Profile Health, Inc.
Effective Date: September 9, 2026

What This Document Is

You have already agreed to the Terms of Service, which let us run your genomic analysis and give you your results. That is everything you need. You are done, and you will receive your full Reports.

This is a separate, optional request. We are asking whether we may keep your sequence data on file and use it, without your name attached, for purposes beyond delivering your own results — improving our analysis, developing models that relate genetic variation to health, and research we may publish. All of it happens inside Profile Health. We are not asking to give your data to anyone else, because we do not do that.

You can say no. Your Service, your Reports, your price, and your support are identical either way. We will not ask you again unless you ask us to, and we will not make the decline path harder than the accept path.

Please take your time. If you would like to think about it, you can skip this now and tell us later at support@profilehealth.com.

Before You Decide: Five Things You Should Understand

1. Genetic data cannot be fully anonymized.

We remove your name and contact details before using data for any of the purposes below, we keep it inside Profile Health, and we bind the small number of vendors who host it never to attempt re-identification. That meaningfully reduces risk.

It does not eliminate it. Your genome is unique to you. Researchers have repeatedly shown that genomic data can be matched back to individuals using public genealogy databases — including for people who never took a genetic test, through their relatives. Any company that tells you de-identification makes genomic data anonymous is overstating what the science supports. We would rather tell you the truth and let you decide.

2. A model trained on your data cannot fully "untrain" it.

If you give this permission and later change your mind, we will stop using your data, remove it from our training sets, and delete it. But a model that has already been trained retains a statistical influence from the data it learned on, and there is no reliable method to remove that. We cannot promise to reverse it.

This is the most important limitation in this document. It is the reason to treat this as a more permanent decision than most of the choices you make in your account, and the reason we describe it here rather than in a footnote.

3. Your genome is partly your family's.

Research using your data may produce findings that apply to your biological relatives, who have not been asked. This is inherent to genetics, not something we can design away.

4. You will not be paid, and you will not own what results.

If research or model development that your data contributes to leads to a commercially valuable product, you have no ownership in it and no right to any share of it. We are stating this plainly because it is a real consequence, not a formality.

5. Saying yes now does not mean saying yes forever.

You can withdraw at any time by writing to support@profilehealth.com. Withdrawal takes effect immediately for future use, and we complete deletion within 30 days.

The Permission

☐ Yes — keep my sequence data on file and use it, de-identified, to improve Profile Health's analysis and research.

This is one permission covering the four uses below. Ticking the box grants all four. Leaving it unticked grants none of them, and costs you nothing.

We have grouped them because they are one continuous activity rather than four separate ventures: the first makes the other three possible, and the last three are the same work — learning from genomes — at successive stages. Separating them on the page would suggest they can be pulled apart in practice more cleanly than they can.

1. Keeping your sequence data on file

We retain your raw sequence data (your FASTQ files) for as long as your account is open and this permission stands, rather than deleting it after your Reports are delivered.

Why this matters to you: we can re-run your genome against new genes, new findings, and improved methods without you providing another sample.

If you decline: we delete your raw sequence data 12 months after delivering your Reports. You keep your Reports and your variant calls, and we will remind you before deletion so you can download your raw data first. Later reanalysis beyond the variant data we still hold would require a new sample.

Duration: while your account is open, unless you withdraw. Not indefinite — retention is tied to your account and your permission, both of which you control.

2. Finding and fixing errors in how variants are interpreted

We use your de-identified genetic data and health information to improve the accuracy of our variant classification, our polygenic scoring, and our interpretive content.

What this means concretely: if our pipeline calls a variant one way and later evidence shows a better call, your data helps us find and fix that class of error. If our polygenic scores perform poorly for people of a particular ancestry, your data helps us measure and correct that.

If you decline: we still verify that your analysis was performed correctly. That quality check is part of delivering your Service and does not depend on this permission.

3. Developing models that relate genetics to health

We include your de-identified genetic data and health information in datasets used to develop, train, validate, and evaluate machine-learning models — including models that relate genetic variation to health-related traits and outcomes, and the software and models we build for clinicians.

Please re-read point 2 above before ticking the box. This is the use that withdrawal cannot fully undo.

What we will not do with these models:

• We will not use any model to generate predictions or inferences about you specifically for any purpose other than delivering a Service you requested.

• We will not sell or license model access to insurers or employers.

• We will not use your data to train models for advertising or marketing.

On request, we will tell you which models, if any, were trained on data including yours.

4. Research we may publish

We include your de-identified data in scientific research intended to contribute to general knowledge, including research we may publish in peer-reviewed journals or present at scientific meetings.

What gets published: summary statistics and group-level findings. Never your individual genome, and never anything identifying you.

Review: research under this permission is reviewed by an independent review board — currently Advarra — before it begins.

One limitation to understand: research already completed or published before you withdraw cannot be undone or retracted. Withdrawal stops your data being used in any study beginning more than 30 days after you withdraw.

If you want some of these but not others

You do not have to take all four to give us anything. If you would like to permit some and not others — most commonly, keeping your data on file for your own reanalysis without contributing it to model development — write to us at support@profilehealth.com and we will record a limited permission and confirm it to you in writing. We will honour it exactly as recorded.

We do not put this on the screen as a set of separate boxes because, for almost everyone, this is one decision. But it is your data, and the box is not the only way to answer.

What Applies No Matter What You Choose

These are commitments, not permissions. They apply to every patient regardless of what you decide here.

• We will never sell your genetic data. Not under any definition of "sell," including exchange for anything of value.

• Your genetic data stays inside Profile Health. We do not license, transfer, or otherwise give your genetic data — identified or de-identified — to any outside company, research partner, university, or pharmaceutical firm. The only outside parties who ever touch it are the sequencing laboratory that produces it and the infrastructure vendors that store it under contract, and neither may use it for anything of their own. There is nothing on this page that would let us do otherwise, because we are not asking for it.

• We will never give your genetic data to an insurer or an employer.

• We will never use your genetic data for advertising or marketing.

• We require a search warrant before disclosing genetic data to law enforcement, we resist overbroad demands, and we do not permit law enforcement searching of our database or participate in investigative genetic genealogy.

• We will not transfer your data in a sale or bankruptcy unless the acquirer agrees in writing to be bound by these same commitments and by your election as it stands today — and we will notify you before it happens so you can delete first.

• We will not broaden these terms retroactively. If we want to do something this permission does not cover, we will ask you specifically. Declining costs you nothing.

• We will not retaliate. Your Service, your price, your results, and your support do not depend on anything on this page.

How to Withdraw

By email: support@profilehealth.com — one message is enough. No form, no phone call, no retention offer, no "are you sure" gauntlet. We confirm in writing within 5 business days.

By mail: Privacy Officer, Profile Health, Inc., 434 Sausalito Blvd, Sausalito, CA 94965

What happens: withdrawal takes effect immediately for future use. We remove your data from the relevant datasets and complete deletion within 30 days, and confirm to you in writing. Section 8.4 of our Privacy Policy explains the one thing withdrawal cannot undo.

8. If the Patient Is Under 18

8.1 This permission is not offered for patients under 18, and a parent cannot give it on a child's behalf. A minor's data is used only to deliver their analysis and their Reports. It is not used to improve our analysis, is not included in any dataset used to develop models, and is not included in research.

We made this choice on purpose. A parent can decide whether their child should have a genetic test. We do not believe a parent can meaningfully decide, on a child's behalf, that the child's genome should permanently shape a commercial model the child will never be able to withdraw from. That decision belongs to the person whose genome it is, once they can make it.

Because there is nothing to elect, this document is not presented during a pediatric activation at all.

8.2 Retention while the patient is a minor. We retain a minor patient's raw sequence data for one purpose only — so that their own genome can be re-run as new genes and findings are added, without another sample. It is not used for anything else, and no permission on this page applies to it.

• Retention is never indefinite.

• Raw sequence data is deleted 90 days after the patient reaches the age of majority, unless the patient, now an adult, gives this permission for themselves.

• For patients under 13, a written retention schedule with a specific deletion date applies to every category of data, as federal law requires.

8.3 At the age of majority. We will contact the patient (and, before that date, the parent) to explain that the account is now theirs, that they may give this permission for themselves, that they may elect to receive any findings we withheld during childhood after being offered genetic counseling, and that they may delete everything. If we cannot reach them, the deletion in 8.2 proceeds.

8.4 If a patient gives this permission as an adult, it applies to their data from that point forward. It does not reach back: data used to deliver their childhood Reports was never in any dataset, and nothing is retroactively added to one.

9. Maryland Residents

Maryland law restricts the processing of genetic data to what is strictly necessary to provide the service you requested, regardless of consent, and prohibits the sale of sensitive data outright.

Accordingly, we do not offer this permission to Maryland residents. If you are a Maryland resident, your genetic data is used only to deliver your analysis and your Reports. You receive the identical Service. There is nothing for you to decide on this page.

Signature

I have read this document. I understand that:

• I did not have to agree to it to receive my results;

• ticking the box grants all four uses described above, and I may instead ask for a limited permission;

• I can withdraw at any time;

• de-identified genetic data is not fully anonymous;

• withdrawal cannot fully reverse model development; and

• I will not be compensated for, and will not own, anything developed using my data.

I make the election I have marked above.

Patient name

____________________

Date of birth

____________________

Signature

____________________

Date

____________________

This document is not presented for patients under 18. See Section 8.

Consent version: 2.0 · Recorded: {{recorded_at}} · A copy has been sent to your email.

Questions

Privacy Officer, Profile Health, Inc. 434 Sausalito Blvd, Sausalito, CA 94965 · support@profilehealth.com · 802-318-6017

If you would like to talk to a genetic counselor before deciding, we will arrange it at no cost. Ask at support@profilehealth.com.