and does not have access to direct participant identifiers unless explicitly authorized by the Research Partner or the participant.

Ani may share limited information with logistics or data-processing providers (for example, laboratories, sequencing facilities, or shipping partners) when required to fulfill study or service operations. All such entities operate under confidentiality and data-protection agreements and may not use the data for any other purpose.

c) For Research and Research Studies

When you use our Services, Ani may use your Personal Information, and other data at individual-level or otherwise (in de-identified, pseudonymized, or aggregate forms) for providing an improved Service and ongoing research conducted by Ani that help us better understand health and longevity at individual as well as at population scale (“Population Research”). The information we use in Population Research is often summarized, aggregated, or combined across a group of subjects to minimize the chance of identification.

With your consent as expressed by acceptance of this Privacy Policy presented to you at Registration, Test Request, or while using the Service, Ani may use your information in Ani lead clinical studies and scientific research activities identified by Ani study protocols that support a specific diagnosis of a disease, to improve our Service, development of a treatment, or predict certain health conditions.

Such research cases are important aspects of our Service. The primary aim of research is to improve our Service using the data we gather from such activities. Ani conducts and supports ongoing research aimed at advancing scientific understanding of biological, cognitive, and environmental factors that influence human health, longevity, and well-being.

By choosing to participate in these studies, you contribute to research that may help improve Ani’s Services and lead to new scientific discoveries in areas such as microbiota, gene expression, and affectoneuroimmunology.

The insights gained from these studies are intended to benefit the broader scientific and medical community and may, over time, contribute to better prevention, wellness, and longevity solutions for society as a whole. While your individual participation does not guarantee a direct personal benefit, your contribution helps expand the collective knowledge that supports innovation in human health.

The research activities may include but not limited to conducting data analysis to develop new or improve existing Services, perform quality control, and identifying potential areas or targets for specific diet or lifestyle recommendations. Research activities may encompass population-scale studies, development of a specific diagnosis or treatment, predict certain health conditions, or develop scientific knowhow, technology, discoveries, and intellectual property assets that improve healthcare for the population as a whole. They may also include publishing study results in peer reviewed scientific journals publications and commercialization activities.

Research activities may also entail use of your Personal Information (including Medical Information), for selecting candidates suitable for a particular research study for identifying the correlations between dietary and lifestyle inputs and illness or wellness at molecular levels. As a result, we may reach out to you from time to time with requests for additional information about you, your diet, lifestyle, or certain conditions by way of surveys and questionnaires as well as additional consents as necessary. When we do, you have the opportunity to choose which surveys to take, which questions to answer and grant us or decline your specific consent for such research activities. By choosing to answer, you are granting us the consent for such research activities.

Unless required by law or a court order, Ani will not release your individual-level Personal Information to any third party not identified in this Privacy Policy without first receiving your explicit consent by way of acceptance of a Consent Form.

For individuals located in the European Union (“EU”): Our legal basis for processing your Sensitive Data for the purposes described above is based on your consent. Please read below on Data Privacy for EU Residents Under GDPR for further details.

d) For Study Participations

From time to time, Ani may engage in additional certain study specific research in collaboration with third parties such as non-profit foundations, academic institutions, healthcare organizations, or commercial research partners with the intent to study about a specific disease condition or a segment of the population (“Study Participations”). In the event we identify you as a potential participant in a specific Partner Study Participation that requires use of individual-level Personally Identifiable Information, we will reach out to you for obtaining study specific informed consent applicable to such Study Participations.

Study Participations are governed by specific regulations and require approval by an independent review board (“IRB”) and your informed consent by way of acceptance of a study specific optional informed consent form that contains specific details on the study, collaborator, and the type of information we collect and share.

Some of these Study Participations are aimed at publication in peer-reviewed journals and other research publications. Study Participations are completely optional and voluntary for participants, and if you wish, you can choose to decline to accept the consent forms or choose not to respond.

Study Participations may require use of Personal Information by way of collection and analyses of physiological and molecular data such as Samples, individual Clinical Data, Test Data, and Self Reporting Information. When you have accepted a study specific consent form for Study Participations, we may share your Personal Information with the identified third-party study collaborators. Ani employs industry standard controls and safeguards in protecting and using your Personal Information for Study Participations as specified in the consent form and in accordance with the terms of this Privacy Policy.

When you have consented to Study Participations by way of accepting a study specific informed consent form, we may store and use your Sample Data and other Personal Information for current and future Study Participations. In addition, based on your Personal Information, if you were a potential fit for other Study Participations, we may contact you at any time of Service via email, website, or mobile application, with a notification for specific Study Participation and acceptance of a study specific consent form. You may choose to accept, decline, or choose not to respond to these invitations and consent forms. In the event you have not accepted a consent form or an invitation for Study Participation, you may still choose to join Study Participations in the future. Similarly, if you have accepted an invitation and a consent form and you do not wish Study Participations, you may decline to participate by withdrawing your consent.

For example, if a university or a collaborator tells us about a new research project on a specific condition, we may send you the study specific details and a consent form to make you aware of the Study Participation. Ani scientists may run, in such a case in collaboration with a university, an extensive clinical study program focused on developing science-based personalized nutrition algorithms towards treatment, prevention, and reversal of a chronic disease.

In the event if you do not wish to receive the Study Participation notifications, you can send a request to our Studies Team using the details below:

By Email:Send in a request with the subject line Assistance with “Study Notifications” using info@ani.ai

By Mail:ANI BIOME PBC

Ani Labs

525 Market Street Suite 700

San Francisco 94158

California

What happens if you do NOT sign or accept a consent form?

If you choose not to accept the consent form applicable to a Study Participation, your Individual-level Personal Information will not be used for Study Participations or shared with collaborators, or third parties associated with Study Participations. You may or may not accept the invitation to join a Study Participation by accepting a Consent Form or you may decide not to respond.

When you have not accepted a Consent Form, your Personal Information in de-identified, pseudonymized, and anonymized forms (that do not identify you personally) and in aggregate form may still be used by us, to the extent permitted by law, for research activities, data analysis, marketing, and for other lawful purposes as outlined in this Privacy Policy.

e) Improve Service, Analysis Methods, and Artificial Intelligence Engine

We continually refine and expand our Services by improving the precision, scalability, and interpretive capacity of our data analysis methods and artificial intelligence systems. These enhancements help Ani generate more accurate, evidence-based, and personalized insights and recommendations for participants, while using pseudonymized or aggregated data wherever possible to ensure privacy and data protection.

Ani may use your Sample Data, Test Results, and Self-Reported Information in de-identified, pseudonymized, anonymized, or aggregate form, together with similar data from other Participants, to enhance and validate Ani’s analytical and artificial-intelligence frameworks. Direct identifiers are carefully removed before any such data are used for model training or analysis.

Ani’s artificial-intelligence engine performs multiple analyses across aggregated, pseudonymized, de-identified datasets, combined with curated scientific literature, expert domain knowledge from Ani’s research team, and Participant feedback, to improve the accuracy and interpretive depth of its algorithms. These processes enable Ani to deliver increasingly precise, evidence-based, and personalized insights about nutrition, supplements, other interventions and related factors influencing human health and longevity.

As part of our Services, Participants may interact with “Talk to Ani”, a conversational feature available through Ani’s mobile application. When you use this feature, your messages or voice inputs may be analyzed to enhance response quality and system performance. To deliver these capabilities, Ani may engage trusted large-language-model (LLM) providers through secure enterprise-level API connections, ensuring that all data processing complies with applicable data-privacy and security standards. Information processed through these APIs is subject to Ani’s data-protection policies, contractual safeguards, and enterprise-grade security measures. These ensure that all data exchanged with Ani’s AI systems remains confidential and protected in line with applicable data-privacy regulations.

Talk to Ani is intended for informational and educational purposes only and does not provide medical advice or diagnosis.

f) Provide Participant Service and Support

When you contact Ani Participant service (“Participant Service”), we may use or request additional Personal Information, as necessary to verify your identity, answer your questions, resolve disputes, and/or investigate and troubleshoot problems or complaints. In certain instances, we may require using one Participant’s Personal Information to resolve another Participant’s request. For example, if a Participant reports the behavior of another Participant that violates our Terms of Service, we will separately process both Participants’ Personal Information and respond separately to each Participant as appropriate. We will not share your Personal Information with another Participant or any third party without your specific consent. To provide efficient support, Ani may engage trusted service providers and subprocessors (as defined in this Privacy Policy) who assist in managing communications, ticketing, and issue resolution. These entities operate under written Data Processing Agreements (DPAs) or equivalent contractual safeguards that ensure all Personal Information is processed securely and only on Ani’s behalf.

g) Surveys and Testimonials

We value our Participants’ feedback and may send you surveys, polls, or requests for testimonials to improve and optimize our Services. We may use your Personal Information to send you surveys, questionnaires, and requests for testimonials that we use to optimize our Service and perform quality control activities. You are in control of the information you would like to share with us. If you do not wish to receive these requests, you can manage them by a request to our Participant Service using the details provided in this Privacy Policy.

h) Marketing and communications

By creating an Ani Account and using our Service, you agree to receiving Service-related email with information such as new features, add-ons, promotions, contests, and other notifications about our Services. You can unsubscribe from receiving these marketing communications at any time. To unsubscribe, click the email footer “unsubscribe” link or send a request to our Participant Service using the details provided above. You may not opt-out of receiving non-promotional messages regarding your Account, such as technical notices, purchase confirmations, important Ani policies and deadlines applicable to use of Kits and Sample submissions or Service-related emails.

We may also use the Personal Information you submit to us to personalize your user experience and to allow us to recommend or deliver the type of content, new features, or Service offering in which you are most interested. We may also use your Personal Information to compile usage statistics and other data regarding use of our Services and for other types of marketing and communication purposes, without asking for and receiving your explicit consent (e.g., targeted advertising that uses third party advertising networks and providers who help us deliver targeted online advertisements or measure the effectiveness of ad campaigns). We and our third-party service providers will not use your Sensitive Information for marketing and communication purposes.

Withdrawing Consent

You may withdraw your consent as expressed by acceptance of a consent form for Study Participations, at any time by sending a request to our research team to change your Consent Form status as stated below:

By Email:Send in a request titled “Consent Withdrawal” using info@ani.ai

By Mail:ANI BIOME PBC

Ani Labs

525 Market Street Suite 700

San Francisco 94158

California

Pursuant to your request, we will not include your Individual-level Personal Information in Study Participations that start more than forty-five (45) days after the date of receipt of your consent withdrawal. Any Study Participations that used your Individual-level Personally Identifiable data that have already been performed or published prior to your withdrawal for which you have given consent to cannot and will not be reversed, undone, or withdrawn.

To the extent permitted by applicable law, we may still use the de-identified, anonymized, or pseudonymized information that do not personally identify you for research, Study Participations, data analysis, marketing, and other purposes in accordance with the terms of this Privacy Policy.

How We Disclose Your Information

In general, Ani will not disclose individual-level Personal Information (including Self-Reported Information and Medical Information) to third parties, except under the following circumstances:

a) With Express Written Permission

Ani may disclose your Personal Information to third parties in accordance with our Terms of Service or where you have otherwise provided express written consent for sharing (e.g., by way of accepting a consent form).

b) Facilitate Business Operations

Ani may disclose individual-level Personal Information as stated in the Terms and this Privacy Policy to partners, vendors, or service providers (e.g., credit card processors, Sample collection services, electronic data processors, chatbot service providers, supplements manufacturers, fulfillment and logistics service providers, Participant service accelerators, accredited reference laboratories, and testing labs), eCommerce store providers, and payment gateways that process and/or store such information in order to help Ani provide, or improve the Service or any part of it. In these instances, the protection of your individual-level Personal Information will be subject to the service agreements between us and the specific service provider and their privacy policies. In addition, we also employ strong terms on data privacy, security, protection, and confidentiality of information shared (including protection of our Participant data) in our legally binding agreements with the service providers. These service providers may use information that does not personally identify you, for their internal operations including data analysis and improving their services in general.

c) As Required by Law

Under certain circumstances, Personal Information may be subject to disclosures pursuant to judicial or other government subpoenas, warrants, or orders, or in coordination with regulatory authorities. You acknowledge and agree that Ani is free to preserve and disclose any and all Personal Information to law enforcement agencies or others regulatory agencies that oversee manufacturing and logistics service, if required to do so by law or in the good faith belief that such preservation or disclosure is reasonably necessary to: (i) comply with legal or regulatory process (such as a judicial proceeding, court order, or government inquiry); (ii) obligations that Ani may owe pursuant to ethical, regulatory (such as Food and Drug Administration), and other professional rules, laws, and regulations; (iii) enforce Terms of Service; (iv) respond to claims that any content violates the rights of third parties; or (v) protect the rights, property, or personal safety of Ani, its employees, its Participants (including you), and the public. In the event Ani is required by law to disclose Personal Information, Ani will notify you through the contact information provided to Ani in advance, unless doing so would violate the law or a court order.

d) Business Necessity

We may share your individual-level Personal Information, without explicit consent, to the extent necessary, and to the extent permitted by law, with third parties: i) in order to perform business operations that help deliver the Services to you (e.g., Sample collection services, laboratory service, inventory controllers that ship Kits, Precision Supplements and Precision Probiotics+Prebiotics manufacturers, logistics operators, IT service providers, Participant service optimizers, etc.); ii) in order to fulfil certain contractual obligations with our authorized channel partners for use in accordance with their then current terms and privacy policies, and iii) for marketing and communication purposes.

We may also share Personal Information in de-identified, pseudonymized, or aggregate forms (without your personal details or aggregated with the information of others so that you cannot reasonably be identified as an individual) for: i) research activities; ii) strategic initiatives with research partners; and iii) for other purposes, to the extent necessary, and as permitted by law.

Unless required by law or a court order, or as specifically stated in the Terms and this Privacy Policy, Ani will not release your individual-level or individually identifiable Personal Information to any third party without first receiving your consent. Specifically, Ani does not share your individually identifiable sensitive Personal Information with third parties, without your explicit consent, in the following ways: i) sell, lease, or rent them; ii) release to any public databases; iii) for Study Participations with collaborators; or iv) with insurance companies, healthcare providers, educational institutions, government agencies, or employers.

e) Lost Capacity

When a Participant has lost capacity or passed away, we will only give their Account information to individuals who are legally authorized to make decisions on their behalf, such as an executor, a personal representative, or a beneficiary of a deceased's estate. The person requesting the information must complete an authorization form and provide evidence and legal documentation indicating they are allowed to act on behalf of the individual before we will provide any information.

f) Business Transitions

In the event Ani goes through a business transition such as a merger, acquisition by another company, or sale of all or a portion of its assets, your Personal Information will likely be among the assets transferred. In such a case, Personal Information would remain subject to the terms of the pre-existing or the current Privacy Policy.

g) Commonly Owned Entities

We may share your Personal Information with other companies under common ownership or control of Ani, as necessary to deliver our Services, perform our contractual obligations, or for other purposes specified in our Terms of Service and this Privacy Policy. We may provide additional notice and ask for your prior consent if we wish to share your Personal Information in a materially different way than as specified in this Privacy Policy.

Information Security Measures

Ani uses a number of physical, technical, and administrative measures to keep your Personal Information safe and secure. By employing these safeguards, we aim to prevent unauthorized access, minimize accidental disclosure, maintain data accuracy and integrity, and ensure appropriate use of the information in accordance with current technological and industry standards. In particular, all connections to Ani websites, software, and mobile applications are encrypted using Secure Socket Layer (“SSL”) technology.

You acknowledge and agree that protecting Personal Information is a responsibility shared between you and Ani. In this regard, we ask all users of our Service to be responsible for keeping their login IDs, passwords, and other authentication information used to access the Service in a secure manner and maintain strict confidentiality. You should not share Account and authentication information with any third parties and should inform Ani immediately of any prohibited use of your Account or authentication information. Ani cannot secure and assumes no liability for Personal Information that is released by our Participants to third parties, such as physicians, insurance companies, or healthcare service providers.

Ani implements several physical and technical security measures to ensure confidentiality, integrity, security, and availability of Ani and Participant data by employing industry standard safeguards such as de-identification, pseudonymization, encryption, and data segmentation. Your Sample Data and other Personal Information you provided to us are stored after labeling them with an assigned code without your name or other Personal Information that can easily identify your Sample with you.

To ensure the on-going confidentiality, integrity, and security of your data, Ani conducts periodic risk assessments of its electronically protected health information systems (“ePHI”) which we use to store your Personal Data. We de-identify Participants’ PII from PHI and use multiple layers of industry standard security measures applicable to encryption and access protection for Sensitive Data, based on job function and role. Ani access controls include multi-factor authentication, single sign-on, and strict least-privileged authorization policies.

Ani keeps all Participant Personal Data and information on secure cloud servers. Only a small group of qualified personnel within Ani can access the information that can be used to identify you. These are personnel who need that information in order to provide, complete, testing, analysis, and reporting related to the Services. The Personal Information that matches the assigned codes will be kept in a secure, access controlled, and protected database at Ani. Only a small group of essential personnel will have access to this secure and protected database.

We will not include any Personal Information that would make it possible to identify you in any research, studies, or publications. All Ani employees, consultants, contractors and others who might have access to your Personal Information must sign confidentiality and non-disclosure agreements that mandate them to keep Participant Personal Information confidential. Your Personal Information may be shared with your health care service provider only with your written permission.

Your Samples and their specimens and their remnants, after testing and analysis, will be stored securely with de-identified alphanumeric IDs (with no Personal Information that can identify you).

Children’s Privacy

Ani is committed to protecting the privacy of children and abiding by the provisions of the Children’s Online Privacy Protection Act (“COPPA”). The Service is not directed, designed, or intended to attract children under the age of 13.

In rare instances, a parent or legal guardian of a child, however, may specifically request or consent his/her child to Study Participation, and may assist the child with providing assent to Study Participation, if the child is old enough to do so. In such cases, the parent or guardian may create an Account for, assist and be responsible with collection of the Clinical Sample, and provide Self-Reported Information on behalf of his or her child. If you are the parent or guardian of a child, you assume full responsibility for ensuring that the information you provide to Ani about your child is: i) accurate; ii) you have the legal right to provide your child’s information to Ani, and iii) that the child’s information is kept confidential and secure.

In the event Ani is notified or becomes aware that the Service has been used by a child under the age of 13 to store information of that child without parental consent, Ani shall be and is authorized to delete, in its entirety, with no notice to you, any of the information stored by that child or by you on that child’s behalf. Ani also reserves the right to revoke any license to use the Service, which is being used or has been used by a child under the age of 13.

Further, Ani Services are not designed for, intended to attract, or directed toward children under the age of 18 or below the legal age of majority to form a binding contract in your country of residence, whichever is greater. A parent or a legal guardian, however, may collect Samples using Kits, and create an Account for, and provide Registration information for his or her child who is under the age of majority. On these occasions, the parent or guardian assumes full responsibility for following the Sample collection instructions and ensuring that the information that he or she provides to Ani about his or her child is kept secure, and that the information submitted is accurate.

Some features associated with the Services and Study Participations are not offered to children or minors, even with parental/guardian consent. In such cases, Ani will restrict Registration for these Service or Study Participations for anyone below the age of 18.

If a parent or guardian allows a minor to interact with Ani through the “Talk to Ani” function, that parent or guardian is solely responsible for supervising the interaction and ensuring that no personal or identifying information is shared during the conversation. Talk to Ani is designed for informational and educational purposes only and does not provide medical advice or diagnosis.

Correction of Personal Information

Your Personal Information and Registration Information, if incorrect, can be corrected, changed, or updated by sending a request to our Participant Service using the information stated below:

Submit online:

Send in a request titled “Correction of Personal Information” using info@ani.ai

Submit by mail:ANI BIOME PBC

Ani Labs

525 Market Street Suite 700

San Francisco 94158

California

Account Closure

If you no longer wish to use the Service or have your Personal Information processed by us in order to provide you the Service, you may close your Account by sending our Participant Service a request using the information specified below.

Submit online:

Send in a request titled “Account Closure” using info@ani.ai

Once we receive your request, we will send an email to the email address linked to your Account detailing our Account Closure Policy and requesting that you confirm your closure request. Once you confirm your request to close your Account, your Account will no longer be accessible. When your request is processed, it cannot be cancelled, undone, withdrawn, or reversed. When closing an Account, Ani removes or deletes Personal Information associated with that Account, subject to certain limitations stated below:

To the extent necessary and permitted by law, Ani may still retain:

i) Limited Registration Information on order history (e.g., name, contact details, closure request, and transaction data) for accounting, audit, and compliance purposes;ii) Limited Personal Information for compliance with legal retention requirements;iii) Limited Personal Information to fulfill contractual obligations, exercise or defend legal claims;iv) Limited Personal Information to fulfill audit and compliance processes;v) Information already used for research and Study Participation; andvi) Limited information in de-identified, pseudonymized, or aggregate forms used in research, product development, data analysis and artificial intelligence.

Retention of Personal Information

Unless you close your Account and delete your Personal Information in the Account as described under Account Closure as specified above, Ani will store your Personal Information as long as your Account is open or as permitted by law.

By choosing to have Ani extract molecular-level data from your Samples as part of the Service, you consent to Ani accessing, analyzing, and storing your Personal Information and associated data using advanced technologies in a manner consistent with our Terms and this Privacy Policy.

Unless otherwise notified, Ani will store your Samples and data derived from those Samples for at least ten (10) years, and, due to the long-term and longitudinal nature of longevity research, may retain such Samples and associated data for longer periods where scientifically justified and permitted by law.

Ani may also retain other forms of data collected through the Ani Digital Platform (such as self-reported, sensor, or interaction data) for extended periods, to support longitudinal analyses, scientific validation, and development of future Services.

All Samples and data retained by Ani are handled under strict security, confidentiality, and data-protection standards. The same safeguards applicable to Personal Information apply to any further processing or storage of your Samples and related data, consistent with this Privacy Policy and Ani’s Terms of Service.

State and Region-Specific Information

You may have specific privacy rights under the laws in your state or region. For example, in the United States, residents of certain states such as California and other states may have specific privacy rights. Residents of certain geographic regions such as the European Union (EU), European Economic Area (EEA), UK, Switzerland, and other jurisdictions also have specific privacy rights.

Under this section of the Privacy Policy, you can find the specific Privacy Notices applicable only to the residents of the below identified US States and the world geographic regions identified as Designated Countries.

Data Privacy for Residents of Certain U.S. States

State Privacy Notices

Under certain U.S. State privacy laws identified below, residents of certain U.S. States are entitled to additional rights by way of privacy policies or notices as specified in our State privacy notices (“State Privacy Notices”) located at: https://www.ani.ai/state_privacy_notices.

Currently, the State Privacy Notices apply to residents of California, Colorado, Virginia, Utah, Nevada, Connecticut, and Washington. Ani State Privacy Notices contain information required by the California Consumer Privacy Act (“CCPA”) as amended by the California Privacy Rights Act (“CPRA”), the Colorado Privacy Act (“CPA”), the Virginia Consumer Data Protection Act (“VCDPA”), the Utah Consumer Privacy Act (“UCPA”), the Nevada Data Privacy Law (“NPL”), the Connecticut Data Privacy Act (“CTDPA”), and the Washington My Health My Data Act (“MHMDA”), as amended or replaced from time to time (collectively, “U.S. State Privacy Laws”), and such State Privacy Notices are incorporated herein by reference and supplement this Privacy Policy.

The State Privacy Notices, together with the Ani Privacy Policy, include the information and disclosures we are required to provide to you under U.S. State Privacy Laws that include CCPA and MHMDA. Please read our State Privacy Notices for further details relevant to your rights.

California Residents

Pursuant to the California Consumer Privacy Act of 2018 (“CCPA”), California residents are afforded certain additional rights regarding use of your Personal Information. However, depending on your data choices, certain services may be limited or unavailable. If you are a California Resident, to learn more about your California Residents’ privacy rights under CCPA by reading our State Privacy Notices located at https://www.ani.ai/state_privacy_notices.

If you have any questions about your CCPA rights, you may contact our Participant Service by sending a request using the information specified below.

Submit online:E-mail info@ani.ai and request Assistance with CCPA Notice Rights.

Submit by mail:ANI BIOME PBC

Ani Data Privacy Office

525 Market Street Suite 700

San Francisco 94158

California

If you are a California resident, you have the right to request access to, correction of, or deletion of your Personal Information, as well as the right to opt out of certain data-sharing activities. You may exercise these rights by contacting us at info@ani.ai. Ani does not sell Personal Information as defined by the California Consumer Privacy Act (CCPA/CPRA).

California Do-Not-Track Disclosures

Ani and its third-party cookie and pixel providers may track its Participants over time and across third party websites to provide targeted advertising and therefore it may not always respond to Do Not Track (“DNT”) signals. Third party cookie and pixel service providers we use may have content embedded on Ani’s websites or mobile applications (e.g., social features or plug Ins) and may set cookies or pixels on a user’s browser and obtain information about the web browser visiting a specific Ani website from a certain IP address. These third parties may collect your Personal Information from Ani’s websites, software, or mobile applications unless you have opted out of non-essential cookies and receiving their marketing messages by using the opt-out choices provided to you or by visiting the third-party service provider websites including services such as https://app.retention.com/optout. You can read more about your rights under the State Privacy Notices and your choices as stated in our Cookie Policy.

Nevada Residents

Pursuant to Nevada Data Privacy Law (“NPL”), Nevada residents may direct a business that operates an internet website not to sell certain Personal Information about you. Ani does not sell your Personal Information to third parties. If you are a Nevada resident, for more information about your rights under NPL or how we handle and share your Personal Information, you can read our State Privacy Notices located at: https://www.ani.ai/state_privacy_notices

You can also contact our Participant Service by sending a request using the information specified below:

Submit online:E-mail info@ani.ai and request Assistance with NPL Rights.

Colorado, Virginia, Utah, and Connecticut Residents

The State Privacy Notices, together with this Privacy Policy, include the information and disclosures we are required to provide to you under U.S. State Privacy Laws based on the State of your residence. You can learn more about your privacy rights under the applicable U.S. State Privacy Law, by reading our State Privacy Notices located at: https://www.ani.ai/state_privacy_notices

Washington Residents

The Washington My Health My Data Act (“MHMDA”) requires certain regulated entities to provide a Consumer Health Data Privacy Policy (“MHMDA Policy”) with privacy disclosures relating to data that meets the definition of “consumer health data”.

MHMDA Consumer Health Data Privacy Policy

The residents of Washington can learn more about their MHMDA rights on the consumer health data as stated in the Washington Consumer Health Data Privacy Policy in our State Privacy Notices located at: https://www.ani.ai/state_privacy_notices

If you have any questions about your MHMDA rights, you may contact our Participant Service by sending a request using the information specified below.

Submit online:Email info@ani.ai and request Assistance with MHMDA Rights.

Submit by mail:ANI BIOME PBC

Ani Data Privacy Office

525 Market Street Suite 700

San Francisco 94158

California

Residents of other US States

Pursuant to the privacy laws of various other US States, residents of certain states may be afforded certain additional rights regarding use of their Personal Information. The privacy policies and practices of Ani as stated herein supplemented by our State Privacy Notices are intended to cover the rights of the residents of these US States when applicable. Please read or State Privacy Notices or contact our Participant Service by sending a request using the information specified above for further details.

Data Privacy for Residents of Designated Countries

Designated Countries’ Privacy Notice

This section (“Designated Countries’ Privacy Notice” or “Notice”) of the Privacy Policy applies only to the personally identifiable information (“Personal Data”) of the residents of the European Economic Area (inclusive of the European Union (“EU”) (“EEA”), United Kingdom (“UK”), or Switzerland (collectively, the “Designated Countries”).

In this Notice, we describe below, the legal bases applicable to transfer of Personal Data, your privacy rights, how you can exercise your rights, how we process your Personal Data, and how we comply with the data privacy laws (such as General Data Protection Regulation (“GDPR”), the Data Protection Act 2018 (“UK GDPR”), and Federal Act on Data Protection in Switzerland (“FADP”)) specifically applicable to individuals located in Designated Countries. This Notice should be read together with our Privacy Policy, Cookie Policy, and our Terms of Service.

When we transfer, store, and process Personal Data of residents of the Designated Countries, we implement appropriate safeguards applicable to transfer of such Personal Data to and from the Designated Countries in accordance with the terms specified below:

Our Relationship with You

Ani is the data controller with respect to Personal Data collected through its Services, including data submitted via the Ani Digital Platform, the Talk to Ani function, or research studies conducted directly by Ani. This means Ani determines the purposes and means of processing your Personal Data for these activities.

In certain research collaborations or partner-led studies, Ani may act as a joint controller together with the partnering institution, or as a data processor when processing data solely on behalf of that partner under a written agreement. In certain research collaborations with partner clinics or institutions, Ani may act as a joint controller or data processor pursuant to Article 26 or 28 of the GDPR, under written agreements that define respective roles and responsibilities. In all cases, Ani ensures that appropriate contractual and organizational safeguards are in place to protect your Personal Data in accordance with applicable data-protection laws.

Legal bases for processing Personal Data

The laws of the Designated Countries require us to rely on certain conditions to process your Personal Data. When we process your Personal Data, we rely on the following conditions or “legal bases”:

• Your consent
• Legal obligations
• To perform contracts we entered with you or others, or to take steps in fulfilling our obligations
• In our legitimate interest as a commercial entity (e.g., to protect our property or rights, or safety of Ani, our Participants or others, to improve our Service)

Your Privacy Rights

Residents of the Designated Countries have the right to access, delete, correct, withdraw their consent, and have portability of their Personal Data. In keeping with Ani’s commitment to ensure strong privacy controls for our Participants, our Privacy Policy together with this Notice outlines how you can access, download, and delete your Personal Data by contacting us.

In addition, you have the right to consent, object or restrict processing of your Personal Data. To exercise such rights, you are provided with specific opt-in and opt-out mechanisms as further specified in our Cookie Policy.

How We Process Your Data

When we process your Personal Data, under the legal bases specified above, following the lawful data transfer mechanisms, along with the purposes specified in the Privacy Policy, we may use your Personal Data for following purposes:

Marketing Communications

With your consent, we may contact you by electronic means for marketing communications with information about our Services that are similar or related to our Services with you. If you do not want us to use your Personal Data in this way, you may not provide the opt-in consent as further described in our Cookie Policy or please contact us at info@ani.ai to withdraw your consent at any time. The withdrawal of your consent will not affect the lawfulness of processing based on consent before its withdrawal.

Transfer to a Third Party

If your Personal Data is transferred to a third party located outside the Designated Countries, Ani implements industry standard privacy and security measures as specified in this Notice and the Privacy Policy. In addition, and we secure appropriate contractual terms with such third parties relating to the transfer of such Personal Data.

Lawful Requests

Ani may be required to disclose Personal Data pursuant to lawful requests made by public authorities, including to meet national security or law enforcement requirements.

How to Exercise Your Rights

You can exercise your privacy rights under GDPR, UK GDPR, or FADP on use of your Personal Data by following the instructions set forth in this Privacy Notice. When you make a request, we may verify your identity as well as the residency status to protect your privacy and security.

We will process your request as expeditiously as possible in accordance with the applicable data protection laws in the Designated Countries. Please note, some cases, your ability to access or control your Personal Data will be limited as required or permitted by the applicable law. We reserve the right to charge a fee, where permitted by law (e.g., if our cost of processing your request is prohibitive, or your request is manifestly unfounded or excessive).

We may not always be able to fully address your request, for example if it would impact the duty of confidentiality we owe to others, or if we are legally entitled to deal with the request in a different way.

We ask that you attempt to resolve any issues regarding your Data Protection or data requests first with us. We will be happy to respond to your request promptly.

You can contact us by:Email: send us a request at: info@ani.ai

Contact of the Data Protection Officer: odvjetnik.stefan.martinic@protonmail.com

By Mail:ANI BIOME PBC

Ani Data Privacy Office

525 Market Street Suite 700

San Francisco 94158

California

How We Comply with Data Privacy Laws

International Transfers

Ani is a global business, meaning your Personal Data will likely be transferred to, stored, and processed in the U.S. and other countries outside of where you live. Regardless of where your data is processed, we apply the same protections described in this Privacy Notice to your Personal Data.

When we conduct such transfers, we rely on various legal bases to lawfully transfer Personal Data around the world, that include fulfillment of our agreements with you, your prior consent, adequacy decisions for relevant countries, or other transfer mechanisms as may be available under applicable law such as the European Union Commission approved standard contractual clauses (“SCCs”) (collectively, “lawful data transfer mechanisms”).

Ani may transfer Personal Data from the European Union, the European Economic Area (EEA), the United Kingdom, and Switzerland to the United States and other jurisdictions based on Standard Contractual Clauses (SCCs) and other appropriate safeguards approved under applicable data-protection laws. Ani may transfer and process Personal Data in countries outside your country of residence, including the United States and European Union. Where Personal Data originates from the European Union, the European Economic Area (EEA), the United Kingdom, or Switzerland, and such countries have not been recognized by the European Commission, the UK Information Commissioner’s Office, or the Swiss Federal Data Protection and Information Commissioner as providing an adequate level of protection, Ani relies on Standard Contractual Clauses (SCCs) and other lawful transfer mechanisms approved under applicable data-protection laws to ensure appropriate safeguards are in place.

Ani implements organizational, contractual, and technical measures to protect Personal Data during cross-border transfers, in accordance with the principles of Privacy by Design and Privacy by Default. Individuals in the EU, EEA, UK, or Switzerland may contact Ani’s designated Data Protection Representatives listed in this Policy for questions or concerns about international data transfers.

To request to limit the use and disclosure of your Personal Data, please submit a written request to: info@ani.ai

In certain research collaborations or studies, Ani may be contractually required to ensure that all Personal Data, including biological and digital data, remain stored and processed within the European Union or another specified jurisdiction. In such cases, Ani complies with the data-location and transfer restrictions defined in the applicable study agreement or data-processing arrangement. Ani will not transfer Personal Data outside the agreed jurisdiction unless expressly authorized by the relevant partner or permitted under applicable data-protection laws and approved safeguards.

Disclosures to Third Parties

In those instances, in which Ani may disclose Personal Data in personally identifiable way to a third party that is not already identified in this Privacy Policy, Ani shall notify the individual of such disclosure and allow the individual the choice to opt-in or to opt-out of such disclosure.

Ani shall ensure that any agent third party for which Personal Data may be disclosed to subscribes to these Principles or are subject to laws providing the same level of privacy protection as is required by these Principles and agree in writing to provide an adequate level of privacy protection.

Ani will not sell, lease, or rent your individual-level Personal Data to any third party or to a third party for research or study purposes without your explicit consent. However, we may use and share de-identified, anonymized, pseudonymized, and aggregate forms of data with third parties (together with the data of others so that you cannot reasonably be identified with the shared data as an individual), in order to perform business operations, initiate research activities, Study Participations, for data analytics and enhancing our data analytics engine, send you marketing emails, or to improve our Services.

Ani’s Accountability

Ani is accountable for Personal Data that it receives in the United States under the Data Privacy Framework and subsequent transfers to a third party as described in the Data Privacy Framework. In particular, Ani remains responsible and liable under the Data Privacy Framework in certain circumstances for onward transfers of Personal Data to third parties if the third-party agents that it engages to process the Personal Data on its behalf do so in a manner inconsistent with the Principles, unless Ani proves that it is not responsible for the event that gave rise to the damage.

Ani is also subjected to the investigatory and enforcement powers of the Federal Trade Commission (“FTC”), the U.S. Department of Transportation (“DOT”) or any other U.S. authorized statutory body and bound by such other applicable laws and regulations.

Data Security

Ani shall take reasonable steps and employ processes to protect Personal Data from loss, misuse and unauthorized access, disclosure, alteration, and destruction. Ani has put in place appropriate physical, electronic, and managerial procedures to safeguard and secure the Participant information from loss, misuse, unauthorized access or disclosure, alteration, or destruction. However, Ani cannot guarantee the security of information on or transmitted via the Internet. Such safeguards and processes include but not limited to:

i) Self-assessment

Ani uses a self-assessment approach or outside compliance review to assure compliance with this Privacy Policy and it periodically verifies that this Privacy Policy is accurate, comprehensive for the information intended to be covered, and in accordance with the Principles.

ii) Data Integrity

Ani shall only process Personal Data in a way that is compatible with and relevant for the purpose for which it was collected or authorized by those who provided the information. To the extent necessary for those purposes, Ani shall take reasonable steps to ensure that Personal Data is accurate, complete, current, and reliable for its intended use.

iii) Access

In those instances, in which Ani collects Personal Data directly from individuals, Ani shall allow those individuals access to their Personal Data and allow the individual to correct, amend or erase inaccurate information, except where the burden or expense of providing access would be disproportionate to the risks to the privacy of the individual in the case in question or where the rights of persons other than the individual would be violated.

How we Handle a Data Breach

Ani’s “Privacy By Design” approach requires that our Participant data protection levels be at the highest setting by default. In the unlikely event of a breach, Ani will notify the applicable Data Subjects and Supervisory Authorities ("SA"s) in the Designated Countries according to procedures provided in GDPR Articles 33 and 34 and the laws applicable in the Designated Countries.

Data Privacy Under GDPR

This Section outlines our policies and commitment to GDPR applicable ONLY to information from and of the residents of the EEA (inclusive of EU). Except where a term is specifically defined herein, the terms used in this Section will have the meaning provided under in the GDPR. In addition to GDPR, Ani is committed to ensure that all Personal Data received from the UK and Switzerland will be handled in accordance with The Data Protection Act 2018 in the UK (“UK GDPR”), Federal Act on Data Protection in Switzerland (“FADP”), and in compliance with the applicable privacy laws.

Ani is committed to GDPR compliance through our robust data privacy and security protections. Under the GDPR, organizations that collect and store Personal Data must implement appropriate technical and organizational measures to ensure a level of security appropriate to the risk associated with processing Personal Data. Ani uses industry-leading organizational and technical measures to keep your Personal Data secure.

In exercising your rights under GDPR, applicable only to residents of Designated Countries, as a precondition for processing your requests, we require proof of your identity and resident status both.

Note: GDPR and Data Privacy policies outlined below do not extend or apply to residents of the United States or countries not included in the Designated Countries as defined above.

Below we describe how we process your Personal Data in accordance with this Privacy Notice.

a) When Ani acts as Controller

Ani acts as a Controller when it determines the purposes and means of processing Personal Data. Where we process your Personal Data in our capacity as a Controller, this Privacy Policy will govern such processing of your Personal Data.

b) When Ani acts as a Processor

Ani acts as a Processor where it processes Personal Data for another Controller. Where we process your Personal Data in our capacity as a Processor, on behalf of a third-party Controller, this Privacy Notice will not govern the processing of your Personal Data. In such events, we encourage you to contact the Controller directly to learn about their privacy policies applicable to processing of your Personal Data and exercise your rights directly with the Controller, or we will forward your request directly to such Controller upon receipt of a request from you.

c) Right to Withdraw Consent

To the extent Ani has requested and you provided your consent for processing of your Personal Data, or accepted a Consent Form, you can withdraw your consent at any time by contacting our Participant Service using the information specified below. Your withdrawal will not affect the lawfulness of our processing based on consent you granted before its withdrawal as well as use of your data in ways otherwise permitted by law.

Submit online:Send us a request titled Assistance with GDPR: Consent Withdrawal using info@ani.ai

Submit by mail:ANI BIOME PBC

Ani Data Privacy Office

525 Market Street Suite 700

San Francisco 94158

California

d) Right of Access and Rectification

Ani allows you to access and rectify certain Registration Information, Self-Reported Information, and other Personal Data as required by applicable law. If you would like to access or rectify your Personal Data, please contact our Participant Service using the details specified below. We may not be able to fulfil part or all of your request if doing so could adversely affect the rights and freedoms of others.

Submit online:Send us a request titled GDPR: Data Access and Rectification using info@ani.ai.

Submit by mail:ANI BIOME PBC

Ani Data Privacy Office

525 Market Street Suite 700

San Francisco 94158

California

e) Right to Erasure ("Right to be Forgotten")

We allow you to delete your Account or your Personal Information following a request for Account Closure at any time. You can request erasure of Personal Data that: (a) is no longer necessary in relation to the purpose for which it was collected or used; (b) was collected with your consent but later you withdrew such consent; or (c) was collected for a purpose with your consent, but there are no overriding legitimate grounds for our further processing.

Ani will take reasonable steps to fulfil your request. Our assistance with your request, however, is subject to the following limitations:

When processing your Personal Data is necessary to comply with a legal obligation, establish, exercise, or defend legal claims;In relevant data protection laws that restrict this right for certain types of data;When there are limitations in the available technology; andWhen we are limited by the cost of implementing

Subject to the above terms and conditions, Ani will fulfill your request within thirty (30) days from receipt of a request from an EU Participant, subject to verification of requester’s identity and other details such as the EU or EEA resident status, before we fulfil your request. Notwithstanding the above, Ani shall be permitted to retain, to the extent permitted by law, any and all Personal Data that is in de-identified, anonymized, pseudonymized, and aggregated forms in accordance with the terms of this Privacy Policy.

Please contact Ani using info@ani.ai to exercise your right to erase your Personal Data pursuant to GDPR using the subject line: GDPR: Right to Erasure.

f) Right to Restrict Processing

Under GDPR, you have the right to restrict our processing of your Personal Data under the following circumstances: (a) you dispute the accuracy of Personal Data; (b) the processing is unlawful and you do not wish the erasure and request the restriction instead; (c) we no longer need the Personal Data for the purposes; and (d) when our legitimate grounds for processing override your rights.

Following a request for restriction, however, we can continue to use your restricted Personal Data, when: a) we have your consent; b) to establish, exercise or defend legal claims; c) to protect the rights of another natural or legal person; or d) for reasons of important public interest.

Please contact Ani by using info@ani.ai to execute your right to Restrict Processing Personal Data using the subject line: GDPR: Right to Restrict Processing.

g) Right to Data Portability

To the extent that we process your Personal Data as Controller (i) with your consent or under a contract; and (ii) through automated means, you may request your Personal Data in a structured, commonly used, machine-readable format. You may also request the transfer of your Personal Data directly to another data Controller, where it is technically feasible, unless choosing to exercise this right adversely affects the rights and freedoms of others.

There may be an additional fee associated with processing your request.

Please contact Ani by using info@ani.ai to exercise your rights to portability of your Personal Data pursuant to GDPR with the subject line: GDPR: Right to Data Portability.

h) Account Closure

To close your Account, please contact our Participant Service using the information specified below. If you closed your Account, we will take the same steps described under Account Closure above.

Submit online:Send us a request titled GDPR: Account Closure or using info@ani.ai.

i) Personal Data retention

Unless you close or delete your Ani Account, we retain and store your Personal Data as long as your Account is open, for other important purposes such as providing you with our Service, complying with legal obligations, resolving disputes, enforcing our agreements, and for other purposes specified in this Privacy Policy and permitted by applicable law.

j) Third parties with access to your Personal Data

Ani may share your Personal Data, with third parties as necessary for them to provide their services to us and help us deliver our Services to you. Service providers are third parties (other companies or individuals) that help us provide, analyze, and improve our Services. While Ani directly conducts the majority of the data processing activities required to provide our Services to you, we may engage some third-party service providers to assist us in supporting our Services, including in the following areas and ways:

i) Order fulfillment and shipping: to provide you with our Services including the Kits and Subscription Services, and their delivery to you.ii) Manufacturers of our Services including the Kits and Subscription Services.iii) Participant Service and related service providers: to process orders, respond to Participant service requests, phone services, and for Participant relationship management.iv) Website and mobile application usage analytics services: to determine who is using Ani’s Services, to improve those Services, and to assist users on use of our website.v) eCommerce Platform or Storefront Services, Payment processors to make recurring charges to process Participant payments using billing information.vi) Sequencing facilities: to provide primary sequencing and other types of analysis (including DNA).vii) Testing facilities: to provide genotype, microbiome, and gene expression testing that form part of our Service.viii) Sample collecting service providers or agents that facilitate the collection process.ix) Study Collaborators: to engage in scientific Study Participations.x) Software developers: to develop and test Ani’s software and mobile applications.xi) Database service providers: to securely store Sample Data and Test Results.xii) Storage facilities: to securely store raw and processed Samples and Sample Data.xiii) Business process outsourcers and electronic data processors.xiv) Study Participation collaborators.xv) Provide Partner Services to you (if applicable).xvi) Other service providers that support our Services.

Like many online services, to the extent necessary and permitted by applicable law, Ani may share de-identified, anonymous, or pseudonymized Personal Data that does not personally identify you or on aggregate basis with our business partners, service providers, and advertisers in accordance with our Terms and this Privacy Policy. This may also include non-individually identifiable data contained in databases, server log files such as your IP address and cookies, generalized traffic flow data, data used for research, inferred, or resulting data, and aggregated statistical data that are not personally identifiable, including users’ demographic information.

Our data processors and their sub processors who use your Personal Data for providing Services may transfer such Personal Data to any country or territory, as may be reasonably necessary for provisioning of their services described in our service agreements with them.

Contact Us

If you have questions about this Notice or Privacy Policy, please contact us by email at info@ani.ai or by writing to us at:

ANI BIOME PBC

Ani Data Privacy Office

525 Market Street Suite 700

San Francisco 94158

California