Privacy Policy

This Privacy Policy explains how Elysium Health, Inc. (“Elysium Health”, “we”, “our”, or “us”) collects, uses, processes, and discloses your personal data in connection with (i) our websites, www.elysiumhealth.com and www.elysiumhealthrx.com, social media sites and other platforms, and online services; and (ii) products or services we offer, the mobile apps, software, platform and all other relevant services and products provided and offered by us and our affiliates, which link to this Privacy Policy (collectively the “Sites”, “Products”, or “Services”).

This Privacy Policy does not address our privacy practices relation to Elysium Health job applicants, employees and other employment-related individuals, nor data that is not subject to applicable data protection laws (such as deidentified or publicly available information). This Privacy Policy is also not a contract and does not create any legal rights or obligations not otherwise provided by law.

We reserve the right to modify this Privacy Policy at any time. If we make any material changes to our Privacy Policy, we will provide prominent notice on the Sites or through other appropriate means. We encourage you to periodically review the Privacy Policy for any modifications. You can determine when this Privacy Policy was last revised by referring to the date it was “last updated” above. All changes will be effective from the “last updated” date unless otherwise indicated.

We may choose or be required by law to provide different or additional disclosures relating to the processing of personal data about residents of certain US states. Please refer to our Additional United States Privacy Disclosures below for additional disclosures that may be applicable to you. For information about our privacy practices with regard to consumer health data, please see our Consumer Health Data Privacy Policy.

Our Role in Processing Personal Data

Data protection laws sometimes differentiate between “controllers” and “processors” of personal data. A “controller” determines the purposes and means (the why and how) of processing personal data. A “processor,” which is sometimes referred to as a “service provider,” processes personal data on behalf of a controller subject to the controller’s instructions.

This Privacy Policy describes our privacy practices where we are acting as the controller of personal data. However, this Privacy Policy does not cover or address how healthcare providers we work with, including Beluga Health, P.A., may process personal data when they provide telehealth services to you, or how we may process personal data on their behalf in accordance with their instructions where we are acting as their processor. As a result, we recommend referring to the privacy policy of the healthcare provider with which you have a relationship for information on how they engage processors, like us, to process personal data on their behalf. The Beluga Health Privacy Policy is available here. In addition, we are generally not permitted to respond to individual requests relating to personal data we process on behalf of independent healthcare providers, so we recommend directing any requests to the relevant provider.

II. Personal Data Collection

What Personal Data Do We Collect Directly?

When you visit and interact with our Sites (including when you make a purchase through our Sites), we may collect some or all of the following personal data directly from you as you use our Sites or Products:

Account Information

Such as name, address, telephone number, email address, date of birth, purchase and ordering history, payment information, and other information you provide during account registration or when purchasing the Products. We use this information to contact you, respond to your inquiries, provide you with requested Products and Services, and otherwise facilitate your access to our Sites, Products, and Services by setting up and administering your account.

Payment Information

When you purchase our Products, we may collect payment card information, billing address, and other financial information (such as routing and account number). Please note that we use third-party payment providers to process payments made to us. We do not retain any personally identifiable financial information, such as payment card number, which you provide to the third-party payment provider. The payment provider’s use of your personal data is governed by its own privacy notice here.

Test Information

When you purchase, access, and use our at-home test or diagnostic products, including Index, its accompanying saliva kit, and all the related platforms, applications and services (“Elysium Test”), you provide the following Test Information:

• Sample Information. To access or use the Elysium Test, you must purchase, or receive as a gift, a testing kit, create an online account and register your kit, and ship your sample (such as a saliva sample) to our partner laboratory and third-party service providers (“Laboratory”). “Sample Information” refers to your sample and your DNA and other data extracted by the Laboratory from your sample for analysis.
  • Genetic Information. “Genetic Information” refers to the genetic and/or epigenetic data including those generated through processing of your sample by us or by the Laboratory, our contractors, vendors, successors, or assignees, or otherwise processed by and/or contributed to us and includes the results reported to you as part of the Products.
  • Test Results. “Test Results” refer to the results and other data obtained and generated from using the Elysium Test (e.g., biological age, system age scores, cumulative rate of aging, etc.).

Health Information

We may process health information you share about your health-related conditions, symptoms, experiences, diagnoses, testing, or treatments, depending on the way in which you interact with our Sites, Products, or Services, such as product purchases.

Research Information

From time to time, we may engage in a wide variety of research, study and observation internally or in collaboration with third parties and ask you to provide personal data, for such research purposes via, for example, a survey or questionnaire.  Such personal data may include: your ethnic origins, ancestry, demographics, personal traits, physical features such as eye color, behavioral information such as exercise habits, health conditions or other health-related information, your family history of those conditions, medical history, known genetic mutations in you or your family members, lifestyle information, etc.

Self-Report Information

Elysium Health may ask you to provide personal data at various times and places (e.g., when you register your Elysium Test on the Site), or you may voluntarily provide certain Information to us (e.g., when you participate in our market campaign). In some cases, if you choose not to provide us with the requested Information, you may not be able to access all of the Site or participate in all of its features.

User Content

This includes information that you create or content that you post or upload on our Site, social media, or public forums that relate to us, such as blogs, data, text, software, documents, audio, photographs, graphics, video, messages, discussions, comments, emails, or other materials that you create or provide to us through public or private transmissions. Note that the publication of your content on social media or other public platforms will depend on your chosen privacy settings with the provider. By posting publicly on our social media pages or other public forums, other users may reshare or redistribute that content both on and off the services. By posting, you are directing us to disclose that information as broadly as possible and directing those who access the content to do the same.

Feedback and Support Information

When you contact us via the contact methods we provide, such as phone and email, we will collect the content of your communications and we may, where permitted by law, record those communications (including calls, and through the use of automated tools provided to us by third-party providers). We use this information primarily to investigate and respond to your inquiries and to communicate with you.

If you choose to contact us, we may need additional information to fulfil your request or respond to your query. We may provide additional privacy disclosures where the scope of the request we receive or personal data we require fall outside the scope of this Privacy Policy. In that case, the additional privacy disclosures will govern how we process the information you provide at that time.

What Personal Data Do We Collect Automatically?

We and our third-party partners may use cookies, web beacons/pixel tags, and other technology (collectively “cookies”) to automatically collect information about you when you visit our Site or interact with us.

A “cookie” is a small text file that a website’s server places on a computer’s web browser. When we use the term “cookie” in this Privacy Policy we are also referring to other tracking technologies, such as web beacons, pixels, embedded scripts, mobile SDKs, location identifying technologies, and logging technologies. The information we and our third-party partners collect from these cookies may be combined with other personal data we collect directly from you or receive from other sources.

We and our third-party partners collect the following data automatically when you use our Sites, Products, or Services:

• Information about your device and network, including browser type and version, operating system, user language, ISP, manufacturer and model, IP address, and unique identifiers associated with you, your device, or your network (including, for example, a persistent device identifier or advertising ID). We employ third-party technologies designed to allow us to recognize when two or more devices are likely being used by the same individual and may leverage these technologies (where permitted) to link information collected from different devices.
• Information about the way individuals use our Sites, Products, or Services, or otherwise interact with us, including the site from which you came, the site to which you are going when you leave our services, how frequently you access our services, whether you open emails or click the links contained in emails, whether you access our services from multiple devices, and other browsing behavior and actions you take on our services (such as the pages you visit, the content you view, videos you watch, the communications you have through our services, and the content, links and ads you interact with). We employ third-party technologies designed to allow us to collect detailed information about browsing behavior and actions that you take on our services, which may record your mouse movements, scrolling, clicks, and keystroke activity on our services and other browsing, search or purchasing behavior. These third-party technologies may also record information you enter when you interact with our products or services, or engage in chat features or other communication platforms we provide.
• Information about your location, including general geographic location that we and our third-party providers may derive from your IP address.

It is possible that one or more of our Sites that link to the Privacy Policy utilize flash cookies, otherwise known as local shared objects, to store your preferences or display personalized content based upon what you view on our Site. “Flash cookies” use technology to remember settings, preferences, and usage similar to browser cookies but these are managed through a different interface than your browser and are not disabled from your normal browser settings. Cookie management tools provided by your browser will not remove Flash cookies. Please see the last section under Cookies and Tracking for information on how to disable Flash cookies.

By collecting the above categories of personal data automatically we can:

• Better understand how you interact with us or our Site;
• Give you a more personal and optimized online experience by remembering you and tracking your preferences;
• Provide you with cross-context behavioral or targeted advertising;
• Improve our Site and Products or Services;
• Diagnose or fix technology problems;
• Fulfill contracts with our business partners;
• Help confirm receipt of and response to our emails;
• Monitor aggregate metrics such as total number of visitors, traffic, usage, and demographic patterns on our Sites;
• Provide more effective customer service.

We may use the personal data we collect automatically for the same purpose as your other personal data, as set out below. You can limit some of this collection by disabling cookies according to the section under Cookies and Tracking, but please be aware that certain portions of the Sites may not be available to you if you do so. Some data is recorded by our servers, content delivery network and security systems whenever you request a page, and cannot be declined through cookie controls.

What Personal Data do we receive from Other Sources and Third Parties?

We receive the same categories of personal data as described above from the following sources and other parties:

• Social Networking: Certain social media features available on our Sites may be hosted by third party sites. For example, some social networking services allow you to share products and services from our Sites via your social networking profile. If you choose to make use of third party social media services (such as Facebook, Twitter, or LinkedIn), we may receive Information about you, such as your name and email address that you have made available through those services. We encourage you to visit those third party social networking services’ privacy policies and review your privacy settings directly on those services. Any information we receive through third party social media services may be used as described in this policy.
• Advertisers, Influencers, and Publishers: We engage in advertising both on our services and through third-party services. Advertisers, influencers, and publishers may share personal data with us in connection with our advertising efforts. For example, we may obtain information about whether an advertisement on our Services led to a successful engagement between you and a third-party advertiser.
• Business Partners: We may receive your information from our business partners, such as companies that offer their products and/or services as a part of or in connection with our Services. For example, certain of our Products and Services allow our customers to integrate third-party services. If you choose to leverage these third-party service integrations, we may receive confirmation from our business partner regarding whether you are an existing customer of their services.
• Service Providers: Our service providers that perform services on our behalf, such as analytics and certain marketing providers, collect personal data and often share some or all of this information with us. For example, we receive personal data you may submit in response to requests for feedback to our survey providers.
• Other Sources: We may also collect personal data about you from other sources, including publicly available sources, third-party data providers, brand partnerships, or through transactions such as mergers and acquisitions.
• Inferences: We may generate inferences or predictions about you and your health, interests and preferences based on the other personal data we collect and the interactions we have with you.

III. Information Use

How We Use Your Information?

General Use:

We use the personal data we collect for various purposes, including to:

• Create an account with Elysium Health;
• Process purchases of Products or Services from Elysium Health through our Sites or via other means;
• Provide and facilitate the processing of our offers;
• Facilitate customer service, or otherwise make use of our customer support tools;
• Sign-up you up for our updates, notifications and newsletters;
• Facilitate your response to our or our partners’ surveys or polls;
• Facilitate your use of our referral program;
• Facilitate your use or access to the functions, services and pages of our Sites;
• Facilitate your ability to connect, link or “share” our Sites via social networking sites or other third-party sites or products;
• Enable you to provide ratings or reviews of our Products and Services;
• Verify your identity;
• Operate, perform, analyze, maintain and improve the Site, our products and/or services;
• Develop new products and/or services;
• Process, analyze and deliver Test Information of the currently purchased tests and future applications;
• Conduct marketing campaigns and provide targeted advertising;
• Communicate and provide administrative messages, requested information, additional information that may be of interest to you (including updates and reminders to new research, future products, promotions and special opportunities);
• Validate your ability to access and/or use certain products or services that may only be intended for individuals meeting certain eligibility requirements or criteria, such as health care professionals;
• Establish your eligibility for special offers or discounts;
• Determine your qualification for external services from partners;
• Recruit you for internal or external research purposes;
• Perform analytics and conduct customer research;
• Allow you to interact with third party sites, services and products (for example, you can link to or view content from third party sites within our Site, view our content on a third party site, or link to third party devices);
• Administer online surveys, polls or special offers from us or through our third party business partners;
• Obtain and post product reviews, testimonials, and comments;
• Enhance network and information safety, integrity, and security, including prevention of fraud and other unauthorized or illegal activities on our Site;
• Manage our everyday business needs, such as administration of the Site, fulfillment, analytics, fraud prevention, and enforcement of our corporate reporting obligations and Terms of Services;
• Comply with our legal, licensing, and regulatory obligations;
• Bring and defend legal claims;
• Create aggregated or deidentified information that cannot reasonably be used to identify you, which information we may use for purposes outside the scope of this Privacy Policy;
• Detect, prevent, investigate, or provide notice of security incidents or other malicious, deceptive, fraudulent, or illegal activity and protect the rights and property of Elysium Health and others;
• Facilitate business transactions and reorganizations impacting the structure of our business;
• Fulfil any other purpose for which you provide your personal data, or for which you have otherwise consented.

We may also use the Information with your consent or as otherwise required or permitted by law.

Use of Test Information and Research Information:

We understand your test results and health conditions may be sensitive to you, so we will handle such information with care.

We may use your Test Information and Research Information for the purposes described above, but with additional restrictions. Specifically, we will only use such information for research purposes with your consent if you participate in our research. For eligible customers, taking part in our research is completely voluntary, and you can change your mind any time. You may refer to Section IV – Research Consent Form for further details, including how your Test and Research Information may be used in research.

Based on our analysis of your Test Information, Elysium Health may combine your Test Results with certain of your other Information for marketing purposes (including targeted advertising) and to make personalized supplement and lifestyle recommendations to you. These personalized recommendations are not medical decisions, diagnoses, or treatment recommendations.

IV. Information Disclosure

Under Which Circumstances May Your Information Be Shared?

Elysium Health is committed to keeping your personal data confidential as required by law. We may share your Information as permitted by law or as follows:

• With any Elysium Health affiliate, which may only use your personal data for the purposes described in this Privacy Policy;
• With our vendors, contractors, business providers and partners (including Laboratory) as necessary for them to provide their services to us and help us perform, provide, analyze and improve our services and products, including without limitation processing and fulfilling orders, data analytics and storage, as well as for the vendors, contractors, business providers and partners to operate their own businesses;
• Assistance with our own marketing purposes (including targeted advertising);
• With other customers and the general public, where you have chosen to post or communicate with us via social media or other public forum;
• Assistance with our distribution of emails and other communications, fraud prevention services, delivery and logistics, Site improvement and operation, and to accomplish the other purposes for information collection and use described above Sections I and II;
• With ad networks and advertising partners for purposes of serving targeted advertising;
• When we include your de-identified or aggregate Information in the relevant research database or in relevant publications;
• In the event we or any of our affiliates file for bankruptcy, or where there is a transfer of ownership (or assets) in connection with proposed or consummated corporate reorganizations of Elysium Health or any of our affiliates, such as mergers, acquisitions, or sales of business units;
• To comply with legal orders and government requests, or as needed to support auditing, compliance, and corporate governance functions;
• To combat fraud or criminal activity, and to protect our rights or those of our affiliates, users, and business partners, or as part of legal proceedings affecting Elysium Health;
• In response to a subpoena, court order, or similar legal process, including to law enforcement agencies, regulators, and courts in the United States and other countries where we operate;
• With your consent, we may share your personal data with third-party collaborators for research purposes. We may engage in research with third parties like universities, hospitals, health systems, government institutions, or private companies to develop new tests, applications, products or services, validate technologies, or improve existing technologies or processes.
• With your consent for other purposes.

Please note: We do not sell or share mobile numbers or text messaging originator opt-in data and consent with any third party or affiliate for their own marketing or promotional purposes. Messages are delivered by service providers that do not share end user phone numbers with third parties for marketing or promotional purposes. All of the above categories of third-party data sharing exclude text messaging originator opt-in data and consent; this information will not be shared with any third parties, excluding aggregators and providers of the Text Message services, except as needed in connection with a business transaction or reorganization, our legal obligations and rights, or otherwise with your consent or direction (each as described above).

How Will Your Test Information Be Shared?

When we share your Test Information for research, we will de-identify such information by, for example, assigning a random ID. Without your express consent, we will NOT share any of your Test Information to any third parties for research purposes.

V. Research Consent Form

As mentioned above, we may use and share your de-identified personal data for internal and external research purposes with your consent.  You may refer to the Research Consent Form by clicking here for details. If you consent to our use of your personal data for research purposes, we may use and aggregate it and may further use and share such de-identified or aggregated data for research purposes without separately obtaining your explicit consent.

VI. Your Privacy Choices

Withdrawal of Consent and Deletion:

Where we have your consent for the processing of your personal data, (e.g., when you opt-in to receive certain types of marketing communications from us), you may withdraw your consent to by emailing [email protected] or calling (888) 220-6436.

If you withdraw your consent, we will delete your personal data. If your personal data is deleted, you will no longer have access through the Site or Products to your Information. Your withdrawal will not affect the lawfulness of our collection, use, processing and disclosure based on consent before your withdrawal (e.g. your Information will not be removed from ongoing or completed research studies which started before we receive your request to delete your Information). If you choose to delete your account, this process cannot be cancelled, undone, withdrawn, or reversed. When your account is deleted, all associated personal data is deleted and any stored samples are discarded, subject to the following limitations:

• Information Previously Included in Research. The Test Information, Research Information and/or other information that you have previously provided and for which you have given consent to use in our research cannot be removed from completed or in process studies that use that information. Your data will not be included in studies and research that start more than 30 business days after your account is closed (it may take up to 30 business days to withdraw your information after your account is closed).
• Legal Retention Requirements. Elysium Health, Laboratory and our partners/vendors will retain your personal data as required for compliance with applicable legal obligations. Elysium Health will also retain limited information related to your account and data deletion request, including but not limited to, your email address, account deletion request identifier, and record of legal agreements for a limited period of time as required by contractual obligations, and/or as necessary for the establishment, exercise or defense of legal claims and for audit and compliance purposes.
• Other Legally Allowed Purposes. We may also maintain your personal data in order to complete transaction for which your personal data is collected, detect illegal activity, debug to identity and repair errors, exercise right provided by law, or conduct any other activities permitted under the law.

Marketing Emails:

You may choose to opt-out of receiving marketing emails from us by following the instructions contained in any of the commercial e-mails we send. Please note that even if you unsubscribe from marketing email messages, we may still email you non-marketing emails related to your account and your transactions on the Sites. Also, please allow us 15 business days from when the request was received to complete the removal. You may update your account preferences at any time. If you wish to opt-out of receiving offers directly from our third-party business partners, you can follow the instructions in the emails that they send you.

Automated Data Collection Preferences:

Certain of our Services may provide you the ability to adjust your preferences regarding our use of automatic data collection technologies. For example, there is a “Cookie Preferences” manager linked in the footer of our websites that allows you to adjust your preferences regarding certain automatic data collection technologies on the specific website you are visiting for the specific device and browser you are using at that time (which means you will need to change your preferences on each device and browser you use to interact with the specific website you are visiting).

You may be able to utilize third-party tools and features to restrict our use of automatic data collection technologies. For example, (i) most browsers allow you to change browser settings to limit automatic data collection technologies on websites, (ii) most email providers allow you to prevent the automatic downloading of images in emails that may contain automatic data collection technologies, and (iii) many devices allow you to change your device settings to limit automatic data collection technologies for device applications. Please note that blocking automatic data collection technologies through third-party tools and features may negatively impact your experience using our Services, as some features and offerings may not work properly or at all. Depending on the third-party tool or feature you use, you may not be able to block all automatic data collection technologies or you may need to update your preferences on multiple devices or browsers. We do not have any control over these third-party tools and features and are not responsible if they do not function as intended.

To disable “flash cookies,” you can adjust the setting of your Flash player to block Flash cookies using the tools contained in your website storage settings panel. More information can be found on Adobe’s website.

Please be aware, however, that if you turn off cookies, you will not be able to take full advantage of all of our Sites’ features. For example, we will not be able to recognize you as a registered user to allow you access to your account information.

Targeted Advertising Preferences:

We engage third parties to help us facilitate targeted advertising designed to show you personalized ads based on predictions of your preferences and interests developed using personal data we maintain and personal data our third-party partners obtain from your activity over time and across nonaffiliated websites and other services. The data we and our third-party partners use for purposes of facilitating targeted advertising, as well as to provide advertising-related services such as reporting, attribution, analytics, and market research, are primarily collected through the use of a variety of automatic data collection technologies, including cookies, web beacons, pixels, embedded scripts, mobile SDKs, location-identifying technologies and logging technologies. We may share a common account identifier (such as a hashed email address or user ID) with our third-party advertising partners to help link the personal data we and our third-party partners collect to the same person, or otherwise target advertising to an individual on a third-party website or platform.

You may be able to further exercise control over the advertisements that you see by leveraging one or more targeted advertising opt-out programs. For example:

• Device-Specific Opt-Out Programs: Certain devices provide individuals the option to turn off targeted advertising for the entire device (such as Apple devices through their App Tracking Transparency framework or Android devices through their opt out of ads personalization feature). Please refer to your device manufacturer’s user guides for additional information about implementing any available device-specific targeted advertising opt-outs.
• Digital Advertising Alliance: The Digital Advertising Alliance allows individuals to opt out of receiving online interest-based targeted advertisements from companies that participate in their program. Please follow the instructions at https://optout.aboutads.info/?c=2&lang=EN for browser-based advertising and https://www.youradchoices.com/appchoices for app-based advertising to opt out of targeted advertising carried out by our third-party partners and other third parties that participate in the Digital Advertising Alliance’s self-regulatory program.
• Network Advertising Initiative: The Network Advertising Initiative similarly allows individuals to opt out of receiving online interest-based targeted advertisements from companies that participate in their program. Please follow the instructions at https://optout.networkadvertising.org/?c=1 to opt out of browser-based targeted advertising carried out by our third-party partners and other third parties that participate in the Network Advertising Initiative’s self-regulatory program.
• Platform-Specific Opt-Out Programs: Certain third-party platforms provide individuals the option to turn off targeted advertising for the entire platform (such as certain social media platforms). Please refer to your platform provider’s user guides for additional information about implementing any available platform-specific targeted advertising opt-outs.

Please note that when you opt out of receiving interest-based advertisements through one of these programs, this does not mean you will no longer see advertisements from us or on our Services.  Instead, it means that the online ads you do see from relevant program participants should not be based on your interests. We are not responsible for the effectiveness of, or compliance with, any third parties’ opt-out options or programs or the accuracy of their statements regarding their programs. In addition, program participants may still use automatic data collection technologies to collect information about your use of our Services, including for analytics and fraud prevention as well as any other purpose permitted under the applicable advertising industry program.

Partner-Specific Preferences:

Certain of our third-party providers and partners offer additional ways that you may exercise control over your personal data, or automatically impose limitations on the way we can use personal data in connection with the services they provide:

• Device-Specific / Platform-Specific Preferences: The device and/or platform you use to interact with us (such as your mobile device or social media provider), may provide you additional choices with regard to the data you choose to share with us. For example, many mobile devices allow you to change your device permissions to prevent our products and services from accessing certain types of information from your device (such as your contact lists or precise geolocation data), and many social media platforms allow you to change your platform permissions to prevent integrated products and services from accessing certain types of information connected with your profile. Please refer to your device or platform provider’s user guides for additional information about implementing any available platform-specific targeted advertising opt-outs.
• Google Analytics: Google Analytics allows us to better understand how our customers interact with our services.  For information on how Google Analytics collects and processes data, as well as how you can control information sent to Google, review Google's website here: www.google.com/policies/privacy/partners/. You can learn about Google Analytics’ currently available opt-outs, including the Google Analytics Browser Add-On here: https://tools.google.com/dlpage/gaoptout/. We may also utilize certain forms of display advertising and other advanced features through Google Analytics. These features enable us to use first-party cookies (such as the Google Analytics cookie) and third-party cookies (such as the DoubleClick advertising cookie) or other third-party cookies together to inform, optimize, and display ads based on your past visits to our services.  You may control your advertising preferences or opt-out of certain Google advertising products by visiting the Google Ads Preferences Manager, currently available at https://myadcenter.google.com/?ref=help-center.

VII. Other Sites

This Privacy Policy only addresses the collection, use, and disclosure of your personal data by Elysium Health through your visit, use and interaction with our Sites, Products or Services. However, our Sites may contain links to other sites that are not owned or controlled by us, such as social networking sites, third party devices, and links to retailers’ sites and e-commerce sites that sell our Products or Services. The Privacy Policy does not address nor do we control or have responsibility for the policies or practices of any third parties or any third-party sites to which our Sites link. If you provide any information to such third parties, different rules regarding the collection, use and disclosure of your personal data may apply.  We strongly suggest you review such third party's privacy policies before providing any data to them. These other sites may send their own cookies or clear GIFs to users, collect data or solicit personal information.  We cannot control this collection of personal data. You should contact these entities directly if you have any questions about their privacy practices.

VIII. Security

Elysium Health takes appropriate steps to manage the security of your personal data. We have implemented commercially reasonable administrative, technical, and physical security controls that are designed to safeguard your personal data. Still, we cannot completely ensure or warrant that your personal data is 100% secure. If you have any questions about the security of your personal data, you can contact us at [email protected].

IX. Retention Policy

Elysium Health retains your personal data for the period necessary to fulfill the purposes outlined in this Privacy Policy, unless a longer retention period is required or permitted by law or to fulfill a legal obligation. Because these needs can vary for different data types in the context of different services, actual retention periods can vary significantly based on criteria such as user expectations or consent, the sensitivity of the data, the availability of automated controls that enable users to delete data, and our legal or contractual obligations.

For customers purchasing, accessing, and using Index, Elysium Health and the Laboratory store de-identified raw data generated from your saliva samples for 3 months before the samples are destroyed (after we ensure quality control) and we will store your data (including your Test Information) permanently or as permitted by the law, but you may request deletion of your data as set forth under this Privacy Policy at any time.

Elysium Health will also retain limited information related to your account and data deletion request, including but not limited to, your email address, account deletion request identifier, communications related to inquiries or complaints and legal agreements for a limited period of time as required by law, contractual obligations, and/or as necessary for the establishment, exercise or defense of legal claims and for audit and compliance purposes.

X. Children Privacy

Our Sites, services and products are designed and intended for adults. We do not intend to, or knowingly, collect or solicit personal data from children under the age of 18. If we obtain actual knowledge that an account is associated with a registered user who is not at least 18 years old, we will promptly delete information associated with that account. If you are a parent or guardian of a child under the age of 18 and believe he or she has disclosed personal data to us, please contact us at [email protected]. A verified parent or guardian of a child under the age of 18 may review and request deletion of such child’s personal data as well as prohibit the use thereof.

XI. International Users

The Sites (including the relevant Products and services) is only intended for residents in the United States. If you reside in a country outside the United States, please note that the data protection and privacy laws of the United States may not be as protective as the laws in your country.

XII. Contact Us

If you have any questions, comments or complaints about our privacy practices or this Privacy Policy or wish to exercise your rights under the applicable law, please contact us by calling (888) 220-6436, by email at [email protected], or by direct mail at Elysium Health at 434 Broadway, 2nd Floor, New York, NY 10013.

Additional United States Privacy Disclosures

These disclosures supplement the information contained in our Privacy Policy by providing additional information about the privacy rights available to individual residents of certain states in the United States and our personal data processing practices relating to those individuals. For a detailed description of how we collect, use, disclose, and otherwise process personal data, please read our Privacy Policy.

Nevada Residents

If you are a resident of the state of Nevada in the United States, you have the right to opt out of the sale of your personal data. Although we do not currently sell personal data of Nevada residents (as defined under Nevada law), you may submit a request to opt-out of the sale of your personal data by contacting [email protected].

California, Colorado, Connecticut, Delaware, Florida, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Jersey, New Hampshire, Oregon, Rhode Island, Tennessee, Texas, Utah, and Virginia Residents

If you are a resident of one of the above states in the United States the following supplementary disclosures apply to you.

Personal Data Disclosures, Sales and Targeted Advertising

We disclose all of the categories of personal data we collect to the categories of recipients set forth in the Information Disclosure section of our Privacy Policy. Our disclosure of personal data to the following categories of third parties qualifies as the sale of personal data or the sharing or processing of personal data for the purpose of displaying advertisements that are selected based on personal data obtained or inferred over time from an individual’s activities across businesses or distinctly-branded websites, applications, or other services (otherwise known as “targeted advertising” or “cross-context behavioral advertising”) under certain privacy laws:

• Ad Networks and Advertising Partners.

Depending on your state of residency and subject to certain legal limitations and exceptions, you may be able to limit or opt-out of the sale of personal data or the processing of personal data for purposes of targeted advertising (as described in the Your Additional U.S. Privacy Choices section below).

Please note we do not sell the personal data of individuals we know to be less than 16 years of age or share such information for targeted advertising purposes.

Sensitive Personal Data

The following personal data elements we collect may be classified as “sensitive” under certain privacy laws:

• Race, ethnicity, or national origin
• Genetic data
• Biometric or biological data
• Health data, including information regarding an individual’s medical history, mental or physical health condition, or medical treatment or diagnosis.
• Government ID numbers, including social security number, driver's license number, state identification card number, or passport number.
• Account log-in, financial account, debit card or credit card number in combination with any required security or access code, password or credentials allowing access to an account.

We use sensitive personal data for the purposes set forth in the Personal Data Collection and Information Use sections of our Privacy Notice. Depending on your state of residency and subject to certain legal limitations and exceptions, you may be able to limit, or withdraw your consent for, our processing of sensitive personal data (as described in the Your Additional U.S. Privacy Choices section below).

Deidentified Information

We may at times receive, or process personal data to create, deidentified information that can no longer reasonably be used to infer information about, or otherwise be linked to, a particular individual or household. Where we maintain deidentified information, we will maintain and use the information in deidentified form and not attempt to reidentify the information except as required or permitted by law.

Automated Decision-Making and Profiling

We do not conduct automated processing of personal data for the purposes of evaluating, analyzing, or predicting an individual’s personal aspects in furtherance of decisions that produce legal or similarly significant effects. As a result, we do not provide a right to exercise control over such forms of automated decision-making and profiling.

Your Additional U.S. Privacy Choices

Depending on your state of residency and subject to certain legal limitations and exceptions, you may be able to exercise some or all of the following rights:

• Right to Know: The right to confirm whether we are processing personal data about you and, for residents of California, Minnesota and Oregon only, to obtain certain personalized details about the personal data we have collected about you, including:
  • The categories of personal data collected;
  • The categories of sources of the personal data;
  • The purposes for which the personal data were collected;
  • The categories of personal data disclosed to third parties (if any), and the categories of recipients to whom this personal data were disclosed;
  • The categories of personal data shared for targeted advertising purposes (if any), and the categories of recipients to whom the personal data were disclosed for these purposes;
  • The categories of personal data sold (if any) and the categories of third parties to whom the personal data were sold; and
  • For Minnesota and Oregon residents only, a list of specific third parties to whom personal data have been disclosed.
• Right to Access & Portability: The right to obtain access to the personal data we have collected about you and, where required by law, the right to obtain a copy of the personal data in a portable and, to the extent technically feasible, readily usable format that allows you to transmit the data to another entity without hindrance.
• Right to Correction: The right to correct inaccuracies in your personal data, taking into account the nature of the personal data and the purposes of the processing of the personal data.
• Right to Control Over Sensitive Personal Data: The right to exercise control over our collection and processing of certain sensitive personal data.
• Right to Opt-Out of Targeted Advertising: The right to direct us not to use or share personal data for certain targeted advertising purposes.
• Right to Opt-Out of Sales: The right to direct us not to sell personal data to third parties, including the right to opt-out of the disclosure of personal data to third parties for the third parties’ direct marketing purposes under California’s “Shine the Light” Law, for which see below.
• Right to Deletion: The right to have us delete personal data we maintain about you.

Depending on your state of residency, you may also have the right to not receive retaliatory or discriminatory treatment in connection with a request to exercise the above rights. However, the exercise of the rights described above may result in a different price, rate or quality level of product or service where that difference is reasonably related to the impact the right has on our relationship or is otherwise permitted by law.

Submitting Privacy Rights Requests

Please submit a request specifying the right you wish to exercise by:

• emailing [email protected]; or
• Calling our toll-free U.S. telephone number: (888) 220-6436.

We will respond to your request within 45 days.

To exercise your right to opt-out as it relates to the use of cookies and related technologies that involve the sale of personal data or the use of personal data for targeted advertising purposes, please click the “Cookie Preferences” link in the footer of the Sites and adjust your preferences accordingly. If you are visiting our Sites with the Global Privacy Control enabled, any cookies that constitute sales or are used for targeted advertising should already be turned off automatically in our cookie preference manager. Please note this opt-out tool is website, device, and browser specific, so you will need to change your preferences on each device and browser you use to interact with the specific website you are visiting. In addition, you may follow the other steps set forth in the Automated Data Collection Preferences and Targeted Advertising Preferences sections of our Privacy Policy to further exercise control over automatic data collection technologies.

Before processing your request to exercise certain rights (including the Right to Know, Access & Portability, Correction, and Deletion), we will need to verify your identity and confirm you are a resident of a state that offers the requested right(s). In order to verify your identity, we will generally either require the successful authentication of your account, or the matching of sufficient information you provide us to the information we maintain about you in our systems. As a result, we require requests submitted through email and the toll-free number to include first and last name, email address, phone number, state of residency and/or the date of your last transaction with us.

In certain circumstances, we may decline or limit your request, particularly where we are unable to verify your identity or locate your information in our systems, or where you are not a resident of one of the eligible states.

Submitting Authorized Agent Requests

In certain circumstances, you are permitted to use an authorized agent to submit requests on your behalf through the designated methods set forth above where we can verify the authorized agent’s authority to act on your behalf. In order to verify the authorized agent’s authority, we generally require evidence of either (i) a valid power of attorney or (ii) a signed letter containing your name and contact information, the name and contact information of the authorized agent, and a statement of authorization for the request. Depending on the evidence provided and your state of residency, we may still need to separately reach out to you to confirm the authorized agent has permission to act on your behalf and to verify your identity in connection with the request.

Appealing Privacy Rights Decisions

Depending on your state of residency, you may be able to appeal a decision we have made in connection with your privacy rights request. All appeal requests should be submitted by replying to the communication resolving your original request. If the appeal is unsuccessful, you may raise a concern or lodge a complaint with the applicable State Attorney General.

Additional California-Specific Disclosures

The following disclosures only apply to residents of the State of California.

California Categories of Personal Data

California law requires we provide disclosures to you about what personal data we collect by reference to the enumerated categories of personal data set forth within California law. To address this obligation, we have identified the relevant enumerated California personal data category for the personal data described in the Privacy Policy below:

• Identifiers, such as real name, postal address, unique personal identifier, online identifier, Internet Protocol address, email address, account name.
• Customer records, such as name, physical characteristics, address, phone number, credit or debit card number and other financial information, medical information.
• Protected classification characteristics, such as race or ethnicity.
• Commercial information, such as products and services purchased, obtained or considered, and other purchasing or consuming histories or tendencies.
• Internet / network information, such as browsing history, search history, and information regarding a consumer’s interaction with an internet website application, or advertisement.
• Sensitive personal data, such as health and genetic data.

California’s “Shine the Light” Law

California's "Shine the Light" law (Civil Code Section §1798.83) provides certain rights to California residents that have an established business relationship with us with regard to the disclosure of certain types of personal information to third parties for their direct marketing purposes. It is company policy that we do not disclose personal information to third parties for their direct marketing purposes if a consumer has exercised their right to opt out. To opt out of having your personal information disclosed to third parties for their direct marketing purposes, please follow the instructions for opting out of targeted advertising and personal data sales (above).

Washington and Nevada Consumer Health Data Privacy Policy

Last updated: September 1, 2026

This Consumer Health Data Privacy Policy (the “Consumer Health Policy”) supplements the Elysium Health Privacy Policy and explains how we collect, use, disclose, and otherwise processes Consumer Health Data (as defined below) of residents of the state of Washington or Nevada, or individuals whose Consumer Health Data is collected in those states through our Services.

This Consumer Health Policy does not address privacy practices relating to Elysium Health job applicants, employees, and other personnel. Please note that this Consumer Health Policy is not a contract and does not create any legal rights or obligations not otherwise provided by law.

Our Collection and Use of Consumer Health Data

The term “Consumer Health Data” as used in this Consumer Health Privacy Policy means any personal data that is linked or reasonably linkable to you and that identifies your past, present, or future physical or mental health status as defined in the Washington My Health My Data Act or the Nevada Consumer Health Data Privacy Law (the “Consumer Health Privacy Laws”). The Consumer Health Data we collect depends on the context of your interactions with us and includes information you provide to us, information we derive from tests we undertake with your consent, and information we collect automatically from your interactions with the Services. Consumer Health Data does not include information that is considered deidentified under the Consumer Health Privacy Laws.

Examples of Consumer Health Data that we may collect include:

• Information you share about your health-related conditions, symptoms, experiences, diagnoses, testing, or treatments.
• Biological and genetic samples we collect in order to carry out tests you request.
• Test results based on Laboratory testing of your biological and genetic samples.
• Other information that may be used to infer or derive data related to the above or other health-related information.

We may process and/or use your Consumer Health Data (including with your consent where required by the Consumer Health Privacy Laws) for the following purposes:

• To manage and provide the Services.
• To manage, provide, maintain, and improve our business.
• To respond to your questions, concerns, and other requests for assistance.
• To customize your browsing experience on the Services.
• For market research and providing insights into longevity preferences.
• To build and enhance consumer profiles.
• To provide targeted offers that may be of interest to you.
• To create anonymous, aggregated, or de-identified data.

We may also combine your Consumer Health Data with other personal data we collect directly from you or receive from other sources.

Sources of Consumer Health Data

The Consumer Health Data we collect depends on the context of your interactions with our Services and includes information you provide to us and information we collect automatically from your interactions with the Services.

We and our service partners may collect this type of information over time and across third-party websites and mobile applications. For more information, please see the Personal Data Collection section of our Privacy Policy.

Our Disclosure of Consumer Health Data

We may share the categories of Consumer Health Data set forth above as follows:

• To Service Providers: We engage other third parties to perform certain services on our behalf in connection with the uses of Consumer Health Data described in the sections above. Depending on the applicable services, these service providers may process Consumer Health Data on our behalf in order to assist us in providing the Services.
• In relation to Business Transactions: We may take part in or be involved with a business transaction, such as a merger. We may disclose Consumer Health Data to a third-party during the negotiation of or in connection with such a transaction.
• In relation to Legal Obligations and Rights: We may disclose Consumer Health Data to third parties in connection with the establishment, exercise, or defense of legal claims; to comply with laws or to respond to lawful requests and legal processes; to protect our rights and property and the rights and property of others, including to enforce our agreements and policies; to detect, suppress, or prevent fraud; to protect the health and safety of us and others; or as otherwise required by applicable law.
• With Your Consent: We may disclose Consumer Health Data about you to other service providers or publicly with your consent or at your direction. For example, with an individual’s consent or at their direction we may post their testimonial on our Services. With your consent, we may also share your Consumer Health Data with other business partners to facilitate your access to treatments or services recommended by your healthcare provider.

Your Privacy Rights

The law may provide the following rights with respect to Consumer Health Data we collect about you:

• Right to Access / Confirm: You may have the right to confirm whether we are collecting, sharing, or selling Consumer Health Data about you and with whom we may be disclosing such Consumer Health Data, and to access such data.
• Right to Withdraw Consent: If you have provided your consent for our processing or sharing of your Consumer Health Data, you may have the right to withdraw your consent.
• Right to Delete: You may have the right to request that we delete your Consumer Health Data and that all third parties to whom we have disclosed your Consumer Health Data delete such data.
• Right to Cease Collecting or Sharing: You may have the right to request that we cease collecting or sharing your Consumer Health Data.

How to Exercise Your Privacy Rights

To exercise any of the privacy rights set forth above or to review or request changes to data, please submit a request by calling (888) 220-6436, by email at [email protected], or by direct mail at Elysium Health at 434 Broadway, 2nd Floor, New York, NY 10013.

Before processing your request, we will need to authenticate your identity. To authenticate your identity, we will generally require matching a minimum amount of information you provide us with the information we maintain about you in our systems. This process may require us to request additional information from you, including, but not limited to, your email address and phone number.

In certain circumstances, we may decline a request to exercise the rights described above, particularly where we are unable to authenticate your identity or locate your information in our systems. If we are unable to comply with all or a portion of your request, we will explain the reasons for our decision.

Appealing Privacy Rights Decisions

If your request to exercise a right is denied, you may appeal that decision by contacting us at [email protected]. If the appeal is unsuccessful, you may raise a concern or lodge a complaint with the applicable State Attorney General.

Changes to this Consumer Health Data Privacy Policy

We may update this Consumer Health Policy from time to time. When we make changes to this Consumer Health Policy, we will notify you by changing the date at the beginning of this Consumer Health Policy. If we make material changes to this Consumer Health Policy, we will notify individuals by email to their registered email address, by prominent posting on this website or our other platforms, or through other appropriate communication channels. All changes shall be effective from the date of publication unless otherwise specified.