Health data gets its own policy, because it should.

Washington's My Health My Data Act, Nevada's SB370 and comparable state laws treat health data as its own category and require a company handling it to publish a policy dedicated to it, separately from its general privacy policy. This is that document.

It applies to everyone, not only to residents of those states. We would rather run one standard than sort customers by postcode. Our general Privacy Policy covers everything else and still applies; where the two describe the same thing they say the same thing, and if they ever do not, this one governs consumer health data.

In this policy, "we" means Cellubrite Inc. and "consumer health data" means personal information linked to you that identifies your past, present or future physical or mental health status. For a company that sells biomarker panels, that is most of what we hold.

We collect nothing in these categories that is not needed to provide the product you asked for, or that you have not separately consented to. We do not infer health conditions about you from anything, we do not derive new health data from what you gave us, and we do not collect precise location data at all.

• From you: what you tell us at checkout, when you create an account, and when you register a kit.
• From the partner clinical laboratory: the result of the test it ran on your sample.
• From our commerce provider: which panel was bought, so we know what to fulfil.

That is the complete list. We do not buy health data, we do not receive it from data brokers, advertising networks or public sources, and we do not obtain it from anyone other than you and the laboratory that tested your sample.

We share consumer health data only where it is necessary to provide the service you bought, or where you asked us to. The categories we share are:

• Health-relevant demographics and identifiers, with the laboratory, so it can accession your sample and report a result for the right person.
• The biological sample itself, with the laboratory and the carrier that transports it.
• Health-care purchase data, with our commerce and shipping providers, only to the extent needed to fulfil and deliver the order.
• Biomarker and genetic results, with a person you have specifically asked us to send them to.
• Anything you choose to type into live chat, with our chat provider. Live chat stays off until you turn it on, and you can turn it back off at any time under Cookie preferences at the bottom of any page.

We do not share biomarker results or genetic data with any advertising, analytics or marketing recipient, in any form, including in a hashed, pseudonymised or aggregated form.

You have the right to:

• Confirm whether we are collecting, sharing or selling your consumer health data.
• Get a list of all third parties and affiliates with whom we have shared or to whom we have sold it, and a way to contact each of them.
• Withdraw your consent to our collection and to our sharing of it.
• Have it deleted.
• Appeal if we refuse any of the above.

How to make a request

Write to privacy@cellubritehealth.com from the email address on your account, saying which right you are using. We will verify it is you, normally by confirming control of that mailbox, and for a request touching results or genetic data we may ask for one further detail we already hold, because the cost of getting identity wrong here is disclosing one person's health record to another.

What we do, and how fast

1. (1)We respond within 45 days. If we genuinely need longer we tell you why inside those 45 days and take no more than a further 45.
2. (2)On a deletion request we delete your consumer health data from our live systems, and from our archives and backups, and we require every service provider and third party that received it from us to do the same.
3. (3)On a withdrawal of consent we stop collecting and stop sharing straight away. Withdrawing consent is not retroactive: it cannot undo a disclosure already made, and it does not reach the laboratory's own record.
4. (4)If we refuse, we tell you why and how to appeal. An appeal is decided within 45 days, and if we still refuse we give you a way to complain to your state Attorney General.

We do not charge for any of this, and we will not deny you a product, charge you a different price, or give you a worse service because you used one of these rights.

We collect and share consumer health data on two bases only. The first is that it is necessary to provide the product you asked us for: you cannot be sent a kit, have a sample tested, or be shown a result without it. The second is your consent, which we ask for separately and specifically where anything goes beyond that.

Genomic panels always require separate, express consent before your sample is processed, described in the consent and limitations notice. You can withdraw it at any time, and you can ask that your sample be destroyed.

We do not bundle consent. We will not ask you to agree to something unrelated as a condition of buying a panel, and a refusal never affects your price or your service.

We do not operate a geofence around any health-care facility, and we do not use location to identify, track, collect data from, or send notifications or advertisements to anyone based on their proximity to one. We do not collect precise geolocation at all. This is prohibited by Washington law and we would not do it anyway.

Access to consumer health data inside Cellubrite is restricted to the people who need it to run the service and to support you, it is granted on that basis and removed when it is no longer needed, and it is logged. Everyone with access is bound by a written confidentiality obligation. Our service providers are under contracts requiring them to hold it to the same standard and to use it only on our instructions.

We will not collect, use or share consumer health data in a way that is not disclosed here. If we ever need to, we will publish the change and ask for your consent before it applies to data we already hold about you, rather than treating a new posting as agreement. This version is effective 29 July 2026.

Requests and questions about consumer health data go to privacy@cellubritehealth.com.

If we get this wrong you can complain to the Attorney General of your state. Washington residents also have a private right of action under the Washington Consumer Protection Act. We would rather you told us first, and we would rather fix it than be told about it by a regulator.