Last updated: July 31, 2026

YUGA BIO INC.

Consumer Health Data and Genetic Information Privacy Policy

Effective Date: July 31, 2026 | Last Updated: July 31, 2026

About this Policy. This Consumer Health Data and Genetic Information Privacy Policy (this “Health Data Policy”) is a separate, standalone policy that supplements the Yuga Bio Privacy Policy. It is provided to satisfy the requirements of United States state consumer-health-data and genetic-privacy laws, including the Washington My Health My Data Act, the Nevada consumer health data law, the health-data provisions of the Connecticut Data Privacy Act, the California Genetic Information Privacy Act, the California Confidentiality of Medical Information Act, other state genetic-privacy statutes, and the sensitive-data provisions of the state comprehensive privacy laws described below. If there is any conflict between this Health Data Policy and the general Privacy Policy with respect to consumer health data or genetic information, this Health Data Policy controls. Capitalized terms not defined here have the meanings given in the Terms of Service and the Privacy Policy. This Health Data Policy describes what we collect, why, how we use and share it, the choices and rights you have, and how to exercise them.

1. Scope, Application, and Who We Are

Yuga Bio Inc. (“Yuga Bio,” “we,” “us,” or “our”) operates yugabio.com and the Krita platform (together, the “Service”), an artificial-intelligence platform that supports cancer-care navigation. This Health Data Policy applies to “consumer health data,” which means personal information that is linked or reasonably linkable to a consumer and that identifies the consumer’s past, present, or future physical or mental health status, and to “genetic information” and “genetic data,” as those terms are defined under applicable law. Consumer health data includes, without limitation, health conditions, diagnoses, and diagnostic testing; treatments, procedures, and medications; biometric data; genetic and genomic data; imaging and laboratory results; information that identifies a consumer seeking health-care services; and inferences derived from any of the foregoing, including inferences generated through algorithms or machine learning.

United States residents only. The Service is offered only to individuals who are residents of, and physically located in, the United States. We do not offer the Service to individuals located outside the United States.

Our role. For consumer health data that we collect directly from consumers who use the Service for their own purposes (our direct-to-consumer channel), Yuga Bio determines the purposes and means of processing and therefore acts as the controller and as the “regulated entity,” “covered entity,” or equivalent responsible party under the applicable state laws. In this direct-to-consumer channel, Yuga Bio is not acting as a HIPAA covered entity or business associate, and this Health Data Policy, rather than the HIPAA notice of privacy practices, governs. Where Yuga Bio instead provides the Service to or on behalf of a health-care provider or other business customer that is a HIPAA covered entity, Yuga Bio acts as that customer’s business associate, protected health information is handled under the applicable business associate agreement, and that channel is outside the scope of this Health Data Policy.

2. Categories of Consumer Health Data We Collect

We collect the following categories of consumer health data, in each case only with your consent or as strictly necessary to provide a product or service you have requested:

Diagnosis and condition information, including cancer type, stage, histology, and biomarkers;
Treatment history and current medications, including the absolute dates of diagnosis and treatment events, which we retain because they are necessary to match you to relevant clinical trials;
Genetic and genomic information, including sequencing data, variant data, and other molecular or multi-omics data;
Imaging, pathology, and laboratory information;
Family health history and health-related goals that you provide;
Information you enter into free-form chat, which may include health information that you choose to volunteer;
Where you enable it, health information drawn from a connected electronic-health-record system that you authorize; and
Inferences, analyses, and research hypotheses that we generate from the foregoing using artificial intelligence.

3. Categories of Sources

We collect consumer health data from the following categories of sources:

Directly from you, including information you enter, upload, or provide through chat;
From health-care providers, laboratories, or record systems that you direct or authorize to share information with us;
From connected applications, devices, or electronic-health-record systems that you choose to link; and
Generated by us, in the form of inferences and analyses derived from the data described above.

4. How We Use Consumer Health Data

We use consumer health data for the following purposes:

To provide, operate, and maintain the Service you request, including running analyses, generating research hypotheses, and matching you to potentially relevant clinical trials;
To enable collaboration within a care team that you create or join, as you direct;
To secure, troubleshoot, and improve the reliability of the Service; and
To comply with law and enforce our agreements.

Limits on use. We do not use consumer health data for targeted advertising, and we do not sell consumer health data. We do not use genetic, genomic, or other identifiable health information to train, fine-tune, or improve artificial-intelligence models. We use consumer health data for research or other secondary purposes only with your separate, express, opt-in consent, as described in Section 6. We will not collect, use, or share categories of consumer health data, or use consumer health data for purposes that are not described in this Health Data Policy without first disclosing them and obtaining your consent.

We share consumer health data only as described in this Health Data Policy. The categories of persons or entities with whom we may share consumer health data are:

Cloud hosting and infrastructure providers that process data on our behalf under written agreement;
Artificial-intelligence model-processing providers operating within our hosting environment under our instructions and under written agreement;
Electronic-health-record connection providers that authenticate and enable transfers you initiate;
Other members of a care team that you create or join, as you direct;
Professional advisors, such as counsel and auditors, under duties of confidentiality; and
Government authorities or other persons where required by law, court order, or valid legal process, or to protect rights, property, or safety.

Specific affiliates and a current list. We share consumer health data with our affiliates only as necessary to operate the Service and consistent with this Health Data Policy. A current list of the specific affiliates and the categories of third parties with whom we share consumer health data, together with an active mechanism to contact them, is available on request at support@yugabio.com and through the rights process described in Section 9.

No sale; no advertising sharing. We do not sell consumer health data, and we do not share consumer health data with advertising networks, data brokers, or analytics providers for cross-context behavioral advertising. We do not disclose genetic information to employers, or to entities administering or making decisions regarding health, life, long-term-care, or disability insurance, without your consent.

We rely on your consent to collect, use, and share consumer health data, obtained through separate, specific, and affirmative opt-in choices presented at the point at which the relevant data is collected or the relevant activity occurs. We do not bundle these consents into a single blanket acceptance, and we do not use pre-checked boxes or deceptive design. Depending on the activity, these consents include:

your consent to collect and process your consumer health data to provide the Service;
a separate and distinct consent to share your consumer health data with the categories of recipients described in Section 5;
for genetic information, the layered express consents described below, which are also addressed in the Genetic Information Collection, Use, Disclosure, and Research Consent; and
a separate, off-by-default opt-in consent for session recording.

Because genetic information receives heightened protection, we obtain your initial express consent to collect, use, and store it, and, at a minimum, we obtain your separate and express consent for each of the following:

each use of your genetic data beyond the primary purpose for which it was collected, including who has access and how it may be used;
each transfer or disclosure of your genetic data to a third party other than a service provider acting on our behalf, including the name of that third party.

You may withdraw any optional consent at any time, without affecting the lawfulness of processing carried out before the withdrawal. We provide effective mechanisms to withdraw consent without unnecessary steps, including at least one method through support@yugabio.com. We honor a withdrawal as soon as practicable and no later than thirty (30) days after receipt.

7. We Do Not Sell Consumer Health Data or Genetic Data

Yuga Bio does not sell consumer health data or genetic data, and does not intend to do so. If this position ever changes, we will first obtain the separate, valid written authorization that applicable law requires before any sale, and we will not condition provision of the Service on your signing such an authorization.

8. Genetic Information: Additional Protections

You may revoke a genetic-information consent at any time. On revocation, we will cease further processing of your genetic data for the revoked purpose, and we will delete or destroy your genetic data within thirty (30) days, except where retention is required by law. You may access your genetic data, delete your account and genetic data at any time. We maintain reasonable security procedures and practices to protect genetic data, and we do not disclose genetic data to employers or to insurance entities as described in Section 5. Where we share de-identified genetic or phenotypic information for scientific research, we do so consistent with the federal Common Rule (45 C.F.R. Part 46).

Re-identification risk. Genetic and genomic data are inherently and uniquely identifying, and no method of de-identification can fully eliminate the possibility that such data could be linked back to you. We therefore treat genetic and genomic data as identifiable, and we do not represent that it is anonymized.

9. Your Rights and How to Exercise Them

Subject to applicable law, you have the right to:

confirm whether we are collecting, sharing, or selling your consumer health data and access that data;
obtain a list of the specific affiliates and third parties with whom we have shared or to whom we have sold your consumer health data, and a mechanism to contact them;
withdraw your consent to our collection, use, or sharing of your consumer health data;
delete your consumer health data;
correct inaccurate personal data and obtain a portable copy of your data; and
opt out of any sale of personal data, targeted advertising, and profiling in furtherance of decisions that produce legal or similarly significant effects, and appeal a refusal to act on your request.

How to exercise. To exercise any of these rights, email support@yugabio.com. You do not need to create an account to make a request. We will respond within the time required by applicable law, and in any event within forty-five (45) days of receipt, which we may extend once by an additional forty-five (45) days where reasonably necessary, with notice to you within the first period. We provide these responses free of charge up to twice per year.

Deletion and pass-through. When you request deletion or withdraw consent, we will delete your consumer health data from our systems, including archived and backup systems within the period permitted by law, and we will notify our affiliates, processors, and other third parties with whom we have shared the data and direct them to delete it as well.

Appeals. If we decline to act on your request, you may appeal by replying to our response or by emailing support@yugabio.com with the word “Appeal.” We will respond in writing within forty-five (45) days of the appeal, explaining our decision. If we deny the appeal, we will provide you with a method to contact the applicable state Attorney General or regulator.

No discrimination; opt-out signals. We will not discriminate against you for exercising any of these rights. Where required by applicable law, we recognize and honor browser-based universal opt-out mechanisms, including the Global Privacy Control.

10. State-Specific Disclosures

This Section provides disclosures that apply to residents of particular states. It supplements, and does not limit, the rest of this Health Data Policy.

10.1 Washington, Nevada, and Connecticut (Consumer Health Data)

If you are a resident of Washington, Nevada, or Connecticut, the consumer-health-data laws of your state apply to our processing of your consumer health data. This Health Data Policy is the separate consumer health data privacy policy required by those laws. It discloses the categories of consumer health data we collect and the purposes of collection, the categories of sources, the categories of consumer health data we share, the categories of third parties and the specific affiliates with whom we share it, and how you may exercise your rights. We obtain your affirmative opt-in consent before collecting consumer health data beyond what is necessary to provide a product or service you have requested, and a separate consent before sharing it. We do not use a geofence around any facility that provides in-person health-care services to identify or track consumers, to collect consumer health data, or to send related notifications or advertisements. Washington residents may enforce the Washington My Health My Data Act through the Washington Consumer Protection Act.

10.2 California (Genetic Information and Medical Information)

If you are a California resident, the California Genetic Information Privacy Act and the California Confidentiality of Medical Information Act apply to our handling of your genetic data and medical information, in addition to the California Consumer Privacy Act. We provide the genetic-data notice, layered express consents, revocation and sample-destruction rights, deletion rights, and security protections described in this Health Data Policy and in the Genetic Information Collection, Use, Disclosure, and Research Consent. We treat genetic data and medical information as sensitive, and you may limit our use of your sensitive personal information as described above.

10.3 Other States with Genetic-Privacy Statutes

If you reside in another state with a genetic-privacy statute, we honor the core protections those statutes require: a public notice of our genetic-data practices; initial express consent and separate express consent for secondary use, named third-party transfer, and marketing; rights to access and delete your genetic data; and reasonable security. Many of these statutes apply regardless of our size or revenue.

10.4 State Comprehensive Privacy Laws (Sensitive Data)

Where you reside in a state with a comprehensive consumer privacy law, health data, genetic data, and biometric data are treated as “sensitive data.” We process sensitive data only where you have given opt-in consent or, where your state so requires, only where the processing is strictly necessary to provide the product or service you have requested, and we apply data-minimization principles to sensitive data. We do not sell sensitive data. We conduct data protection assessments for processing that presents a heightened risk of harm, including the processing of sensitive data. You may exercise the access, correction, deletion, portability, and opt-out rights described in Section 9, and we honor recognized universal opt-out signals where required.

11. Data Retention and De-identification

We retain consumer health data for as long as your account is active and as needed to provide the Service, and otherwise only as permitted or required by law. The table below describes our general retention approach by category. Where a shorter statutory period applies, we follow it.

Category	General retention	Notes
Account and profile data	Life of the account	Deleted on account closure, subject to legal holds
Medical records and diagnosis/treatment data	Life of the account	Absolute diagnosis and treatment dates retained for trial matching
Genetic and genomic data	Until consent withdrawn	Deleted or destroyed within 30 days of withdrawal, subject to law
Imaging and laboratory data	Life of the account	Deleted on account closure, subject to legal holds
Chat logs and generated inferences	Life of the account	May be retained in de-identified form for reliability
Consent and authorization records	As required by law	Retained to evidence consent and comply with law

De-identification. We apply de-identification on a limited-scope basis to certain uploaded medical-record extracts, but we do not de-identify genetic or variant data, we cannot guarantee de-identification of information you volunteer in free-form chat, and we deliberately retain absolute diagnosis and treatment dates for clinical-trial matching. For these reasons, we do not represent that the data we process is fully anonymized or de-identified within the meaning of applicable law, unless it has been treated in accordance with the applicable legal standard, which may require a documented expert determination that the risk of re-identification is very small. Where we do create de-identified data, we maintain it only in de-identified form, we publicly commit not to attempt to re-identify it, and we require recipients to do the same.

12. Security

We implement administrative, technical, and physical safeguards that are commercially reasonable in light of the nature and volume of the data we process, and that are designed to protect consumer health data against unauthorized access, use, disclosure, alteration, or destruction. These safeguards include encryption of data in transit and at rest, access controls, and monitoring. We restrict access to consumer health data to those of our personnel, processors, and contractors for whom access is necessary to provide the Service or to further the purposes for which you gave consent, and we bind those parties to confidentiality obligations. No method of transmission or storage is perfectly secure, and we cannot guarantee absolute security.

13. Data Breach Notification

If we become aware of a breach of security involving your consumer health data, we will notify you and applicable authorities as required by law, including, where applicable, the Federal Trade Commission’s Health Breach Notification Rule and state breach-notification laws. We will provide notice without unreasonable delay and within the timeframes required by the applicable law.

14. Children and Pediatric Use

The Service is intended for use by adults. We recognize, however, that the Service may be used to support care for patients with pediatric cancers and other conditions. A parent or legal guardian may create and use an account on behalf of a minor child and may provide the child’s consumer health data in that capacity, and by doing so represents that they have the authority to act on the child’s behalf. The Service is not intended for direct, unsupervised use by minors, and we do not knowingly permit minors to create their own accounts. We do not use a minor’s consumer health data for targeted advertising and do not sell it. Where a child is under 13, we handle any online collection consistent with the Children’s Online Privacy Protection Act.

15. Processors and Service Providers

We engage processors and service providers to perform functions on our behalf. We bind them by written contract to process consumer health data only on our documented instructions, to maintain confidentiality and appropriate security, to assist us in fulfilling your rights and our obligations, to engage sub-processors only under equivalent terms, and to delete or return consumer health data at the end of the engagement. A processor that processes consumer health data outside our instructions becomes independently responsible for that processing under applicable law.

16. Changes to This Policy

We may update this Health Data Policy from time to time. When we do, we will revise the “Last Updated” date above and post the updated policy at the separate, distinct link where this policy is maintained. Where required by law, we will obtain your consent before materially changing how we use or share previously collected consumer health data, and we will not apply a new or materially different use to previously collected consumer health data retroactively without first obtaining your consent. Prior versions are available on request.

17. Relationship to Other Terms; Contact

This Health Data Policy supplements the Privacy Policy and the Terms of Service. The Terms of Service govern your use of the Service and contain important provisions, including limitation of liability, mandatory arbitration, and a class-action waiver, which are incorporated by reference and are not repeated in this Health Data Policy. To the extent those provisions apply to a dispute concerning consumer health data, they are governed by the Terms of Service.

Contact and complaints. Questions about this Health Data Policy, and requests to exercise your rights, may be directed to support@yugabio.com. If you are not satisfied with our response, you may have the right to contact the Attorney General or privacy regulator in your state.