GENETIC DATA PRIVACY NOTICE

Genetic Data Privacy Notice Version 1.2 | Effective August 18, 2026 This Notice explains how Woolf Software, Inc. ("we," "us," or "Consultant") handles genetic, genomic, medical, and related personal information submitted for computational genomics services. It applies before, during, and after the service. 1. Plain-Language Summary We use your data only to perform the analysis you request, protect and operate the service, maintain required records, and comply with law. We do not sell genetic data. We do not use it for advertising, unrelated research, model training, or product development. We delete active analysis files after the retention period below or following a verified deletion request, subject to limited legal and backup exceptions. 2. Information We Collect Genetic data — VCF, gVCF, BAM, CRAM, FASTQ, genotypes, variants, annotations, quality metrics, inferred information, and related metadata. Related information — Medical or family information you choose to provide, laboratory reports, symptoms or phenotypes included in the project request, and correspondence. Account information — Name, email, contact information, payment status, project details, and consent records. Technical records — Upload and access logs, IP address, device/browser information, security events, file identifiers, and agreement/notice versions. 3. Why We Use It - To receive, store, organize, and analyze the files for the specific service you request. - To generate and securely deliver your report or other agreed output. - To authenticate users, maintain security, investigate incidents, and prevent unauthorized access. - To process deletion, access, consent-revocation, and support requests. - To maintain transaction, consent, and legal records and comply with lawful process. 4. Who Can Access It Access is limited to Bradley Woolf and contractors who need access to perform the requested service and are bound by confidentiality and data-use restrictions. Genetic data may be processed using Amazon Web Services in the United States for encrypted transfer, storage, computing, logging, and backups. We do not send raw or identifiable genetic or medical data to generative-AI services or external annotation services unless the service is identified to you before processing, contractually restricted to the requested purpose, and covered by your express consent where required. Public scientific databases may be downloaded and queried inside our controlled environment without sending your complete file to the database operator. We may disclose the minimum necessary information to professional advisers under confidentiality obligations or when legally required. Unless prohibited, we will attempt to notify you before compelled disclosure. We do not disclose genetic data to insurers or employers for their decision-making purposes. 5. No Sale, Advertising, Research, or Model Training We do not sell, rent, license, publish, advertise with, or independently commercialize your genetic data. We do not use it to train, fine-tune, evaluate, benchmark, or improve machine-learning models, embeddings, indexes, or products. We do not conduct secondary research with it. Any future secondary use or disclosure to a third party other than a service provider requires a new, separate, specific express consent. 6. Retention and Deletion Submitted genetic and medical files and identifiable working files are retained only while needed for the requested service and for no longer than 90 days after final delivery, unless you request earlier deletion or law requires temporary retention. Ordinary encrypted backups may persist for up to 30 additional days and remain isolated from ordinary use. Signed agreements, consent records, invoices, and security logs may be retained for up to seven years to document the transaction, protect legal rights, and comply with law. A verified revocation or deletion request will be honored as soon as reasonably practicable and no later than 30 days. We will stop optional future processing. We may retain only information legally required or reasonably necessary to document the request, prevent fraud, resolve a dispute, or comply with a valid legal hold. 7. Security We use reasonable administrative, technical, and physical safeguards designed for sensitive genetic data, including encrypted transfer and storage, access restrictions, multifactor authentication, logging, separation of client projects, and deletion procedures. No system can guarantee absolute security. If a legally reportable breach occurs, we will provide required notices within applicable deadlines. 8. Your Rights - Access: request a copy of genetic data we maintain about you. - Deletion: request deletion of your account, submitted files, and genetic data, subject to limited legal exceptions. - Revocation: withdraw consent for future processing through the same primary communication channel used for the service. - Correction: request correction of inaccurate account or contact information. - No discrimination: exercising a privacy right will not cause denial of service, a penalty, or a different service level, except where the requested service cannot be performed after consent is withdrawn or necessary data is deleted. Submit a request through the privacy contact displayed on the upload page or by replying to your project email with “Genetic Data Privacy Request” in the subject line. We may verify identity before acting. 9. Complaints You may submit a complaint through the privacy contact displayed on the upload page. California residents may also contact the California Attorney General, a district attorney, or another prosecutor authorized under California Civil Code section 56.182. California Attorney General consumer complaints: https://oag.ca.gov/contact/consumer-complaint-against-business-or-company. 10. Children and Other People’s Data The service is for adults. Do not submit a minor’s data. Do not submit another adult’s genetic or medical data unless that person separately reviews this Notice and gives express consent through their own verified acceptance event. Possession of a relative’s file does not establish authority to submit it. 11. Changes to This Notice We may update this Notice prospectively. We will not materially expand how previously submitted genetic data is used or disclosed without notice and renewed express consent when required. The version accepted with each project is preserved in the consent record. Website Consent REQUIRED CHECKBOX 2 I expressly consent to Woolf Software, Inc. collecting, using, storing, and disclosing my genetic and related information solely to perform the computational genomics service I requested, including processing by the service providers described in this Genetic Data Privacy Notice. I understand my access, revocation, deletion, and complaint rights. This consent covers only the primary requested service and its necessary service providers. It does not authorize biological-sample storage, advertising based on genetic data, secondary research, model training, or disclosure to unrelated third parties.