Genpath.ai, LLC d/b/a HelixaHealth.ai

Effective Date: September 15, 2026

Version: 1.0

This Privacy Policy explains how Genpath.ai, LLC d/b/a HelixaHealth.ai (“Helixa,” “we,” or “us”) collects, uses, discloses, and protects your information, with particular attention to genetic data. It supplements the Genetic Testing Informed Consent and Data Authorization (the “Consent”), which governs your specific authorizations. Where the Consent and this Policy address the same subject, the Consent controls as to the authorizations you gave.

1. Who We Are

Helixa sells genetic testing kits and delivers results and related insights. The laboratory analysis is performed by Dynamic DNA Laboratories, an independent laboratory. After analysis, your genetic raw data and results are returned to Helixa for further processing to produce your reports. Because Helixa offers this service directly to consumers and is not acting as a HIPAA-covered healthcare provider or health plan in this transaction, the information you provide is protected under this Policy and applicable consumer-privacy and genetic-privacy laws rather than under HIPAA, based on Helixa's current business model. If Helixa's role changes in a way that would make HIPAA applicable, we will update this Policy and the Consent accordingly. Helixa also offers optional features that let you upload additional health records and connect a wearable device, each described further in Section 2A and in our separate Wearable Device and Connected Health Data Consent Agreement.

2. Information We Collect

• Account and contact information, such as your name, email, shipping address, and password.
• Order and payment information, processed through our payment provider.
• Intake information required for testing, such as age, sex, and the fields required by the laboratory.
• Genetic data - the raw genetic data and test results returned to Helixa by Dynamic DNA.
• Usage and device information collected automatically when you use the platform, including cookies and similar technologies. We also collect your IP address, which we use, among other purposes, to estimate your approximate location so we can determine which features are available to you, as described in Section 16.

2A. User-Uploaded Health Records

If you choose to use this optional feature, you may upload additional health-related documents to your Helixa account, such as laboratory reports, genetic testing reports from third-party providers, and medical prescriptions (“Uploaded Health Records”). Uploading Uploaded Health Records is voluntary; declining to upload this information will not affect your ability to use Helixa's core services. Uploaded Health Records may include highly sensitive information, including diagnoses, medications, and information originating from a third-party healthcare provider or laboratory. We use Uploaded Health Records only as you direct, including to generate the Combined Insights described in Section 6A, and we apply the same administrative, technical, and physical safeguards described in Section 8 to Uploaded Health Records as we do to your genetic data. You may delete Uploaded Health Records you have previously provided at any time through your account settings or by contacting privacy@helixahealth.ai. Before you upload health records, or genetic data you obtained elsewhere, we obtain your separate, affirmative consent through the Uploaded Health Records and Uploaded Genetic Data Consent Agreement, which governs that feature and which you may withdraw at any time.

Analysis of Uploaded Genetic Data. If you upload genetic data you obtained from a source other than Helixa’s own testing service (for example, raw data or a report from another consumer genetic testing company), you authorize Helixa to receive, store, and analyze that genetic data, using the same systems Helixa uses to analyze genetic data obtained through Dynamic DNA, in order to generate reports and insights for you. Because Helixa did not collect this genetic data through its own laboratory process, Helixa does not verify its accuracy, authenticity, or chain of custody, and cannot confirm that it corresponds to you; any reports or insights Helixa generates from uploaded genetic data are only as reliable as the data you provide, and are subject to inherent analytic and clinical limitations: no genetic test is completely accurate, results can include false positives and false negatives, and a negative result does not eliminate risk. Helixa’s other commitments regarding genetic data - including that we do not sell it, do not use it for advertising, do not use it to train or improve machine-learning models, and apply the safeguards described in Section 8 - apply equally to genetic data you upload, and you may delete it at any time as described above.

3. How We Use Information

We use your information to fulfill and support your order; to generate, interpret, and deliver your results; to provide customer service; to secure and improve the platform; to communicate with you about your order and results; and to meet legal, tax, and audit obligations. We use your genetic data only to provide the services you requested and as otherwise described in this Policy and the Consent.

4. Consent

We rely on the consents you provide in the Consent to collect, use, and disclose your genetic data. Where applicable law requires separate, express consent before genetic data is transferred to certain third parties, retained beyond initial testing, or used for research or marketing, we obtain that consent separately, and you may withdraw it at any time without affecting testing already performed.

5. How We Share Information

We share information only as needed to operate the service and as required by law:

• With Dynamic DNA, to fulfill and process your order;
• With service providers who operate parts of our platform under contract (for example payment processing, hosting, and shipping), limited to what each needs and bound by confidentiality and data-protection obligations;
• Where legally compelled by valid legal process, or to protect rights, safety, or security; and
• In a business transfer, subject to Section 12; and With a healthcare provider or genetic counselor of your choosing, but only at your direction. We do not share your genetic data or results with any corporate affiliate; if this changes, we will update this Policy and, where required by law, obtain your consent first.

We do not sell your genetic information, do not use it for advertising, do not share it for cross-context behavioral advertising, and do not disclose it to data brokers. We do not disclose your genetic data to insurers or employers, and we do not provide it to law enforcement absent valid legal process.

6. Automated Processing; No Model Training

We use automated systems, which may include machine-learning models, to generate and interpret your results. We do not use your genetic data to train or improve machine-learning models. This commitment applies regardless of whether you have opted in to the optional research use described in the Consent; de-identified genetic data contributed under that opt-in is not used to train or improve machine-learning models absent a separate, specific disclosure and opt-in for that purpose. Your genetic data is used only to produce the results and insights you purchased and as otherwise described in this Policy.

6A. Combined AI Health Insights

Where you have connected a wearable device under our separate Wearable Device and Connected Health Data Consent Agreement, or have provided Uploaded Health Records under Section 2A, and you have given the separate, additional opt-in consent described in the Wearable Device and Connected Health Data Consent Agreement or, where you have uploaded health records without connecting a wearable device, in the Uploaded Health Records and Uploaded Genetic Data Consent Agreement, our automated systems, which may include artificial intelligence models, may combine that data with your genetic data to generate additional insights for you (“Combined Insights”). We do not generate Combined Insights unless you have given that separate consent, which is distinct from your acceptance of this Policy. Combined Insights are educational and informational only; they are not a medical diagnosis or treatment recommendation, do not create a physician-patient relationship, and are not a substitute for professional medical advice. You should talk to a qualified healthcare provider before making a health-related decision based on a Combined Insight. Consistent with Section 6, we do not use Uploaded Health Records or wearable data, individually or combined with your genetic data, to train or improve machine-learning models. You may decline Combined Insights by withholding that separate consent, and you may withdraw it at any time without affecting your ability to use Helixa’s other features. You may also delete your Uploaded Health Records under Section 2A or disconnect your wearable device as described in the Wearable Device and Connected Health Data Consent Agreement.

7. Data Retention and De-Identification

We retain your information for as long as your account remains active and as needed to meet legal, tax, and audit obligations, and thereafter we delete or de-identify it. When we de-identify data, we use measures reasonably designed to prevent its association with you using a methodology consistent with recognized frameworks such as the HIPAA Safe Harbor or Expert Determination methods, adapted to our context; de-identified data may retain a low residual risk of re-identification, we do not attempt to re-identify de-identified data except as permitted by law to test our de-identification, and we contractually require any recipient of de-identified data to maintain it in de-identified form and not to attempt re-identification. The laboratory’s retention of your physical sample is governed by the laboratory’s consent. We retain account and order information for the life of your account and up to seven (7) years thereafter for tax and audit purposes; genetic raw data and results are retained for the life of your account unless you request earlier deletion. “Anonymize” or “anonymization” means processing data so that re-identification is not reasonably possible by any party, including us, and anonymized data is not personal information under applicable law.

8. Data Security and Breach Notification

We maintain administrative, technical, and physical safeguards designed to protect your information, including encryption in transit and access controls limiting who may view genetic data. No system is perfectly secure. If a breach affecting your information occurs, we will notify you and the authorities as required by applicable law. Because our services may involve genetic and other health-related information, we comply with the FTC’s Health Breach Notification Rule (16 C.F.R. Part 318) in addition to applicable state breach-notification laws, including notifying affected individuals without unreasonable delay and in any event within sixty (60) calendar days of discovery, and notifying the Federal Trade Commission within the timeframe the Rule requires.

For residents of the United Kingdom, we will also notify the Information Commissioner’s Office (ICO) of a qualifying personal data breach without undue delay and, where feasible, within seventy-two (72) hours of becoming aware of it, and will notify affected individuals without undue delay where the breach is likely to result in a high risk to their rights and freedoms, as required under the UK GDPR. For residents of India, we will also notify the Data Protection Board of India and affected Data Principals of a personal data breach in the manner and within the timeframe prescribed under the Digital Personal Data Protection Act, 2023 and its rules.

9. Your Rights

Subject to applicable law and legitimate recordkeeping obligations, you may access, correct, delete, and (where applicable) port your information; withdraw consent; and request that the laboratory destroy your sample. When we receive a deletion request we can verify, we will complete it within forty-five (45) days, with one permitted extension of up to an additional forty-five (45) days for complex requests where the law allows, and we will confirm when it is done. To exercise these rights, contact privacy@helixahealth.ai. California residents: your genetic data, health-related information, and certain other information we collect are “sensitive personal information” under the California Consumer Privacy Act, as amended. We use and disclose sensitive personal information only for the limited business purposes described in this Policy and do not use it to infer characteristics about you for unrelated purposes; because we do not use or disclose sensitive personal information beyond these limited purposes, California law does not currently require us to offer a separate “Limit the Use of My Sensitive Personal Information” option, and if this changes we will provide that option. You may use an authorized agent, and where a state law provides a right to appeal a denied request, we will provide an appeal mechanism.

10. State-Specific Disclosures

California

Under the California Genetic Information Privacy Act (GIPA) and the California Consumer Privacy Act, as amended (CCPA/CPRA), California residents have the rights described above, including the right to delete genetic data, to have the biological sample destroyed, and to be free from discrimination for exercising these rights. We do not sell or share personal information as those terms are defined under the CCPA.

Illinois

Under the Illinois Genetic Information Privacy Act, we will not disclose your genetic testing information except with your written authorization or as otherwise permitted by that Act, and we obtain the consents that Act requires before disclosure.

Other states

Residents of other states with consumer-privacy or genetic-privacy laws have the rights those laws provide, which we honor where they apply. In addition to the California and Illinois disclosures above, residents of Alabama, Arizona, Florida, Kentucky, Louisiana, Maryland, Montana, Nebraska, South Dakota, Tennessee, Texas, Utah, Virginia, Wyoming, and any other state with a genetic-privacy or comprehensive consumer-privacy statute that applies to Helixa have the rights that statute provides, which we honor regardless of the state in which you reside. If you are a Washington or Nevada resident, or are physically present in Washington or Nevada when you use our services, our collection, use, and sharing of your consumer health data, including genetic data, is additionally governed by Washington’s My Health My Data Act or Nevada’s consumer health data law, as applicable, and by our separate Consumer Health Data Privacy Policy; we do not collect consumer health data beyond what is strictly necessary to provide the product or service you requested without your separate, valid authorization.

India

If you are located in India, the Digital Personal Data Protection Act, 2023 (“DPDPA”) governs Helixa’s processing of your personal data, including your genetic data, as a Data Fiduciary. In addition to the rights described in Section 9, the DPDPA gives you the right to withdraw consent at any time as easily as you gave it, the right to have your grievances redressed by Helixa’s Grievance Officer before approaching the Data Protection Board of India, and the right to nominate another individual to exercise your rights under the DPDPA in the event of your death or incapacity. Helixa’s Grievance Officer may be contacted at privacy@helixahealth.ai.

United Kingdom

If you are located in the United Kingdom, the UK General Data Protection Regulation and the Data Protection Act 2018 (together, “UK GDPR”) govern Helixa’s processing of your personal data. Your genetic data is “special category data” under Article 9 of the UK GDPR, and we process it on the basis of your explicit consent, which you may withdraw at any time. You have the rights of access, rectification, erasure, restriction, portability, and objection under the UK GDPR, and the right to lodge a complaint with the Information Commissioner’s Office (ICO) at ico.org.uk. Consistent with Section 6A, our use of automated systems to generate Combined Insights does not involve a decision producing a legal or similarly significant effect concerning you without appropriate human involvement; you have the right under Article 22 of the UK GDPR not to be subject to such a decision based solely on automated processing.

11. Genetic Non-discrimination

The federal Genetic Information Non-discrimination Act (GINA) restricts the use of genetic information by health insurers and employers. Its protections are limited and do not cover life, disability, or long-term-care insurance. State law may provide additional protection. Consider these limits before sharing your results with third parties.

12. Business Transfers and Insolvency

If Helixa is involved in a merger, acquisition, financing, reorganization, sale of assets, or bankruptcy, your information may be transferred as part of that transaction only to a successor that agrees to be bound by commitments no less protective than those in this Policy and the Consent. We will notify you before your genetic data would become subject to a materially different privacy practice, and you will have the opportunity to delete your data and direct destruction of your sample beforehand. We will not sell or transfer your genetic data as a standalone asset stripped of these commitments.

13. Law Enforcement and Third-Party Requests

We require valid legal process before disclosing personal information or genetic data in response to a government or third-party request, we review requests for legal sufficiency, and we seek to narrow or challenge requests that are overbroad or improper. We do not voluntarily provide genetic data to law enforcement.

14. Children

The services are intended for adults. We test a person under eighteen (18) only with the consent of a parent or legal guardian, and we do not knowingly collect information from a child except through that parent or guardian. The Helixa platform is not directed to children under thirteen (13) and we do not knowingly collect personal information directly from a child under thirteen through the platform, consistent with the Children's Online Privacy Protection Act. Where a minor is tested, the minor does not create their own account or interact directly with the platform; their parent or legal guardian creates and controls the account, provides all information, and receives all results. If you are located in India, the Digital Personal Data Protection Act, 2023 requires verifiable parental or guardian consent before we process the personal data of anyone under the age of eighteen (18), not only children under thirteen (13), and we obtain that consent before processing the data of any user in India who is under eighteen.

15. Cookies and Tracking

We use cookies and similar technologies to operate the platform, remember preferences, and measure usage. You can control cookies through your browser settings. We use essential cookies to operate the platform, functional cookies to remember your preferences, and, where disclosed to you at collection, analytics cookies to measure usage. We also use advertising cookies, and you may opt out through the cookie banner or by using your browser’s controls. We honor Global Privacy Control signals as a valid opt-out request where applicable law requires.

If you are located in the United Kingdom, the Privacy and Electronic Communications Regulations (PECR) require your prior opt-in consent before we set non-essential cookies (including functional and analytics cookies) on your device, other than cookies that are strictly necessary to operate the platform. We obtain that consent through the cookie banner presented to United Kingdom visitors before any non-essential cookie is set, and you may withdraw it at any time through the cookie banner or your browser controls.

16. Countries Where We Operate

The Helixa platform is offered in the United States, India, and the United Kingdom, and is intended for residents of those countries. Which features are available in each country varies, and kit ordering in particular remains subject to the regulatory confirmations described in Section 5 of the Terms of Service. The services are offered subject to the country-specific provisions of Section 10 above, this Section 16, the Consent, and the Wearable Device and Connected Health Data Consent Agreement. Kits are not available to residents of New York, and we do not offer the services where prohibited by law. If you are located in India or the United Kingdom, using the services necessarily involves transferring your personal information, including your genetic data, to Helixa’s servers and personnel in the United States; for India, this transfer is made in reliance on the Digital Personal Data Protection Act, 2023, which permits transfer of personal data outside India except to countries the Central Government restricts (the United States is not currently restricted); for the United Kingdom, this transfer is made using the UK Extension to the EU-U.S. Data Privacy Framework (the “UK-U.S. Data Bridge”) or another transfer mechanism recognized under UK data protection law.

Within the countries where the Helixa platform operates, not every feature is available in every location - for example, whether kit ordering through Dynamic DNA is offered to you depends on where you are located. Section 5A of the Terms of Service explains, in general terms that apply regardless of which countries the platform operates in at a given time, how feature availability works and how we determine your location for this purpose.

17. Changes to This Policy

We may update this Policy. Material changes will be communicated, and the version in effect when you provided your information governs that information unless you agree to an updated version.

18. Contact

Genpath.ai, LLC d/b/a HelixaHealth.ai, 9238 Diamond Pointe Drive, Indianapolis, IN. Email: privacy@helixahealth.ai. Helixa's Privacy Officer is responsible for this Policy and can be reached at the address above.

End of Privacy Policy.